From 161ce0e98260e8cf487e6b60e1a64ea2b38f432e Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 4 May 2026 09:18:04 +0200
Subject: [PATCH 001/136] refactor(frontend): clean up and restructure app

---
 dev/setup.sh                                  | 102 +++++++++++++---
 package-lock.json                             |  30 ++++-
 package.json                                  |   1 +
 src/lib/components/layout/Header.svelte       | 112 ------------------
 .../components/layout/LanguageSwitcher.svelte |  31 +----
 src/lib/components/layout/ThemeToggle.svelte  |  30 +----
 .../components/layout/header/Header.svelte    |  49 ++++++++
 .../components/layout/header/UserMenu.svelte  |  52 ++++++++
 .../layout/{ => sidebar}/Sidebar.svelte       |  94 ++-------------
 .../components/layout/sidebar/nav-items.ts    |  33 ++++++
 src/routes/(app)/+layout.svelte               |   6 +-
 11 files changed, 263 insertions(+), 277 deletions(-)
 delete mode 100644 src/lib/components/layout/Header.svelte
 create mode 100644 src/lib/components/layout/header/Header.svelte
 create mode 100644 src/lib/components/layout/header/UserMenu.svelte
 rename src/lib/components/layout/{ => sidebar}/Sidebar.svelte (66%)
 create mode 100644 src/lib/components/layout/sidebar/nav-items.ts

diff --git a/dev/setup.sh b/dev/setup.sh
index bd60601b..d779b3b4 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -3,11 +3,22 @@
 # Assumes: kind cluster is running, kubectl context points to it.
 set -euo pipefail
 
+SKIP_TRINO=false
+for arg in "$@"; do
+  case "$arg" in
+    --skip-trino) SKIP_TRINO=true ;;
+    *) echo "Unknown argument: $arg"; echo "Usage: $0 [--skip-trino]"; exit 1 ;;
+  esac
+done
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 ENV_FILE="$PROJECT_DIR/.env.development"
 
 echo "=== Stackable UI dev environment setup ==="
+if [[ "$SKIP_TRINO" == true ]]; then
+  echo "(Trino deployment skipped via --skip-trino)"
+fi
 echo ""
 
 # ------------------------------------------------------------------
@@ -24,8 +35,13 @@ fi
 # 2. Install Stackable operators
 # ------------------------------------------------------------------
 echo ""
-echo "Installing Stackable operators (commons, listener, secret, trino)..."
-stackablectl operator install commons listener secret trino
+if [[ "$SKIP_TRINO" == true ]]; then
+  echo "Installing Stackable operators (commons, listener, secret)..."
+  stackablectl operator install commons listener secret
+else
+  echo "Installing Stackable operators (commons, listener, secret, trino)..."
+  stackablectl operator install commons listener secret trino
+fi
 
 # ------------------------------------------------------------------
 # 3. Deploy Keycloak
@@ -52,12 +68,32 @@ echo "Node IP: $NODE_IP"
 # ------------------------------------------------------------------
 # 5. Deploy Trino (after node IP is known, trino.yaml is a template)
 # ------------------------------------------------------------------
-echo ""
-echo "Deploying Trino..."
-sed "s/\${NODE_IP}/$NODE_IP/g" "$SCRIPT_DIR/trino.yaml" | kubectl apply -f -
+if [[ "$SKIP_TRINO" == false ]]; then
+  echo ""
+  echo "Deploying Trino..."
+  sed "s/\${NODE_IP}/$NODE_IP/g" "$SCRIPT_DIR/trino.yaml" | kubectl apply -f -
+fi
+
+# On some local Kubernetes distributions (e.g. Rancher Desktop k3s), the node's
+# InternalIP is not reachable from the host network, but NodePorts are exposed
+# on localhost. Probe both and use the first reachable URL.
+KEYCLOAK_BASE_URL=""
+for base in "http://${NODE_IP}:30080" "http://127.0.0.1:30080" "http://localhost:30080"; do
+  if curl -sf --max-time 2 "${base}/realms/master" >/dev/null 2>&1; then
+    KEYCLOAK_BASE_URL="$base"
+    break
+  fi
+done
+
+if [ -z "$KEYCLOAK_BASE_URL" ]; then
+  echo "ERROR: Could not reach Keycloak via NodePort 30080."
+  echo "Tried: http://${NODE_IP}:30080, http://127.0.0.1:30080, http://localhost:30080"
+  exit 1
+fi
+echo "Keycloak URL: ${KEYCLOAK_BASE_URL}"
 
 echo "Waiting for Keycloak to accept connections"
-until curl -sf "http://${NODE_IP}:30080/realms/master" >/dev/null 2>&1; do
+until curl -sf "${KEYCLOAK_BASE_URL}/realms/master" >/dev/null 2>&1; do
   sleep 2
 done
 
@@ -147,31 +183,56 @@ if [ -f "$ENV_FILE" ]; then
   cp "$ENV_FILE" "$ENV_FILE.bak"
 fi
 
-TRINO_PORT=$(kubectl get svc trino-coordinator -o jsonpath='{.spec.ports[0].nodePort}')
+if [[ "$SKIP_TRINO" == false ]]; then
+  TRINO_PORT=$(kubectl get svc trino-coordinator -o jsonpath='{.spec.ports[0].nodePort}')
+
+  # Probe Trino reachability the same way we did for Keycloak.
+  TRINO_BASE_URL=""
+  for base in "https://${NODE_IP}:${TRINO_PORT}" "https://127.0.0.1:${TRINO_PORT}" "https://localhost:${TRINO_PORT}"; do
+    if curl -sfk --max-time 2 "${base}/v1/info" >/dev/null 2>&1; then
+      TRINO_BASE_URL="$base"
+      break
+    fi
+  done
+  # Fall back to NODE_IP if none respond yet (Trino may still be starting).
+  TRINO_BASE_URL="${TRINO_BASE_URL:-https://${NODE_IP}:${TRINO_PORT}}"
+fi
 
-cat > "$ENV_FILE" <<EOF
-STACKABLE_UI_OIDC_DISCOVERY_URL=http://${NODE_IP}:30080/realms/stackable/.well-known/openid-configuration
+if [[ "$SKIP_TRINO" == false ]]; then
+  cat > "$ENV_FILE" <<EOF
+STACKABLE_UI_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
 STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
 STACKABLE_UI_OIDC_CLIENT_SECRET=${SECRET}
 STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
 STACKABLE_UI_BASE_URL=http://localhost:5173
-STACKABLE_UI_TRINO_URL=https://${NODE_IP}:${TRINO_PORT}
+STACKABLE_UI_TRINO_URL=${TRINO_BASE_URL}
 STACKABLE_UI_TRINO_AUTH_TYPE=basic
 STACKABLE_UI_TRINO_AUTH_USERNAME=stackable-ui
 STACKABLE_UI_TRINO_AUTH_PASSWORD=stackable-ui-dev
 STACKABLE_UI_TRINO_TLS_INSECURE=true
 EOF
+else
+  cat > "$ENV_FILE" <<EOF
+STACKABLE_UI_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
+STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
+STACKABLE_UI_OIDC_CLIENT_SECRET=${SECRET}
+STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
+STACKABLE_UI_BASE_URL=http://localhost:5173
+EOF
+fi
 
 echo "Wrote $ENV_FILE"
 
 # ------------------------------------------------------------------
 # 8. Wait for Trino to be ready
 # ------------------------------------------------------------------
-echo ""
-echo "Waiting for Trino to be ready..."
-kubectl rollout status statefulset/trino-coordinator-default --timeout=300s
+if [[ "$SKIP_TRINO" == false ]]; then
+  echo ""
+  echo "Waiting for Trino to be ready..."
+  kubectl rollout status statefulset/trino-coordinator-default --timeout=300s
 
-echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
+  echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
+fi
 
 # ------------------------------------------------------------------
 # Done
@@ -184,10 +245,15 @@ echo ""
 echo "Keycloak:       http://${NODE_IP}:30080"
 echo "  Admin:        admin / admin"
 echo ""
-echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
-echo ""
-echo "Trino connection is pre-configured via STACKABLE_UI_TRINO_* env vars."
-echo ""
+if [[ "$SKIP_TRINO" == false ]]; then
+  echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
+  echo ""
+  echo "Trino connection is pre-configured via STACKABLE_UI_TRINO_* env vars."
+  echo ""
+else
+  echo "Trino was skipped. Add STACKABLE_UI_TRINO_* vars to $ENV_FILE manually when ready."
+  echo ""
+fi
 echo "Test users (OIDC):"
 echo "  alice / alicealice"
 echo "  bob   / bobbob"
diff --git a/package-lock.json b/package-lock.json
index 10e4fea3..0fd8ac44 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21,6 +21,7 @@
         "@cyclonedx/cyclonedx-npm": "^4.2.1",
         "@eslint/compat": "^2.0.2",
         "@eslint/js": "^9.39.2",
+        "@iconify/svelte": "^5.2.1",
         "@inlang/paraglide-js": "^2.12.0",
         "@playwright/test": "^1.58.2",
         "@sveltejs/adapter-node": "^5.5.3",
@@ -1018,6 +1019,29 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
+    "node_modules/@iconify/svelte": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/@iconify/svelte/-/svelte-5.2.1.tgz",
+      "integrity": "sha512-zHmsIPmnIhGd5gc95bNN5FL+GifwMZv7M2rlZEpa7IXYGFJm/XGHdWf6PWQa6OBoC+R69WyiPO9NAj5wjfjbow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@iconify/types": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/cyberalien"
+      },
+      "peerDependencies": {
+        "svelte": ">5.0.0"
+      }
+    },
+    "node_modules/@iconify/types": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
+      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@inlang/paraglide-js": {
       "version": "2.12.0",
       "resolved": "https://registry.npmjs.org/@inlang/paraglide-js/-/paraglide-js-2.12.0.tgz",
@@ -3167,9 +3191,9 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.15.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
-      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
+      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "devOptional": true,
       "license": "MIT",
       "bin": {
diff --git a/package.json b/package.json
index 1ebaf820..b29560f9 100644
--- a/package.json
+++ b/package.json
@@ -22,6 +22,7 @@
     "@cyclonedx/cyclonedx-npm": "^4.2.1",
     "@eslint/compat": "^2.0.2",
     "@eslint/js": "^9.39.2",
+    "@iconify/svelte": "^5.2.1",
     "@inlang/paraglide-js": "^2.12.0",
     "@playwright/test": "^1.58.2",
     "@sveltejs/adapter-node": "^5.5.3",
diff --git a/src/lib/components/layout/Header.svelte b/src/lib/components/layout/Header.svelte
deleted file mode 100644
index dbd087ef..00000000
--- a/src/lib/components/layout/Header.svelte
+++ /dev/null
@@ -1,112 +0,0 @@
-<script lang="ts">
-  import * as m from '$lib/paraglide/messages.js';
-  import LanguageSwitcher from './LanguageSwitcher.svelte';
-  import ThemeToggle from './ThemeToggle.svelte';
-  import { authClient } from '$lib/auth-client';
-
-  type User = typeof authClient.$Infer.Session.user;
-
-  let {
-    title = m.page_title_dashboard(),
-    mobileOpen = false,
-    user = null,
-    onToggleMobile
-  }: {
-    title?: string;
-    mobileOpen?: boolean;
-    user?: User | null;
-    onToggleMobile?: () => void;
-  } = $props();
-
-  const initials = $derived(
-    user?.name
-      ? user.name
-          .split(' ')
-          .map((n) => n[0])
-          .join('')
-          .toUpperCase()
-          .slice(0, 2)
-      : '?'
-  );
-</script>
-
-<header
-  class="border-base-300 bg-base-100 flex h-16 shrink-0 items-center gap-4 border-b px-4 lg:px-6"
->
-  <!-- Mobile menu button -->
-  <button
-    class="btn btn-ghost btn-sm btn-square lg:hidden"
-    onclick={onToggleMobile}
-    aria-label={mobileOpen ? m.header_close_nav() : m.header_open_nav()}
-    aria-expanded={mobileOpen}
-    aria-controls="sidebar"
-  >
-    <svg
-      class="h-5 w-5"
-      aria-hidden="true"
-      viewBox="0 0 24 24"
-      fill="none"
-      stroke="currentColor"
-      stroke-width="1.5"
-      stroke-linecap="round"
-      stroke-linejoin="round"
-    >
-      <path d="M3 6h18M3 12h18M3 18h18" />
-    </svg>
-  </button>
-
-  <h1 class="text-base-content text-lg font-semibold">{title}</h1>
-
-  <div class="flex-1"></div>
-
-  <div class="flex items-center gap-1">
-    <LanguageSwitcher />
-    <ThemeToggle />
-    {#if user}
-      <div class="dropdown dropdown-end">
-        <button tabindex="0" class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
-          {#if user.image}
-            <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
-          {:else}
-            <span
-              class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
-              aria-hidden="true"
-            >
-              {initials}
-            </span>
-          {/if}
-        </button>
-        <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
-        <ul
-          tabindex="0"
-          class="dropdown-content menu bg-base-100 border-base-300 z-10 w-56 rounded-lg border p-1 shadow-lg"
-        >
-          <li class="px-3 py-2">
-            <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
-            <p class="text-base-content/60 truncate text-xs">{user.email}</p>
-          </li>
-          <li><hr class="border-base-300 my-1" /></li>
-          <li>
-            <a href="/auth/logout" class="text-sm">
-              <svg
-                class="h-4 w-4"
-                aria-hidden="true"
-                viewBox="0 0 24 24"
-                fill="none"
-                stroke="currentColor"
-                stroke-width="1.5"
-                stroke-linecap="round"
-                stroke-linejoin="round"
-              >
-                <path d="M9 21H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h4" />
-                <polyline points="16 17 21 12 16 7" />
-                <line x1="21" y1="12" x2="9" y2="12" />
-              </svg>
-              {m.header_sign_out()}
-            </a>
-          </li>
-        </ul>
-      </div>
-    {/if}
-  </div>
-</header>
diff --git a/src/lib/components/layout/LanguageSwitcher.svelte b/src/lib/components/layout/LanguageSwitcher.svelte
index 2852ab2a..0d3e99d7 100644
--- a/src/lib/components/layout/LanguageSwitcher.svelte
+++ b/src/lib/components/layout/LanguageSwitcher.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import { getLocale, setLocale, locales } from '$lib/paraglide/runtime.js';
+  import Icon from '@iconify/svelte';
 
   type LocaleMeta = {
     code: (typeof locales)[number];
@@ -32,22 +33,7 @@
     ? `${m.language_label()}: ${currentLocaleMeta.label()}`
     : m.language_label()}
 >
-  <svg
-    class="h-5 w-5"
-    aria-hidden="true"
-    viewBox="0 0 24 24"
-    fill="none"
-    stroke="currentColor"
-    stroke-width="1.5"
-    stroke-linecap="round"
-    stroke-linejoin="round"
-  >
-    <circle cx="12" cy="12" r="10" />
-    <path d="M2 12h20" />
-    <path
-      d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"
-    />
-  </svg>
+  <Icon icon="material-symbols:language" class="h-5 w-5" aria-hidden="true" />
   {#if showLabel}
     <span class="text-sm font-medium">{currentLocaleMeta.label()}</span>
   {/if}
@@ -68,18 +54,7 @@
       >
         <span>{locale.label()}</span>
         {#if isActive}
-          <svg
-            class="h-4 w-4"
-            aria-hidden="true"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            stroke-width="2"
-            stroke-linecap="round"
-            stroke-linejoin="round"
-          >
-            <path d="M20 6 9 17l-5-5" />
-          </svg>
+          <Icon icon="material-symbols:check" class="h-4 w-4" aria-hidden="true" />
         {/if}
       </button>
     </li>
diff --git a/src/lib/components/layout/ThemeToggle.svelte b/src/lib/components/layout/ThemeToggle.svelte
index d9ee82d5..ef5af4fd 100644
--- a/src/lib/components/layout/ThemeToggle.svelte
+++ b/src/lib/components/layout/ThemeToggle.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import { browser } from '$app/environment';
   import * as m from '$lib/paraglide/messages.js';
+  import Icon from '@iconify/svelte';
 
   function prefersDark(): boolean {
     if (!browser) return false;
@@ -25,33 +26,8 @@
   aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
 >
   {#if dark}
-    <svg
-      class="h-5 w-5"
-      aria-hidden="true"
-      viewBox="0 0 24 24"
-      fill="none"
-      stroke="currentColor"
-      stroke-width="1.5"
-      stroke-linecap="round"
-      stroke-linejoin="round"
-    >
-      <circle cx="12" cy="12" r="5" />
-      <path
-        d="M12 1v2M12 21v2M4.22 4.22l1.42 1.42M18.36 18.36l1.42 1.42M1 12h2M21 12h2M4.22 19.78l1.42-1.42M18.36 5.64l1.42-1.42"
-      />
-    </svg>
+    <Icon icon="material-symbols:light-mode" class="h-5 w-5" aria-hidden="true" />
   {:else}
-    <svg
-      class="h-5 w-5"
-      aria-hidden="true"
-      viewBox="0 0 24 24"
-      fill="none"
-      stroke="currentColor"
-      stroke-width="1.5"
-      stroke-linecap="round"
-      stroke-linejoin="round"
-    >
-      <path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z" />
-    </svg>
+    <Icon icon="material-symbols:dark-mode" class="h-5 w-5" aria-hidden="true" />
   {/if}
 </button>
diff --git a/src/lib/components/layout/header/Header.svelte b/src/lib/components/layout/header/Header.svelte
new file mode 100644
index 00000000..198f50d1
--- /dev/null
+++ b/src/lib/components/layout/header/Header.svelte
@@ -0,0 +1,49 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import Icon from '@iconify/svelte';
+  import LanguageSwitcher from '../LanguageSwitcher.svelte';
+  import ThemeToggle from '../ThemeToggle.svelte';
+  import UserMenu from './UserMenu.svelte';
+  import { authClient } from '$lib/auth-client';
+
+  type User = typeof authClient.$Infer.Session.user;
+
+  let {
+    title = m.page_title_dashboard(),
+    mobileOpen = false,
+    user = null,
+    onToggleMobile
+  }: {
+    title?: string;
+    mobileOpen?: boolean;
+    user?: User | null;
+    onToggleMobile?: () => void;
+  } = $props();
+</script>
+
+<header
+  class="border-base-300 bg-base-100 flex h-16 shrink-0 items-center gap-4 border-b px-4 lg:px-6"
+>
+  <!-- Mobile menu button -->
+  <button
+    class="btn btn-ghost btn-sm btn-square lg:hidden"
+    onclick={onToggleMobile}
+    aria-label={mobileOpen ? m.header_close_nav() : m.header_open_nav()}
+    aria-expanded={mobileOpen}
+    aria-controls="sidebar"
+  >
+    <Icon icon="material-symbols:menu" class="h-5 w-5" aria-hidden="true" />
+  </button>
+
+  <h1 class="text-base-content text-lg font-semibold">{title}</h1>
+
+  <div class="flex-1"></div>
+
+  <div class="flex items-center gap-1">
+    <LanguageSwitcher />
+    <ThemeToggle />
+    {#if user}
+      <UserMenu {user} />
+    {/if}
+  </div>
+</header>
diff --git a/src/lib/components/layout/header/UserMenu.svelte b/src/lib/components/layout/header/UserMenu.svelte
new file mode 100644
index 00000000..bda04ab0
--- /dev/null
+++ b/src/lib/components/layout/header/UserMenu.svelte
@@ -0,0 +1,52 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import Icon from '@iconify/svelte';
+  import { authClient } from '$lib/auth-client';
+
+  type User = typeof authClient.$Infer.Session.user;
+
+  let { user }: { user: User } = $props();
+
+  const initials = $derived(
+    user.name
+      ? user.name
+          .split(' ')
+          .map((n) => n[0])
+          .join('')
+          .toUpperCase()
+          .slice(0, 2)
+      : '?'
+  );
+</script>
+
+<div class="dropdown dropdown-end">
+  <button tabindex="0" class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
+    {#if user.image}
+      <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
+    {:else}
+      <span
+        class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
+        aria-hidden="true"
+      >
+        {initials}
+      </span>
+    {/if}
+  </button>
+  <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+  <ul
+    tabindex="0"
+    class="dropdown-content menu bg-base-100 border-base-300 z-10 w-56 rounded-lg border p-1 shadow-lg"
+  >
+    <li class="px-3 py-2">
+      <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
+      <p class="text-base-content/60 truncate text-xs">{user.email}</p>
+    </li>
+    <!-- <li><hr class="border-base-300 my-1" /></li> -->
+    <li class="mt-4">
+      <a href="/auth/logout" class="text-sm">
+        <Icon icon="material-symbols:logout" class="h-4 w-4" aria-hidden="true" />
+        {m.header_sign_out()}
+      </a>
+    </li>
+  </ul>
+</div>
diff --git a/src/lib/components/layout/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
similarity index 66%
rename from src/lib/components/layout/Sidebar.svelte
rename to src/lib/components/layout/sidebar/Sidebar.svelte
index b0a9eaff..65c5f350 100644
--- a/src/lib/components/layout/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -1,6 +1,8 @@
 <script lang="ts">
   import { page } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
+  import Icon from '@iconify/svelte';
+  import { type NavItem, getNavSections } from './nav-items.js';
 
   let {
     collapsed = $bindable(false),
@@ -10,35 +12,7 @@
     mobileOpen?: boolean;
   } = $props();
 
-  type NavItem = {
-    label: string;
-    href: string;
-    icon: string;
-    disabled?: boolean;
-    badge?: string;
-  };
-
-  type NavSection = {
-    title: string;
-    items: NavItem[];
-  };
-
-  const sections: NavSection[] = $derived([
-    {
-      title: m.nav_platform(),
-      items: [{ label: m.nav_dashboard(), href: '/', icon: 'dashboard' }]
-    },
-    {
-      title: m.nav_data_tools(),
-      items: [
-        {
-          label: m.nav_trino(),
-          href: '/trino',
-          icon: 'database'
-        }
-      ]
-    }
-  ]);
+  const sections = $derived(getNavSections());
 
   function isActive(href: string): boolean {
     if (href === '/') return page.url.pathname === '/';
@@ -63,38 +37,8 @@
 </script>
 
 {#snippet navIcon(name: string)}
-  {#if name === 'dashboard'}
-    <svg
-      class="h-5 w-5 shrink-0"
-      aria-hidden="true"
-      viewBox="0 0 24 24"
-      fill="none"
-      stroke="currentColor"
-      stroke-width="1.5"
-      stroke-linecap="round"
-      stroke-linejoin="round"
-    >
-      <rect x="3" y="3" width="7" height="7" rx="1" />
-      <rect x="14" y="3" width="7" height="7" rx="1" />
-      <rect x="3" y="14" width="7" height="7" rx="1" />
-      <rect x="14" y="14" width="7" height="7" rx="1" />
-    </svg>
-  {:else if name === 'database'}
-    <svg
-      class="h-5 w-5 shrink-0"
-      aria-hidden="true"
-      viewBox="0 0 24 24"
-      fill="none"
-      stroke="currentColor"
-      stroke-width="1.5"
-      stroke-linecap="round"
-      stroke-linejoin="round"
-    >
-      <ellipse cx="12" cy="5" rx="9" ry="3" />
-      <path d="M3 5v14c0 1.66 4.03 3 9 3s9-1.34 9-3V5" />
-      <path d="M3 12c0 1.66 4.03 3 9 3s9-1.34 9-3" />
-    </svg>
-  {/if}
+  {@const iconName = `material-symbols:${name}`}
+  <Icon icon={iconName} class="h-5 w-5 shrink-0" aria-hidden="true" />
 {/snippet}
 
 <!-- Mobile backdrop -->
@@ -112,7 +56,7 @@
   bind:this={sidebarEl}
   id="sidebar"
   aria-label={m.sidebar_label()}
-  class="border-base-300 bg-base-200 fixed inset-y-0 left-0 z-50 flex flex-col border-r
+  class="border-base-300 bg-base-100 fixed inset-y-0 left-0 z-50 flex flex-col border-r
     transition-[transform,width] duration-200 ease-out
     lg:relative lg:inset-auto lg:z-auto lg:translate-x-0
     {mobileOpen ? 'translate-x-0' : '-translate-x-full'}
@@ -188,31 +132,9 @@
       aria-label={collapsed ? m.sidebar_expand() : m.sidebar_collapse()}
     >
       {#if collapsed}
-        <svg
-          class="h-4 w-4 shrink-0"
-          aria-hidden="true"
-          viewBox="0 0 24 24"
-          fill="none"
-          stroke="currentColor"
-          stroke-width="1.5"
-          stroke-linecap="round"
-          stroke-linejoin="round"
-        >
-          <path d="m9 5 7 7-7 7" />
-        </svg>
+        <Icon icon="material-symbols:chevron-right" class="h-4 w-4 shrink-0" aria-hidden="true" />
       {:else}
-        <svg
-          class="h-4 w-4 shrink-0"
-          aria-hidden="true"
-          viewBox="0 0 24 24"
-          fill="none"
-          stroke="currentColor"
-          stroke-width="1.5"
-          stroke-linecap="round"
-          stroke-linejoin="round"
-        >
-          <path d="m15 5-7 7 7 7" />
-        </svg>
+        <Icon icon="material-symbols:chevron-left" class="h-4 w-4 shrink-0" aria-hidden="true" />
         <span>{m.sidebar_collapse_label()}</span>
       {/if}
     </button>
diff --git a/src/lib/components/layout/sidebar/nav-items.ts b/src/lib/components/layout/sidebar/nav-items.ts
new file mode 100644
index 00000000..e3aa3743
--- /dev/null
+++ b/src/lib/components/layout/sidebar/nav-items.ts
@@ -0,0 +1,33 @@
+import * as m from '$lib/paraglide/messages.js';
+
+export type NavItem = {
+  label: string;
+  href: string;
+  icon: string;
+  disabled?: boolean;
+  badge?: string;
+};
+
+export type NavSection = {
+  title: string;
+  items: NavItem[];
+};
+
+export function getNavSections(): NavSection[] {
+  return [
+    {
+      title: m.nav_platform(),
+      items: [{ label: m.nav_dashboard(), href: '/', icon: 'dashboard' }]
+    },
+    {
+      title: m.nav_data_tools(),
+      items: [
+        {
+          label: m.nav_trino(),
+          href: '/trino',
+          icon: 'database'
+        }
+      ]
+    }
+  ];
+}
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index 28d640d8..f1b2b5db 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import { page } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
-  import Sidebar from '$lib/components/layout/Sidebar.svelte';
-  import Header from '$lib/components/layout/Header.svelte';
+  import Sidebar from '$lib/components/layout/sidebar/Sidebar.svelte';
+  import Header from '$lib/components/layout/header/Header.svelte';
 
   let { children, data } = $props();
 
@@ -11,7 +11,7 @@
 
   const pageTitles: Record<string, () => string> = {
     '/': m.page_title_dashboard,
-    '/trino': m.page_title_trino
+    '/trino': m.page_title_trino,
   };
 
   let title = $derived((pageTitles[page.url.pathname] ?? m.page_title_default)());

From d2de208f3b3b9ff0a41b16475c8ae22e10289b95 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 4 May 2026 09:32:52 +0200
Subject: [PATCH 002/136] fix: add lint:fix script to package.json and clean up
 trailing comma in +layout.svelte

---
 package.json                    | 1 +
 src/routes/(app)/+layout.svelte | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index b29560f9..f7b6ed81 100644
--- a/package.json
+++ b/package.json
@@ -13,6 +13,7 @@
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
     "format": "prettier --write --ignore-path .prettierignore .",
     "lint": "prettier --check --ignore-path .prettierignore . && eslint .",
+    "lint:fix": "prettier --write --ignore-path .prettierignore . && eslint . --fix",
     "test:unit": "vitest run",
     "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && playwright test",
     "test:e2e:ui": "playwright test --ui",
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index f1b2b5db..d5e3fdef 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -11,7 +11,7 @@
 
   const pageTitles: Record<string, () => string> = {
     '/': m.page_title_dashboard,
-    '/trino': m.page_title_trino,
+    '/trino': m.page_title_trino
   };
 
   let title = $derived((pageTitles[page.url.pathname] ?? m.page_title_default)());

From c81b4d06328f6fb1167decdb06406e5e2f056142 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 4 May 2026 09:38:05 +0200
Subject: [PATCH 003/136] docs: update AGENTS.md to include Material UI icon
 library usage

---
 AGENTS.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/AGENTS.md b/AGENTS.md
index d89721bc..235fb24a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,6 +11,7 @@ The application is designed with a **plugin/module architecture** so future Stac
 - **SvelteKit** with **Svelte 5** - Always use Svelte 5 syntax with runes (`$props`, `$state`, `$derived`, etc.)
 - **Tailwind CSS v4** - No tailwind.config.js file (uses CSS-based configuration)
 - **DaisyUI** - Use DaisyUI components/classes where possible for consistent UI - This is DaisyUI v5! A lot of classes you know about DON'T EXIST anymore. Check <https://daisyui.com/docs/upgrade/?lang=enj> if needed
+- **Icon Library** - Use Material UI icons for all icons in the application. Import icons from the Material UI icon library for consistency.
 - **Monaco Editor** - SQL editor component (dynamic import, SSR-safe)
 - **ANTLR4** (antlr4ng) - Trino SQL parsing for syntax highlighting and code completion
 - **zod & superforms** - All forms are to use zod & superforms

From 9add069fc769ce4834a39a41b2ab5cda4e7c97ad Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 4 May 2026 09:44:24 +0200
Subject: [PATCH 004/136] refactor(header): move components for header into own
 directory

---
 src/lib/components/layout/header/Header.svelte                | 4 ++--
 .../components/layout/{ => header}/LanguageSwitcher.svelte    | 0
 src/lib/components/layout/{ => header}/ThemeToggle.svelte     | 0
 .../components/layout/{ => header}/ThemeToggle.svelte.spec.ts | 0
 4 files changed, 2 insertions(+), 2 deletions(-)
 rename src/lib/components/layout/{ => header}/LanguageSwitcher.svelte (100%)
 rename src/lib/components/layout/{ => header}/ThemeToggle.svelte (100%)
 rename src/lib/components/layout/{ => header}/ThemeToggle.svelte.spec.ts (100%)

diff --git a/src/lib/components/layout/header/Header.svelte b/src/lib/components/layout/header/Header.svelte
index 198f50d1..397c6185 100644
--- a/src/lib/components/layout/header/Header.svelte
+++ b/src/lib/components/layout/header/Header.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import Icon from '@iconify/svelte';
-  import LanguageSwitcher from '../LanguageSwitcher.svelte';
-  import ThemeToggle from '../ThemeToggle.svelte';
+  import LanguageSwitcher from './LanguageSwitcher.svelte';
+  import ThemeToggle from './ThemeToggle.svelte';
   import UserMenu from './UserMenu.svelte';
   import { authClient } from '$lib/auth-client';
 
diff --git a/src/lib/components/layout/LanguageSwitcher.svelte b/src/lib/components/layout/header/LanguageSwitcher.svelte
similarity index 100%
rename from src/lib/components/layout/LanguageSwitcher.svelte
rename to src/lib/components/layout/header/LanguageSwitcher.svelte
diff --git a/src/lib/components/layout/ThemeToggle.svelte b/src/lib/components/layout/header/ThemeToggle.svelte
similarity index 100%
rename from src/lib/components/layout/ThemeToggle.svelte
rename to src/lib/components/layout/header/ThemeToggle.svelte
diff --git a/src/lib/components/layout/ThemeToggle.svelte.spec.ts b/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
similarity index 100%
rename from src/lib/components/layout/ThemeToggle.svelte.spec.ts
rename to src/lib/components/layout/header/ThemeToggle.svelte.spec.ts

From 8343022d4d371971234cc33ac2448824e14316ab Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 4 May 2026 09:50:20 +0200
Subject: [PATCH 005/136] chore: dedupe lockfile

---
 package-lock.json | 180 ++++++++++++++++++----------------------------
 1 file changed, 68 insertions(+), 112 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0fd8ac44..68f2ff51 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -85,6 +85,12 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@better-auth/utils": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
+      "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
+      "license": "MIT"
+    },
     "node_modules/@better-fetch/fetch": {
       "version": "1.1.21",
       "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.1.21.tgz",
@@ -210,9 +216,9 @@
       }
     },
     "node_modules/@cyclonedx/cyclonedx-npm/node_modules/ajv": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
-      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -814,9 +820,9 @@
       }
     },
     "node_modules/@eslint/core": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.1.0.tgz",
-      "integrity": "sha512-/nr9K9wkr3P1EzFTdFdMoLuo1PmIxjmwvPozwoSodjNBdefGujXQUF93u1DDZpEaTuDvMsIQddsd35BwtrW9Xw==",
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1299,14 +1305,6 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/@npmcli/agent/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
     "node_modules/@npmcli/fs": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
@@ -2872,9 +2870,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
-      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2885,13 +2883,13 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.4.tgz",
-      "integrity": "sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==",
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.2"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -3225,9 +3223,9 @@
       }
     },
     "node_modules/ajv": {
-      "version": "6.12.6",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
-      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3278,9 +3276,9 @@
       }
     },
     "node_modules/ajv-formats/node_modules/ajv": {
-      "version": "8.18.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
-      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3693,16 +3691,10 @@
         "@better-auth/core": "1.5.4"
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/utils": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
-      "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
-      "license": "MIT"
-    },
     "node_modules/better-auth/node_modules/kysely": {
-      "version": "0.28.11",
-      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.11.tgz",
-      "integrity": "sha512-zpGIFg0HuoC893rIjYX1BETkVWdDnzTzF5e0kWXJFg5lE0k1/LfNWBejrcnOFu8Q2Rfq/hTDTU7XLUM8QOrpzg==",
+      "version": "0.28.17",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz",
+      "integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==",
       "license": "MIT",
       "engines": {
         "node": ">=20.0.0"
@@ -3728,12 +3720,6 @@
         }
       }
     },
-    "node_modules/better-call/node_modules/@better-auth/utils": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
-      "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
-      "license": "MIT"
-    },
     "node_modules/bindings": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
@@ -3871,14 +3857,6 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/cacache/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
     "node_modules/call-bind-apply-helpers": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
@@ -4561,9 +4539,9 @@
       "license": "MIT"
     },
     "node_modules/effect": {
-      "version": "3.19.17",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-3.19.17.tgz",
-      "integrity": "sha512-MChgn9z0y3KJ2DJ+VsZt1bdVDJ0bDIZt9zm4s3iPpRLzgcEGDOIP8pwADjAWifaP0S672nlRE5rZPBbyDcjn1g==",
+      "version": "3.21.2",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.2.tgz",
+      "integrity": "sha512-rXd2FGDM8KdjSIrc+mqEELo7ScW7xTVxEf1iInmPSpIde9/nyGuFM710cjTo7/EreGXiUX2MOonPpprbz2XHCg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5525,9 +5503,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
-      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
+      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5675,9 +5653,9 @@
       }
     },
     "node_modules/hosted-git-info/node_modules/lru-cache": {
-      "version": "11.2.6",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.6.tgz",
-      "integrity": "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==",
+      "version": "11.3.5",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.5.tgz",
+      "integrity": "sha512-NxVFwLAnrd9i7KUBxC4DrUhmgjzOs+1Qm50D3oF1/oL+r1NpZ4gA7xvG0/zJ8evR7zIKn4vLf7qTNduWFtCrRw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -6479,6 +6457,14 @@
       "license": "Apache-2.0",
       "peer": true
     },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
     "node_modules/lru.min": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz",
@@ -6647,9 +6633,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7222,9 +7208,9 @@
       }
     },
     "node_modules/nypm/node_modules/citty": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.1.tgz",
-      "integrity": "sha512-kEV95lFBhQgtogAPlQfJJ0WGVSokvLr/UEoFPiKKOXF7pl98HfUVUD0ejsuTCld/9xH9vogSywZ5KqHzXrZpqg==",
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz",
+      "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
       "license": "MIT",
       "peer": true
     },
@@ -7474,14 +7460,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/path-scurry/node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
     "node_modules/path-to-regexp": {
       "version": "8.3.0",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
@@ -8886,17 +8864,6 @@
         "spdx-license-ids": "^3.0.0"
       }
     },
-    "node_modules/spdx-correct/node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
@@ -8905,9 +8872,9 @@
       "license": "CC-BY-3.0"
     },
     "node_modules/spdx-expression-parse": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-4.0.0.tgz",
-      "integrity": "sha512-Clya5JIij/7C6bRR22+tnGXbc4VKlibKSVj2iHvVeX5iMW7s1SIQlqu699JkODJJIhh/pUu8L0/VLh8xflD+LQ==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9517,17 +9484,6 @@
         "node": ">=18"
       }
     },
-    "node_modules/tar/node_modules/yallist": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true,
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/tdigest": {
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/tdigest/-/tdigest-0.1.2.tgz",
@@ -9935,9 +9891,9 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "13.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.0.tgz",
-      "integrity": "sha512-XQegIaBTVUjSHliKqcnFqYypAd4S+WCYt5NIeRs6w/UAry7z8Y9j5ZwRRL4kzq9U3sD6v+85er9FvkEaBpji2w==",
+      "version": "13.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.1.tgz",
+      "integrity": "sha512-9ezox2roIft6ExBVTVqibSd5dc5/47Sw/uY6b4SjQUT2TzQ0tltNquWA46y4xPQmdZYqvnio22SgWd41M86+jw==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
@@ -9973,17 +9929,6 @@
         "spdx-expression-parse": "^3.0.0"
       }
     },
-    "node_modules/validate-npm-package-license/node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
     "node_modules/validator": {
       "version": "13.15.26",
       "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
@@ -10487,6 +10432,17 @@
         "node": ">=20.0"
       }
     },
+    "node_modules/yallist": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
+      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",

From 4bc8e9312e9506c49aa0376e6a15e7972bfe7e3c Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 4 May 2026 10:14:22 +0200
Subject: [PATCH 006/136] fix(sidebar): add hover cursor style to toggle button

---
 src/lib/components/layout/sidebar/Sidebar.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index 65c5f350..da363eb0 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -127,7 +127,7 @@
     <button
       onclick={() => (collapsed = !collapsed)}
       class="text-base-content/60 hover:bg-base-content/5 hover:text-base-content flex w-full items-center gap-3 rounded-lg px-3 py-2
-        text-sm font-medium transition-colors
+        text-sm font-medium transition-colors hover:cursor-pointer
         {collapsed ? 'justify-center' : ''}"
       aria-label={collapsed ? m.sidebar_expand() : m.sidebar_collapse()}
     >

From 952dc8011d63882d83dae53697b52c491a8a252c Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 4 May 2026 10:36:20 +0200
Subject: [PATCH 007/136] chore(types): centralise navigation and auth types;
 update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>
---
 src/lib/components/layout/header/Header.svelte   |  4 +---
 src/lib/components/layout/header/UserMenu.svelte |  4 +---
 src/lib/components/layout/sidebar/Sidebar.svelte |  3 ++-
 src/lib/components/layout/sidebar/nav-items.ts   | 14 ++------------
 src/lib/types/auth.ts                            |  3 +++
 src/lib/types/navigation.ts                      | 12 ++++++++++++
 6 files changed, 21 insertions(+), 19 deletions(-)
 create mode 100644 src/lib/types/auth.ts
 create mode 100644 src/lib/types/navigation.ts

diff --git a/src/lib/components/layout/header/Header.svelte b/src/lib/components/layout/header/Header.svelte
index 397c6185..c0883480 100644
--- a/src/lib/components/layout/header/Header.svelte
+++ b/src/lib/components/layout/header/Header.svelte
@@ -4,9 +4,7 @@
   import LanguageSwitcher from './LanguageSwitcher.svelte';
   import ThemeToggle from './ThemeToggle.svelte';
   import UserMenu from './UserMenu.svelte';
-  import { authClient } from '$lib/auth-client';
-
-  type User = typeof authClient.$Infer.Session.user;
+  import type { User } from '$lib/types/auth.js';
 
   let {
     title = m.page_title_dashboard(),
diff --git a/src/lib/components/layout/header/UserMenu.svelte b/src/lib/components/layout/header/UserMenu.svelte
index bda04ab0..6427cc43 100644
--- a/src/lib/components/layout/header/UserMenu.svelte
+++ b/src/lib/components/layout/header/UserMenu.svelte
@@ -1,9 +1,7 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import Icon from '@iconify/svelte';
-  import { authClient } from '$lib/auth-client';
-
-  type User = typeof authClient.$Infer.Session.user;
+  import type { User } from '$lib/types/auth.js';
 
   let { user }: { user: User } = $props();
 
diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index da363eb0..4a46fee6 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -2,7 +2,8 @@
   import { page } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
   import Icon from '@iconify/svelte';
-  import { type NavItem, getNavSections } from './nav-items.js';
+  import type { NavItem } from '$lib/types/navigation.js';
+  import { getNavSections } from './nav-items.js';
 
   let {
     collapsed = $bindable(false),
diff --git a/src/lib/components/layout/sidebar/nav-items.ts b/src/lib/components/layout/sidebar/nav-items.ts
index e3aa3743..dc7ca30d 100644
--- a/src/lib/components/layout/sidebar/nav-items.ts
+++ b/src/lib/components/layout/sidebar/nav-items.ts
@@ -1,17 +1,7 @@
 import * as m from '$lib/paraglide/messages.js';
+import type { NavItem, NavSection } from '$lib/types/navigation.js';
 
-export type NavItem = {
-  label: string;
-  href: string;
-  icon: string;
-  disabled?: boolean;
-  badge?: string;
-};
-
-export type NavSection = {
-  title: string;
-  items: NavItem[];
-};
+export type { NavItem, NavSection };
 
 export function getNavSections(): NavSection[] {
   return [
diff --git a/src/lib/types/auth.ts b/src/lib/types/auth.ts
new file mode 100644
index 00000000..0921ae02
--- /dev/null
+++ b/src/lib/types/auth.ts
@@ -0,0 +1,3 @@
+import { authClient } from '$lib/auth-client';
+
+export type User = typeof authClient.$Infer.Session.user;
diff --git a/src/lib/types/navigation.ts b/src/lib/types/navigation.ts
new file mode 100644
index 00000000..2d765198
--- /dev/null
+++ b/src/lib/types/navigation.ts
@@ -0,0 +1,12 @@
+export type NavItem = {
+  label: string;
+  href: string;
+  icon: string;
+  disabled?: boolean;
+  badge?: string;
+};
+
+export type NavSection = {
+  title: string;
+  items: NavItem[];
+};

From cba786674a1d87a7ea8005a23a9579749718dc24 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 09:22:01 +0200
Subject: [PATCH 008/136] feat(storage): initial Filebrowser UI implementation

Co-authored-by: Copilot <copilot@github.com>
---
 AGENTS.md                                     |   18 +
 STORAGE_REORG_PLAN.md                         |  159 +
 TECH_DEBT.md                                  |    8 +
 messages/de.json                              |   51 +-
 messages/en.json                              |   51 +-
 package-lock.json                             | 4848 +++++++++++------
 package.json                                  |    2 +
 .../components/layout/header/Header.svelte    |   13 +-
 .../layout/header/LanguageSwitcher.svelte     |   14 +-
 .../layout/header/ThemeToggle.svelte          |   26 +-
 .../components/layout/header/UserMenu.svelte  |   22 +-
 .../components/layout/sidebar/Sidebar.svelte  |   67 +-
 .../components/layout/sidebar/nav-items.ts    |    5 +
 src/lib/components/storage/BucketGrid.svelte  |   40 +
 src/lib/components/storage/BucketList.svelte  |   90 +
 src/lib/components/storage/ContextMenu.svelte |  132 +
 .../components/storage/FileExplorer.svelte    |  189 +
 src/lib/components/storage/ObjectTable.svelte |  307 ++
 .../storage/SelectionToolbar.svelte           |   78 +
 .../storage/StorageBreadcrumb.svelte          |  178 +
 .../storage/StorageConnectForm.svelte         |  141 +
 src/lib/components/storage/storage-utils.ts   |   45 +
 .../components/trino/StatementResult.svelte   |   75 +-
 src/lib/schemas/storage.ts                    |   28 +
 src/lib/server/storage/factory.ts             |   15 +
 src/lib/server/storage/hdfs-provider.ts       |   24 +
 src/lib/server/storage/provider.ts            |    9 +
 src/lib/server/storage/s3-provider.ts         |  123 +
 src/lib/server/storage/types.ts               |   26 +
 src/lib/server/storage/user-connections.ts    |   47 +
 src/lib/types/storage.ts                      |   25 +
 src/routes/(app)/+layout.svelte               |    7 +-
 src/routes/(app)/+page.svelte                 |   58 +-
 src/routes/(app)/storage/+error.svelte        |   59 +
 src/routes/(app)/storage/+layout.server.ts    |   20 +
 src/routes/(app)/storage/+layout.svelte       |   16 +
 src/routes/(app)/storage/+page.server.ts      |   69 +
 src/routes/(app)/storage/+page.svelte         |   17 +
 .../[bucket]/[...prefix]/+page.server.ts      |   45 +
 .../storage/[bucket]/[...prefix]/+page.svelte |   27 +
 src/routes/(app)/storage/validation.ts        |    1 +
 src/routes/(app)/trino/+page.svelte           |  126 +-
 src/routes/auth/login/+page.svelte            |   25 +-
 43 files changed, 5606 insertions(+), 1720 deletions(-)
 create mode 100644 STORAGE_REORG_PLAN.md
 create mode 100644 src/lib/components/storage/BucketGrid.svelte
 create mode 100644 src/lib/components/storage/BucketList.svelte
 create mode 100644 src/lib/components/storage/ContextMenu.svelte
 create mode 100644 src/lib/components/storage/FileExplorer.svelte
 create mode 100644 src/lib/components/storage/ObjectTable.svelte
 create mode 100644 src/lib/components/storage/SelectionToolbar.svelte
 create mode 100644 src/lib/components/storage/StorageBreadcrumb.svelte
 create mode 100644 src/lib/components/storage/StorageConnectForm.svelte
 create mode 100644 src/lib/components/storage/storage-utils.ts
 create mode 100644 src/lib/schemas/storage.ts
 create mode 100644 src/lib/server/storage/factory.ts
 create mode 100644 src/lib/server/storage/hdfs-provider.ts
 create mode 100644 src/lib/server/storage/provider.ts
 create mode 100644 src/lib/server/storage/s3-provider.ts
 create mode 100644 src/lib/server/storage/types.ts
 create mode 100644 src/lib/server/storage/user-connections.ts
 create mode 100644 src/lib/types/storage.ts
 create mode 100644 src/routes/(app)/storage/+error.svelte
 create mode 100644 src/routes/(app)/storage/+layout.server.ts
 create mode 100644 src/routes/(app)/storage/+layout.svelte
 create mode 100644 src/routes/(app)/storage/+page.server.ts
 create mode 100644 src/routes/(app)/storage/+page.svelte
 create mode 100644 src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
 create mode 100644 src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
 create mode 100644 src/routes/(app)/storage/validation.ts

diff --git a/AGENTS.md b/AGENTS.md
index 235fb24a..52c7f860 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -12,6 +12,24 @@ The application is designed with a **plugin/module architecture** so future Stac
 - **Tailwind CSS v4** - No tailwind.config.js file (uses CSS-based configuration)
 - **DaisyUI** - Use DaisyUI components/classes where possible for consistent UI - This is DaisyUI v5! A lot of classes you know about DON'T EXIST anymore. Check <https://daisyui.com/docs/upgrade/?lang=enj> if needed
 - **Icon Library** - Use Material UI icons for all icons in the application. Import icons from the Material UI icon library for consistency.
+
+  Example (project uses Iconify Material symbols):
+
+  ```svelte
+  <script lang="ts">
+    import Icon from '@iconify/svelte';
+  </script>
+
+  <!-- decorative icon -->
+  <Icon icon="material-symbols:warning" class="text-error h-6 w-6" aria-hidden="true" />
+
+  <!-- accessible icon with label -->
+  <span class="flex items-center gap-2">
+    <Icon icon="material-symbols:storage" class="h-4 w-4" aria-hidden="true" />
+    <span>Storage</span>
+  </span>
+  ```
+
 - **Monaco Editor** - SQL editor component (dynamic import, SSR-safe)
 - **ANTLR4** (antlr4ng) - Trino SQL parsing for syntax highlighting and code completion
 - **zod & superforms** - All forms are to use zod & superforms
diff --git a/STORAGE_REORG_PLAN.md b/STORAGE_REORG_PLAN.md
new file mode 100644
index 00000000..d20120d6
--- /dev/null
+++ b/STORAGE_REORG_PLAN.md
@@ -0,0 +1,159 @@
+# Storage Feature — Reorganization Plan
+
+This document is an easy-to-follow, step-by-step plan to reorganise the S3 file-browser/storage feature into a clearer, more secure, and testable structure. Follow each step and use the verification checks to confirm progress.
+
+---
+
+## Overview
+- Goal: Separate UI, shared domain logic, server providers, business service layer, and public API routes. Add tests and secure persistence for user connection credentials.
+- Scope: Minimal breaking changes for UI; refactor server code to centralise logic and enable proper APIs.
+
+---
+
+## Prerequisites
+- Node.js version from `.node-version` and `nvm` available.
+- Ensure you can run dev server: `npm run dev`.
+- AWS SDK is already a dependency (`@aws-sdk/client-s3`).
+
+---
+
+## Canonical Folder Layout (target)
+- `src/lib/components/storage/` — UI components (Breadcrumb, FileExplorer, ObjectTable, BucketList, ContextMenu, SelectionToolbar, ConnectForm)
+- `src/lib/storage/` — shared domain models and client helpers (`types.ts`, `storage-utils.ts`, `tokenMap.ts`)
+- `src/lib/server/storage/` — server implementations: `provider.ts`, `factory.ts`, `s3-provider.ts`, `hdfs-provider.ts` (or remove), `service.ts`, `persistence-adapter.ts`, `audit.ts`
+- `src/routes/api/storage/` — API endpoints: `list`, `object`, `metadata`, `download`, `rename`, `move`, `delete`, `connect`
+- `src/lib/server/storage/__tests__/` — unit tests for providers/service
+
+---
+
+## Step-by-step Plan (follow in order)
+
+1) Create canonical folder layout
+- What: Add the folders above and move existing files into their new homes (or create shims that import old files to avoid breaking routes while migrating).
+- Commands (example):
+
+```bash
+# create directories
+mkdir -p src/lib/storage src/lib/server/storage src/routes/api/storage
+git add -A
+```
+
+- Verify: files exist in their new locations or shims import moved files.
+- Est. time: 30–60 min
+
+2) Extract server service layer (`service.ts`)
+- What: Move S3-listing, error handling, and connection lookup logic from `+page.server.ts`/`+layout.server.ts` into `src/lib/server/storage/service.ts`. The service exposes functions like `listObjects(userId, bucket, prefix, continuationToken)` and `getObjectStream(userId, bucket, key)`.
+- Why: Improves testability and removes business logic from route loaders.
+- Verify: route loaders call `service.ts` and behavior remains identical.
+- Est. time: 60–90 min
+
+3) Implement pluggable persistence adapter for user connections
+- What: Replace `user-connections.ts` in-memory Map with `persistence-adapter.ts` (interface + `in-memory` and `file` adapters). Persist secrets encrypted for dev if needed.
+- Commands: create `src/lib/server/storage/persistence-adapter.ts` with methods `saveConnection(userId, conn)`, `getConnection(userId)`, `deleteConnection(userId)`.
+- Verify: connect/disconnect route actions still work, credentials survive dev-server restarts if `file` adapter chosen.
+- Est. time: 1–3 hours (depends encryption chosen).
+
+4) Add API routes under `src/routes/api/storage/`
+- What: Create thin REST endpoints used by the UI to perform object operations. Examples:
+  - `GET /api/storage/list?bucket=...&prefix=...&continuationToken=...`
+  - `GET /api/storage/object?bucket=...&key=...` (metadata and/or signed streaming)
+  - `GET /api/storage/download?bucket=...&key=...` (download proxy)
+  - `POST /api/storage/rename`, `POST /api/storage/delete`, etc.
+- Why: Keep client UI decoupled from provider SDK and centralise auth, audit and rate limits.
+- Verify: UI calls endpoints and responses are correct; add server logs for calls.
+- Est. time: 2–4 hours
+
+5) Change S3 provider to use continuation tokens (cursor) instead of offset pages
+- What: Refactor `s3-provider.ts` to return `ContinuationToken` and `IsTruncated`/`NextContinuationToken` per S3 API, and make the `list` API pass tokens through.
+- Why: S3 list is designed for cursor pagination and is far more efficient for large buckets.
+- Verify: `GET /api/storage/list` returns `items` and `nextContinuationToken`; client can request next pages with the token.
+- Est. time: 1–3 hours
+
+6) Wire UI actions to the new API routes
+- What: Replace client-side stubs for preview/download/rename/move/delete with calls to endpoints in `src/routes/api/storage/*`. Use streaming downloads for large objects.
+- Accessibility: keep keyboard/aria behaviour in components intact.
+- Verify: right-click menu and selection toolbar actions work and show server-side errors when appropriate.
+- Est. time: 3–6 hours
+
+7) Add unit tests (providers and utils)
+- What: Add unit tests for `s3-provider.ts`, `storage-utils.ts`, and `service.ts`. Mock `@aws-sdk/client-s3` responses using jest or vitest.
+- Verify: tests cover listing, metadata parsing, error mapping, and token propagation.
+- Est. time: 2–4 hours
+
+8) Add E2E tests for connect → list → download
+- What: Add Playwright tests in `e2e/` to exercise connect form, listing, pagination, and a download/preview.
+- Verify: Playwright tests pass locally.
+- Est. time: 3–6 hours
+
+9) Security hardening and operational concerns
+- What: Ensure:
+  - credentials are stored encrypted and not logged, use a vault in production
+  - server endpoints perform authorization checks (OPA) and audit destructive actions
+  - rate-limiting for download/preview endpoints
+  - remove `hdfs-provider.ts` or implement it properly
+- Verify: manual security review + running app with audit logs enabled.
+- Est. time: 4+ hours (depends on infra)
+
+10) Documentation and tech-debt updates
+- What: Update `TECH_DEBT.md`, add README for storage module, and document the persistence adapter selection.
+- Verify: docs updated and reviewed.
+- Est. time: 30–60 min
+
+---
+
+## Quick Implementation Checklist (commands)
+
+- Create directories:
+
+```bash
+mkdir -p src/lib/storage src/lib/server/storage src/routes/api/storage
+```
+
+- Scaffold `service.ts` and `persistence-adapter.ts` files (example):
+
+```bash
+# create files (example)
+cat > src/lib/server/storage/service.ts <<'EOF'
+// scaffold service layer
+EOF
+
+cat > src/lib/server/storage/persistence-adapter.ts <<'EOF'
+// scaffold persistence adapter
+EOF
+```
+
+- Run dev server and run tests as you implement:
+
+```bash
+npm run dev
+npm run test:e2e
+# or unit tests
+npm run test
+```
+
+---
+
+## Verification & Acceptance Criteria
+- UI behaves the same from a user perspective for connect + list flows.
+- Server-side code tested (unit tests) for provider and service logic.
+- Continuation-token pagination works and is used by the UI to page.
+- Credentials are not stored in a process-local Map for production (use `persistence-adapter`).
+- Audit logs are emitted for destructive operations and not for secrets.
+
+---
+
+## Notes & Security reminders
+- Never log credentials. Ensure `pino` redaction config covers credential fields.
+- For multi-replica deployments, use a replicated secret store (Vault, KMS-encrypted DB column).
+- Use server-side streaming for downloads — avoid loading whole object into memory.
+
+---
+
+## Next steps (you can do these now)
+1. Decide on persistence adapter to use for dev: `in-memory (dev)`, `file (dev)`, or `DB/vault (prod)`.
+2. Run the directory scaffolding commands above.
+3. Implement `service.ts` and move listing logic from `+page.server.ts` into it.
+
+---
+
+Saved checklist & plan in this repo file.
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index de08b2e4..892ce56e 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -46,6 +46,14 @@ Trino error messages and Node.js exception messages are returned to the browser
 
 ---
 
+### In-memory storage connection state
+
+**File:** `src/lib/server/storage/user-connections.ts`
+
+Per-user S3 connection configs (endpoint, region, credentials) are stored in a server-side `Map`. All connections are lost on server restart and cannot be shared across multiple replicas. Acceptable for the initial phase; mirrors the same pattern used by the Trino user-clients module. Long-term fix: persist encrypted connection configs server-side, tied to the authenticated session.
+
+---
+
 ### In-memory session store loses state on restart and prevents horizontal scaling
 
 **File:** `src/lib/server/auth.ts`
diff --git a/messages/de.json b/messages/de.json
index e92d253d..9d40ad97 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -108,5 +108,54 @@
   "trino_statements_skipped_other": "{count} Anweisungen wurden aufgrund eines vorherigen Fehlers übersprungen.",
   "trino_statement_collapse": "Ergebnisse von Anweisung {index} ein-/ausblenden",
   "trino_export_csv": "Exportieren",
-  "trino_export_csv_column_names": "Spaltennamen"
+  "trino_export_csv_column_names": "Spaltennamen",
+  "nav_storage": "Speicher",
+  "page_title_storage": "Speicher",
+  "storage_connect_title": "Mit Speicher verbinden",
+  "storage_connect_subtitle": "Konfigurieren Sie ein Speicher-Backend, um Buckets und Objekte zu durchsuchen.",
+  "storage_connect_type": "Backend-Typ",
+  "storage_connect_type_s3": "S3-kompatibel",
+  "storage_connect_type_hdfs": "HDFS",
+  "storage_connect_endpoint": "Endpunkt-URL",
+  "storage_connect_endpoint_placeholder": "https://minio.beispiel.de:9000",
+  "storage_connect_endpoint_hint": "Leer lassen für AWS S3",
+  "storage_connect_region": "Region",
+  "storage_connect_access_key": "Zugriffsschlüssel-ID",
+  "storage_connect_secret_key": "Geheimer Zugriffsschlüssel",
+  "storage_connect_submit": "Verbinden",
+  "storage_connect_error": "Verbindung fehlgeschlagen — Endpunkt und Zugangsdaten prüfen.",
+  "storage_disconnect": "Verbindung Trennen",
+  "storage_buckets_label": "Buckets",
+  "storage_view_all_buckets": "Alle Buckets anzeigen",
+  "storage_buckets_empty": "Keine Buckets gefunden",
+  "storage_bucket_empty": "Dieser Bucket ist leer",
+  "storage_folder": "Ordner",
+  "storage_folders": "Ordner",
+  "storage_file": "Datei",
+  "storage_files": "Dateien",
+  "storage_select_toggle": "Auswahlmodus umschalten",
+  "storage_paste": "{count} Element einfügen",
+  "storage_paste_plural": "{count} Elemente einfügen",
+  "storage_selected": "{count} ausgewählt",
+  "storage_action_preview": "Vorschau",
+  "storage_action_rename": "Umbenennen",
+  "storage_action_download": "Herunterladen",
+  "storage_action_cut": "Ausschneiden",
+  "storage_action_copy": "Kopieren",
+  "storage_action_move": "Verschieben",
+  "storage_action_delete": "Löschen",
+  "storage_action_paste": "Einfügen",
+  "storage_danger_zone": "Gefahrenbereich",
+  "storage_parent_dir": "Übergeordnetes Verzeichnis",
+  "storage_loading": "Wird geladen…",
+  "storage_breadcrumb_more": "Weitere Ordner",
+  "storage_error_title": "Speicherfehler",
+  "storage_error_access_denied": "Sie haben keine Berechtigung, auf den Bucket \u201e{bucket}\u201c zuzugreifen.",
+  "storage_error_not_found": "Der Bucket \u201e{bucket}\u201c existiert nicht.",
+  "storage_error_storage_error": "Beim Zugriff auf den Bucket \u201e{bucket}\u201c ist ein Fehler aufgetreten.",
+  "storage_error_back_to_storage": "Zurück zum Speicher",
+  "storage_error_go_back": "Zurück",
+  "storage_header_name": "Name",
+  "storage_header_size": "Größe",
+  "storage_header_last_modified": "Zuletzt geändert"
 }
diff --git a/messages/en.json b/messages/en.json
index fb44888a..779753f8 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -108,5 +108,54 @@
   "trino_statements_skipped_other": "{count} statements were skipped due to a preceding error.",
   "trino_statement_collapse": "Toggle statement {index} results",
   "trino_export_csv": "Export",
-  "trino_export_csv_column_names": "Column names"
+  "trino_export_csv_column_names": "Column names",
+  "nav_storage": "Storage",
+  "page_title_storage": "Storage",
+  "storage_connect_title": "Connect to storage",
+  "storage_connect_subtitle": "Configure a storage backend to browse buckets and objects.",
+  "storage_connect_type": "Backend type",
+  "storage_connect_type_s3": "S3-compatible",
+  "storage_connect_type_hdfs": "HDFS",
+  "storage_connect_endpoint": "Endpoint URL",
+  "storage_connect_endpoint_placeholder": "https://minio.example.com:9000",
+  "storage_connect_endpoint_hint": "Leave blank to use AWS S3",
+  "storage_connect_region": "Region",
+  "storage_connect_access_key": "Access key ID",
+  "storage_connect_secret_key": "Secret access key",
+  "storage_connect_submit": "Connect",
+  "storage_connect_error": "Could not connect — check the endpoint and credentials.",
+  "storage_disconnect": "Disconnect",
+  "storage_buckets_label": "Buckets",
+  "storage_view_all_buckets": "View all buckets",
+  "storage_buckets_empty": "No buckets found",
+  "storage_bucket_empty": "This bucket is empty",
+  "storage_folder": "folder",
+  "storage_folders": "folders",
+  "storage_file": "file",
+  "storage_files": "files",
+  "storage_select_toggle": "Toggle selection mode",
+  "storage_paste": "Paste {count} item",
+  "storage_paste_plural": "Paste {count} items",
+  "storage_selected": "{count} selected",
+  "storage_action_preview": "Preview",
+  "storage_action_rename": "Rename",
+  "storage_action_download": "Download",
+  "storage_action_cut": "Cut",
+  "storage_action_copy": "Copy",
+  "storage_action_move": "Move",
+  "storage_action_delete": "Delete",
+  "storage_action_paste": "Paste",
+  "storage_danger_zone": "Danger zone",
+  "storage_parent_dir": "Parent directory",
+  "storage_loading": "Loading…",
+  "storage_breadcrumb_more": "More folders",
+  "storage_error_title": "Storage error",
+  "storage_error_access_denied": "You do not have permission to access the bucket \u201c{bucket}\u201d.",
+  "storage_error_not_found": "The bucket \u201c{bucket}\u201d does not exist.",
+  "storage_error_storage_error": "An error occurred while accessing the bucket \u201c{bucket}\u201d.",
+  "storage_error_back_to_storage": "Back to storage",
+  "storage_error_go_back": "Go back",
+  "storage_header_name": "Name",
+  "storage_header_size": "Size",
+  "storage_header_last_modified": "Last modified"
 }
diff --git a/package-lock.json b/package-lock.json
index 68f2ff51..562b711a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,11 +9,13 @@
       "version": "0.0.1",
       "license": "Apache-2.0",
       "dependencies": {
+        "@aws-sdk/client-s3": "^3.1041.0",
         "@internationalized/date": "^3.11.0",
         "antlr4ng": "^3.0.16",
         "better-auth": "^1.5.4",
         "monaco-editor": "^0.55.1",
         "pino": "^10.3.1",
+        "pretty-bytes": "^7.1.0",
         "prom-client": "^15.1.3",
         "undici": "^7.24.4"
       },
@@ -74,2041 +76,3626 @@
       "license": "MIT",
       "optional": true
     },
-    "node_modules/@babel/runtime": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
-      "integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
+    "node_modules/@aws-crypto/crc32": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@aws-crypto/crc32/-/crc32-5.2.0.tgz",
+      "integrity": "sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/util": "^5.2.0",
+        "@aws-sdk/types": "^3.222.0",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=6.9.0"
+        "node": ">=16.0.0"
       }
     },
-    "node_modules/@better-auth/utils": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
-      "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
-      "license": "MIT"
+    "node_modules/@aws-crypto/crc32c": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@aws-crypto/crc32c/-/crc32c-5.2.0.tgz",
+      "integrity": "sha512-+iWb8qaHLYKrNvGRbiYRHSdKRWhto5XlZUEBwDjYNf+ly5SVYG6zEoYIdxvf5R3zyeP16w4PLBn3rH1xc74Rag==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/util": "^5.2.0",
+        "@aws-sdk/types": "^3.222.0",
+        "tslib": "^2.6.2"
+      }
     },
-    "node_modules/@better-fetch/fetch": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.1.21.tgz",
-      "integrity": "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="
+    "node_modules/@aws-crypto/sha1-browser": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@aws-crypto/sha1-browser/-/sha1-browser-5.2.0.tgz",
+      "integrity": "sha512-OH6lveCFfcDjX4dbAvCFSYUjJZjDr/3XJ3xHtjn3Oj5b9RjojQo8npoLeA/bNwkOkrSQ0wgrHzXk4tDRxGKJeg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/supports-web-crypto": "^5.2.0",
+        "@aws-crypto/util": "^5.2.0",
+        "@aws-sdk/types": "^3.222.0",
+        "@aws-sdk/util-locate-window": "^3.0.0",
+        "@smithy/util-utf8": "^2.0.0",
+        "tslib": "^2.6.2"
+      }
     },
-    "node_modules/@chevrotain/cst-dts-gen": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-10.5.0.tgz",
-      "integrity": "sha512-lhmC/FyqQ2o7pGK4Om+hzuDrm9rhFYIJ/AXoQBeongmn870Xeb0L6oGEiuR8nohFNL5sMaQEJWCxr1oIVIVXrw==",
+    "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/is-array-buffer": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
+      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@chevrotain/gast": "10.5.0",
-        "@chevrotain/types": "10.5.0",
-        "lodash": "4.17.21"
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@chevrotain/gast": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-10.5.0.tgz",
-      "integrity": "sha512-pXdMJ9XeDAbgOWKuD1Fldz4ieCs6+nLNmyVhe2gZVqoO7v8HXuHYs5OV2EzUtbuai37TlOAQHrTDvxMnvMJz3A==",
+    "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/util-buffer-from": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
+      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@chevrotain/types": "10.5.0",
-        "lodash": "4.17.21"
+        "@smithy/is-array-buffer": "^2.2.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@chevrotain/types": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-10.5.0.tgz",
-      "integrity": "sha512-f1MAia0x/pAVPWH/T73BJVyO2XU5tI4/iE7cnxb7tqdNTNhQI3Uq3XkqcoteTmD4t1aM0LbHCJOhgIDn07kl2A==",
+    "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/util-utf8": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
+      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
       "license": "Apache-2.0",
-      "peer": true
+      "dependencies": {
+        "@smithy/util-buffer-from": "^2.2.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
     },
-    "node_modules/@chevrotain/utils": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-10.5.0.tgz",
-      "integrity": "sha512-hBzuU5+JjB2cqNZyszkDHZgOSrUUT8V3dhgRl8Q9Gp6dAj/H5+KILGjbhDpc3Iy9qmqlm/akuOI2ut9VUtzJxQ==",
+    "node_modules/@aws-crypto/sha256-browser": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-browser/-/sha256-browser-5.2.0.tgz",
+      "integrity": "sha512-AXfN/lGotSQwu6HNcEsIASo7kWXZ5HYWvfOmSNKDsEqC4OashTp8alTmaz+F7TC2L083SFv5RdB+qU3Vs1kZqw==",
       "license": "Apache-2.0",
-      "peer": true
+      "dependencies": {
+        "@aws-crypto/sha256-js": "^5.2.0",
+        "@aws-crypto/supports-web-crypto": "^5.2.0",
+        "@aws-crypto/util": "^5.2.0",
+        "@aws-sdk/types": "^3.222.0",
+        "@aws-sdk/util-locate-window": "^3.0.0",
+        "@smithy/util-utf8": "^2.0.0",
+        "tslib": "^2.6.2"
+      }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-4.2.1.tgz",
-      "integrity": "sha512-SOA/96sf0wsgUYCRtFkLFm6WoFhG+q1BxdC84hPSn9J3xWlH1e7OnTPJT+WNUzTqzX1nSm5JhjRX4krozu2X+g==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
-        }
-      ],
+    "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/is-array-buffer": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
+      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@cyclonedx/cyclonedx-library": "^10.0.0",
-        "commander": "^14.0.0",
-        "normalize-package-data": "^7.0.0 || ^8.0.0",
-        "packageurl-js": "^2.0.1",
-        "spdx-expression-parse": "^3.0.1 || ^4.0.0",
-        "xmlbuilder2": "^3.0.2 || ^4.0.3"
-      },
-      "bin": {
-        "cyclonedx-npm": "bin/cyclonedx-npm-cli.js"
+        "tslib": "^2.6.2"
       },
       "engines": {
-        "node": ">=20.18.0",
-        "npm": ">=9"
-      },
-      "optionalDependencies": {
-        "ajv": "^8.12.0",
-        "ajv-formats": "^3.0.1",
-        "ajv-formats-draft2019": "^1.6.1",
-        "libxmljs2": "^0.35||^0.37"
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/@cyclonedx/cyclonedx-library": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-library/-/cyclonedx-library-10.0.0.tgz",
-      "integrity": "sha512-xDXf2eqzeFHdjamj6oBV3duRSfrlmsJ5+2z9tXp7q5qxJP5Awmjf4ABSutS4qkVHHj7JzKFL/EM0V0Nihc7zPg==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
-        }
-      ],
+    "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-buffer-from": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
+      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
       "license": "Apache-2.0",
-      "engines": {
-        "node": ">=20.18.0"
-      },
-      "peerDependencies": {
-        "ajv": "^8.12.0",
-        "ajv-formats": "^3.0.1",
-        "ajv-formats-draft2019": "^1.6.1",
-        "libxmljs2": "^0.35||^0.37",
-        "packageurl-js": "*",
-        "spdx-expression-parse": "*",
-        "xmlbuilder2": "^3.0.2||^4.0.0"
+      "dependencies": {
+        "@smithy/is-array-buffer": "^2.2.0",
+        "tslib": "^2.6.2"
       },
-      "peerDependenciesMeta": {
-        "ajv": {
-          "optional": true
-        },
-        "ajv-formats": {
-          "optional": true
-        },
-        "ajv-formats-draft2019": {
-          "optional": true
-        },
-        "libxmljs2": {
-          "optional": true
-        },
-        "packageurl-js": {
-          "optional": true
-        },
-        "spdx-expression-parse": {
-          "optional": true
-        },
-        "xmlbuilder2": {
-          "optional": true
-        }
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
+    "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-utf8": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
+      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
+        "@smithy/util-buffer-from": "^2.2.0",
+        "tslib": "^2.6.2"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/commander": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/@aws-crypto/sha256-js": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-js/-/sha256-js-5.2.0.tgz",
+      "integrity": "sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/util": "^5.2.0",
+        "@aws-sdk/types": "^3.222.0",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=20"
+        "node": ">=16.0.0"
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
+    "node_modules/@aws-crypto/supports-web-crypto": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@aws-crypto/supports-web-crypto/-/supports-web-crypto-5.2.0.tgz",
+      "integrity": "sha512-iAvUotm021kM33eCdNfwIN//F77/IADDSs58i+MDaOqFrVjZo9bAal0NK7HurRuWLLpF1iLX7gbWrjHjeo+YFg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      }
     },
-    "node_modules/@electric-sql/pglite": {
-      "version": "0.3.15",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.3.15.tgz",
-      "integrity": "sha512-Cj++n1Mekf9ETfdc16TlDi+cDDQF0W7EcbyRHYOAeZdsAe8M/FJg18itDTSwyHfar2WIezawM9o0EKaRGVKygQ==",
+    "node_modules/@aws-crypto/util": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/@aws-crypto/util/-/util-5.2.0.tgz",
+      "integrity": "sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==",
       "license": "Apache-2.0",
-      "peer": true
+      "dependencies": {
+        "@aws-sdk/types": "^3.222.0",
+        "@smithy/util-utf8": "^2.0.0",
+        "tslib": "^2.6.2"
+      }
     },
-    "node_modules/@electric-sql/pglite-socket": {
-      "version": "0.0.20",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.0.20.tgz",
-      "integrity": "sha512-J5nLGsicnD9wJHnno9r+DGxfcZWh+YJMCe0q/aCgtG6XOm9Z7fKeite8IZSNXgZeGltSigM9U/vAWZQWdgcSFg==",
+    "node_modules/@aws-crypto/util/node_modules/@smithy/is-array-buffer": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
+      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
       "license": "Apache-2.0",
-      "peer": true,
-      "bin": {
-        "pglite-server": "dist/scripts/server.js"
+      "dependencies": {
+        "tslib": "^2.6.2"
       },
-      "peerDependencies": {
-        "@electric-sql/pglite": "0.3.15"
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@electric-sql/pglite-tools": {
-      "version": "0.2.20",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.2.20.tgz",
-      "integrity": "sha512-BK50ZnYa3IG7ztXhtgYf0Q7zijV32Iw1cYS8C+ThdQlwx12V5VZ9KRJ42y82Hyb4PkTxZQklVQA9JHyUlex33A==",
+    "node_modules/@aws-crypto/util/node_modules/@smithy/util-buffer-from": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
+      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
       "license": "Apache-2.0",
-      "peer": true,
-      "peerDependencies": {
-        "@electric-sql/pglite": "0.3.15"
+      "dependencies": {
+        "@smithy/is-array-buffer": "^2.2.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@emnapi/core": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.9.0.tgz",
-      "integrity": "sha512-0DQ98G9ZQZOxfUcQn1waV2yS8aWdZ6kJMbYCJB3oUBecjWYO1fqJ+a1DRfPF3O5JEkwqwP1A9QEN/9mYm2Yd0w==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
+    "node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
+      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.0",
-        "tslib": "^2.4.0"
+        "@smithy/util-buffer-from": "^2.2.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@emnapi/runtime": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.9.0.tgz",
-      "integrity": "sha512-QN75eB0IH2ywSpRpNddCRfQIhmJYBCJ1x5Lb3IscKAL8bMnVAKnRg8dCoXbHzVLLH7P38N2Z3mtulB7W0J0FKw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
+    "node_modules/@aws-sdk/client-s3": {
+      "version": "3.1041.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1041.0.tgz",
+      "integrity": "sha512-sQV14bIqslnBHuSlLMD+fc3pH+ajop6vnrFlJ4wM4JDqcYwVik4O+9srnZUrkesFw5y+CN0GfOQ06CAgtC4mjQ==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "tslib": "^2.4.0"
+        "@aws-crypto/sha1-browser": "5.2.0",
+        "@aws-crypto/sha256-browser": "5.2.0",
+        "@aws-crypto/sha256-js": "5.2.0",
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/credential-provider-node": "^3.972.39",
+        "@aws-sdk/middleware-bucket-endpoint": "^3.972.10",
+        "@aws-sdk/middleware-expect-continue": "^3.972.10",
+        "@aws-sdk/middleware-flexible-checksums": "^3.974.16",
+        "@aws-sdk/middleware-host-header": "^3.972.10",
+        "@aws-sdk/middleware-location-constraint": "^3.972.10",
+        "@aws-sdk/middleware-logger": "^3.972.10",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
+        "@aws-sdk/middleware-sdk-s3": "^3.972.37",
+        "@aws-sdk/middleware-ssec": "^3.972.10",
+        "@aws-sdk/middleware-user-agent": "^3.972.38",
+        "@aws-sdk/region-config-resolver": "^3.972.13",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.25",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.8",
+        "@aws-sdk/util-user-agent-browser": "^3.972.10",
+        "@aws-sdk/util-user-agent-node": "^3.973.24",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/core": "^3.23.17",
+        "@smithy/eventstream-serde-browser": "^4.2.14",
+        "@smithy/eventstream-serde-config-resolver": "^4.3.14",
+        "@smithy/eventstream-serde-node": "^4.2.14",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/hash-blob-browser": "^4.2.15",
+        "@smithy/hash-node": "^4.2.14",
+        "@smithy/hash-stream-node": "^4.2.14",
+        "@smithy/invalid-dependency": "^4.2.14",
+        "@smithy/md5-js": "^4.2.14",
+        "@smithy/middleware-content-length": "^4.2.14",
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/middleware-retry": "^4.5.7",
+        "@smithy/middleware-serde": "^4.2.20",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-base64": "^4.3.2",
+        "@smithy/util-body-length-browser": "^4.2.2",
+        "@smithy/util-body-length-node": "^4.2.3",
+        "@smithy/util-defaults-mode-browser": "^4.3.49",
+        "@smithy/util-defaults-mode-node": "^4.2.54",
+        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.6",
+        "@smithy/util-stream": "^4.5.25",
+        "@smithy/util-utf8": "^4.2.2",
+        "@smithy/util-waiter": "^4.3.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.0.tgz",
-      "integrity": "sha512-N10dEJNSsUx41Z6pZsXU8FjPjpBEplgH24sfkmITrBED1/U2Esum9F3lfLrMjKHHjmi557zQn7kR9R+XWXu5Rg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
+    "node_modules/@aws-sdk/core": {
+      "version": "3.974.8",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.8.tgz",
+      "integrity": "sha512-njR2qoG6ZuB0kvAS2FyICsFZJ6gmCcf2X/7JcD14sUvGDm26wiZ5BrA6LOiUxKFEF+IVe7kdroxyE00YlkiYsw==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "tslib": "^2.4.0"
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/xml-builder": "^3.972.22",
+        "@smithy/core": "^3.23.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/signature-v4": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-base64": "^4.3.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.6",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
-      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
+    "node_modules/@aws-sdk/crc64-nvme": {
+      "version": "3.972.7",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/crc64-nvme/-/crc64-nvme-3.972.7.tgz",
+      "integrity": "sha512-QUagVVBbC8gODCF6e1aV0mE2TXWB9Opz4k8EJFdNrujUVQm5R4AjJa1mpOqzwOuROBzqJU9zawzig7M96L8Ejg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/android-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
-      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
+    "node_modules/@aws-sdk/credential-provider-env": {
+      "version": "3.972.34",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.34.tgz",
+      "integrity": "sha512-XT0jtf8Fw9JE6ppsQeoNnZRiG+jqRixMT1v1ZR17G60UvVdsQmTG8nbEyHuEPfMxDXEhfdARaM/XiEhca4lGHQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/android-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
-      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
+    "node_modules/@aws-sdk/credential-provider-http": {
+      "version": "3.972.36",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.36.tgz",
+      "integrity": "sha512-DPoGWfy7J7RKxvbf5kOKIGQkD2ek3dbKgzKIGrnLuvZBz5myU+Im/H6pmc14QcnFbqHMqxvtWSgRDSJW3qXLQg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-stream": "^4.5.25",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/android-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
-      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
+    "node_modules/@aws-sdk/credential-provider-ini": {
+      "version": "3.972.38",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.38.tgz",
+      "integrity": "sha512-oDzUBu2MGJFgoar05sPMCwSrhw44ASyccrHzj66vO69OZqi7I6hZZxXfuPLC8OCzW7C+sU+bI73XHij41yekgQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/credential-provider-env": "^3.972.34",
+        "@aws-sdk/credential-provider-http": "^3.972.36",
+        "@aws-sdk/credential-provider-login": "^3.972.38",
+        "@aws-sdk/credential-provider-process": "^3.972.34",
+        "@aws-sdk/credential-provider-sso": "^3.972.38",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.38",
+        "@aws-sdk/nested-clients": "^3.997.6",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/credential-provider-imds": "^4.2.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
-      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
+    "node_modules/@aws-sdk/credential-provider-login": {
+      "version": "3.972.38",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.38.tgz",
+      "integrity": "sha512-g1NosS8qe4OF++G2UFCM5ovSkgipC7YYor5KCWatG0UoMSO5YFj9C8muePlyVmOBV/WTI16Jo3/s1NUo/o1Bww==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/nested-clients": "^3.997.6",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
-      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
+    "node_modules/@aws-sdk/credential-provider-node": {
+      "version": "3.972.39",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.39.tgz",
+      "integrity": "sha512-HEswDQyxUtadoZ/bJsPPENHg7R0Lzym5LuMksJeHvqhCOpP+rtkDLKI4/ZChH4w3cf5kG8n6bZuI8PzajoiqMg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/credential-provider-env": "^3.972.34",
+        "@aws-sdk/credential-provider-http": "^3.972.36",
+        "@aws-sdk/credential-provider-ini": "^3.972.38",
+        "@aws-sdk/credential-provider-process": "^3.972.34",
+        "@aws-sdk/credential-provider-sso": "^3.972.38",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.38",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/credential-provider-imds": "^4.2.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
+    "node_modules/@aws-sdk/credential-provider-process": {
+      "version": "3.972.34",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.34.tgz",
+      "integrity": "sha512-T3IFs4EVmVi1dVN5RciFnklCANSzvrQd/VuHY9ThHSQmYkTogjcGkoJEr+oNUPQZnso52183088NqysMPji1/Q==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
-      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
+    "node_modules/@aws-sdk/credential-provider-sso": {
+      "version": "3.972.38",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.38.tgz",
+      "integrity": "sha512-5ZxG+t0+3Q3QPh8KEjX6syskhgNf7I0MN7oGioTf6Lm1NTjfP7sIcYGNsthXC2qR8vcD3edNZwCr2ovfSSWuRA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/nested-clients": "^3.997.6",
+        "@aws-sdk/token-providers": "3.1041.0",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
-      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/credential-provider-web-identity": {
+      "version": "3.972.38",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.38.tgz",
+      "integrity": "sha512-lYHFF30DGI20jZcYX8cm6Ns0V7f1dDN6g/MBDLTyD/5iw+bXs3yBr2iAiHDkx4RFU5JgsnZvCHYKiRVPRdmOgw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/nested-clients": "^3.997.6",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
-      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/middleware-bucket-endpoint": {
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.10.tgz",
+      "integrity": "sha512-Vbc2frZH7wXlMNd+ZZSXUEs/l1Sv8Jj4zUnIfwrYF5lwaLdXHZ9xx4U3rjUcaye3HRhFVc+E5DbBxpRAbB16BA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-arn-parser": "^3.972.3",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-config-provider": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
-      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/middleware-expect-continue": {
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-expect-continue/-/middleware-expect-continue-3.972.10.tgz",
+      "integrity": "sha512-2Yn0f1Qiq/DjxYR3wfI3LokXnjOhFM7Ssn4LTdFDIxRMCE6I32MAsVnhPX1cUZsuVA9tiZtwwhlSLAtFGxAZlQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
-      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/middleware-flexible-checksums": {
+      "version": "3.974.16",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.974.16.tgz",
+      "integrity": "sha512-6ru8doI0/XzszqLIPXf0E/V7HhAw1Pu94010XCKYtBUfD0LxF0BuOzrUf8OQGR6j2o6wgKTHUniOmndQycHwCA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/crc32": "5.2.0",
+        "@aws-crypto/crc32c": "5.2.0",
+        "@aws-crypto/util": "5.2.0",
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/crc64-nvme": "^3.972.7",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/is-array-buffer": "^4.2.2",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-stream": "^4.5.25",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
-      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
-      "cpu": [
-        "mips64el"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/middleware-host-header": {
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-host-header/-/middleware-host-header-3.972.10.tgz",
+      "integrity": "sha512-IJSsIMeVQ8MMCPbuh1AbltkFhLBLXn7aejzfX5YKT/VLDHn++Dcz8886tXckE+wQssyPUhaXrJhdakO2VilRhg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
-      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/middleware-location-constraint": {
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-location-constraint/-/middleware-location-constraint-3.972.10.tgz",
+      "integrity": "sha512-rI3NZvJcEvjoD0+0PI0iUAwlPw2IlSlhyvgBK/3WkKJQE/YiKFedd9dMN2lVacdNxPNhxL/jzQaKQdrGtQagjQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
-      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/middleware-logger": {
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-logger/-/middleware-logger-3.972.10.tgz",
+      "integrity": "sha512-OOuGvvz1Dm20SjZo5oEBePFqxt5nf8AwkNDSyUHvD9/bfNASmstcYxFAHUowy4n6Io7mWUZ04JURZwSBvyQanQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
-      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/@aws-sdk/middleware-recursion-detection": {
+      "version": "3.972.11",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-recursion-detection/-/middleware-recursion-detection-3.972.11.tgz",
+      "integrity": "sha512-+zz6f79Kj9V5qFK2P+D8Ehjnw4AhphAlCAsPjUqEcInA9umtSSKMrHbSagEeOIsDNuvVrH98bjRHcyQukTrhaQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@aws/lambda-invoke-store": "^0.2.2",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
+    "node_modules/@aws-sdk/middleware-sdk-s3": {
+      "version": "3.972.37",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.37.tgz",
+      "integrity": "sha512-Km7M+i8DrLArVzrid1gfxeGhYHBd3uxvE77g0s5a52zPSVosxzQBnJ0gwWb6NIp/DOk8gsBMhi7V+cpJG0ndTA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-arn-parser": "^3.972.3",
+        "@smithy/core": "^3.23.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/signature-v4": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-config-provider": "^4.2.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-stream": "^4.5.25",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
+    "node_modules/@aws-sdk/middleware-ssec": {
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-ssec/-/middleware-ssec-3.972.10.tgz",
+      "integrity": "sha512-Gli9A0u8EVVb+5bFDGS/QbSVg28w/wpEidg1ggVcSj65BDTdGR6punsOcVjqdiu1i42WHWo51MCvARPIIz9juw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
+    "node_modules/@aws-sdk/middleware-user-agent": {
+      "version": "3.972.38",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.972.38.tgz",
+      "integrity": "sha512-iz+B29TXcAZsJpwB+AwG/TTGA5l/VnmMZ2UxtiySOZjI6gCdmviXPwdgzcmuazMy16rXoPY4mYCGe7zdNKfx5A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.8",
+        "@smithy/core": "^3.23.17",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-retry": "^4.3.6",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
+    "node_modules/@aws-sdk/nested-clients": {
+      "version": "3.997.6",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.6.tgz",
+      "integrity": "sha512-WBDnqatJl+kGObpfmfSxqnXeYTu3Me8wx8WCtvoxX3pfWrrTv8I4WTMSSs7PZqcRcVh8WeUKMgGFjMG+52SR1w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/sha256-browser": "5.2.0",
+        "@aws-crypto/sha256-js": "5.2.0",
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/middleware-host-header": "^3.972.10",
+        "@aws-sdk/middleware-logger": "^3.972.10",
+        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
+        "@aws-sdk/middleware-user-agent": "^3.972.38",
+        "@aws-sdk/region-config-resolver": "^3.972.13",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.25",
+        "@aws-sdk/types": "^3.973.8",
+        "@aws-sdk/util-endpoints": "^3.996.8",
+        "@aws-sdk/util-user-agent-browser": "^3.972.10",
+        "@aws-sdk/util-user-agent-node": "^3.973.24",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/core": "^3.23.17",
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/hash-node": "^4.2.14",
+        "@smithy/invalid-dependency": "^4.2.14",
+        "@smithy/middleware-content-length": "^4.2.14",
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/middleware-retry": "^4.5.7",
+        "@smithy/middleware-serde": "^4.2.20",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-base64": "^4.3.2",
+        "@smithy/util-body-length-browser": "^4.2.2",
+        "@smithy/util-body-length-node": "^4.2.3",
+        "@smithy/util-defaults-mode-browser": "^4.3.49",
+        "@smithy/util-defaults-mode-node": "^4.2.54",
+        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.6",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
-      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
+    "node_modules/@aws-sdk/region-config-resolver": {
+      "version": "3.972.13",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/region-config-resolver/-/region-config-resolver-3.972.13.tgz",
+      "integrity": "sha512-CvJ2ZIjK/jVD/lbOpowBVElJyC1YxLTIJ13yM0AEo0t2v7swOzGjSA6lJGH+DwZXQhcjUjoYwc8bVYCX5MDr1A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
-      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
+    "node_modules/@aws-sdk/signature-v4-multi-region": {
+      "version": "3.996.25",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.25.tgz",
+      "integrity": "sha512-+CMIt3e1VzlklAECmG+DtP1sV8iKq25FuA0OKpnJ4KA0kxUtd7CgClY7/RU6VzJBQwbN4EJ9Ue6plvqx1qGadw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/middleware-sdk-s3": "^3.972.37",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/signature-v4": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
-      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+    "node_modules/@aws-sdk/token-providers": {
+      "version": "3.1041.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1041.0.tgz",
+      "integrity": "sha512-Th7kPI6YPtvJUcdznooXJMy+9rQWjmEF81LxaJssngBzuysK4a/x+l8kjm1zb7nYsUPbndnBdUnwng/3PLvtGw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.8",
+        "@aws-sdk/nested-clients": "^3.997.6",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
-      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+    "node_modules/@aws-sdk/types": {
+      "version": "3.973.8",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.8.tgz",
+      "integrity": "sha512-gjlAdtHMbtR9X5iIhVUvbVcy55KnznpC6bkDUWW9z915bi0ckdUr5cjf16Kp6xq0bP5HBD2xzgbL9F9Quv5vUw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@esbuild/win32-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
-      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+    "node_modules/@aws-sdk/util-arn-parser": {
+      "version": "3.972.3",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-arn-parser/-/util-arn-parser-3.972.3.tgz",
+      "integrity": "sha512-HzSD8PMFrvgi2Kserxuff5VitNq2sgf3w9qxmskKDiDTThWfVteJxuCS9JXiPIPtmCrp+7N9asfIaVhBFORllA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
-      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/@aws-sdk/util-endpoints": {
+      "version": "3.996.8",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.8.tgz",
+      "integrity": "sha512-oOZHcRDihk5iEe5V25NVWg45b3qEA8OpHWVdU/XQh8Zj4heVPAJqWvMphQnU7LkufmUo10EpvFPZuQMiFLJK3g==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "eslint-visitor-keys": "^3.4.3"
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-endpoints": "^3.4.2",
+        "tslib": "^2.6.2"
       },
       "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
-      "dev": true,
+    "node_modules/@aws-sdk/util-locate-window": {
+      "version": "3.965.5",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-locate-window/-/util-locate-window-3.965.5.tgz",
+      "integrity": "sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ==",
       "license": "Apache-2.0",
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      "dependencies": {
+        "tslib": "^2.6.2"
       },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@eslint-community/regexpp": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
+    "node_modules/@aws-sdk/util-user-agent-browser": {
+      "version": "3.972.10",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-browser/-/util-user-agent-browser-3.972.10.tgz",
+      "integrity": "sha512-FAzqXvfEssGdSIz8ejatan0bOdx1qefBWKF/gWmVBXIP1HkS7v/wjjaqrAGGKvyihrXTXW00/2/1nTJtxpXz7g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/types": "^4.14.1",
+        "bowser": "^2.11.0",
+        "tslib": "^2.6.2"
       }
     },
-    "node_modules/@eslint/compat": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.0.2.tgz",
-      "integrity": "sha512-pR1DoD0h3HfF675QZx0xsyrsU8q70Z/plx7880NOhS02NuWLgBCOMDL787nUeQ7EWLkxv3bPQJaarjcPQb2Dwg==",
-      "dev": true,
+    "node_modules/@aws-sdk/util-user-agent-node": {
+      "version": "3.973.24",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.973.24.tgz",
+      "integrity": "sha512-ZWwlkjcIp7cEL8ZfTpTAPNkwx25p7xol0xlKoWVVf22+nsjwmLcHYtTPjIV1cSpmB/b6DaK4cb1fSkvCXHgRdw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^1.1.0"
+        "@aws-sdk/middleware-user-agent": "^3.972.38",
+        "@aws-sdk/types": "^3.973.8",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-config-provider": "^4.2.2",
+        "tslib": "^2.6.2"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": ">=20.0.0"
       },
       "peerDependencies": {
-        "eslint": "^8.40 || 9 || 10"
+        "aws-crt": ">=1.0.0"
       },
       "peerDependenciesMeta": {
-        "eslint": {
+        "aws-crt": {
           "optional": true
         }
       }
     },
-    "node_modules/@eslint/config-array": {
-      "version": "0.21.1",
-      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",
-      "integrity": "sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==",
-      "dev": true,
+    "node_modules/@aws-sdk/xml-builder": {
+      "version": "3.972.22",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.22.tgz",
+      "integrity": "sha512-PMYKKtJd70IsSG0yHrdAbxBr+ZWBKLvzFZfD3/urxgf6hXVMzuU5M+3MJ5G67RpOmLBu1fAUN65SbWuKUCOlAA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/object-schema": "^2.1.7",
-        "debug": "^4.3.1",
-        "minimatch": "^3.1.2"
+        "@nodable/entities": "2.1.0",
+        "@smithy/types": "^4.14.1",
+        "fast-xml-parser": "5.7.2",
+        "tslib": "^2.6.2"
       },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@eslint/config-helpers": {
-      "version": "0.4.2",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
-      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
-      "dev": true,
+    "node_modules/@aws/lambda-invoke-store": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/@aws/lambda-invoke-store/-/lambda-invoke-store-0.2.4.tgz",
+      "integrity": "sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.17.0"
-      },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/@eslint/config-helpers/node_modules/@eslint/core": {
-      "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
+    "node_modules/@babel/runtime": {
+      "version": "7.28.6",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
+      "integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
       "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
+      "license": "MIT",
+      "optional": true,
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=6.9.0"
       }
     },
-    "node_modules/@eslint/core": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
-      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
-      "dev": true,
+    "node_modules/@better-auth/utils": {
+      "version": "0.3.1",
+      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
+      "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
+      "license": "MIT"
+    },
+    "node_modules/@better-fetch/fetch": {
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.1.21.tgz",
+      "integrity": "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="
+    },
+    "node_modules/@chevrotain/cst-dts-gen": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-10.5.0.tgz",
+      "integrity": "sha512-lhmC/FyqQ2o7pGK4Om+hzuDrm9rhFYIJ/AXoQBeongmn870Xeb0L6oGEiuR8nohFNL5sMaQEJWCxr1oIVIVXrw==",
       "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "@chevrotain/gast": "10.5.0",
+        "@chevrotain/types": "10.5.0",
+        "lodash": "4.17.21"
       }
     },
-    "node_modules/@eslint/css-tree": {
-      "version": "3.6.9",
-      "resolved": "https://registry.npmjs.org/@eslint/css-tree/-/css-tree-3.6.9.tgz",
-      "integrity": "sha512-3D5/OHibNEGk+wKwNwMbz63NMf367EoR4mVNNpxddCHKEb2Nez7z62J2U6YjtErSsZDoY0CsccmoUpdEbkogNA==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/@chevrotain/gast": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-10.5.0.tgz",
+      "integrity": "sha512-pXdMJ9XeDAbgOWKuD1Fldz4ieCs6+nLNmyVhe2gZVqoO7v8HXuHYs5OV2EzUtbuai37TlOAQHrTDvxMnvMJz3A==",
+      "license": "Apache-2.0",
+      "peer": true,
       "dependencies": {
-        "mdn-data": "2.23.0",
-        "source-map-js": "^1.0.1"
-      },
-      "engines": {
-        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
+        "@chevrotain/types": "10.5.0",
+        "lodash": "4.17.21"
       }
     },
-    "node_modules/@eslint/eslintrc": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.3.tgz",
-      "integrity": "sha512-Kr+LPIUVKz2qkx1HAMH8q1q6azbqBAsXJUxBl/ODDuVPX45Z9DfwB8tPjTi6nNZ8BuM3nbJxC5zCAg5elnBUTQ==",
+    "node_modules/@chevrotain/types": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-10.5.0.tgz",
+      "integrity": "sha512-f1MAia0x/pAVPWH/T73BJVyO2XU5tI4/iE7cnxb7tqdNTNhQI3Uq3XkqcoteTmD4t1aM0LbHCJOhgIDn07kl2A==",
+      "license": "Apache-2.0",
+      "peer": true
+    },
+    "node_modules/@chevrotain/utils": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-10.5.0.tgz",
+      "integrity": "sha512-hBzuU5+JjB2cqNZyszkDHZgOSrUUT8V3dhgRl8Q9Gp6dAj/H5+KILGjbhDpc3Iy9qmqlm/akuOI2ut9VUtzJxQ==",
+      "license": "Apache-2.0",
+      "peer": true
+    },
+    "node_modules/@cyclonedx/cyclonedx-npm": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-4.2.1.tgz",
+      "integrity": "sha512-SOA/96sf0wsgUYCRtFkLFm6WoFhG+q1BxdC84hPSn9J3xWlH1e7OnTPJT+WNUzTqzX1nSm5JhjRX4krozu2X+g==",
       "dev": true,
-      "license": "MIT",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        }
+      ],
+      "license": "Apache-2.0",
       "dependencies": {
-        "ajv": "^6.12.4",
-        "debug": "^4.3.2",
-        "espree": "^10.0.1",
-        "globals": "^14.0.0",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.1",
-        "minimatch": "^3.1.2",
-        "strip-json-comments": "^3.1.1"
+        "@cyclonedx/cyclonedx-library": "^10.0.0",
+        "commander": "^14.0.0",
+        "normalize-package-data": "^7.0.0 || ^8.0.0",
+        "packageurl-js": "^2.0.1",
+        "spdx-expression-parse": "^3.0.1 || ^4.0.0",
+        "xmlbuilder2": "^3.0.2 || ^4.0.3"
+      },
+      "bin": {
+        "cyclonedx-npm": "bin/cyclonedx-npm-cli.js"
       },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=20.18.0",
+        "npm": ">=9"
       },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+      "optionalDependencies": {
+        "ajv": "^8.12.0",
+        "ajv-formats": "^3.0.1",
+        "ajv-formats-draft2019": "^1.6.1",
+        "libxmljs2": "^0.35||^0.37"
       }
     },
-    "node_modules/@eslint/eslintrc/node_modules/globals": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
-      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/@cyclonedx/cyclonedx-library": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-library/-/cyclonedx-library-10.0.0.tgz",
+      "integrity": "sha512-xDXf2eqzeFHdjamj6oBV3duRSfrlmsJ5+2z9tXp7q5qxJP5Awmjf4ABSutS4qkVHHj7JzKFL/EM0V0Nihc7zPg==",
       "dev": true,
-      "license": "MIT",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        }
+      ],
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">=18"
+        "node": ">=20.18.0"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "peerDependencies": {
+        "ajv": "^8.12.0",
+        "ajv-formats": "^3.0.1",
+        "ajv-formats-draft2019": "^1.6.1",
+        "libxmljs2": "^0.35||^0.37",
+        "packageurl-js": "*",
+        "spdx-expression-parse": "*",
+        "xmlbuilder2": "^3.0.2||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        },
+        "ajv-formats": {
+          "optional": true
+        },
+        "ajv-formats-draft2019": {
+          "optional": true
+        },
+        "libxmljs2": {
+          "optional": true
+        },
+        "packageurl-js": {
+          "optional": true
+        },
+        "spdx-expression-parse": {
+          "optional": true
+        },
+        "xmlbuilder2": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@eslint/js": {
-      "version": "9.39.2",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.2.tgz",
-      "integrity": "sha512-q1mjIoW1VX4IvSocvM/vbTiveKC4k9eLrajNEuSsmjymSDEbpGddtpfOoN7YGAqBK3NG+uqo8ia4PDTt8buCYA==",
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      "optional": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
       },
       "funding": {
-        "url": "https://eslint.org/donate"
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/@eslint/object-schema": {
-      "version": "2.1.7",
-      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
-      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/commander": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=20"
       }
     },
-    "node_modules/@eslint/plugin-kit": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
-      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
       "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/@electric-sql/pglite": {
+      "version": "0.3.15",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.3.15.tgz",
+      "integrity": "sha512-Cj++n1Mekf9ETfdc16TlDi+cDDQF0W7EcbyRHYOAeZdsAe8M/FJg18itDTSwyHfar2WIezawM9o0EKaRGVKygQ==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.17.0",
-        "levn": "^0.4.1"
+      "peer": true
+    },
+    "node_modules/@electric-sql/pglite-socket": {
+      "version": "0.0.20",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.0.20.tgz",
+      "integrity": "sha512-J5nLGsicnD9wJHnno9r+DGxfcZWh+YJMCe0q/aCgtG6XOm9Z7fKeite8IZSNXgZeGltSigM9U/vAWZQWdgcSFg==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "bin": {
+        "pglite-server": "dist/scripts/server.js"
       },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      "peerDependencies": {
+        "@electric-sql/pglite": "0.3.15"
       }
     },
-    "node_modules/@eslint/plugin-kit/node_modules/@eslint/core": {
-      "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
-      "dev": true,
+    "node_modules/@electric-sql/pglite-tools": {
+      "version": "0.2.20",
+      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.2.20.tgz",
+      "integrity": "sha512-BK50ZnYa3IG7ztXhtgYf0Q7zijV32Iw1cYS8C+ThdQlwx12V5VZ9KRJ42y82Hyb4PkTxZQklVQA9JHyUlex33A==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      "peer": true,
+      "peerDependencies": {
+        "@electric-sql/pglite": "0.3.15"
       }
     },
-    "node_modules/@exodus/schemasafe": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@exodus/schemasafe/-/schemasafe-1.3.0.tgz",
-      "integrity": "sha512-5Aap/GaRupgNx/feGBwLLTVv8OQFfv3pq2lPRzPg9R+IOBnDgghTGW7l7EuVXOvg5cc/xSAlRW8rBrjIC3Nvqw==",
+    "node_modules/@emnapi/core": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.9.0.tgz",
+      "integrity": "sha512-0DQ98G9ZQZOxfUcQn1waV2yS8aWdZ6kJMbYCJB3oUBecjWYO1fqJ+a1DRfPF3O5JEkwqwP1A9QEN/9mYm2Yd0w==",
       "dev": true,
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.0",
+        "tslib": "^2.4.0"
+      }
     },
-    "node_modules/@hapi/hoek": {
-      "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
-      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
+    "node_modules/@emnapi/runtime": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.9.0.tgz",
+      "integrity": "sha512-QN75eB0IH2ywSpRpNddCRfQIhmJYBCJ1x5Lb3IscKAL8bMnVAKnRg8dCoXbHzVLLH7P38N2Z3mtulB7W0J0FKw==",
       "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
     },
-    "node_modules/@hapi/topo": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
-      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
+    "node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.0.tgz",
+      "integrity": "sha512-N10dEJNSsUx41Z6pZsXU8FjPjpBEplgH24sfkmITrBED1/U2Esum9F3lfLrMjKHHjmi557zQn7kR9R+XWXu5Rg==",
       "dev": true,
-      "license": "BSD-3-Clause",
+      "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@hapi/hoek": "^9.0.0"
+        "tslib": "^2.4.0"
       }
     },
-    "node_modules/@hono/node-server": {
-      "version": "1.19.9",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
-      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
+      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "cpu": [
+        "ppc64"
+      ],
       "license": "MIT",
-      "peer": true,
+      "optional": true,
+      "os": [
+        "aix"
+      ],
       "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
+      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=18.18.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@humanfs/core": "^0.19.1",
-        "@humanwhocodes/retry": "^0.4.0"
-      },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
+      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=18.18.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanwhocodes/module-importer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
+      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=12.22"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanwhocodes/retry": {
-      "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
-      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
+      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=18.18"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "node": ">=18"
       }
     },
-    "node_modules/@iconify/svelte": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/@iconify/svelte/-/svelte-5.2.1.tgz",
-      "integrity": "sha512-zHmsIPmnIhGd5gc95bNN5FL+GifwMZv7M2rlZEpa7IXYGFJm/XGHdWf6PWQa6OBoC+R69WyiPO9NAj5wjfjbow==",
-      "dev": true,
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
+      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@iconify/types": "^2.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/cyberalien"
-      },
-      "peerDependencies": {
-        "svelte": ">5.0.0"
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@iconify/types": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
-      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/@inlang/paraglide-js": {
-      "version": "2.12.0",
-      "resolved": "https://registry.npmjs.org/@inlang/paraglide-js/-/paraglide-js-2.12.0.tgz",
-      "integrity": "sha512-wnqTeSLcMMS2usL8zjS8bDGs9r16X00aeoGk2wVAnPfAgCChYalKdG20pS2XtJVMM1H6nBBBLKt3ZQMnKrusKQ==",
-      "dev": true,
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
+      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@inlang/recommend-sherlock": "^0.2.1",
-        "@inlang/sdk": "^2.7.0",
-        "commander": "11.1.0",
-        "consola": "3.4.0",
-        "json5": "2.2.3",
-        "unplugin": "^2.1.2",
-        "urlpattern-polyfill": "^10.0.0"
-      },
-      "bin": {
-        "paraglide-js": "bin/run.js"
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@inlang/recommend-sherlock": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@inlang/recommend-sherlock/-/recommend-sherlock-0.2.1.tgz",
-      "integrity": "sha512-ckv8HvHy/iTqaVAEKrr+gnl+p3XFNwe5D2+6w6wJk2ORV2XkcRkKOJ/XsTUJbPSiyi4PI+p+T3bqbmNx/rDUlg==",
-      "dev": true,
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
+      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "cpu": [
+        "arm"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "comment-json": "^4.2.3"
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@inlang/sdk": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@inlang/sdk/-/sdk-2.7.0.tgz",
-      "integrity": "sha512-yJNBD0o8i29TTJqWX5uDRHxnalDGcsUDctxepzFXsUfkzqGWfiFBxODdxvReqvM2CuKAAOo/kib/F1UcgdYFNQ==",
-      "dev": true,
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
+      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@lix-js/sdk": "0.4.7",
-        "@sinclair/typebox": "^0.31.17",
-        "kysely": "^0.27.4",
-        "sqlite-wasm-kysely": "0.3.0",
-        "uuid": "^13.0.0"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@internationalized/date": {
-      "version": "3.11.0",
-      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.11.0.tgz",
-      "integrity": "sha512-BOx5huLAWhicM9/ZFs84CzP+V3gBW6vlpM02yzsdYC7TGlZJX1OJiEEHcSayF00Z+3jLlm4w79amvSt6RqKN3Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
-      }
-    },
-    "node_modules/@isaacs/cliui": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
+      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "string-width": "^5.1.2",
-        "string-width-cjs": "npm:string-width@^4.2.0",
-        "strip-ansi": "^7.0.1",
-        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
-        "wrap-ansi": "^8.1.0",
-        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
-    "node_modules/@isaacs/fs-minipass": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
-      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
+      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "minipass": "^7.0.4"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "devOptional": true,
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
+      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "cpu": [
+        "mips64el"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@jridgewell/trace-mapping": "^0.3.24"
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@jridgewell/remapping": {
-      "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "devOptional": true,
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
+      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "cpu": [
+        "ppc64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "devOptional": true,
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
+      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "cpu": [
+        "riscv64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=6.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "devOptional": true,
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
+      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "cpu": [
+        "s390x"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
-      }
-    },
-    "node_modules/@lix-js/sdk": {
-      "version": "0.4.7",
-      "resolved": "https://registry.npmjs.org/@lix-js/sdk/-/sdk-0.4.7.tgz",
-      "integrity": "sha512-pRbW+joG12L0ULfMiWYosIW0plmW4AsUdiPCp+Z8rAsElJ+wJ6in58zhD3UwUcd4BNcpldEGjg6PdA7e0RgsDQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@lix-js/server-protocol-schema": "0.1.1",
-        "dedent": "1.5.1",
-        "human-id": "^4.1.1",
-        "js-sha256": "^0.11.0",
-        "kysely": "^0.27.4",
-        "sqlite-wasm-kysely": "0.3.0",
-        "uuid": "^10.0.0"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">=18"
       }
     },
-    "node_modules/@lix-js/sdk/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
-      "dev": true,
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "cpu": [
+        "arm64"
       ],
       "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@lix-js/server-protocol-schema": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/@lix-js/server-protocol-schema/-/server-protocol-schema-0.1.1.tgz",
-      "integrity": "sha512-jBeALB6prAbtr5q4vTuxnRZZv1M2rKe8iNqRQhFJ4Tv7150unEa0vKyz0hs8Gl3fUGsWaNJBh3J8++fpbrpRBQ==",
-      "dev": true,
-      "license": "Apache-2.0"
-    },
-    "node_modules/@mongodb-js/saslprep": {
-      "version": "1.4.6",
-      "resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.4.6.tgz",
-      "integrity": "sha512-y+x3H1xBZd38n10NZF/rEBlvDOOMQ6LKUTHqr8R9VkJ+mmQOYtJFxIlkkK8fZrtOiL6VixbOBWMbZGBdal3Z1g==",
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "sparse-bitfield": "^3.0.3"
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@mrleebo/prisma-ast": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/@mrleebo/prisma-ast/-/prisma-ast-0.13.1.tgz",
-      "integrity": "sha512-XyroGQXcHrZdvmrGJvsA9KNeOOgGMg1Vg9OlheUsBOSKznLMDl+YChxbkboRHvtFYJEMRYmlV3uoo/njCw05iw==",
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
+      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "chevrotain": "^10.5.0",
-        "lilconfig": "^2.1.0"
-      },
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
       "engines": {
-        "node": ">=16"
+        "node": ">=18"
       }
     },
-    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
-      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
-      "dev": true,
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
+      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "@emnapi/core": "^1.4.3",
-        "@emnapi/runtime": "^1.4.3",
-        "@tybys/wasm-util": "^0.10.0"
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@noble/ciphers": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.1.1.tgz",
-      "integrity": "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
-    "node_modules/@noble/hashes": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.0.1.tgz",
-      "integrity": "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==",
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
+      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
       "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+        "node": ">=18"
       }
     },
-    "node_modules/@npmcli/agent": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
-      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
+      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.1",
-        "lru-cache": "^10.0.1",
-        "socks-proxy-agent": "^8.0.3"
-      },
+      "os": [
+        "sunos"
+      ],
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@npmcli/fs": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
-      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
+      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "semver": "^7.3.5"
-      },
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@oozcitak/dom": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz",
-      "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==",
-      "dev": true,
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
+      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
+      "cpu": [
+        "ia32"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@oozcitak/infra": "^2.0.2",
-        "@oozcitak/url": "^3.0.0",
-        "@oozcitak/util": "^10.0.0"
-      },
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=20.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@oozcitak/infra": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz",
-      "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==",
-      "dev": true,
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.27.3",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
+      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@oozcitak/util": "^10.0.0"
-      },
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=20.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@oozcitak/url": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz",
-      "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==",
+    "node_modules/@eslint-community/eslint-utils": {
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
+      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oozcitak/infra": "^2.0.2",
-        "@oozcitak/util": "^10.0.0"
+        "eslint-visitor-keys": "^3.4.3"
       },
       "engines": {
-        "node": ">=20.0"
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
       }
     },
-    "node_modules/@oozcitak/util": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz",
-      "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==",
+    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.0"
-      }
-    },
-    "node_modules/@opentelemetry/api": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
-      "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
       "license": "Apache-2.0",
       "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@pinojs/redact": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
-      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
-      "license": "MIT"
-    },
-    "node_modules/@pkgjs/parseargs": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=14"
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/@pkgr/core": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
-      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
+    "node_modules/@eslint-community/regexpp": {
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/pkgr"
+        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
       }
     },
-    "node_modules/@playwright/test": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
-      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+    "node_modules/@eslint/compat": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.0.2.tgz",
+      "integrity": "sha512-pR1DoD0h3HfF675QZx0xsyrsU8q70Z/plx7880NOhS02NuWLgBCOMDL787nUeQ7EWLkxv3bPQJaarjcPQb2Dwg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.58.2"
-      },
-      "bin": {
-        "playwright": "cli.js"
+        "@eslint/core": "^1.1.0"
       },
       "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@polka/url": {
-      "version": "1.0.0-next.29",
-      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
-      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
-      "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/@poppinss/macroable": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@poppinss/macroable/-/macroable-1.1.0.tgz",
-      "integrity": "sha512-y/YKzZDuG8XrpXpM7Z1RdQpiIc0MAKyva24Ux1PB4aI7RiSI/79K8JVDcdyubriTm7vJ1LhFs8CrZpmPnx/8Pw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/@prisma/client": {
-      "version": "5.22.0",
-      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-5.22.0.tgz",
-      "integrity": "sha512-M0SVXfyHnQREBKxCgyo7sffrKttwE6R8PMq330MIUF0pTwjUhLbW84pFDlf06B27XyCR++VtjugEnIHdr07SVA==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "peer": true,
-      "engines": {
-        "node": ">=16.13"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       },
       "peerDependencies": {
-        "prisma": "*"
+        "eslint": "^8.40 || 9 || 10"
       },
       "peerDependenciesMeta": {
-        "prisma": {
+        "eslint": {
           "optional": true
         }
       }
     },
-    "node_modules/@prisma/config": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.4.2.tgz",
-      "integrity": "sha512-CftBjWxav99lzY1Z4oDgomdb1gh9BJFAOmWF6P2v1xRfXqQb56DfBub+QKcERRdNoAzCb3HXy3Zii8Vb4AsXhg==",
+    "node_modules/@eslint/config-array": {
+      "version": "0.21.1",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",
+      "integrity": "sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==",
+      "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "c12": "3.1.0",
-        "deepmerge-ts": "7.1.5",
-        "effect": "3.18.4",
-        "empathic": "2.0.0"
+        "@eslint/object-schema": "^2.1.7",
+        "debug": "^4.3.1",
+        "minimatch": "^3.1.2"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@prisma/config/node_modules/c12": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/c12/-/c12-3.1.0.tgz",
-      "integrity": "sha512-uWoS8OU1MEIsOv8p/5a82c3H31LsWVR5qiyXVfBNOzfffjUWtPnhAb4BYI2uG2HfGmZmFjCtui5XNWaps+iFuw==",
-      "license": "MIT",
-      "peer": true,
+    "node_modules/@eslint/config-helpers": {
+      "version": "0.4.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
+      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
+      "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "chokidar": "^4.0.3",
-        "confbox": "^0.2.2",
-        "defu": "^6.1.4",
-        "dotenv": "^16.6.1",
-        "exsolve": "^1.0.7",
-        "giget": "^2.0.0",
-        "jiti": "^2.4.2",
-        "ohash": "^2.0.11",
-        "pathe": "^2.0.3",
-        "perfect-debounce": "^1.0.0",
-        "pkg-types": "^2.2.0",
-        "rc9": "^2.1.2"
-      },
-      "peerDependencies": {
-        "magicast": "^0.3.5"
+        "@eslint/core": "^0.17.0"
       },
-      "peerDependenciesMeta": {
-        "magicast": {
-          "optional": true
-        }
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@prisma/config/node_modules/dotenv": {
-      "version": "16.6.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
-      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
-      "license": "BSD-2-Clause",
-      "peer": true,
+    "node_modules/@eslint/config-helpers/node_modules/@eslint/core": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
+      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
       "engines": {
-        "node": ">=12"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      }
+    },
+    "node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
       },
-      "funding": {
-        "url": "https://dotenvx.com"
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       }
     },
-    "node_modules/@prisma/config/node_modules/effect": {
-      "version": "3.18.4",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-3.18.4.tgz",
-      "integrity": "sha512-b1LXQJLe9D11wfnOKAk3PKxuqYshQ0Heez+y5pnkd3jLj1yx9QhM72zZ9uUrOQyNvrs2GZZd/3maL0ZV18YuDA==",
+    "node_modules/@eslint/css-tree": {
+      "version": "3.6.9",
+      "resolved": "https://registry.npmjs.org/@eslint/css-tree/-/css-tree-3.6.9.tgz",
+      "integrity": "sha512-3D5/OHibNEGk+wKwNwMbz63NMf367EoR4mVNNpxddCHKEb2Nez7z62J2U6YjtErSsZDoY0CsccmoUpdEbkogNA==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
-        "fast-check": "^3.23.1"
+        "mdn-data": "2.23.0",
+        "source-map-js": "^1.0.1"
+      },
+      "engines": {
+        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
       }
     },
-    "node_modules/@prisma/config/node_modules/perfect-debounce": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
-      "integrity": "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==",
+    "node_modules/@eslint/eslintrc": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.3.tgz",
+      "integrity": "sha512-Kr+LPIUVKz2qkx1HAMH8q1q6azbqBAsXJUxBl/ODDuVPX45Z9DfwB8tPjTi6nNZ8BuM3nbJxC5zCAg5elnBUTQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@prisma/debug": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.4.2.tgz",
-      "integrity": "sha512-aP7qzu+g/JnbF6U69LMwHoUkELiserKmWsE2shYuEpNUJ4GrtxBCvZwCyCBHFSH2kLTF2l1goBlBh4wuvRq62w==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/@prisma/dev": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.20.0.tgz",
-      "integrity": "sha512-ovlBYwWor0OzG+yH4J3Ot+AneD818BttLA+Ii7wjbcLHUrnC4tbUPVGyNd3c/+71KETPKZfjhkTSpdS15dmXNQ==",
-      "license": "ISC",
-      "peer": true,
       "dependencies": {
-        "@electric-sql/pglite": "0.3.15",
-        "@electric-sql/pglite-socket": "0.0.20",
-        "@electric-sql/pglite-tools": "0.2.20",
-        "@hono/node-server": "1.19.9",
-        "@mrleebo/prisma-ast": "0.13.1",
-        "@prisma/get-platform": "7.2.0",
-        "@prisma/query-plan-executor": "7.2.0",
-        "foreground-child": "3.3.1",
-        "get-port-please": "3.2.0",
-        "hono": "4.11.4",
-        "http-status-codes": "2.3.0",
-        "pathe": "2.0.3",
-        "proper-lockfile": "4.1.2",
-        "remeda": "2.33.4",
-        "std-env": "3.10.0",
-        "valibot": "1.2.0",
-        "zeptomatch": "2.1.0"
+        "ajv": "^6.12.4",
+        "debug": "^4.3.2",
+        "espree": "^10.0.1",
+        "globals": "^14.0.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.1",
+        "minimatch": "^3.1.2",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/@prisma/engines": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.4.2.tgz",
-      "integrity": "sha512-B+ZZhI4rXlzjVqRw/93AothEKOU5/x4oVyJFGo9RpHPnBwaPwk4Pi0Q4iGXipKxeXPs/dqljgNBjK0m8nocOJA==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@prisma/debug": "7.4.2",
-        "@prisma/engines-version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
-        "@prisma/fetch-engine": "7.4.2",
-        "@prisma/get-platform": "7.4.2"
+    "node_modules/@eslint/eslintrc/node_modules/globals": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@prisma/engines-version": {
-      "version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
-      "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919.tgz",
-      "integrity": "sha512-5FIKY3KoYQlBuZC2yc16EXfVRQ8HY+fLqgxkYfWCtKhRb3ajCRzP/rPeoSx11+NueJDANdh4hjY36mdmrTcGSg==",
-      "license": "Apache-2.0",
-      "peer": true
+    "node_modules/@eslint/js": {
+      "version": "9.39.2",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.2.tgz",
+      "integrity": "sha512-q1mjIoW1VX4IvSocvM/vbTiveKC4k9eLrajNEuSsmjymSDEbpGddtpfOoN7YGAqBK3NG+uqo8ia4PDTt8buCYA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      }
     },
-    "node_modules/@prisma/engines/node_modules/@prisma/get-platform": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.4.2.tgz",
-      "integrity": "sha512-UTnChXRwiauzl/8wT4hhe7Xmixja9WE28oCnGpBtRejaHhvekx5kudr3R4Y9mLSA0kqGnAMeyTiKwDVMjaEVsw==",
+    "node_modules/@eslint/object-schema": {
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
+      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
+      "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@prisma/debug": "7.4.2"
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@prisma/fetch-engine": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.4.2.tgz",
-      "integrity": "sha512-f/c/MwYpdJO7taLETU8rahEstLeXfYgQGlz5fycG7Fbmva3iPdzGmjiSWHeSWIgNnlXnelUdCJqyZnFocurZuA==",
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
+      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
+      "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@prisma/debug": "7.4.2",
-        "@prisma/engines-version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
-        "@prisma/get-platform": "7.4.2"
+        "@eslint/core": "^0.17.0",
+        "levn": "^0.4.1"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@prisma/fetch-engine/node_modules/@prisma/get-platform": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.4.2.tgz",
-      "integrity": "sha512-UTnChXRwiauzl/8wT4hhe7Xmixja9WE28oCnGpBtRejaHhvekx5kudr3R4Y9mLSA0kqGnAMeyTiKwDVMjaEVsw==",
+    "node_modules/@eslint/plugin-kit/node_modules/@eslint/core": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
+      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
+      "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@prisma/debug": "7.4.2"
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@prisma/get-platform": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.2.0.tgz",
-      "integrity": "sha512-k1V0l0Td1732EHpAfi2eySTezyllok9dXb6UQanajkJQzPUGi3vO2z7jdkz67SypFTdmbnyGYxvEvYZdZsMAVA==",
-      "license": "Apache-2.0",
-      "peer": true,
+    "node_modules/@exodus/schemasafe": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@exodus/schemasafe/-/schemasafe-1.3.0.tgz",
+      "integrity": "sha512-5Aap/GaRupgNx/feGBwLLTVv8OQFfv3pq2lPRzPg9R+IOBnDgghTGW7l7EuVXOvg5cc/xSAlRW8rBrjIC3Nvqw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/@hapi/hoek": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
+      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
+    "node_modules/@hapi/topo": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
+      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true,
       "dependencies": {
-        "@prisma/debug": "7.2.0"
+        "@hapi/hoek": "^9.0.0"
       }
     },
-    "node_modules/@prisma/get-platform/node_modules/@prisma/debug": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.2.0.tgz",
-      "integrity": "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/@prisma/query-plan-executor": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/@prisma/query-plan-executor/-/query-plan-executor-7.2.0.tgz",
-      "integrity": "sha512-EOZmNzcV8uJ0mae3DhTsiHgoNCuu1J9mULQpGCh62zN3PxPTd+qI9tJvk5jOst8WHKQNwJWR3b39t0XvfBB0WQ==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/@prisma/studio-core": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.13.1.tgz",
-      "integrity": "sha512-agdqaPEePRHcQ7CexEfkX1RvSH9uWDb6pXrZnhCRykhDFAV0/0P3d07WtfiY8hZWb7oRU4v+NkT4cGFHkQJIPg==",
-      "license": "Apache-2.0",
+    "node_modules/@hono/node-server": {
+      "version": "1.19.9",
+      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
+      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
+      "license": "MIT",
       "peer": true,
+      "engines": {
+        "node": ">=18.14.1"
+      },
       "peerDependencies": {
-        "@types/react": "^18.0.0 || ^19.0.0",
-        "react": "^18.0.0 || ^19.0.0",
-        "react-dom": "^18.0.0 || ^19.0.0"
+        "hono": "^4"
       }
     },
-    "node_modules/@rollup/plugin-commonjs": {
-      "version": "29.0.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-29.0.0.tgz",
-      "integrity": "sha512-U2YHaxR2cU/yAiwKJtJRhnyLk7cifnQw0zUpISsocBDoHDJn+HTV74ABqnwr5bEgWUwFZC9oFL6wLe21lHu5eQ==",
+    "node_modules/@humanfs/core": {
+      "version": "0.19.1",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
+      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
       "dev": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanfs/node": {
+      "version": "0.16.7",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
+      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "@rollup/pluginutils": "^5.0.1",
-        "commondir": "^1.0.1",
-        "estree-walker": "^2.0.2",
-        "fdir": "^6.2.0",
-        "is-reference": "1.2.1",
-        "magic-string": "^0.30.3",
-        "picomatch": "^4.0.2"
+        "@humanfs/core": "^0.19.1",
+        "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
-        "node": ">=16.0.0 || 14 >= 14.17"
+        "node": ">=18.18.0"
+      }
+    },
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.22"
       },
-      "peerDependencies": {
-        "rollup": "^2.68.0||^3.0.0||^4.0.0"
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
+      }
+    },
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
+      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18"
       },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
       }
     },
-    "node_modules/@rollup/plugin-json": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-json/-/plugin-json-6.1.0.tgz",
-      "integrity": "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA==",
+    "node_modules/@iconify/svelte": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/@iconify/svelte/-/svelte-5.2.1.tgz",
+      "integrity": "sha512-zHmsIPmnIhGd5gc95bNN5FL+GifwMZv7M2rlZEpa7IXYGFJm/XGHdWf6PWQa6OBoC+R69WyiPO9NAj5wjfjbow==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rollup/pluginutils": "^5.1.0"
+        "@iconify/types": "^2.0.0"
       },
-      "engines": {
-        "node": ">=14.0.0"
+      "funding": {
+        "url": "https://github.com/sponsors/cyberalien"
       },
       "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+        "svelte": ">5.0.0"
       }
     },
-    "node_modules/@rollup/plugin-node-resolve": {
-      "version": "16.0.3",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-16.0.3.tgz",
-      "integrity": "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==",
+    "node_modules/@iconify/types": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
+      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@inlang/paraglide-js": {
+      "version": "2.12.0",
+      "resolved": "https://registry.npmjs.org/@inlang/paraglide-js/-/paraglide-js-2.12.0.tgz",
+      "integrity": "sha512-wnqTeSLcMMS2usL8zjS8bDGs9r16X00aeoGk2wVAnPfAgCChYalKdG20pS2XtJVMM1H6nBBBLKt3ZQMnKrusKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rollup/pluginutils": "^5.0.1",
-        "@types/resolve": "1.20.2",
-        "deepmerge": "^4.2.2",
-        "is-module": "^1.0.0",
-        "resolve": "^1.22.1"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^2.78.0||^3.0.0||^4.0.0"
+        "@inlang/recommend-sherlock": "^0.2.1",
+        "@inlang/sdk": "^2.7.0",
+        "commander": "11.1.0",
+        "consola": "3.4.0",
+        "json5": "2.2.3",
+        "unplugin": "^2.1.2",
+        "urlpattern-polyfill": "^10.0.0"
       },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+      "bin": {
+        "paraglide-js": "bin/run.js"
       }
     },
-    "node_modules/@rollup/pluginutils": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.3.0.tgz",
-      "integrity": "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==",
+    "node_modules/@inlang/recommend-sherlock": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/@inlang/recommend-sherlock/-/recommend-sherlock-0.2.1.tgz",
+      "integrity": "sha512-ckv8HvHy/iTqaVAEKrr+gnl+p3XFNwe5D2+6w6wJk2ORV2XkcRkKOJ/XsTUJbPSiyi4PI+p+T3bqbmNx/rDUlg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "^1.0.0",
-        "estree-walker": "^2.0.2",
-        "picomatch": "^4.0.2"
+        "comment-json": "^4.2.3"
+      }
+    },
+    "node_modules/@inlang/sdk": {
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/@inlang/sdk/-/sdk-2.7.0.tgz",
+      "integrity": "sha512-yJNBD0o8i29TTJqWX5uDRHxnalDGcsUDctxepzFXsUfkzqGWfiFBxODdxvReqvM2CuKAAOo/kib/F1UcgdYFNQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@lix-js/sdk": "0.4.7",
+        "@sinclair/typebox": "^0.31.17",
+        "kysely": "^0.27.4",
+        "sqlite-wasm-kysely": "0.3.0",
+        "uuid": "^13.0.0"
       },
       "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.57.1.tgz",
-      "integrity": "sha512-A6ehUVSiSaaliTxai040ZpZ2zTevHYbvu/lDoeAteHI8QnaosIzm4qwtezfRg1jOYaUmnzLX1AOD6Z+UJjtifg==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
+    "node_modules/@internationalized/date": {
+      "version": "3.11.0",
+      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.11.0.tgz",
+      "integrity": "sha512-BOx5huLAWhicM9/ZFs84CzP+V3gBW6vlpM02yzsdYC7TGlZJX1OJiEEHcSayF00Z+3jLlm4w79amvSt6RqKN3Q==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/helpers": "^0.5.0"
+      }
     },
-    "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.57.1.tgz",
-      "integrity": "sha512-dQaAddCY9YgkFHZcFNS/606Exo8vcLHwArFZ7vxXq4rigo2bb494/xKMMwRRQW6ug7Js6yXmBZhSBRuBvCCQ3w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dev": true,
+      "license": "ISC",
       "optional": true,
-      "os": [
-        "android"
-      ]
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
     },
-    "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.57.1.tgz",
-      "integrity": "sha512-crNPrwJOrRxagUYeMn/DZwqN88SDmwaJ8Cvi/TN1HnWBU7GwknckyosC2gd0IqYRsHDEnXf328o9/HC6OkPgOg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "dev": true,
+      "license": "ISC",
       "optional": true,
-      "os": [
-        "darwin"
-      ]
-    },
-    "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.57.1.tgz",
-      "integrity": "sha512-Ji8g8ChVbKrhFtig5QBV7iMaJrGtpHelkB3lsaKzadFBe58gmjfGXAOfI5FV0lYMH8wiqsxKQ1C9B0YTRXVy4w==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.57.1.tgz",
-      "integrity": "sha512-R+/WwhsjmwodAcz65guCGFRkMb4gKWTcIeLy60JJQbXrJ97BOXHxnkPFrP+YwFlaS0m+uWJTstrUA9o+UchFug==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
     },
-    "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.57.1.tgz",
-      "integrity": "sha512-IEQTCHeiTOnAUC3IDQdzRAGj3jOAYNr9kBguI7MQAAZK3caezRrg0GxAb6Hchg4lxdZEI5Oq3iov/w/hnFWY9Q==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
     },
-    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.57.1.tgz",
-      "integrity": "sha512-F8sWbhZ7tyuEfsmOxwc2giKDQzN3+kuBLPwwZGyVkLlKGdV1nvnNwYD0fKQ8+XS6hp9nY7B+ZeK01EBUE7aHaw==",
-      "cpu": [
-        "arm"
-      ],
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+      "engines": {
+        "node": ">=6.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.57.1.tgz",
-      "integrity": "sha512-rGfNUfn0GIeXtBP1wL5MnzSj98+PZe/AXaGBCRmT0ts80lU5CATYGxXukeTX39XBKsxzFpEeK+Mrp9faXOlmrw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "devOptional": true,
+      "license": "MIT"
     },
-    "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.57.1.tgz",
-      "integrity": "sha512-MMtej3YHWeg/0klK2Qodf3yrNzz6CGjo2UntLvk2RSPlhzgLvYEB3frRvbEF2wRKh1Z2fDIg9KRPe1fawv7C+g==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
     },
-    "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.57.1.tgz",
-      "integrity": "sha512-1a/qhaaOXhqXGpMFMET9VqwZakkljWHLmZOX48R0I/YLbhdxr1m4gtG1Hq7++VhVUmf+L3sTAf9op4JlhQ5u1Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+    "node_modules/@lix-js/sdk": {
+      "version": "0.4.7",
+      "resolved": "https://registry.npmjs.org/@lix-js/sdk/-/sdk-0.4.7.tgz",
+      "integrity": "sha512-pRbW+joG12L0ULfMiWYosIW0plmW4AsUdiPCp+Z8rAsElJ+wJ6in58zhD3UwUcd4BNcpldEGjg6PdA7e0RgsDQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@lix-js/server-protocol-schema": "0.1.1",
+        "dedent": "1.5.1",
+        "human-id": "^4.1.1",
+        "js-sha256": "^0.11.0",
+        "kysely": "^0.27.4",
+        "sqlite-wasm-kysely": "0.3.0",
+        "uuid": "^10.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.57.1.tgz",
-      "integrity": "sha512-QWO6RQTZ/cqYtJMtxhkRkidoNGXc7ERPbZN7dVW5SdURuLeVU7lwKMpo18XdcmpWYd0qsP1bwKPf7DNSUinhvA==",
-      "cpu": [
-        "loong64"
+    "node_modules/@lix-js/sdk/node_modules/uuid": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
+      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
       ],
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
     },
-    "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.57.1.tgz",
-      "integrity": "sha512-xpObYIf+8gprgWaPP32xiN5RVTi/s5FCR+XMXSKmhfoJjrpRAjCuuqQXyxUa/eJTdAE6eJ+KDKaoEqjZQxh3Gw==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+    "node_modules/@lix-js/server-protocol-schema": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@lix-js/server-protocol-schema/-/server-protocol-schema-0.1.1.tgz",
+      "integrity": "sha512-jBeALB6prAbtr5q4vTuxnRZZv1M2rKe8iNqRQhFJ4Tv7150unEa0vKyz0hs8Gl3fUGsWaNJBh3J8++fpbrpRBQ==",
+      "dev": true,
+      "license": "Apache-2.0"
     },
-    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.57.1.tgz",
-      "integrity": "sha512-4BrCgrpZo4hvzMDKRqEaW1zeecScDCR+2nZ86ATLhAoJ5FQ+lbHVD3ttKe74/c7tNT9c6F2viwB3ufwp01Oh2w==",
-      "cpu": [
-        "ppc64"
-      ],
+    "node_modules/@mongodb-js/saslprep": {
+      "version": "1.4.6",
+      "resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.4.6.tgz",
+      "integrity": "sha512-y+x3H1xBZd38n10NZF/rEBlvDOOMQ6LKUTHqr8R9VkJ+mmQOYtJFxIlkkK8fZrtOiL6VixbOBWMbZGBdal3Z1g==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+      "peer": true,
+      "dependencies": {
+        "sparse-bitfield": "^3.0.3"
+      }
     },
-    "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.57.1.tgz",
-      "integrity": "sha512-NOlUuzesGauESAyEYFSe3QTUguL+lvrN1HtwEEsU2rOwdUDeTMJdO5dUYl/2hKf9jWydJrO9OL/XSSf65R5+Xw==",
-      "cpu": [
-        "ppc64"
-      ],
+    "node_modules/@mrleebo/prisma-ast": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/@mrleebo/prisma-ast/-/prisma-ast-0.13.1.tgz",
+      "integrity": "sha512-XyroGQXcHrZdvmrGJvsA9KNeOOgGMg1Vg9OlheUsBOSKznLMDl+YChxbkboRHvtFYJEMRYmlV3uoo/njCw05iw==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+      "peer": true,
+      "dependencies": {
+        "chevrotain": "^10.5.0",
+        "lilconfig": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=16"
+      }
     },
-    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ptA88htVp0AwUUqhVghwDIKlvJMD/fmL/wrQj99PRHFRAG6Z5nbWoWG4o81Nt9FT+IuqUQi+L31ZKAFeJ5Is+A==",
-      "cpu": [
-        "riscv64"
-      ],
+    "node_modules/@napi-rs/wasm-runtime": {
+      "version": "0.2.12",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
+      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
-      "os": [
-        "linux"
-      ]
+      "dependencies": {
+        "@emnapi/core": "^1.4.3",
+        "@emnapi/runtime": "^1.4.3",
+        "@tybys/wasm-util": "^0.10.0"
+      }
     },
-    "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.57.1.tgz",
-      "integrity": "sha512-S51t7aMMTNdmAMPpBg7OOsTdn4tySRQvklmL3RpDRyknk87+Sp3xaumlatU+ppQ+5raY7sSTcC2beGgvhENfuw==",
-      "cpu": [
-        "riscv64"
-      ],
+    "node_modules/@noble/ciphers": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.1.1.tgz",
+      "integrity": "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
     },
-    "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.57.1.tgz",
-      "integrity": "sha512-Bl00OFnVFkL82FHbEqy3k5CUCKH6OEJL54KCyx2oqsmZnFTR8IoNqBF+mjQVcRCT5sB6yOvK8A37LNm/kPJiZg==",
-      "cpu": [
-        "s390x"
+    "node_modules/@noble/hashes": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.0.1.tgz",
+      "integrity": "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
+    "node_modules/@nodable/entities": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
+      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodable"
+        }
       ],
+      "license": "MIT"
+    },
+    "node_modules/@npmcli/agent": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
+      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "agent-base": "^7.1.0",
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.1",
+        "lru-cache": "^10.0.1",
+        "socks-proxy-agent": "^8.0.3"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/@npmcli/fs": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
+      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/@oozcitak/dom": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz",
+      "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oozcitak/infra": "^2.0.2",
+        "@oozcitak/url": "^3.0.0",
+        "@oozcitak/util": "^10.0.0"
+      },
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@oozcitak/infra": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz",
+      "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oozcitak/util": "^10.0.0"
+      },
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@oozcitak/url": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz",
+      "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@oozcitak/infra": "^2.0.2",
+        "@oozcitak/util": "^10.0.0"
+      },
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@oozcitak/util": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz",
+      "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.0"
+      }
+    },
+    "node_modules/@opentelemetry/api": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
+      "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/@pinojs/redact": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
+      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
+      "license": "MIT"
+    },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
-      "os": [
-        "linux"
-      ]
+      "engines": {
+        "node": ">=14"
+      }
+    },
+    "node_modules/@pkgr/core": {
+      "version": "0.2.9",
+      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
+      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pkgr"
+      }
+    },
+    "node_modules/@playwright/test": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
+      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@polka/url": {
+      "version": "1.0.0-next.29",
+      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
+      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@poppinss/macroable": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@poppinss/macroable/-/macroable-1.1.0.tgz",
+      "integrity": "sha512-y/YKzZDuG8XrpXpM7Z1RdQpiIc0MAKyva24Ux1PB4aI7RiSI/79K8JVDcdyubriTm7vJ1LhFs8CrZpmPnx/8Pw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/@prisma/client": {
+      "version": "5.22.0",
+      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-5.22.0.tgz",
+      "integrity": "sha512-M0SVXfyHnQREBKxCgyo7sffrKttwE6R8PMq330MIUF0pTwjUhLbW84pFDlf06B27XyCR++VtjugEnIHdr07SVA==",
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "peer": true,
+      "engines": {
+        "node": ">=16.13"
+      },
+      "peerDependencies": {
+        "prisma": "*"
+      },
+      "peerDependenciesMeta": {
+        "prisma": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@prisma/config": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.4.2.tgz",
+      "integrity": "sha512-CftBjWxav99lzY1Z4oDgomdb1gh9BJFAOmWF6P2v1xRfXqQb56DfBub+QKcERRdNoAzCb3HXy3Zii8Vb4AsXhg==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "c12": "3.1.0",
+        "deepmerge-ts": "7.1.5",
+        "effect": "3.18.4",
+        "empathic": "2.0.0"
+      }
+    },
+    "node_modules/@prisma/config/node_modules/c12": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/c12/-/c12-3.1.0.tgz",
+      "integrity": "sha512-uWoS8OU1MEIsOv8p/5a82c3H31LsWVR5qiyXVfBNOzfffjUWtPnhAb4BYI2uG2HfGmZmFjCtui5XNWaps+iFuw==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "chokidar": "^4.0.3",
+        "confbox": "^0.2.2",
+        "defu": "^6.1.4",
+        "dotenv": "^16.6.1",
+        "exsolve": "^1.0.7",
+        "giget": "^2.0.0",
+        "jiti": "^2.4.2",
+        "ohash": "^2.0.11",
+        "pathe": "^2.0.3",
+        "perfect-debounce": "^1.0.0",
+        "pkg-types": "^2.2.0",
+        "rc9": "^2.1.2"
+      },
+      "peerDependencies": {
+        "magicast": "^0.3.5"
+      },
+      "peerDependenciesMeta": {
+        "magicast": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@prisma/config/node_modules/dotenv": {
+      "version": "16.6.1",
+      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
+      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
+      "license": "BSD-2-Clause",
+      "peer": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://dotenvx.com"
+      }
+    },
+    "node_modules/@prisma/config/node_modules/effect": {
+      "version": "3.18.4",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-3.18.4.tgz",
+      "integrity": "sha512-b1LXQJLe9D11wfnOKAk3PKxuqYshQ0Heez+y5pnkd3jLj1yx9QhM72zZ9uUrOQyNvrs2GZZd/3maL0ZV18YuDA==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "fast-check": "^3.23.1"
+      }
+    },
+    "node_modules/@prisma/config/node_modules/perfect-debounce": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
+      "integrity": "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/@prisma/debug": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.4.2.tgz",
+      "integrity": "sha512-aP7qzu+g/JnbF6U69LMwHoUkELiserKmWsE2shYuEpNUJ4GrtxBCvZwCyCBHFSH2kLTF2l1goBlBh4wuvRq62w==",
+      "license": "Apache-2.0",
+      "peer": true
+    },
+    "node_modules/@prisma/dev": {
+      "version": "0.20.0",
+      "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.20.0.tgz",
+      "integrity": "sha512-ovlBYwWor0OzG+yH4J3Ot+AneD818BttLA+Ii7wjbcLHUrnC4tbUPVGyNd3c/+71KETPKZfjhkTSpdS15dmXNQ==",
+      "license": "ISC",
+      "peer": true,
+      "dependencies": {
+        "@electric-sql/pglite": "0.3.15",
+        "@electric-sql/pglite-socket": "0.0.20",
+        "@electric-sql/pglite-tools": "0.2.20",
+        "@hono/node-server": "1.19.9",
+        "@mrleebo/prisma-ast": "0.13.1",
+        "@prisma/get-platform": "7.2.0",
+        "@prisma/query-plan-executor": "7.2.0",
+        "foreground-child": "3.3.1",
+        "get-port-please": "3.2.0",
+        "hono": "4.11.4",
+        "http-status-codes": "2.3.0",
+        "pathe": "2.0.3",
+        "proper-lockfile": "4.1.2",
+        "remeda": "2.33.4",
+        "std-env": "3.10.0",
+        "valibot": "1.2.0",
+        "zeptomatch": "2.1.0"
+      }
+    },
+    "node_modules/@prisma/engines": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.4.2.tgz",
+      "integrity": "sha512-B+ZZhI4rXlzjVqRw/93AothEKOU5/x4oVyJFGo9RpHPnBwaPwk4Pi0Q4iGXipKxeXPs/dqljgNBjK0m8nocOJA==",
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "@prisma/debug": "7.4.2",
+        "@prisma/engines-version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
+        "@prisma/fetch-engine": "7.4.2",
+        "@prisma/get-platform": "7.4.2"
+      }
+    },
+    "node_modules/@prisma/engines-version": {
+      "version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
+      "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919.tgz",
+      "integrity": "sha512-5FIKY3KoYQlBuZC2yc16EXfVRQ8HY+fLqgxkYfWCtKhRb3ajCRzP/rPeoSx11+NueJDANdh4hjY36mdmrTcGSg==",
+      "license": "Apache-2.0",
+      "peer": true
+    },
+    "node_modules/@prisma/engines/node_modules/@prisma/get-platform": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.4.2.tgz",
+      "integrity": "sha512-UTnChXRwiauzl/8wT4hhe7Xmixja9WE28oCnGpBtRejaHhvekx5kudr3R4Y9mLSA0kqGnAMeyTiKwDVMjaEVsw==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "@prisma/debug": "7.4.2"
+      }
+    },
+    "node_modules/@prisma/fetch-engine": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.4.2.tgz",
+      "integrity": "sha512-f/c/MwYpdJO7taLETU8rahEstLeXfYgQGlz5fycG7Fbmva3iPdzGmjiSWHeSWIgNnlXnelUdCJqyZnFocurZuA==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "@prisma/debug": "7.4.2",
+        "@prisma/engines-version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
+        "@prisma/get-platform": "7.4.2"
+      }
+    },
+    "node_modules/@prisma/fetch-engine/node_modules/@prisma/get-platform": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.4.2.tgz",
+      "integrity": "sha512-UTnChXRwiauzl/8wT4hhe7Xmixja9WE28oCnGpBtRejaHhvekx5kudr3R4Y9mLSA0kqGnAMeyTiKwDVMjaEVsw==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "@prisma/debug": "7.4.2"
+      }
+    },
+    "node_modules/@prisma/get-platform": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.2.0.tgz",
+      "integrity": "sha512-k1V0l0Td1732EHpAfi2eySTezyllok9dXb6UQanajkJQzPUGi3vO2z7jdkz67SypFTdmbnyGYxvEvYZdZsMAVA==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "@prisma/debug": "7.2.0"
+      }
+    },
+    "node_modules/@prisma/get-platform/node_modules/@prisma/debug": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.2.0.tgz",
+      "integrity": "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw==",
+      "license": "Apache-2.0",
+      "peer": true
+    },
+    "node_modules/@prisma/query-plan-executor": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/@prisma/query-plan-executor/-/query-plan-executor-7.2.0.tgz",
+      "integrity": "sha512-EOZmNzcV8uJ0mae3DhTsiHgoNCuu1J9mULQpGCh62zN3PxPTd+qI9tJvk5jOst8WHKQNwJWR3b39t0XvfBB0WQ==",
+      "license": "Apache-2.0",
+      "peer": true
+    },
+    "node_modules/@prisma/studio-core": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.13.1.tgz",
+      "integrity": "sha512-agdqaPEePRHcQ7CexEfkX1RvSH9uWDb6pXrZnhCRykhDFAV0/0P3d07WtfiY8hZWb7oRU4v+NkT4cGFHkQJIPg==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "peerDependencies": {
+        "@types/react": "^18.0.0 || ^19.0.0",
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0"
+      }
+    },
+    "node_modules/@rollup/plugin-commonjs": {
+      "version": "29.0.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-29.0.0.tgz",
+      "integrity": "sha512-U2YHaxR2cU/yAiwKJtJRhnyLk7cifnQw0zUpISsocBDoHDJn+HTV74ABqnwr5bEgWUwFZC9oFL6wLe21lHu5eQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rollup/pluginutils": "^5.0.1",
+        "commondir": "^1.0.1",
+        "estree-walker": "^2.0.2",
+        "fdir": "^6.2.0",
+        "is-reference": "1.2.1",
+        "magic-string": "^0.30.3",
+        "picomatch": "^4.0.2"
+      },
+      "engines": {
+        "node": ">=16.0.0 || 14 >= 14.17"
+      },
+      "peerDependencies": {
+        "rollup": "^2.68.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@rollup/plugin-json": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-json/-/plugin-json-6.1.0.tgz",
+      "integrity": "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rollup/pluginutils": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@rollup/plugin-node-resolve": {
+      "version": "16.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-16.0.3.tgz",
+      "integrity": "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@rollup/pluginutils": "^5.0.1",
+        "@types/resolve": "1.20.2",
+        "deepmerge": "^4.2.2",
+        "is-module": "^1.0.0",
+        "resolve": "^1.22.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "rollup": "^2.78.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@rollup/pluginutils": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.3.0.tgz",
+      "integrity": "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0",
+        "estree-walker": "^2.0.2",
+        "picomatch": "^4.0.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      },
+      "peerDependencies": {
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@rollup/rollup-android-arm-eabi": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.57.1.tgz",
+      "integrity": "sha512-A6ehUVSiSaaliTxai040ZpZ2zTevHYbvu/lDoeAteHI8QnaosIzm4qwtezfRg1jOYaUmnzLX1AOD6Z+UJjtifg==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-android-arm64": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.57.1.tgz",
+      "integrity": "sha512-dQaAddCY9YgkFHZcFNS/606Exo8vcLHwArFZ7vxXq4rigo2bb494/xKMMwRRQW6ug7Js6yXmBZhSBRuBvCCQ3w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-arm64": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.57.1.tgz",
+      "integrity": "sha512-crNPrwJOrRxagUYeMn/DZwqN88SDmwaJ8Cvi/TN1HnWBU7GwknckyosC2gd0IqYRsHDEnXf328o9/HC6OkPgOg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-x64": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.57.1.tgz",
+      "integrity": "sha512-Ji8g8ChVbKrhFtig5QBV7iMaJrGtpHelkB3lsaKzadFBe58gmjfGXAOfI5FV0lYMH8wiqsxKQ1C9B0YTRXVy4w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-arm64": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.57.1.tgz",
+      "integrity": "sha512-R+/WwhsjmwodAcz65guCGFRkMb4gKWTcIeLy60JJQbXrJ97BOXHxnkPFrP+YwFlaS0m+uWJTstrUA9o+UchFug==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-x64": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.57.1.tgz",
+      "integrity": "sha512-IEQTCHeiTOnAUC3IDQdzRAGj3jOAYNr9kBguI7MQAAZK3caezRrg0GxAb6Hchg4lxdZEI5Oq3iov/w/hnFWY9Q==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.57.1.tgz",
+      "integrity": "sha512-F8sWbhZ7tyuEfsmOxwc2giKDQzN3+kuBLPwwZGyVkLlKGdV1nvnNwYD0fKQ8+XS6hp9nY7B+ZeK01EBUE7aHaw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.57.1.tgz",
+      "integrity": "sha512-rGfNUfn0GIeXtBP1wL5MnzSj98+PZe/AXaGBCRmT0ts80lU5CATYGxXukeTX39XBKsxzFpEeK+Mrp9faXOlmrw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.57.1.tgz",
+      "integrity": "sha512-MMtej3YHWeg/0klK2Qodf3yrNzz6CGjo2UntLvk2RSPlhzgLvYEB3frRvbEF2wRKh1Z2fDIg9KRPe1fawv7C+g==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-musl": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.57.1.tgz",
+      "integrity": "sha512-1a/qhaaOXhqXGpMFMET9VqwZakkljWHLmZOX48R0I/YLbhdxr1m4gtG1Hq7++VhVUmf+L3sTAf9op4JlhQ5u1Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.57.1.tgz",
+      "integrity": "sha512-QWO6RQTZ/cqYtJMtxhkRkidoNGXc7ERPbZN7dVW5SdURuLeVU7lwKMpo18XdcmpWYd0qsP1bwKPf7DNSUinhvA==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.57.1.tgz",
+      "integrity": "sha512-xpObYIf+8gprgWaPP32xiN5RVTi/s5FCR+XMXSKmhfoJjrpRAjCuuqQXyxUa/eJTdAE6eJ+KDKaoEqjZQxh3Gw==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.57.1.tgz",
+      "integrity": "sha512-4BrCgrpZo4hvzMDKRqEaW1zeecScDCR+2nZ86ATLhAoJ5FQ+lbHVD3ttKe74/c7tNT9c6F2viwB3ufwp01Oh2w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.57.1.tgz",
+      "integrity": "sha512-NOlUuzesGauESAyEYFSe3QTUguL+lvrN1HtwEEsU2rOwdUDeTMJdO5dUYl/2hKf9jWydJrO9OL/XSSf65R5+Xw==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.57.1.tgz",
+      "integrity": "sha512-ptA88htVp0AwUUqhVghwDIKlvJMD/fmL/wrQj99PRHFRAG6Z5nbWoWG4o81Nt9FT+IuqUQi+L31ZKAFeJ5Is+A==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-musl": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.57.1.tgz",
+      "integrity": "sha512-S51t7aMMTNdmAMPpBg7OOsTdn4tySRQvklmL3RpDRyknk87+Sp3xaumlatU+ppQ+5raY7sSTcC2beGgvhENfuw==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-s390x-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.57.1.tgz",
+      "integrity": "sha512-Bl00OFnVFkL82FHbEqy3k5CUCKH6OEJL54KCyx2oqsmZnFTR8IoNqBF+mjQVcRCT5sB6yOvK8A37LNm/kPJiZg==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.57.1.tgz",
+      "integrity": "sha512-ABca4ceT4N+Tv/GtotnWAeXZUZuM/9AQyCyKYyKnpk4yoA7QIAuBt6Hkgpw8kActYlew2mvckXkvx0FfoInnLg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-musl": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.57.1.tgz",
+      "integrity": "sha512-HFps0JeGtuOR2convgRRkHCekD7j+gdAuXM+/i6kGzQtFhlCtQkpwtNzkNj6QhCDp7DRJ7+qC/1Vg2jt5iSOFw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.57.1.tgz",
+      "integrity": "sha512-H+hXEv9gdVQuDTgnqD+SQffoWoc0Of59AStSzTEj/feWTBAnSfSD3+Dql1ZruJQxmykT/JVY0dE8Ka7z0DH1hw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.57.1.tgz",
+      "integrity": "sha512-4wYoDpNg6o/oPximyc/NG+mYUejZrCU2q+2w6YZqrAs2UcNUChIZXjtafAiiZSUc7On8v5NyNj34Kzj/Ltk6dQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-arm64-msvc": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.57.1.tgz",
+      "integrity": "sha512-O54mtsV/6LW3P8qdTcamQmuC990HDfR71lo44oZMZlXU4tzLrbvTii87Ni9opq60ds0YzuAlEr/GNwuNluZyMQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-ia32-msvc": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.57.1.tgz",
+      "integrity": "sha512-P3dLS+IerxCT/7D2q2FYcRdWRl22dNbrbBEtxdWhXrfIMPP9lQhb5h4Du04mdl5Woq05jVCDPCMF7Ub0NAjIew==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
+      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
+      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@sideway/address": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
+      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true,
+      "dependencies": {
+        "@hapi/hoek": "^9.0.0"
+      }
+    },
+    "node_modules/@sideway/formula": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
+      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
+    "node_modules/@sideway/pinpoint": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
+      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
+    "node_modules/@sinclair/typebox": {
+      "version": "0.31.28",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.31.28.tgz",
+      "integrity": "sha512-/s55Jujywdw/Jpan+vsy6JZs1z2ZTGxTmbZTPiuSL2wz9mfzA2gN1zzaqmvfi4pq+uOt7Du85fkiwv5ymW84aQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@smithy/chunked-blob-reader": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/chunked-blob-reader/-/chunked-blob-reader-5.2.2.tgz",
+      "integrity": "sha512-St+kVicSyayWQca+I1rGitaOEH6uKgE8IUWoYnnEX26SWdWQcL6LvMSD19Lg+vYHKdT9B2Zuu7rd3i6Wnyb/iw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/chunked-blob-reader-native": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/@smithy/chunked-blob-reader-native/-/chunked-blob-reader-native-4.2.3.tgz",
+      "integrity": "sha512-jA5k5Udn7Y5717L86h4EIv06wIr3xn8GM1qHRi/Nf31annXcXHJjBKvgztnbn2TxH3xWrPBfgwHsOwZf0UmQWw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/util-base64": "^4.3.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/config-resolver": {
+      "version": "4.4.17",
+      "resolved": "https://registry.npmjs.org/@smithy/config-resolver/-/config-resolver-4.4.17.tgz",
+      "integrity": "sha512-TzDZcAnhTyAHbXVxWZo7/tEcrIeFq20IBk8So3OLOetWpR8EwY/yEqBMBFaJMeyEiREDq4NfEl+qO3OAUD+vbQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-config-provider": "^4.2.2",
+        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/core": {
+      "version": "3.23.17",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.23.17.tgz",
+      "integrity": "sha512-x7BlLbUFL8NWCGjMF9C+1N5cVCxcPa7g6Tv9B4A2luWx3be3oU8hQ96wIwxe/s7OhIzvoJH73HAUSg5JXVlEtQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-base64": "^4.3.2",
+        "@smithy/util-body-length-browser": "^4.2.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-stream": "^4.5.25",
+        "@smithy/util-utf8": "^4.2.2",
+        "@smithy/uuid": "^1.1.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/credential-provider-imds": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.2.14.tgz",
+      "integrity": "sha512-Au28zBN48ZAoXdooGUHemuVBrkE+Ie6RPmGNIAJsFqj33Vhb6xAgRifUydZ2aY+M+KaMAETAlKk5NC5h1G7wpg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/eventstream-codec": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/eventstream-codec/-/eventstream-codec-4.2.14.tgz",
+      "integrity": "sha512-erZq0nOIpzfeZdCyzZjdJb4nVSKLUmSkaQUVkRGQTXs30gyUGeKnrYEg+Xe1W5gE3aReS7IgsvANwVPxSzY6Pw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/crc32": "5.2.0",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-hex-encoding": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/eventstream-serde-browser": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-browser/-/eventstream-serde-browser-4.2.14.tgz",
+      "integrity": "sha512-8IelTCtTctWRbb+0Dcy+C0aICh1qa0qWXqgjcXDmMuCvPJRnv26hiDZoAau2ILOniki65mCPKqOQs/BaWvO4CQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/eventstream-serde-universal": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/eventstream-serde-config-resolver": {
+      "version": "4.3.14",
+      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-config-resolver/-/eventstream-serde-config-resolver-4.3.14.tgz",
+      "integrity": "sha512-sqHiHpYRYo3FJlaIxD1J8PhbcmJAm7IuM16mVnwSkCToD7g00IBZzKuiLNMGmftULmEUX6/UAz8/NN5uMP8bVA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/eventstream-serde-node": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-node/-/eventstream-serde-node-4.2.14.tgz",
+      "integrity": "sha512-Ht/8BuGlKfFTy0H3+8eEu0vdpwGztCnaLLXtpXNdQqiR7Hj4vFScU3T436vRAjATglOIPjJXronY+1WxxNLSiw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/eventstream-serde-universal": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/eventstream-serde-universal": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-universal/-/eventstream-serde-universal-4.2.14.tgz",
+      "integrity": "sha512-lWyt4T2XQZUZgK3tQ3Wn0w3XBvZsK/vjTuJl6bXbnGZBHH0ZUSONTYiK9TgjTTzU54xQr3DRFwpjmhp0oLm3gg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/eventstream-codec": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/fetch-http-handler": {
+      "version": "5.3.17",
+      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.3.17.tgz",
+      "integrity": "sha512-bXOvQzaSm6MnmLaWA1elgfQcAtN4UP3vXqV97bHuoOrHQOJiLT3ds6o9eo5bqd0TJfRFpzdGnDQdW3FACiAVdw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/querystring-builder": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-base64": "^4.3.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/hash-blob-browser": {
+      "version": "4.2.15",
+      "resolved": "https://registry.npmjs.org/@smithy/hash-blob-browser/-/hash-blob-browser-4.2.15.tgz",
+      "integrity": "sha512-0PJ4Al3fg2nM4qKrAIxyNcApgqHAXcBkN8FeizOz69z0rb26uZ6lMESYtxegaTlXB5Hj84JfwMPavMrwDMjucA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/chunked-blob-reader": "^5.2.2",
+        "@smithy/chunked-blob-reader-native": "^4.2.3",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/hash-node": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/hash-node/-/hash-node-4.2.14.tgz",
+      "integrity": "sha512-8ZBDY2DD4wr+GGjTpPtiglEsqr0lUP+KHqgZcWczFf6qeZ/YRjMIOoQWVQlmwu7EtxKTd8YXD8lblmYcpBIA1g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-buffer-from": "^4.2.2",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/hash-stream-node": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/hash-stream-node/-/hash-stream-node-4.2.14.tgz",
+      "integrity": "sha512-tw4GANWkZPb6+BdD4Fgucqzey2+r73Z/GRo9zklsCdwrnxxumUV83ZIaBDdudV4Ylazw3EPTiJZhpX42105ruQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/invalid-dependency": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/invalid-dependency/-/invalid-dependency-4.2.14.tgz",
+      "integrity": "sha512-c21qJiTSb25xvvOp+H2TNZzPCngrvl5vIPqPB8zQ/DmJF4QWXO19x1dWfMJZ6wZuuWUPPm0gV8C0cU3+ifcWuw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/is-array-buffer": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
+      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/md5-js": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/md5-js/-/md5-js-4.2.14.tgz",
+      "integrity": "sha512-V2v0vx+h0iUSNG1Alt+GNBMSLGCrl9iVsdd+Ap67HPM9PN479x12V8LkuMoKImNZxn3MXeuyUjls+/7ZACZghA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/middleware-content-length": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-content-length/-/middleware-content-length-4.2.14.tgz",
+      "integrity": "sha512-xhHq7fX4/3lv5NHxLUk3OeEvl0xZ+Ek3qIbWaCL4f9JwgDZEclPBElljaZCAItdGPQl/kSM4LPMOpy1MYgprpw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/middleware-endpoint": {
+      "version": "4.4.32",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-endpoint/-/middleware-endpoint-4.4.32.tgz",
+      "integrity": "sha512-ZZkgyjnJppiZbIm6Qbx92pbXYi1uzenIvGhBSCDlc7NwuAkiqSgS75j1czAD25ZLs2FjMjYy1q7gyRVWG6JA0Q==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/core": "^3.23.17",
+        "@smithy/middleware-serde": "^4.2.20",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "@smithy/url-parser": "^4.2.14",
+        "@smithy/util-middleware": "^4.2.14",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/middleware-retry": {
+      "version": "4.5.7",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-retry/-/middleware-retry-4.5.7.tgz",
+      "integrity": "sha512-bRt6ZImqVSeTk39Nm81K20ObIiAZ3WefY7G6+iz/0tZjs4dgRRjvRX2sgsH+zi6iDCRR/aQvQofLKxxz4rPBZg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/core": "^3.23.17",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/service-error-classification": "^4.3.1",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-retry": "^4.3.6",
+        "@smithy/uuid": "^1.1.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/middleware-serde": {
+      "version": "4.2.20",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-serde/-/middleware-serde-4.2.20.tgz",
+      "integrity": "sha512-Lx9JMO9vArPtiChE3wbEZ5akMIDQpWQtlu90lhACQmNOXcGXRbaDywMHDzuDZ2OkZzP+9wQfZi3YJT9F67zTQQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/core": "^3.23.17",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/middleware-stack": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/middleware-stack/-/middleware-stack-4.2.14.tgz",
+      "integrity": "sha512-2dvkUKLuFdKsCRmOE4Mn63co0Djtsm+JMh0bYZQupN1pJwMeE8FmQmRLLzzEMN0dnNi7CDCYYH8F0EVwWiPBeA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/node-config-provider": {
+      "version": "4.3.14",
+      "resolved": "https://registry.npmjs.org/@smithy/node-config-provider/-/node-config-provider-4.3.14.tgz",
+      "integrity": "sha512-S+gFjyo/weSVL0P1b9Ts8C/CwIfNCgUPikk3sl6QVsfE/uUuO+QsF+NsE/JkpvWqqyz1wg7HFdiaZuj5CoBMRg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/shared-ini-file-loader": "^4.4.9",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/node-http-handler": {
+      "version": "4.6.1",
+      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.6.1.tgz",
+      "integrity": "sha512-iB+orM4x3xrr57X3YaXazfKnntl0LHlZB1kcXSGzMV1Tt0+YwEjGlbjk/44qEGtBzXAz6yFDzkYTKSV6Pj2HUg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/querystring-builder": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/property-provider": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/property-provider/-/property-provider-4.2.14.tgz",
+      "integrity": "sha512-WuM31CgfsnQ/10i7NYr0PyxqknD72Y5uMfUMVSniPjbEPceiTErb4eIqJQ+pdxNEAUEWrewrGjIRjVbVHsxZiQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/protocol-http": {
+      "version": "5.3.14",
+      "resolved": "https://registry.npmjs.org/@smithy/protocol-http/-/protocol-http-5.3.14.tgz",
+      "integrity": "sha512-dN5F8kHx8RNU0r+pCwNmFZyz6ChjMkzShy/zup6MtkRmmix4vZzJdW+di7x//b1LiynIev88FM18ie+wwPcQtQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/querystring-builder": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/querystring-builder/-/querystring-builder-4.2.14.tgz",
+      "integrity": "sha512-XYA5Z0IqTeF+5XDdh4BBmSA0HvbgVZIyv4cmOoUheDNR57K1HgBp9ukUMx3Cr3XpDHHpLBnexPE3LAtDsZkj2A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-uri-escape": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/querystring-parser": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/querystring-parser/-/querystring-parser-4.2.14.tgz",
+      "integrity": "sha512-hr+YyqBD23GVvRxGGrcc/oOeNlK3PzT5Fu4dzrDXxzS1LpFiuL2PQQqKPs87M79aW7ziMs+nvB3qdw77SqE7Lw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/service-error-classification": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@smithy/service-error-classification/-/service-error-classification-4.3.1.tgz",
+      "integrity": "sha512-aUQuDGh760ts/8MU+APjIZhlLPKhIIfqyzZaJikLEIMrdxFvxuLYD0WxWzaYWpmLbQlXDe9p7EWM3HsBe0K6Gw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/shared-ini-file-loader": {
+      "version": "4.4.9",
+      "resolved": "https://registry.npmjs.org/@smithy/shared-ini-file-loader/-/shared-ini-file-loader-4.4.9.tgz",
+      "integrity": "sha512-495/V2I15SHgedSJoDPD23JuSfKAp726ZI1V0wtjB07Wh7q/0tri/0e0DLefZCHgxZonrGKt/OCTpAtP1wE1kQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/signature-v4": {
+      "version": "5.3.14",
+      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.3.14.tgz",
+      "integrity": "sha512-1D9Y/nmlVjCeSivCbhZ7hgEpmHyY1h0GvpSZt3l0xcD9JjmjVC1CHOozS6+Gh+/ldMH8JuJ6cujObQqfayAVFA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/is-array-buffer": "^4.2.2",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-hex-encoding": "^4.2.2",
+        "@smithy/util-middleware": "^4.2.14",
+        "@smithy/util-uri-escape": "^4.2.2",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/smithy-client": {
+      "version": "4.12.13",
+      "resolved": "https://registry.npmjs.org/@smithy/smithy-client/-/smithy-client-4.12.13.tgz",
+      "integrity": "sha512-y/Pcj1V9+qG98gyu1gvftHB7rDpdh+7kIBIggs55yGm3JdtBV8GT8IFF3a1qxZ79QnaJHX9GXzvBG6tAd+czJA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/core": "^3.23.17",
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/middleware-stack": "^4.2.14",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-stream": "^4.5.25",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/types": {
+      "version": "4.14.1",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.1.tgz",
+      "integrity": "sha512-59b5HtSVrVR/eYNei3BUj3DCPKD/G7EtDDe7OEJE7i7FtQFugYo6MxbotS8mVJkLNVf8gYaAlEBwwtJ9HzhWSg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/url-parser": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/url-parser/-/url-parser-4.2.14.tgz",
+      "integrity": "sha512-p06BiBigJ8bTA3MgnOfCtDUWnAMY0YfedO/GRpmc7p+wg3KW8vbXy1xwSu5ASy0wV7rRYtlfZOIKH4XqfhjSQQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/querystring-parser": "^4.2.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/util-base64": {
+      "version": "4.3.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-base64/-/util-base64-4.3.2.tgz",
+      "integrity": "sha512-XRH6b0H/5A3SgblmMa5ErXQ2XKhfbQB+Fm/oyLZ2O2kCUrwgg55bU0RekmzAhuwOjA9qdN5VU2BprOvGGUkOOQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/util-buffer-from": "^4.2.2",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/util-body-length-browser": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-body-length-browser/-/util-body-length-browser-4.2.2.tgz",
+      "integrity": "sha512-JKCrLNOup3OOgmzeaKQwi4ZCTWlYR5H4Gm1r2uTMVBXoemo1UEghk5vtMi1xSu2ymgKVGW631e2fp9/R610ZjQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/util-body-length-node": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/@smithy/util-body-length-node/-/util-body-length-node-4.2.3.tgz",
+      "integrity": "sha512-ZkJGvqBzMHVHE7r/hcuCxlTY8pQr1kMtdsVPs7ex4mMU+EAbcXppfo5NmyxMYi2XU49eqaz56j2gsk4dHHPG/g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ABca4ceT4N+Tv/GtotnWAeXZUZuM/9AQyCyKYyKnpk4yoA7QIAuBt6Hkgpw8kActYlew2mvckXkvx0FfoInnLg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+    "node_modules/@smithy/util-buffer-from": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
+      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/is-array-buffer": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.57.1.tgz",
-      "integrity": "sha512-HFps0JeGtuOR2convgRRkHCekD7j+gdAuXM+/i6kGzQtFhlCtQkpwtNzkNj6QhCDp7DRJ7+qC/1Vg2jt5iSOFw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+    "node_modules/@smithy/util-config-provider": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-config-provider/-/util-config-provider-4.2.2.tgz",
+      "integrity": "sha512-dWU03V3XUprJwaUIFVv4iOnS1FC9HnMHDfUrlNDSh4315v0cWyaIErP8KiqGVbf5z+JupoVpNM7ZB3jFiTejvQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.57.1.tgz",
-      "integrity": "sha512-H+hXEv9gdVQuDTgnqD+SQffoWoc0Of59AStSzTEj/feWTBAnSfSD3+Dql1ZruJQxmykT/JVY0dE8Ka7z0DH1hw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ]
+    "node_modules/@smithy/util-defaults-mode-browser": {
+      "version": "4.3.49",
+      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.3.49.tgz",
+      "integrity": "sha512-a5bNrdiONYB/qE2BuKegvUMd/+ZDwdg4vsNuuSzYE8qs2EYAdK9CynL+Rzn29PbPiUqoz/cbpRbcLzD5lEevHw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.57.1.tgz",
-      "integrity": "sha512-4wYoDpNg6o/oPximyc/NG+mYUejZrCU2q+2w6YZqrAs2UcNUChIZXjtafAiiZSUc7On8v5NyNj34Kzj/Ltk6dQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ]
+    "node_modules/@smithy/util-defaults-mode-node": {
+      "version": "4.2.54",
+      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.2.54.tgz",
+      "integrity": "sha512-g1cvrJvOnzeJgEdf7AE4luI7gp6L8weE0y9a9wQUSGtjb8QRHDbCJYuE4Sy0SD9N8RrnNPFsPltAz/OSoBR9Zw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/config-resolver": "^4.4.17",
+        "@smithy/credential-provider-imds": "^4.2.14",
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/property-provider": "^4.2.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.57.1.tgz",
-      "integrity": "sha512-O54mtsV/6LW3P8qdTcamQmuC990HDfR71lo44oZMZlXU4tzLrbvTii87Ni9opq60ds0YzuAlEr/GNwuNluZyMQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+    "node_modules/@smithy/util-endpoints": {
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-endpoints/-/util-endpoints-3.4.2.tgz",
+      "integrity": "sha512-a55Tr+3OKld4TTtnT+RhKOQHyPxm3j/xL4OR83WBUhLJaKDS9dnJ7arRMOp3t31dcLhApwG9bgvrRXBHlLdIkg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/node-config-provider": "^4.3.14",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.57.1.tgz",
-      "integrity": "sha512-P3dLS+IerxCT/7D2q2FYcRdWRl22dNbrbBEtxdWhXrfIMPP9lQhb5h4Du04mdl5Woq05jVCDPCMF7Ub0NAjIew==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+    "node_modules/@smithy/util-hex-encoding": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-hex-encoding/-/util-hex-encoding-4.2.2.tgz",
+      "integrity": "sha512-Qcz3W5vuHK4sLQdyT93k/rfrUwdJ8/HZ+nMUOyGdpeGA1Wxt65zYwi3oEl9kOM+RswvYq90fzkNDahPS8K0OIg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+    "node_modules/@smithy/util-middleware": {
+      "version": "4.2.14",
+      "resolved": "https://registry.npmjs.org/@smithy/util-middleware/-/util-middleware-4.2.14.tgz",
+      "integrity": "sha512-1Su2vj9RYNDEv/V+2E+jXkkwGsgR7dc4sfHn9Z7ruzQHJIEni9zzw5CauvRXlFJfmgcqYP8fWa0dkh2Q2YaQyw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
-      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+    "node_modules/@smithy/util-retry": {
+      "version": "4.3.8",
+      "resolved": "https://registry.npmjs.org/@smithy/util-retry/-/util-retry-4.3.8.tgz",
+      "integrity": "sha512-LUIxbTBi+OpvXpg91poGA6BdyoleMDLnfXjVDqyi2RvZmTveY5loE/FgYUBCR5LU2BThW2SoZRh8dTIIy38IPw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/service-error-classification": "^4.3.1",
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@sideway/address": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
-      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true,
+    "node_modules/@smithy/util-stream": {
+      "version": "4.5.25",
+      "resolved": "https://registry.npmjs.org/@smithy/util-stream/-/util-stream-4.5.25.tgz",
+      "integrity": "sha512-/PFpG4k8Ze8Ei+mMKj3oiPICYekthuzePZMgZbCqMiXIHHf4n2aZ4Ps0aSRShycFTGuj/J6XldmC0x0DwednIA==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@hapi/hoek": "^9.0.0"
+        "@smithy/fetch-http-handler": "^5.3.17",
+        "@smithy/node-http-handler": "^4.6.1",
+        "@smithy/types": "^4.14.1",
+        "@smithy/util-base64": "^4.3.2",
+        "@smithy/util-buffer-from": "^4.2.2",
+        "@smithy/util-hex-encoding": "^4.2.2",
+        "@smithy/util-utf8": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/@sideway/formula": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
-      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
+    "node_modules/@smithy/util-uri-escape": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-uri-escape/-/util-uri-escape-4.2.2.tgz",
+      "integrity": "sha512-2kAStBlvq+lTXHyAZYfJRb/DfS3rsinLiwb+69SstC9Vb0s9vNWkRwpnj918Pfi85mzi42sOqdV72OLxWAISnw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@sideway/pinpoint": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
-      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
+    "node_modules/@smithy/util-utf8": {
+      "version": "4.2.2",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
+      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/util-buffer-from": "^4.2.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@sinclair/typebox": {
-      "version": "0.31.28",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.31.28.tgz",
-      "integrity": "sha512-/s55Jujywdw/Jpan+vsy6JZs1z2ZTGxTmbZTPiuSL2wz9mfzA2gN1zzaqmvfi4pq+uOt7Du85fkiwv5ymW84aQ==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/@smithy/util-waiter": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-waiter/-/util-waiter-4.3.0.tgz",
+      "integrity": "sha512-JyjYmLAfS+pdxF92o4yLgEoy0zhayKTw73FU1aofLWwLcJw7iSqIY2exGmMTrl/lmZugP5p/zxdFSippJDfKWA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/types": "^4.14.1",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@smithy/uuid": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@smithy/uuid/-/uuid-1.1.2.tgz",
+      "integrity": "sha512-O/IEdcCUKkubz60tFbGA7ceITTAJsty+lBjNoorP4Z6XRqaFb/OjQjZODophEcuq68nKm6/0r+6/lLQ+XVpk8g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
     "node_modules/@sqlite.org/sqlite-wasm": {
       "version": "3.48.0-build4",
@@ -3775,6 +5362,12 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/bowser": {
+      "version": "2.14.1",
+      "resolved": "https://registry.npmjs.org/bowser/-/bowser-2.14.1.tgz",
+      "integrity": "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==",
+      "license": "MIT"
+    },
     "node_modules/brace-expansion": {
       "version": "1.1.12",
       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
@@ -5203,6 +6796,42 @@
       "license": "BSD-3-Clause",
       "optional": true
     },
+    "node_modules/fast-xml-builder": {
+      "version": "1.1.7",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.7.tgz",
+      "integrity": "sha512-Yh7/7rQuMXICNr0oMYDR2yHP6oUvmQsTToFeOWj/kIDhAwQ+c4Ol/lbcwOmEM5OHYQmh6S6EQSQ1sljCKP36bQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "path-expression-matcher": "^1.1.3"
+      }
+    },
+    "node_modules/fast-xml-parser": {
+      "version": "5.7.2",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.2.tgz",
+      "integrity": "sha512-P7oW7tLbYnhOLQk/Gv7cZgzgMPP/XN03K02/Jy6Y/NHzyIAIpxuZIM/YqAkfiXFPxA2CTm7NtCijK9EDu09u2w==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@nodable/entities": "^2.1.0",
+        "fast-xml-builder": "^1.1.5",
+        "path-expression-matcher": "^1.5.0",
+        "strnum": "^2.2.3"
+      },
+      "bin": {
+        "fxparser": "src/cli/cli.js"
+      }
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -7426,6 +9055,21 @@
         "node": ">=8"
       }
     },
+    "node_modules/path-expression-matcher": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
+      "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/path-key": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -7935,6 +9579,18 @@
         }
       }
     },
+    "node_modules/pretty-bytes": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-7.1.0.tgz",
+      "integrity": "sha512-nODzvTiYVRGRqAOvE84Vk5JDPyyxsVk0/fbA/bq7RqlnhksGpset09XTxbpvLTIjoaF7K8Z8DG8yHtKGTPSYRw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/prisma": {
       "version": "7.4.2",
       "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.4.2.tgz",
@@ -9145,6 +10801,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/strnum": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz",
+      "integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/superstruct": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/superstruct/-/superstruct-2.0.2.tgz",
diff --git a/package.json b/package.json
index f7b6ed81..9272a319 100644
--- a/package.json
+++ b/package.json
@@ -57,11 +57,13 @@
     "zod": "^4.3.6"
   },
   "dependencies": {
+    "@aws-sdk/client-s3": "^3.1041.0",
     "@internationalized/date": "^3.11.0",
     "antlr4ng": "^3.0.16",
     "better-auth": "^1.5.4",
     "monaco-editor": "^0.55.1",
     "pino": "^10.3.1",
+    "pretty-bytes": "^7.1.0",
     "prom-client": "^15.1.3",
     "undici": "^7.24.4"
   }
diff --git a/src/lib/components/layout/header/Header.svelte b/src/lib/components/layout/header/Header.svelte
index c0883480..e73d9a41 100644
--- a/src/lib/components/layout/header/Header.svelte
+++ b/src/lib/components/layout/header/Header.svelte
@@ -20,17 +20,24 @@
 </script>
 
 <header
-  class="border-base-300 bg-base-100 flex h-16 shrink-0 items-center gap-4 border-b px-4 lg:px-6"
+  class="
+    border-base-300 bg-base-100 flex h-16 shrink-0 items-center gap-4 border-b
+    px-4
+    lg:px-6
+  "
 >
   <!-- Mobile menu button -->
   <button
-    class="btn btn-ghost btn-sm btn-square lg:hidden"
+    class="
+      btn btn-square btn-ghost btn-sm
+      lg:hidden
+    "
     onclick={onToggleMobile}
     aria-label={mobileOpen ? m.header_close_nav() : m.header_open_nav()}
     aria-expanded={mobileOpen}
     aria-controls="sidebar"
   >
-    <Icon icon="material-symbols:menu" class="h-5 w-5" aria-hidden="true" />
+    <Icon icon="material-symbols:menu" class="size-5" aria-hidden="true" />
   </button>
 
   <h1 class="text-base-content text-lg font-semibold">{title}</h1>
diff --git a/src/lib/components/layout/header/LanguageSwitcher.svelte b/src/lib/components/layout/header/LanguageSwitcher.svelte
index 0d3e99d7..d4f42eed 100644
--- a/src/lib/components/layout/header/LanguageSwitcher.svelte
+++ b/src/lib/components/layout/header/LanguageSwitcher.svelte
@@ -26,20 +26,26 @@
 </script>
 
 <button
-  class={`btn btn-ghost btn-sm ${showLabel ? 'gap-2' : 'btn-square'}`}
+  class={`
+    btn btn-ghost btn-sm
+    ${showLabel ? 'gap-2' : 'btn-square'}
+  `}
   popovertarget="lang-switcher"
   style="anchor-name:--lang-switcher"
   aria-label={showLabel
     ? `${m.language_label()}: ${currentLocaleMeta.label()}`
     : m.language_label()}
 >
-  <Icon icon="material-symbols:language" class="h-5 w-5" aria-hidden="true" />
+  <Icon icon="material-symbols:language" class="size-5" aria-hidden="true" />
   {#if showLabel}
     <span class="text-sm font-medium">{currentLocaleMeta.label()}</span>
   {/if}
 </button>
 <ul
-  class="dropdown dropdown-end menu bg-base-100 border-base-300 w-40 rounded-lg border p-1 shadow-lg"
+  class="
+    menu dropdown dropdown-end border-base-300 bg-base-100 w-40 rounded-lg
+    border p-1 shadow-lg
+  "
   popover
   id="lang-switcher"
   style="position-anchor:--lang-switcher"
@@ -54,7 +60,7 @@
       >
         <span>{locale.label()}</span>
         {#if isActive}
-          <Icon icon="material-symbols:check" class="h-4 w-4" aria-hidden="true" />
+          <Icon icon="material-symbols:check" class="size-4" aria-hidden="true" />
         {/if}
       </button>
     </li>
diff --git a/src/lib/components/layout/header/ThemeToggle.svelte b/src/lib/components/layout/header/ThemeToggle.svelte
index ef5af4fd..db4d6362 100644
--- a/src/lib/components/layout/header/ThemeToggle.svelte
+++ b/src/lib/components/layout/header/ThemeToggle.svelte
@@ -20,14 +20,18 @@
   });
 </script>
 
-<button
-  onclick={() => (dark = !dark)}
-  class="btn btn-ghost btn-sm btn-square"
-  aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
->
-  {#if dark}
-    <Icon icon="material-symbols:light-mode" class="h-5 w-5" aria-hidden="true" />
-  {:else}
-    <Icon icon="material-symbols:dark-mode" class="h-5 w-5" aria-hidden="true" />
-  {/if}
-</button>
+<label class="swap swap-rotate">
+  <!-- this hidden checkbox controls the state -->
+  <input
+    type="checkbox"
+    class="theme-controller"
+    bind:checked={dark}
+    aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
+  />
+
+  <!-- sun icon (visible when unchecked) -->
+  <Icon icon="material-symbols:light-mode" class="swap-off size-5" aria-hidden="true" />
+
+  <!-- moon icon (visible when checked) -->
+  <Icon icon="material-symbols:dark-mode" class="swap-on size-5" aria-hidden="true" />
+</label>
diff --git a/src/lib/components/layout/header/UserMenu.svelte b/src/lib/components/layout/header/UserMenu.svelte
index 6427cc43..d6cc55ed 100644
--- a/src/lib/components/layout/header/UserMenu.svelte
+++ b/src/lib/components/layout/header/UserMenu.svelte
@@ -18,12 +18,21 @@
 </script>
 
 <div class="dropdown dropdown-end">
-  <button tabindex="0" class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
+  <button tabindex="0" class="btn btn-circle btn-ghost" aria-label={m.header_user_menu()}>
     {#if user.image}
-      <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
+      <img
+        src={user.image}
+        alt={user.name ?? ''}
+        class="
+        size-8 rounded-full object-cover
+      "
+      />
     {:else}
       <span
-        class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
+        class="
+          bg-primary/10 text-primary flex size-8 items-center justify-center
+          rounded-full text-xs font-semibold
+        "
         aria-hidden="true"
       >
         {initials}
@@ -33,7 +42,10 @@
   <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
   <ul
     tabindex="0"
-    class="dropdown-content menu bg-base-100 border-base-300 z-10 w-56 rounded-lg border p-1 shadow-lg"
+    class="
+      dropdown-content menu border-base-300 bg-base-100 z-10 w-56 rounded-lg
+      border p-1 shadow-lg
+    "
   >
     <li class="px-3 py-2">
       <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
@@ -42,7 +54,7 @@
     <!-- <li><hr class="border-base-300 my-1" /></li> -->
     <li class="mt-4">
       <a href="/auth/logout" class="text-sm">
-        <Icon icon="material-symbols:logout" class="h-4 w-4" aria-hidden="true" />
+        <Icon icon="material-symbols:logout" class="size-4" aria-hidden="true" />
         {m.header_sign_out()}
       </a>
     </li>
diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index 4a46fee6..4a8797d5 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -39,13 +39,16 @@
 
 {#snippet navIcon(name: string)}
   {@const iconName = `material-symbols:${name}`}
-  <Icon icon={iconName} class="h-5 w-5 shrink-0" aria-hidden="true" />
+  <Icon icon={iconName} class="size-5 shrink-0" aria-hidden="true" />
 {/snippet}
 
 <!-- Mobile backdrop -->
 {#if mobileOpen}
   <button
-    class="fixed inset-0 z-40 bg-black/30 backdrop-blur-sm lg:hidden"
+    class="
+      fixed inset-0 z-40 bg-black/30 backdrop-blur-sm
+      lg:hidden
+    "
     onclick={() => (mobileOpen = false)}
     aria-label={m.sidebar_close_nav()}
     tabindex="-1"
@@ -57,15 +60,20 @@
   bind:this={sidebarEl}
   id="sidebar"
   aria-label={m.sidebar_label()}
-  class="border-base-300 bg-base-100 fixed inset-y-0 left-0 z-50 flex flex-col border-r
-    transition-[transform,width] duration-200 ease-out
+  class="
+    border-base-300 bg-base-100 fixed inset-y-0 left-0 z-50 flex flex-col
+    border-r transition-[transform,width] duration-200 ease-out
     lg:relative lg:inset-auto lg:z-auto lg:translate-x-0
     {mobileOpen ? 'translate-x-0' : '-translate-x-full'}
     {collapsed ? 'w-16' : 'w-60'}"
 >
   <!-- Brand -->
-  <div class="border-base-300 flex h-16 shrink-0 items-center gap-3 border-b px-4">
-    <img src="/stackable-logo-bimi-v2.svg" alt="" class="h-7 w-7 shrink-0" />
+  <div
+    class="
+    border-base-300 flex h-16 shrink-0 items-center gap-3 border-b px-4
+  "
+  >
+    <img src="/stackable-logo-bimi-v2.svg" alt="" class="size-7 shrink-0" />
     {#if !collapsed}
       <span class="text-base-content text-lg font-bold tracking-tight">Stackable</span>
     {/if}
@@ -73,7 +81,7 @@
 
   <!-- Navigation -->
   <nav
-    class="flex-1 overflow-x-hidden overflow-y-auto px-3 py-4"
+    class="flex-1 px-3 py-4 {collapsed ? 'overflow-visible' : 'overflow-x-hidden overflow-y-auto'}"
     aria-label={m.sidebar_nav_label()}
   >
     {#each sections as section, sectionIdx (section.title)}
@@ -82,7 +90,12 @@
       {/if}
 
       {#if !collapsed}
-        <div class="text-base-content/60 mb-2 px-3 text-xs font-semibold tracking-wider uppercase">
+        <div
+          class="
+            text-base-content/60 mb-2 px-3 text-xs font-semibold tracking-wider
+            uppercase
+          "
+        >
           {section.title}
         </div>
       {/if}
@@ -95,11 +108,17 @@
               href={item.href}
               onclick={(e) => handleNavClick(e, item)}
               onkeydown={(e) => handleNavKeydown(e, item)}
-              title={collapsed ? item.label : undefined}
-              class="flex min-h-[44px] items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium transition-colors
+              data-tip={collapsed ? item.label : undefined}
+              class="
+                flex min-h-11 items-center gap-3 rounded-lg px-3 py-2
+                text-sm font-medium transition-colors
+                {collapsed ? 'tooltip tooltip-right' : ''}
                 {active
                 ? 'bg-primary/10 text-primary'
-                : 'text-base-content/70 hover:bg-base-content/5 hover:text-base-content'}
+                : `
+                  text-base-content/70
+                  hover:bg-base-content/5 hover:text-base-content
+                `}
                 {item.disabled ? 'opacity-40' : ''}
                 {collapsed ? 'justify-center' : ''}"
               aria-current={active ? 'page' : undefined}
@@ -110,7 +129,11 @@
                 <span class="truncate">{item.label}</span>
                 {#if item.badge}
                   <span
-                    class="bg-base-300 text-base-content/60 ml-auto rounded-md px-1.5 py-0.5 text-xs font-semibold tracking-wider uppercase"
+                    class="
+                      bg-base-300 text-base-content/60 ml-auto rounded-md px-1.5 py-0.5
+                      text-xs font-semibold tracking-wider
+                      uppercase
+                    "
                   >
                     {item.badge}
                   </span>
@@ -124,18 +147,26 @@
   </nav>
 
   <!-- Footer: collapse toggle (desktop only) -->
-  <div class="border-base-300 hidden shrink-0 border-t p-3 lg:block">
+  <div
+    class="
+      border-base-300 hidden shrink-0 border-t p-3
+      lg:block
+    "
+  >
     <button
       onclick={() => (collapsed = !collapsed)}
-      class="text-base-content/60 hover:bg-base-content/5 hover:text-base-content flex w-full items-center gap-3 rounded-lg px-3 py-2
-        text-sm font-medium transition-colors hover:cursor-pointer
-        {collapsed ? 'justify-center' : ''}"
+      data-tip={collapsed ? m.sidebar_expand() : undefined}
+      class="
+        text-base-content/60 hover:bg-base-content/5 hover:text-base-content flex w-full items-center gap-3 rounded-lg px-3
+        py-2 text-sm
+        font-medium transition-colors hover:cursor-pointer
+        {collapsed ? 'tooltip tooltip-right justify-center' : ''}"
       aria-label={collapsed ? m.sidebar_expand() : m.sidebar_collapse()}
     >
       {#if collapsed}
-        <Icon icon="material-symbols:chevron-right" class="h-4 w-4 shrink-0" aria-hidden="true" />
+        <Icon icon="material-symbols:chevron-right" class="size-4 shrink-0" aria-hidden="true" />
       {:else}
-        <Icon icon="material-symbols:chevron-left" class="h-4 w-4 shrink-0" aria-hidden="true" />
+        <Icon icon="material-symbols:chevron-left" class="size-4 shrink-0" aria-hidden="true" />
         <span>{m.sidebar_collapse_label()}</span>
       {/if}
     </button>
diff --git a/src/lib/components/layout/sidebar/nav-items.ts b/src/lib/components/layout/sidebar/nav-items.ts
index dc7ca30d..9577b366 100644
--- a/src/lib/components/layout/sidebar/nav-items.ts
+++ b/src/lib/components/layout/sidebar/nav-items.ts
@@ -16,6 +16,11 @@ export function getNavSections(): NavSection[] {
           label: m.nav_trino(),
           href: '/trino',
           icon: 'database'
+        },
+        {
+          label: m.nav_storage(),
+          href: '/storage',
+          icon: 'folder'
         }
       ]
     }
diff --git a/src/lib/components/storage/BucketGrid.svelte b/src/lib/components/storage/BucketGrid.svelte
new file mode 100644
index 00000000..2cb72c9b
--- /dev/null
+++ b/src/lib/components/storage/BucketGrid.svelte
@@ -0,0 +1,40 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    buckets?: string[];
+  }
+
+  let { buckets = [] }: Props = $props();
+</script>
+
+{#if buckets.length > 0}
+  <div
+    class="
+    grid grid-cols-2 gap-3
+    sm:grid-cols-3
+    md:grid-cols-4
+    lg:grid-cols-6
+  "
+  >
+    {#each buckets as bucket (bucket)}
+      <div class="tooltip tooltip-bottom" data-tip={bucket}>
+        <a
+          href="/storage/{encodeURIComponent(bucket)}"
+          data-sveltekit-preload-data="off"
+          class="
+            border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 flex flex-col items-center
+            gap-2 rounded-xl border p-4
+            text-center transition-colors
+          "
+        >
+          <Icon icon="mdi:bucket-outline" class="text-warning size-10" aria-hidden="true" />
+          <span class="w-full truncate text-sm font-medium">{bucket}</span>
+        </a>
+      </div>
+    {/each}
+  </div>
+{:else}
+  <p class="text-base-content/50 text-sm">{m.storage_buckets_empty()}</p>
+{/if}
diff --git a/src/lib/components/storage/BucketList.svelte b/src/lib/components/storage/BucketList.svelte
new file mode 100644
index 00000000..32bcfc67
--- /dev/null
+++ b/src/lib/components/storage/BucketList.svelte
@@ -0,0 +1,90 @@
+<script lang="ts">
+  import { page } from '$app/state';
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    buckets: string[];
+  }
+
+  let { buckets }: Props = $props();
+
+  const activeBucket = $derived(page.params.bucket ?? null);
+</script>
+
+<nav
+  class="
+    border-base-300 bg-base-100 flex w-48 shrink-0 flex-col overflow-hidden
+    rounded-lg border
+  "
+  aria-label={m.storage_buckets_label()}
+>
+  <div
+    class="
+      border-base-300 flex items-center justify-between border-b px-3 py-2
+    "
+  >
+    <span
+      class="
+        text-base-content/50 text-xs font-semibold tracking-wide uppercase
+      "
+    >
+      {m.storage_buckets_label()}
+    </span>
+    <a
+      href="/storage"
+      data-sveltekit-preload-data="off"
+      class="btn btn-ghost btn-xs"
+      title={m.storage_view_all_buckets()}
+      aria-label={m.storage_view_all_buckets()}
+    >
+      <Icon icon="material-symbols:grid-view" class="size-3.5" aria-hidden="true" />
+    </a>
+  </div>
+
+  <ul class="flex-1 overflow-y-auto py-1" role="list">
+    {#if buckets.length === 0}
+      <li class="text-base-content/40 px-3 py-4 text-center text-xs">
+        {m.storage_buckets_empty()}
+      </li>
+    {:else}
+      {#each buckets as bucket (bucket)}
+        <li role="none">
+          <a
+            href="/storage/{encodeURIComponent(bucket)}"
+            data-sveltekit-preload-data="off"
+            class="
+              hover:bg-base-200 flex items-center gap-2 px-3 py-1.5
+              text-sm
+              {activeBucket === bucket
+              ? 'bg-primary/10 text-primary font-medium'
+              : 'text-base-content'}"
+            aria-current={activeBucket === bucket ? 'page' : undefined}
+          >
+            <Icon
+              icon="mdi:bucket-outline"
+              class="size-3.5 shrink-0 opacity-60"
+              aria-hidden="true"
+            />
+            <span class="truncate">{bucket}</span>
+          </a>
+        </li>
+      {/each}
+    {/if}
+  </ul>
+
+  <!-- TODO: This needs to be a two step process to avoid unintentional disconnects from misclicks -->
+  <!-- Disconnect button -->
+  <div class="border-base-300 border-t p-2">
+    <form method="POST" action="/storage?/disconnect">
+      <button
+        type="submit"
+        class="
+        btn text-base-content/60 btn-ghost btn-xs hover:text-error w-full
+      "
+      >
+        {m.storage_disconnect()}
+      </button>
+    </form>
+  </div>
+</nav>
diff --git a/src/lib/components/storage/ContextMenu.svelte b/src/lib/components/storage/ContextMenu.svelte
new file mode 100644
index 00000000..a8763b37
--- /dev/null
+++ b/src/lib/components/storage/ContextMenu.svelte
@@ -0,0 +1,132 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    x: number;
+    y: number;
+    selectionCount: number;
+    canPreview: boolean;
+    canDownload: boolean;
+    onaction: (action: string) => void;
+    onclose: () => void;
+  }
+
+  let { x, y, selectionCount, canPreview, canDownload, onaction, onclose }: Props = $props();
+
+  let menuEl = $state<HTMLUListElement | null>(null);
+
+  // Adjust position so menu stays within viewport
+  const adjustedPos = $derived.by(() => {
+    if (!menuEl) return { left: x, top: y };
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left: x + rect.width > window.innerWidth ? x - rect.width : x,
+      top: y + rect.height > window.innerHeight ? y - rect.height : y
+    };
+  });
+
+  function emit(action: string) {
+    onaction(action);
+    onclose();
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (e.key === 'Escape') onclose();
+  }
+
+  function handleOutsideClick(e: MouseEvent) {
+    if (menuEl && !menuEl.contains(e.target as Node)) onclose();
+  }
+
+  onMount(() => {
+    menuEl?.focus();
+    document.addEventListener('click', handleOutsideClick, true);
+    return () => document.removeEventListener('click', handleOutsideClick, true);
+  });
+
+  const actions = [
+    {
+      key: 'preview',
+      icon: 'material-symbols:visibility',
+      label: () => m.storage_action_preview(),
+      disabled: () => !canPreview
+    },
+    {
+      key: 'rename',
+      icon: 'material-symbols:edit',
+      label: () => m.storage_action_rename(),
+      disabled: () => selectionCount !== 1
+    },
+    {
+      key: 'download',
+      icon: 'material-symbols:download',
+      label: () => m.storage_action_download(),
+      disabled: () => !canDownload
+    },
+    {
+      key: 'move',
+      icon: 'material-symbols:drive-file-move',
+      label: () => m.storage_action_move(),
+      disabled: () => selectionCount === 0
+    }
+  ];
+
+  const dangerActions = [
+    {
+      key: 'delete',
+      icon: 'material-symbols:delete',
+      label: () => m.storage_action_delete(),
+      disabled: () => selectionCount === 0,
+      class: 'text-error'
+    }
+  ];
+</script>
+
+<svelte:window onkeydown={handleKeydown} />
+
+<ul
+  bind:this={menuEl}
+  class="
+    menu menu-sm border-base-300 bg-base-100 absolute z-50 w-48 rounded-lg
+    border p-1 shadow-lg
+  "
+  role="menu"
+  tabindex="-1"
+  style="left: {adjustedPos.left}px; top: {adjustedPos.top}px;"
+>
+  {#each actions as act (act.key)}
+    <li role="none">
+      <button
+        role="menuitem"
+        class="justify-start"
+        onclick={() => emit(act.key)}
+        disabled={act.disabled()}
+      >
+        <Icon icon={act.icon} class="mr-2 size-4 shrink-0" aria-hidden="true" />
+        {act.label()}
+      </button>
+    </li>
+  {/each}
+
+  <li class="menu-title" role="none"><span>{m.storage_danger_zone()}</span></li>
+
+  {#each dangerActions as act (act.key)}
+    <li role="none">
+      <button
+        role="menuitem"
+        class={'justify-start ' + (act.class ?? '')}
+        onclick={() => emit(act.key)}
+        disabled={act.disabled()}
+      >
+        <Icon
+          icon={act.icon}
+          class={'mr-2 h-4 w-4 shrink-0 ' + (act.class ?? '')}
+          aria-hidden="true"
+        />
+        {act.label()}
+      </button>
+    </li>
+  {/each}
+</ul>
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
new file mode 100644
index 00000000..954186cb
--- /dev/null
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -0,0 +1,189 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import StorageBreadcrumb from './StorageBreadcrumb.svelte';
+  import ObjectTable from './ObjectTable.svelte';
+  import ContextMenu from './ContextMenu.svelte';
+  import type { StoragePage } from '$lib/types/storage.js';
+
+  interface Props {
+    bucket: string;
+    objects: StoragePage;
+    prefix: string;
+    onnavigate: (prefix: string) => void;
+  }
+
+  let { bucket, objects, prefix, onnavigate }: Props = $props();
+
+  // ── Derived folder/file lists ─────────────────────────────────────────────
+  const folders = $derived(objects.objects.filter((o) => o.isDirectory));
+  const files = $derived(objects.objects.filter((o) => !o.isDirectory));
+
+  // ── Selection state ───────────────────────────────────────────────────────
+  let selectedKeys = $state<Set<string>>(new Set());
+  let selectionMode = $state(false);
+
+  // Clear selection on navigation
+  $effect(() => {
+    prefix;
+    selectedKeys = new Set();
+  });
+
+  function toggleSelectionMode() {
+    selectionMode = !selectionMode;
+    if (!selectionMode) selectedKeys = new Set();
+  }
+
+  function toggleSelect(key: string, force = false) {
+    if (force || selectionMode) {
+      const next = new Set(selectedKeys);
+      if (next.has(key)) next.delete(key);
+      else next.add(key);
+      selectedKeys = next;
+    } else {
+      selectedKeys = new Set([key]);
+    }
+  }
+
+  function selectAll(checked: boolean) {
+    if (checked) {
+      selectedKeys = new Set([...folders.map((f) => f.key), ...files.map((f) => f.key)]);
+    } else {
+      selectedKeys = new Set();
+    }
+  }
+
+  const totalItemCount = $derived(folders.length + files.length);
+  const allSelected = $derived(totalItemCount > 0 && selectedKeys.size >= totalItemCount);
+  const someSelected = $derived(selectedKeys.size > 0 && selectedKeys.size < totalItemCount);
+  const showCheckboxes = $derived(selectionMode || selectedKeys.size > 0);
+
+  const selectedFiles = $derived(files.filter((f) => selectedKeys.has(f.key)));
+  const selectedFolders = $derived(folders.filter((f) => selectedKeys.has(f.key)));
+  const deleteCount = $derived(selectedFiles.length + selectedFolders.length);
+
+  // ── Loading state ─────────────────────────────────────────────────────────
+  let loading = $state(false);
+
+  // Clear loading when new objects arrive from the server
+  $effect(() => {
+    objects;
+    loading = false;
+  });
+
+  function handleNavigate(prefix: string) {
+    loading = true;
+    onnavigate(prefix);
+  }
+
+  // ── Context menu ──────────────────────────────────────────────────────────
+  let ctxMenu = $state<{ x: number; y: number } | null>(null);
+
+  let ctxKey = $state<string | null>(null);
+
+  function openContextMenu(e: MouseEvent, key: string) {
+    e.preventDefault();
+    e.stopPropagation();
+    ctxKey = key;
+    ctxMenu = { x: e.clientX, y: e.clientY };
+  }
+
+  // ── Modal state ───────────────────────────────────────────────────────────
+  let showDeleteModal = $state(false);
+
+  // ── Action dispatch ───────────────────────────────────────────────────────
+  function handleAction(action: string) {
+    switch (action) {
+      case 'preview':
+        alert(m.storage_action_preview() + ' — not implemented');
+        break;
+      case 'rename':
+        alert(m.storage_action_rename() + ' — not implemented');
+        break;
+      case 'download':
+        alert(m.storage_action_download() + ' — not implemented');
+        break;
+      case 'move':
+        alert(m.storage_action_move() + ' — not implemented');
+        break;
+      case 'delete':
+        alert(m.storage_action_delete() + ' — not implemented');
+        break;
+      default:
+        alert(`${action} — not implemented`);
+    }
+  }
+
+  // ── Keyboard shortcuts ────────────────────────────────────────────────────
+  function handleGlobalKeydown(e: KeyboardEvent) {
+    if (showDeleteModal) return;
+    if (e.key === 'Delete' && selectedKeys.size > 0) showDeleteModal = true;
+    else if (e.key === 'F2' && selectedKeys.size === 1) handleAction('rename');
+    else if (e.key === 'Escape') selectedKeys = new Set();
+  }
+</script>
+
+<svelte:window onkeydown={handleGlobalKeydown} />
+
+<!-- svelte-ignore a11y_click_events_have_key_events -->
+<!-- svelte-ignore a11y_no_static_element_interactions -->
+<div
+  class="bg-base-100 flex flex-1 flex-col overflow-hidden"
+  onclick={(e) => {
+    if (!(e.target as HTMLElement).closest('tr')) selectedKeys = new Set();
+  }}
+>
+  <StorageBreadcrumb
+    {bucket}
+    {prefix}
+    folderCount={folders.length}
+    fileCount={files.length}
+    {selectionMode}
+    onnavigate={handleNavigate}
+    onToggleSelectionMode={toggleSelectionMode}
+  />
+
+  <div class="relative flex-1 overflow-y-auto">
+    {#if loading}
+      <div
+        class="
+          bg-base-100/70 absolute inset-0 z-10 flex items-center justify-center
+        "
+        aria-live="polite"
+        aria-label={m.storage_loading()}
+      >
+        <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
+      </div>
+    {/if}
+    <ObjectTable
+      {prefix}
+      {folders}
+      {files}
+      {selectedKeys}
+      {ctxKey}
+      {showCheckboxes}
+      {allSelected}
+      {someSelected}
+      onnavigate={handleNavigate}
+      onSelectAll={selectAll}
+      onToggleSelect={toggleSelect}
+      onContextMenu={openContextMenu}
+      onaction={handleAction}
+    />
+  </div>
+</div>
+
+<!-- Context menu -->
+{#if ctxMenu}
+  <ContextMenu
+    x={ctxMenu.x}
+    y={ctxMenu.y}
+    selectionCount={selectedKeys.size}
+    canPreview={selectedFiles.length === 1 && selectedFolders.length === 0}
+    canDownload={selectedFiles.length > 0}
+    onaction={handleAction}
+    onclose={() => {
+      ctxMenu = null;
+      ctxKey = null;
+    }}
+  />
+{/if}
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
new file mode 100644
index 00000000..cf564f4a
--- /dev/null
+++ b/src/lib/components/storage/ObjectTable.svelte
@@ -0,0 +1,307 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import Icon from '@iconify/svelte';
+  import SelectionToolbar from './SelectionToolbar.svelte';
+  import { fileIconKind, iconColors, formatDate, keyToName } from './storage-utils.js';
+  import type { StorageObject } from '$lib/types/storage.js';
+  import { flip } from 'svelte/animate';
+  import prettyBytes from 'pretty-bytes';
+
+  interface Props {
+    prefix: string;
+    folders: StorageObject[];
+    files: StorageObject[];
+    selectedKeys: Set<string>;
+    ctxKey: string | null;
+    showCheckboxes: boolean;
+    allSelected: boolean;
+    someSelected: boolean;
+    onnavigate: (prefix: string) => void;
+    onSelectAll: (checked: boolean) => void;
+    onToggleSelect: (key: string, force?: boolean) => void;
+    onContextMenu: (e: MouseEvent, key: string) => void;
+    onaction: (action: string) => void;
+  }
+
+  let {
+    prefix,
+    folders,
+    files,
+    selectedKeys,
+    ctxKey,
+    showCheckboxes,
+    allSelected,
+    someSelected,
+    onnavigate,
+    onSelectAll,
+    onToggleSelect,
+    onContextMenu,
+    onaction
+  }: Props = $props();
+
+  const selectedCount = $derived(selectedKeys.size);
+  const canPreview = $derived(
+    files.filter((f) => selectedKeys.has(f.key)).length === 1 &&
+      folders.filter((f) => selectedKeys.has(f.key)).length === 0
+  );
+  const selectedFileCount = $derived(files.filter((f) => selectedKeys.has(f.key)).length);
+  const canRename = $derived(
+    (selectedFileCount === 1 && folders.filter((f) => selectedKeys.has(f.key)).length === 0) ||
+      (folders.filter((f) => selectedKeys.has(f.key)).length === 1 && selectedFileCount === 0)
+  );
+  const canDownload = $derived(selectedFileCount > 0);
+
+  let selectAllEl = $state<HTMLInputElement | null>(null);
+  $effect(() => {
+    if (selectAllEl) selectAllEl.indeterminate = someSelected;
+  });
+
+  function navigateUp() {
+    if (!prefix) return;
+    const withoutTrailing = prefix.slice(0, -1);
+    const lastSlash = withoutTrailing.lastIndexOf('/');
+    onnavigate(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
+  }
+</script>
+
+<div class="overflow-x-auto">
+  <table class="table-sm table">
+    <thead>
+      <!-- Column headers -->
+      <tr
+        class="
+          bg-base-200/60 text-base-content/50 text-xs tracking-wide uppercase
+        "
+      >
+        <th class="w-8 pr-0">
+          <input
+            type="checkbox"
+            class="
+              checkbox checkbox-xs
+              {!showCheckboxes ? `pointer-events-none invisible` : ''}"
+            bind:this={selectAllEl}
+            checked={allSelected}
+            onchange={(e) => onSelectAll(e.currentTarget.checked)}
+            onclick={(e) => e.stopPropagation()}
+            disabled={!showCheckboxes}
+            aria-label="Select all"
+          />
+        </th>
+        <th class="w-7/12 font-semibold">{m.storage_header_name()}</th>
+        <th class="w-2/12 text-right font-semibold">{m.storage_header_size()}</th>
+        <th class="w-3/12 font-semibold">{m.storage_header_last_modified()}</th>
+        <th class="w-10"></th>
+      </tr>
+
+      <!-- Selection action toolbar -->
+      <SelectionToolbar {selectedCount} {canPreview} {canRename} {canDownload} {onaction} />
+    </thead>
+
+    <tbody>
+      <!-- Parent directory row -->
+      {#if prefix}
+        <tr class="hover cursor-pointer" onclick={navigateUp}>
+          <td class="pr-0"></td>
+          <td colspan={3}>
+            <div class="text-base-content/50 flex items-center gap-2">
+              <Icon icon="material-symbols:arrow-back" class="size-4 shrink-0" aria-hidden="true" />
+              <span class="tracking-widest italic" aria-label={m.storage_parent_dir()}>...</span>
+            </div>
+          </td>
+          <td></td>
+        </tr>
+      {/if}
+
+      <!-- Folders -->
+      {#each folders as folder (folder.key)}
+        <tr
+          animate:flip={{ duration: 200 }}
+          class="
+            group cursor-pointer select-none
+            {ctxKey === folder.key
+            ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
+            : selectedKeys.has(folder.key)
+              ? `
+                bg-primary/10
+                hover:bg-primary/15
+              `
+              : 'hover'}"
+          onclick={(e) => {
+            if (showCheckboxes || e.ctrlKey || e.metaKey) {
+              onToggleSelect(folder.key, true);
+            } else {
+              onnavigate(folder.key);
+            }
+          }}
+          ondblclick={(e) => {
+            if (e.ctrlKey || e.metaKey) {
+              onnavigate(folder.key);
+            }
+          }}
+          oncontextmenu={(e) => onContextMenu(e, folder.key)}
+        >
+          <td class="pr-0">
+            <input
+              type="checkbox"
+              class="
+                checkbox checkbox-xs
+                {!showCheckboxes ? `pointer-events-none invisible` : ''}"
+              checked={selectedKeys.has(folder.key)}
+              onchange={() => onToggleSelect(folder.key, true)}
+              onclick={(e) => e.stopPropagation()}
+              disabled={!showCheckboxes}
+              aria-label="Select {keyToName(folder.key)}"
+            />
+          </td>
+          <td>
+            <div class="flex items-center gap-2.5">
+              <Icon
+                icon="material-symbols:folder"
+                class="text-warning size-5 shrink-0"
+                aria-hidden="true"
+              />
+              <span class="font-medium">{keyToName(folder.key)}/</span>
+            </div>
+          </td>
+          <td class="text-base-content/30 text-right">—</td>
+          <td class="text-base-content/30">—</td>
+          <td class="w-10 py-0 pr-2 text-right">
+            <button
+              class="
+                btn btn-ghost btn-xs opacity-0
+                group-hover:opacity-100
+              "
+              title="Actions"
+              aria-label="Actions for {keyToName(folder.key)}"
+              onclick={(e) => onContextMenu(e, folder.key)}
+            >
+              <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
+            </button>
+          </td>
+        </tr>
+      {/each}
+
+      <!-- Files -->
+      {#each files as file (file.key)}
+        {@const kind = fileIconKind(file.contentType)}
+        {@const color = iconColors[kind]}
+        <tr
+          animate:flip={{ duration: 200 }}
+          class="
+            group cursor-pointer select-none
+            {ctxKey === file.key
+            ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
+            : selectedKeys.has(file.key)
+              ? `
+                bg-primary/10
+                hover:bg-primary/15
+              `
+              : 'hover'}"
+          onclick={(e) => onToggleSelect(file.key, e.ctrlKey || e.metaKey)}
+          ondblclick={() => onaction('preview')}
+          oncontextmenu={(e) => onContextMenu(e, file.key)}
+        >
+          <td class="pr-0">
+            <input
+              type="checkbox"
+              class="
+                checkbox checkbox-xs
+                {!showCheckboxes ? `pointer-events-none invisible` : ''}"
+              checked={selectedKeys.has(file.key)}
+              onchange={() => onToggleSelect(file.key, true)}
+              onclick={(e) => e.stopPropagation()}
+              disabled={!showCheckboxes}
+              aria-label="Select {keyToName(file.key)}"
+            />
+          </td>
+          <td>
+            <div class="flex items-center gap-2.5">
+              {#if kind === 'image'}
+                <Icon
+                  icon="material-symbols:image"
+                  class="
+                    size-5 shrink-0
+                    {color}"
+                  aria-hidden="true"
+                />
+              {:else if kind === 'code'}
+                <Icon
+                  icon="material-symbols:code"
+                  class="
+                    size-5 shrink-0
+                    {color}"
+                  aria-hidden="true"
+                />
+              {:else if kind === 'archive'}
+                <Icon
+                  icon="material-symbols:archive"
+                  class="
+                    size-5 shrink-0
+                    {color}"
+                  aria-hidden="true"
+                />
+              {:else if kind === 'pdf'}
+                <Icon
+                  icon="material-symbols:picture-as-pdf"
+                  class="
+                    size-5 shrink-0
+                    {color}"
+                  aria-hidden="true"
+                />
+              {:else}
+                <!-- text / document fallback -->
+                <Icon
+                  icon="material-symbols:description"
+                  class="
+                    size-5 shrink-0
+                    {color}"
+                  aria-hidden="true"
+                />
+              {/if}
+              <span class="truncate">{keyToName(file.key)}</span>
+              {#if file.contentType}
+                <span
+                  class="
+                    badge badge-ghost badge-sm ml-1 shrink-0 text-[10px]
+                    opacity-50
+                  "
+                >
+                  {file.contentType.split('/').at(-1) ?? ''}
+                </span>
+              {/if}
+            </div>
+          </td>
+          <td class="text-right font-mono text-sm">{prettyBytes(file.size)}</td>
+          <td class="text-base-content/60 text-sm">{formatDate(file.lastModified)}</td>
+          <td class="w-10 py-0 pr-2 text-right">
+            <button
+              class="
+                btn btn-ghost btn-xs opacity-0
+                group-hover:opacity-100
+              "
+              title="Actions"
+              aria-label="Actions for {keyToName(file.key)}"
+              onclick={(e) => onContextMenu(e, file.key)}
+            >
+              <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
+            </button>
+          </td>
+        </tr>
+      {/each}
+
+      <!-- Empty folder -->
+      {#if folders.length === 0 && files.length === 0}
+        <tr>
+          <td colspan={5} class="text-base-content/40 py-16 text-center">
+            <Icon
+              icon="material-symbols:folder-open"
+              class="mx-auto mb-3 size-10 opacity-30"
+              aria-hidden="true"
+            />
+            {m.storage_bucket_empty()}
+          </td>
+        </tr>
+      {/if}
+    </tbody>
+  </table>
+</div>
diff --git a/src/lib/components/storage/SelectionToolbar.svelte b/src/lib/components/storage/SelectionToolbar.svelte
new file mode 100644
index 00000000..d342e1fc
--- /dev/null
+++ b/src/lib/components/storage/SelectionToolbar.svelte
@@ -0,0 +1,78 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    /** Total number of selected items. */
+    selectedCount: number;
+    canPreview: boolean;
+    canRename: boolean;
+    canDownload: boolean;
+    onaction: (action: string) => void;
+  }
+
+  let { selectedCount, canPreview, canRename, canDownload, onaction }: Props = $props();
+</script>
+
+<tr class="border-primary/20 bg-primary/5 border-t">
+  <th colspan={5} class="px-4 py-1.5 font-normal">
+    <div class="flex items-center gap-1">
+      <span class="text-base-content/50 mr-1 text-xs">
+        {m.storage_selected({ count: selectedCount })}
+      </span>
+
+      <button
+        class="btn btn-ghost btn-xs gap-1"
+        title={m.storage_action_preview()}
+        onclick={() => onaction('preview')}
+        disabled={!canPreview}
+      >
+        <Icon icon="material-symbols:visibility" class="size-3.5" aria-hidden="true" />
+        {m.storage_action_preview()}
+      </button>
+
+      <button
+        class="btn btn-ghost btn-xs gap-1"
+        title="{m.storage_action_rename()} (F2)"
+        onclick={() => onaction('rename')}
+        disabled={!canRename}
+      >
+        <Icon icon="material-symbols:edit" class="size-3.5" aria-hidden="true" />
+        {m.storage_action_rename()}
+      </button>
+
+      <button
+        class="btn btn-ghost btn-xs gap-1"
+        title={m.storage_action_download()}
+        onclick={() => onaction('download')}
+        disabled={!canDownload}
+      >
+        <Icon icon="material-symbols:download" class="size-3.5" aria-hidden="true" />
+        {m.storage_action_download()}
+      </button>
+
+      <button
+        class="btn btn-ghost btn-xs gap-1"
+        title={m.storage_action_move()}
+        onclick={() => onaction('move')}
+        disabled={selectedCount === 0}
+      >
+        <Icon icon="material-symbols:drive-file-move" class="size-3.5" aria-hidden="true" />
+        {m.storage_action_move()}
+      </button>
+
+      <button
+        class="
+          btn text-error btn-ghost btn-xs hover:bg-error/10
+          gap-1
+        "
+        title="{m.storage_action_delete()} (Del)"
+        onclick={() => onaction('delete')}
+        disabled={selectedCount === 0}
+      >
+        <Icon icon="material-symbols:delete" class="size-3.5" aria-hidden="true" />
+        {m.storage_action_delete()}
+      </button>
+    </div>
+  </th>
+</tr>
diff --git a/src/lib/components/storage/StorageBreadcrumb.svelte b/src/lib/components/storage/StorageBreadcrumb.svelte
new file mode 100644
index 00000000..1870e3ef
--- /dev/null
+++ b/src/lib/components/storage/StorageBreadcrumb.svelte
@@ -0,0 +1,178 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    bucket: string;
+    prefix: string;
+    folderCount: number;
+    fileCount: number;
+    selectionMode: boolean;
+    onnavigate: (prefix: string) => void;
+    onToggleSelectionMode: () => void;
+  }
+
+  let {
+    bucket,
+    prefix,
+    folderCount,
+    fileCount,
+    selectionMode,
+    onnavigate,
+    onToggleSelectionMode
+  }: Props = $props();
+
+  const breadcrumbParts = $derived(
+    prefix
+      ? prefix
+          .slice(0, -1)
+          .split('/')
+          .map((label, i, parts) => ({
+            label,
+            prefix: parts.slice(0, i + 1).join('/') + '/'
+          }))
+      : []
+  );
+
+  const MAX_TAIL = 2;
+  const collapsedParts = $derived(
+    breadcrumbParts.length > MAX_TAIL ? breadcrumbParts.slice(0, -MAX_TAIL) : []
+  );
+  const visibleParts = $derived(
+    breadcrumbParts.length > MAX_TAIL ? breadcrumbParts.slice(-MAX_TAIL) : breadcrumbParts
+  );
+</script>
+
+<div class="border-base-300 flex items-center gap-3 border-b px-6 py-3">
+  <!-- Breadcrumbs -->
+  <nav
+    aria-label="breadcrumb"
+    class="
+    flex min-w-0 flex-1 items-center gap-1 text-sm
+  "
+  >
+    {#if breadcrumbParts.length === 0}
+      <span
+        class="
+          text-base-content flex shrink-0 items-center gap-1.5 rounded-sm px-1.5
+          py-0.5 font-medium
+        "
+        title={bucket}
+        aria-current="page"
+      >
+        <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
+        {bucket}
+      </span>
+    {:else}
+      <button
+        class="
+          text-base-content/70 hover:bg-base-200 hover:text-base-content flex shrink-0 items-center gap-1.5
+          rounded-sm px-1.5
+          py-0.5 transition-colors hover:cursor-pointer
+        "
+        title={bucket}
+        onclick={() => onnavigate('')}
+      >
+        <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
+        {bucket}
+      </button>
+    {/if}
+    {#if collapsedParts.length > 0}
+      <Icon
+        icon="material-symbols:chevron-right"
+        class="text-base-content/30 size-4 shrink-0"
+        aria-hidden="true"
+      />
+      <div class="dropdown">
+        <button
+          tabindex="0"
+          class="
+            hover:bg-base-200 hover:text-base-content flex items-center rounded-sm px-1.5
+            py-0.5 transition-colors hover:cursor-pointer
+            focus-visible:outline
+          "
+          aria-label={m.storage_breadcrumb_more()}
+          aria-haspopup="listbox"
+        >
+          <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
+        </button>
+        <ul
+          tabindex="0"
+          role="listbox"
+          aria-label={m.storage_breadcrumb_more()}
+          class="
+            dropdown-content menu rounded-box border-base-300 bg-base-100 z-50 w-48
+            border p-1 shadow-lg
+          "
+        >
+          {#each collapsedParts as part (part.prefix)}
+            <li>
+              <button
+                class="
+                  text-sm
+                  hover:cursor-pointer
+                "
+                onclick={() => onnavigate(part.prefix)}
+              >
+                {part.label}
+              </button>
+            </li>
+          {/each}
+        </ul>
+      </div>
+    {/if}
+    {#each visibleParts as part, i (part.prefix)}
+      {@const isCurrent = i === visibleParts.length - 1}
+      <Icon
+        icon="material-symbols:chevron-right"
+        class="text-base-content/30 size-4 shrink-0"
+        aria-hidden="true"
+      />
+      {#if isCurrent}
+        <span
+          class="
+            text-base-content min-w-0 truncate rounded-sm px-1.5 py-0.5
+            font-medium
+          "
+          title={part.label}
+          aria-current="page"
+        >
+          {part.label}
+        </span>
+      {:else}
+        <button
+          class="
+            hover:bg-base-200 hover:text-base-content min-w-0 truncate rounded-sm px-1.5
+            py-0.5 transition-colors hover:cursor-pointer
+          "
+          title={part.label}
+          onclick={() => onnavigate(part.prefix)}
+        >
+          {part.label}
+        </button>
+      {/if}
+    {/each}
+  </nav>
+
+  <!-- Item count badge -->
+  <span class="text-base-content/40 shrink-0 text-xs">
+    {folderCount}
+    {folderCount === 1 ? m.storage_folder() : m.storage_folders()},
+    {fileCount}
+    {fileCount === 1 ? m.storage_file() : m.storage_files()}
+  </span>
+
+  <!-- Multi-select toggle -->
+  <button
+    class={'btn btn-ghost btn-xs gap-1 ' + (selectionMode ? 'bg-success/20 text-success' : '')}
+    title={m.storage_select_toggle()}
+    aria-pressed={selectionMode}
+    onclick={onToggleSelectionMode}
+  >
+    <span class={'swap swap-rotate ' + (selectionMode ? 'swap-active' : '')} aria-hidden="true">
+      <Icon icon="material-symbols:check-box" class="swap-on size-3.5" />
+      <Icon icon="material-symbols:check-box-outline-blank" class="swap-off size-3.5" />
+    </span>
+    {m.storage_select_toggle()}
+  </button>
+</div>
diff --git a/src/lib/components/storage/StorageConnectForm.svelte b/src/lib/components/storage/StorageConnectForm.svelte
new file mode 100644
index 00000000..c28c7321
--- /dev/null
+++ b/src/lib/components/storage/StorageConnectForm.svelte
@@ -0,0 +1,141 @@
+<script lang="ts">
+  import type { SuperValidated } from 'sveltekit-superforms';
+  import { superForm } from 'sveltekit-superforms';
+  import { zod4 as zod } from 'sveltekit-superforms/adapters';
+  import * as m from '$lib/paraglide/messages.js';
+  import { StorageConnectionSchema } from '$lib/schemas/storage.js';
+  import type { z } from 'zod';
+
+  interface Props {
+    connectionForm: SuperValidated<z.infer<typeof StorageConnectionSchema>, string>;
+  }
+
+  let { connectionForm }: Props = $props();
+
+  const uid = $props.id();
+
+  const { form, errors, enhance, submitting, message } = superForm(connectionForm, {
+    validators: zod(StorageConnectionSchema)
+  });
+</script>
+
+<div class="mx-auto max-w-md p-6">
+  <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
+  <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+
+  <form
+    method="POST"
+    action="?/connect"
+    use:enhance
+    class="
+    flex flex-col gap-4
+  "
+  >
+    <!-- Backend type -->
+    <div>
+      <label for="{uid}-type" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_type()}
+      </label>
+      <select
+        id="{uid}-type"
+        name="type"
+        class="select-bordered select w-full"
+        bind:value={$form.type}
+      >
+        <option value="s3">{m.storage_connect_type_s3()}</option>
+        <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
+      </select>
+    </div>
+
+    <!-- Endpoint URL -->
+    <div>
+      <label for="{uid}-endpoint" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_endpoint()}
+      </label>
+      <input
+        id="{uid}-endpoint"
+        name="endpoint"
+        type="url"
+        class="
+          input-bordered input w-full
+          {$errors.endpoint ? 'input-error' : ''}"
+        placeholder={m.storage_connect_endpoint_placeholder()}
+        bind:value={$form.endpoint}
+      />
+      <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_endpoint_hint()}</p>
+      {#if $errors.endpoint}
+        <p class="text-error mt-1 text-xs">{$errors.endpoint}</p>
+      {/if}
+    </div>
+
+    <!-- Region -->
+    <div>
+      <label for="{uid}-region" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_region()}
+      </label>
+      <input
+        id="{uid}-region"
+        name="region"
+        type="text"
+        class="
+          input-bordered input w-full
+          {$errors.region ? 'input-error' : ''}"
+        bind:value={$form.region}
+      />
+      {#if $errors.region}
+        <p class="text-error mt-1 text-xs">{$errors.region}</p>
+      {/if}
+    </div>
+
+    <!-- Access key ID -->
+    <div>
+      <label for="{uid}-access-key" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_access_key()}
+      </label>
+      <input
+        id="{uid}-access-key"
+        name="accessKeyId"
+        type="text"
+        class="
+          input-bordered input w-full
+          {$errors.accessKeyId ? 'input-error' : ''}"
+        autocomplete="username"
+        bind:value={$form.accessKeyId}
+      />
+      {#if $errors.accessKeyId}
+        <p class="text-error mt-1 text-xs">{$errors.accessKeyId}</p>
+      {/if}
+    </div>
+
+    <!-- Secret access key -->
+    <div>
+      <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_secret_key()}
+      </label>
+      <input
+        id="{uid}-secret-key"
+        name="secretAccessKey"
+        type="password"
+        class="
+          input-bordered input w-full
+          {$errors.secretAccessKey ? `input-error` : ''}"
+        autocomplete="current-password"
+        bind:value={$form.secretAccessKey}
+      />
+      {#if $errors.secretAccessKey}
+        <p class="text-error mt-1 text-xs">{$errors.secretAccessKey}</p>
+      {/if}
+    </div>
+
+    {#if $message}
+      <p class="text-error text-sm">{$message}</p>
+    {/if}
+
+    <button type="submit" class="btn btn-primary" disabled={$submitting}>
+      {#if $submitting}
+        <span class="loading loading-sm loading-spinner"></span>
+      {/if}
+      {m.storage_connect_submit()}
+    </button>
+  </form>
+</div>
diff --git a/src/lib/components/storage/storage-utils.ts b/src/lib/components/storage/storage-utils.ts
new file mode 100644
index 00000000..9ca5bc6b
--- /dev/null
+++ b/src/lib/components/storage/storage-utils.ts
@@ -0,0 +1,45 @@
+export type FileIconKind = 'image' | 'pdf' | 'code' | 'archive' | 'text' | 'document';
+
+const CODE_TYPES = new Set([
+  'application/json',
+  'text/css',
+  'text/html',
+  'application/javascript',
+  'text/javascript',
+  'text/markdown'
+]);
+
+const ARCHIVE_TYPES = new Set(['application/gzip', 'application/zip', 'application/x-tar']);
+
+export function fileIconKind(contentType: string | undefined): FileIconKind {
+  if (!contentType) return 'document';
+  if (contentType.startsWith('image/')) return 'image';
+  if (contentType === 'application/pdf') return 'pdf';
+  if (CODE_TYPES.has(contentType)) return 'code';
+  if (ARCHIVE_TYPES.has(contentType)) return 'archive';
+  if (contentType.startsWith('text/')) return 'text';
+  return 'document';
+}
+
+export const iconColors: Record<FileIconKind, string> = {
+  image: 'text-success',
+  pdf: 'text-error',
+  code: 'text-info',
+  archive: 'text-secondary',
+  text: 'text-warning',
+  document: 'text-primary'
+};
+
+export function formatDate(date: Date): string {
+  return new Intl.DateTimeFormat('en-GB', {
+    year: 'numeric',
+    month: 'short',
+    day: '2-digit'
+  }).format(date);
+}
+
+/** Derive a human-readable display name from an S3 key. */
+export function keyToName(key: string): string {
+  const stripped = key.endsWith('/') ? key.slice(0, -1) : key;
+  return stripped.split('/').at(-1) ?? key;
+}
diff --git a/src/lib/components/trino/StatementResult.svelte b/src/lib/components/trino/StatementResult.svelte
index c829dc2a..94c12f9a 100644
--- a/src/lib/components/trino/StatementResult.svelte
+++ b/src/lib/components/trino/StatementResult.svelte
@@ -104,10 +104,19 @@
   }
 </script>
 
-<div class="border-base-300 border-b last:border-b-0">
+<div
+  class="
+    border-base-300 border-b
+    last:border-b-0
+  "
+>
   {#if showHeader}
     <div
-      class="bg-base-200/50 hover:bg-base-200 flex w-full cursor-pointer items-center gap-5 px-4 py-2 text-left transition-colors"
+      class="
+        bg-base-200/50 hover:bg-base-200 flex w-full cursor-pointer items-center gap-5 px-4
+        py-2 text-left
+        transition-colors
+      "
       onclick={() => (collapsed = !collapsed)}
       onkeydown={(e) => e.key === 'Enter' && (collapsed = !collapsed)}
       role="button"
@@ -117,7 +126,9 @@
       aria-label={m.trino_statement_collapse({ index: index + 1 })}
     >
       <span
-        class="badge badge-sm pointer-events-none {result.state === 'FINISHED'
+        class="
+          badge badge-sm pointer-events-none
+          {result.state === 'FINISHED'
           ? 'badge-success'
           : result.state === 'FAILED'
             ? 'badge-error'
@@ -127,7 +138,11 @@
       >
         {m.trino_statement_header({ index: index + 1 })}
       </span>
-      <code class="text-base-content/60 pointer-events-none max-w-md truncate text-xs">
+      <code
+        class="
+          text-base-content/60 pointer-events-none max-w-md truncate text-xs
+        "
+      >
         {result.sql.length > 80 ? result.sql.slice(0, 80) + '\u2026' : result.sql}
       </code>
       {#if totalRows > 0}
@@ -140,12 +155,12 @@
         </span>
       {/if}
       <span
-        class="text-base-content/40 pointer-events-none transition-transform {collapsed
-          ? ''
-          : 'rotate-180'}"
+        class="
+          text-base-content/40 pointer-events-none transition-transform
+          {collapsed ? '' : 'rotate-180'}"
         aria-hidden="true"
       >
-        <svg class="h-4 w-4" viewBox="0 0 20 20" fill="currentColor">
+        <svg class="size-4" viewBox="0 0 20 20" fill="currentColor">
           <path
             fill-rule="evenodd"
             d="M5.23 7.21a.75.75 0 011.06.02L10 11.168l3.71-3.938a.75.75 0 111.08 1.04l-4.25 4.5a.75.75 0 01-1.08 0l-4.25-4.5a.75.75 0 01.02-1.06z"
@@ -155,7 +170,11 @@
       </span>
     </div>
   {/if}
-  <div id="{uid}-panel" class="{showHeader ? 'px-4 py-2' : 'p-4'} {collapsed ? 'hidden' : ''}">
+  <div
+    id="{uid}-panel"
+    class="{showHeader ? 'px-4 py-2' : 'p-4'}
+      {collapsed ? `hidden` : ''}"
+  >
     {#if result.trinoQueryUrl || result.columns.length > 0}
       <div class="flex items-center gap-2 pb-1">
         {#if result.trinoQueryUrl}
@@ -163,12 +182,12 @@
             href={result.trinoQueryUrl}
             target="_blank"
             rel="noopener noreferrer"
-            class="btn btn-xs btn-ghost"
+            class="btn btn-ghost btn-xs"
           >
             {m.trino_view_in_trino()}
             <svg
               xmlns="http://www.w3.org/2000/svg"
-              class="h-3.5 w-3.5"
+              class="size-3.5"
               viewBox="0 0 20 20"
               fill="currentColor"
               aria-hidden="true"
@@ -186,10 +205,10 @@
           {#if result.trinoQueryUrl}
             <div class="divider divider-horizontal mx-0"></div>
           {/if}
-          <button class="btn btn-xs btn-ghost" onclick={downloadCsv}>
+          <button class="btn btn-ghost btn-xs" onclick={downloadCsv}>
             <svg
               xmlns="http://www.w3.org/2000/svg"
-              class="h-4 w-4"
+              class="size-4"
               viewBox="0 0 20 20"
               fill="currentColor"
               aria-hidden="true"
@@ -202,10 +221,14 @@
             </svg>
             {m.trino_export_csv()}
           </button>
-          <label class="flex cursor-pointer items-center gap-1 text-xs whitespace-nowrap">
+          <label
+            class="
+              flex cursor-pointer items-center gap-1 text-xs whitespace-nowrap
+            "
+          >
             <input
               type="checkbox"
-              class="checkbox checkbox-xs checkbox-primary h-3.5 w-3.5"
+              class="checkbox checkbox-xs checkbox-primary size-3.5"
               checked={includeHeaders}
               onchange={handleIncludeHeadersChange}
             />
@@ -218,12 +241,15 @@
       <div class="flex flex-col gap-2" role="alert">
         <p class="text-error text-sm font-semibold">{m.trino_query_error()}</p>
         <pre
-          class="bg-base-200 text-base-content overflow-x-auto rounded-lg p-3 text-xs whitespace-pre-wrap">{stmtError}</pre>
+          class="
+            bg-base-200 text-base-content overflow-x-auto rounded-lg p-3
+            text-xs whitespace-pre-wrap
+          ">{stmtError}</pre>
       </div>
     {:else if result.state === 'FINISHED' && result.columns.length > 0}
       <div class="overflow-x-auto">
         <table
-          class="table-sm table-zebra table"
+          class="table-zebra table-sm table"
           aria-label={showHeader
             ? `${m.trino_results_label()} \u2014 ${m.trino_statement_header({ index: index + 1 })}`
             : m.trino_results_label()}
@@ -260,7 +286,7 @@
           {#if totalPages > 1}
             <nav class="join" aria-label={m.trino_results_label()}>
               <button
-                class="btn btn-xs join-item"
+                class="btn join-item btn-xs"
                 disabled={currentPage === 0}
                 onclick={() => (currentPage = 0)}
                 aria-label={m.trino_first_page()}
@@ -268,7 +294,7 @@
                 &#171;
               </button>
               <button
-                class="btn btn-xs join-item"
+                class="btn join-item btn-xs"
                 disabled={currentPage === 0}
                 onclick={() => (currentPage = Math.max(0, currentPage - 1))}
                 aria-label={m.trino_prev_page()}
@@ -276,7 +302,7 @@
                 &#8249;
               </button>
               <button
-                class="btn btn-xs join-item"
+                class="btn join-item btn-xs"
                 disabled={currentPage === lastPage}
                 onclick={() => (currentPage = Math.min(lastPage, currentPage + 1))}
                 aria-label={m.trino_next_page()}
@@ -284,7 +310,7 @@
                 &#8250;
               </button>
               <button
-                class="btn btn-xs join-item"
+                class="btn join-item btn-xs"
                 disabled={currentPage === lastPage}
                 onclick={() => (currentPage = lastPage)}
                 aria-label={m.trino_last_page()}
@@ -302,7 +328,12 @@
           </span>
         </div>
         <div class="flex items-center gap-2">
-          <label for="{uid}-page-size" class="text-base-content/60 text-xs whitespace-nowrap">
+          <label
+            for="{uid}-page-size"
+            class="
+            text-base-content/60 text-xs whitespace-nowrap
+          "
+          >
             {m.trino_page_size()}
           </label>
           <select
diff --git a/src/lib/schemas/storage.ts b/src/lib/schemas/storage.ts
new file mode 100644
index 00000000..77bbe150
--- /dev/null
+++ b/src/lib/schemas/storage.ts
@@ -0,0 +1,28 @@
+import { z } from 'zod';
+
+export const StorageConnectionSchema = z
+  .object({
+    type: z.enum(['s3', 'hdfs']).default('s3'),
+    endpoint: z.url({ message: 'Must be a valid URL' }).or(z.literal('')).optional(),
+    region: z.string().min(1).default('eu-central-1'),
+    accessKeyId: z.string().optional(),
+    secretAccessKey: z.string().optional()
+  })
+  .superRefine((data, ctx) => {
+    const hasKey = !!data.accessKeyId;
+    const hasSecret = !!data.secretAccessKey;
+    if (hasKey && !hasSecret) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['secretAccessKey'],
+        message: 'Secret access key is required when access key ID is provided'
+      });
+    }
+    if (!hasKey && hasSecret) {
+      ctx.addIssue({
+        code: 'custom',
+        path: ['accessKeyId'],
+        message: 'Access key ID is required when secret access key is provided'
+      });
+    }
+  });
diff --git a/src/lib/server/storage/factory.ts b/src/lib/server/storage/factory.ts
new file mode 100644
index 00000000..1831ed94
--- /dev/null
+++ b/src/lib/server/storage/factory.ts
@@ -0,0 +1,15 @@
+import type { StorageProvider } from './provider.js';
+import type { StorageConfig } from './types.js';
+import { S3StorageProvider } from './s3-provider.js';
+import { HDFSStorageProvider } from './hdfs-provider.js';
+
+export class StorageProviderFactory {
+  static create(config: StorageConfig): StorageProvider {
+    switch (config.type) {
+      case 's3':
+        return new S3StorageProvider(config);
+      case 'hdfs':
+        return new HDFSStorageProvider(config);
+    }
+  }
+}
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
new file mode 100644
index 00000000..4878446a
--- /dev/null
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -0,0 +1,24 @@
+import type { StorageProvider } from './provider.js';
+import type { HDFSConfig } from './types.js';
+import type { StoragePage, StorageMetadata } from '$lib/types/storage.js';
+
+/** Stub implementation — HDFS support is not yet implemented. */
+export class HDFSStorageProvider implements StorageProvider {
+  constructor(_config: HDFSConfig) {}
+
+  listObjects(_prefix: string, _pageSize: number, _page: number): Promise<StoragePage> {
+    throw new Error('HDFS not implemented');
+  }
+
+  getObject(_key: string): Promise<ReadableStream> {
+    throw new Error('HDFS not implemented');
+  }
+
+  getMetadata(_key: string): Promise<StorageMetadata> {
+    throw new Error('HDFS not implemented');
+  }
+
+  exists(_key: string): Promise<boolean> {
+    throw new Error('HDFS not implemented');
+  }
+}
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
new file mode 100644
index 00000000..24016697
--- /dev/null
+++ b/src/lib/server/storage/provider.ts
@@ -0,0 +1,9 @@
+import type { StoragePage, StorageMetadata } from '$lib/types/storage.js';
+
+/** Backend-agnostic interface for a bucket-scoped storage provider. */
+export interface StorageProvider {
+  listObjects(prefix: string, pageSize: number, page: number): Promise<StoragePage>;
+  getObject(key: string): Promise<ReadableStream>;
+  getMetadata(key: string): Promise<StorageMetadata>;
+  exists(key: string): Promise<boolean>;
+}
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
new file mode 100644
index 00000000..8b1ed623
--- /dev/null
+++ b/src/lib/server/storage/s3-provider.ts
@@ -0,0 +1,123 @@
+import {
+  S3Client,
+  ListObjectsV2Command,
+  GetObjectCommand,
+  HeadObjectCommand,
+  type ListObjectsV2CommandOutput
+} from '@aws-sdk/client-s3';
+import type { StorageProvider } from './provider.js';
+import type { S3Config } from './types.js';
+import type { StoragePage, StorageObject, StorageMetadata } from '$lib/types/storage.js';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 's3-provider' });
+
+export class S3StorageProvider implements StorageProvider {
+  private readonly client: S3Client;
+  private readonly bucket: string;
+
+  constructor(config: S3Config) {
+    this.bucket = config.bucket;
+    this.client = new S3Client({
+      region: config.region,
+      ...(config.endpoint && {
+        endpoint: config.endpoint,
+        forcePathStyle: true
+      }),
+      ...(config.accessKeyId &&
+        config.secretAccessKey && {
+          credentials: {
+            accessKeyId: config.accessKeyId,
+            secretAccessKey: config.secretAccessKey
+          }
+        })
+    });
+  }
+
+  async listObjects(prefix: string, pageSize: number, page: number): Promise<StoragePage> {
+    log.debug({ bucket: this.bucket, prefix, page_size: pageSize, page }, 'listing objects');
+
+    // S3 uses cursor-based pagination via continuation tokens, not offset-based.
+    // To reach page N we advance through N-1 pages sequentially.
+    let continuationToken: string | undefined;
+    let currentPage = 1;
+
+    while (true) {
+      const output: ListObjectsV2CommandOutput = await this.client.send(
+        new ListObjectsV2Command({
+          Bucket: this.bucket,
+          Prefix: prefix || undefined,
+          Delimiter: '/',
+          MaxKeys: pageSize,
+          ContinuationToken: continuationToken
+        })
+      );
+
+      if (currentPage === page) {
+        const objects: StorageObject[] = [
+          ...(output.CommonPrefixes ?? []).map((cp) => ({
+            key: cp.Prefix ?? '',
+            size: 0,
+            lastModified: new Date(0),
+            isDirectory: true,
+            contentType: undefined
+          })),
+          ...(output.Contents ?? [])
+            // Filter out the prefix itself (S3 sometimes echoes it back)
+            .filter((obj) => obj.Key !== prefix)
+            .map((obj) => ({
+              key: obj.Key ?? '',
+              size: obj.Size ?? 0,
+              lastModified: obj.LastModified ?? new Date(0),
+              isDirectory: false,
+              contentType: undefined
+            }))
+        ];
+
+        return {
+          objects,
+          hasNextPage: output.IsTruncated ?? false,
+          currentPage,
+          pageSize
+        };
+      }
+
+      if (!output.IsTruncated || !output.NextContinuationToken) {
+        return { objects: [], hasNextPage: false, currentPage: page, pageSize };
+      }
+
+      continuationToken = output.NextContinuationToken;
+      currentPage++;
+    }
+  }
+
+  async getObject(key: string): Promise<ReadableStream> {
+    log.debug({ bucket: this.bucket, key }, 'getting object');
+    const output = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
+    if (!output.Body) {
+      throw new Error(`Object ${key} has no body`);
+    }
+    return output.Body.transformToWebStream();
+  }
+
+  async getMetadata(key: string): Promise<StorageMetadata> {
+    log.debug({ bucket: this.bucket, key }, 'getting object metadata');
+    const output = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+    return {
+      size: output.ContentLength ?? 0,
+      lastModified: output.LastModified ?? new Date(0),
+      contentType: output.ContentType,
+      etag: output.ETag,
+      customMetadata: output.Metadata
+    };
+  }
+
+  async exists(key: string): Promise<boolean> {
+    try {
+      await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+      return true;
+    } catch {
+      return false;
+    }
+  }
+}
diff --git a/src/lib/server/storage/types.ts b/src/lib/server/storage/types.ts
new file mode 100644
index 00000000..51f9eca4
--- /dev/null
+++ b/src/lib/server/storage/types.ts
@@ -0,0 +1,26 @@
+/** Per-user S3 connection config — no bucket, stored server-side. */
+export interface S3ConnectionConfig {
+  type: 's3';
+  endpoint?: string;
+  region: string;
+  accessKeyId?: string;
+  secretAccessKey?: string;
+}
+
+/** Full S3 config for creating a bucket-scoped provider. */
+export interface S3Config extends S3ConnectionConfig {
+  bucket: string;
+}
+
+export interface HDFSConfig {
+  type: 'hdfs';
+  nameNode: string;
+  port: number;
+  user: string;
+}
+
+/** Full config for creating a storage provider (always includes bucket/path scope). */
+export type StorageConfig = S3Config | HDFSConfig;
+
+/** Per-user connection config stored in memory (no bucket). */
+export type StorageConnectionConfig = S3ConnectionConfig | HDFSConfig;
diff --git a/src/lib/server/storage/user-connections.ts b/src/lib/server/storage/user-connections.ts
new file mode 100644
index 00000000..834e8b10
--- /dev/null
+++ b/src/lib/server/storage/user-connections.ts
@@ -0,0 +1,47 @@
+import { S3Client, ListBucketsCommand } from '@aws-sdk/client-s3';
+import type { S3ConnectionConfig } from './types.js';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'storage-user-connections' });
+
+const userConnections = new Map<string, S3ConnectionConfig>();
+
+export function setUserConnection(userId: string, config: S3ConnectionConfig): void {
+  userConnections.set(userId, config);
+  log.info({ user_id: userId, storage_type: config.type }, 'user storage connection saved');
+}
+
+export function getUserConnection(userId: string): S3ConnectionConfig | null {
+  return userConnections.get(userId) ?? null;
+}
+
+export function clearUserConnection(userId: string): void {
+  userConnections.delete(userId);
+  log.info({ user_id: userId }, 'user storage connection cleared');
+}
+
+/** List all buckets accessible with the user's current connection. Throws on connectivity error. */
+export async function listBucketsForUser(userId: string): Promise<string[]> {
+  const config = getUserConnection(userId);
+  if (!config) return [];
+
+  const client = new S3Client({
+    region: config.region,
+    ...(config.endpoint && {
+      endpoint: config.endpoint,
+      forcePathStyle: true
+    }),
+    ...(config.accessKeyId &&
+      config.secretAccessKey && {
+        credentials: {
+          accessKeyId: config.accessKeyId,
+          secretAccessKey: config.secretAccessKey
+        }
+      })
+  });
+
+  const output = await client.send(new ListBucketsCommand({}));
+  const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
+  log.debug({ user_id: userId, bucket_count: buckets.length }, 'listed buckets');
+  return buckets;
+}
diff --git a/src/lib/types/storage.ts b/src/lib/types/storage.ts
new file mode 100644
index 00000000..c9f4c339
--- /dev/null
+++ b/src/lib/types/storage.ts
@@ -0,0 +1,25 @@
+/** A single object (file or directory) returned from a storage listing. */
+export interface StorageObject {
+  key: string;
+  size: number;
+  lastModified: Date;
+  isDirectory: boolean;
+  contentType: string | undefined;
+}
+
+/** Full metadata for a single object. */
+export interface StorageMetadata {
+  size: number;
+  lastModified: Date;
+  contentType: string | undefined;
+  etag: string | undefined;
+  customMetadata: Record<string, string> | undefined;
+}
+
+/** A page of listed objects from a storage provider. */
+export interface StoragePage {
+  objects: StorageObject[];
+  hasNextPage: boolean;
+  currentPage: number;
+  pageSize: number;
+}
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index d5e3fdef..b4be2617 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -14,7 +14,12 @@
     '/trino': m.page_title_trino
   };
 
-  let title = $derived((pageTitles[page.url.pathname] ?? m.page_title_default)());
+  let title = $derived(
+    (
+      pageTitles[page.url.pathname] ??
+      (page.url.pathname.startsWith('/storage') ? m.page_title_storage : m.page_title_default)
+    )()
+  );
 </script>
 
 <svelte:head>
diff --git a/src/routes/(app)/+page.svelte b/src/routes/(app)/+page.svelte
index ca7b42e4..8363307a 100644
--- a/src/routes/(app)/+page.svelte
+++ b/src/routes/(app)/+page.svelte
@@ -11,9 +11,19 @@
     <p class="text-base-content/60 mt-1 text-sm">{m.dashboard_subtitle()}</p>
   </div>
 
-  <div class="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3">
+  <div
+    class="
+      grid grid-cols-1 gap-4
+      sm:grid-cols-2
+      lg:grid-cols-3
+    "
+  >
     <div class="border-base-300 bg-base-100 rounded-xl border p-5">
-      <p class="text-base-content/60 text-xs font-medium tracking-wider uppercase">
+      <p
+        class="
+          text-base-content/60 text-xs font-medium tracking-wider uppercase
+        "
+      >
         {m.dashboard_services()}
       </p>
       <p class="text-base-content mt-2 text-3xl font-bold">{props.data.serviceCount}</p>
@@ -21,7 +31,11 @@
     </div>
 
     <div class="border-base-300 bg-base-100 rounded-xl border p-5">
-      <p class="text-base-content/60 text-xs font-medium tracking-wider uppercase">
+      <p
+        class="
+          text-base-content/60 text-xs font-medium tracking-wider uppercase
+        "
+      >
         {m.dashboard_queries()}
       </p>
       <p class="text-base-content mt-2 text-3xl font-bold">&mdash;</p>
@@ -29,7 +43,11 @@
     </div>
 
     <div class="border-base-300 bg-base-100 rounded-xl border p-5">
-      <p class="text-base-content/60 text-xs font-medium tracking-wider uppercase">
+      <p
+        class="
+          text-base-content/60 text-xs font-medium tracking-wider uppercase
+        "
+      >
         {m.dashboard_health()}
       </p>
       <p class="text-base-content mt-2 text-3xl font-bold">
@@ -41,33 +59,51 @@
 
   <div class="border-base-300 bg-base-100 rounded-xl border p-6">
     <h3 class="text-base-content text-base font-semibold">{m.dashboard_getting_started()}</h3>
-    <p class="text-base-content/60 mt-2 text-sm leading-relaxed">
+    <p class="text-base-content/60 mt-2 text-sm/relaxed">
       {m.dashboard_getting_started_description()}
     </p>
     <ol class="mt-4 flex flex-wrap gap-3" aria-label={m.setup_steps_label()}>
       <li
-        class="bg-base-200 text-base-content/70 flex items-center gap-2 rounded-lg px-3 py-2 text-sm"
+        class="
+          bg-base-200 text-base-content/70 flex items-center gap-2 rounded-lg px-3 py-2
+          text-sm
+        "
       >
         <span
-          class="bg-primary/10 text-primary flex h-5 w-5 items-center justify-center rounded-full text-xs font-bold"
+          class="
+            bg-primary/10 text-primary flex size-5 items-center justify-center
+            rounded-full text-xs font-bold
+          "
           aria-hidden="true">1</span
         >
         {m.dashboard_step_oidc()}
       </li>
       <li
-        class="bg-base-200 text-base-content/70 flex items-center gap-2 rounded-lg px-3 py-2 text-sm"
+        class="
+          bg-base-200 text-base-content/70 flex items-center gap-2 rounded-lg px-3 py-2
+          text-sm
+        "
       >
         <span
-          class="bg-primary/10 text-primary flex h-5 w-5 items-center justify-center rounded-full text-xs font-bold"
+          class="
+            bg-primary/10 text-primary flex size-5 items-center justify-center
+            rounded-full text-xs font-bold
+          "
           aria-hidden="true">2</span
         >
         {m.dashboard_step_trino()}
       </li>
       <li
-        class="bg-base-200 text-base-content/70 flex items-center gap-2 rounded-lg px-3 py-2 text-sm"
+        class="
+          bg-base-200 text-base-content/70 flex items-center gap-2 rounded-lg px-3 py-2
+          text-sm
+        "
       >
         <span
-          class="bg-primary/10 text-primary flex h-5 w-5 items-center justify-center rounded-full text-xs font-bold"
+          class="
+            bg-primary/10 text-primary flex size-5 items-center justify-center
+            rounded-full text-xs font-bold
+          "
           aria-hidden="true">3</span
         >
         {m.dashboard_step_browse()}
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
new file mode 100644
index 00000000..2c221b3c
--- /dev/null
+++ b/src/routes/(app)/storage/+error.svelte
@@ -0,0 +1,59 @@
+<script lang="ts">
+  import { page } from '$app/state';
+  import { resolve } from '$app/paths';
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  const bucket = $derived(page.params.bucket ?? '');
+
+  function bucketErrorMessage(status: number, name: string): string | null {
+    if (!name) return null;
+    if (status === 403) return m.storage_error_access_denied({ bucket: name });
+    if (status === 404) return m.storage_error_not_found({ bucket: name });
+    if (status === 502) return m.storage_error_storage_error({ bucket: name });
+    return null;
+  }
+
+  const errorMessage = $derived(bucketErrorMessage(page.status, bucket));
+</script>
+
+<div
+  class="
+    flex flex-1 flex-col items-center justify-center gap-6 p-8 text-center
+  "
+>
+  <div
+    class="
+      bg-error/10 text-error flex size-20 items-center justify-center
+      rounded-full
+    "
+    aria-hidden="true"
+  >
+    <Icon icon="line-md:alert" class="size-10" aria-hidden="true" />
+  </div>
+
+  <div>
+    <p
+      class="
+        text-base-content/50 mb-1 text-sm font-medium tracking-widest uppercase
+      "
+    >
+      {m.storage_error_title()}
+    </p>
+    <h1 class="text-base-content text-3xl font-bold">
+      {page.status}
+    </h1>
+    <p class="text-base-content/70 mt-2 max-w-sm text-sm">
+      {errorMessage ?? page.error?.message ?? ''}
+    </p>
+  </div>
+
+  <div class="flex flex-wrap items-center justify-center gap-3">
+    <a href={resolve('/storage')} class="btn btn-sm btn-primary">
+      {m.storage_error_back_to_storage()}
+    </a>
+    <button type="button" class="btn btn-ghost btn-sm" onclick={() => history.back()}>
+      {m.storage_error_go_back()}
+    </button>
+  </div>
+</div>
diff --git a/src/routes/(app)/storage/+layout.server.ts b/src/routes/(app)/storage/+layout.server.ts
new file mode 100644
index 00000000..5bde3235
--- /dev/null
+++ b/src/routes/(app)/storage/+layout.server.ts
@@ -0,0 +1,20 @@
+import type { LayoutServerLoad } from './$types';
+import { getUserConnection, listBucketsForUser } from '$lib/server/storage/user-connections.js';
+import { getUserId } from '$lib/server/auth-utils.js';
+
+export const load: LayoutServerLoad = async ({ locals }) => {
+  const userId = getUserId(locals);
+  const connection = getUserConnection(userId);
+
+  if (!connection) {
+    return { connected: false, buckets: [] as string[], connectionType: null };
+  }
+
+  try {
+    const buckets = await listBucketsForUser(userId);
+    return { connected: true, buckets, connectionType: connection.type };
+  } catch (err) {
+    locals.logger.warn({ err }, 'failed to list buckets for storage layout');
+    return { connected: true, buckets: [] as string[], connectionType: connection.type };
+  }
+};
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
new file mode 100644
index 00000000..ad79d409
--- /dev/null
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+  import BucketList from '$lib/components/storage/BucketList.svelte';
+
+  let { children, data } = $props();
+</script>
+
+{#if data.connected}
+  <div class="flex h-full min-h-0 gap-4">
+    <BucketList buckets={data.buckets} />
+    <div class="flex min-w-0 flex-1 flex-col">
+      {@render children()}
+    </div>
+  </div>
+{:else}
+  {@render children()}
+{/if}
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
new file mode 100644
index 00000000..92ad3fb0
--- /dev/null
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -0,0 +1,69 @@
+import { fail, redirect } from '@sveltejs/kit';
+import { superValidate, message } from 'sveltekit-superforms';
+import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import type { Actions, PageServerLoad } from './$types';
+import { StorageConnectionSchema } from './validation.js';
+import { getUserId } from '$lib/server/auth-utils.js';
+import {
+  setUserConnection,
+  clearUserConnection,
+  listBucketsForUser,
+  getUserConnection
+} from '$lib/server/storage/user-connections.js';
+import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
+
+export const load: PageServerLoad = async ({ locals }) => {
+  const connectionForm = await superValidate(zod(StorageConnectionSchema));
+  const userId = getUserId(locals);
+  const connected = getUserConnection(userId) !== null;
+  locals.logger.debug({ connected }, 'loading storage page');
+  return { connectionForm, connected };
+};
+
+export const actions: Actions = {
+  connect: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(StorageConnectionSchema));
+
+    if (!form.valid) {
+      log.debug({ errors: form.errors }, 'storage connection form validation failed');
+      return fail(400, { form });
+    }
+
+    const userId = getUserId(locals);
+    const { type, endpoint, region, accessKeyId, secretAccessKey } = form.data;
+
+    if (type !== 's3') {
+      return message(form, 'HDFS connections are not yet supported', { status: 400 });
+    }
+
+    const config: S3ConnectionConfig = {
+      type: 's3',
+      endpoint: endpoint || undefined,
+      region,
+      accessKeyId: accessKeyId || undefined,
+      secretAccessKey: secretAccessKey || undefined
+    };
+
+    try {
+      setUserConnection(userId, config);
+      await listBucketsForUser(userId);
+      log.info({ storage_type: type }, 'user storage connection verified and saved');
+    } catch (err) {
+      clearUserConnection(userId);
+      log.warn({ err }, 'storage connection test failed');
+      return message(form, 'Could not connect — check the endpoint and credentials.', {
+        status: 400
+      });
+    }
+
+    throw redirect(303, '/storage');
+  },
+
+  disconnect: async ({ locals }) => {
+    const userId = getUserId(locals);
+    clearUserConnection(userId);
+    locals.logger.info({ user_id: userId }, 'user storage connection cleared');
+    throw redirect(303, '/storage');
+  }
+};
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
new file mode 100644
index 00000000..9a65bdb7
--- /dev/null
+++ b/src/routes/(app)/storage/+page.svelte
@@ -0,0 +1,17 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import BucketGrid from '$lib/components/storage/BucketGrid.svelte';
+  import StorageConnectForm from '$lib/components/storage/StorageConnectForm.svelte';
+
+  let { data } = $props();
+</script>
+
+{#if data.connected}
+  <div class="p-2">
+    <h1 class="mb-1 text-xl font-semibold">{m.storage_buckets_label()}</h1>
+    <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+    <BucketGrid buckets={data.buckets} />
+  </div>
+{:else}
+  <StorageConnectForm connectionForm={data.connectionForm} />
+{/if}
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
new file mode 100644
index 00000000..e566d950
--- /dev/null
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -0,0 +1,45 @@
+import type { PageServerLoad } from './$types';
+import { getUserConnection } from '$lib/server/storage/user-connections.js';
+import { StorageProviderFactory } from '$lib/server/storage/factory.js';
+import { getUserId } from '$lib/server/auth-utils.js';
+import { error } from '@sveltejs/kit';
+import { S3ServiceException } from '@aws-sdk/client-s3';
+
+export const load: PageServerLoad = async ({ locals, params }) => {
+  const userId = getUserId(locals);
+  const connection = getUserConnection(userId);
+
+  if (!connection) {
+    throw error(401, 'No storage connection configured');
+  }
+
+  if (connection.type !== 's3') {
+    throw error(400, 'Storage backend not supported');
+  }
+
+  const prefix = params.prefix ? params.prefix + '/' : '';
+  const bucket = params.bucket;
+
+  locals.logger.debug({ bucket, prefix }, 'loading storage bucket objects');
+
+  const provider = StorageProviderFactory.create({ ...connection, bucket });
+
+  try {
+    const objects = await provider.listObjects(prefix, 50, 1);
+    return { objects, prefix, bucket };
+  } catch (err) {
+    if (err instanceof S3ServiceException) {
+      const code = err.name;
+      locals.logger.warn({ bucket, prefix, error_code: code }, 'S3 error loading bucket objects');
+
+      if (code === 'AccessDenied' || err.$metadata?.httpStatusCode === 403) {
+        throw error(403, `Access denied to bucket "${bucket}"`);
+      }
+      if (code === 'NoSuchBucket' || err.$metadata?.httpStatusCode === 404) {
+        throw error(404, `Bucket "${bucket}" not found`);
+      }
+      throw error(502, `Storage error: ${err.message}`);
+    }
+    throw err;
+  }
+};
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
new file mode 100644
index 00000000..a36d41f6
--- /dev/null
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -0,0 +1,27 @@
+<script lang="ts">
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
+  import FileExplorer from '$lib/components/storage/FileExplorer.svelte';
+
+  let { data } = $props();
+
+  function handleNavigate(prefix: string) {
+    const encodedPrefix = prefix
+      ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+      : '';
+    goto(
+      resolve('/(app)/storage/[bucket]/[...prefix]', {
+        bucket: encodeURIComponent(data.bucket),
+        prefix: encodedPrefix
+      }),
+      { replaceState: false }
+    );
+  }
+</script>
+
+<FileExplorer
+  bucket={data.bucket}
+  objects={data.objects}
+  prefix={data.prefix}
+  onnavigate={handleNavigate}
+/>
diff --git a/src/routes/(app)/storage/validation.ts b/src/routes/(app)/storage/validation.ts
new file mode 100644
index 00000000..039a3879
--- /dev/null
+++ b/src/routes/(app)/storage/validation.ts
@@ -0,0 +1 @@
+export { StorageConnectionSchema } from '$lib/schemas/storage.js';
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 8d3913ec..8d14faff 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -390,7 +390,7 @@
 
 {#snippet closeIcon()}
   <svg
-    class="h-4 w-4"
+    class="size-4"
     aria-hidden="true"
     viewBox="0 0 24 24"
     fill="none"
@@ -404,11 +404,18 @@
 <div class="flex h-full gap-4">
   <!-- Catalog browser panel (desktop) — always in DOM, collapses via width transition -->
   <aside
-    class="bg-base-100 border-base-300 hidden shrink-0 flex-col overflow-hidden rounded-xl border transition-[width] duration-200 ease-out lg:flex {catalogBrowserOpen
-      ? 'w-72'
-      : 'invisible w-0 border-0'}"
+    class="
+      border-base-300 bg-base-100 hidden shrink-0 flex-col overflow-hidden rounded-xl
+      border transition-[width] duration-200 ease-out
+      lg:flex
+      {catalogBrowserOpen ? 'w-72' : 'invisible w-0 border-0'}"
   >
-    <div class="border-base-300 flex w-72 items-center justify-between border-b px-3 py-2">
+    <div
+      class="
+        border-base-300 flex w-72 items-center justify-between border-b px-3
+        py-2
+      "
+    >
       <span class="text-base-content/60 text-sm font-medium">{m.trino_catalog_browser()}</span>
     </div>
     <div class="w-72">
@@ -424,10 +431,17 @@
   <!-- Mobile catalog browser overlay -->
   <Modal
     bind:open={mobileCatalogOpen}
-    class="bg-base-100 fixed inset-0 z-40 h-full max-h-full w-full max-w-full p-0 lg:hidden"
+    class="
+      bg-base-100 fixed inset-0 z-40 size-full max-h-full max-w-full p-0
+      lg:hidden
+    "
   >
     <div class="flex h-full flex-col">
-      <div class="border-base-300 flex items-center justify-between border-b px-3 py-2">
+      <div
+        class="
+          border-base-300 flex items-center justify-between border-b px-3 py-2
+        "
+      >
         <span class="text-base-content/60 text-sm font-medium">{m.trino_catalog_browser()}</span>
         <button
           class="btn btn-ghost btn-xs"
@@ -459,7 +473,7 @@
         <input type="hidden" name="authUsername" value={authUsername} />
         <input type="hidden" name="authPassword" value={authPassword} />
 
-        <div class="bg-base-100 border-base-300 collapse rounded-xl border">
+        <div class="border-base-300 bg-base-100 collapse rounded-xl border">
           <input
             type="checkbox"
             class="peer"
@@ -467,7 +481,10 @@
             bind:checked={connectionOpen}
           />
           <div
-            class="collapse-title text-base-content flex items-center justify-between pr-4 text-sm font-medium"
+            class="
+              collapse-title text-base-content flex items-center justify-between pr-4
+              text-sm font-medium
+            "
           >
             <span>{m.trino_connection_label()}</span>
             <span class="text-base-content/50 font-mono text-xs">{connectionSummary}</span>
@@ -497,7 +514,7 @@
               <div class="join" role="group" aria-label={m.trino_connection_auth()}>
                 <input
                   id="{uid}-auth-none"
-                  class="join-item btn btn-sm"
+                  class="btn join-item btn-sm"
                   type="radio"
                   name="{uid}-auth"
                   aria-label={m.trino_auth_none()}
@@ -506,7 +523,7 @@
                 />
                 <input
                   id="{uid}-auth-basic"
-                  class="join-item btn btn-sm"
+                  class="btn join-item btn-sm"
                   type="radio"
                   name="{uid}-auth"
                   aria-label={m.trino_auth_basic()}
@@ -518,7 +535,12 @@
 
             <!-- Basic auth credentials -->
             {#if authType === 'basic'}
-              <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+              <div
+                class="
+                  grid grid-cols-1 gap-3
+                  sm:grid-cols-2
+                "
+              >
                 <div class="flex flex-col gap-1">
                   <label for="{uid}-auth-username" class="label text-sm">
                     {m.trino_auth_username()}
@@ -556,7 +578,7 @@
 
             <!-- Save button -->
             <div class="flex justify-end">
-              <button type="submit" class="btn btn-primary btn-sm">
+              <button type="submit" class="btn btn-sm btn-primary">
                 {m.trino_save_connection()}
               </button>
             </div>
@@ -599,11 +621,18 @@
 
     <!-- Content card (editor + status + results) -->
     <div
-      class="bg-base-100 border-base-300 flex min-h-0 flex-1 flex-col rounded-t-none rounded-b-xl border"
+      class="
+        border-base-300 bg-base-100 flex min-h-0 flex-1 flex-col rounded-t-none
+        rounded-b-xl border
+      "
       role="tabpanel"
       aria-labelledby="tab-{tabStore.activeTabId}"
     >
-      <div class="border-base-300 flex items-center justify-between border-b px-4 py-2">
+      <div
+        class="
+          border-base-300 flex items-center justify-between border-b px-4 py-2
+        "
+      >
         <div class="flex items-center gap-2">
           <div class="tooltip tooltip-right" data-tip={m.trino_catalog_browser_toggle()}>
             <button
@@ -614,7 +643,10 @@
             >
               {#if catalogBrowserOpen}
                 <svg
-                  class="hidden h-4 w-4 lg:block"
+                  class="
+                    hidden size-4
+                    lg:block
+                  "
                   aria-hidden="true"
                   viewBox="0 0 24 24"
                   fill="none"
@@ -627,7 +659,10 @@
                   /></svg
                 >
                 <svg
-                  class="h-4 w-4 lg:hidden"
+                  class="
+                    size-4
+                    lg:hidden
+                  "
                   aria-hidden="true"
                   viewBox="0 0 24 24"
                   fill="none"
@@ -638,7 +673,7 @@
                 >
               {:else}
                 <svg
-                  class="h-4 w-4"
+                  class="size-4"
                   aria-hidden="true"
                   viewBox="0 0 24 24"
                   fill="none"
@@ -664,7 +699,7 @@
           {#if isActive}
             <button
               type="button"
-              class="btn btn-error btn-sm"
+              class="btn btn-sm btn-error"
               onclick={() => runner.cancel()}
               aria-label={m.trino_cancel_query()}
             >
@@ -682,16 +717,21 @@
             <div class="join">
               <button
                 type="button"
-                class="btn btn-primary join-item py-1.5"
+                class="btn join-item btn-primary py-1.5"
                 disabled={isActive}
                 aria-label={runButtonLabel}
                 onclick={handleRun}
               >
                 {#if isActive}
-                  <span class="loading loading-spinner loading-xs"></span>
+                  <span class="loading loading-xs loading-spinner"></span>
                   {m.trino_running()}
                 {:else}
-                  <span class="grid [&>*]:[grid-area:1/1]">
+                  <span
+                    class="
+                      grid
+                      *:[grid-area:1/1]
+                    "
+                  >
                     <!-- Invisible sizers: longest option sets width -->
                     <span class="invisible" aria-hidden="true">
                       {@render runOption(m.trino_run_at_cursor(), 'Ctrl+Shift+↵')}
@@ -708,12 +748,15 @@
               </button>
               <button
                 type="button"
-                class="btn btn-primary join-item border-l-primary-content/20 self-stretch border-l px-2"
+                class="
+                  btn join-item border-l-primary-content/20 btn-primary
+                  self-stretch border-l px-2
+                "
                 class:pointer-events-none={isActive}
                 aria-haspopup="true"
                 aria-label={m.trino_run_mode_select()}
               >
-                <svg class="h-3 w-3" aria-hidden="true" viewBox="0 0 20 20" fill="currentColor">
+                <svg class="size-3" aria-hidden="true" viewBox="0 0 20 20" fill="currentColor">
                   <path
                     fill-rule="evenodd"
                     d="M5.23 7.21a.75.75 0 011.06.02L10 11.168l3.71-3.938a.75.75 0 111.08 1.04l-4.25 4.5a.75.75 0 01-1.08 0l-4.25-4.5a.75.75 0 01.02-1.06z"
@@ -723,24 +766,27 @@
               </button>
             </div>
             <div
-              class="dropdown-content bg-primary text-primary-content rounded-box z-10 mt-1 flex w-full flex-col gap-1 p-1.5 shadow-lg"
+              class="
+                dropdown-content rounded-box bg-primary text-primary-content z-10 mt-1 flex
+                w-full flex-col gap-1 p-1.5 shadow-lg
+              "
             >
               <button
                 type="button"
-                class="rounded-btn hover:bg-primary-content/20 cursor-pointer px-3 py-1.5 text-left {runMode ===
-                'cursor'
-                  ? 'bg-primary-content/15'
-                  : ''}"
+                class="
+                  rounded-btn hover:bg-primary-content/20 cursor-pointer px-3 py-1.5
+                  text-left
+                  {runMode === 'cursor' ? 'bg-primary-content/15' : ''}"
                 onclick={() => selectRunMode('cursor')}
               >
                 {@render runOption(m.trino_run_at_cursor(), 'Ctrl+↵')}
               </button>
               <button
                 type="button"
-                class="rounded-btn hover:bg-primary-content/20 cursor-pointer px-3 py-1.5 text-left {runMode ===
-                'all'
-                  ? 'bg-primary-content/15'
-                  : ''}"
+                class="
+                  rounded-btn hover:bg-primary-content/20 cursor-pointer px-3 py-1.5
+                  text-left
+                  {runMode === 'all' ? 'bg-primary-content/15' : ''}"
                 onclick={() => selectRunMode('all')}
               >
                 {@render runOption(
@@ -765,7 +811,9 @@
       <!-- Status display -->
       {#if runner.state !== 'IDLE'}
         <div
-          class="border-base-300 flex flex-wrap items-center gap-3 border-t px-4 py-2"
+          class="
+            border-base-300 flex flex-wrap items-center gap-3 border-t px-4 py-2
+          "
           aria-live="polite"
           data-query-state={runner.state}
         >
@@ -785,7 +833,11 @@
             {/if}
           {/if}
           {#if stateLabel}
-            <span class="badge {stateBadgeClass}">{stateLabel}</span>
+            <span
+              class="
+                badge
+                {stateBadgeClass}">{stateLabel}</span
+            >
           {/if}
           {#if runner.state === 'RUNNING'}
             <span class="text-base-content/60 text-xs tabular-nums"
@@ -811,12 +863,12 @@
               href={runner.currentTrinoQueryUrl}
               target="_blank"
               rel="noopener noreferrer"
-              class="btn btn-xs btn-ghost"
+              class="btn btn-ghost btn-xs"
             >
               {m.trino_view_in_trino()}
               <svg
                 xmlns="http://www.w3.org/2000/svg"
-                class="h-3.5 w-3.5"
+                class="size-3.5"
                 viewBox="0 0 20 20"
                 fill="currentColor"
                 aria-hidden="true"
diff --git a/src/routes/auth/login/+page.svelte b/src/routes/auth/login/+page.svelte
index 7398269a..ecdbe3e3 100644
--- a/src/routes/auth/login/+page.svelte
+++ b/src/routes/auth/login/+page.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import { authClient } from '$lib/auth-client.js';
+  import Icon from '@iconify/svelte';
 
   let { data } = $props();
 
@@ -28,11 +29,15 @@
 </svelte:head>
 
 <div class="bg-base-200 flex min-h-dvh items-center justify-center p-4">
-  <div class="card bg-base-100 border-base-300 w-full max-w-sm border shadow-xl">
+  <div
+    class="
+    card border-base-300 bg-base-100 w-full max-w-sm border shadow-xl
+  "
+  >
     <div class="card-body items-center text-center">
       <div class="mb-2">
         <svg
-          class="text-primary mx-auto h-12 w-12"
+          class="text-primary mx-auto size-12"
           aria-hidden="true"
           viewBox="0 0 24 24"
           fill="none"
@@ -51,19 +56,7 @@
 
       {#if error}
         <div role="alert" class="alert alert-error mt-2 w-full text-sm">
-          <svg
-            class="h-4 w-4 shrink-0"
-            aria-hidden="true"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            stroke-width="2"
-            stroke-linecap="round"
-            stroke-linejoin="round"
-          >
-            <circle cx="12" cy="12" r="10" />
-            <path d="M12 8v4m0 4h.01" />
-          </svg>
+          <Icon icon="line-md:alert" class="size-5" aria-hidden="true" />
           <span>{error}</span>
         </div>
       {/if}
@@ -76,7 +69,7 @@
           aria-busy={loading}
         >
           {#if loading}
-            <span class="loading loading-spinner loading-sm" aria-hidden="true"></span>
+            <span class="loading loading-sm loading-spinner" aria-hidden="true"></span>
           {/if}
           {m.auth_login_button()}
         </button>

From 5de8d9f8e291a7c95573df2367ad7e34e620c2e3 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 09:31:31 +0200
Subject: [PATCH 009/136] refactor(storage): extract service layer and
 consolidate storage types/utils

Co-authored-by: Copilot <copilot@github.com>
---
 .../components/storage/FileExplorer.svelte    |  2 +-
 src/lib/components/storage/ObjectTable.svelte |  4 +-
 .../storage/StorageConnectForm.svelte         |  2 +-
 src/lib/server/storage/hdfs-provider.ts       |  2 +-
 src/lib/server/storage/provider.ts            |  2 +-
 src/lib/server/storage/s3-provider.ts         |  2 +-
 src/lib/server/storage/service.ts             | 78 +++++++++++++++++++
 src/lib/server/storage/user-connections.ts    | 27 -------
 .../storage.ts => storage/schemas.ts}         |  0
 .../{types/storage.ts => storage/types.ts}    |  0
 .../storage-utils.ts => storage/utils.ts}     |  0
 src/routes/(app)/storage/+layout.server.ts    |  6 +-
 src/routes/(app)/storage/+page.server.ts      | 22 +++---
 .../[bucket]/[...prefix]/+page.server.ts      | 37 +--------
 src/routes/(app)/storage/validation.ts        |  2 +-
 15 files changed, 103 insertions(+), 83 deletions(-)
 create mode 100644 src/lib/server/storage/service.ts
 rename src/lib/{schemas/storage.ts => storage/schemas.ts} (100%)
 rename src/lib/{types/storage.ts => storage/types.ts} (100%)
 rename src/lib/{components/storage/storage-utils.ts => storage/utils.ts} (100%)

diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 954186cb..1b1a43aa 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -3,7 +3,7 @@
   import StorageBreadcrumb from './StorageBreadcrumb.svelte';
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
-  import type { StoragePage } from '$lib/types/storage.js';
+  import type { StoragePage } from '$lib/storage/types.js';
 
   interface Props {
     bucket: string;
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
index cf564f4a..9dc74b8f 100644
--- a/src/lib/components/storage/ObjectTable.svelte
+++ b/src/lib/components/storage/ObjectTable.svelte
@@ -2,8 +2,8 @@
   import * as m from '$lib/paraglide/messages.js';
   import Icon from '@iconify/svelte';
   import SelectionToolbar from './SelectionToolbar.svelte';
-  import { fileIconKind, iconColors, formatDate, keyToName } from './storage-utils.js';
-  import type { StorageObject } from '$lib/types/storage.js';
+  import { fileIconKind, iconColors, formatDate, keyToName } from '$lib/storage/utils.js';
+  import type { StorageObject } from '$lib/storage/types.js';
   import { flip } from 'svelte/animate';
   import prettyBytes from 'pretty-bytes';
 
diff --git a/src/lib/components/storage/StorageConnectForm.svelte b/src/lib/components/storage/StorageConnectForm.svelte
index c28c7321..be3d4e17 100644
--- a/src/lib/components/storage/StorageConnectForm.svelte
+++ b/src/lib/components/storage/StorageConnectForm.svelte
@@ -3,7 +3,7 @@
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
   import * as m from '$lib/paraglide/messages.js';
-  import { StorageConnectionSchema } from '$lib/schemas/storage.js';
+  import { StorageConnectionSchema } from '$lib/storage/schemas.js';
   import type { z } from 'zod';
 
   interface Props {
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 4878446a..3d2d6192 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -1,6 +1,6 @@
 import type { StorageProvider } from './provider.js';
 import type { HDFSConfig } from './types.js';
-import type { StoragePage, StorageMetadata } from '$lib/types/storage.js';
+import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
 /** Stub implementation — HDFS support is not yet implemented. */
 export class HDFSStorageProvider implements StorageProvider {
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index 24016697..e1ebe3b0 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -1,4 +1,4 @@
-import type { StoragePage, StorageMetadata } from '$lib/types/storage.js';
+import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
 /** Backend-agnostic interface for a bucket-scoped storage provider. */
 export interface StorageProvider {
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 8b1ed623..b7f79441 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -7,7 +7,7 @@ import {
 } from '@aws-sdk/client-s3';
 import type { StorageProvider } from './provider.js';
 import type { S3Config } from './types.js';
-import type { StoragePage, StorageObject, StorageMetadata } from '$lib/types/storage.js';
+import type { StoragePage, StorageObject, StorageMetadata } from '$lib/storage/types.js';
 import { logger } from '$lib/server/logging';
 
 const log = logger.child({ module: 's3-provider' });
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
new file mode 100644
index 00000000..a60877c2
--- /dev/null
+++ b/src/lib/server/storage/service.ts
@@ -0,0 +1,78 @@
+import { S3Client, ListBucketsCommand, S3ServiceException } from '@aws-sdk/client-s3';
+import { error } from '@sveltejs/kit';
+import { getUserConnection, setUserConnection, clearUserConnection } from './user-connections.js';
+import { StorageProviderFactory } from './factory.js';
+import type { S3ConnectionConfig } from './types.js';
+import type { StoragePage } from '$lib/storage/types.js';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'storage-service' });
+
+export { getUserConnection as getConnection };
+export { setUserConnection as saveConnection };
+export { clearUserConnection as clearConnection };
+
+/** List all buckets accessible with the user's current connection. Returns [] when not connected. */
+export async function listBuckets(userId: string): Promise<string[]> {
+  const config = getUserConnection(userId);
+  if (!config) return [];
+
+  const client = new S3Client({
+    region: config.region,
+    ...(config.endpoint && {
+      endpoint: config.endpoint,
+      forcePathStyle: true
+    }),
+    ...(config.accessKeyId &&
+      config.secretAccessKey && {
+        credentials: {
+          accessKeyId: config.accessKeyId,
+          secretAccessKey: config.secretAccessKey
+        }
+      })
+  });
+
+  const output = await client.send(new ListBucketsCommand({}));
+  const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
+  log.debug({ user_id: userId, bucket_count: buckets.length }, 'listed buckets');
+  return buckets;
+}
+
+/** List objects at the given bucket/prefix for the user's current connection. Throws on S3 errors. */
+export async function listObjects(
+  userId: string,
+  bucket: string,
+  prefix: string
+): Promise<StoragePage> {
+  const connection = getUserConnection(userId);
+
+  if (!connection) {
+    throw error(401, 'No storage connection configured');
+  }
+
+  if (connection.type !== 's3') {
+    throw error(400, 'Storage backend not supported');
+  }
+
+  const provider = StorageProviderFactory.create({ ...connection, bucket });
+
+  try {
+    return await provider.listObjects(prefix, 50, 1);
+  } catch (err) {
+    if (err instanceof S3ServiceException) {
+      const code = err.name;
+      log.warn({ user_id: userId, bucket, prefix, error_code: code }, 'S3 error listing objects');
+
+      if (code === 'AccessDenied' || err.$metadata?.httpStatusCode === 403) {
+        throw error(403, `Access denied to bucket "${bucket}"`);
+      }
+      if (code === 'NoSuchBucket' || err.$metadata?.httpStatusCode === 404) {
+        throw error(404, `Bucket "${bucket}" not found`);
+      }
+      throw error(502, `Storage error: ${err.message}`);
+    }
+    throw err;
+  }
+}
+
+export type { S3ConnectionConfig };
diff --git a/src/lib/server/storage/user-connections.ts b/src/lib/server/storage/user-connections.ts
index 834e8b10..bcfa9835 100644
--- a/src/lib/server/storage/user-connections.ts
+++ b/src/lib/server/storage/user-connections.ts
@@ -1,4 +1,3 @@
-import { S3Client, ListBucketsCommand } from '@aws-sdk/client-s3';
 import type { S3ConnectionConfig } from './types.js';
 import { logger } from '$lib/server/logging';
 
@@ -19,29 +18,3 @@ export function clearUserConnection(userId: string): void {
   userConnections.delete(userId);
   log.info({ user_id: userId }, 'user storage connection cleared');
 }
-
-/** List all buckets accessible with the user's current connection. Throws on connectivity error. */
-export async function listBucketsForUser(userId: string): Promise<string[]> {
-  const config = getUserConnection(userId);
-  if (!config) return [];
-
-  const client = new S3Client({
-    region: config.region,
-    ...(config.endpoint && {
-      endpoint: config.endpoint,
-      forcePathStyle: true
-    }),
-    ...(config.accessKeyId &&
-      config.secretAccessKey && {
-        credentials: {
-          accessKeyId: config.accessKeyId,
-          secretAccessKey: config.secretAccessKey
-        }
-      })
-  });
-
-  const output = await client.send(new ListBucketsCommand({}));
-  const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
-  log.debug({ user_id: userId, bucket_count: buckets.length }, 'listed buckets');
-  return buckets;
-}
diff --git a/src/lib/schemas/storage.ts b/src/lib/storage/schemas.ts
similarity index 100%
rename from src/lib/schemas/storage.ts
rename to src/lib/storage/schemas.ts
diff --git a/src/lib/types/storage.ts b/src/lib/storage/types.ts
similarity index 100%
rename from src/lib/types/storage.ts
rename to src/lib/storage/types.ts
diff --git a/src/lib/components/storage/storage-utils.ts b/src/lib/storage/utils.ts
similarity index 100%
rename from src/lib/components/storage/storage-utils.ts
rename to src/lib/storage/utils.ts
diff --git a/src/routes/(app)/storage/+layout.server.ts b/src/routes/(app)/storage/+layout.server.ts
index 5bde3235..24edb44c 100644
--- a/src/routes/(app)/storage/+layout.server.ts
+++ b/src/routes/(app)/storage/+layout.server.ts
@@ -1,17 +1,17 @@
 import type { LayoutServerLoad } from './$types';
-import { getUserConnection, listBucketsForUser } from '$lib/server/storage/user-connections.js';
+import { getConnection, listBuckets } from '$lib/server/storage/service.js';
 import { getUserId } from '$lib/server/auth-utils.js';
 
 export const load: LayoutServerLoad = async ({ locals }) => {
   const userId = getUserId(locals);
-  const connection = getUserConnection(userId);
+  const connection = getConnection(userId);
 
   if (!connection) {
     return { connected: false, buckets: [] as string[], connectionType: null };
   }
 
   try {
-    const buckets = await listBucketsForUser(userId);
+    const buckets = await listBuckets(userId);
     return { connected: true, buckets, connectionType: connection.type };
   } catch (err) {
     locals.logger.warn({ err }, 'failed to list buckets for storage layout');
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 92ad3fb0..53872a5f 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -2,20 +2,20 @@ import { fail, redirect } from '@sveltejs/kit';
 import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
-import { StorageConnectionSchema } from './validation.js';
+import { StorageConnectionSchema } from '$lib/storage/schemas.js';
 import { getUserId } from '$lib/server/auth-utils.js';
 import {
-  setUserConnection,
-  clearUserConnection,
-  listBucketsForUser,
-  getUserConnection
-} from '$lib/server/storage/user-connections.js';
+  getConnection,
+  saveConnection,
+  clearConnection,
+  listBuckets
+} from '$lib/server/storage/service.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
   const connectionForm = await superValidate(zod(StorageConnectionSchema));
   const userId = getUserId(locals);
-  const connected = getUserConnection(userId) !== null;
+  const connected = getConnection(userId) !== null;
   locals.logger.debug({ connected }, 'loading storage page');
   return { connectionForm, connected };
 };
@@ -46,11 +46,11 @@ export const actions: Actions = {
     };
 
     try {
-      setUserConnection(userId, config);
-      await listBucketsForUser(userId);
+      saveConnection(userId, config);
+      await listBuckets(userId);
       log.info({ storage_type: type }, 'user storage connection verified and saved');
     } catch (err) {
-      clearUserConnection(userId);
+      clearConnection(userId);
       log.warn({ err }, 'storage connection test failed');
       return message(form, 'Could not connect — check the endpoint and credentials.', {
         status: 400
@@ -62,7 +62,7 @@ export const actions: Actions = {
 
   disconnect: async ({ locals }) => {
     const userId = getUserId(locals);
-    clearUserConnection(userId);
+    clearConnection(userId);
     locals.logger.info({ user_id: userId }, 'user storage connection cleared');
     throw redirect(303, '/storage');
   }
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
index e566d950..0dc9bd6f 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -1,45 +1,14 @@
 import type { PageServerLoad } from './$types';
-import { getUserConnection } from '$lib/server/storage/user-connections.js';
-import { StorageProviderFactory } from '$lib/server/storage/factory.js';
+import { listObjects } from '$lib/server/storage/service.js';
 import { getUserId } from '$lib/server/auth-utils.js';
-import { error } from '@sveltejs/kit';
-import { S3ServiceException } from '@aws-sdk/client-s3';
 
 export const load: PageServerLoad = async ({ locals, params }) => {
   const userId = getUserId(locals);
-  const connection = getUserConnection(userId);
-
-  if (!connection) {
-    throw error(401, 'No storage connection configured');
-  }
-
-  if (connection.type !== 's3') {
-    throw error(400, 'Storage backend not supported');
-  }
-
   const prefix = params.prefix ? params.prefix + '/' : '';
   const bucket = params.bucket;
 
   locals.logger.debug({ bucket, prefix }, 'loading storage bucket objects');
 
-  const provider = StorageProviderFactory.create({ ...connection, bucket });
-
-  try {
-    const objects = await provider.listObjects(prefix, 50, 1);
-    return { objects, prefix, bucket };
-  } catch (err) {
-    if (err instanceof S3ServiceException) {
-      const code = err.name;
-      locals.logger.warn({ bucket, prefix, error_code: code }, 'S3 error loading bucket objects');
-
-      if (code === 'AccessDenied' || err.$metadata?.httpStatusCode === 403) {
-        throw error(403, `Access denied to bucket "${bucket}"`);
-      }
-      if (code === 'NoSuchBucket' || err.$metadata?.httpStatusCode === 404) {
-        throw error(404, `Bucket "${bucket}" not found`);
-      }
-      throw error(502, `Storage error: ${err.message}`);
-    }
-    throw err;
-  }
+  const objects = await listObjects(userId, bucket, prefix);
+  return { objects, prefix, bucket };
 };
diff --git a/src/routes/(app)/storage/validation.ts b/src/routes/(app)/storage/validation.ts
index 039a3879..eae24d5d 100644
--- a/src/routes/(app)/storage/validation.ts
+++ b/src/routes/(app)/storage/validation.ts
@@ -1 +1 @@
-export { StorageConnectionSchema } from '$lib/schemas/storage.js';
+export { StorageConnectionSchema } from '$lib/storage/schemas.js';

From 2b335336788ce04374abd5c090d2201ecc12a34c Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 09:48:57 +0200
Subject: [PATCH 010/136] chore(storage): remove outdated STORAGE_REORG_PLAN.md

---
 STORAGE_REORG_PLAN.md | 159 ------------------------------------------
 1 file changed, 159 deletions(-)
 delete mode 100644 STORAGE_REORG_PLAN.md

diff --git a/STORAGE_REORG_PLAN.md b/STORAGE_REORG_PLAN.md
deleted file mode 100644
index d20120d6..00000000
--- a/STORAGE_REORG_PLAN.md
+++ /dev/null
@@ -1,159 +0,0 @@
-# Storage Feature — Reorganization Plan
-
-This document is an easy-to-follow, step-by-step plan to reorganise the S3 file-browser/storage feature into a clearer, more secure, and testable structure. Follow each step and use the verification checks to confirm progress.
-
----
-
-## Overview
-- Goal: Separate UI, shared domain logic, server providers, business service layer, and public API routes. Add tests and secure persistence for user connection credentials.
-- Scope: Minimal breaking changes for UI; refactor server code to centralise logic and enable proper APIs.
-
----
-
-## Prerequisites
-- Node.js version from `.node-version` and `nvm` available.
-- Ensure you can run dev server: `npm run dev`.
-- AWS SDK is already a dependency (`@aws-sdk/client-s3`).
-
----
-
-## Canonical Folder Layout (target)
-- `src/lib/components/storage/` — UI components (Breadcrumb, FileExplorer, ObjectTable, BucketList, ContextMenu, SelectionToolbar, ConnectForm)
-- `src/lib/storage/` — shared domain models and client helpers (`types.ts`, `storage-utils.ts`, `tokenMap.ts`)
-- `src/lib/server/storage/` — server implementations: `provider.ts`, `factory.ts`, `s3-provider.ts`, `hdfs-provider.ts` (or remove), `service.ts`, `persistence-adapter.ts`, `audit.ts`
-- `src/routes/api/storage/` — API endpoints: `list`, `object`, `metadata`, `download`, `rename`, `move`, `delete`, `connect`
-- `src/lib/server/storage/__tests__/` — unit tests for providers/service
-
----
-
-## Step-by-step Plan (follow in order)
-
-1) Create canonical folder layout
-- What: Add the folders above and move existing files into their new homes (or create shims that import old files to avoid breaking routes while migrating).
-- Commands (example):
-
-```bash
-# create directories
-mkdir -p src/lib/storage src/lib/server/storage src/routes/api/storage
-git add -A
-```
-
-- Verify: files exist in their new locations or shims import moved files.
-- Est. time: 30–60 min
-
-2) Extract server service layer (`service.ts`)
-- What: Move S3-listing, error handling, and connection lookup logic from `+page.server.ts`/`+layout.server.ts` into `src/lib/server/storage/service.ts`. The service exposes functions like `listObjects(userId, bucket, prefix, continuationToken)` and `getObjectStream(userId, bucket, key)`.
-- Why: Improves testability and removes business logic from route loaders.
-- Verify: route loaders call `service.ts` and behavior remains identical.
-- Est. time: 60–90 min
-
-3) Implement pluggable persistence adapter for user connections
-- What: Replace `user-connections.ts` in-memory Map with `persistence-adapter.ts` (interface + `in-memory` and `file` adapters). Persist secrets encrypted for dev if needed.
-- Commands: create `src/lib/server/storage/persistence-adapter.ts` with methods `saveConnection(userId, conn)`, `getConnection(userId)`, `deleteConnection(userId)`.
-- Verify: connect/disconnect route actions still work, credentials survive dev-server restarts if `file` adapter chosen.
-- Est. time: 1–3 hours (depends encryption chosen).
-
-4) Add API routes under `src/routes/api/storage/`
-- What: Create thin REST endpoints used by the UI to perform object operations. Examples:
-  - `GET /api/storage/list?bucket=...&prefix=...&continuationToken=...`
-  - `GET /api/storage/object?bucket=...&key=...` (metadata and/or signed streaming)
-  - `GET /api/storage/download?bucket=...&key=...` (download proxy)
-  - `POST /api/storage/rename`, `POST /api/storage/delete`, etc.
-- Why: Keep client UI decoupled from provider SDK and centralise auth, audit and rate limits.
-- Verify: UI calls endpoints and responses are correct; add server logs for calls.
-- Est. time: 2–4 hours
-
-5) Change S3 provider to use continuation tokens (cursor) instead of offset pages
-- What: Refactor `s3-provider.ts` to return `ContinuationToken` and `IsTruncated`/`NextContinuationToken` per S3 API, and make the `list` API pass tokens through.
-- Why: S3 list is designed for cursor pagination and is far more efficient for large buckets.
-- Verify: `GET /api/storage/list` returns `items` and `nextContinuationToken`; client can request next pages with the token.
-- Est. time: 1–3 hours
-
-6) Wire UI actions to the new API routes
-- What: Replace client-side stubs for preview/download/rename/move/delete with calls to endpoints in `src/routes/api/storage/*`. Use streaming downloads for large objects.
-- Accessibility: keep keyboard/aria behaviour in components intact.
-- Verify: right-click menu and selection toolbar actions work and show server-side errors when appropriate.
-- Est. time: 3–6 hours
-
-7) Add unit tests (providers and utils)
-- What: Add unit tests for `s3-provider.ts`, `storage-utils.ts`, and `service.ts`. Mock `@aws-sdk/client-s3` responses using jest or vitest.
-- Verify: tests cover listing, metadata parsing, error mapping, and token propagation.
-- Est. time: 2–4 hours
-
-8) Add E2E tests for connect → list → download
-- What: Add Playwright tests in `e2e/` to exercise connect form, listing, pagination, and a download/preview.
-- Verify: Playwright tests pass locally.
-- Est. time: 3–6 hours
-
-9) Security hardening and operational concerns
-- What: Ensure:
-  - credentials are stored encrypted and not logged, use a vault in production
-  - server endpoints perform authorization checks (OPA) and audit destructive actions
-  - rate-limiting for download/preview endpoints
-  - remove `hdfs-provider.ts` or implement it properly
-- Verify: manual security review + running app with audit logs enabled.
-- Est. time: 4+ hours (depends on infra)
-
-10) Documentation and tech-debt updates
-- What: Update `TECH_DEBT.md`, add README for storage module, and document the persistence adapter selection.
-- Verify: docs updated and reviewed.
-- Est. time: 30–60 min
-
----
-
-## Quick Implementation Checklist (commands)
-
-- Create directories:
-
-```bash
-mkdir -p src/lib/storage src/lib/server/storage src/routes/api/storage
-```
-
-- Scaffold `service.ts` and `persistence-adapter.ts` files (example):
-
-```bash
-# create files (example)
-cat > src/lib/server/storage/service.ts <<'EOF'
-// scaffold service layer
-EOF
-
-cat > src/lib/server/storage/persistence-adapter.ts <<'EOF'
-// scaffold persistence adapter
-EOF
-```
-
-- Run dev server and run tests as you implement:
-
-```bash
-npm run dev
-npm run test:e2e
-# or unit tests
-npm run test
-```
-
----
-
-## Verification & Acceptance Criteria
-- UI behaves the same from a user perspective for connect + list flows.
-- Server-side code tested (unit tests) for provider and service logic.
-- Continuation-token pagination works and is used by the UI to page.
-- Credentials are not stored in a process-local Map for production (use `persistence-adapter`).
-- Audit logs are emitted for destructive operations and not for secrets.
-
----
-
-## Notes & Security reminders
-- Never log credentials. Ensure `pino` redaction config covers credential fields.
-- For multi-replica deployments, use a replicated secret store (Vault, KMS-encrypted DB column).
-- Use server-side streaming for downloads — avoid loading whole object into memory.
-
----
-
-## Next steps (you can do these now)
-1. Decide on persistence adapter to use for dev: `in-memory (dev)`, `file (dev)`, or `DB/vault (prod)`.
-2. Run the directory scaffolding commands above.
-3. Implement `service.ts` and move listing logic from `+page.server.ts` into it.
-
----
-
-Saved checklist & plan in this repo file.

From aeac85d01c7b3d3537aeeb505a739756895132f5 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 10:03:32 +0200
Subject: [PATCH 011/136] fix(lint): resolve errors

---
 .../components/storage/FileExplorer.svelte    | 25 +++++++++++--------
 src/lib/server/storage/hdfs-provider.ts       |  4 +++
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 1b1a43aa..dcfed7d1 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -4,6 +4,7 @@
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
   import type { StoragePage } from '$lib/storage/types.js';
+    import { SvelteSet } from 'svelte/reactivity';
 
   interface Props {
     bucket: string;
@@ -19,36 +20,36 @@
   const files = $derived(objects.objects.filter((o) => !o.isDirectory));
 
   // ── Selection state ───────────────────────────────────────────────────────
-  let selectedKeys = $state<Set<string>>(new Set());
+  let selectedKeys = $state<Set<string>>(new Set<string>());
   let selectionMode = $state(false);
 
   // Clear selection on navigation
   $effect(() => {
-    prefix;
-    selectedKeys = new Set();
+    void prefix;
+    selectedKeys = new SvelteSet<string>();
   });
 
   function toggleSelectionMode() {
     selectionMode = !selectionMode;
-    if (!selectionMode) selectedKeys = new Set();
+    if (!selectionMode) selectedKeys = new SvelteSet<string>();
   }
 
   function toggleSelect(key: string, force = false) {
     if (force || selectionMode) {
-      const next = new Set(selectedKeys);
+      const next = new SvelteSet<string>(selectedKeys);
       if (next.has(key)) next.delete(key);
       else next.add(key);
       selectedKeys = next;
     } else {
-      selectedKeys = new Set([key]);
+      selectedKeys = new SvelteSet<string>([key]);
     }
   }
 
   function selectAll(checked: boolean) {
     if (checked) {
-      selectedKeys = new Set([...folders.map((f) => f.key), ...files.map((f) => f.key)]);
+      selectedKeys = new SvelteSet<string>([...folders.map((f) => f.key), ...files.map((f) => f.key)]);
     } else {
-      selectedKeys = new Set();
+      selectedKeys = new SvelteSet<string>();
     }
   }
 
@@ -59,6 +60,8 @@
 
   const selectedFiles = $derived(files.filter((f) => selectedKeys.has(f.key)));
   const selectedFolders = $derived(folders.filter((f) => selectedKeys.has(f.key)));
+  // TODO: This resolves once a modal for confirming deletion is implemented.
+  /* eslint-disable-next-line @typescript-eslint/no-unused-vars */
   const deleteCount = $derived(selectedFiles.length + selectedFolders.length);
 
   // ── Loading state ─────────────────────────────────────────────────────────
@@ -66,7 +69,7 @@
 
   // Clear loading when new objects arrive from the server
   $effect(() => {
-    objects;
+    void objects;
     loading = false;
   });
 
@@ -118,7 +121,7 @@
     if (showDeleteModal) return;
     if (e.key === 'Delete' && selectedKeys.size > 0) showDeleteModal = true;
     else if (e.key === 'F2' && selectedKeys.size === 1) handleAction('rename');
-    else if (e.key === 'Escape') selectedKeys = new Set();
+    else if (e.key === 'Escape') selectedKeys = new SvelteSet<string>();
   }
 </script>
 
@@ -129,7 +132,7 @@
 <div
   class="bg-base-100 flex flex-1 flex-col overflow-hidden"
   onclick={(e) => {
-    if (!(e.target as HTMLElement).closest('tr')) selectedKeys = new Set();
+    if (!(e.target as HTMLElement).closest('tr')) selectedKeys = new SvelteSet<string>();
   }}
 >
   <StorageBreadcrumb
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 3d2d6192..6c08cd08 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -2,6 +2,10 @@ import type { StorageProvider } from './provider.js';
 import type { HDFSConfig } from './types.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
+/* TODO: Remove this file and related HDFS provider code until we have a concrete plan for HDFS support. 
+For now, this serves as a placeholder to prevent compile errors. */
+/* eslint-disable  @typescript-eslint/no-unused-vars */
+
 /** Stub implementation — HDFS support is not yet implemented. */
 export class HDFSStorageProvider implements StorageProvider {
   constructor(_config: HDFSConfig) {}

From f2ba2844781b0c348dd7c25e400a640a299655c3 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 10:06:11 +0200
Subject: [PATCH 012/136] refactor(tests): update ThemeToggle tests to use
 checkbox role

Co-authored-by: Copilot <copilot@github.com>
---
 .../layout/header/ThemeToggle.svelte.spec.ts  | 20 +++++++++----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts b/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
index 82cccfa7..f1ce2552 100644
--- a/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
+++ b/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
@@ -7,35 +7,33 @@ describe('ThemeToggle', () => {
   it('should render a toggle button', async () => {
     render(ThemeToggle);
 
-    const button = page.getByRole('button');
-    await expect.element(button).toBeInTheDocument();
+    const control = page.getByRole('checkbox');
+    await expect.element(control).toBeInTheDocument();
   });
 
   it('should toggle the aria-label on click', async () => {
     render(ThemeToggle);
-
-    const button = page.getByRole('button');
+    const control = page.getByRole('checkbox');
 
     // Starts in light mode — label offers to switch to dark
-    await expect.element(button).toHaveAttribute('aria-label', 'Switch to dark mode');
+    await expect.element(control).toHaveAttribute('aria-label', 'Switch to dark mode');
 
-    await button.click();
+    await control.click();
 
     // Now in dark mode — label offers to switch to light
-    await expect.element(button).toHaveAttribute('aria-label', 'Switch to light mode');
+    await expect.element(control).toHaveAttribute('aria-label', 'Switch to light mode');
   });
 
   it('should toggle the data-theme attribute on the document', async () => {
     render(ThemeToggle);
-
-    const button = page.getByRole('button');
+    const control = page.getByRole('checkbox');
     const themeBefore = document.documentElement.getAttribute('data-theme');
 
-    await button.click();
+    await control.click();
     const themeAfter = document.documentElement.getAttribute('data-theme');
     expect(themeAfter).not.toBe(themeBefore);
 
-    await button.click();
+    await control.click();
     const themeRestored = document.documentElement.getAttribute('data-theme');
     expect(themeRestored).toBe(themeBefore);
   });

From af9b65132013f3f33a7773d33f539d45c518d509 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 10:12:13 +0200
Subject: [PATCH 013/136] style: format code

---
 src/lib/components/storage/FileExplorer.svelte | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index dcfed7d1..28045047 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -4,7 +4,7 @@
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
   import type { StoragePage } from '$lib/storage/types.js';
-    import { SvelteSet } from 'svelte/reactivity';
+  import { SvelteSet } from 'svelte/reactivity';
 
   interface Props {
     bucket: string;
@@ -47,7 +47,10 @@
 
   function selectAll(checked: boolean) {
     if (checked) {
-      selectedKeys = new SvelteSet<string>([...folders.map((f) => f.key), ...files.map((f) => f.key)]);
+      selectedKeys = new SvelteSet<string>([
+        ...folders.map((f) => f.key),
+        ...files.map((f) => f.key)
+      ]);
     } else {
       selectedKeys = new SvelteSet<string>();
     }

From 83739749db327ea102f3b666c60dcaeda1765ea8 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 11:25:51 +0200
Subject: [PATCH 014/136] fix(tests): update theme toggle role from button to
 checkbox

Co-authored-by: Copilot <copilot@github.com>
---
 e2e/smoke.spec.ts                       | 2 +-
 src/lib/server/storage/hdfs-provider.ts | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/e2e/smoke.spec.ts b/e2e/smoke.spec.ts
index 77e97478..0c257d97 100644
--- a/e2e/smoke.spec.ts
+++ b/e2e/smoke.spec.ts
@@ -31,7 +31,7 @@ test.describe('Smoke tests', () => {
     await page.goto('/');
 
     const html = page.locator('html');
-    const toggle = page.getByRole('button', {
+    const toggle = page.getByRole('checkbox', {
       name: /switch to (light|dark) mode|zum (hellen|dunklen) modus wechseln/i
     });
 
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 6c08cd08..4bc8c563 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -2,8 +2,8 @@ import type { StorageProvider } from './provider.js';
 import type { HDFSConfig } from './types.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
-/* TODO: Remove this file and related HDFS provider code until we have a concrete plan for HDFS support. 
-For now, this serves as a placeholder to prevent compile errors. */
+/* TODO: Remove this file and related HDFS provider code until we have a concrete plan for HDFS support.
+ For now, this serves as a placeholder to prevent compile errors. */
 /* eslint-disable  @typescript-eslint/no-unused-vars */
 
 /** Stub implementation — HDFS support is not yet implemented. */

From 7aff59bc28b22e8ae8779629b6f14999c0507cac Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 14:12:17 +0200
Subject: [PATCH 015/136] fix: revert changes to Theme Toggle

---
 .../layout/header/ThemeToggle.svelte          | 28 ++++++++-----------
 .../layout/header/ThemeToggle.svelte.spec.ts  |  6 ++--
 2 files changed, 15 insertions(+), 19 deletions(-)

diff --git a/src/lib/components/layout/header/ThemeToggle.svelte b/src/lib/components/layout/header/ThemeToggle.svelte
index db4d6362..17916a5a 100644
--- a/src/lib/components/layout/header/ThemeToggle.svelte
+++ b/src/lib/components/layout/header/ThemeToggle.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { browser } from '$app/environment';
-  import * as m from '$lib/paraglide/messages.js';
   import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
 
   function prefersDark(): boolean {
     if (!browser) return false;
@@ -20,18 +20,14 @@
   });
 </script>
 
-<label class="swap swap-rotate">
-  <!-- this hidden checkbox controls the state -->
-  <input
-    type="checkbox"
-    class="theme-controller"
-    bind:checked={dark}
-    aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
-  />
-
-  <!-- sun icon (visible when unchecked) -->
-  <Icon icon="material-symbols:light-mode" class="swap-off size-5" aria-hidden="true" />
-
-  <!-- moon icon (visible when checked) -->
-  <Icon icon="material-symbols:dark-mode" class="swap-on size-5" aria-hidden="true" />
-</label>
+<button
+  onclick={() => (dark = !dark)}
+  class="btn btn-ghost btn-sm btn-square"
+  aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
+>
+  {#if dark}
+    <Icon icon="material-symbols:dark-mode" class="size-5" aria-hidden="true" />
+  {:else}
+    <Icon icon="material-symbols:light-mode" class="size-5" aria-hidden="true" />
+  {/if}
+</button>
diff --git a/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts b/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
index f1ce2552..52736536 100644
--- a/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
+++ b/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
@@ -7,13 +7,13 @@ describe('ThemeToggle', () => {
   it('should render a toggle button', async () => {
     render(ThemeToggle);
 
-    const control = page.getByRole('checkbox');
+    const control = page.getByRole('button');
     await expect.element(control).toBeInTheDocument();
   });
 
   it('should toggle the aria-label on click', async () => {
     render(ThemeToggle);
-    const control = page.getByRole('checkbox');
+    const control = page.getByRole('button');
 
     // Starts in light mode — label offers to switch to dark
     await expect.element(control).toHaveAttribute('aria-label', 'Switch to dark mode');
@@ -26,7 +26,7 @@ describe('ThemeToggle', () => {
 
   it('should toggle the data-theme attribute on the document', async () => {
     render(ThemeToggle);
-    const control = page.getByRole('checkbox');
+    const control = page.getByRole('button');
     const themeBefore = document.documentElement.getAttribute('data-theme');
 
     await control.click();

From 266a045f8a530ca43a108da74e477648f122e7f6 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 6 May 2026 14:31:50 +0200
Subject: [PATCH 016/136] fix: revert changes to Theme Toggle

---
 e2e/smoke.spec.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/e2e/smoke.spec.ts b/e2e/smoke.spec.ts
index 0c257d97..77e97478 100644
--- a/e2e/smoke.spec.ts
+++ b/e2e/smoke.spec.ts
@@ -31,7 +31,7 @@ test.describe('Smoke tests', () => {
     await page.goto('/');
 
     const html = page.locator('html');
-    const toggle = page.getByRole('checkbox', {
+    const toggle = page.getByRole('button', {
       name: /switch to (light|dark) mode|zum (hellen|dunklen) modus wechseln/i
     });
 

From 3386182b25b211c8109d9f5f7c559c6cee45426d Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 7 May 2026 10:58:35 +0200
Subject: [PATCH 017/136] #80 use pagination controls to navigate the file
 browser

---
 messages/de.json                              |  6 +-
 messages/en.json                              |  6 +-
 package-lock.json                             | 86 ++++++++++++++---
 .../components/storage/FileExplorer.svelte    | 96 ++++++++++++++++++-
 src/lib/components/storage/ObjectTable.svelte |  2 +-
 src/lib/server/storage/hdfs-provider.ts       |  2 +-
 src/lib/server/storage/provider.ts            |  7 +-
 src/lib/server/storage/s3-provider.ts         | 94 ++++++++----------
 src/lib/server/storage/service.ts             |  6 +-
 src/lib/storage/types.ts                      |  4 +
 .../[bucket]/[...prefix]/+page.server.ts      |  9 +-
 .../storage/[bucket]/[...prefix]/+page.svelte | 21 ++--
 12 files changed, 256 insertions(+), 83 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 449560c7..4d984779 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -165,5 +165,9 @@
   "storage_error_go_back": "Zurück",
   "storage_header_name": "Name",
   "storage_header_size": "Größe",
-  "storage_header_last_modified": "Zuletzt geändert"
+  "storage_header_last_modified": "Zuletzt geändert",
+  "storage_page_size": "Elemente pro Seite",
+  "storage_first_page": "Erste Seite",
+  "storage_previous_page": "Vorherige Seite",
+  "storage_next_page": "Nächste Seite"
 }
diff --git a/messages/en.json b/messages/en.json
index b0426d9f..6be46952 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -165,5 +165,9 @@
   "storage_error_go_back": "Go back",
   "storage_header_name": "Name",
   "storage_header_size": "Size",
-  "storage_header_last_modified": "Last modified"
+  "storage_header_last_modified": "Last modified",
+  "storage_page_size": "Items per page",
+  "storage_first_page": "First page",
+  "storage_previous_page": "Previous page",
+  "storage_next_page": "Next page"
 }
diff --git a/package-lock.json b/package-lock.json
index c3cf3a25..924a636a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1179,6 +1179,7 @@
       "cpu": [
         "ppc64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1195,6 +1196,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1211,6 +1213,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1227,6 +1230,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1243,6 +1247,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1259,6 +1264,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1275,6 +1281,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1291,6 +1298,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1307,6 +1315,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1323,6 +1332,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1339,6 +1349,7 @@
       "cpu": [
         "ia32"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1355,6 +1366,7 @@
       "cpu": [
         "loong64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1371,6 +1383,7 @@
       "cpu": [
         "mips64el"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1387,6 +1400,7 @@
       "cpu": [
         "ppc64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1403,6 +1417,7 @@
       "cpu": [
         "riscv64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1419,6 +1434,7 @@
       "cpu": [
         "s390x"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1435,6 +1451,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1451,6 +1468,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1467,6 +1485,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1483,6 +1502,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1499,6 +1519,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1515,6 +1536,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1531,6 +1553,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1547,6 +1570,7 @@
       "cpu": [
         "ia32"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1563,6 +1587,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2627,6 +2652,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2640,6 +2666,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2653,6 +2680,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2666,6 +2694,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2679,6 +2708,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2692,6 +2722,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2705,6 +2736,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2718,6 +2750,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2731,6 +2764,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2744,6 +2778,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2757,6 +2792,7 @@
       "cpu": [
         "loong64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2770,6 +2806,7 @@
       "cpu": [
         "loong64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2783,6 +2820,7 @@
       "cpu": [
         "ppc64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2796,6 +2834,7 @@
       "cpu": [
         "ppc64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2809,6 +2848,7 @@
       "cpu": [
         "riscv64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2822,6 +2862,7 @@
       "cpu": [
         "riscv64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2835,6 +2876,7 @@
       "cpu": [
         "s390x"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2848,6 +2890,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2861,6 +2904,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2874,6 +2918,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2887,6 +2932,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2900,6 +2946,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2913,6 +2960,7 @@
       "cpu": [
         "ia32"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2926,6 +2974,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2939,6 +2988,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4169,7 +4219,7 @@
       "version": "24.10.13",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.13.tgz",
       "integrity": "sha512-oH72nZRfDv9lADUBSo104Aq7gPHpQZc4BTx38r9xf9pg5LfP6EzSyH2n7qFmmxRQXh7YlUXODcYsg6PuTDSxGg==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~7.16.0"
@@ -4587,7 +4637,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.0.18.tgz",
       "integrity": "sha512-gVQqh7paBz3gC+ZdcCmNSWJMk70IUjDeVqi+5m5vYpEHsIwRgw3Y545jljtajhkekIpIp5Gg8oK7bctgY0E2Ng==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/mocker": "4.0.18",
@@ -4610,7 +4660,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.0.18.tgz",
       "integrity": "sha512-gfajTHVCiwpxRj1qh0Sh/5bbGLG4F/ZH/V9xvFVoFddpITfMta9YGow0W6ZpTTORv2vdJuz9TnrNSmjKvpOf4g==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/browser": "4.0.18",
@@ -5951,7 +6001,7 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
       "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "devOptional": true,
+      "dev": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">=8"
@@ -7003,6 +7053,7 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
       "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -7797,7 +7848,7 @@
       "version": "1.31.1",
       "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
       "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
-      "devOptional": true,
+      "dev": true,
       "license": "MPL-2.0",
       "dependencies": {
         "detect-libc": "^2.0.3"
@@ -7830,6 +7881,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7850,6 +7902,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7870,6 +7923,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7890,6 +7944,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7910,6 +7965,7 @@
       "cpu": [
         "arm"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7930,6 +7986,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7950,6 +8007,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7970,6 +8028,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7990,6 +8049,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8010,6 +8070,7 @@
       "cpu": [
         "arm64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8030,6 +8091,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -9230,7 +9292,7 @@
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
       "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
-      "devOptional": true,
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "pngjs": "^7.0.0"
@@ -9255,7 +9317,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
       "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
-      "devOptional": true,
+      "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "playwright-core": "1.58.2"
@@ -9274,7 +9336,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
       "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
-      "devOptional": true,
+      "dev": true,
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
@@ -9287,7 +9349,7 @@
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
       "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=14.19.0"
@@ -11465,7 +11527,7 @@
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
       "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/unicode-properties": {
@@ -11710,6 +11772,7 @@
       "cpu": [
         "x64"
       ],
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11765,6 +11828,7 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -12076,7 +12140,7 @@
       "version": "8.19.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
       "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 28045047..5b367c5f 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -6,11 +6,15 @@
   import type { StoragePage } from '$lib/storage/types.js';
   import { SvelteSet } from 'svelte/reactivity';
 
+  import Icon from '@iconify/svelte';
+  import { browser } from '$app/environment';
+  import { ALLOWED_PAGE_SIZES, isPageSize, type PageSize } from '$lib/types/pagination.js';
+
   interface Props {
     bucket: string;
     objects: StoragePage;
     prefix: string;
-    onnavigate: (prefix: string) => void;
+    onnavigate: (prefix: string, continuationToken?: string | null) => void;
   }
 
   let { bucket, objects, prefix, onnavigate }: Props = $props();
@@ -23,6 +27,29 @@
   let selectedKeys = $state<Set<string>>(new Set<string>());
   let selectionMode = $state(false);
 
+  // Stack of previous continuation tokens for deterministic "Prev" navigation.
+  let prevTokens = $state<string[]>([]);
+
+  const STORAGE_KEY = 'storage_page_size';
+
+  function initPageSize(): PageSize {
+    if (!browser) return 25;
+    const stored = parseInt(localStorage.getItem(STORAGE_KEY) ?? '', 10);
+    return isPageSize(stored) ? stored : 25;
+  }
+
+  let pageSize = $state<PageSize>(initPageSize());
+
+  function handlePageSizeChange(event: Event) {
+    const n = parseInt((event.target as HTMLSelectElement).value, 10);
+    if (isPageSize(n)) {
+      pageSize = n;
+      prevTokens = [];
+      if (browser) localStorage.setItem(STORAGE_KEY, String(n));
+      goFirst();
+    }
+  }
+
   // Clear selection on navigation
   $effect(() => {
     void prefix;
@@ -67,6 +94,10 @@
   /* eslint-disable-next-line @typescript-eslint/no-unused-vars */
   const deleteCount = $derived(selectedFiles.length + selectedFolders.length);
 
+  const canGoPrev = $derived(prevTokens.length > 0);
+  const canGoFirst = $derived(prevTokens.length > 0 || objects.continuationToken);
+  const canGoNext = $derived(objects.hasNextPage);
+
   // ── Loading state ─────────────────────────────────────────────────────────
   let loading = $state(false);
 
@@ -78,7 +109,29 @@
 
   function handleNavigate(prefix: string) {
     loading = true;
-    onnavigate(prefix);
+    prevTokens = [];
+    onnavigate(prefix, null, pageSize);
+  }
+
+  function handlePageNavigate(token: string | null) {
+    // push current page token so we can go back deterministically
+    prevTokens = [...prevTokens, objects.continuationToken ?? null];
+    loading = true;
+    onnavigate(prefix, token, pageSize);
+  }
+
+  function goFirst() {
+    prevTokens = [];
+    loading = true;
+    onnavigate(prefix, null, pageSize);
+  }
+
+  function goPrev() {
+    const copy = [...prevTokens];
+    const last = copy.pop() ?? null;
+    prevTokens = copy;
+    loading = true;
+    onnavigate(prefix, last, pageSize);
   }
 
   // ── Context menu ──────────────────────────────────────────────────────────
@@ -176,6 +229,45 @@
       onaction={handleAction}
     />
   </div>
+
+  <!-- Fixed pagination bar at bottom -->
+  <div class="px-4 py-3 border-t border-base-200/40 bg-base-100 flex items-center justify-end gap-2 sticky bottom-0 z-10">
+    <label class="text-base-content/60 text-xs mr-2">{m.storage_page_size()}</label>
+    <select id="storage-page-size" class="select select-xs w-14 px-1 mr-4" value={pageSize} onchange={handlePageSizeChange}>
+      {#each ALLOWED_PAGE_SIZES as size (size)}
+        <option value={size}>{size}</option>
+      {/each}
+    </select>
+    <button
+      class="btn btn-ghost btn-sm"
+      onclick={goFirst}
+      disabled={!canGoFirst}
+      aria-label={m.storage_first_page()}
+      title={m.storage_first_page()}
+    >
+      <Icon icon="material-symbols:first-page" class={"size-4 " + (canGoFirst ? '' : 'opacity-40')} aria-hidden="true" />
+    </button>
+
+    <button
+      class="btn btn-ghost btn-sm"
+      onclick={goPrev}
+      disabled={!canGoPrev}
+      aria-label={m.storage_previous_page()}
+      title={m.storage_previous_page()}
+    >
+      <Icon icon="material-symbols:chevron-left" class={"size-4 " + (canGoPrev ? '' : 'opacity-40')} aria-hidden="true" />
+    </button>
+
+    <button
+      class="btn btn-primary btn-sm"
+      onclick={() => handlePageNavigate(objects.nextContinuationToken ?? null)}
+      disabled={!canGoNext}
+      aria-label={m.storage_next_page()}
+      title={m.storage_next_page()}
+    >
+      <Icon icon="material-symbols:chevron-right" class={"size-4 " + (canGoNext ? '' : 'opacity-40')} aria-hidden="true" />
+    </button>
+  </div>
 </div>
 
 <!-- Context menu -->
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
index 9dc74b8f..b1793656 100644
--- a/src/lib/components/storage/ObjectTable.svelte
+++ b/src/lib/components/storage/ObjectTable.svelte
@@ -16,7 +16,7 @@
     showCheckboxes: boolean;
     allSelected: boolean;
     someSelected: boolean;
-    onnavigate: (prefix: string) => void;
+    onnavigate: (prefix: string, continuationToken?: string | null, pageSize?: number) => void;
     onSelectAll: (checked: boolean) => void;
     onToggleSelect: (key: string, force?: boolean) => void;
     onContextMenu: (e: MouseEvent, key: string) => void;
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 4bc8c563..798377ff 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -10,7 +10,7 @@ import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 export class HDFSStorageProvider implements StorageProvider {
   constructor(_config: HDFSConfig) {}
 
-  listObjects(_prefix: string, _pageSize: number, _page: number): Promise<StoragePage> {
+  listObjects(_prefix: string, _pageSize: number, _continuationToken?: string | null): Promise<StoragePage> {
     throw new Error('HDFS not implemented');
   }
 
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index e1ebe3b0..4abcd0d8 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -2,7 +2,12 @@ import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
 /** Backend-agnostic interface for a bucket-scoped storage provider. */
 export interface StorageProvider {
-  listObjects(prefix: string, pageSize: number, page: number): Promise<StoragePage>;
+  /**
+   * List objects using cursor-based pagination. `continuationToken` is the
+   * provider-specific opaque token returned from a previous call. When
+   * omitted, the first page is returned.
+   */
+  listObjects(prefix: string, pageSize: number, continuationToken?: string | null): Promise<StoragePage>;
   getObject(key: string): Promise<ReadableStream>;
   getMetadata(key: string): Promise<StorageMetadata>;
   exists(key: string): Promise<boolean>;
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index b7f79441..4157769b 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -34,61 +34,51 @@ export class S3StorageProvider implements StorageProvider {
     });
   }
 
-  async listObjects(prefix: string, pageSize: number, page: number): Promise<StoragePage> {
-    log.debug({ bucket: this.bucket, prefix, page_size: pageSize, page }, 'listing objects');
+  async listObjects(
+    prefix: string,
+    pageSize: number,
+    continuationToken?: string | null
+  ): Promise<StoragePage> {
+    log.debug({ bucket: this.bucket, prefix, page_size: pageSize }, 'listing objects');
 
-    // S3 uses cursor-based pagination via continuation tokens, not offset-based.
-    // To reach page N we advance through N-1 pages sequentially.
-    let continuationToken: string | undefined;
-    let currentPage = 1;
+    const output: ListObjectsV2CommandOutput = await this.client.send(
+      new ListObjectsV2Command({
+        Bucket: this.bucket,
+        Prefix: prefix || undefined,
+        Delimiter: '/',
+        MaxKeys: pageSize,
+        ContinuationToken: continuationToken ?? undefined
+      })
+    );
 
-    while (true) {
-      const output: ListObjectsV2CommandOutput = await this.client.send(
-        new ListObjectsV2Command({
-          Bucket: this.bucket,
-          Prefix: prefix || undefined,
-          Delimiter: '/',
-          MaxKeys: pageSize,
-          ContinuationToken: continuationToken
-        })
-      );
-
-      if (currentPage === page) {
-        const objects: StorageObject[] = [
-          ...(output.CommonPrefixes ?? []).map((cp) => ({
-            key: cp.Prefix ?? '',
-            size: 0,
-            lastModified: new Date(0),
-            isDirectory: true,
-            contentType: undefined
-          })),
-          ...(output.Contents ?? [])
-            // Filter out the prefix itself (S3 sometimes echoes it back)
-            .filter((obj) => obj.Key !== prefix)
-            .map((obj) => ({
-              key: obj.Key ?? '',
-              size: obj.Size ?? 0,
-              lastModified: obj.LastModified ?? new Date(0),
-              isDirectory: false,
-              contentType: undefined
-            }))
-        ];
-
-        return {
-          objects,
-          hasNextPage: output.IsTruncated ?? false,
-          currentPage,
-          pageSize
-        };
-      }
-
-      if (!output.IsTruncated || !output.NextContinuationToken) {
-        return { objects: [], hasNextPage: false, currentPage: page, pageSize };
-      }
+    const objects: StorageObject[] = [
+      ...(output.CommonPrefixes ?? []).map((cp) => ({
+        key: cp.Prefix ?? '',
+        size: 0,
+        lastModified: new Date(0),
+        isDirectory: true,
+        contentType: undefined
+      })),
+      ...(output.Contents ?? [])
+        // Filter out the prefix itself (S3 sometimes echoes it back)
+        .filter((obj) => obj.Key !== prefix)
+        .map((obj) => ({
+          key: obj.Key ?? '',
+          size: obj.Size ?? 0,
+          lastModified: obj.LastModified ?? new Date(0),
+          isDirectory: false,
+          contentType: undefined
+        }))
+    ];
 
-      continuationToken = output.NextContinuationToken;
-      currentPage++;
-    }
+    return {
+      objects,
+      hasNextPage: output.IsTruncated ?? false,
+      currentPage: 1,
+      pageSize,
+      continuationToken: continuationToken ?? null,
+      nextContinuationToken: output.NextContinuationToken ?? null
+    };
   }
 
   async getObject(key: string): Promise<ReadableStream> {
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index a60877c2..38fa59a1 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -42,7 +42,9 @@ export async function listBuckets(userId: string): Promise<string[]> {
 export async function listObjects(
   userId: string,
   bucket: string,
-  prefix: string
+  prefix: string,
+  pageSize: number,
+  continuationToken?: string | null
 ): Promise<StoragePage> {
   const connection = getUserConnection(userId);
 
@@ -57,7 +59,7 @@ export async function listObjects(
   const provider = StorageProviderFactory.create({ ...connection, bucket });
 
   try {
-    return await provider.listObjects(prefix, 50, 1);
+    return await provider.listObjects(prefix, pageSize, continuationToken ?? undefined);
   } catch (err) {
     if (err instanceof S3ServiceException) {
       const code = err.name;
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index c9f4c339..b138c120 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -22,4 +22,8 @@ export interface StoragePage {
   hasNextPage: boolean;
   currentPage: number;
   pageSize: number;
+  /** Continuation token for the current page (if provided). */
+  continuationToken?: string | null;
+  /** Token to request the next page from the provider (if any). */
+  nextContinuationToken?: string | null;
 }
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
index 0dc9bd6f..4ad33d15 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -2,13 +2,16 @@ import type { PageServerLoad } from './$types';
 import { listObjects } from '$lib/server/storage/service.js';
 import { getUserId } from '$lib/server/auth-utils.js';
 
-export const load: PageServerLoad = async ({ locals, params }) => {
+export const load: PageServerLoad = async ({ locals, params, url }) => {
   const userId = getUserId(locals);
   const prefix = params.prefix ? params.prefix + '/' : '';
   const bucket = params.bucket;
+  const continuationToken = url.searchParams.get('continuationToken');
+  const pageSizeParam = url.searchParams.get('pageSize');
+  const pageSize = pageSizeParam ? parseInt(pageSizeParam, 10) : undefined;
 
-  locals.logger.debug({ bucket, prefix }, 'loading storage bucket objects');
+  locals.logger.debug({ bucket, prefix, continuation_token: continuationToken, page_size: pageSize }, 'loading storage bucket objects');
 
-  const objects = await listObjects(userId, bucket, prefix);
+  const objects = await listObjects(userId, bucket, prefix, pageSize ?? 25, continuationToken ?? undefined);
   return { objects, prefix, bucket };
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index a36d41f6..a9704a05 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -5,17 +5,22 @@
 
   let { data } = $props();
 
-  function handleNavigate(prefix: string) {
+  function handleNavigate(prefix: string, continuationToken = null, pageSize = null) {
     const encodedPrefix = prefix
       ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';
-    goto(
-      resolve('/(app)/storage/[bucket]/[...prefix]', {
-        bucket: encodeURIComponent(data.bucket),
-        prefix: encodedPrefix
-      }),
-      { replaceState: false }
-    );
+
+    const target = resolve('/(app)/storage/[bucket]/[...prefix]', {
+      bucket: encodeURIComponent(data.bucket),
+      prefix: encodedPrefix
+    });
+
+    const params = new URLSearchParams();
+    if (continuationToken) params.set('continuationToken', String(continuationToken));
+    if (pageSize) params.set('pageSize', String(pageSize));
+
+    const url = params.toString() ? `${target}?${params.toString()}` : target;
+    goto(url, { replaceState: false });
   }
 </script>
 

From b77bcfa8b0e497f5f9f2c843a5443d9886f2ec16 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 7 May 2026 11:18:45 +0200
Subject: [PATCH 018/136] #80 show page counter for pagination control

Co-authored-by: Copilot <copilot@github.com>
---
 messages/de.json                               | 3 ++-
 messages/en.json                               | 3 ++-
 src/lib/components/storage/FileExplorer.svelte | 2 ++
 3 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 4d984779..d72230ab 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -169,5 +169,6 @@
   "storage_page_size": "Elemente pro Seite",
   "storage_first_page": "Erste Seite",
   "storage_previous_page": "Vorherige Seite",
-  "storage_next_page": "Nächste Seite"
+  "storage_next_page": "Nächste Seite",
+  "storage_page": "Seite"
 }
diff --git a/messages/en.json b/messages/en.json
index 6be46952..275d14be 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -169,5 +169,6 @@
   "storage_page_size": "Items per page",
   "storage_first_page": "First page",
   "storage_previous_page": "Previous page",
-  "storage_next_page": "Next page"
+  "storage_next_page": "Next page",
+  "storage_page": "Page"
 }
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 5b367c5f..0a30945e 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -97,6 +97,7 @@
   const canGoPrev = $derived(prevTokens.length > 0);
   const canGoFirst = $derived(prevTokens.length > 0 || objects.continuationToken);
   const canGoNext = $derived(objects.hasNextPage);
+  const currentPage = $derived(prevTokens.length + 1);
 
   // ── Loading state ─────────────────────────────────────────────────────────
   let loading = $state(false);
@@ -238,6 +239,7 @@
         <option value={size}>{size}</option>
       {/each}
     </select>
+    <span class="text-base-content/60 text-xs mr-2">{`${m.storage_page()} ${currentPage}`}</span>
     <button
       class="btn btn-ghost btn-sm"
       onclick={goFirst}

From 48b552e6c40933d4cd80d3b1dcd6af5de771fb23 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 7 May 2026 12:23:22 +0200
Subject: [PATCH 019/136] #80 fix lint and svelte check

Co-authored-by: Copilot <copilot@github.com>
---
 .../components/storage/FileExplorer.svelte    | 43 +++++++++++++++----
 .../storage/StorageConnectForm.svelte         | 24 +++++------
 src/lib/server/storage/hdfs-provider.ts       |  6 ++-
 src/lib/server/storage/provider.ts            |  6 ++-
 .../[bucket]/[...prefix]/+page.server.ts      | 13 +++++-
 .../storage/[bucket]/[...prefix]/+page.svelte |  6 ++-
 6 files changed, 72 insertions(+), 26 deletions(-)

diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 0a30945e..69baa74d 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -14,7 +14,11 @@
     bucket: string;
     objects: StoragePage;
     prefix: string;
-    onnavigate: (prefix: string, continuationToken?: string | null) => void;
+    onnavigate: (
+      prefix: string,
+      continuationToken?: string | null,
+      pageSize?: number | null
+    ) => void;
   }
 
   let { bucket, objects, prefix, onnavigate }: Props = $props();
@@ -28,7 +32,7 @@
   let selectionMode = $state(false);
 
   // Stack of previous continuation tokens for deterministic "Prev" navigation.
-  let prevTokens = $state<string[]>([]);
+  let prevTokens = $state<(string | null)[]>([]);
 
   const STORAGE_KEY = 'storage_page_size';
 
@@ -232,14 +236,23 @@
   </div>
 
   <!-- Fixed pagination bar at bottom -->
-  <div class="px-4 py-3 border-t border-base-200/40 bg-base-100 flex items-center justify-end gap-2 sticky bottom-0 z-10">
-    <label class="text-base-content/60 text-xs mr-2">{m.storage_page_size()}</label>
-    <select id="storage-page-size" class="select select-xs w-14 px-1 mr-4" value={pageSize} onchange={handlePageSizeChange}>
+  <div
+    class="border-base-200/40 bg-base-100 sticky bottom-0 z-10 flex items-center justify-end gap-2 border-t px-4 py-3"
+  >
+    <label for="storage-page-size" class="text-base-content/60 mr-2 text-xs"
+      >{m.storage_page_size()}</label
+    >
+    <select
+      id="storage-page-size"
+      class="select select-xs mr-4 w-14 px-1"
+      value={pageSize}
+      onchange={handlePageSizeChange}
+    >
       {#each ALLOWED_PAGE_SIZES as size (size)}
         <option value={size}>{size}</option>
       {/each}
     </select>
-    <span class="text-base-content/60 text-xs mr-2">{`${m.storage_page()} ${currentPage}`}</span>
+    <span class="text-base-content/60 mr-2 text-xs">{`${m.storage_page()} ${currentPage}`}</span>
     <button
       class="btn btn-ghost btn-sm"
       onclick={goFirst}
@@ -247,7 +260,11 @@
       aria-label={m.storage_first_page()}
       title={m.storage_first_page()}
     >
-      <Icon icon="material-symbols:first-page" class={"size-4 " + (canGoFirst ? '' : 'opacity-40')} aria-hidden="true" />
+      <Icon
+        icon="material-symbols:first-page"
+        class={'size-4 ' + (canGoFirst ? '' : 'opacity-40')}
+        aria-hidden="true"
+      />
     </button>
 
     <button
@@ -257,7 +274,11 @@
       aria-label={m.storage_previous_page()}
       title={m.storage_previous_page()}
     >
-      <Icon icon="material-symbols:chevron-left" class={"size-4 " + (canGoPrev ? '' : 'opacity-40')} aria-hidden="true" />
+      <Icon
+        icon="material-symbols:chevron-left"
+        class={'size-4 ' + (canGoPrev ? '' : 'opacity-40')}
+        aria-hidden="true"
+      />
     </button>
 
     <button
@@ -267,7 +288,11 @@
       aria-label={m.storage_next_page()}
       title={m.storage_next_page()}
     >
-      <Icon icon="material-symbols:chevron-right" class={"size-4 " + (canGoNext ? '' : 'opacity-40')} aria-hidden="true" />
+      <Icon
+        icon="material-symbols:chevron-right"
+        class={'size-4 ' + (canGoNext ? '' : 'opacity-40')}
+        aria-hidden="true"
+      />
     </button>
   </div>
 </div>
diff --git a/src/lib/components/storage/StorageConnectForm.svelte b/src/lib/components/storage/StorageConnectForm.svelte
index be3d4e17..d66cc821 100644
--- a/src/lib/components/storage/StorageConnectForm.svelte
+++ b/src/lib/components/storage/StorageConnectForm.svelte
@@ -58,13 +58,13 @@
         type="url"
         class="
           input-bordered input w-full
-          {$errors.endpoint ? 'input-error' : ''}"
+          {$errors?.endpoint ? 'input-error' : ''}"
         placeholder={m.storage_connect_endpoint_placeholder()}
         bind:value={$form.endpoint}
       />
       <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_endpoint_hint()}</p>
-      {#if $errors.endpoint}
-        <p class="text-error mt-1 text-xs">{$errors.endpoint}</p>
+      {#if $errors?.endpoint}
+        <p class="text-error mt-1 text-xs">{$errors?.endpoint}</p>
       {/if}
     </div>
 
@@ -79,11 +79,11 @@
         type="text"
         class="
           input-bordered input w-full
-          {$errors.region ? 'input-error' : ''}"
+          {$errors?.region ? 'input-error' : ''}"
         bind:value={$form.region}
       />
-      {#if $errors.region}
-        <p class="text-error mt-1 text-xs">{$errors.region}</p>
+      {#if $errors?.region}
+        <p class="text-error mt-1 text-xs">{$errors?.region}</p>
       {/if}
     </div>
 
@@ -98,12 +98,12 @@
         type="text"
         class="
           input-bordered input w-full
-          {$errors.accessKeyId ? 'input-error' : ''}"
+          {$errors?.accessKeyId ? 'input-error' : ''}"
         autocomplete="username"
         bind:value={$form.accessKeyId}
       />
-      {#if $errors.accessKeyId}
-        <p class="text-error mt-1 text-xs">{$errors.accessKeyId}</p>
+      {#if $errors?.accessKeyId}
+        <p class="text-error mt-1 text-xs">{$errors?.accessKeyId}</p>
       {/if}
     </div>
 
@@ -118,12 +118,12 @@
         type="password"
         class="
           input-bordered input w-full
-          {$errors.secretAccessKey ? `input-error` : ''}"
+          {$errors?.secretAccessKey ? `input-error` : ''}"
         autocomplete="current-password"
         bind:value={$form.secretAccessKey}
       />
-      {#if $errors.secretAccessKey}
-        <p class="text-error mt-1 text-xs">{$errors.secretAccessKey}</p>
+      {#if $errors?.secretAccessKey}
+        <p class="text-error mt-1 text-xs">{$errors?.secretAccessKey}</p>
       {/if}
     </div>
 
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 798377ff..131e05cd 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -10,7 +10,11 @@ import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 export class HDFSStorageProvider implements StorageProvider {
   constructor(_config: HDFSConfig) {}
 
-  listObjects(_prefix: string, _pageSize: number, _continuationToken?: string | null): Promise<StoragePage> {
+  listObjects(
+    _prefix: string,
+    _pageSize: number,
+    _continuationToken?: string | null
+  ): Promise<StoragePage> {
     throw new Error('HDFS not implemented');
   }
 
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index 4abcd0d8..ae6b850d 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -7,7 +7,11 @@ export interface StorageProvider {
    * provider-specific opaque token returned from a previous call. When
    * omitted, the first page is returned.
    */
-  listObjects(prefix: string, pageSize: number, continuationToken?: string | null): Promise<StoragePage>;
+  listObjects(
+    prefix: string,
+    pageSize: number,
+    continuationToken?: string | null
+  ): Promise<StoragePage>;
   getObject(key: string): Promise<ReadableStream>;
   getMetadata(key: string): Promise<StorageMetadata>;
   exists(key: string): Promise<boolean>;
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
index 4ad33d15..df190b1b 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -10,8 +10,17 @@ export const load: PageServerLoad = async ({ locals, params, url }) => {
   const pageSizeParam = url.searchParams.get('pageSize');
   const pageSize = pageSizeParam ? parseInt(pageSizeParam, 10) : undefined;
 
-  locals.logger.debug({ bucket, prefix, continuation_token: continuationToken, page_size: pageSize }, 'loading storage bucket objects');
+  locals.logger.debug(
+    { bucket, prefix, continuation_token: continuationToken, page_size: pageSize },
+    'loading storage bucket objects'
+  );
 
-  const objects = await listObjects(userId, bucket, prefix, pageSize ?? 25, continuationToken ?? undefined);
+  const objects = await listObjects(
+    userId,
+    bucket,
+    prefix,
+    pageSize ?? 25,
+    continuationToken ?? undefined
+  );
   return { objects, prefix, bucket };
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index a9704a05..af096ab0 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -5,7 +5,11 @@
 
   let { data } = $props();
 
-  function handleNavigate(prefix: string, continuationToken = null, pageSize = null) {
+  function handleNavigate(
+    prefix: string,
+    continuationToken: string | null = null,
+    pageSize: number | null = null
+  ) {
     const encodedPrefix = prefix
       ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';

From 7c9733f2122aa004aefb48b633e5a212f7a2b1cd Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 7 May 2026 14:02:35 +0200
Subject: [PATCH 020/136] fix lint error

---
 .../storage/[bucket]/[...prefix]/+page.svelte | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index af096ab0..b428774b 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -14,17 +14,19 @@
       ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';
 
-    const target = resolve('/(app)/storage/[bucket]/[...prefix]', {
-      bucket: encodeURIComponent(data.bucket),
-      prefix: encodedPrefix
-    });
+    const parts: string[] = [];
+    if (continuationToken)
+      parts.push(`continuationToken=${encodeURIComponent(String(continuationToken))}`);
+    if (pageSize) parts.push(`pageSize=${encodeURIComponent(String(pageSize))}`);
 
-    const params = new URLSearchParams();
-    if (continuationToken) params.set('continuationToken', String(continuationToken));
-    if (pageSize) params.set('pageSize', String(pageSize));
-
-    const url = params.toString() ? `${target}?${params.toString()}` : target;
-    goto(url, { replaceState: false });
+    const query = parts.length ? `?${parts.join('&')}` : '';
+    goto(
+      resolve('/(app)/storage/[bucket]/[...prefix]', {
+        bucket: encodeURIComponent(data.bucket),
+        prefix: encodedPrefix
+      }) + query,
+      { replaceState: false }
+    );
   }
 </script>
 

From b4e25eca4d1222b752a33194221534c52ef79ac0 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 8 May 2026 08:15:00 +0200
Subject: [PATCH 021/136] File Browser: Feature Flag (#105)

* #96 disable the storage browser if feature flag is set

* #96 fix svelte-check

* #96 fix lint

* #96 disable storage browser by default
---
 .../components/layout/sidebar/Sidebar.svelte  |  6 ++-
 .../components/layout/sidebar/nav-items.ts    | 37 ++++++++++++-------
 src/lib/server/feature-flags.ts               |  6 +++
 src/routes/(app)/+layout.server.ts            |  3 +-
 src/routes/(app)/+layout.svelte               |  6 ++-
 src/routes/(app)/page.svelte.spec.ts          |  6 ++-
 src/routes/(app)/storage/+layout.server.ts    |  6 +++
 7 files changed, 52 insertions(+), 18 deletions(-)

diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index 4a8797d5..fb04d015 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -7,13 +7,15 @@
 
   let {
     collapsed = $bindable(false),
-    mobileOpen = $bindable(false)
+    mobileOpen = $bindable(false),
+    storageBrowserEnabled = false
   }: {
     collapsed?: boolean;
     mobileOpen?: boolean;
+    storageBrowserEnabled?: boolean;
   } = $props();
 
-  const sections = $derived(getNavSections());
+  const sections = $derived(getNavSections({ storageBrowserEnabled }));
 
   function isActive(href: string): boolean {
     if (href === '/') return page.url.pathname === '/';
diff --git a/src/lib/components/layout/sidebar/nav-items.ts b/src/lib/components/layout/sidebar/nav-items.ts
index 9577b366..311c9b67 100644
--- a/src/lib/components/layout/sidebar/nav-items.ts
+++ b/src/lib/components/layout/sidebar/nav-items.ts
@@ -3,7 +3,29 @@ import type { NavItem, NavSection } from '$lib/types/navigation.js';
 
 export type { NavItem, NavSection };
 
-export function getNavSections(): NavSection[] {
+export interface NavFlags {
+  storageBrowserEnabled?: boolean;
+}
+
+export function getNavSections(flags: NavFlags = {}): NavSection[] {
+  const { storageBrowserEnabled = false } = flags;
+
+  const dataToolsItems: NavItem[] = [
+    {
+      label: m.nav_trino(),
+      href: '/trino',
+      icon: 'database'
+    }
+  ];
+
+  if (storageBrowserEnabled) {
+    dataToolsItems.push({
+      label: m.nav_storage(),
+      href: '/storage',
+      icon: 'folder'
+    });
+  }
+
   return [
     {
       title: m.nav_platform(),
@@ -11,18 +33,7 @@ export function getNavSections(): NavSection[] {
     },
     {
       title: m.nav_data_tools(),
-      items: [
-        {
-          label: m.nav_trino(),
-          href: '/trino',
-          icon: 'database'
-        },
-        {
-          label: m.nav_storage(),
-          href: '/storage',
-          icon: 'folder'
-        }
-      ]
+      items: dataToolsItems
     }
   ];
 }
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 26a3355d..e43b1eff 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -8,3 +8,9 @@ import { env } from '$env/dynamic/private';
  *  refuses requests. Useful to fall back to plain syntax highlighting if
  *  completion misbehaves or generates undesirable load on Trino. */
 export const completionEnabled = env.STACKABLE_UI_COMPLETION_DISABLED !== 'true';
+
+/** When `STACKABLE_UI_STORAGE_BROWSER_ENABLED=true`, the S3/HDFS file
+ *  browser is shown in the sidebar and routes under `/storage` become
+ *  active. Disabled by default — opt in explicitly to expose storage
+ *  credentials and the file-browser UI. */
+export const storageBrowserEnabled = env.STACKABLE_UI_STORAGE_BROWSER_ENABLED === 'true';
diff --git a/src/routes/(app)/+layout.server.ts b/src/routes/(app)/+layout.server.ts
index c77935c7..a31f7956 100644
--- a/src/routes/(app)/+layout.server.ts
+++ b/src/routes/(app)/+layout.server.ts
@@ -1,5 +1,6 @@
 import type { LayoutServerLoad } from './$types';
+import { storageBrowserEnabled } from '$lib/server/feature-flags.js';
 
 export const load: LayoutServerLoad = async ({ locals }) => {
-  return { user: locals.user };
+  return { user: locals.user, storageBrowserEnabled };
 };
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index b4be2617..e8bf57b9 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -27,7 +27,11 @@
 </svelte:head>
 
 <div class="bg-base-100 flex h-dvh overflow-hidden">
-  <Sidebar bind:collapsed={sidebarCollapsed} bind:mobileOpen />
+  <Sidebar
+    bind:collapsed={sidebarCollapsed}
+    bind:mobileOpen
+    storageBrowserEnabled={data.storageBrowserEnabled}
+  />
 
   <div class="flex min-w-0 flex-1 flex-col">
     <Header
diff --git a/src/routes/(app)/page.svelte.spec.ts b/src/routes/(app)/page.svelte.spec.ts
index a3ca6ac4..380860f2 100644
--- a/src/routes/(app)/page.svelte.spec.ts
+++ b/src/routes/(app)/page.svelte.spec.ts
@@ -4,7 +4,11 @@ import { render } from 'vitest-browser-svelte';
 import Page from './+page.svelte';
 
 const renderPage = () =>
-  render(Page, { params: {}, data: { user: null, serviceCount: 0, healthy: true }, form: null });
+  render(Page, {
+    params: {},
+    data: { user: null, storageBrowserEnabled: true, serviceCount: 0, healthy: true },
+    form: null
+  });
 
 describe('/(app)/+page.svelte', () => {
   it('should render the welcome heading', async () => {
diff --git a/src/routes/(app)/storage/+layout.server.ts b/src/routes/(app)/storage/+layout.server.ts
index 24edb44c..ce04ed41 100644
--- a/src/routes/(app)/storage/+layout.server.ts
+++ b/src/routes/(app)/storage/+layout.server.ts
@@ -1,8 +1,14 @@
 import type { LayoutServerLoad } from './$types';
+import { error } from '@sveltejs/kit';
 import { getConnection, listBuckets } from '$lib/server/storage/service.js';
 import { getUserId } from '$lib/server/auth-utils.js';
+import { storageBrowserEnabled } from '$lib/server/feature-flags.js';
 
 export const load: LayoutServerLoad = async ({ locals }) => {
+  if (!storageBrowserEnabled) {
+    throw error(404, 'Not found');
+  }
+
   const userId = getUserId(locals);
   const connection = getConnection(userId);
 

From c36f1c8ff233e2a202786094daed6b06c18dcae6 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 8 May 2026 08:26:36 +0200
Subject: [PATCH 022/136] Rename option STACKABLE_UI_COMPLETION_DISABLED (#106)

---
 src/lib/server/feature-flags.ts | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index e43b1eff..53e543b8 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -3,11 +3,10 @@
 
 import { env } from '$env/dynamic/private';
 
-/** When `STACKABLE_UI_COMPLETION_DISABLED=true`, the SQL editor's
- *  code-completion provider is not registered and the metadata endpoint
- *  refuses requests. Useful to fall back to plain syntax highlighting if
- *  completion misbehaves or generates undesirable load on Trino. */
-export const completionEnabled = env.STACKABLE_UI_COMPLETION_DISABLED !== 'true';
+/** When `STACKABLE_UI_COMPLETION_ENABLED=true`, the SQL editor's
+ *  code-completion provider is registered and the metadata endpoint
+ *  accepts requests. Useful to enable enhanced SQL editing features. */
+export const completionEnabled = env.STACKABLE_UI_COMPLETION_ENABLED === 'true';
 
 /** When `STACKABLE_UI_STORAGE_BROWSER_ENABLED=true`, the S3/HDFS file
  *  browser is shown in the sidebar and routes under `/storage` become

From ff43b22e228eee98996229599987d243ae8401ea Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 8 May 2026 09:04:52 +0200
Subject: [PATCH 023/136] S3 File Browser: Shared Pagination Component (#103)

* #102 refactor pagination controls into a separate component

* #102 simplified pagination props
---
 messages/de.json                              |  10 +-
 messages/en.json                              |  10 +-
 src/lib/components/Pagination.svelte          | 233 ++++++++++++++++++
 .../components/storage/FileExplorer.svelte    | 100 ++------
 .../components/trino/StatementResult.svelte   | 103 ++------
 src/lib/types/pagination.ts                   |   8 +
 6 files changed, 290 insertions(+), 174 deletions(-)
 create mode 100644 src/lib/components/Pagination.svelte

diff --git a/messages/de.json b/messages/de.json
index d72230ab..25095167 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -167,8 +167,10 @@
   "storage_header_size": "Größe",
   "storage_header_last_modified": "Zuletzt geändert",
   "storage_page_size": "Elemente pro Seite",
-  "storage_first_page": "Erste Seite",
-  "storage_previous_page": "Vorherige Seite",
-  "storage_next_page": "Nächste Seite",
-  "storage_page": "Seite"
+  "storage_page": "Seite",
+  "pagination_first_page": "Erste Seite",
+  "pagination_prev_page": "Vorherige Seite",
+  "pagination_next_page": "Nächste Seite",
+  "pagination_last_page": "Letzte Seite",
+  "pagination_nav": "Seitennavigation"
 }
diff --git a/messages/en.json b/messages/en.json
index 275d14be..116159a7 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -167,8 +167,10 @@
   "storage_header_size": "Size",
   "storage_header_last_modified": "Last modified",
   "storage_page_size": "Items per page",
-  "storage_first_page": "First page",
-  "storage_previous_page": "Previous page",
-  "storage_next_page": "Next page",
-  "storage_page": "Page"
+  "storage_page": "Page",
+  "pagination_first_page": "First page",
+  "pagination_prev_page": "Previous page",
+  "pagination_next_page": "Next page",
+  "pagination_last_page": "Last page",
+  "pagination_nav": "Pagination"
 }
diff --git a/src/lib/components/Pagination.svelte b/src/lib/components/Pagination.svelte
new file mode 100644
index 00000000..615ed87a
--- /dev/null
+++ b/src/lib/components/Pagination.svelte
@@ -0,0 +1,233 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+  import { browser } from '$app/environment';
+  import { ALLOWED_PAGE_SIZES, isPageSize, type PageSize } from '$lib/types/pagination.js';
+
+  interface Props {
+    /** Bound page size — parent initialises this from `initPageSize()`. */
+    pageSize: PageSize;
+    /** localStorage key used to persist the selected page size. */
+    storageKey: string;
+    /** Translated label shown next to the page-size selector. */
+    pageSizeLabel: string;
+    /**
+     * Optional info text rendered beside the navigation buttons.
+     * E.g. "Page 3" (storage) or "Rows 1–25 of 100" (trino).
+     */
+    infoLabel?: string;
+    /** 0-based current page index. The component derives first/prev states from this. */
+    current: number;
+    /**
+     * Total number of pages, if known. Drives next/last button states and renders a Last button.
+     * When omitted (e.g. S3 cursor pagination where total pages are unknown), provide `hasNext`.
+     */
+    total?: number;
+    /**
+     * Whether the next page exists. Only used when `total` is not provided (cursor-based
+     * pagination where the total page count is unknown from the API).
+     */
+    hasNext?: boolean;
+    onfirst: () => void;
+    onprev: () => void;
+    onnext: () => void;
+    /** Called when navigating to the last page. Only relevant when `total` is provided. */
+    onlast?: () => void;
+    /** Called after the page size changes so the parent can reset page state. */
+    onpagesizechange?: () => void;
+    /**
+     * Layout variant.
+     * - `false` (default): page-size selector on the left, info + buttons on the right.
+     * - `true`: nav buttons + info on the left, page-size selector on the right.
+     */
+    pageSizeRight?: boolean;
+  }
+
+  let {
+    pageSize = $bindable(),
+    storageKey,
+    pageSizeLabel,
+    infoLabel,
+    current,
+    total,
+    hasNext,
+    onfirst,
+    onprev,
+    onnext,
+    onlast,
+    onpagesizechange,
+    pageSizeRight = false
+  }: Props = $props();
+
+  const uid = $props.id();
+
+  const canGoFirst = $derived(current > 0);
+  const canGoPrev = $derived(current > 0);
+  const canGoNext = $derived(total !== undefined ? current < total - 1 : (hasNext ?? false));
+  const canGoLast = $derived(total !== undefined && current < total - 1);
+  const showLast = $derived(total !== undefined && onlast !== undefined);
+  const showNavButtons = $derived(canGoFirst || canGoNext || showLast);
+
+  function handlePageSizeChange(event: Event) {
+    const n = parseInt((event.target as HTMLSelectElement).value, 10);
+    if (isPageSize(n)) {
+      pageSize = n;
+      if (browser) localStorage.setItem(storageKey, String(n));
+      onpagesizechange?.();
+    }
+  }
+</script>
+
+{#snippet pageSizeSelector()}
+  <div class="flex items-center gap-2">
+    <label for="{uid}-page-size" class="text-base-content/60 text-xs whitespace-nowrap">
+      {pageSizeLabel}
+    </label>
+    <select
+      id="{uid}-page-size"
+      class="select select-xs w-14 px-1"
+      value={pageSize}
+      onchange={handlePageSizeChange}
+    >
+      {#each ALLOWED_PAGE_SIZES as size (size)}
+        <option value={size}>{size}</option>
+      {/each}
+    </select>
+  </div>
+{/snippet}
+
+{#if pageSizeRight}
+  <!-- Trino layout: nav + info on left, page-size selector on right -->
+  <div class="flex items-center justify-between">
+    <div class="flex items-center gap-3">
+      {#if showNavButtons}
+        <nav class="flex items-center" aria-label={m.pagination_nav()}>
+          <button
+            class="btn btn-ghost btn-xs"
+            onclick={onfirst}
+            disabled={!canGoFirst}
+            aria-label={m.pagination_first_page()}
+            title={m.pagination_first_page()}
+          >
+            <Icon
+              icon="material-symbols:first-page"
+              class="size-4 {canGoFirst ? '' : 'opacity-40'}"
+              aria-hidden="true"
+            />
+          </button>
+          <button
+            class="btn btn-ghost btn-xs"
+            onclick={onprev}
+            disabled={!canGoPrev}
+            aria-label={m.pagination_prev_page()}
+            title={m.pagination_prev_page()}
+          >
+            <Icon
+              icon="material-symbols:chevron-left"
+              class="size-4 {canGoPrev ? '' : 'opacity-40'}"
+              aria-hidden="true"
+            />
+          </button>
+          <button
+            class="btn btn-ghost btn-xs"
+            onclick={onnext}
+            disabled={!canGoNext}
+            aria-label={m.pagination_next_page()}
+            title={m.pagination_next_page()}
+          >
+            <Icon
+              icon="material-symbols:chevron-right"
+              class="size-4 {canGoNext ? '' : 'opacity-40'}"
+              aria-hidden="true"
+            />
+          </button>
+          {#if showLast}
+            <button
+              class="btn btn-ghost btn-xs"
+              onclick={onlast}
+              disabled={!canGoLast}
+              aria-label={m.pagination_last_page()}
+              title={m.pagination_last_page()}
+            >
+              <Icon
+                icon="material-symbols:last-page"
+                class="size-4 {canGoLast ? '' : 'opacity-40'}"
+                aria-hidden="true"
+              />
+            </button>
+          {/if}
+        </nav>
+      {/if}
+      {#if infoLabel}
+        <span class="text-base-content/60 text-xs">{infoLabel}</span>
+      {/if}
+    </div>
+    {@render pageSizeSelector()}
+  </div>
+{:else}
+  <!-- Storage layout: page-size selector on left, info + buttons on right -->
+  <div class="flex items-center justify-end gap-2">
+    <div class="mr-4">
+      {@render pageSizeSelector()}
+    </div>
+    {#if infoLabel}
+      <span class="text-base-content/60 mr-1 text-xs">{infoLabel}</span>
+    {/if}
+    <nav class="flex items-center gap-1" aria-label={m.pagination_nav()}>
+      <button
+        class="btn btn-ghost btn-sm"
+        onclick={onfirst}
+        disabled={!canGoFirst}
+        aria-label={m.pagination_first_page()}
+        title={m.pagination_first_page()}
+      >
+        <Icon
+          icon="material-symbols:first-page"
+          class="size-4 {canGoFirst ? '' : 'opacity-40'}"
+          aria-hidden="true"
+        />
+      </button>
+      <button
+        class="btn btn-ghost btn-sm"
+        onclick={onprev}
+        disabled={!canGoPrev}
+        aria-label={m.pagination_prev_page()}
+        title={m.pagination_prev_page()}
+      >
+        <Icon
+          icon="material-symbols:chevron-left"
+          class="size-4 {canGoPrev ? '' : 'opacity-40'}"
+          aria-hidden="true"
+        />
+      </button>
+      <button
+        class="btn btn-primary btn-sm"
+        onclick={onnext}
+        disabled={!canGoNext}
+        aria-label={m.pagination_next_page()}
+        title={m.pagination_next_page()}
+      >
+        <Icon
+          icon="material-symbols:chevron-right"
+          class="size-4 {canGoNext ? '' : 'opacity-40'}"
+          aria-hidden="true"
+        />
+      </button>
+      {#if showLast}
+        <button
+          class="btn btn-ghost btn-sm"
+          onclick={onlast}
+          disabled={!canGoLast}
+          aria-label={m.pagination_last_page()}
+          title={m.pagination_last_page()}
+        >
+          <Icon
+            icon="material-symbols:last-page"
+            class="size-4 {canGoLast ? '' : 'opacity-40'}"
+            aria-hidden="true"
+          />
+        </button>
+      {/if}
+    </nav>
+  </div>
+{/if}
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 69baa74d..cdf8a33e 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -3,12 +3,11 @@
   import StorageBreadcrumb from './StorageBreadcrumb.svelte';
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
+  import Pagination from '$lib/components/Pagination.svelte';
   import type { StoragePage } from '$lib/storage/types.js';
   import { SvelteSet } from 'svelte/reactivity';
 
-  import Icon from '@iconify/svelte';
-  import { browser } from '$app/environment';
-  import { ALLOWED_PAGE_SIZES, isPageSize, type PageSize } from '$lib/types/pagination.js';
+  import { initPageSize, type PageSize } from '$lib/types/pagination.js';
 
   interface Props {
     bucket: string;
@@ -36,23 +35,7 @@
 
   const STORAGE_KEY = 'storage_page_size';
 
-  function initPageSize(): PageSize {
-    if (!browser) return 25;
-    const stored = parseInt(localStorage.getItem(STORAGE_KEY) ?? '', 10);
-    return isPageSize(stored) ? stored : 25;
-  }
-
-  let pageSize = $state<PageSize>(initPageSize());
-
-  function handlePageSizeChange(event: Event) {
-    const n = parseInt((event.target as HTMLSelectElement).value, 10);
-    if (isPageSize(n)) {
-      pageSize = n;
-      prevTokens = [];
-      if (browser) localStorage.setItem(STORAGE_KEY, String(n));
-      goFirst();
-    }
-  }
+  let pageSize = $state<PageSize>(initPageSize(STORAGE_KEY));
 
   // Clear selection on navigation
   $effect(() => {
@@ -98,9 +81,6 @@
   /* eslint-disable-next-line @typescript-eslint/no-unused-vars */
   const deleteCount = $derived(selectedFiles.length + selectedFolders.length);
 
-  const canGoPrev = $derived(prevTokens.length > 0);
-  const canGoFirst = $derived(prevTokens.length > 0 || objects.continuationToken);
-  const canGoNext = $derived(objects.hasNextPage);
   const currentPage = $derived(prevTokens.length + 1);
 
   // ── Loading state ─────────────────────────────────────────────────────────
@@ -236,64 +216,22 @@
   </div>
 
   <!-- Fixed pagination bar at bottom -->
-  <div
-    class="border-base-200/40 bg-base-100 sticky bottom-0 z-10 flex items-center justify-end gap-2 border-t px-4 py-3"
-  >
-    <label for="storage-page-size" class="text-base-content/60 mr-2 text-xs"
-      >{m.storage_page_size()}</label
-    >
-    <select
-      id="storage-page-size"
-      class="select select-xs mr-4 w-14 px-1"
-      value={pageSize}
-      onchange={handlePageSizeChange}
-    >
-      {#each ALLOWED_PAGE_SIZES as size (size)}
-        <option value={size}>{size}</option>
-      {/each}
-    </select>
-    <span class="text-base-content/60 mr-2 text-xs">{`${m.storage_page()} ${currentPage}`}</span>
-    <button
-      class="btn btn-ghost btn-sm"
-      onclick={goFirst}
-      disabled={!canGoFirst}
-      aria-label={m.storage_first_page()}
-      title={m.storage_first_page()}
-    >
-      <Icon
-        icon="material-symbols:first-page"
-        class={'size-4 ' + (canGoFirst ? '' : 'opacity-40')}
-        aria-hidden="true"
-      />
-    </button>
-
-    <button
-      class="btn btn-ghost btn-sm"
-      onclick={goPrev}
-      disabled={!canGoPrev}
-      aria-label={m.storage_previous_page()}
-      title={m.storage_previous_page()}
-    >
-      <Icon
-        icon="material-symbols:chevron-left"
-        class={'size-4 ' + (canGoPrev ? '' : 'opacity-40')}
-        aria-hidden="true"
-      />
-    </button>
-
-    <button
-      class="btn btn-primary btn-sm"
-      onclick={() => handlePageNavigate(objects.nextContinuationToken ?? null)}
-      disabled={!canGoNext}
-      aria-label={m.storage_next_page()}
-      title={m.storage_next_page()}
-    >
-      <Icon
-        icon="material-symbols:chevron-right"
-        class={'size-4 ' + (canGoNext ? '' : 'opacity-40')}
-        aria-hidden="true"
-      />
-    </button>
+  <div class="border-base-200/40 bg-base-100 sticky bottom-0 z-10 border-t px-4 py-3">
+    <Pagination
+      bind:pageSize
+      storageKey="storage_page_size"
+      pageSizeLabel={m.storage_page_size()}
+      infoLabel="{m.storage_page()} {currentPage}"
+      current={prevTokens.length}
+      hasNext={objects.hasNextPage}
+      onfirst={goFirst}
+      onprev={goPrev}
+      onnext={() => handlePageNavigate(objects.nextContinuationToken ?? null)}
+      onpagesizechange={() => {
+        prevTokens = [];
+        goFirst();
+      }}
+    />
   </div>
 </div>
 
diff --git a/src/lib/components/trino/StatementResult.svelte b/src/lib/components/trino/StatementResult.svelte
index 94c12f9a..ec9f2838 100644
--- a/src/lib/components/trino/StatementResult.svelte
+++ b/src/lib/components/trino/StatementResult.svelte
@@ -2,7 +2,8 @@
   import { browser } from '$app/environment';
   import * as m from '$lib/paraglide/messages.js';
   import type { QuerySnapshot } from '$lib/types/query';
-  import { ALLOWED_PAGE_SIZES, isPageSize, type PageSize } from '$lib/types/pagination.js';
+  import { initPageSize, type PageSize } from '$lib/types/pagination.js';
+  import Pagination from '$lib/components/Pagination.svelte';
 
   const STORAGE_KEY = 'trino_page_size';
 
@@ -20,24 +21,7 @@
 
   let collapsed = $state(false);
   let currentPage = $state(0);
-  let pageSize = $state<PageSize>(initPageSize());
-
-  function initPageSize(): PageSize {
-    if (!browser) return 25;
-    const stored = parseInt(localStorage.getItem(STORAGE_KEY) ?? '', 10);
-    return isPageSize(stored) ? stored : 25;
-  }
-
-  function handlePageSizeChange(event: Event) {
-    const n = parseInt((event.target as HTMLSelectElement).value, 10);
-    if (isPageSize(n)) {
-      pageSize = n;
-      currentPage = 0;
-      if (browser && totalStatements === 1) {
-        localStorage.setItem(STORAGE_KEY, String(n));
-      }
-    }
-  }
+  let pageSize = $state<PageSize>(initPageSize(STORAGE_KEY));
 
   const totalRows = $derived(result.rows.length);
   const displayedRows = $derived(
@@ -281,72 +265,21 @@
       {#if rowLimitWarning}
         <span class="text-warning mt-1 block text-xs">{rowLimitWarning}</span>
       {/if}
-      <div class="flex items-center justify-between pt-2">
-        <div class="flex items-center gap-4">
-          {#if totalPages > 1}
-            <nav class="join" aria-label={m.trino_results_label()}>
-              <button
-                class="btn join-item btn-xs"
-                disabled={currentPage === 0}
-                onclick={() => (currentPage = 0)}
-                aria-label={m.trino_first_page()}
-              >
-                &#171;
-              </button>
-              <button
-                class="btn join-item btn-xs"
-                disabled={currentPage === 0}
-                onclick={() => (currentPage = Math.max(0, currentPage - 1))}
-                aria-label={m.trino_prev_page()}
-              >
-                &#8249;
-              </button>
-              <button
-                class="btn join-item btn-xs"
-                disabled={currentPage === lastPage}
-                onclick={() => (currentPage = Math.min(lastPage, currentPage + 1))}
-                aria-label={m.trino_next_page()}
-              >
-                &#8250;
-              </button>
-              <button
-                class="btn join-item btn-xs"
-                disabled={currentPage === lastPage}
-                onclick={() => (currentPage = lastPage)}
-                aria-label={m.trino_last_page()}
-              >
-                &#187;
-              </button>
-            </nav>
-          {/if}
-          <span class="text-base-content/60 text-xs">
-            {m.trino_rows_range({
-              start: rowStart,
-              end: rowEnd,
-              total: totalRows
-            })}
-          </span>
-        </div>
-        <div class="flex items-center gap-2">
-          <label
-            for="{uid}-page-size"
-            class="
-            text-base-content/60 text-xs whitespace-nowrap
-          "
-          >
-            {m.trino_page_size()}
-          </label>
-          <select
-            id="{uid}-page-size"
-            class="select select-xs"
-            value={pageSize}
-            onchange={handlePageSizeChange}
-          >
-            {#each ALLOWED_PAGE_SIZES as size (size)}
-              <option value={size}>{size}</option>
-            {/each}
-          </select>
-        </div>
+      <div class="pt-2">
+        <Pagination
+          bind:pageSize
+          storageKey={STORAGE_KEY}
+          pageSizeLabel={m.trino_page_size()}
+          infoLabel={m.trino_rows_range({ start: rowStart, end: rowEnd, total: totalRows })}
+          current={currentPage}
+          total={totalPages}
+          onfirst={() => (currentPage = 0)}
+          onprev={() => (currentPage = Math.max(0, currentPage - 1))}
+          onnext={() => (currentPage = Math.min(lastPage, currentPage + 1))}
+          onlast={() => (currentPage = lastPage)}
+          onpagesizechange={() => (currentPage = 0)}
+          pageSizeRight={true}
+        />
       </div>
     {:else if result.state === 'FINISHED' && result.columns.length === 0}
       <p class="text-base-content/40 py-2 text-sm">{m.trino_results_empty()}</p>
diff --git a/src/lib/types/pagination.ts b/src/lib/types/pagination.ts
index 555f7ec6..618c42dc 100644
--- a/src/lib/types/pagination.ts
+++ b/src/lib/types/pagination.ts
@@ -1,6 +1,14 @@
+import { browser } from '$app/environment';
+
 export const ALLOWED_PAGE_SIZES = [25, 50, 100] as const;
 export type PageSize = (typeof ALLOWED_PAGE_SIZES)[number];
 
 export function isPageSize(n: number): n is PageSize {
   return (ALLOWED_PAGE_SIZES as readonly number[]).includes(n);
 }
+
+export function initPageSize(storageKey: string): PageSize {
+  if (!browser) return 25;
+  const stored = parseInt(localStorage.getItem(storageKey) ?? '', 10);
+  return isPageSize(stored) ? stored : 25;
+}

From 21bb0f2caf7b915dd2fd0f49a13fd8e64aeae5cf Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 11 May 2026 14:37:46 +0200
Subject: [PATCH 024/136] #93 S3 File Browser: Document Preview (#113)

* #93 add modal preview for file display

* #93 fix broken e2e tests

* #93 add preview for parquet files, fix scrollbar visibility in preview, allow ms excel csv data for preview

* #93 improve parquet row fetch handling

* #93 fix lint

* #93 move preview endpoint logic into separate files

* #93 disable parquet preview
---
 .env.test                                     |   1 +
 e2e/document-preview.spec.ts                  | 262 +++++++++++++
 e2e/start-mock-s3.ts                          | 220 +++++++++++
 messages/de.json                              |  19 +-
 messages/en.json                              |  19 +-
 package-lock.json                             |  26 ++
 package.json                                  |   2 +
 playwright.config.ts                          |  43 +--
 src/app.css                                   |  29 ++
 .../components/storage/FileExplorer.svelte    |  20 +-
 src/lib/components/storage/ObjectTable.svelte |   8 +-
 .../components/storage/PreviewModal.svelte    | 343 ++++++++++++++++++
 .../storage/preview/CsvPreview.svelte         |  83 +++++
 .../storage/preview/FallbackPreview.svelte    |  37 ++
 .../storage/preview/ImagePreview.svelte       |  32 ++
 .../storage/preview/PdfPreview.svelte         |  18 +
 .../storage/preview/TextPreview.svelte        |  40 ++
 src/lib/server/storage/hdfs-provider.ts       |   4 +
 src/lib/server/storage/preview/binary.ts      |  35 ++
 src/lib/server/storage/preview/parquet.ts     | 196 ++++++++++
 src/lib/server/storage/preview/stream.ts      |  57 +++
 src/lib/server/storage/provider.ts            |   5 +
 src/lib/server/storage/s3-provider.ts         |  11 +
 .../(app)/storage/api/preview/+server.ts      |  88 +++++
 24 files changed, 1553 insertions(+), 45 deletions(-)
 create mode 100644 e2e/document-preview.spec.ts
 create mode 100644 e2e/start-mock-s3.ts
 create mode 100644 src/lib/components/storage/PreviewModal.svelte
 create mode 100644 src/lib/components/storage/preview/CsvPreview.svelte
 create mode 100644 src/lib/components/storage/preview/FallbackPreview.svelte
 create mode 100644 src/lib/components/storage/preview/ImagePreview.svelte
 create mode 100644 src/lib/components/storage/preview/PdfPreview.svelte
 create mode 100644 src/lib/components/storage/preview/TextPreview.svelte
 create mode 100644 src/lib/server/storage/preview/binary.ts
 create mode 100644 src/lib/server/storage/preview/parquet.ts
 create mode 100644 src/lib/server/storage/preview/stream.ts
 create mode 100644 src/routes/(app)/storage/api/preview/+server.ts

diff --git a/.env.test b/.env.test
index adc891e2..786a7210 100644
--- a/.env.test
+++ b/.env.test
@@ -4,4 +4,5 @@ STACKABLE_UI_OIDC_DISCOVERY_URL=http://localhost:9090/.well-known/openid-configu
 STACKABLE_UI_SESSION_SECRET=e2e-test-session-secret-that-is-long-enough
 STACKABLE_UI_BASE_URL=http://localhost:4173
 STACKABLE_UI_TRINO_URL=http://localhost:8080
+STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
 ORIGIN=http://localhost:4173
diff --git a/e2e/document-preview.spec.ts b/e2e/document-preview.spec.ts
new file mode 100644
index 00000000..27d772a2
--- /dev/null
+++ b/e2e/document-preview.spec.ts
@@ -0,0 +1,262 @@
+/**
+ * E2E tests for the document (file) preview feature in the S3 file browser.
+ *
+ * These tests use the mock S3 server (start-mock-s3.ts) which listens on
+ * port 9191 and serves a set of fixture objects in the "test-bucket" bucket.
+ *
+ * Test flow per test:
+ *   1. Navigate to /storage and fill-in + submit the connect form to
+ *      establish a server-side session pointing at the mock S3.
+ *   2. Navigate to the test-bucket listing.
+ *   3. Click "Preview" on a file object.
+ *   4. Assert the preview modal contents.
+ */
+
+import { test, expect, type Page } from '@playwright/test';
+import { waitForHydration } from './helpers';
+
+const MOCK_S3_ENDPOINT = 'http://localhost:9191';
+const BUCKET = 'test-bucket';
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+/** Connect to the mock S3 server by submitting the connect form on /storage. */
+async function connectToMockS3(page: Page) {
+  await page.goto('/storage');
+  await waitForHydration(page);
+
+  // Ensure the connect form is visible (not already connected)
+  const typeSelect = page.getByLabel('Backend type');
+  if (!(await typeSelect.isVisible())) {
+    // Already connected — disconnect first so we can re-connect with the right endpoint
+    await page.getByRole('button', { name: 'Disconnect' }).click();
+    await page.waitForURL('**/storage');
+    await waitForHydration(page);
+  }
+
+  await typeSelect.selectOption('s3');
+  await page.getByLabel('Endpoint URL').fill(MOCK_S3_ENDPOINT);
+  await page.getByLabel('Region').fill('us-east-1');
+  await page.getByLabel('Access key ID').fill('test-access-key');
+  await page.getByLabel('Secret access key').fill('test-secret-key');
+  await page.getByRole('button', { name: 'Connect' }).click();
+
+  // After successful connect, the page redirects back to /storage and shows the bucket grid
+  await page.waitForURL('**/storage');
+  await expect(page.getByText(BUCKET).first()).toBeVisible();
+}
+
+/** Navigate to the test-bucket listing and return when files are visible. */
+async function navigateToBucket(page: Page) {
+  await page.goto(`/storage/${BUCKET}`);
+  await waitForHydration(page);
+  // Wait for the file table to be rendered
+  await expect(page.getByRole('table')).toBeVisible();
+}
+
+/** Click the Preview action for a given filename (single-click to select, then toolbar button). */
+async function clickPreview(page: Page, filename: string) {
+  // Click the file row to select it
+  await page.getByRole('row', { name: new RegExp(filename, 'i') }).click();
+  // Click the Preview button in the selection toolbar
+  await page.getByRole('button', { name: 'Preview' }).first().click();
+}
+
+/** Click the Preview action from the context menu for a given filename. */
+async function rightClickPreview(page: Page, filename: string) {
+  await page.getByRole('row', { name: new RegExp(filename, 'i') }).click({ button: 'right' });
+  await page.getByRole('menuitem', { name: 'Preview' }).click();
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+test.describe('Document preview', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(async ({ page }) => {
+    await connectToMockS3(page);
+    await navigateToBucket(page);
+  });
+
+  test('preview modal opens for a text file and shows content', async ({ page }) => {
+    await clickPreview(page, 'hello.txt');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+
+    // Header shows filename
+    await expect(dialog.getByRole('heading', { name: 'hello.txt' })).toBeVisible();
+
+    // Content is rendered as text
+    await expect(dialog.locator('pre')).toContainText('Hello, World!');
+
+    // Close button works
+    await dialog.getByRole('button', { name: 'Close' }).last().click();
+    await expect(dialog).not.toBeVisible();
+  });
+
+  test('preview modal shows JSON with pretty-printing', async ({ page }) => {
+    await clickPreview(page, 'data.json');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+
+    await expect(dialog.getByRole('heading', { name: 'data.json' })).toBeVisible();
+    // JSON is pretty-printed
+    await expect(dialog.locator('pre')).toContainText('"name"');
+    await expect(dialog.locator('pre')).toContainText('"Alice"');
+  });
+
+  test('preview modal renders CSV as a table', async ({ page }) => {
+    await clickPreview(page, 'data.csv');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+
+    await expect(dialog.getByRole('heading', { name: 'data.csv' })).toBeVisible();
+
+    // CSV header row
+    const table = dialog.getByRole('table', { name: 'CSV preview' });
+    await expect(table).toBeVisible();
+    await expect(table.getByRole('columnheader', { name: 'id' })).toBeVisible();
+    await expect(table.getByRole('columnheader', { name: 'name' })).toBeVisible();
+    await expect(table.getByRole('columnheader', { name: 'role' })).toBeVisible();
+
+    // Data rows
+    await expect(table.getByRole('cell', { name: 'Alice' })).toBeVisible();
+    await expect(table.getByRole('cell', { name: 'Bob' })).toBeVisible();
+  });
+
+  test('preview modal renders image inline', async ({ page }) => {
+    await clickPreview(page, 'image.png');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+
+    await expect(dialog.getByRole('heading', { name: 'image.png' })).toBeVisible();
+
+    // Image is rendered
+    const img = dialog.locator('img');
+    await expect(img).toBeVisible();
+    await expect(img).toHaveAttribute('alt', /Preview of image\.png/i);
+  });
+
+  test('preview modal shows fallback for unsupported binary type', async ({ page }) => {
+    await clickPreview(page, 'archive.bin');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+
+    await expect(dialog.getByRole('heading', { name: 'archive.bin' })).toBeVisible();
+    // Binary fallback message
+    await expect(dialog.getByText('Binary content')).toBeVisible();
+
+    // Download link present
+    const downloadLink = dialog.getByRole('link', { name: 'Download full file' });
+    await expect(downloadLink).toBeVisible();
+  });
+
+  test('large text file shows truncation notice', async ({ page }) => {
+    await clickPreview(page, 'large.txt');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+
+    await expect(dialog.getByRole('heading', { name: 'large.txt' })).toBeVisible();
+
+    // Truncation notice in the subtitle
+    await expect(dialog.getByText(/Content truncated/i)).toBeVisible();
+
+    // Download full file button visible in footer
+    const downloadLink = dialog.getByRole('link', { name: 'Download full file' });
+    await expect(downloadLink).toBeVisible();
+  });
+
+  test('preview via context menu works', async ({ page }) => {
+    await rightClickPreview(page, 'hello.txt');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+    await expect(dialog.getByRole('heading', { name: 'hello.txt' })).toBeVisible();
+    await expect(dialog.locator('pre')).toContainText('Hello, World!');
+  });
+
+  test('preview modal shows error for access-denied object', async ({ page }) => {
+    // Intercept the preview API to simulate a 403 response
+    await page.route('**/storage/api/preview**', async (route) => {
+      await route.fulfill({
+        status: 403,
+        contentType: 'application/json',
+        body: JSON.stringify({ error: 'Access denied' })
+      });
+    });
+
+    await clickPreview(page, 'hello.txt');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+    await expect(dialog.getByRole('heading', { name: 'hello.txt' })).toBeVisible();
+    // Error state is shown
+    await expect(dialog.getByText('Preview failed')).toBeVisible();
+    await expect(
+      dialog.getByText('You do not have permission to preview this file.')
+    ).toBeVisible();
+    await dialog.getByRole('button', { name: 'Close' }).last().click();
+    await expect(dialog).not.toBeVisible();
+  });
+
+  test('preview API returns 401 when not connected', async ({ page }) => {
+    // Disconnect the S3 connection via the browser UI
+    await page.goto('/storage');
+    await waitForHydration(page);
+    const disconnectBtn = page.getByRole('button', { name: 'Disconnect' });
+    if (await disconnectBtn.isVisible()) {
+      await disconnectBtn.click();
+      await page.waitForURL('**/storage');
+    }
+
+    // Use the page's authenticated session (fetch runs in the browser context
+    // with the session cookie) — the storage layer should return 401 when there
+    // is no S3 connection configured for this user.
+    const status = await page.evaluate(async (url) => {
+      const res = await fetch(url);
+      return res.status;
+    }, `/storage/api/preview?bucket=${BUCKET}&key=hello.txt`);
+    expect(status).toBe(401);
+  });
+
+  test('preview button is enabled for a single selected file', async ({ page }) => {
+    // Select one file — the Preview button in the toolbar becomes enabled
+    await page.getByRole('row', { name: /hello\.txt/i }).click();
+    const previewBtn = page.getByRole('button', { name: 'Preview' }).first();
+    await expect(previewBtn).toBeEnabled();
+    await expect(previewBtn).toBeVisible();
+  });
+
+  /* Re-enable once we have a more robust parquet preview solution in place
+  test('preview modal renders parquet file as a table', async ({ page }) => {
+    await clickPreview(page, 'data.parquet');
+
+    const dialog = page.locator('dialog[open]');
+    await expect(dialog).toBeVisible();
+
+    await expect(dialog.getByRole('heading', { name: 'data.parquet' })).toBeVisible();
+
+    // Parquet is rendered as a CSV-style table
+    const table = dialog.getByRole('table', { name: 'CSV preview' });
+    await expect(table).toBeVisible();
+
+    // Column headers from the parquet schema
+    await expect(table.getByRole('columnheader', { name: 'id' })).toBeVisible();
+    await expect(table.getByRole('columnheader', { name: 'name' })).toBeVisible();
+    await expect(table.getByRole('columnheader', { name: 'role' })).toBeVisible();
+
+    // Data rows
+    await expect(table.getByRole('cell', { name: 'Alice' })).toBeVisible();
+    await expect(table.getByRole('cell', { name: 'Bob' })).toBeVisible();
+
+    // File size is shown in the header subtitle
+    await expect(dialog.locator('p').filter({ hasText: /B/ })).toBeVisible();
+  });
+  */
+});
diff --git a/e2e/start-mock-s3.ts b/e2e/start-mock-s3.ts
new file mode 100644
index 00000000..f6277dad
--- /dev/null
+++ b/e2e/start-mock-s3.ts
@@ -0,0 +1,220 @@
+/**
+ * Minimal S3-compatible mock server for E2E tests.
+ *
+ * Handles the subset of the S3 API that the storage provider uses:
+ *   - ListBuckets    (GET /)
+ *   - ListObjectsV2  (GET /<bucket>?list-type=2&...)
+ *   - HeadObject     (HEAD /<bucket>/<key>)
+ *   - GetObject      (GET  /<bucket>/<key>  — supports Range header)
+ *
+ * All operations use path-style addressing (forcePathStyle=true in the SDK).
+ */
+
+import * as http from 'node:http';
+
+const PORT = 9191;
+const BUCKET = 'test-bucket';
+
+// ── Static file fixtures ───────────────────────────────────────────────────
+
+interface Fixture {
+  contentType: string;
+  content: Buffer;
+}
+
+const TEXT_CONTENT = Buffer.from('Hello, World!\nThis is a preview test file.', 'utf-8');
+const JSON_CONTENT = Buffer.from(
+  JSON.stringify({ name: 'Alice', role: 'engineer', team: 'data' }, null, 2),
+  'utf-8'
+);
+const CSV_CONTENT = Buffer.from(
+  ['id,name,role', '1,Alice,engineer', '2,Bob,analyst', '3,Carol,manager'].join('\n'),
+  'utf-8'
+);
+// Minimal 1×1 red PNG (68 bytes)
+const PNG_CONTENT = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwADhQGAWjR9awAAAABJRU5ErkJggg==',
+  'base64'
+);
+// Fake gzip header (non-UTF-8, binary)
+const BINARY_CONTENT = Buffer.from([0x1f, 0x8b, 0x08, 0x00, 0xde, 0xad, 0xbe, 0xef]);
+
+// Minimal GZIP-compressed parquet file: 5 rows × 3 columns (id, name, role).
+// Generated with pyarrow, write_page_index=True so OffsetIndex is present.
+// This is used to test the parquet preview flow end-to-end without a real S3.
+const PARQUET_CONTENT = Buffer.from(
+  'UEFSMRUEFSgVREwVChUAEgAAH4sIAAAAAAACA2NkYGBgAmJmIGYBYlYgBgCQqRgpFAAAABUAFRYVPiwV' +
+    'ChUQFQYVBgAAH4sIAAAAAAACA2NiYGDgYmRm7nBjAABD89dACwAAABUEFVAVakwVChUAEgAAH4sIAAAA' +
+    'AAACA2NlYGBwzMlMTmUGMpzyk1iBlHNiUX4OC5DhklgGFnctSwUASeUo8CgAAAAVABUWFT4sFQoVEBUG' +
+    'FQYAAB+LCAAAAAAAAgNjYmBg4GJkZu5wYwAAQ/PXQAsAAAAVBBVEFWJMFQYVABIAAB+LCAAAAAAAAgPj' +
+    'YGBgSM1Lz8xLTS1iB7IT8xJzKotLQMxcIDs9tQgA05P9siIAAAAVABUUFTwsFQoVEBUGFQYAAB+LCAAA' +
+    'AAAAAgNjYmBg4GJkYlZhBAB/FSRVCgAAABkRAhkYBAEAAAAZGAQFAAAAFQIZFgApJgAKABkRAhkYBUFs' +
+    'aWNlGRgDRXZlFQIZFgApJgAKABkRAhkYB2FuYWx5c3QZGAdtYW5hZ2VyFQIZFgApJgAKABkcFmgVYBYA' +
+    'AAAZHBbOAhVgFgAAGRYoABkcFqwEFV4WAAAZFkoAFQQZTDUAGAZzY2hlbWEVBgAVAiUCGAJpZAAVDCUC' +
+    'GARuYW1lJQBMHAAAABUMJQIYBHJvbGUlAEwcAAAAFgoZHBk8JgAcFQIZNQAGEBkYAmlkFQQWChZ8FsAB' +
+    'JmgmCBwYBAUAAAAYBAEAAAAWACgEBQAAABgEAQAAABERABksFQQVABUCABUAFRAVAgA8KQYZJgAKAAAW' +
+    'uAYVFBaKBRU2ACYAHBUMGTUABhAZGARuYW1lFQQWChakARbmASbOAibIARw2ACgDRXZlGAVBbGljZRER' +
+    'ABksFQQVABUCABUAFRAVAgA8FigZBhkmAAoAABbMBhUcFsAFFTYAJgAcFQwZNQAGEBkYBHJvbGUVBBYK' +
+    'FpYBFtwBJqwEJq4DHDYAKAdtYW5hZ2VyGAdhbmFseXN0EREAGSwVBBUAFQIAFQAVEBUCADwWShkGGSYA' +
+    'CgAAFugGFRwW9gUVQgAWtgMWCiYIFoIFABkcGAxBUlJPVzpzY2hlbWEYrAIvLy8vLzlnQUFBQVFBQUFB' +
+    'QUFBS0FBd0FCZ0FGQUFnQUNnQUFBQUFCQkFBTUFBQUFDQUFJQUFBQUJBQUlBQUFBQkFBQUFBTUFBQUJ3' +
+    'QUFBQU1BQUFBQVFBQUFDcy8vLy9BQUFCQlJBQUFBQVlBQUFBQkFBQUFBQUFBQUFFQUFBQWNtOXNaUUFB' +
+    'QUFEWS8vLy8xUC8vL3dBQUFRVVFBQUFBSEFBQUFBUUFBQUFBQUFBQUJBQUFBRzVoYldVQUFBQUFCQUFF' +
+    'QUFRQUFBQVFBQlFBQ0FBR0FBY0FEQUFBQUJBQUVBQUFBQUFBQVFJUUFBQUFIQUFBQUFRQUFBQUFBQUFB' +
+    'QWdBQUFHbGtBQUFJQUF3QUNBQUhBQWdBQUFBQUFBQUJJQUFBQUFBQUFBQT0AGCBwYXJxdWV0LWNwcC1h' +
+    'cnJvdyB2ZXJzaW9uIDI0LjAuMBk8HAAAHAAAHAAAANECAABQQVIx',
+  'base64'
+);
+
+const FIXTURES: Record<string, Fixture> = {
+  'hello.txt': { contentType: 'text/plain', content: TEXT_CONTENT },
+  'data.json': { contentType: 'application/json', content: JSON_CONTENT },
+  'data.csv': { contentType: 'text/csv', content: CSV_CONTENT },
+  'image.png': { contentType: 'image/png', content: PNG_CONTENT },
+  'archive.bin': { contentType: 'application/octet-stream', content: BINARY_CONTENT },
+  'data.parquet': {
+    contentType: 'application/vnd.apache.parquet',
+    content: PARQUET_CONTENT
+  },
+  // Large text file (> 256 KiB) — used to test truncation
+  'large.txt': {
+    contentType: 'text/plain',
+    content: Buffer.from('A'.repeat(300 * 1024), 'utf-8')
+  }
+};
+
+// ── XML helpers ────────────────────────────────────────────────────────────
+
+function listBucketsXml(): string {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<ListAllMyBucketsResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Owner><ID>test-owner</ID><DisplayName>test</DisplayName></Owner>
+  <Buckets>
+    <Bucket>
+      <Name>${BUCKET}</Name>
+      <CreationDate>2026-01-01T00:00:00.000Z</CreationDate>
+    </Bucket>
+  </Buckets>
+</ListAllMyBucketsResult>`;
+}
+
+function listObjectsXml(prefix: string): string {
+  const entries = Object.entries(FIXTURES)
+    .filter(([key]) => key.startsWith(prefix))
+    .map(
+      ([key, f]) => `
+  <Contents>
+    <Key>${key}</Key>
+    <Size>${f.content.length}</Size>
+    <LastModified>2026-01-01T00:00:00.000Z</LastModified>
+    <ETag>"test-etag-${key}"</ETag>
+    <StorageClass>STANDARD</StorageClass>
+  </Contents>`
+    )
+    .join('');
+
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+  <Name>${BUCKET}</Name>
+  <Prefix>${prefix}</Prefix>
+  <Delimiter>/</Delimiter>
+  <MaxKeys>100</MaxKeys>
+  <IsTruncated>false</IsTruncated>
+  ${entries}
+</ListBucketResult>`;
+}
+
+function errorXml(code: string, message: string): string {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<Error>
+  <Code>${code}</Code>
+  <Message>${message}</Message>
+</Error>`;
+}
+
+// ── Request handler ────────────────────────────────────────────────────────
+
+http
+  .createServer((req, res) => {
+    const url = new URL(req.url ?? '/', `http://localhost:${PORT}`);
+    const pathParts = url.pathname.slice(1).split('/');
+    const bucket = pathParts[0];
+    const key = pathParts.slice(1).join('/');
+
+    // ListBuckets: GET /
+    if (req.method === 'GET' && !bucket) {
+      res.writeHead(200, { 'Content-Type': 'application/xml' });
+      res.end(listBucketsXml());
+      return;
+    }
+
+    // ListObjectsV2: GET /<bucket>?list-type=2
+    if (req.method === 'GET' && bucket === BUCKET && !key && url.searchParams.has('list-type')) {
+      const prefix = url.searchParams.get('prefix') ?? '';
+      res.writeHead(200, { 'Content-Type': 'application/xml' });
+      res.end(listObjectsXml(prefix));
+      return;
+    }
+
+    // HeadObject / GetObject: HEAD or GET /<bucket>/<key>
+    if ((req.method === 'HEAD' || req.method === 'GET') && bucket === BUCKET && key) {
+      // Simulate 403 for a specific test key
+      if (key === 'no-access.txt') {
+        res.writeHead(403, { 'Content-Type': 'application/xml' });
+        res.end(errorXml('AccessDenied', 'Access Denied'));
+        return;
+      }
+
+      const fixture = FIXTURES[key];
+      if (!fixture) {
+        res.writeHead(404, { 'Content-Type': 'application/xml' });
+        res.end(errorXml('NoSuchKey', 'The specified key does not exist.'));
+        return;
+      }
+
+      // Parse Range header
+      const rangeHeader = req.headers['range'];
+      if (rangeHeader && req.method === 'GET') {
+        const match = /^bytes=(\d+)-(\d+)$/.exec(rangeHeader);
+        if (match) {
+          const start = parseInt(match[1], 10);
+          const end = Math.min(parseInt(match[2], 10), fixture.content.length - 1);
+          const chunk = fixture.content.slice(start, end + 1);
+          res.writeHead(206, {
+            'Content-Type': fixture.contentType,
+            'Content-Length': String(chunk.length),
+            'Content-Range': `bytes ${start}-${end}/${fixture.content.length}`,
+            'Accept-Ranges': 'bytes'
+          });
+          res.end(chunk);
+          return;
+        }
+      }
+
+      if (req.method === 'HEAD') {
+        res.writeHead(200, {
+          'Content-Type': fixture.contentType,
+          'Content-Length': String(fixture.content.length),
+          'Last-Modified': 'Wed, 01 Jan 2026 00:00:00 GMT',
+          ETag: `"test-etag-${key}"`
+        });
+        res.end();
+        return;
+      }
+
+      // Full GET
+      res.writeHead(200, {
+        'Content-Type': fixture.contentType,
+        'Content-Length': String(fixture.content.length),
+        'Last-Modified': 'Wed, 01 Jan 2026 00:00:00 GMT',
+        ETag: `"test-etag-${key}"`
+      });
+      res.end(fixture.content);
+      return;
+    }
+
+    // Fallback
+    res.writeHead(404, { 'Content-Type': 'application/xml' });
+    res.end(errorXml('NoSuchBucket', 'The specified bucket does not exist.'));
+  })
+  .listen(PORT, 'localhost', () => console.log(`Mock S3 on :${PORT}`));
diff --git a/messages/de.json b/messages/de.json
index 424f8bee..77721278 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -174,5 +174,22 @@
   "pagination_prev_page": "Vorherige Seite",
   "pagination_next_page": "Nächste Seite",
   "pagination_last_page": "Letzte Seite",
-  "pagination_nav": "Seitennavigation"
+  "pagination_nav": "Seitennavigation",
+  "storage_preview_loading": "Vorschau wird geladen…",
+  "storage_preview_truncated": "Inhalt abgeschnitten — erste {size} werden angezeigt.",
+  "storage_preview_download_full": "Vollständige Datei herunterladen",
+  "storage_preview_fetch_more": "Mehr laden",
+  "storage_preview_close": "Schließen",
+  "storage_preview_unsupported_title": "Vorschau nicht verfügbar",
+  "storage_preview_unsupported_desc": "Dieser Dateityp kann nicht inline angezeigt werden.",
+  "storage_preview_binary_title": "Binäre Inhalte",
+  "storage_preview_binary_desc": "Diese Datei scheint binäre Daten zu enthalten und kann nicht als Text angezeigt werden.",
+  "storage_preview_error_title": "Vorschau fehlgeschlagen",
+  "storage_preview_error_desc": "Beim Laden der Vorschau ist ein Fehler aufgetreten.",
+  "storage_preview_access_denied": "Sie haben keine Berechtigung, diese Datei in der Vorschau anzuzeigen.",
+  "storage_preview_not_found": "Die Datei konnte nicht gefunden werden.",
+  "storage_preview_image_alt": "Vorschau von {name}",
+  "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
+  "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
+  "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau."
 }
diff --git a/messages/en.json b/messages/en.json
index f524fa92..28268cff 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -174,5 +174,22 @@
   "pagination_prev_page": "Previous page",
   "pagination_next_page": "Next page",
   "pagination_last_page": "Last page",
-  "pagination_nav": "Pagination"
+  "pagination_nav": "Pagination",
+  "storage_preview_loading": "Loading preview…",
+  "storage_preview_truncated": "Content truncated — showing first {size}.",
+  "storage_preview_download_full": "Download full file",
+  "storage_preview_fetch_more": "Fetch more",
+  "storage_preview_close": "Close",
+  "storage_preview_unsupported_title": "Preview unavailable",
+  "storage_preview_unsupported_desc": "This file type cannot be previewed inline.",
+  "storage_preview_binary_title": "Binary content",
+  "storage_preview_binary_desc": "This file appears to contain binary data and cannot be displayed as text.",
+  "storage_preview_error_title": "Preview failed",
+  "storage_preview_error_desc": "An error occurred while loading the preview.",
+  "storage_preview_access_denied": "You do not have permission to preview this file.",
+  "storage_preview_not_found": "The file could not be found.",
+  "storage_preview_image_alt": "Preview of {name}",
+  "storage_preview_csv_rows": "Showing first {count} rows",
+  "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
+  "storage_preview_pdf_too_large": "PDF is too large to preview inline."
 }
diff --git a/package-lock.json b/package-lock.json
index 924a636a..70e67b31 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,6 +14,8 @@
         "antlr4-c3": "^3.4.4",
         "antlr4ng": "^3.0.16",
         "better-auth": "^1.5.4",
+        "hyparquet": "^1.25.8",
+        "hyparquet-compressors": "^1.1.1",
         "monaco-editor": "^0.55.1",
         "pino": "^10.3.1",
         "pretty-bytes": "^7.1.0",
@@ -7074,6 +7076,11 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/fzstd": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/fzstd/-/fzstd-0.1.1.tgz",
+      "integrity": "sha512-dkuVSOKKwh3eas5VkJy1AW1vFpet8TA/fGmVA5krThl8YcOVE/8ZIoEA1+U1vEn5ckxxhLirSdY837azmbaNHA=="
+    },
     "node_modules/generate-function": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
@@ -7428,6 +7435,25 @@
         "human-id": "dist/cli.js"
       }
     },
+    "node_modules/hyparquet": {
+      "version": "1.25.8",
+      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.25.8.tgz",
+      "integrity": "sha512-KYRKZCHBgEY9FOuqTe9m+zdrKBcTo9ZcaIUqG7SdZygv5hwrGD3C6wuTrGt07cbEkgO71UIih+KbojLKf3ENbg=="
+    },
+    "node_modules/hyparquet-compressors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/hyparquet-compressors/-/hyparquet-compressors-1.1.1.tgz",
+      "integrity": "sha512-yx7aA3Rhj0YycbdV71+XznQSLAefa4cT0urpgNXy4aM6eSeCknaVDNne8y45Uz74Fb15yyXUzOStlceOJBan7A==",
+      "dependencies": {
+        "fzstd": "0.1.1",
+        "hysnappy": "1.0.0"
+      }
+    },
+    "node_modules/hysnappy": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/hysnappy/-/hysnappy-1.0.0.tgz",
+      "integrity": "sha512-MNrC4NfwDGPb889O6gIfEtbvEZCSWUsSEhsz4Oq2FRcpGtXHfeVz3KciSPp5Pnnz1NjFMgDQNfxdJozymJEDDA=="
+    },
     "node_modules/iconv-lite": {
       "version": "0.7.2",
       "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
diff --git a/package.json b/package.json
index 8d995cc0..97f56c28 100644
--- a/package.json
+++ b/package.json
@@ -62,6 +62,8 @@
     "antlr4-c3": "^3.4.4",
     "antlr4ng": "^3.0.16",
     "better-auth": "^1.5.4",
+    "hyparquet": "^1.25.8",
+    "hyparquet-compressors": "^1.1.1",
     "monaco-editor": "^0.55.1",
     "pino": "^10.3.1",
     "pretty-bytes": "^7.1.0",
diff --git a/playwright.config.ts b/playwright.config.ts
index d0e6813d..bb12bf99 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -22,17 +22,22 @@ export default defineConfig({
     {
       command: 'npx tsx e2e/start-mock-oidc.ts',
       url: 'http://localhost:9090/.well-known/openid-configuration',
-      reuseExistingServer: false
+      reuseExistingServer: true
     },
     {
       command: 'npx tsx e2e/start-mock-trino.ts',
       url: 'http://localhost:8080',
-      reuseExistingServer: false
+      reuseExistingServer: true
+    },
+    {
+      command: 'npx tsx e2e/start-mock-s3.ts',
+      url: 'http://localhost:9191',
+      reuseExistingServer: true
     },
     {
       command: 'PORT=4173 node --env-file=.env.test build',
       url: baseURL,
-      reuseExistingServer: false
+      reuseExistingServer: true
     }
   ],
   projects: [
@@ -55,18 +60,6 @@ export default defineConfig({
         viewport: { width: 1280, height: 720 }
       }
     },
-    ...(!process.env.CI
-      ? [
-          {
-            name: 'setup-mobile',
-            testMatch: /auth\.setup\.ts/,
-            use: {
-              browserName: 'chromium' as const,
-              viewport: { width: 393, height: 851 }
-            }
-          }
-        ]
-      : []),
     {
       name: 'firefox',
       use: {
@@ -85,24 +78,6 @@ export default defineConfig({
         ...(chromiumExecutablePath && { launchOptions: { executablePath: chromiumExecutablePath } })
       },
       dependencies: ['setup-chromium']
-    },
-    ...(!process.env.CI
-      ? [
-          {
-            name: 'mobile',
-            use: {
-              browserName: 'chromium' as const,
-              viewport: { width: 393, height: 851 },
-              isMobile: true,
-              hasTouch: true,
-              storageState: 'e2e/.auth/user-setup-mobile.json',
-              ...(chromiumExecutablePath && {
-                launchOptions: { executablePath: chromiumExecutablePath }
-              })
-            },
-            dependencies: ['setup-mobile']
-          }
-        ]
-      : [])
+    }
   ]
 });
diff --git a/src/app.css b/src/app.css
index 825f2044..30b34902 100644
--- a/src/app.css
+++ b/src/app.css
@@ -23,3 +23,32 @@ progress.progress::-webkit-progress-value {
 progress.progress::-moz-progress-bar {
   transition: none;
 }
+
+/*
+ * Visible scrollbars for preview panels. Uses DaisyUI semantic color variables
+ * so the thumb adapts to both light and dark themes automatically.
+ */
+.preview-scroll {
+  scrollbar-width: thin;
+  /* Use currentColor so Firefox resolves the thumb colour immediately at paint
+     time rather than deferring CSS custom-property resolution. */
+  scrollbar-color: color-mix(in oklch, currentColor 28%, transparent) transparent;
+}
+
+.preview-scroll::-webkit-scrollbar {
+  width: 8px;
+  height: 8px;
+}
+
+.preview-scroll::-webkit-scrollbar-track {
+  background: transparent;
+}
+
+.preview-scroll::-webkit-scrollbar-thumb {
+  background-color: color-mix(in oklch, currentColor 28%, transparent);
+  border-radius: 4px;
+}
+
+.preview-scroll::-webkit-scrollbar-thumb:hover {
+  background-color: color-mix(in oklch, currentColor 50%, transparent);
+}
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index cdf8a33e..eafe38eb 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -3,6 +3,7 @@
   import StorageBreadcrumb from './StorageBreadcrumb.svelte';
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
+  import PreviewModal from './PreviewModal.svelte';
   import Pagination from '$lib/components/Pagination.svelte';
   import type { StoragePage } from '$lib/storage/types.js';
   import { SvelteSet } from 'svelte/reactivity';
@@ -133,13 +134,22 @@
 
   // ── Modal state ───────────────────────────────────────────────────────────
   let showDeleteModal = $state(false);
+  let showPreviewModal = $state(false);
+  let previewKey = $state<string | null>(null);
 
   // ── Action dispatch ───────────────────────────────────────────────────────
   function handleAction(action: string) {
     switch (action) {
-      case 'preview':
-        alert(m.storage_action_preview() + ' — not implemented');
+      case 'preview': {
+        // Prefer selection; fall back to the context menu target (if it's a file, not a folder)
+        const ctxFile = ctxKey && files.find((f) => f.key === ctxKey) ? ctxKey : null;
+        const key = selectedFiles[0]?.key ?? ctxFile;
+        if (key) {
+          previewKey = key;
+          showPreviewModal = true;
+        }
         break;
+      }
       case 'rename':
         alert(m.storage_action_rename() + ' — not implemented');
         break;
@@ -241,7 +251,8 @@
     x={ctxMenu.x}
     y={ctxMenu.y}
     selectionCount={selectedKeys.size}
-    canPreview={selectedFiles.length === 1 && selectedFolders.length === 0}
+    canPreview={(selectedFiles.length === 1 && selectedFolders.length === 0) ||
+      (ctxKey !== null && files.some((f) => f.key === ctxKey))}
     canDownload={selectedFiles.length > 0}
     onaction={handleAction}
     onclose={() => {
@@ -250,3 +261,6 @@
     }}
   />
 {/if}
+
+<!-- Preview modal -->
+<PreviewModal bind:open={showPreviewModal} {bucket} objectKey={previewKey} />
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
index b1793656..b5c33d90 100644
--- a/src/lib/components/storage/ObjectTable.svelte
+++ b/src/lib/components/storage/ObjectTable.svelte
@@ -127,17 +127,13 @@
               `
               : 'hover'}"
           onclick={(e) => {
-            if (showCheckboxes || e.ctrlKey || e.metaKey) {
+            if (e.ctrlKey || e.metaKey) {
               onToggleSelect(folder.key, true);
             } else {
               onnavigate(folder.key);
             }
           }}
-          ondblclick={(e) => {
-            if (e.ctrlKey || e.metaKey) {
-              onnavigate(folder.key);
-            }
-          }}
+          ondblclick={() => onnavigate(folder.key)}
           oncontextmenu={(e) => onContextMenu(e, folder.key)}
         >
           <td class="pr-0">
diff --git a/src/lib/components/storage/PreviewModal.svelte b/src/lib/components/storage/PreviewModal.svelte
new file mode 100644
index 00000000..6a52d597
--- /dev/null
+++ b/src/lib/components/storage/PreviewModal.svelte
@@ -0,0 +1,343 @@
+<script lang="ts">
+  import { onDestroy } from 'svelte';
+  import Icon from '@iconify/svelte';
+  import prettyBytes from 'pretty-bytes';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import TextPreview from './preview/TextPreview.svelte';
+  import CsvPreview from './preview/CsvPreview.svelte';
+  import ImagePreview from './preview/ImagePreview.svelte';
+  import PdfPreview from './preview/PdfPreview.svelte';
+  import FallbackPreview from './preview/FallbackPreview.svelte';
+  import { keyToName } from '$lib/storage/utils.js';
+
+  interface Props {
+    open: boolean;
+    bucket: string;
+    objectKey: string | null;
+  }
+
+  let { open = $bindable(false), bucket, objectKey }: Props = $props();
+
+  type PreviewKind =
+    | { kind: 'idle' }
+    | { kind: 'loading' }
+    | {
+        kind: 'text';
+        text: string;
+        contentType: string;
+        truncated: boolean;
+        totalSize: number;
+        previewBytes: number;
+      }
+    | { kind: 'csv'; text: string; truncated: boolean; totalSize: number; previewBytes: number }
+    | {
+        kind: 'parquet';
+        text: string;
+        truncated: boolean;
+        totalSize: number;
+        totalRows: number;
+        previewRows: number;
+      }
+    | { kind: 'image'; blobUrl: string; contentType: string; totalSize: number }
+    | { kind: 'pdf'; blobUrl: string; totalSize: number }
+    | { kind: 'fallback'; contentType: string; isBinary: boolean }
+    | { kind: 'error'; message: string };
+
+  let preview: PreviewKind = $state({ kind: 'idle' });
+  // Not $state — the template never reads blobUrls directly, only preview.blobUrl.
+  // Keeping it non-reactive prevents a read/write cycle inside the $effect below.
+  let blobUrls: string[] = [];
+  let maximized = $state(false);
+
+  // Revoke blob URLs when the component is destroyed
+  onDestroy(() => {
+    for (const url of blobUrls) {
+      URL.revokeObjectURL(url);
+    }
+  });
+
+  function revokeBlobUrls() {
+    for (const url of blobUrls) {
+      URL.revokeObjectURL(url);
+    }
+    blobUrls = [];
+  }
+
+  // Load preview whenever the modal opens or the key changes
+  $effect(() => {
+    if (open && objectKey) {
+      void loadPreview(objectKey, bucket);
+    }
+    if (!open) {
+      revokeBlobUrls();
+      preview = { kind: 'idle' };
+    }
+  });
+
+  async function loadPreview(key: string, bkt: string) {
+    preview = { kind: 'loading' };
+    revokeBlobUrls();
+
+    try {
+      const params = new URLSearchParams({ bucket: bkt, key });
+      const res = await fetch(`/storage/api/preview?${params}`);
+
+      if (!res.ok) {
+        const errBody = await res.json().catch(() => ({}));
+        const msg =
+          res.status === 403
+            ? m.storage_preview_access_denied()
+            : res.status === 404
+              ? m.storage_preview_not_found()
+              : (errBody?.error ?? m.storage_preview_error_desc());
+        preview = { kind: 'error', message: msg };
+        return;
+      }
+
+      const contentType = (res.headers.get('Content-Type') ?? 'application/octet-stream')
+        .split(';')[0]
+        .trim();
+      const format = res.headers.get('X-Preview-Format');
+      const truncated = res.headers.get('X-Preview-Truncated') === 'true';
+      const totalSize = Number(res.headers.get('X-Preview-Total-Size') ?? '0');
+      const previewBytes = Number(res.headers.get('X-Preview-Bytes') ?? '0');
+      const totalRows = Number(res.headers.get('X-Preview-Total-Rows') ?? '0');
+      const previewRows = Number(res.headers.get('X-Preview-Preview-Rows') ?? '0');
+
+      // Server flagged this as a known-binary type — skip body fetch entirely.
+      if (res.headers.get('X-Preview-Renderable') === 'false') {
+        await res.body?.cancel();
+        preview = { kind: 'fallback', contentType, isBinary: false };
+        return;
+      }
+
+      // Images — render as blob URL
+      if (contentType.startsWith('image/')) {
+        const blob = await res.blob();
+        const url = URL.createObjectURL(blob);
+        blobUrls = [url];
+        preview = { kind: 'image', blobUrl: url, contentType, totalSize };
+        return;
+      }
+
+      // PDF — render in iframe
+      if (contentType === 'application/pdf') {
+        const blob = await res.blob();
+        const url = URL.createObjectURL(blob);
+        blobUrls = [url];
+        preview = { kind: 'pdf', blobUrl: url, totalSize };
+        return;
+      }
+
+      // For everything else (text/*, application/json, application/octet-stream,
+      // application/yaml, etc.) attempt UTF-8 decode. Success → text view;
+      // failure → the file is genuinely binary.
+      const text = await readTextSafely(res, key);
+      if (text === null) {
+        preview = { kind: 'fallback', contentType, isBinary: true };
+        return;
+      }
+
+      // Parquet data pre-parsed by the server and returned as CSV text.
+      if (format === 'parquet') {
+        preview = { kind: 'parquet', text, truncated, totalSize, totalRows, previewRows };
+        return;
+      }
+
+      // CSV by content-type or file extension
+      if (
+        contentType === 'text/csv' ||
+        contentType === 'application/csv' ||
+        contentType === 'application/vnd.ms-excel' ||
+        key.toLowerCase().endsWith('.csv')
+      ) {
+        preview = { kind: 'csv', text, truncated, totalSize, previewBytes };
+        return;
+      }
+
+      // All other decoded text
+      preview = { kind: 'text', text, contentType, truncated, totalSize, previewBytes };
+    } catch {
+      preview = { kind: 'error', message: m.storage_preview_error_desc() };
+    }
+  }
+
+  /**
+   * Read response body as text. Handles UTF-16 BOMs, strict UTF-8, and falls
+   * back to Windows-1252 for CSV/TSV files (common for Excel-exported CSVs).
+   * Returns null if the content cannot be decoded as any recognised encoding
+   * (indicating genuinely binary content).
+   */
+  async function readTextSafely(res: Response, key: string): Promise<string | null> {
+    try {
+      const buf = await res.arrayBuffer();
+      const bytes = new Uint8Array(buf);
+
+      // Detect UTF-16 BOM (common in Excel "Save as CSV (UTF-16)")
+      if (bytes.length >= 2) {
+        if (bytes[0] === 0xff && bytes[1] === 0xfe) {
+          return new TextDecoder('utf-16le').decode(buf);
+        }
+        if (bytes[0] === 0xfe && bytes[1] === 0xff) {
+          return new TextDecoder('utf-16be').decode(buf);
+        }
+      }
+
+      // Try strict UTF-8 (handles UTF-8 with or without BOM)
+      try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(buf);
+      } catch {
+        // For CSV/TSV files try Windows-1252 — the default encoding used by
+        // Excel on Windows when exporting to CSV.
+        const lowerKey = key.toLowerCase();
+        if (lowerKey.endsWith('.csv') || lowerKey.endsWith('.tsv')) {
+          return new TextDecoder('windows-1252').decode(buf);
+        }
+        return null;
+      }
+    } catch {
+      return null;
+    }
+  }
+
+  const filename = $derived(objectKey ? keyToName(objectKey) : '');
+
+  function buildDownloadUrl(key: string, bkt: string): string {
+    return `/storage/api/preview?${new URLSearchParams({ bucket: bkt, key })}`;
+  }
+
+  function close() {
+    open = false;
+  }
+
+  function toggleMaximized() {
+    maximized = !maximized;
+  }
+</script>
+
+<Modal bind:open class="modal">
+  <div
+    class="modal-box flex flex-col p-0 transition-none
+      {maximized ? 'h-dvh max-h-dvh w-screen max-w-none rounded-none' : 'w-full max-w-5xl'}"
+    style={maximized ? '' : 'height: min(88dvh, 900px)'}
+  >
+    <!-- Header -->
+    <div class="border-base-300 flex shrink-0 items-center gap-3 border-b px-5 py-2">
+      <div class="min-w-0 flex-1">
+        <h2 class="text-base-content truncate font-semibold" id="preview-modal-title">
+          {filename}
+        </h2>
+        {#if preview.kind === 'text' || preview.kind === 'csv'}
+          <p class="text-base-content/50 mt-0.5 text-xs">
+            {prettyBytes(preview.totalSize)}
+            {#if preview.truncated}
+              &mdash;
+              {m.storage_preview_truncated({ size: prettyBytes(preview.previewBytes) })}
+            {/if}
+          </p>
+        {:else if preview.kind === 'parquet'}
+          <p class="text-base-content/50 mt-0.5 text-xs">
+            {prettyBytes(preview.totalSize)}
+            {#if preview.truncated}
+              &mdash;
+              {m.storage_preview_parquet_rows({
+                count: preview.previewRows,
+                total: preview.totalRows
+              })}
+            {/if}
+          </p>
+        {:else if preview.kind === 'image' || preview.kind === 'pdf'}
+          <p class="text-base-content/50 mt-0.5 text-xs">{prettyBytes(preview.totalSize)}</p>
+        {/if}
+      </div>
+      <button
+        class="btn btn-ghost btn-sm btn-square"
+        onclick={toggleMaximized}
+        aria-label={maximized ? 'Restore' : 'Maximise'}
+      >
+        <Icon
+          icon={maximized ? 'material-symbols:close-fullscreen' : 'material-symbols:open-in-full'}
+          class="size-4"
+          aria-hidden="true"
+        />
+      </button>
+      <button
+        class="btn btn-ghost btn-sm btn-square"
+        onclick={close}
+        aria-label={m.storage_preview_close()}
+      >
+        <Icon icon="material-symbols:close" class="size-5" aria-hidden="true" />
+      </button>
+    </div>
+
+    <!-- Body -->
+    <div class="preview-scroll min-h-0 min-w-0 flex-1 overflow-scroll">
+      {#if preview.kind === 'idle' || preview.kind === 'loading'}
+        <div
+          class="flex items-center justify-center p-12"
+          aria-live="polite"
+          aria-label={m.storage_preview_loading()}
+        >
+          <span class="loading loading-spinner loading-md text-primary" aria-hidden="true"></span>
+          <span class="sr-only">{m.storage_preview_loading()}</span>
+        </div>
+      {:else if preview.kind === 'error'}
+        <div class="flex flex-col items-center gap-3 p-8 text-center" role="alert">
+          <Icon
+            icon="material-symbols:error-outline"
+            class="text-error size-12"
+            aria-hidden="true"
+          />
+          <p class="text-base-content font-semibold">{m.storage_preview_error_title()}</p>
+          <p class="text-base-content/60 text-sm">{preview.message}</p>
+        </div>
+      {:else if preview.kind === 'text'}
+        <TextPreview text={preview.text} contentType={preview.contentType} />
+      {:else if preview.kind === 'csv'}
+        <CsvPreview text={preview.text} />
+      {:else if preview.kind === 'parquet'}
+        <CsvPreview text={preview.text} />
+      {:else if preview.kind === 'image'}
+        <ImagePreview src={preview.blobUrl} name={filename} />
+      {:else if preview.kind === 'pdf'}
+        <PdfPreview src={preview.blobUrl} name={filename} />
+      {:else if preview.kind === 'fallback'}
+        <FallbackPreview
+          contentType={preview.contentType}
+          downloadUrl={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
+          name={filename}
+          isBinary={preview.isBinary}
+        />
+      {/if}
+    </div>
+
+    <!-- Footer -->
+    {#if preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'parquet' || preview.kind === 'image' || preview.kind === 'pdf'}
+      <div class="border-base-300 flex shrink-0 items-center justify-end gap-2 border-t px-5 py-2">
+        {#if (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
+          <a
+            href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
+            download={filename}
+            class="btn btn-ghost btn-sm gap-1.5"
+          >
+            <Icon icon="material-symbols:download" class="size-4" aria-hidden="true" />
+            {m.storage_preview_download_full()}
+          </a>
+        {:else if preview.kind === 'image' || preview.kind === 'pdf'}
+          <a
+            href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
+            download={filename}
+            class="btn btn-ghost btn-sm gap-1.5"
+          >
+            <Icon icon="material-symbols:download" class="size-4" aria-hidden="true" />
+            {m.storage_preview_download_full()}
+          </a>
+        {/if}
+        <button class="btn btn-primary btn-sm" onclick={close}>
+          {m.storage_preview_close()}
+        </button>
+      </div>
+    {/if}
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/preview/CsvPreview.svelte b/src/lib/components/storage/preview/CsvPreview.svelte
new file mode 100644
index 00000000..4a596fd6
--- /dev/null
+++ b/src/lib/components/storage/preview/CsvPreview.svelte
@@ -0,0 +1,83 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+
+  const MAX_ROWS = 250;
+
+  interface Props {
+    text: string;
+  }
+
+  let { text }: Props = $props();
+
+  const { headers, rows } = $derived.by(() => {
+    // Split into lines, strip trailing newline
+    const lines = text.split('\n').filter((l) => l.trim() !== '');
+    if (lines.length === 0) return { headers: [], rows: [] };
+
+    // Simple CSV parse: handle quoted fields
+    function parseLine(line: string): string[] {
+      const result: string[] = [];
+      let current = '';
+      let inQuotes = false;
+      for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '"') {
+          if (inQuotes && line[i + 1] === '"') {
+            current += '"';
+            i++;
+          } else {
+            inQuotes = !inQuotes;
+          }
+        } else if (ch === ',' && !inQuotes) {
+          result.push(current);
+          current = '';
+        } else {
+          current += ch;
+        }
+      }
+      result.push(current);
+      return result;
+    }
+
+    const [headerLine, ...dataLines] = lines;
+    const hdrs = parseLine(headerLine);
+    const rws = dataLines.slice(0, MAX_ROWS).map(parseLine);
+    return { headers: hdrs, rows: rws };
+  });
+
+  const truncated = $derived.by(() => {
+    const lines = text.split('\n').filter((l) => l.trim() !== '');
+    return lines.length > MAX_ROWS + 1;
+  });
+</script>
+
+<div>
+  {#if headers.length === 0}
+    <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
+  {:else}
+    <table class="table-xs table min-w-max" aria-label="CSV preview">
+      <thead>
+        <tr class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs">
+          {#each headers as header (header)}
+            <th class="font-semibold whitespace-nowrap">{header}</th>
+          {/each}
+        </tr>
+      </thead>
+      <tbody>
+        {#each rows as row, i (i)}
+          <tr class="hover">
+            <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
+            {#each headers as _h, j (j)}
+              <td class="text-base-content/80 max-w-xs truncate text-xs">{row[j] ?? ''}</td>
+            {/each}
+          </tr>
+        {/each}
+      </tbody>
+    </table>
+    {#if truncated}
+      <p class="text-base-content/50 px-4 py-2 text-xs italic">
+        {m.storage_preview_csv_rows({ count: rows.length })}
+      </p>
+    {/if}
+  {/if}
+</div>
diff --git a/src/lib/components/storage/preview/FallbackPreview.svelte b/src/lib/components/storage/preview/FallbackPreview.svelte
new file mode 100644
index 00000000..7c8a5483
--- /dev/null
+++ b/src/lib/components/storage/preview/FallbackPreview.svelte
@@ -0,0 +1,37 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    contentType: string;
+    downloadUrl: string;
+    name: string;
+    /** When true, the content was determined to be binary (non-displayable UTF-8). */
+    isBinary?: boolean;
+  }
+
+  let { contentType, downloadUrl, name, isBinary = false }: Props = $props();
+</script>
+
+<div class="flex flex-col items-center gap-4 p-8 text-center">
+  <Icon
+    icon="material-symbols:file-present"
+    class="text-base-content/30 size-16"
+    aria-hidden="true"
+  />
+  <div>
+    <p class="text-base-content font-semibold">
+      {isBinary ? m.storage_preview_binary_title() : m.storage_preview_unsupported_title()}
+    </p>
+    <p class="text-base-content/60 mt-1 text-sm">
+      {isBinary ? m.storage_preview_binary_desc() : m.storage_preview_unsupported_desc()}
+    </p>
+    {#if contentType}
+      <p class="text-base-content/40 mt-1 font-mono text-xs">{contentType}</p>
+    {/if}
+  </div>
+  <a href={downloadUrl} download={name} class="btn btn-primary btn-sm gap-2">
+    <Icon icon="material-symbols:download" class="size-4" aria-hidden="true" />
+    {m.storage_preview_download_full()}
+  </a>
+</div>
diff --git a/src/lib/components/storage/preview/ImagePreview.svelte b/src/lib/components/storage/preview/ImagePreview.svelte
new file mode 100644
index 00000000..a33214c9
--- /dev/null
+++ b/src/lib/components/storage/preview/ImagePreview.svelte
@@ -0,0 +1,32 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    /** Object URL for the image blob. */
+    src: string;
+    name: string;
+  }
+
+  let { src, name }: Props = $props();
+
+  let naturalWidth = $state(0);
+  let naturalHeight = $state(0);
+</script>
+
+<div class="flex flex-col items-center gap-3 p-4">
+  <img
+    {src}
+    alt={m.storage_preview_image_alt({ name })}
+    class="max-h-[60vh] max-w-full rounded object-contain shadow"
+    onload={(e) => {
+      const img = e.currentTarget as HTMLImageElement;
+      naturalWidth = img.naturalWidth;
+      naturalHeight = img.naturalHeight;
+    }}
+  />
+  {#if naturalWidth > 0}
+    <p class="text-base-content/50 text-xs">
+      {naturalWidth} &times; {naturalHeight}
+    </p>
+  {/if}
+</div>
diff --git a/src/lib/components/storage/preview/PdfPreview.svelte b/src/lib/components/storage/preview/PdfPreview.svelte
new file mode 100644
index 00000000..114e7ac5
--- /dev/null
+++ b/src/lib/components/storage/preview/PdfPreview.svelte
@@ -0,0 +1,18 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    /** Object URL for the PDF blob. */
+    src: string;
+    name: string;
+  }
+
+  let { src, name }: Props = $props();
+</script>
+
+<iframe
+  {src}
+  title={m.storage_preview_image_alt({ name })}
+  class="h-full w-full rounded border-0"
+  aria-label={m.storage_preview_image_alt({ name })}
+></iframe>
diff --git a/src/lib/components/storage/preview/TextPreview.svelte b/src/lib/components/storage/preview/TextPreview.svelte
new file mode 100644
index 00000000..6930ac8c
--- /dev/null
+++ b/src/lib/components/storage/preview/TextPreview.svelte
@@ -0,0 +1,40 @@
+<script lang="ts">
+  interface Props {
+    text: string;
+    contentType: string;
+  }
+
+  let { text, contentType }: Props = $props();
+
+  // Detect JSON by content type or by trying to parse
+  const isJson = $derived(
+    contentType === 'application/json' ||
+      contentType === 'text/json' ||
+      contentType.includes('+json')
+  );
+
+  const formatted = $derived.by(() => {
+    if (!isJson) return text;
+    try {
+      return JSON.stringify(JSON.parse(text), null, 2);
+    } catch {
+      return text;
+    }
+  });
+
+  const language = $derived.by(() => {
+    if (isJson) return 'json';
+    if (contentType === 'text/css') return 'css';
+    if (contentType === 'text/html') return 'html';
+    if (contentType === 'text/javascript' || contentType === 'application/javascript')
+      return 'javascript';
+    if (contentType === 'text/markdown') return 'markdown';
+    if (contentType === 'text/csv' || contentType === 'application/csv') return 'text';
+    return 'text';
+  });
+</script>
+
+<pre
+  class="text-base-content/90 bg-base-200/50 min-h-0 rounded p-4 font-mono text-xs leading-relaxed whitespace-pre"
+  data-language={language}
+  aria-label="File content preview">{formatted}</pre>
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 131e05cd..3ac254ef 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -22,6 +22,10 @@ export class HDFSStorageProvider implements StorageProvider {
     throw new Error('HDFS not implemented');
   }
 
+  getObjectRange(_key: string, _start: number, _end: number): Promise<ReadableStream> {
+    throw new Error('HDFS not implemented');
+  }
+
   getMetadata(_key: string): Promise<StorageMetadata> {
     throw new Error('HDFS not implemented');
   }
diff --git a/src/lib/server/storage/preview/binary.ts b/src/lib/server/storage/preview/binary.ts
new file mode 100644
index 00000000..1614bddf
--- /dev/null
+++ b/src/lib/server/storage/preview/binary.ts
@@ -0,0 +1,35 @@
+/**
+ * Content types that are definitively binary and cannot be rendered as text.
+ * For these we skip the body fetch entirely and tell the client upfront.
+ */
+export const KNOWN_BINARY_TYPES = new Set([
+  'application/gzip',
+  'application/x-gzip',
+  'application/zip',
+  'application/x-zip-compressed',
+  'application/x-tar',
+  'application/x-bzip2',
+  'application/x-xz',
+  'application/x-zstd',
+  'application/zstd',
+  'application/avro',
+  'application/x-avro',
+  'application/orc',
+  'application/x-orc',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
+]);
+
+export function binaryPreview(contentType: string, totalSize: number): Response {
+  return new Response(null, {
+    headers: {
+      'Content-Type': contentType,
+      'X-Preview-Renderable': 'false',
+      'X-Preview-Total-Size': String(totalSize),
+      'X-Preview-Bytes': '0',
+      'X-Preview-Truncated': 'false',
+      'Cache-Control': 'no-store'
+    }
+  });
+}
diff --git a/src/lib/server/storage/preview/parquet.ts b/src/lib/server/storage/preview/parquet.ts
new file mode 100644
index 00000000..443d06df
--- /dev/null
+++ b/src/lib/server/storage/preview/parquet.ts
@@ -0,0 +1,196 @@
+import { gunzipSync } from 'node:zlib';
+import { parquetMetadataAsync, parquetReadObjects, parquetSchema } from 'hyparquet';
+import { compressors } from 'hyparquet-compressors';
+import type pino from 'pino';
+import type { StorageProvider } from '$lib/server/storage/provider.js';
+
+/** Maximum rows to include in a parquet preview. */
+const PARQUET_PREVIEW_ROWS = 250;
+
+/**
+ * Override the pure-JS GZIP decompressor from hyparquet-compressors with
+ * Node's native zlib binding — orders of magnitude faster for large payloads.
+ */
+const nodeCompressors = {
+  ...compressors,
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars -- signature must match hyparquet's expectation of (input, outputLength)
+  GZIP: (input: Uint8Array, _outputLength: number): Uint8Array => new Uint8Array(gunzipSync(input))
+};
+
+/** Read a ReadableStream into an ArrayBuffer. */
+async function streamToArrayBuffer(stream: ReadableStream): Promise<ArrayBuffer> {
+  const chunks: Uint8Array[] = [];
+  const reader = stream.getReader();
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value as Uint8Array);
+  }
+  const totalLength = chunks.reduce((acc, c) => acc + c.length, 0);
+  const result = new Uint8Array(totalLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result.buffer;
+}
+
+/** Serialise a parquet cell value to a string suitable for CSV embedding. */
+function formatParquetValue(value: unknown): string {
+  if (value === null || value === undefined) return '';
+  if (typeof value === 'bigint') return value.toString();
+  if (value instanceof Date) return value.toISOString();
+  if (typeof value === 'object') return JSON.stringify(value);
+  return String(value);
+}
+
+/** Escape a single CSV field (RFC 4180). */
+function escapeCSVField(field: string): string {
+  if (field.includes(',') || field.includes('"') || field.includes('\n') || field.includes('\r')) {
+    return '"' + field.replace(/"/g, '""') + '"';
+  }
+  return field;
+}
+
+export async function parquetPreview(
+  provider: StorageProvider,
+  key: string,
+  totalSize: number,
+  userId: string,
+  log: pino.Logger
+): Promise<Response> {
+  // ── Step 1: footer (serial, ≤ 2 range requests) ────────────────────────
+  // hyparquet fetches the last 512 KB first; if the footer is larger it
+  // makes a second request. Serial avoids ETIMEDOUT.
+  let footerQueue: Promise<void> = Promise.resolve();
+  const footerBuffer = {
+    byteLength: totalSize,
+    slice: (start: number, end?: number): Promise<ArrayBuffer> => {
+      const rangeEnd = end !== undefined ? end - 1 : totalSize - 1;
+      const req = footerQueue.then(async () => {
+        const stream = await provider.getObjectRange(key, start, rangeEnd);
+        return streamToArrayBuffer(stream as ReadableStream);
+      });
+      footerQueue = req.then(
+        () => {},
+        () => {}
+      );
+      return req;
+    }
+  };
+
+  const parquetMeta = await parquetMetadataAsync(footerBuffer);
+  const totalRows = Number(parquetMeta.num_rows);
+  const previewRows = Math.min(totalRows, PARQUET_PREVIEW_ROWS);
+  const truncated = previewRows < totalRows;
+  const schema = parquetSchema(parquetMeta);
+  const columnNames = schema.children.map((e) => e.element.name);
+
+  // ── Step 2: pre-fetch OffsetIndex in ONE merged range request ───────────
+  // OffsetIndex entries for all columns are stored contiguously near the
+  // end of the file (written just before the file metadata). Fetching them
+  // together eliminates one S3 round-trip per column (~30 saved requests).
+  let oiMin = Infinity;
+  let oiMax = 0;
+  let rowsScanned = 0;
+  for (const rg of parquetMeta.row_groups) {
+    if (rowsScanned >= previewRows) break;
+    rowsScanned += Number(rg.num_rows);
+    for (const col of rg.columns) {
+      if (col.offset_index_offset && col.offset_index_length) {
+        const s = Number(col.offset_index_offset);
+        const e = s + col.offset_index_length;
+        if (s < oiMin) oiMin = s;
+        if (e > oiMax) oiMax = e;
+      }
+    }
+  }
+  let oiCache: { start: number; buf: ArrayBuffer } | null = null;
+  if (isFinite(oiMin)) {
+    const oiStream = await provider.getObjectRange(key, oiMin, oiMax - 1);
+    oiCache = { start: oiMin, buf: await streamToArrayBuffer(oiStream as ReadableStream) };
+    log.debug({ user_id: userId, key, oi_bytes: oiMax - oiMin }, 'parquet OffsetIndex pre-fetched');
+  }
+
+  // ── Step 3: concurrency-limited buffer for data page reads ──────────────
+  // prefetchAsyncBuffer inside hyparquet calls file.slice() for every fetch
+  // in one synchronous pass. Limit to 4 concurrent S3 connections to stay
+  // well below the threshold that triggers ETIMEDOUT on the S3 endpoint,
+  // while being 4× faster than serial (30 pages / 4 = 8 batches × ~1.5s).
+  const CONCURRENCY = 4;
+  let running = 0;
+  const waiters: Array<() => void> = [];
+  const acquire = (): Promise<void> =>
+    running < CONCURRENCY
+      ? (running++, Promise.resolve())
+      : new Promise((resolve) => waiters.push(resolve));
+  const release = () => {
+    const next = waiters.shift();
+    if (next) next();
+    else running--;
+  };
+
+  const asyncBuffer = {
+    byteLength: totalSize,
+    slice: (start: number, end?: number): Promise<ArrayBuffer> => {
+      const rangeEnd = end ?? totalSize;
+      // Serve OffsetIndex reads from the pre-fetched in-memory cache.
+      if (oiCache && start >= oiCache.start && rangeEnd <= oiCache.start + oiCache.buf.byteLength) {
+        return Promise.resolve(oiCache.buf.slice(start - oiCache.start, rangeEnd - oiCache.start));
+      }
+      // All other reads (data pages): rate-limited S3 range request.
+      return acquire().then(async () => {
+        try {
+          const stream = await provider.getObjectRange(key, start, rangeEnd - 1);
+          return await streamToArrayBuffer(stream as ReadableStream);
+        } finally {
+          release();
+        }
+      });
+    }
+  };
+
+  // useOffsetIndex: true — fetch only the specific pages covering the first
+  // previewRows rows (requires OffsetIndex in file; falls back to full column
+  // chunks if absent, which is unavoidable without page-level metadata).
+  const rows = await parquetReadObjects({
+    file: asyncBuffer,
+    metadata: parquetMeta,
+    rowEnd: previewRows,
+    useOffsetIndex: true,
+    compressors: nodeCompressors
+  });
+
+  const csvLines = [
+    columnNames.map(escapeCSVField).join(','),
+    ...rows.map((row) =>
+      columnNames.map((col) => escapeCSVField(formatParquetValue(row[col]))).join(',')
+    )
+  ];
+  const csvText = csvLines.join('\n');
+
+  log.info(
+    {
+      user_id: userId,
+      key,
+      total_rows: totalRows,
+      preview_rows: previewRows,
+      truncated
+    },
+    'parquet preview ready'
+  );
+
+  return new Response(csvText, {
+    headers: {
+      'Content-Type': 'text/csv',
+      'X-Preview-Format': 'parquet',
+      'X-Preview-Renderable': 'true',
+      'X-Preview-Truncated': String(truncated),
+      'X-Preview-Total-Size': String(totalSize),
+      'X-Preview-Total-Rows': String(totalRows),
+      'X-Preview-Preview-Rows': String(previewRows),
+      'Cache-Control': 'no-store'
+    }
+  });
+}
diff --git a/src/lib/server/storage/preview/stream.ts b/src/lib/server/storage/preview/stream.ts
new file mode 100644
index 00000000..69a42141
--- /dev/null
+++ b/src/lib/server/storage/preview/stream.ts
@@ -0,0 +1,57 @@
+import type pino from 'pino';
+import type { StorageProvider } from '$lib/server/storage/provider.js';
+
+/** Maximum bytes fetched for text-based previews (256 KiB). */
+const TEXT_PREVIEW_BYTES = 256 * 1024;
+/** Maximum bytes fetched for image previews (5 MiB). */
+const IMAGE_PREVIEW_BYTES = 5 * 1024 * 1024;
+/** Maximum bytes fetched for PDF previews (25 MiB). */
+const PDF_PREVIEW_BYTES = 25 * 1024 * 1024;
+
+export async function streamPreview(
+  provider: StorageProvider,
+  key: string,
+  contentType: string,
+  totalSize: number,
+  userId: string,
+  log: pino.Logger
+): Promise<Response> {
+  let limitBytes: number;
+  if (contentType.startsWith('image/')) {
+    limitBytes = IMAGE_PREVIEW_BYTES;
+  } else if (contentType === 'application/pdf') {
+    limitBytes = PDF_PREVIEW_BYTES;
+  } else {
+    limitBytes = TEXT_PREVIEW_BYTES;
+  }
+
+  const previewBytes = Math.min(totalSize, limitBytes);
+  const truncated = previewBytes < totalSize;
+
+  log.info(
+    {
+      user_id: userId,
+      key,
+      content_type: contentType,
+      preview_bytes: previewBytes,
+      truncated
+    },
+    'fetching object preview'
+  );
+
+  const stream =
+    previewBytes === totalSize
+      ? await provider.getObject(key)
+      : await provider.getObjectRange(key, 0, previewBytes - 1);
+
+  return new Response(stream as ReadableStream, {
+    headers: {
+      'Content-Type': contentType,
+      'X-Preview-Renderable': 'true',
+      'X-Preview-Truncated': String(truncated),
+      'X-Preview-Total-Size': String(totalSize),
+      'X-Preview-Bytes': String(previewBytes),
+      'Cache-Control': 'no-store'
+    }
+  });
+}
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index ae6b850d..e09ca065 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -13,6 +13,11 @@ export interface StorageProvider {
     continuationToken?: string | null
   ): Promise<StoragePage>;
   getObject(key: string): Promise<ReadableStream>;
+  /**
+   * Fetch a byte range of an object. Both `start` and `end` are inclusive,
+   * following the HTTP `Range: bytes=start-end` convention.
+   */
+  getObjectRange(key: string, start: number, end: number): Promise<ReadableStream>;
   getMetadata(key: string): Promise<StorageMetadata>;
   exists(key: string): Promise<boolean>;
 }
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 4157769b..b4196903 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -90,6 +90,17 @@ export class S3StorageProvider implements StorageProvider {
     return output.Body.transformToWebStream();
   }
 
+  async getObjectRange(key: string, start: number, end: number): Promise<ReadableStream> {
+    log.debug({ bucket: this.bucket, key, start, end }, 'getting object range');
+    const output = await this.client.send(
+      new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
+    );
+    if (!output.Body) {
+      throw new Error(`Object ${key} has no body`);
+    }
+    return output.Body.transformToWebStream();
+  }
+
   async getMetadata(key: string): Promise<StorageMetadata> {
     log.debug({ bucket: this.bucket, key }, 'getting object metadata');
     const output = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
diff --git a/src/routes/(app)/storage/api/preview/+server.ts b/src/routes/(app)/storage/api/preview/+server.ts
new file mode 100644
index 00000000..351e896e
--- /dev/null
+++ b/src/routes/(app)/storage/api/preview/+server.ts
@@ -0,0 +1,88 @@
+import { error, json } from '@sveltejs/kit';
+import { S3ServiceException } from '@aws-sdk/client-s3';
+import { getUserId } from '$lib/server/auth-utils.js';
+import { getConnection } from '$lib/server/storage/service.js';
+import { StorageProviderFactory } from '$lib/server/storage/factory.js';
+// import { parquetPreview } from '$lib/server/storage/preview/parquet.js';
+import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
+import { streamPreview } from '$lib/server/storage/preview/stream.js';
+import type { RequestHandler } from '@sveltejs/kit';
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const log = locals.logger;
+  const userId = getUserId(locals);
+
+  const bucket = url.searchParams.get('bucket');
+  const key = url.searchParams.get('key');
+
+  if (!bucket || !key) {
+    return json({ error: 'Missing bucket or key parameter' }, { status: 400 });
+  }
+
+  const connection = getConnection(userId);
+  if (!connection) {
+    return json({ error: 'No storage connection configured' }, { status: 401 });
+  }
+  if (connection.type !== 's3') {
+    return json({ error: 'Storage backend not supported for preview' }, { status: 400 });
+  }
+
+  const provider = StorageProviderFactory.create({ ...connection, bucket });
+
+  try {
+    const metadata = await provider.getMetadata(key);
+    const rawContentType = metadata.contentType ?? 'application/octet-stream';
+    const totalSize = metadata.size;
+    const lowerKey = key.toLowerCase();
+
+    // Parquet files (by content-type or extension) — parse server-side and emit CSV rows.
+    const isParquet =
+      rawContentType === 'application/vnd.apache.parquet' ||
+      rawContentType === 'application/x-parquet' ||
+      lowerKey.endsWith('.parquet');
+
+    if (isParquet) {
+      log.info(
+        { user_id: userId, bucket, key, content_type: rawContentType, total_size: totalSize },
+        'parquet preview disabled'
+      );
+      // TODO: re-enable once we have a more robust parquet preview solution in place
+      // return await parquetPreview(provider, key, totalSize, userId, log);
+    }
+
+    // Skip body fetch for known-binary formats — client will show fallback immediately.
+    if (KNOWN_BINARY_TYPES.has(rawContentType)) {
+      log.info(
+        { user_id: userId, bucket, key, content_type: rawContentType },
+        'skipping preview fetch for known-binary type'
+      );
+      return binaryPreview(rawContentType, totalSize);
+    }
+
+    // Normalise the content-type for Excel-exported CSV files so the client
+    // treats them as text/csv rather than binary.
+    const contentType =
+      rawContentType === 'application/vnd.ms-excel' && lowerKey.endsWith('.csv')
+        ? 'text/csv'
+        : rawContentType;
+
+    return await streamPreview(provider, key, contentType, totalSize, userId, log);
+  } catch (err) {
+    if (err instanceof S3ServiceException) {
+      const code = err.name;
+      const status = err.$metadata?.httpStatusCode;
+      log.warn(
+        { user_id: userId, bucket, key, error_code: code, http_status: status },
+        'S3 error fetching preview'
+      );
+      if (code === 'AccessDenied' || status === 403) {
+        throw error(403, 'Access denied');
+      }
+      if (code === 'NoSuchKey' || status === 404) {
+        throw error(404, 'Object not found');
+      }
+      throw error(502, `Storage error: ${err.message}`);
+    }
+    throw err;
+  }
+};

From 184fa843256e555e017366232c5d9a40091125be Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 12 May 2026 13:42:45 +0200
Subject: [PATCH 025/136] Feat/s3 file browser refactor object table (#120)

* refactor(ObjectTable): extract File and Folde rows into seperate components

* style: format code

* style: use camelCase

* style: use camelCase
---
 src/lib/components/storage/ContextMenu.svelte |  14 +-
 .../components/storage/FileExplorer.svelte    |  22 +-
 src/lib/components/storage/FileRow.svelte     |  88 ++++++++
 src/lib/components/storage/FolderRow.svelte   |  82 +++++++
 src/lib/components/storage/ObjectTable.svelte | 200 +++---------------
 .../storage/SelectionToolbar.svelte           |  14 +-
 .../storage/StorageBreadcrumb.svelte          |  10 +-
 .../storage/[bucket]/[...prefix]/+page.svelte |   2 +-
 8 files changed, 227 insertions(+), 205 deletions(-)
 create mode 100644 src/lib/components/storage/FileRow.svelte
 create mode 100644 src/lib/components/storage/FolderRow.svelte

diff --git a/src/lib/components/storage/ContextMenu.svelte b/src/lib/components/storage/ContextMenu.svelte
index a8763b37..751cd815 100644
--- a/src/lib/components/storage/ContextMenu.svelte
+++ b/src/lib/components/storage/ContextMenu.svelte
@@ -9,11 +9,11 @@
     selectionCount: number;
     canPreview: boolean;
     canDownload: boolean;
-    onaction: (action: string) => void;
-    onclose: () => void;
+    onAction: (action: string) => void;
+    onClose: () => void;
   }
 
-  let { x, y, selectionCount, canPreview, canDownload, onaction, onclose }: Props = $props();
+  let { x, y, selectionCount, canPreview, canDownload, onAction, onClose }: Props = $props();
 
   let menuEl = $state<HTMLUListElement | null>(null);
 
@@ -28,16 +28,16 @@
   });
 
   function emit(action: string) {
-    onaction(action);
-    onclose();
+    onAction(action);
+    onClose();
   }
 
   function handleKeydown(e: KeyboardEvent) {
-    if (e.key === 'Escape') onclose();
+    if (e.key === 'Escape') onClose();
   }
 
   function handleOutsideClick(e: MouseEvent) {
-    if (menuEl && !menuEl.contains(e.target as Node)) onclose();
+    if (menuEl && !menuEl.contains(e.target as Node)) onClose();
   }
 
   onMount(() => {
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index eafe38eb..971260ff 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -14,14 +14,14 @@
     bucket: string;
     objects: StoragePage;
     prefix: string;
-    onnavigate: (
+    onNavigate: (
       prefix: string,
       continuationToken?: string | null,
       pageSize?: number | null
     ) => void;
   }
 
-  let { bucket, objects, prefix, onnavigate }: Props = $props();
+  let { bucket, objects, prefix, onNavigate }: Props = $props();
 
   // ── Derived folder/file lists ─────────────────────────────────────────────
   const folders = $derived(objects.objects.filter((o) => o.isDirectory));
@@ -96,20 +96,20 @@
   function handleNavigate(prefix: string) {
     loading = true;
     prevTokens = [];
-    onnavigate(prefix, null, pageSize);
+    onNavigate(prefix, null, pageSize);
   }
 
   function handlePageNavigate(token: string | null) {
     // push current page token so we can go back deterministically
     prevTokens = [...prevTokens, objects.continuationToken ?? null];
     loading = true;
-    onnavigate(prefix, token, pageSize);
+    onNavigate(prefix, token, pageSize);
   }
 
   function goFirst() {
     prevTokens = [];
     loading = true;
-    onnavigate(prefix, null, pageSize);
+    onNavigate(prefix, null, pageSize);
   }
 
   function goPrev() {
@@ -117,7 +117,7 @@
     const last = copy.pop() ?? null;
     prevTokens = copy;
     loading = true;
-    onnavigate(prefix, last, pageSize);
+    onNavigate(prefix, last, pageSize);
   }
 
   // ── Context menu ──────────────────────────────────────────────────────────
@@ -192,7 +192,7 @@
     folderCount={folders.length}
     fileCount={files.length}
     {selectionMode}
-    onnavigate={handleNavigate}
+    onNavigate={handleNavigate}
     onToggleSelectionMode={toggleSelectionMode}
   />
 
@@ -217,11 +217,11 @@
       {showCheckboxes}
       {allSelected}
       {someSelected}
-      onnavigate={handleNavigate}
+      onNavigate={handleNavigate}
       onSelectAll={selectAll}
       onToggleSelect={toggleSelect}
       onContextMenu={openContextMenu}
-      onaction={handleAction}
+      onAction={handleAction}
     />
   </div>
 
@@ -254,8 +254,8 @@
     canPreview={(selectedFiles.length === 1 && selectedFolders.length === 0) ||
       (ctxKey !== null && files.some((f) => f.key === ctxKey))}
     canDownload={selectedFiles.length > 0}
-    onaction={handleAction}
-    onclose={() => {
+    onAction={handleAction}
+    onClose={() => {
       ctxMenu = null;
       ctxKey = null;
     }}
diff --git a/src/lib/components/storage/FileRow.svelte b/src/lib/components/storage/FileRow.svelte
new file mode 100644
index 00000000..ba60c674
--- /dev/null
+++ b/src/lib/components/storage/FileRow.svelte
@@ -0,0 +1,88 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import { fileIconKind, iconColors, formatDate, keyToName } from '$lib/storage/utils.js';
+  import type { StorageObject } from '$lib/storage/types.js';
+  import prettyBytes from 'pretty-bytes';
+
+  interface Props {
+    file: StorageObject;
+    selected: boolean;
+    isCtx: boolean;
+    showCheckboxes: boolean;
+    onToggleSelect: (key: string, force?: boolean) => void;
+    onContextMenu: (e: MouseEvent, key: string) => void;
+    onAction: (action: string) => void;
+  }
+
+  let { file, selected, isCtx, showCheckboxes, onToggleSelect, onContextMenu, onAction }: Props =
+    $props();
+
+  const kind = $derived(fileIconKind(file.contentType));
+  const color = $derived(iconColors[kind]);
+</script>
+
+<tr
+  class="
+    group cursor-pointer select-none
+    {isCtx
+    ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
+    : selected
+      ? 'bg-primary/10 hover:bg-primary/15'
+      : 'hover'}"
+  onclick={(e) => onToggleSelect(file.key, e.ctrlKey || e.metaKey)}
+  ondblclick={() => onAction('preview')}
+  oncontextmenu={(e) => onContextMenu(e, file.key)}
+>
+  <td class="pr-0">
+    <input
+      type="checkbox"
+      class="checkbox checkbox-xs {!showCheckboxes ? 'pointer-events-none invisible' : ''}"
+      checked={selected}
+      onchange={() => onToggleSelect(file.key, true)}
+      onclick={(e) => e.stopPropagation()}
+      disabled={!showCheckboxes}
+      aria-label="Select {keyToName(file.key)}"
+    />
+  </td>
+  <td>
+    <div class="flex items-center gap-2.5">
+      {#if kind === 'image'}
+        <Icon icon="material-symbols:image" class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {:else if kind === 'code'}
+        <Icon icon="material-symbols:code" class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {:else if kind === 'archive'}
+        <Icon icon="material-symbols:archive" class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {:else if kind === 'pdf'}
+        <Icon
+          icon="material-symbols:picture-as-pdf"
+          class="size-5 shrink-0 {color}"
+          aria-hidden="true"
+        />
+      {:else}
+        <Icon
+          icon="material-symbols:description"
+          class="size-5 shrink-0 {color}"
+          aria-hidden="true"
+        />
+      {/if}
+      <span class="truncate">{keyToName(file.key)}</span>
+      {#if file.contentType}
+        <span class="badge badge-ghost badge-sm ml-1 shrink-0 text-[10px] opacity-50">
+          {file.contentType.split('/').at(-1) ?? ''}
+        </span>
+      {/if}
+    </div>
+  </td>
+  <td class="text-right font-mono text-sm">{prettyBytes(file.size)}</td>
+  <td class="text-base-content/60 text-sm">{formatDate(file.lastModified)}</td>
+  <td class="w-10 py-0 pr-2 text-right">
+    <button
+      class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
+      title="Actions"
+      aria-label="Actions for {keyToName(file.key)}"
+      onclick={(e) => onContextMenu(e, file.key)}
+    >
+      <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
+    </button>
+  </td>
+</tr>
diff --git a/src/lib/components/storage/FolderRow.svelte b/src/lib/components/storage/FolderRow.svelte
new file mode 100644
index 00000000..be96fd46
--- /dev/null
+++ b/src/lib/components/storage/FolderRow.svelte
@@ -0,0 +1,82 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import { keyToName } from '$lib/storage/utils.js';
+  import type { StorageObject } from '$lib/storage/types.js';
+
+  interface Props {
+    folder: StorageObject;
+    selected: boolean;
+    isCtx: boolean;
+    showCheckboxes: boolean;
+    onNavigate: (prefix: string) => void;
+    onToggleSelect: (key: string, force?: boolean) => void;
+    onContextMenu: (e: MouseEvent, key: string) => void;
+  }
+
+  let {
+    folder,
+    selected,
+    isCtx,
+    showCheckboxes,
+    onNavigate,
+    onToggleSelect,
+    onContextMenu
+  }: Props = $props();
+</script>
+
+<tr
+  class="
+    group cursor-pointer select-none
+    {isCtx
+    ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
+    : selected
+      ? 'bg-primary/10 hover:bg-primary/15'
+      : 'hover'}"
+  onclick={(e) => {
+    if (showCheckboxes || e.ctrlKey || e.metaKey) {
+      onToggleSelect(folder.key, true);
+    } else {
+      onNavigate(folder.key);
+    }
+  }}
+  ondblclick={(e) => {
+    if (e.ctrlKey || e.metaKey) {
+      onNavigate(folder.key);
+    }
+  }}
+  oncontextmenu={(e) => onContextMenu(e, folder.key)}
+>
+  <td class="pr-0">
+    <input
+      type="checkbox"
+      class="checkbox checkbox-xs {!showCheckboxes ? 'pointer-events-none invisible' : ''}"
+      checked={selected}
+      onchange={() => onToggleSelect(folder.key, true)}
+      onclick={(e) => e.stopPropagation()}
+      disabled={!showCheckboxes}
+      aria-label="Select {keyToName(folder.key)}"
+    />
+  </td>
+  <td>
+    <div class="flex items-center gap-2.5">
+      <Icon
+        icon="material-symbols:folder"
+        class="text-warning size-5 shrink-0"
+        aria-hidden="true"
+      />
+      <span class="font-medium">{keyToName(folder.key)}/</span>
+    </div>
+  </td>
+  <td class="text-base-content/30 text-right">—</td>
+  <td class="text-base-content/30">—</td>
+  <td class="w-10 py-0 pr-2 text-right">
+    <button
+      class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
+      title="Actions"
+      aria-label="Actions for {keyToName(folder.key)}"
+      onclick={(e) => onContextMenu(e, folder.key)}
+    >
+      <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
+    </button>
+  </td>
+</tr>
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
index b5c33d90..7f05324d 100644
--- a/src/lib/components/storage/ObjectTable.svelte
+++ b/src/lib/components/storage/ObjectTable.svelte
@@ -2,10 +2,9 @@
   import * as m from '$lib/paraglide/messages.js';
   import Icon from '@iconify/svelte';
   import SelectionToolbar from './SelectionToolbar.svelte';
-  import { fileIconKind, iconColors, formatDate, keyToName } from '$lib/storage/utils.js';
+  import FolderRow from './FolderRow.svelte';
+  import FileRow from './FileRow.svelte';
   import type { StorageObject } from '$lib/storage/types.js';
-  import { flip } from 'svelte/animate';
-  import prettyBytes from 'pretty-bytes';
 
   interface Props {
     prefix: string;
@@ -16,11 +15,11 @@
     showCheckboxes: boolean;
     allSelected: boolean;
     someSelected: boolean;
-    onnavigate: (prefix: string, continuationToken?: string | null, pageSize?: number) => void;
+    onNavigate: (prefix: string, continuationToken?: string | null, pageSize?: number) => void;
     onSelectAll: (checked: boolean) => void;
     onToggleSelect: (key: string, force?: boolean) => void;
     onContextMenu: (e: MouseEvent, key: string) => void;
-    onaction: (action: string) => void;
+    onAction: (action: string) => void;
   }
 
   let {
@@ -32,11 +31,11 @@
     showCheckboxes,
     allSelected,
     someSelected,
-    onnavigate,
+    onNavigate,
     onSelectAll,
     onToggleSelect,
     onContextMenu,
-    onaction
+    onAction
   }: Props = $props();
 
   const selectedCount = $derived(selectedKeys.size);
@@ -60,7 +59,7 @@
     if (!prefix) return;
     const withoutTrailing = prefix.slice(0, -1);
     const lastSlash = withoutTrailing.lastIndexOf('/');
-    onnavigate(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
+    onNavigate(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
   }
 </script>
 
@@ -94,7 +93,7 @@
       </tr>
 
       <!-- Selection action toolbar -->
-      <SelectionToolbar {selectedCount} {canPreview} {canRename} {canDownload} {onaction} />
+      <SelectionToolbar {selectedCount} {canPreview} {canRename} {canDownload} {onAction} />
     </thead>
 
     <tbody>
@@ -114,175 +113,28 @@
 
       <!-- Folders -->
       {#each folders as folder (folder.key)}
-        <tr
-          animate:flip={{ duration: 200 }}
-          class="
-            group cursor-pointer select-none
-            {ctxKey === folder.key
-            ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
-            : selectedKeys.has(folder.key)
-              ? `
-                bg-primary/10
-                hover:bg-primary/15
-              `
-              : 'hover'}"
-          onclick={(e) => {
-            if (e.ctrlKey || e.metaKey) {
-              onToggleSelect(folder.key, true);
-            } else {
-              onnavigate(folder.key);
-            }
-          }}
-          ondblclick={() => onnavigate(folder.key)}
-          oncontextmenu={(e) => onContextMenu(e, folder.key)}
-        >
-          <td class="pr-0">
-            <input
-              type="checkbox"
-              class="
-                checkbox checkbox-xs
-                {!showCheckboxes ? `pointer-events-none invisible` : ''}"
-              checked={selectedKeys.has(folder.key)}
-              onchange={() => onToggleSelect(folder.key, true)}
-              onclick={(e) => e.stopPropagation()}
-              disabled={!showCheckboxes}
-              aria-label="Select {keyToName(folder.key)}"
-            />
-          </td>
-          <td>
-            <div class="flex items-center gap-2.5">
-              <Icon
-                icon="material-symbols:folder"
-                class="text-warning size-5 shrink-0"
-                aria-hidden="true"
-              />
-              <span class="font-medium">{keyToName(folder.key)}/</span>
-            </div>
-          </td>
-          <td class="text-base-content/30 text-right">—</td>
-          <td class="text-base-content/30">—</td>
-          <td class="w-10 py-0 pr-2 text-right">
-            <button
-              class="
-                btn btn-ghost btn-xs opacity-0
-                group-hover:opacity-100
-              "
-              title="Actions"
-              aria-label="Actions for {keyToName(folder.key)}"
-              onclick={(e) => onContextMenu(e, folder.key)}
-            >
-              <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
-            </button>
-          </td>
-        </tr>
+        <FolderRow
+          {folder}
+          selected={selectedKeys.has(folder.key)}
+          isCtx={ctxKey === folder.key}
+          {showCheckboxes}
+          {onNavigate}
+          {onToggleSelect}
+          {onContextMenu}
+        />
       {/each}
 
       <!-- Files -->
       {#each files as file (file.key)}
-        {@const kind = fileIconKind(file.contentType)}
-        {@const color = iconColors[kind]}
-        <tr
-          animate:flip={{ duration: 200 }}
-          class="
-            group cursor-pointer select-none
-            {ctxKey === file.key
-            ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
-            : selectedKeys.has(file.key)
-              ? `
-                bg-primary/10
-                hover:bg-primary/15
-              `
-              : 'hover'}"
-          onclick={(e) => onToggleSelect(file.key, e.ctrlKey || e.metaKey)}
-          ondblclick={() => onaction('preview')}
-          oncontextmenu={(e) => onContextMenu(e, file.key)}
-        >
-          <td class="pr-0">
-            <input
-              type="checkbox"
-              class="
-                checkbox checkbox-xs
-                {!showCheckboxes ? `pointer-events-none invisible` : ''}"
-              checked={selectedKeys.has(file.key)}
-              onchange={() => onToggleSelect(file.key, true)}
-              onclick={(e) => e.stopPropagation()}
-              disabled={!showCheckboxes}
-              aria-label="Select {keyToName(file.key)}"
-            />
-          </td>
-          <td>
-            <div class="flex items-center gap-2.5">
-              {#if kind === 'image'}
-                <Icon
-                  icon="material-symbols:image"
-                  class="
-                    size-5 shrink-0
-                    {color}"
-                  aria-hidden="true"
-                />
-              {:else if kind === 'code'}
-                <Icon
-                  icon="material-symbols:code"
-                  class="
-                    size-5 shrink-0
-                    {color}"
-                  aria-hidden="true"
-                />
-              {:else if kind === 'archive'}
-                <Icon
-                  icon="material-symbols:archive"
-                  class="
-                    size-5 shrink-0
-                    {color}"
-                  aria-hidden="true"
-                />
-              {:else if kind === 'pdf'}
-                <Icon
-                  icon="material-symbols:picture-as-pdf"
-                  class="
-                    size-5 shrink-0
-                    {color}"
-                  aria-hidden="true"
-                />
-              {:else}
-                <!-- text / document fallback -->
-                <Icon
-                  icon="material-symbols:description"
-                  class="
-                    size-5 shrink-0
-                    {color}"
-                  aria-hidden="true"
-                />
-              {/if}
-              <span class="truncate">{keyToName(file.key)}</span>
-              {#if file.contentType}
-                <span
-                  class="
-                    badge badge-ghost badge-sm ml-1 shrink-0 text-[10px]
-                    opacity-50
-                  "
-                >
-                  {file.contentType.split('/').at(-1) ?? ''}
-                </span>
-              {/if}
-            </div>
-          </td>
-          <td class="text-right font-mono text-sm">{prettyBytes(file.size)}</td>
-          <td class="text-base-content/60 text-sm">{formatDate(file.lastModified)}</td>
-          <td class="w-10 py-0 pr-2 text-right">
-            <button
-              class="
-                btn btn-ghost btn-xs opacity-0
-                group-hover:opacity-100
-              "
-              title="Actions"
-              aria-label="Actions for {keyToName(file.key)}"
-              onclick={(e) => onContextMenu(e, file.key)}
-            >
-              <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
-            </button>
-          </td>
-        </tr>
+        <FileRow
+          {file}
+          selected={selectedKeys.has(file.key)}
+          isCtx={ctxKey === file.key}
+          {showCheckboxes}
+          {onToggleSelect}
+          {onContextMenu}
+          {onAction}
+        />
       {/each}
 
       <!-- Empty folder -->
diff --git a/src/lib/components/storage/SelectionToolbar.svelte b/src/lib/components/storage/SelectionToolbar.svelte
index d342e1fc..1cb2e339 100644
--- a/src/lib/components/storage/SelectionToolbar.svelte
+++ b/src/lib/components/storage/SelectionToolbar.svelte
@@ -8,10 +8,10 @@
     canPreview: boolean;
     canRename: boolean;
     canDownload: boolean;
-    onaction: (action: string) => void;
+    onAction: (action: string) => void;
   }
 
-  let { selectedCount, canPreview, canRename, canDownload, onaction }: Props = $props();
+  let { selectedCount, canPreview, canRename, canDownload, onAction }: Props = $props();
 </script>
 
 <tr class="border-primary/20 bg-primary/5 border-t">
@@ -24,7 +24,7 @@
       <button
         class="btn btn-ghost btn-xs gap-1"
         title={m.storage_action_preview()}
-        onclick={() => onaction('preview')}
+        onclick={() => onAction('preview')}
         disabled={!canPreview}
       >
         <Icon icon="material-symbols:visibility" class="size-3.5" aria-hidden="true" />
@@ -34,7 +34,7 @@
       <button
         class="btn btn-ghost btn-xs gap-1"
         title="{m.storage_action_rename()} (F2)"
-        onclick={() => onaction('rename')}
+        onclick={() => onAction('rename')}
         disabled={!canRename}
       >
         <Icon icon="material-symbols:edit" class="size-3.5" aria-hidden="true" />
@@ -44,7 +44,7 @@
       <button
         class="btn btn-ghost btn-xs gap-1"
         title={m.storage_action_download()}
-        onclick={() => onaction('download')}
+        onclick={() => onAction('download')}
         disabled={!canDownload}
       >
         <Icon icon="material-symbols:download" class="size-3.5" aria-hidden="true" />
@@ -54,7 +54,7 @@
       <button
         class="btn btn-ghost btn-xs gap-1"
         title={m.storage_action_move()}
-        onclick={() => onaction('move')}
+        onclick={() => onAction('move')}
         disabled={selectedCount === 0}
       >
         <Icon icon="material-symbols:drive-file-move" class="size-3.5" aria-hidden="true" />
@@ -67,7 +67,7 @@
           gap-1
         "
         title="{m.storage_action_delete()} (Del)"
-        onclick={() => onaction('delete')}
+        onclick={() => onAction('delete')}
         disabled={selectedCount === 0}
       >
         <Icon icon="material-symbols:delete" class="size-3.5" aria-hidden="true" />
diff --git a/src/lib/components/storage/StorageBreadcrumb.svelte b/src/lib/components/storage/StorageBreadcrumb.svelte
index 1870e3ef..4606c4a0 100644
--- a/src/lib/components/storage/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/StorageBreadcrumb.svelte
@@ -8,7 +8,7 @@
     folderCount: number;
     fileCount: number;
     selectionMode: boolean;
-    onnavigate: (prefix: string) => void;
+    onNavigate: (prefix: string) => void;
     onToggleSelectionMode: () => void;
   }
 
@@ -18,7 +18,7 @@
     folderCount,
     fileCount,
     selectionMode,
-    onnavigate,
+    onNavigate,
     onToggleSelectionMode
   }: Props = $props();
 
@@ -71,7 +71,7 @@
           py-0.5 transition-colors hover:cursor-pointer
         "
         title={bucket}
-        onclick={() => onnavigate('')}
+        onclick={() => onNavigate('')}
       >
         <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
         {bucket}
@@ -112,7 +112,7 @@
                   text-sm
                   hover:cursor-pointer
                 "
-                onclick={() => onnavigate(part.prefix)}
+                onclick={() => onNavigate(part.prefix)}
               >
                 {part.label}
               </button>
@@ -146,7 +146,7 @@
             py-0.5 transition-colors hover:cursor-pointer
           "
           title={part.label}
-          onclick={() => onnavigate(part.prefix)}
+          onclick={() => onNavigate(part.prefix)}
         >
           {part.label}
         </button>
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index b428774b..b5049759 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -34,5 +34,5 @@
   bucket={data.bucket}
   objects={data.objects}
   prefix={data.prefix}
-  onnavigate={handleNavigate}
+  onNavigate={handleNavigate}
 />

From 888681454d69429201cbd4b2430db76e7c485771 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 12 May 2026 13:55:58 +0200
Subject: [PATCH 026/136] #91 - Feat/s3 filebrowser downloads (#116)

* feat: implement single-file download functionality and error handling for S3 storage

* feat: refactor S3 download endpoint to use new API structure and improve error handling

* chore: remove obsolete note about static download route segment in tech debt documentation

* style: format code

* fix: improve type safety in S3 error handling

* fix: preview action

* feat: add context menu header and improve file selection handling in FileExplorer

* fix: reset selection state on context menu close and refine download action logic

* style: format files

* style: remove pointer events from Actions row on ContextMenu

* #91 fix lint

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 TECH_DEBT.md                                  |  8 ++
 messages/de.json                              | 10 +-
 messages/en.json                              | 10 +-
 package-lock.json                             | 86 +++--------------
 src/lib/components/ToastHost.svelte           | 38 ++++++++
 src/lib/components/storage/ContextMenu.svelte | 26 +++++-
 .../components/storage/FileExplorer.svelte    | 80 +++++++++++-----
 src/lib/components/storage/ObjectTable.svelte |  4 +-
 .../components/storage/actions/download.ts    | 19 ++++
 src/lib/components/storage/actions/errors.ts  | 18 ++++
 src/lib/components/storage/actions/index.ts   | 18 ++++
 src/lib/components/storage/actions/preview.ts |  8 ++
 src/lib/components/storage/actions/types.ts   | 20 ++++
 src/lib/server/storage/hdfs-provider.ts       |  4 +-
 src/lib/server/storage/preview/stream.ts      |  4 +-
 src/lib/server/storage/provider.ts            | 10 +-
 src/lib/server/storage/s3-client.ts           | 19 ++++
 src/lib/server/storage/s3-errors.ts           | 54 +++++++++++
 src/lib/server/storage/s3-provider.ts         | 40 ++++----
 src/lib/server/storage/service.ts             | 79 +++++++++-------
 src/lib/server/storage/utils.ts               | 17 ++++
 src/lib/storage/download.ts                   | 75 +++++++++++++++
 src/lib/stores/toast.svelte.ts                | 22 +++++
 src/routes/(app)/+layout.svelte               |  3 +
 .../(app)/storage/api/download/+server.ts     | 92 +++++++++++++++++++
 25 files changed, 597 insertions(+), 167 deletions(-)
 create mode 100644 src/lib/components/ToastHost.svelte
 create mode 100644 src/lib/components/storage/actions/download.ts
 create mode 100644 src/lib/components/storage/actions/errors.ts
 create mode 100644 src/lib/components/storage/actions/index.ts
 create mode 100644 src/lib/components/storage/actions/preview.ts
 create mode 100644 src/lib/components/storage/actions/types.ts
 create mode 100644 src/lib/server/storage/s3-client.ts
 create mode 100644 src/lib/server/storage/s3-errors.ts
 create mode 100644 src/lib/server/storage/utils.ts
 create mode 100644 src/lib/storage/download.ts
 create mode 100644 src/lib/stores/toast.svelte.ts
 create mode 100644 src/routes/(app)/storage/api/download/+server.ts

diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 892ce56e..a46d0986 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -78,6 +78,14 @@ All server-side query state (progress, rows, status) is held in a module-level `
 
 ---
 
+### Single-file download limit
+
+**File:** `src/lib/storage/download.ts`, `src/lib/components/storage/FileExplorer.svelte`
+
+The Download action is intentionally restricted to a single file at a time. Multi-file or folder downloads (e.g. zipping selected items on the fly) are deferred to a future ticket. Until then, the Download button is disabled whenever more than one item is selected and is always disabled for directories.
+
+---
+
 ### Completed query results are ephemeral (30-minute TTL)
 
 **File:** `src/lib/server/query-store.ts`
diff --git a/messages/de.json b/messages/de.json
index 77721278..78ccb209 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -165,6 +165,13 @@
   "storage_error_storage_error": "Beim Zugriff auf den Bucket \u201e{bucket}\u201c ist ein Fehler aufgetreten.",
   "storage_error_back_to_storage": "Zurück zum Speicher",
   "storage_error_go_back": "Zurück",
+  "storage_download_error_title": "Download fehlgeschlagen",
+  "storage_download_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
+  "storage_download_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung, diese Datei herunterzuladen.",
+  "storage_download_error_not_found": "Datei nicht gefunden. Sie wurde möglicherweise verschoben oder gelöscht.",
+  "storage_download_error_server_error": "Beim Herunterladen der Datei ist ein Serverfehler aufgetreten. Bitte versuchen Sie es erneut.",
+  "storage_download_error_unknown": "Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es erneut.",
+  "storage_download_dismiss": "Schließen",
   "storage_header_name": "Name",
   "storage_header_size": "Größe",
   "storage_header_last_modified": "Zuletzt geändert",
@@ -191,5 +198,6 @@
   "storage_preview_image_alt": "Vorschau von {name}",
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
-  "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau."
+  "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
+  "storage_context_menu_actions": "Aktionen"
 }
diff --git a/messages/en.json b/messages/en.json
index 28268cff..115276ea 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -165,6 +165,13 @@
   "storage_error_storage_error": "An error occurred while accessing the bucket \u201c{bucket}\u201d.",
   "storage_error_back_to_storage": "Back to storage",
   "storage_error_go_back": "Go back",
+  "storage_download_error_title": "Download failed",
+  "storage_download_error_not_connected": "No storage connection configured. Please connect first.",
+  "storage_download_error_access_denied": "Access denied. You do not have permission to download this file.",
+  "storage_download_error_not_found": "File not found. It may have been moved or deleted.",
+  "storage_download_error_server_error": "A server error occurred while downloading the file. Please try again.",
+  "storage_download_error_unknown": "An unexpected error occurred. Please try again.",
+  "storage_download_dismiss": "Dismiss",
   "storage_header_name": "Name",
   "storage_header_size": "Size",
   "storage_header_last_modified": "Last modified",
@@ -191,5 +198,6 @@
   "storage_preview_image_alt": "Preview of {name}",
   "storage_preview_csv_rows": "Showing first {count} rows",
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
-  "storage_preview_pdf_too_large": "PDF is too large to preview inline."
+  "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
+  "storage_context_menu_actions": "Actions"
 }
diff --git a/package-lock.json b/package-lock.json
index 70e67b31..b3924792 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1181,7 +1181,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1198,7 +1197,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1215,7 +1213,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1232,7 +1229,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1249,7 +1245,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1266,7 +1261,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1283,7 +1277,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1300,7 +1293,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1317,7 +1309,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1334,7 +1325,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1351,7 +1341,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1368,7 +1357,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1385,7 +1373,6 @@
       "cpu": [
         "mips64el"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1402,7 +1389,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1419,7 +1405,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1436,7 +1421,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1453,7 +1437,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1470,7 +1453,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1487,7 +1469,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1504,7 +1485,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1521,7 +1501,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1538,7 +1517,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1555,7 +1533,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1572,7 +1549,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1589,7 +1565,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2654,7 +2629,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2668,7 +2642,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2682,7 +2655,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2696,7 +2668,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2710,7 +2681,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2724,7 +2694,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2738,7 +2707,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2752,7 +2720,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2766,7 +2733,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2780,7 +2746,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2794,7 +2759,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2808,7 +2772,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2822,7 +2785,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2836,7 +2798,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2850,7 +2811,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2864,7 +2824,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2878,7 +2837,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2892,7 +2850,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2906,7 +2863,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2920,7 +2876,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2934,7 +2889,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2948,7 +2902,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2962,7 +2915,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2976,7 +2928,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2990,7 +2941,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -4221,7 +4171,7 @@
       "version": "24.10.13",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.13.tgz",
       "integrity": "sha512-oH72nZRfDv9lADUBSo104Aq7gPHpQZc4BTx38r9xf9pg5LfP6EzSyH2n7qFmmxRQXh7YlUXODcYsg6PuTDSxGg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "undici-types": "~7.16.0"
@@ -4639,7 +4589,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.0.18.tgz",
       "integrity": "sha512-gVQqh7paBz3gC+ZdcCmNSWJMk70IUjDeVqi+5m5vYpEHsIwRgw3Y545jljtajhkekIpIp5Gg8oK7bctgY0E2Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/mocker": "4.0.18",
@@ -4662,7 +4612,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.0.18.tgz",
       "integrity": "sha512-gfajTHVCiwpxRj1qh0Sh/5bbGLG4F/ZH/V9xvFVoFddpITfMta9YGow0W6ZpTTORv2vdJuz9TnrNSmjKvpOf4g==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/browser": "4.0.18",
@@ -6003,7 +5953,7 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
       "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">=8"
@@ -7055,7 +7005,6 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
       "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -7874,7 +7823,7 @@
       "version": "1.31.1",
       "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
       "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MPL-2.0",
       "dependencies": {
         "detect-libc": "^2.0.3"
@@ -7907,7 +7856,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7928,7 +7876,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7949,7 +7896,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7970,7 +7916,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7991,7 +7936,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8012,7 +7956,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8033,7 +7976,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8054,7 +7996,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8075,7 +8016,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8096,7 +8036,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8117,7 +8056,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -9318,7 +9256,7 @@
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
       "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "pngjs": "^7.0.0"
@@ -9343,7 +9281,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
       "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "playwright-core": "1.58.2"
@@ -9362,7 +9300,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
       "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
@@ -9375,7 +9313,7 @@
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
       "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14.19.0"
@@ -11553,7 +11491,7 @@
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
       "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/unicode-properties": {
@@ -11798,7 +11736,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11854,7 +11791,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -12166,7 +12102,7 @@
       "version": "8.19.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
       "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
diff --git a/src/lib/components/ToastHost.svelte b/src/lib/components/ToastHost.svelte
new file mode 100644
index 00000000..4b4a3b91
--- /dev/null
+++ b/src/lib/components/ToastHost.svelte
@@ -0,0 +1,38 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import { toasts, removeToast, type ToastType } from '$lib/stores/toast.svelte.js';
+
+  const iconMap: Record<ToastType, string> = {
+    info: 'material-symbols:info',
+    success: 'material-symbols:check-circle',
+    warning: 'material-symbols:warning',
+    error: 'material-symbols:error'
+  };
+
+  const alertClassMap: Record<ToastType, string> = {
+    info: 'alert-info',
+    success: 'alert-success',
+    warning: 'alert-warning',
+    error: 'alert-error'
+  };
+</script>
+
+<!-- Positioned fixed at the bottom-end corner, above everything -->
+<div class="toast toast-end toast-bottom z-100 gap-2" aria-live="polite" aria-atomic="false">
+  {#each toasts as toast (toast.id)}
+    <div
+      role="alert"
+      class="alert {alertClassMap[toast.type]} flex max-w-sm items-start gap-2 shadow-lg"
+    >
+      <Icon icon={iconMap[toast.type]} class="mt-0.5 h-5 w-5 shrink-0" aria-hidden="true" />
+      <span class="flex-1 text-sm">{toast.message}</span>
+      <button
+        class="btn btn-ghost btn-xs ml-1 shrink-0"
+        aria-label="Dismiss"
+        onclick={() => removeToast(toast.id)}
+      >
+        <Icon icon="material-symbols:close" class="h-4 w-4" aria-hidden="true" />
+      </button>
+    </div>
+  {/each}
+</div>
diff --git a/src/lib/components/storage/ContextMenu.svelte b/src/lib/components/storage/ContextMenu.svelte
index 751cd815..23063d2c 100644
--- a/src/lib/components/storage/ContextMenu.svelte
+++ b/src/lib/components/storage/ContextMenu.svelte
@@ -96,13 +96,33 @@
   tabindex="-1"
   style="left: {adjustedPos.left}px; top: {adjustedPos.top}px;"
 >
+  <li class="menu-title p-0" role="none">
+    <div class="menu-title flex items-center justify-between py-1 pr-0 pl-2">
+      <span class="text-base-content/70 text-xs font-medium">
+        {m.storage_context_menu_actions()}
+      </span>
+
+      <button
+        type="button"
+        role="menuitem"
+        class="btn btn-ghost btn-xs"
+        aria-label="Close"
+        onclick={onclose}
+      >
+        <Icon icon="mdi:close" class="size-4" aria-hidden="true" />
+      </button>
+    </div>
+  </li>
+
   {#each actions as act (act.key)}
-    <li role="none">
+    {@const disabled = act.disabled()}
+    <li role="none" class:menu-disabled={disabled}>
       <button
         role="menuitem"
         class="justify-start"
         onclick={() => emit(act.key)}
-        disabled={act.disabled()}
+        {disabled}
+        aria-disabled={disabled}
       >
         <Icon icon={act.icon} class="mr-2 size-4 shrink-0" aria-hidden="true" />
         {act.label()}
@@ -110,8 +130,6 @@
     </li>
   {/each}
 
-  <li class="menu-title" role="none"><span>{m.storage_danger_zone()}</span></li>
-
   {#each dangerActions as act (act.key)}
     <li role="none">
       <button
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 971260ff..d4da78e4 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -7,6 +7,10 @@
   import Pagination from '$lib/components/Pagination.svelte';
   import type { StoragePage } from '$lib/storage/types.js';
   import { SvelteSet } from 'svelte/reactivity';
+  import { executeAction } from './actions/index.js';
+  import { ActionError } from './actions/types.js';
+  import { getActionErrorMessage } from './actions/errors.js';
+  import { addToast } from '$lib/stores/toast.svelte.js';
 
   import { initPageSize, type PageSize } from '$lib/types/pagination.js';
 
@@ -125,9 +129,17 @@
 
   let ctxKey = $state<string | null>(null);
 
+  const ctxFileObj = $derived(ctxKey ? (files.find((f) => f.key === ctxKey) ?? null) : null);
+  const ctxIsFile = $derived(ctxFileObj !== null);
+
   function openContextMenu(e: MouseEvent, key: string) {
     e.preventDefault();
     e.stopPropagation();
+
+    if (!selectedKeys.has(key)) {
+      selectedKeys = selectedKeys.size === 0 ? new SvelteSet<string>([key]) : selectedKeys.add(key);
+    }
+
     ctxKey = key;
     ctxMenu = { x: e.clientX, y: e.clientY };
   }
@@ -138,32 +150,42 @@
   let previewKey = $state<string | null>(null);
 
   // ── Action dispatch ───────────────────────────────────────────────────────
-  function handleAction(action: string) {
-    switch (action) {
-      case 'preview': {
-        // Prefer selection; fall back to the context menu target (if it's a file, not a folder)
-        const ctxFile = ctxKey && files.find((f) => f.key === ctxKey) ? ctxKey : null;
-        const key = selectedFiles[0]?.key ?? ctxFile;
-        if (key) {
-          previewKey = key;
+
+  async function handleAction(action: string) {
+    const ctxFile = ctxKey && files.find((f) => f.key === ctxKey) ? ctxKey : null;
+    const key = ctxFile ?? selectedFiles[0]?.key;
+
+    // Effective selection for context actions:
+    const effectiveSelectedFiles = ctxFile
+      ? [files.find((f) => f.key === ctxFile)!]
+      : selectedFiles;
+
+    const effectiveSelectedKeys = ctxFile ? [ctxFile] : [...selectedKeys];
+
+    const ctx = {
+      bucket,
+      key,
+      selectedKeys: effectiveSelectedKeys,
+      selectedFiles: effectiveSelectedFiles
+    };
+
+    try {
+      if (action === 'download' || action === 'upload' || action === 'preview') {
+        const res = await executeAction(action, ctx);
+        if (res?.previewKey) {
+          previewKey = res.previewKey;
           showPreviewModal = true;
+        } else if (res?.unimplemented) {
+          addToast('warning', `${action} — not implemented`);
         }
-        break;
+      } else {
+        addToast('warning', `${action} — not implemented`);
       }
-      case 'rename':
-        alert(m.storage_action_rename() + ' — not implemented');
-        break;
-      case 'download':
-        alert(m.storage_action_download() + ' — not implemented');
-        break;
-      case 'move':
-        alert(m.storage_action_move() + ' — not implemented');
-        break;
-      case 'delete':
-        alert(m.storage_action_delete() + ' — not implemented');
-        break;
-      default:
-        alert(`${action} — not implemented`);
+    } catch (err: unknown) {
+      addToast(
+        'error',
+        err instanceof ActionError ? getActionErrorMessage(err) : m.storage_download_error_unknown()
+      );
     }
   }
 
@@ -172,7 +194,15 @@
     if (showDeleteModal) return;
     if (e.key === 'Delete' && selectedKeys.size > 0) showDeleteModal = true;
     else if (e.key === 'F2' && selectedKeys.size === 1) handleAction('rename');
-    else if (e.key === 'Escape') selectedKeys = new SvelteSet<string>();
+    else if (e.key === 'Escape') {
+      if (ctxMenu) {
+        selectedKeys.delete(ctxKey!);
+        ctxMenu = null;
+        ctxKey = null;
+      }
+      selectionMode = false;
+      selectedKeys = new SvelteSet<string>();
+    }
   }
 </script>
 
@@ -253,7 +283,7 @@
     selectionCount={selectedKeys.size}
     canPreview={(selectedFiles.length === 1 && selectedFolders.length === 0) ||
       (ctxKey !== null && files.some((f) => f.key === ctxKey))}
-    canDownload={selectedFiles.length > 0}
+    canDownload={selectedFiles.length > 0 || ctxIsFile}
     onAction={handleAction}
     onClose={() => {
       ctxMenu = null;
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
index 7f05324d..ae71ab3b 100644
--- a/src/lib/components/storage/ObjectTable.svelte
+++ b/src/lib/components/storage/ObjectTable.svelte
@@ -48,7 +48,9 @@
     (selectedFileCount === 1 && folders.filter((f) => selectedKeys.has(f.key)).length === 0) ||
       (folders.filter((f) => selectedKeys.has(f.key)).length === 1 && selectedFileCount === 0)
   );
-  const canDownload = $derived(selectedFileCount > 0);
+  const canDownload = $derived(
+    selectedFileCount === 1 && folders.filter((f) => selectedKeys.has(f.key)).length === 0
+  );
 
   let selectAllEl = $state<HTMLInputElement | null>(null);
   $effect(() => {
diff --git a/src/lib/components/storage/actions/download.ts b/src/lib/components/storage/actions/download.ts
new file mode 100644
index 00000000..c9bad028
--- /dev/null
+++ b/src/lib/components/storage/actions/download.ts
@@ -0,0 +1,19 @@
+import type { ActionContext, ActionResult } from './types';
+import { ActionError } from './types';
+import { downloadObject as clientDownload, DownloadError } from '$lib/storage/download.js';
+
+export default async function downloadAction(ctx: ActionContext): Promise<ActionResult> {
+  const key = ctx.key ?? ctx.selectedFiles?.[0]?.key;
+  if (!key) throw new ActionError('no_key', 'No key specified for download');
+
+  try {
+    await clientDownload(ctx.bucket, key);
+    return { success: true };
+  } catch (err: unknown) {
+    if (err instanceof DownloadError) {
+      // map DownloadError to ActionError so callers only need to handle ActionError
+      throw new ActionError(err.code, err.message);
+    }
+    throw err;
+  }
+}
diff --git a/src/lib/components/storage/actions/errors.ts b/src/lib/components/storage/actions/errors.ts
new file mode 100644
index 00000000..0568933f
--- /dev/null
+++ b/src/lib/components/storage/actions/errors.ts
@@ -0,0 +1,18 @@
+import * as m from '$lib/paraglide/messages.js';
+import type { ActionError } from './types.js';
+
+/** Map an ActionError to a localised user-facing string. */
+export function getActionErrorMessage(err: ActionError): string {
+  switch (err.code) {
+    case 'not_connected':
+      return m.storage_download_error_not_connected();
+    case 'access_denied':
+      return m.storage_download_error_access_denied();
+    case 'not_found':
+      return m.storage_download_error_not_found();
+    case 'server_error':
+      return m.storage_download_error_server_error();
+    default:
+      return m.storage_download_error_unknown();
+  }
+}
diff --git a/src/lib/components/storage/actions/index.ts b/src/lib/components/storage/actions/index.ts
new file mode 100644
index 00000000..98eb4a25
--- /dev/null
+++ b/src/lib/components/storage/actions/index.ts
@@ -0,0 +1,18 @@
+import type { ActionContext, ActionResult, ActionName } from './types';
+import download from './download';
+import preview from './preview';
+
+const actions: Record<ActionName, (ctx: ActionContext) => Promise<ActionResult>> = {
+  download,
+  upload: async () => ({ unimplemented: true }),
+  preview,
+  delete: async () => ({ unimplemented: true })
+};
+
+export async function executeAction(name: ActionName, ctx: ActionContext): Promise<ActionResult> {
+  const handler = actions[name];
+  if (!handler) return { unimplemented: true };
+  return await handler(ctx);
+}
+
+export { actions };
diff --git a/src/lib/components/storage/actions/preview.ts b/src/lib/components/storage/actions/preview.ts
new file mode 100644
index 00000000..ad3337c1
--- /dev/null
+++ b/src/lib/components/storage/actions/preview.ts
@@ -0,0 +1,8 @@
+import type { ActionContext, ActionResult } from './types';
+import { ActionError } from './types';
+
+export default async function previewAction(ctx: ActionContext): Promise<ActionResult> {
+  const key = ctx.key ?? ctx.selectedFiles?.[0]?.key;
+  if (!key) throw new ActionError('no_key', 'No key specified for preview');
+  return { previewKey: key };
+}
diff --git a/src/lib/components/storage/actions/types.ts b/src/lib/components/storage/actions/types.ts
new file mode 100644
index 00000000..a262e3e1
--- /dev/null
+++ b/src/lib/components/storage/actions/types.ts
@@ -0,0 +1,20 @@
+export type ActionResult = { success?: true; unimplemented?: true; previewKey?: string };
+
+export type ActionName = 'download' | 'upload' | 'preview' | 'delete';
+
+export class ActionError extends Error {
+  constructor(
+    public readonly code: string,
+    message: string
+  ) {
+    super(message);
+    this.name = 'ActionError';
+  }
+}
+
+export type ActionContext = {
+  bucket: string;
+  key?: string;
+  selectedKeys?: string[];
+  selectedFiles?: Array<{ key: string }>;
+};
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 3ac254ef..73e91c8d 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -1,4 +1,4 @@
-import type { StorageProvider } from './provider.js';
+import type { StorageProvider, ObjectDownload } from './provider.js';
 import type { HDFSConfig } from './types.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
@@ -18,7 +18,7 @@ export class HDFSStorageProvider implements StorageProvider {
     throw new Error('HDFS not implemented');
   }
 
-  getObject(_key: string): Promise<ReadableStream> {
+  getObject(_key: string): Promise<ObjectDownload> {
     throw new Error('HDFS not implemented');
   }
 
diff --git a/src/lib/server/storage/preview/stream.ts b/src/lib/server/storage/preview/stream.ts
index 69a42141..6617f2ee 100644
--- a/src/lib/server/storage/preview/stream.ts
+++ b/src/lib/server/storage/preview/stream.ts
@@ -41,10 +41,10 @@ export async function streamPreview(
 
   const stream =
     previewBytes === totalSize
-      ? await provider.getObject(key)
+      ? (await provider.getObject(key)).stream
       : await provider.getObjectRange(key, 0, previewBytes - 1);
 
-  return new Response(stream as ReadableStream, {
+  return new Response(stream, {
     headers: {
       'Content-Type': contentType,
       'X-Preview-Renderable': 'true',
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index e09ca065..1c8fbc10 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -1,5 +1,13 @@
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
+/** Metadata and body stream returned when fetching a storage object. */
+export interface ObjectDownload {
+  stream: ReadableStream;
+  contentType?: string;
+  contentLength?: number;
+  etag?: string;
+}
+
 /** Backend-agnostic interface for a bucket-scoped storage provider. */
 export interface StorageProvider {
   /**
@@ -12,7 +20,7 @@ export interface StorageProvider {
     pageSize: number,
     continuationToken?: string | null
   ): Promise<StoragePage>;
-  getObject(key: string): Promise<ReadableStream>;
+  getObject(key: string): Promise<ObjectDownload>;
   /**
    * Fetch a byte range of an object. Both `start` and `end` are inclusive,
    * following the HTTP `Range: bytes=start-end` convention.
diff --git a/src/lib/server/storage/s3-client.ts b/src/lib/server/storage/s3-client.ts
new file mode 100644
index 00000000..aa40136b
--- /dev/null
+++ b/src/lib/server/storage/s3-client.ts
@@ -0,0 +1,19 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import type { S3ConnectionConfig } from './types.js';
+
+export function createS3Client(config: S3ConnectionConfig): S3Client {
+  return new S3Client({
+    region: config.region,
+    ...(config.endpoint && {
+      endpoint: config.endpoint,
+      forcePathStyle: true
+    }),
+    ...(config.accessKeyId &&
+      config.secretAccessKey && {
+        credentials: {
+          accessKeyId: config.accessKeyId,
+          secretAccessKey: config.secretAccessKey
+        }
+      })
+  });
+}
diff --git a/src/lib/server/storage/s3-errors.ts b/src/lib/server/storage/s3-errors.ts
new file mode 100644
index 00000000..707f9f13
--- /dev/null
+++ b/src/lib/server/storage/s3-errors.ts
@@ -0,0 +1,54 @@
+import { S3ServiceException } from '@aws-sdk/client-s3';
+import { error } from '@sveltejs/kit';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 's3-errors' });
+
+type Context = { bucket?: string; key?: string; operation?: string };
+
+function isS3ServiceException(err: unknown): err is S3ServiceException {
+  return err instanceof S3ServiceException;
+}
+
+function getHttpStatus(err: S3ServiceException): number | undefined {
+  return err.$metadata?.httpStatusCode;
+}
+
+function isAccessDenied(code: string, httpStatus?: number): boolean {
+  return code === 'AccessDenied' || httpStatus === 403;
+}
+
+function isNotFound(code: string, httpStatus?: number): boolean {
+  return code === 'NoSuchKey' || code === 'NoSuchBucket' || httpStatus === 404;
+}
+
+function notFoundMessage(context: Context): string {
+  if (context.key) return `Object "${context.key}" not found`;
+  if (context.bucket) return `Bucket "${context.bucket}" not found`;
+  return 'Not found';
+}
+
+function accessDeniedMessage(context: Context): string {
+  return context.key ? `Access denied to "${context.key}"` : 'Access denied';
+}
+
+export function mapS3ErrorToHttp(err: unknown, context: Context): never {
+  if (!isS3ServiceException(err)) {
+    throw err;
+  }
+
+  const code = err.name;
+  const httpStatus = getHttpStatus(err);
+
+  log.warn({ ...context, error_code: code }, 'S3 error');
+
+  if (isAccessDenied(code, httpStatus)) {
+    throw error(403, accessDeniedMessage(context));
+  }
+
+  if (isNotFound(code, httpStatus)) {
+    throw error(404, notFoundMessage(context));
+  }
+
+  throw error(502, `Storage error: ${(err as Error).message}`);
+}
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index b4196903..87009f8c 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -1,14 +1,16 @@
 import {
   S3Client,
+  S3ServiceException,
   ListObjectsV2Command,
   GetObjectCommand,
   HeadObjectCommand,
   type ListObjectsV2CommandOutput
 } from '@aws-sdk/client-s3';
-import type { StorageProvider } from './provider.js';
+import type { StorageProvider, ObjectDownload } from './provider.js';
 import type { S3Config } from './types.js';
 import type { StoragePage, StorageObject, StorageMetadata } from '$lib/storage/types.js';
 import { logger } from '$lib/server/logging';
+import { createS3Client } from './s3-client.js';
 
 const log = logger.child({ module: 's3-provider' });
 
@@ -16,22 +18,9 @@ export class S3StorageProvider implements StorageProvider {
   private readonly client: S3Client;
   private readonly bucket: string;
 
-  constructor(config: S3Config) {
+  constructor(config: S3Config, client?: S3Client) {
     this.bucket = config.bucket;
-    this.client = new S3Client({
-      region: config.region,
-      ...(config.endpoint && {
-        endpoint: config.endpoint,
-        forcePathStyle: true
-      }),
-      ...(config.accessKeyId &&
-        config.secretAccessKey && {
-          credentials: {
-            accessKeyId: config.accessKeyId,
-            secretAccessKey: config.secretAccessKey
-          }
-        })
-    });
+    this.client = client ?? createS3Client(config);
   }
 
   async listObjects(
@@ -81,13 +70,18 @@ export class S3StorageProvider implements StorageProvider {
     };
   }
 
-  async getObject(key: string): Promise<ReadableStream> {
+  async getObject(key: string): Promise<ObjectDownload> {
     log.debug({ bucket: this.bucket, key }, 'getting object');
     const output = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
     if (!output.Body) {
       throw new Error(`Object ${key} has no body`);
     }
-    return output.Body.transformToWebStream();
+    return {
+      stream: output.Body.transformToWebStream(),
+      contentType: output.ContentType,
+      contentLength: output.ContentLength,
+      etag: output.ETag
+    };
   }
 
   async getObjectRange(key: string, start: number, end: number): Promise<ReadableStream> {
@@ -117,8 +111,14 @@ export class S3StorageProvider implements StorageProvider {
     try {
       await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
       return true;
-    } catch {
-      return false;
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        const code = err.name;
+        if (code === 'NoSuchKey' || code === 'NotFound' || err.$metadata?.httpStatusCode === 404) {
+          return false;
+        }
+      }
+      throw err;
     }
   }
 }
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index 38fa59a1..b1506467 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -1,9 +1,11 @@
-import { S3Client, ListBucketsCommand, S3ServiceException } from '@aws-sdk/client-s3';
-import { error } from '@sveltejs/kit';
+import { S3ServiceException, ListBucketsCommand } from '@aws-sdk/client-s3';
 import { getUserConnection, setUserConnection, clearUserConnection } from './user-connections.js';
-import { StorageProviderFactory } from './factory.js';
 import type { S3ConnectionConfig } from './types.js';
-import type { StoragePage } from '$lib/storage/types.js';
+import { createS3Client } from './s3-client.js';
+import { mapS3ErrorToHttp } from './s3-errors.js';
+import { getProviderForUser } from './utils.js';
+import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
+import type { ObjectDownload } from './provider.js';
 import { logger } from '$lib/server/logging';
 
 const log = logger.child({ module: 'storage-service' });
@@ -17,20 +19,7 @@ export async function listBuckets(userId: string): Promise<string[]> {
   const config = getUserConnection(userId);
   if (!config) return [];
 
-  const client = new S3Client({
-    region: config.region,
-    ...(config.endpoint && {
-      endpoint: config.endpoint,
-      forcePathStyle: true
-    }),
-    ...(config.accessKeyId &&
-      config.secretAccessKey && {
-        credentials: {
-          accessKeyId: config.accessKeyId,
-          secretAccessKey: config.secretAccessKey
-        }
-      })
-  });
+  const client = createS3Client(config);
 
   const output = await client.send(new ListBucketsCommand({}));
   const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
@@ -46,32 +35,52 @@ export async function listObjects(
   pageSize: number,
   continuationToken?: string | null
 ): Promise<StoragePage> {
-  const connection = getUserConnection(userId);
+  const provider = getProviderForUser(userId, bucket);
 
-  if (!connection) {
-    throw error(401, 'No storage connection configured');
+  try {
+    return await provider.listObjects(prefix, pageSize, continuationToken ?? undefined);
+  } catch (err) {
+    if (err instanceof S3ServiceException) {
+      mapS3ErrorToHttp(err, { bucket, operation: 'listObjects' });
+    }
+    throw err;
   }
+}
+/** Download a single object from the bucket, returning a stream and metadata for the HTTP response. */
+export async function downloadObject(
+  userId: string,
+  bucket: string,
+  key: string
+): Promise<ObjectDownload> {
+  const provider = getProviderForUser(userId, bucket);
 
-  if (connection.type !== 's3') {
-    throw error(400, 'Storage backend not supported');
+  try {
+    log.debug({ user_id: userId, bucket, key }, 'downloading object');
+    const download = await provider.getObject(key);
+    log.info({ user_id: userId, bucket, key }, 'object download started');
+    return download;
+  } catch (err) {
+    if (err instanceof S3ServiceException) {
+      mapS3ErrorToHttp(err, { bucket, key, operation: 'getObject' });
+    }
+    throw err;
   }
+}
 
-  const provider = StorageProviderFactory.create({ ...connection, bucket });
+/** Fetch metadata for a single object — used for lightweight pre-flight checks. */
+export async function getObjectMetadata(
+  userId: string,
+  bucket: string,
+  key: string
+): Promise<StorageMetadata> {
+  const provider = getProviderForUser(userId, bucket);
 
   try {
-    return await provider.listObjects(prefix, pageSize, continuationToken ?? undefined);
+    log.debug({ user_id: userId, bucket, key }, 'getting object metadata');
+    return await provider.getMetadata(key);
   } catch (err) {
     if (err instanceof S3ServiceException) {
-      const code = err.name;
-      log.warn({ user_id: userId, bucket, prefix, error_code: code }, 'S3 error listing objects');
-
-      if (code === 'AccessDenied' || err.$metadata?.httpStatusCode === 403) {
-        throw error(403, `Access denied to bucket "${bucket}"`);
-      }
-      if (code === 'NoSuchBucket' || err.$metadata?.httpStatusCode === 404) {
-        throw error(404, `Bucket "${bucket}" not found`);
-      }
-      throw error(502, `Storage error: ${err.message}`);
+      mapS3ErrorToHttp(err, { bucket, key, operation: 'getMetadata' });
     }
     throw err;
   }
diff --git a/src/lib/server/storage/utils.ts b/src/lib/server/storage/utils.ts
new file mode 100644
index 00000000..c98a0d2c
--- /dev/null
+++ b/src/lib/server/storage/utils.ts
@@ -0,0 +1,17 @@
+import { error } from '@sveltejs/kit';
+import { getUserConnection } from './user-connections.js';
+import { StorageProviderFactory } from './factory.js';
+import type { StorageProvider } from './provider.js';
+
+export function getProviderForUser(userId: string, bucket: string): StorageProvider {
+  const connection = getUserConnection(userId);
+  if (!connection) {
+    throw error(401, 'No storage connection configured');
+  }
+
+  if (connection.type !== 's3') {
+    throw error(400, 'Storage backend not supported');
+  }
+
+  return StorageProviderFactory.create({ ...connection, bucket });
+}
diff --git a/src/lib/storage/download.ts b/src/lib/storage/download.ts
new file mode 100644
index 00000000..7f7ad963
--- /dev/null
+++ b/src/lib/storage/download.ts
@@ -0,0 +1,75 @@
+/**
+ * Client-side utility for downloading a single S3 object via the server proxy.
+ *
+ * Strategy:
+ *  1. Send a HEAD request to validate credentials and access rights without
+ *     transferring the object body (server uses HeadObject internally).
+ *  2. On error: throw a `DownloadError` with a typed `code` so the caller can
+ *     display a localised message.
+ *  3. On success: trigger a native browser download via a programmatic anchor
+ *     click. The browser streams the object directly to disk — no client-side
+ *     buffering occurs regardless of file size.
+ */
+
+export type DownloadErrorCode =
+  | 'not_connected'
+  | 'access_denied'
+  | 'not_found'
+  | 'server_error'
+  | 'unknown';
+
+export class DownloadError extends Error {
+  constructor(
+    public readonly code: DownloadErrorCode,
+    message: string
+  ) {
+    super(message);
+    this.name = 'DownloadError';
+  }
+}
+
+function buildDownloadUrl(bucket: string, key: string): string {
+  return `/storage/api/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
+}
+
+function mapStatusToCode(status: number): DownloadErrorCode {
+  if (status === 401) return 'not_connected';
+  if (status === 403) return 'access_denied';
+  if (status === 404) return 'not_found';
+  if (status >= 500) return 'server_error';
+  return 'unknown';
+}
+
+/**
+ * Download a single S3 object.
+ *
+ * Performs a HEAD pre-flight to surface auth and access errors as typed
+ * `DownloadError` exceptions, then triggers a native browser download for
+ * the actual transfer so the file streams straight to disk.
+ *
+ * @throws {DownloadError} when the server returns a non-2xx response on the
+ *   pre-flight check.
+ */
+export async function downloadObject(bucket: string, key: string): Promise<void> {
+  const url = buildDownloadUrl(bucket, key);
+
+  // Pre-flight: validate credentials and access without fetching the body.
+  const check = await fetch(url, { method: 'HEAD' });
+  if (!check.ok) {
+    const code = mapStatusToCode(check.status);
+    throw new DownloadError(code, `Download pre-flight failed with status ${check.status}`);
+  }
+
+  // Derive filename from the key (last path segment).
+  const filename = key.split('/').filter(Boolean).pop() ?? key;
+
+  // Trigger a native browser download. The browser sends the session cookie
+  // automatically and streams the response body directly to disk.
+  const anchor = document.createElement('a');
+  anchor.href = url;
+  anchor.download = filename;
+  anchor.style.display = 'none';
+  document.body.appendChild(anchor);
+  anchor.click();
+  document.body.removeChild(anchor);
+}
diff --git a/src/lib/stores/toast.svelte.ts b/src/lib/stores/toast.svelte.ts
new file mode 100644
index 00000000..7a405679
--- /dev/null
+++ b/src/lib/stores/toast.svelte.ts
@@ -0,0 +1,22 @@
+export type ToastType = 'info' | 'success' | 'warning' | 'error';
+
+interface Toast {
+  id: string;
+  type: ToastType;
+  message: string;
+}
+
+export const toasts = $state<Toast[]>([]);
+
+export function addToast(type: ToastType, message: string, durationMs = 5000): void {
+  const id = crypto.randomUUID();
+  toasts.push({ id, type, message });
+  if (durationMs > 0) {
+    setTimeout(() => removeToast(id), durationMs);
+  }
+}
+
+export function removeToast(id: string): void {
+  const idx = toasts.findIndex((t) => t.id === id);
+  if (idx !== -1) toasts.splice(idx, 1);
+}
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index e8bf57b9..1715f43a 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -3,6 +3,7 @@
   import * as m from '$lib/paraglide/messages.js';
   import Sidebar from '$lib/components/layout/sidebar/Sidebar.svelte';
   import Header from '$lib/components/layout/header/Header.svelte';
+  import ToastHost from '$lib/components/ToastHost.svelte';
 
   let { children, data } = $props();
 
@@ -46,3 +47,5 @@
     </main>
   </div>
 </div>
+
+<ToastHost />
diff --git a/src/routes/(app)/storage/api/download/+server.ts b/src/routes/(app)/storage/api/download/+server.ts
new file mode 100644
index 00000000..c57b3bdc
--- /dev/null
+++ b/src/routes/(app)/storage/api/download/+server.ts
@@ -0,0 +1,92 @@
+import type { RequestHandler } from './$types';
+import { error } from '@sveltejs/kit';
+import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
+import { getUserId } from '$lib/server/auth-utils.js';
+
+/** Derive the bare filename from a (possibly path-prefixed) object key. */
+function filenameFromKey(key: string): string {
+  return key.split('/').filter(Boolean).pop() ?? key;
+}
+
+/**
+ * GET /storage/api/download?bucket=<bucket>&key=<object-key>
+ *
+ * Proxies an S3 object directly to the client as a streaming download.
+ * Authentication is enforced by the app-level auth guard in hooks.server.ts.
+ * The S3 body stream is piped straight to the HTTP response — no server-side
+ * buffering occurs.
+ */
+export const GET: RequestHandler = async ({ locals, url }) => {
+  const bucket = url.searchParams.get('bucket');
+  if (!bucket || !bucket.trim()) {
+    throw error(400, 'Missing required query parameter: bucket');
+  }
+
+  const key = url.searchParams.get('key');
+  if (!key || !key.trim()) {
+    throw error(400, 'Missing required query parameter: key');
+  }
+
+  const userId = getUserId(locals);
+
+  locals.logger.debug({ bucket, key }, 'download request received');
+
+  const download = await downloadObject(userId, bucket, key);
+
+  const filename = filenameFromKey(key);
+  // RFC 5987 encoding for non-ASCII filenames in Content-Disposition
+  const encodedFilename = encodeURIComponent(filename);
+  const contentDisposition = `attachment; filename="${filename}"; filename*=UTF-8''${encodedFilename}`;
+
+  const headers: Record<string, string> = {
+    'Content-Disposition': contentDisposition,
+    'Content-Type': download.contentType ?? 'application/octet-stream',
+    'Cache-Control': 'private, no-store'
+  };
+
+  if (download.contentLength !== undefined) {
+    headers['Content-Length'] = String(download.contentLength);
+  }
+
+  if (download.etag) {
+    headers['ETag'] = download.etag;
+  }
+
+  locals.logger.info({ bucket, key, filename }, 'streaming object download');
+
+  return new Response(download.stream, { status: 200, headers });
+};
+
+/**
+ * HEAD /storage/api/download?bucket=<bucket>&key=<object-key>
+ *
+ * Lightweight pre-flight that validates credentials and access rights using
+ * a HeadObject call (no object body transferred). The client uses this before
+ * initiating a native browser download to surface auth/not-found errors as
+ * inline UI messages rather than browser download failures.
+ */
+export const HEAD: RequestHandler = async ({ locals, url }) => {
+  const bucket = url.searchParams.get('bucket');
+  if (!bucket || !bucket.trim()) {
+    throw error(400, 'Missing required query parameter: bucket');
+  }
+
+  const key = url.searchParams.get('key');
+  if (!key || !key.trim()) {
+    throw error(400, 'Missing required query parameter: key');
+  }
+
+  const userId = getUserId(locals);
+
+  locals.logger.debug({ bucket, key }, 'download pre-flight check');
+
+  const meta = await getObjectMetadata(userId, bucket, key);
+
+  return new Response(null, {
+    status: 200,
+    headers: {
+      'Content-Type': meta.contentType ?? 'application/octet-stream',
+      'Content-Length': String(meta.size)
+    }
+  });
+};

From d8e7d2a6c0a579968715e652eef156455abb1e54 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 12 May 2026 14:05:13 +0200
Subject: [PATCH 027/136] #121 check multiselect checkbox on ctrl click to
 enable multiselect (#122)

---
 src/lib/components/storage/FileExplorer.svelte | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index d4da78e4..16823ff6 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -55,6 +55,7 @@
 
   function toggleSelect(key: string, force = false) {
     if (force || selectionMode) {
+      if (force && !selectionMode) selectionMode = true;
       const next = new SvelteSet<string>(selectedKeys);
       if (next.has(key)) next.delete(key);
       else next.add(key);

From 3f5231b89b7befb1278c356c0d9c1946bc9e52f5 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 19 May 2026 09:41:42 +0200
Subject: [PATCH 028/136] #144 remove trailing slash on directory name

---
 src/lib/components/storage/FolderRow.svelte | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/lib/components/storage/FolderRow.svelte b/src/lib/components/storage/FolderRow.svelte
index be96fd46..f67c9214 100644
--- a/src/lib/components/storage/FolderRow.svelte
+++ b/src/lib/components/storage/FolderRow.svelte
@@ -64,7 +64,7 @@
         class="text-warning size-5 shrink-0"
         aria-hidden="true"
       />
-      <span class="font-medium">{keyToName(folder.key)}/</span>
+      <span class="font-medium">{keyToName(folder.key)}</span>
     </div>
   </td>
   <td class="text-base-content/30 text-right">—</td>

From 5f8c73927154315f427a1288106c9595a29bdfc7 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 19 May 2026 10:03:15 +0200
Subject: [PATCH 029/136] #94 S3 File Browser: Delete Action (#137)

* #94 add delete action

* #94 refactor, implement delete action in hdfs provider

* #94 cleaned up types, use paraglide pluralisation
---
 messages/de.json                              | 19 ++++++
 messages/en.json                              | 19 ++++++
 .../storage/DeleteConfirmModal.svelte         | 40 ++++++++++++
 .../components/storage/FileExplorer.svelte    | 62 +++++++++++++++++--
 src/lib/components/storage/actions/delete.ts  | 21 +++++++
 src/lib/components/storage/actions/index.ts   |  3 +-
 src/lib/components/storage/actions/types.ts   |  7 ++-
 src/lib/server/storage/hdfs-provider.ts       |  6 +-
 src/lib/server/storage/provider.ts            |  5 +-
 src/lib/server/storage/s3-provider.ts         | 28 ++++++++-
 src/lib/server/storage/service.ts             | 26 +++++++-
 src/lib/storage/delete.ts                     | 42 +++++++++++++
 src/lib/storage/types.ts                      |  5 ++
 .../(app)/storage/api/delete/+server.ts       | 35 +++++++++++
 14 files changed, 306 insertions(+), 12 deletions(-)
 create mode 100644 src/lib/components/storage/DeleteConfirmModal.svelte
 create mode 100644 src/lib/components/storage/actions/delete.ts
 create mode 100644 src/lib/storage/delete.ts
 create mode 100644 src/routes/(app)/storage/api/delete/+server.ts

diff --git a/messages/de.json b/messages/de.json
index 78ccb209..813bc669 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -172,6 +172,25 @@
   "storage_download_error_server_error": "Beim Herunterladen der Datei ist ein Serverfehler aufgetreten. Bitte versuchen Sie es erneut.",
   "storage_download_error_unknown": "Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es erneut.",
   "storage_download_dismiss": "Schließen",
+  "storage_delete_confirm_title_one": "\u201e{name}\u201c löschen?",
+  "storage_delete_confirm_title_many": "{count} Elemente löschen?",
+  "storage_delete_confirm_message": "Diese Aktion kann nicht rückgängig gemacht werden.",
+  "storage_delete_confirm_button": "Endgültig löschen",
+  "storage_delete_cancel": "Abbrechen",
+  "storage_delete_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
+  "storage_delete_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung, dieses Element zu löschen.",
+  "storage_delete_error_server_error": "Beim Löschen ist ein Serverfehler aufgetreten. Bitte versuchen Sie es erneut.",
+  "storage_delete_error_unknown": "Beim Löschen ist ein unerwarteter Fehler aufgetreten. Bitte versuchen Sie es erneut.",
+  "storage_delete_partial_failure": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element konnte nicht gelöscht werden.",
+        "countPlural=other": "{count} Elemente konnten nicht gelöscht werden."
+      }
+    }
+  ],
   "storage_header_name": "Name",
   "storage_header_size": "Größe",
   "storage_header_last_modified": "Zuletzt geändert",
diff --git a/messages/en.json b/messages/en.json
index 115276ea..98bdc15e 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -172,6 +172,25 @@
   "storage_download_error_server_error": "A server error occurred while downloading the file. Please try again.",
   "storage_download_error_unknown": "An unexpected error occurred. Please try again.",
   "storage_download_dismiss": "Dismiss",
+  "storage_delete_confirm_title_one": "Delete \"{name}\"?",
+  "storage_delete_confirm_title_many": "Delete {count} items?",
+  "storage_delete_confirm_message": "This action cannot be undone.",
+  "storage_delete_confirm_button": "Delete permanently",
+  "storage_delete_cancel": "Cancel",
+  "storage_delete_error_not_connected": "No storage connection configured. Please connect first.",
+  "storage_delete_error_access_denied": "Access denied. You do not have permission to delete this item.",
+  "storage_delete_error_server_error": "A server error occurred while deleting. Please try again.",
+  "storage_delete_error_unknown": "An unexpected error occurred while deleting. Please try again.",
+  "storage_delete_partial_failure": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 item could not be deleted.",
+        "countPlural=other": "{count} items could not be deleted."
+      }
+    }
+  ],
   "storage_header_name": "Name",
   "storage_header_size": "Size",
   "storage_header_last_modified": "Last modified",
diff --git a/src/lib/components/storage/DeleteConfirmModal.svelte b/src/lib/components/storage/DeleteConfirmModal.svelte
new file mode 100644
index 00000000..70db4e5c
--- /dev/null
+++ b/src/lib/components/storage/DeleteConfirmModal.svelte
@@ -0,0 +1,40 @@
+<script lang="ts">
+  import Modal from '$lib/components/Modal.svelte';
+  import Icon from '@iconify/svelte';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    open: boolean;
+    keys: string[];
+    onConfirm: () => void;
+    onCancel: () => void;
+  }
+
+  let { open = $bindable(), keys, onConfirm, onCancel }: Props = $props();
+
+  const count = $derived(keys.length);
+  const firstName = $derived(keys[0]?.split('/').filter(Boolean).pop() ?? '');
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box max-w-sm">
+    <h3 class="text-error mb-3 flex items-center gap-2 text-lg font-bold">
+      <Icon icon="material-symbols:delete-forever" class="size-5 shrink-0" aria-hidden="true" />
+      {count === 1
+        ? m.storage_delete_confirm_title_one({ name: firstName })
+        : m.storage_delete_confirm_title_many({ count })}
+    </h3>
+    <p class="text-base-content/80 text-sm">
+      {m.storage_delete_confirm_message()}
+    </p>
+    <div class="modal-action mt-6">
+      <button class="btn btn-ghost" onclick={onCancel}>
+        {m.storage_delete_cancel()}
+      </button>
+      <button class="btn btn-error" onclick={onConfirm}>
+        <Icon icon="material-symbols:delete-forever" class="size-4" aria-hidden="true" />
+        {m.storage_delete_confirm_button()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 16823ff6..28cb968d 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -11,6 +11,8 @@
   import { ActionError } from './actions/types.js';
   import { getActionErrorMessage } from './actions/errors.js';
   import { addToast } from '$lib/stores/toast.svelte.js';
+  import DeleteConfirmModal from './DeleteConfirmModal.svelte';
+  import { invalidateAll } from '$app/navigation';
 
   import { initPageSize, type PageSize } from '$lib/types/pagination.js';
 
@@ -83,14 +85,12 @@
 
   const selectedFiles = $derived(files.filter((f) => selectedKeys.has(f.key)));
   const selectedFolders = $derived(folders.filter((f) => selectedKeys.has(f.key)));
-  // TODO: This resolves once a modal for confirming deletion is implemented.
-  /* eslint-disable-next-line @typescript-eslint/no-unused-vars */
-  const deleteCount = $derived(selectedFiles.length + selectedFolders.length);
 
   const currentPage = $derived(prevTokens.length + 1);
 
   // ── Loading state ─────────────────────────────────────────────────────────
   let loading = $state(false);
+  let deleting = $state(false); // true while the delete API call is in flight
 
   // Clear loading when new objects arrive from the server
   $effect(() => {
@@ -147,6 +147,7 @@
 
   // ── Modal state ───────────────────────────────────────────────────────────
   let showDeleteModal = $state(false);
+  let pendingDeleteKeys = $state<string[]>([]);
   let showPreviewModal = $state(false);
   let previewKey = $state<string | null>(null);
 
@@ -170,6 +171,12 @@
       selectedFiles: effectiveSelectedFiles
     };
 
+    if (action === 'delete') {
+      pendingDeleteKeys = effectiveSelectedKeys;
+      showDeleteModal = true;
+      return;
+    }
+
     try {
       if (action === 'download' || action === 'upload' || action === 'preview') {
         const res = await executeAction(action, ctx);
@@ -190,11 +197,46 @@
     }
   }
 
+  async function confirmDelete() {
+    showDeleteModal = false;
+    const keys = pendingDeleteKeys;
+    pendingDeleteKeys = [];
+    deleting = true;
+    try {
+      const result = await executeAction('delete', { bucket, selectedKeys: keys });
+      if (result.failedKeys && result.failedKeys.length > 0) {
+        addToast('warning', m.storage_delete_partial_failure({ count: result.failedKeys.length }));
+      }
+      selectedKeys = new SvelteSet<string>();
+      selectionMode = false;
+      loading = true;
+      await invalidateAll();
+    } catch (err: unknown) {
+      loading = false;
+      let msg = m.storage_delete_error_unknown();
+      if (err instanceof ActionError) {
+        if (err.code === 'not_connected') msg = m.storage_delete_error_not_connected();
+        else if (err.code === 'access_denied') msg = m.storage_delete_error_access_denied();
+        else if (err.code === 'server_error') msg = m.storage_delete_error_server_error();
+      }
+      addToast('error', msg);
+    } finally {
+      deleting = false;
+    }
+  }
+
+  function cancelDelete() {
+    showDeleteModal = false;
+    pendingDeleteKeys = [];
+  }
+
   // ── Keyboard shortcuts ────────────────────────────────────────────────────
   function handleGlobalKeydown(e: KeyboardEvent) {
     if (showDeleteModal) return;
-    if (e.key === 'Delete' && selectedKeys.size > 0) showDeleteModal = true;
-    else if (e.key === 'F2' && selectedKeys.size === 1) handleAction('rename');
+    if (e.key === 'Delete' && selectedKeys.size > 0) {
+      pendingDeleteKeys = [...selectedKeys];
+      showDeleteModal = true;
+    } else if (e.key === 'F2' && selectedKeys.size === 1) handleAction('rename');
     else if (e.key === 'Escape') {
       if (ctxMenu) {
         selectedKeys.delete(ctxKey!);
@@ -228,7 +270,7 @@
   />
 
   <div class="relative flex-1 overflow-y-auto">
-    {#if loading}
+    {#if loading || deleting}
       <div
         class="
           bg-base-100/70 absolute inset-0 z-10 flex items-center justify-center
@@ -293,5 +335,13 @@
   />
 {/if}
 
+<!-- Delete confirmation modal -->
+<DeleteConfirmModal
+  bind:open={showDeleteModal}
+  keys={pendingDeleteKeys}
+  onConfirm={confirmDelete}
+  onCancel={cancelDelete}
+/>
+
 <!-- Preview modal -->
 <PreviewModal bind:open={showPreviewModal} {bucket} objectKey={previewKey} />
diff --git a/src/lib/components/storage/actions/delete.ts b/src/lib/components/storage/actions/delete.ts
new file mode 100644
index 00000000..ecdf3cfa
--- /dev/null
+++ b/src/lib/components/storage/actions/delete.ts
@@ -0,0 +1,21 @@
+import type { ActionContext, ActionResult } from './types';
+import { ActionError } from './types';
+import { deleteObjects as clientDelete, DeleteError } from '$lib/storage/delete.js';
+
+export default async function (ctx: ActionContext): Promise<ActionResult> {
+  const keys = ctx.selectedKeys ?? (ctx.key ? [ctx.key] : []);
+  if (!keys.length) throw new ActionError('no_key', 'No keys specified for deletion');
+
+  try {
+    const result = await clientDelete(ctx.bucket, keys);
+    return {
+      success: true,
+      failedKeys: result.failed.map((f) => ({ key: f.key, message: f.message }))
+    };
+  } catch (err: unknown) {
+    if (err instanceof DeleteError) {
+      throw new ActionError(err.code, err.message);
+    }
+    throw err;
+  }
+}
diff --git a/src/lib/components/storage/actions/index.ts b/src/lib/components/storage/actions/index.ts
index 98eb4a25..182e8649 100644
--- a/src/lib/components/storage/actions/index.ts
+++ b/src/lib/components/storage/actions/index.ts
@@ -1,12 +1,13 @@
 import type { ActionContext, ActionResult, ActionName } from './types';
 import download from './download';
 import preview from './preview';
+import deleteAction from './delete';
 
 const actions: Record<ActionName, (ctx: ActionContext) => Promise<ActionResult>> = {
   download,
   upload: async () => ({ unimplemented: true }),
   preview,
-  delete: async () => ({ unimplemented: true })
+  delete: deleteAction
 };
 
 export async function executeAction(name: ActionName, ctx: ActionContext): Promise<ActionResult> {
diff --git a/src/lib/components/storage/actions/types.ts b/src/lib/components/storage/actions/types.ts
index a262e3e1..d7da20a9 100644
--- a/src/lib/components/storage/actions/types.ts
+++ b/src/lib/components/storage/actions/types.ts
@@ -1,4 +1,9 @@
-export type ActionResult = { success?: true; unimplemented?: true; previewKey?: string };
+export type ActionResult = {
+  success?: true;
+  unimplemented?: true;
+  previewKey?: string;
+  failedKeys?: Array<{ key: string; message?: string }>;
+};
 
 export type ActionName = 'download' | 'upload' | 'preview' | 'delete';
 
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 73e91c8d..327fa26a 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -1,4 +1,4 @@
-import type { StorageProvider, ObjectDownload } from './provider.js';
+import type { StorageProvider, ObjectDownload, DeleteObjectsResult } from './provider.js';
 import type { HDFSConfig } from './types.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 
@@ -33,4 +33,8 @@ export class HDFSStorageProvider implements StorageProvider {
   exists(_key: string): Promise<boolean> {
     throw new Error('HDFS not implemented');
   }
+
+  deleteObjects(_keys: string[]): Promise<DeleteObjectsResult> {
+    throw new Error('HDFS not implemented');
+  }
 }
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index 1c8fbc10..bf488f16 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -1,4 +1,6 @@
-import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
+import type { StoragePage, StorageMetadata, DeleteObjectsResult } from '$lib/storage/types.js';
+
+export type { DeleteObjectsResult };
 
 /** Metadata and body stream returned when fetching a storage object. */
 export interface ObjectDownload {
@@ -28,4 +30,5 @@ export interface StorageProvider {
   getObjectRange(key: string, start: number, end: number): Promise<ReadableStream>;
   getMetadata(key: string): Promise<StorageMetadata>;
   exists(key: string): Promise<boolean>;
+  deleteObjects(keys: string[]): Promise<DeleteObjectsResult>;
 }
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 87009f8c..abfcd6f8 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -4,9 +4,10 @@ import {
   ListObjectsV2Command,
   GetObjectCommand,
   HeadObjectCommand,
+  DeleteObjectsCommand,
   type ListObjectsV2CommandOutput
 } from '@aws-sdk/client-s3';
-import type { StorageProvider, ObjectDownload } from './provider.js';
+import type { StorageProvider, ObjectDownload, DeleteObjectsResult } from './provider.js';
 import type { S3Config } from './types.js';
 import type { StoragePage, StorageObject, StorageMetadata } from '$lib/storage/types.js';
 import { logger } from '$lib/server/logging';
@@ -121,4 +122,29 @@ export class S3StorageProvider implements StorageProvider {
       throw err;
     }
   }
+
+  async deleteObjects(keys: string[]): Promise<DeleteObjectsResult> {
+    log.debug({ bucket: this.bucket, key_count: keys.length }, 'deleting objects');
+    const output = await this.client.send(
+      new DeleteObjectsCommand({
+        Bucket: this.bucket,
+        Delete: {
+          Objects: keys.map((key) => ({ Key: key })),
+          Quiet: true
+        }
+      })
+    );
+    const failed = (output.Errors ?? []).map((e) => ({
+      key: e.Key ?? '',
+      code: e.Code,
+      message: e.Message
+    }));
+    if (failed.length > 0) {
+      log.warn(
+        { bucket: this.bucket, failed_count: failed.length },
+        'some objects failed to delete'
+      );
+    }
+    return { failed };
+  }
 }
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index b1506467..8511b67e 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -5,7 +5,7 @@ import { createS3Client } from './s3-client.js';
 import { mapS3ErrorToHttp } from './s3-errors.js';
 import { getProviderForUser } from './utils.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
-import type { ObjectDownload } from './provider.js';
+import type { ObjectDownload, DeleteObjectsResult } from './provider.js';
 import { logger } from '$lib/server/logging';
 
 const log = logger.child({ module: 'storage-service' });
@@ -86,4 +86,28 @@ export async function getObjectMetadata(
   }
 }
 
+/** Delete one or more objects from the bucket. Returns a result listing any keys that failed. */
+export async function deleteObjects(
+  userId: string,
+  bucket: string,
+  keys: string[]
+): Promise<DeleteObjectsResult> {
+  const provider = getProviderForUser(userId, bucket);
+
+  try {
+    log.debug({ user_id: userId, bucket, key_count: keys.length }, 'deleting objects');
+    const result = await provider.deleteObjects(keys);
+    log.info(
+      { user_id: userId, bucket, key_count: keys.length, failed_count: result.failed.length },
+      'objects delete completed'
+    );
+    return result;
+  } catch (err) {
+    if (err instanceof S3ServiceException) {
+      mapS3ErrorToHttp(err, { bucket, operation: 'deleteObjects' });
+    }
+    throw err;
+  }
+}
+
 export type { S3ConnectionConfig };
diff --git a/src/lib/storage/delete.ts b/src/lib/storage/delete.ts
new file mode 100644
index 00000000..d7cc1490
--- /dev/null
+++ b/src/lib/storage/delete.ts
@@ -0,0 +1,42 @@
+/**
+ * Client-side utility for deleting one or more S3 objects via the server proxy.
+ */
+
+import type { DeleteObjectsResult } from '$lib/storage/types.js';
+
+export type DeleteErrorCode = 'not_connected' | 'access_denied' | 'server_error' | 'unknown';
+
+export class DeleteError extends Error {
+  constructor(
+    public readonly code: DeleteErrorCode,
+    message: string
+  ) {
+    super(message);
+    this.name = 'DeleteError';
+  }
+}
+
+function mapStatusToCode(status: number): DeleteErrorCode {
+  if (status === 401) return 'not_connected';
+  if (status === 403) return 'access_denied';
+  if (status >= 500) return 'server_error';
+  return 'unknown';
+}
+
+/**
+ * Delete one or more S3 objects.
+ *
+ * Resolves with `failed` listing any objects the server could not delete
+ * (partial S3 failures). Throws a `DeleteError` only on transport/auth errors.
+ */
+export async function deleteObjects(bucket: string, keys: string[]): Promise<DeleteObjectsResult> {
+  const params = new URLSearchParams({ bucket });
+  for (const key of keys) params.append('keys', key);
+
+  const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE' });
+  if (!res.ok) {
+    throw new DeleteError(mapStatusToCode(res.status), `Delete failed with status ${res.status}`);
+  }
+
+  return (await res.json()) as DeleteObjectsResult;
+}
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index b138c120..0629c950 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -27,3 +27,8 @@ export interface StoragePage {
   /** Token to request the next page from the provider (if any). */
   nextContinuationToken?: string | null;
 }
+
+/** Result of a bulk-delete operation. `failed` lists keys that could not be deleted. */
+export interface DeleteObjectsResult {
+  failed: Array<{ key: string; code?: string; message?: string }>;
+}
diff --git a/src/routes/(app)/storage/api/delete/+server.ts b/src/routes/(app)/storage/api/delete/+server.ts
new file mode 100644
index 00000000..066534f3
--- /dev/null
+++ b/src/routes/(app)/storage/api/delete/+server.ts
@@ -0,0 +1,35 @@
+import type { RequestHandler } from './$types';
+import { error } from '@sveltejs/kit';
+import { deleteObjects } from '$lib/server/storage/service.js';
+import { getUserId } from '$lib/server/auth-utils.js';
+
+/**
+ * DELETE /storage/api/delete?bucket=<bucket>&keys=<key1>&keys=<key2>&...
+ *
+ * Deletes one or more S3 objects from the given bucket.
+ * Authentication is enforced by the app-level auth guard in hooks.server.ts.
+ */
+export const DELETE: RequestHandler = async ({ locals, url }) => {
+  const bucket = url.searchParams.get('bucket');
+  if (!bucket || !bucket.trim()) {
+    throw error(400, 'Missing required query parameter: bucket');
+  }
+
+  const keys = url.searchParams.getAll('keys');
+  if (!keys.length) {
+    throw error(400, 'Missing required query parameter: keys');
+  }
+
+  const userId = getUserId(locals);
+
+  locals.logger.debug({ bucket, key_count: keys.length }, 'delete request received');
+
+  const result = await deleteObjects(userId, bucket, keys);
+
+  locals.logger.info(
+    { bucket, key_count: keys.length, failed_count: result.failed.length },
+    'objects delete completed'
+  );
+
+  return Response.json(result);
+};

From 034236608468c114d2793ee2957005dd74977b75 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 19 May 2026 10:03:28 +0200
Subject: [PATCH 030/136] #118 S3 File Browser: Pinned and Recent Access (#126)

* #118 add pinned access

* #118 add recently accessed file and locations

* #118 show loading spinner for quick navigation, use daisyui tooltips, limit recent access item count

* #118 show timestamp on hover, add preview action, add clickable label for recent locations

* #118 refactor timestamp tooltip into own component, add timestamp tooltip to file explorer files

* #131 fix download path for truncated previews, #118 add button to open context actions on pinned access

* #118 refactor suggested code from #126, show pin location menu above breadcrumb menu

* #118 fix timestamp string format, make timestamp display relative

* #118 add month and year suffixes to last modified timestamp display

* #118 fix visuals for pinned access entry width
---
 messages/de.json                              |  70 +++++-
 messages/en.json                              |  70 +++++-
 src/lib/components/storage/BucketGrid.svelte  |  18 +-
 src/lib/components/storage/BucketList.svelte  | 128 ++++++++++-
 src/lib/components/storage/ContextMenu.svelte |  39 ++--
 .../components/storage/FileExplorer.svelte    |  28 ++-
 src/lib/components/storage/FileRow.svelte     |   7 +-
 .../components/storage/PreviewModal.svelte    |   2 +-
 src/lib/components/storage/RecentItems.svelte | 210 ++++++++++++++++++
 .../storage/StorageBreadcrumb.svelte          | 114 ++++++++++
 .../storage/TimestampDisplay.svelte           |  56 +++++
 src/lib/stores/pinned-locations.svelte.ts     |  65 ++++++
 src/lib/stores/recent-items.svelte.ts         | 117 ++++++++++
 src/routes/(app)/storage/+page.svelte         |  14 +-
 14 files changed, 906 insertions(+), 32 deletions(-)
 create mode 100644 src/lib/components/storage/RecentItems.svelte
 create mode 100644 src/lib/components/storage/TimestampDisplay.svelte
 create mode 100644 src/lib/stores/pinned-locations.svelte.ts
 create mode 100644 src/lib/stores/recent-items.svelte.ts

diff --git a/messages/de.json b/messages/de.json
index 813bc669..7973e89c 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -155,6 +155,23 @@
   "storage_action_move": "Verschieben",
   "storage_action_delete": "Löschen",
   "storage_action_paste": "Einfügen",
+  "storage_action_pin": "Ort anheften",
+  "storage_action_unpin": "Loslösen",
+  "storage_pinned_label": "Angeheftete Orte",
+  "storage_more_options": "Weitere Optionen",
+  "storage_recent_files": "Zuletzt geöffnete Dateien",
+  "storage_recent_locations": "Zuletzt besuchte Orte",
+  "storage_recent_empty_files": "Keine zuletzt geöffneten Dateien.",
+  "storage_recent_empty_locations": "Keine zuletzt besuchten Orte.",
+  "storage_recent_col_name": "Name",
+  "storage_recent_col_location": "Ort",
+  "storage_recent_col_path": "Pfad",
+  "storage_recent_col_size": "Größe",
+  "storage_recent_col_visited": "Besucht",
+  "storage_recent_col_actions": "Aktionen",
+  "storage_recent_open_folder": "Ordner öffnen",
+  "storage_recent_go_to_location": "Zum Ort navigieren",
+  "storage_recent_preview_file": "Datei vorschau",
   "storage_danger_zone": "Gefahrenbereich",
   "storage_parent_dir": "Übergeordnetes Verzeichnis",
   "storage_loading": "Wird geladen…",
@@ -218,5 +235,56 @@
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
-  "storage_context_menu_actions": "Aktionen"
+  "storage_context_menu_actions": "Actions",
+  "timestamp_just_now": "gerade eben",
+  "timestamp_minutes_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "vor {count} Min.",
+        "n=other": "vor {count} Min."
+      }
+    }
+  ],
+  "timestamp_hours_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "vor {count} Std.",
+        "n=other": "vor {count} Std."
+      }
+    }
+  ],
+  "timestamp_days_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "vor {count} T.",
+        "n=other": "vor {count} T."
+      }
+    }
+  ],
+  "timestamp_months_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "vor {count} Mon.",
+        "n=other": "vor {count} Mon."
+      }
+    }
+  ],
+  "timestamp_years_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "vor {count} J.",
+        "n=other": "vor {count} J."
+      }
+    }
+  ]
 }
diff --git a/messages/en.json b/messages/en.json
index 98bdc15e..b663d655 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -155,6 +155,23 @@
   "storage_action_move": "Move",
   "storage_action_delete": "Delete",
   "storage_action_paste": "Paste",
+  "storage_action_pin": "Pin this location",
+  "storage_action_unpin": "Unpin",
+  "storage_pinned_label": "Pinned Access",
+  "storage_more_options": "More options",
+  "storage_recent_files": "Recent Files",
+  "storage_recent_locations": "Recent Locations",
+  "storage_recent_empty_files": "No recently accessed files.",
+  "storage_recent_empty_locations": "No recently visited locations.",
+  "storage_recent_col_name": "Name",
+  "storage_recent_col_location": "Location",
+  "storage_recent_col_path": "Path",
+  "storage_recent_col_size": "Size",
+  "storage_recent_col_visited": "Visited",
+  "storage_recent_col_actions": "Actions",
+  "storage_recent_open_folder": "Open folder",
+  "storage_recent_go_to_location": "Go to location",
+  "storage_recent_preview_file": "Preview file",
   "storage_danger_zone": "Danger zone",
   "storage_parent_dir": "Parent directory",
   "storage_loading": "Loading…",
@@ -218,5 +235,56 @@
   "storage_preview_csv_rows": "Showing first {count} rows",
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
-  "storage_context_menu_actions": "Actions"
+  "storage_context_menu_actions": "Actions",
+  "timestamp_just_now": "just now",
+  "timestamp_minutes_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "{count}m ago",
+        "n=other": "{count}m ago"
+      }
+    }
+  ],
+  "timestamp_hours_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "{count}h ago",
+        "n=other": "{count}h ago"
+      }
+    }
+  ],
+  "timestamp_days_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "{count}d ago",
+        "n=other": "{count}d ago"
+      }
+    }
+  ],
+  "timestamp_months_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "{count}mo ago",
+        "n=other": "{count}mo ago"
+      }
+    }
+  ],
+  "timestamp_years_ago": [
+    {
+      "declarations": ["input count", "local n = count: plural"],
+      "selectors": ["n"],
+      "match": {
+        "n=one": "{count}y ago",
+        "n=other": "{count}y ago"
+      }
+    }
+  ]
 }
diff --git a/src/lib/components/storage/BucketGrid.svelte b/src/lib/components/storage/BucketGrid.svelte
index 2cb72c9b..8cca881a 100644
--- a/src/lib/components/storage/BucketGrid.svelte
+++ b/src/lib/components/storage/BucketGrid.svelte
@@ -12,11 +12,11 @@
 {#if buckets.length > 0}
   <div
     class="
-    grid grid-cols-2 gap-3
-    sm:grid-cols-3
-    md:grid-cols-4
-    lg:grid-cols-6
-  "
+      grid grid-cols-2 gap-3
+      sm:grid-cols-3
+      md:grid-cols-4
+      lg:grid-cols-6
+    "
   >
     {#each buckets as bucket (bucket)}
       <div class="tooltip tooltip-bottom" data-tip={bucket}>
@@ -24,10 +24,10 @@
           href="/storage/{encodeURIComponent(bucket)}"
           data-sveltekit-preload-data="off"
           class="
-            border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 flex flex-col items-center
-            gap-2 rounded-xl border p-4
-            text-center transition-colors
-          "
+              border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 flex flex-col items-center
+              gap-2 rounded-xl border p-4
+              text-center transition-colors
+            "
         >
           <Icon icon="mdi:bucket-outline" class="text-warning size-10" aria-hidden="true" />
           <span class="w-full truncate text-sm font-medium">{bucket}</span>
diff --git a/src/lib/components/storage/BucketList.svelte b/src/lib/components/storage/BucketList.svelte
index 32bcfc67..3dd09a5b 100644
--- a/src/lib/components/storage/BucketList.svelte
+++ b/src/lib/components/storage/BucketList.svelte
@@ -2,6 +2,14 @@
   import { page } from '$app/state';
   import Icon from '@iconify/svelte';
   import * as m from '$lib/paraglide/messages.js';
+  import {
+    pinnedLocations,
+    unpinLocation,
+    pinnedLabel,
+    pinnedHref,
+    type PinnedLocation,
+    type StorageLocation
+  } from '$lib/stores/pinned-locations.svelte.js';
 
   interface Props {
     buckets: string[];
@@ -9,9 +17,70 @@
 
   let { buckets }: Props = $props();
 
-  const activeBucket = $derived(page.params.bucket ?? null);
+  // Detect the active bucket from the URL so the highlight stays on when
+  // navigating into any sub-prefix within the bucket.
+  const activeBucket = $derived.by(() => {
+    const match = page.url.pathname.match(/^\/storage\/([^/]+)/);
+    return match ? decodeURIComponent(match[1]) : null;
+  });
+  const activePrefix = $derived(page.params.prefix ? page.params.prefix + '/' : '');
+
+  function isPinnedActive(pin: PinnedLocation): boolean {
+    return page.params.bucket === pin.bucket && activePrefix === pin.prefix;
+  }
+
+  // ── Unpin context menu ────────────────────────────────────────────────────
+  let unpinCtx = $state<({ x: number; y: number } & StorageLocation) | null>(null);
+
+  function openUnpinMenu(e: MouseEvent, pin: PinnedLocation) {
+    e.preventDefault();
+    e.stopPropagation();
+    unpinCtx = { x: e.clientX, y: e.clientY, bucket: pin.bucket, prefix: pin.prefix };
+  }
+
+  function openUnpinMenuFromButton(e: MouseEvent, pin: PinnedLocation) {
+    e.preventDefault();
+    e.stopPropagation();
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    unpinCtx = { x: rect.right, y: rect.bottom, bucket: pin.bucket, prefix: pin.prefix };
+  }
+
+  function closeUnpinMenu() {
+    unpinCtx = null;
+  }
+
+  function handleUnpin() {
+    if (unpinCtx) {
+      unpinLocation(unpinCtx.bucket, unpinCtx.prefix);
+      closeUnpinMenu();
+    }
+  }
 </script>
 
+{#if unpinCtx}
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div
+    class="fixed inset-0 z-40"
+    onmousedown={closeUnpinMenu}
+    onkeydown={(e) => e.key === 'Escape' && closeUnpinMenu()}
+  ></div>
+  <ul
+    class="
+      menu menu-sm border-base-300 bg-base-100 fixed z-50 w-40 rounded-lg
+      border p-1 shadow-lg
+    "
+    role="menu"
+    style="left: {unpinCtx.x}px; top: {unpinCtx.y}px;"
+  >
+    <li role="none">
+      <button role="menuitem" class="text-error justify-start" onclick={handleUnpin}>
+        <Icon icon="material-symbols:push-pin-outline" class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_action_unpin()}
+      </button>
+    </li>
+  </ul>
+{/if}
+
 <nav
   class="
     border-base-300 bg-base-100 flex w-48 shrink-0 flex-col overflow-hidden
@@ -19,6 +88,61 @@
   "
   aria-label={m.storage_buckets_label()}
 >
+  <!-- Pinned Access section -->
+  {#if pinnedLocations.length > 0}
+    <div class="border-base-300 border-b">
+      <div class="flex items-center px-3 py-2">
+        <span class="text-base-content/50 text-xs font-semibold tracking-wide uppercase">
+          {m.storage_pinned_label()}
+        </span>
+      </div>
+      <ul class="py-1" role="list">
+        {#each pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
+          {@const active = isPinnedActive(pin)}
+          <li role="none" class="group relative">
+            <a
+              href={pinnedHref(pin)}
+              data-sveltekit-preload-data="off"
+              class="
+                hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                pr-7 text-sm
+                {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}"
+              aria-current={active ? 'page' : undefined}
+              oncontextmenu={(e) => openUnpinMenu(e, pin)}
+            >
+              {#if pin.prefix === ''}
+                <Icon
+                  icon="mdi:bucket-outline"
+                  class="size-3.5 shrink-0 opacity-60"
+                  aria-hidden="true"
+                />
+              {:else}
+                <Icon
+                  icon="material-symbols:folder-outline"
+                  class="size-3.5 shrink-0 opacity-60"
+                  aria-hidden="true"
+                />
+              {/if}
+              <span class="truncate">{pinnedLabel(pin)}</span>
+            </a>
+            <button
+              class="
+                btn btn-ghost btn-xs absolute top-1/2 right-1 -translate-y-1/2 p-0
+                opacity-0 transition-opacity
+                group-hover:opacity-100 focus:opacity-100
+              "
+              onclick={(e) => openUnpinMenuFromButton(e, pin)}
+              aria-label={m.storage_more_options()}
+              title={m.storage_more_options()}
+            >
+              <Icon icon="material-symbols:more-vert" class="size-3.5" aria-hidden="true" />
+            </button>
+          </li>
+        {/each}
+      </ul>
+    </div>
+  {/if}
+
   <div
     class="
       border-base-300 flex items-center justify-between border-b px-3 py-2
@@ -59,7 +183,7 @@
               {activeBucket === bucket
               ? 'bg-primary/10 text-primary font-medium'
               : 'text-base-content'}"
-            aria-current={activeBucket === bucket ? 'page' : undefined}
+            aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
           >
             <Icon
               icon="mdi:bucket-outline"
diff --git a/src/lib/components/storage/ContextMenu.svelte b/src/lib/components/storage/ContextMenu.svelte
index 23063d2c..d7ad9c10 100644
--- a/src/lib/components/storage/ContextMenu.svelte
+++ b/src/lib/components/storage/ContextMenu.svelte
@@ -9,11 +9,13 @@
     selectionCount: number;
     canPreview: boolean;
     canDownload: boolean;
+    canPin: boolean;
     onAction: (action: string) => void;
     onClose: () => void;
   }
 
-  let { x, y, selectionCount, canPreview, canDownload, onAction, onClose }: Props = $props();
+  let { x, y, selectionCount, canPreview, canDownload, canPin, onAction, onClose }: Props =
+    $props();
 
   let menuEl = $state<HTMLUListElement | null>(null);
 
@@ -70,6 +72,13 @@
       icon: 'material-symbols:drive-file-move',
       label: () => m.storage_action_move(),
       disabled: () => selectionCount === 0
+    },
+    {
+      key: 'pin',
+      icon: 'material-symbols:push-pin-outline',
+      label: () => m.storage_action_pin(),
+      disabled: () => !canPin,
+      hidden: () => !canPin
     }
   ];
 
@@ -115,19 +124,21 @@
   </li>
 
   {#each actions as act (act.key)}
-    {@const disabled = act.disabled()}
-    <li role="none" class:menu-disabled={disabled}>
-      <button
-        role="menuitem"
-        class="justify-start"
-        onclick={() => emit(act.key)}
-        {disabled}
-        aria-disabled={disabled}
-      >
-        <Icon icon={act.icon} class="mr-2 size-4 shrink-0" aria-hidden="true" />
-        {act.label()}
-      </button>
-    </li>
+    {#if !act.hidden?.()}
+      {@const disabled = act.disabled()}
+      <li role="none" class:menu-disabled={disabled}>
+        <button
+          role="menuitem"
+          class="justify-start"
+          onclick={() => emit(act.key)}
+          {disabled}
+          aria-disabled={disabled}
+        >
+          <Icon icon={act.icon} class="mr-2 size-4 shrink-0" aria-hidden="true" />
+          {act.label()}
+        </button>
+      </li>
+    {/if}
   {/each}
 
   {#each dangerActions as act (act.key)}
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 28cb968d..92063890 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -14,7 +14,11 @@
   import DeleteConfirmModal from './DeleteConfirmModal.svelte';
   import { invalidateAll } from '$app/navigation';
 
+  import { untrack } from 'svelte';
+  import { navigating } from '$app/state';
   import { initPageSize, type PageSize } from '$lib/types/pagination.js';
+  import { pinLocation } from '$lib/stores/pinned-locations.svelte.js';
+  import { recordLocationVisit, recordFileVisit } from '$lib/stores/recent-items.svelte.js';
 
   interface Props {
     bucket: string;
@@ -50,6 +54,15 @@
     selectedKeys = new SvelteSet<string>();
   });
 
+  // Record location visit whenever the current bucket/prefix changes.
+  // untrack() prevents the store reads inside recordLocationVisit from
+  // creating a dependency that would cause this effect to re-run on every write.
+  $effect(() => {
+    const b = bucket;
+    const p = prefix;
+    untrack(() => recordLocationVisit(b, p));
+  });
+
   function toggleSelectionMode() {
     selectionMode = !selectionMode;
     if (!selectionMode) selectedKeys = new SvelteSet<string>();
@@ -92,6 +105,11 @@
   let loading = $state(false);
   let deleting = $state(false); // true while the delete API call is in flight
 
+  // Show loading overlay for any navigation (including sidebar/grid links).
+  $effect(() => {
+    if (navigating) loading = true;
+  });
+
   // Clear loading when new objects arrive from the server
   $effect(() => {
     void objects;
@@ -132,6 +150,7 @@
 
   const ctxFileObj = $derived(ctxKey ? (files.find((f) => f.key === ctxKey) ?? null) : null);
   const ctxIsFile = $derived(ctxFileObj !== null);
+  const canPin = $derived(ctxKey !== null && !ctxIsFile);
 
   function openContextMenu(e: MouseEvent, key: string) {
     e.preventDefault();
@@ -178,7 +197,13 @@
     }
 
     try {
-      if (action === 'download' || action === 'upload' || action === 'preview') {
+      if (action === 'pin') {
+        pinLocation(bucket, ctxKey ?? prefix);
+      } else if (action === 'download' || action === 'upload' || action === 'preview') {
+        // Record file visit for the acted-on file(s)
+        for (const f of effectiveSelectedFiles) {
+          recordFileVisit(bucket, f.key, f.size);
+        }
         const res = await executeAction(action, ctx);
         if (res?.previewKey) {
           previewKey = res.previewKey;
@@ -327,6 +352,7 @@
     canPreview={(selectedFiles.length === 1 && selectedFolders.length === 0) ||
       (ctxKey !== null && files.some((f) => f.key === ctxKey))}
     canDownload={selectedFiles.length > 0 || ctxIsFile}
+    {canPin}
     onAction={handleAction}
     onClose={() => {
       ctxMenu = null;
diff --git a/src/lib/components/storage/FileRow.svelte b/src/lib/components/storage/FileRow.svelte
index ba60c674..5664dc91 100644
--- a/src/lib/components/storage/FileRow.svelte
+++ b/src/lib/components/storage/FileRow.svelte
@@ -1,8 +1,9 @@
 <script lang="ts">
   import Icon from '@iconify/svelte';
-  import { fileIconKind, iconColors, formatDate, keyToName } from '$lib/storage/utils.js';
+  import { fileIconKind, iconColors, keyToName } from '$lib/storage/utils.js';
   import type { StorageObject } from '$lib/storage/types.js';
   import prettyBytes from 'pretty-bytes';
+  import TimestampDisplay from '$lib/components/storage/TimestampDisplay.svelte';
 
   interface Props {
     file: StorageObject;
@@ -74,7 +75,9 @@
     </div>
   </td>
   <td class="text-right font-mono text-sm">{prettyBytes(file.size)}</td>
-  <td class="text-base-content/60 text-sm">{formatDate(file.lastModified)}</td>
+  <td class="text-base-content/60 text-sm"
+    ><TimestampDisplay date={file.lastModified} relative /></td
+  >
   <td class="w-10 py-0 pr-2 text-right">
     <button
       class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
diff --git a/src/lib/components/storage/PreviewModal.svelte b/src/lib/components/storage/PreviewModal.svelte
index 6a52d597..bb801ad3 100644
--- a/src/lib/components/storage/PreviewModal.svelte
+++ b/src/lib/components/storage/PreviewModal.svelte
@@ -204,7 +204,7 @@
   const filename = $derived(objectKey ? keyToName(objectKey) : '');
 
   function buildDownloadUrl(key: string, bkt: string): string {
-    return `/storage/api/preview?${new URLSearchParams({ bucket: bkt, key })}`;
+    return `/storage/api/download?${new URLSearchParams({ bucket: bkt, key })}`;
   }
 
   function close() {
diff --git a/src/lib/components/storage/RecentItems.svelte b/src/lib/components/storage/RecentItems.svelte
new file mode 100644
index 00000000..acda1080
--- /dev/null
+++ b/src/lib/components/storage/RecentItems.svelte
@@ -0,0 +1,210 @@
+<script lang="ts">
+  import type { Snippet } from 'svelte';
+  import Icon from '@iconify/svelte';
+  import prettyBytes from 'pretty-bytes';
+  import * as m from '$lib/paraglide/messages.js';
+  import {
+    recentFiles,
+    recentLocations,
+    fileName,
+    fileLocation,
+    locationName,
+    locationPath,
+    fileHref,
+    locationHref
+  } from '$lib/stores/recent-items.svelte.js';
+  import PreviewModal from '$lib/components/storage/PreviewModal.svelte';
+  import TimestampDisplay from '$lib/components/storage/TimestampDisplay.svelte';
+
+  type Tab = 'files' | 'locations';
+  let activeTab = $state<Tab>('files');
+
+  let showPreviewModal = $state(false);
+  let previewBucket = $state('');
+  let previewKey = $state<string | null>(null);
+
+  function openPreview(bucket: string, key: string) {
+    previewBucket = bucket;
+    previewKey = key;
+    showPreviewModal = true;
+  }
+</script>
+
+{#snippet tabPanel(isEmpty: boolean, emptyMessage: string, tableContent: Snippet)}
+  {#if isEmpty}
+    <p class="text-base-content/40 px-4 py-8 text-center text-sm">{emptyMessage}</p>
+  {:else}
+    <div class="overflow-x-auto">
+      {@render tableContent()}
+    </div>
+  {/if}
+{/snippet}
+
+{#snippet filesTable()}
+  <table class="table-sm table w-full">
+    <thead>
+      <tr>
+        <th>{m.storage_recent_col_name()}</th>
+        <th>{m.storage_recent_col_location()}</th>
+        <th>{m.storage_recent_col_size()}</th>
+        <th>{m.storage_recent_col_visited()}</th>
+        <th class="w-16">{m.storage_recent_col_actions()}</th>
+      </tr>
+    </thead>
+    <tbody>
+      {#each recentFiles as file (file.bucket + '::' + file.key)}
+        <tr class="hover">
+          <td>
+            <div class="flex items-center gap-2">
+              <Icon
+                icon="material-symbols:description-outline"
+                class="text-primary size-4 shrink-0"
+                aria-hidden="true"
+              />
+              <span class="font-medium">{fileName(file.key)}</span>
+            </div>
+          </td>
+          <td>
+            <span class="text-base-content/60 truncate text-xs">
+              {fileLocation(file)}
+            </span>
+          </td>
+          <td class="text-base-content/60 text-xs whitespace-nowrap">
+            {prettyBytes(file.size)}
+          </td>
+          <td class="text-base-content/50 text-xs whitespace-nowrap">
+            <TimestampDisplay date={file.visitedAt} relative tooltip="tooltip-left" />
+          </td>
+          <td>
+            <div class="flex items-center gap-1">
+              <div class="tooltip tooltip-left" data-tip={m.storage_recent_preview_file()}>
+                <button
+                  class="btn btn-ghost btn-xs"
+                  aria-label="{m.storage_recent_preview_file()} — {fileName(file.key)}"
+                  onclick={() => openPreview(file.bucket, file.key)}
+                >
+                  <Icon
+                    icon="material-symbols:preview-outline"
+                    class="size-3.5"
+                    aria-hidden="true"
+                  />
+                </button>
+              </div>
+              <div class="tooltip tooltip-left" data-tip={m.storage_recent_open_folder()}>
+                <a
+                  href={fileHref(file)}
+                  data-sveltekit-preload-data="off"
+                  class="btn btn-ghost btn-xs"
+                  aria-label="{m.storage_recent_open_folder()} — {fileName(file.key)}"
+                >
+                  <Icon
+                    icon="material-symbols:folder-open-outline"
+                    class="size-3.5"
+                    aria-hidden="true"
+                  />
+                </a>
+              </div>
+            </div>
+          </td>
+        </tr>
+      {/each}
+    </tbody>
+  </table>
+{/snippet}
+
+{#snippet locationsTable()}
+  <table class="table-sm table w-full">
+    <thead>
+      <tr>
+        <th>{m.storage_recent_col_name()}</th>
+        <th>{m.storage_recent_col_path()}</th>
+        <th>{m.storage_recent_col_visited()}</th>
+        <th class="w-16">{m.storage_recent_col_actions()}</th>
+      </tr>
+    </thead>
+    <tbody>
+      {#each recentLocations as loc (loc.bucket + '::' + loc.prefix)}
+        <tr class="hover">
+          <td>
+            <div class="flex items-center gap-2">
+              {#if loc.prefix === ''}
+                <Icon
+                  icon="mdi:bucket-outline"
+                  class="text-warning size-4 shrink-0"
+                  aria-hidden="true"
+                />
+              {:else}
+                <Icon
+                  icon="material-symbols:folder-outline"
+                  class="text-warning size-4 shrink-0"
+                  aria-hidden="true"
+                />
+              {/if}
+              <a
+                href={locationHref(loc)}
+                data-sveltekit-preload-data="off"
+                class="hover:text-primary font-medium">{locationName(loc)}</a
+              >
+            </div>
+          </td>
+          <td>
+            <span class="text-base-content/60 truncate text-xs">
+              {locationPath(loc)}
+            </span>
+          </td>
+          <td class="text-base-content/50 text-xs whitespace-nowrap">
+            <TimestampDisplay date={loc.visitedAt} relative tooltip="tooltip-left" />
+          </td>
+          <td>
+            <div class="tooltip tooltip-left" data-tip={m.storage_recent_go_to_location()}>
+              <a
+                href={locationHref(loc)}
+                data-sveltekit-preload-data="off"
+                class="btn btn-ghost btn-xs"
+                aria-label="{m.storage_recent_go_to_location()} — {locationName(loc)}"
+              >
+                <Icon icon="material-symbols:arrow-forward" class="size-3.5" aria-hidden="true" />
+              </a>
+            </div>
+          </td>
+        </tr>
+      {/each}
+    </tbody>
+  </table>
+{/snippet}
+
+<section class="mt-8 flex min-h-0 flex-1 flex-col">
+  <!-- Tab header -->
+  <div role="tablist" class="tabs tabs-border mb-0">
+    <button
+      role="tab"
+      class="tab {activeTab === 'files' ? 'tab-active' : ''}"
+      aria-selected={activeTab === 'files'}
+      onclick={() => (activeTab = 'files')}
+    >
+      {m.storage_recent_files()}
+    </button>
+    <button
+      role="tab"
+      class="tab {activeTab === 'locations' ? 'tab-active' : ''}"
+      aria-selected={activeTab === 'locations'}
+      onclick={() => (activeTab = 'locations')}
+    >
+      {m.storage_recent_locations()}
+    </button>
+  </div>
+
+  <div class="border-base-300 min-h-0 flex-1 overflow-y-auto rounded-tr-lg rounded-b-lg border">
+    {#if activeTab === 'files'}
+      {@render tabPanel(recentFiles.length === 0, m.storage_recent_empty_files(), filesTable)}
+    {:else}
+      {@render tabPanel(
+        recentLocations.length === 0,
+        m.storage_recent_empty_locations(),
+        locationsTable
+      )}
+    {/if}
+  </div>
+</section>
+
+<PreviewModal bind:open={showPreviewModal} bucket={previewBucket} objectKey={previewKey} />
diff --git a/src/lib/components/storage/StorageBreadcrumb.svelte b/src/lib/components/storage/StorageBreadcrumb.svelte
index 4606c4a0..18c971db 100644
--- a/src/lib/components/storage/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/StorageBreadcrumb.svelte
@@ -1,6 +1,12 @@
 <script lang="ts">
   import Icon from '@iconify/svelte';
   import * as m from '$lib/paraglide/messages.js';
+  import {
+    pinLocation,
+    unpinLocation,
+    isPinned,
+    type StorageLocation
+  } from '$lib/stores/pinned-locations.svelte.js';
 
   interface Props {
     bucket: string;
@@ -41,8 +47,65 @@
   const visibleParts = $derived(
     breadcrumbParts.length > MAX_TAIL ? breadcrumbParts.slice(-MAX_TAIL) : breadcrumbParts
   );
+
+  const currentIsPinned = $derived(isPinned(bucket, prefix));
+
+  // ── Breadcrumb label context menu (right-click to pin / unpin) ───────────
+  let breadcrumbCtx = $state<({ x: number; y: number } & StorageLocation) | null>(null);
+
+  function openBreadcrumbCtx(e: MouseEvent, b: string, p: string) {
+    e.preventDefault();
+    breadcrumbCtx = { x: e.clientX, y: e.clientY, bucket: b, prefix: p };
+  }
+
+  function closeBreadcrumbCtx() {
+    breadcrumbCtx = null;
+  }
 </script>
 
+{#if breadcrumbCtx}
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div
+    class="fixed inset-0 z-40"
+    onmousedown={closeBreadcrumbCtx}
+    onkeydown={(e) => e.key === 'Escape' && closeBreadcrumbCtx()}
+  ></div>
+  <ul
+    class="
+      menu menu-sm border-base-300 bg-base-100 fixed z-[60] w-48 rounded-lg
+      border p-1 shadow-lg
+    "
+    role="menu"
+    style="left: {breadcrumbCtx.x}px; bottom: calc(100vh - {breadcrumbCtx.y}px);"
+  >
+    <li role="none">
+      <button
+        role="menuitem"
+        class="justify-start"
+        onclick={() => {
+          if (isPinned(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix)) {
+            unpinLocation(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
+          } else {
+            pinLocation(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
+          }
+          closeBreadcrumbCtx();
+        }}
+      >
+        <Icon
+          icon={isPinned(breadcrumbCtx.bucket, breadcrumbCtx.prefix)
+            ? 'material-symbols:push-pin'
+            : 'material-symbols:push-pin-outline'}
+          class="size-4 shrink-0"
+          aria-hidden="true"
+        />
+        {isPinned(breadcrumbCtx.bucket, breadcrumbCtx.prefix)
+          ? m.storage_action_unpin()
+          : m.storage_action_pin()}
+      </button>
+    </li>
+  </ul>
+{/if}
+
 <div class="border-base-300 flex items-center gap-3 border-b px-6 py-3">
   <!-- Breadcrumbs -->
   <nav
@@ -52,6 +115,7 @@
   "
   >
     {#if breadcrumbParts.length === 0}
+      <!-- svelte-ignore a11y_no_static_element_interactions -->
       <span
         class="
           text-base-content flex shrink-0 items-center gap-1.5 rounded-sm px-1.5
@@ -59,6 +123,7 @@
         "
         title={bucket}
         aria-current="page"
+        oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
       >
         <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
         {bucket}
@@ -72,6 +137,7 @@
         "
         title={bucket}
         onclick={() => onNavigate('')}
+        oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
       >
         <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
         {bucket}
@@ -113,6 +179,7 @@
                   hover:cursor-pointer
                 "
                 onclick={() => onNavigate(part.prefix)}
+                oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
               >
                 {part.label}
               </button>
@@ -129,6 +196,7 @@
         aria-hidden="true"
       />
       {#if isCurrent}
+        <!-- svelte-ignore a11y_no_static_element_interactions -->
         <span
           class="
             text-base-content min-w-0 truncate rounded-sm px-1.5 py-0.5
@@ -136,6 +204,7 @@
           "
           title={part.label}
           aria-current="page"
+          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
         >
           {part.label}
         </span>
@@ -147,6 +216,7 @@
           "
           title={part.label}
           onclick={() => onNavigate(part.prefix)}
+          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
         >
           {part.label}
         </button>
@@ -175,4 +245,48 @@
     </span>
     {m.storage_select_toggle()}
   </button>
+
+  <!-- More options (pin current location) -->
+  <div class="dropdown dropdown-end">
+    <button
+      tabindex="0"
+      class="btn btn-ghost btn-xs"
+      title={m.storage_more_options()}
+      aria-label={m.storage_more_options()}
+      aria-haspopup="menu"
+    >
+      <Icon icon="material-symbols:more-vert" class="size-3.5" aria-hidden="true" />
+    </button>
+    <ul
+      tabindex="0"
+      role="menu"
+      class="
+        dropdown-content menu rounded-box border-base-300 bg-base-100 z-50 w-52
+        border p-1 shadow-lg
+      "
+    >
+      <li role="none">
+        <button
+          role="menuitem"
+          class="justify-start text-sm"
+          onclick={() => {
+            if (currentIsPinned) {
+              unpinLocation(bucket, prefix);
+            } else {
+              pinLocation(bucket, prefix);
+            }
+          }}
+        >
+          <Icon
+            icon={currentIsPinned
+              ? 'material-symbols:push-pin'
+              : 'material-symbols:push-pin-outline'}
+            class="size-4 shrink-0"
+            aria-hidden="true"
+          />
+          {currentIsPinned ? m.storage_action_unpin() : m.storage_action_pin()}
+        </button>
+      </li>
+    </ul>
+  </div>
 </div>
diff --git a/src/lib/components/storage/TimestampDisplay.svelte b/src/lib/components/storage/TimestampDisplay.svelte
new file mode 100644
index 00000000..72b3f835
--- /dev/null
+++ b/src/lib/components/storage/TimestampDisplay.svelte
@@ -0,0 +1,56 @@
+<script lang="ts">
+  import { getLocale } from '$lib/paraglide/runtime.js';
+  import * as m from '$lib/paraglide/messages.js';
+
+  type TooltipPosition = 'tooltip-top' | 'tooltip-bottom' | 'tooltip-left' | 'tooltip-right';
+
+  interface Props {
+    /** The date to display. Accepts a `Date` object or an ISO string. */
+    date: Date | string;
+    /**
+     * When true, the label shows a relative time ("2h ago").
+     * When false (default), the label shows a short formatted date ("13 May 2026").
+     */
+    relative?: boolean;
+    /** DaisyUI tooltip direction. */
+    tooltip?: TooltipPosition;
+  }
+
+  let { date, relative = false, tooltip = 'tooltip-top' }: Props = $props();
+
+  const d = $derived(typeof date === 'string' ? new Date(date) : date);
+
+  const fullTimestamp = $derived(
+    d.toLocaleString(getLocale(), {
+      year: 'numeric',
+      month: 'short',
+      day: 'numeric',
+      hour: '2-digit',
+      minute: '2-digit'
+    })
+  );
+
+  const label = $derived.by(() => {
+    if (relative) {
+      const diff = Date.now() - d.getTime();
+      const mins = Math.floor(diff / 60_000);
+      if (mins < 1) return m.timestamp_just_now();
+      if (mins < 60) return m.timestamp_minutes_ago({ count: mins });
+      const hrs = Math.floor(mins / 60);
+      if (hrs < 24) return m.timestamp_hours_ago({ count: hrs });
+      const days = Math.floor(hrs / 24);
+      if (days < 30) return m.timestamp_days_ago({ count: days });
+      const months = Math.floor(days / 30);
+      if (months < 12) return m.timestamp_months_ago({ count: months });
+      const years = Math.floor(days / 365);
+      return m.timestamp_years_ago({ count: years });
+    }
+    return new Intl.DateTimeFormat(getLocale(), {
+      year: 'numeric',
+      month: 'short',
+      day: '2-digit'
+    }).format(d);
+  });
+</script>
+
+<span class="tooltip {tooltip}" data-tip={fullTimestamp}>{label}</span>
diff --git a/src/lib/stores/pinned-locations.svelte.ts b/src/lib/stores/pinned-locations.svelte.ts
new file mode 100644
index 00000000..416be9e5
--- /dev/null
+++ b/src/lib/stores/pinned-locations.svelte.ts
@@ -0,0 +1,65 @@
+/** A storage location: a bucket plus an optional path prefix. */
+export interface StorageLocation {
+  bucket: string;
+  /** Empty string = bucket root; otherwise a slash-terminated path, e.g. 'folder/sub/'. */
+  prefix: string;
+}
+
+export type PinnedLocation = StorageLocation;
+
+const STORAGE_KEY = 'pinned_storage_locations';
+
+function loadPinned(): PinnedLocation[] {
+  if (typeof localStorage === 'undefined') return [];
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    return raw ? (JSON.parse(raw) as PinnedLocation[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+export const pinnedLocations = $state<PinnedLocation[]>(loadPinned());
+
+function persist() {
+  if (typeof localStorage !== 'undefined') {
+    localStorage.setItem(STORAGE_KEY, JSON.stringify([...pinnedLocations]));
+  }
+}
+
+export function pinLocation(bucket: string, prefix: string): void {
+  if (pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix)) return;
+  pinnedLocations.push({ bucket, prefix });
+  persist();
+}
+
+export function unpinLocation(bucket: string, prefix: string): void {
+  const idx = pinnedLocations.findIndex((p) => p.bucket === bucket && p.prefix === prefix);
+  if (idx !== -1) {
+    pinnedLocations.splice(idx, 1);
+    persist();
+  }
+}
+
+export function isPinned(bucket: string, prefix: string): boolean {
+  return pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix);
+}
+
+/** Returns the navigation href for a storage location (bucket + optional prefix). */
+export function storageHref(bucket: string, prefix: string): string {
+  if (!prefix) return `/storage/${encodeURIComponent(bucket)}`;
+  const encoded = prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/');
+  return `/storage/${encodeURIComponent(bucket)}/${encoded}`;
+}
+
+/** Returns the display label for a pinned location. */
+export function pinnedLabel(pin: PinnedLocation): string {
+  if (!pin.prefix) return pin.bucket;
+  const parts = pin.prefix.split('/').filter(Boolean);
+  return parts[parts.length - 1] ?? pin.bucket;
+}
+
+/** Returns the navigation href for a pinned location. */
+export function pinnedHref(pin: PinnedLocation): string {
+  return storageHref(pin.bucket, pin.prefix);
+}
diff --git a/src/lib/stores/recent-items.svelte.ts b/src/lib/stores/recent-items.svelte.ts
new file mode 100644
index 00000000..cca64456
--- /dev/null
+++ b/src/lib/stores/recent-items.svelte.ts
@@ -0,0 +1,117 @@
+import { storageHref } from './pinned-locations.svelte.js';
+
+const MAX_RECENT = 15;
+const LS_FILES = 'recent_storage_files';
+const LS_LOCATIONS = 'recent_storage_locations';
+
+// ── Types ─────────────────────────────────────────────────────────────────
+
+export interface RecentFile {
+  /** Full object key within the bucket. */
+  key: string;
+  bucket: string;
+  /** File size in bytes. */
+  size: number;
+  /** ISO string so it survives JSON round-trip. */
+  visitedAt: string;
+}
+
+export interface RecentLocation {
+  bucket: string;
+  /** Trailing-slash prefix, empty string = bucket root. */
+  prefix: string;
+  visitedAt: string;
+}
+
+// ── Persistence helpers ───────────────────────────────────────────────────
+
+function load<T>(key: string): T[] {
+  if (typeof localStorage === 'undefined') return [];
+  try {
+    const raw = localStorage.getItem(key);
+    return raw ? (JSON.parse(raw) as T[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+function persist(key: string, data: unknown[]): void {
+  if (typeof localStorage !== 'undefined') {
+    localStorage.setItem(key, JSON.stringify(data));
+  }
+}
+
+// ── Reactive state ────────────────────────────────────────────────────────
+
+export const recentFiles = $state<RecentFile[]>(load<RecentFile>(LS_FILES));
+export const recentLocations = $state<RecentLocation[]>(load<RecentLocation>(LS_LOCATIONS));
+
+// ── Mutators ──────────────────────────────────────────────────────────────
+
+export function recordFileVisit(bucket: string, key: string, size: number): void {
+  const idx = recentFiles.findIndex((f) => f.bucket === bucket && f.key === key);
+  // eslint-disable-next-line svelte/prefer-svelte-reactivity
+  const entry: RecentFile = { key, bucket, size, visitedAt: new Date().toISOString() };
+  if (idx !== -1) {
+    recentFiles.splice(idx, 1);
+  }
+  recentFiles.unshift(entry);
+  if (recentFiles.length > MAX_RECENT) recentFiles.splice(MAX_RECENT);
+  persist(LS_FILES, [...recentFiles]);
+}
+
+export function recordLocationVisit(bucket: string, prefix: string): void {
+  const idx = recentLocations.findIndex((l) => l.bucket === bucket && l.prefix === prefix);
+  // eslint-disable-next-line svelte/prefer-svelte-reactivity
+  const entry: RecentLocation = { bucket, prefix, visitedAt: new Date().toISOString() };
+  if (idx !== -1) {
+    recentLocations.splice(idx, 1);
+  }
+  recentLocations.unshift(entry);
+  if (recentLocations.length > MAX_RECENT) recentLocations.splice(MAX_RECENT);
+  persist(LS_LOCATIONS, [...recentLocations]);
+}
+
+// ── Derived display helpers ───────────────────────────────────────────────
+
+/** Display name for a file key (last path segment). */
+export function fileName(key: string): string {
+  const parts = key.split('/').filter(Boolean);
+  return parts[parts.length - 1] ?? key;
+}
+
+/** Human-readable location path for a recent file: "bucket / folder / …" */
+export function fileLocation(file: RecentFile): string {
+  const parts = file.key.split('/').filter(Boolean);
+  parts.pop(); // remove filename
+  return parts.length > 0 ? `${file.bucket} / ${parts.join(' / ')}` : file.bucket;
+}
+
+/** Display name for a location: last path segment or bucket name. */
+export function locationName(loc: RecentLocation): string {
+  if (!loc.prefix) return loc.bucket;
+  const parts = loc.prefix.split('/').filter(Boolean);
+  return parts[parts.length - 1] ?? loc.bucket;
+}
+
+/** Full breadcrumb path for a location. */
+export function locationPath(loc: RecentLocation): string {
+  if (!loc.prefix) return loc.bucket;
+  const parts = loc.prefix.split('/').filter(Boolean);
+  return `${loc.bucket} / ${parts.join(' / ')}`;
+}
+
+/** Navigation href for a recent file (goes to its parent folder). */
+export function fileHref(file: RecentFile): string {
+  const parts = file.key.split('/').filter(Boolean);
+  parts.pop();
+  const encoded = parts.map(encodeURIComponent).join('/');
+  return encoded
+    ? `/storage/${encodeURIComponent(file.bucket)}/${encoded}`
+    : `/storage/${encodeURIComponent(file.bucket)}`;
+}
+
+/** Navigation href for a recent location. */
+export function locationHref(loc: RecentLocation): string {
+  return storageHref(loc.bucket, loc.prefix);
+}
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 9a65bdb7..12e24a76 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -1,16 +1,28 @@
 <script lang="ts">
+  import { navigating } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
   import BucketGrid from '$lib/components/storage/BucketGrid.svelte';
   import StorageConnectForm from '$lib/components/storage/StorageConnectForm.svelte';
+  import RecentItems from '$lib/components/storage/RecentItems.svelte';
 
   let { data } = $props();
 </script>
 
 {#if data.connected}
-  <div class="p-2">
+  <div class="relative flex h-full min-h-0 flex-col overflow-hidden p-2">
+    {#if navigating?.to?.url.pathname.startsWith('/storage/')}
+      <div
+        class="bg-base-100/70 absolute inset-0 z-10 flex items-center justify-center rounded-xl"
+        aria-live="polite"
+        aria-label={m.storage_loading()}
+      >
+        <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
+      </div>
+    {/if}
     <h1 class="mb-1 text-xl font-semibold">{m.storage_buckets_label()}</h1>
     <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
     <BucketGrid buckets={data.buckets} />
+    <RecentItems />
   </div>
 {:else}
   <StorageConnectForm connectionForm={data.connectionForm} />

From 079cee9bab3a01f4e81f0dfb4bfa7c5a45496ad4 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 19 May 2026 12:00:46 +0200
Subject: [PATCH 031/136] #140 Add tooltips to BucketList (#145)

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 src/lib/components/layout/sidebar/Sidebar.svelte |  6 +++---
 src/lib/components/storage/BucketList.svelte     | 13 +++++++------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index fb04d015..5909262c 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -65,7 +65,7 @@
   class="
     border-base-300 bg-base-100 fixed inset-y-0 left-0 z-50 flex flex-col
     border-r transition-[transform,width] duration-200 ease-out
-    lg:relative lg:inset-auto lg:z-auto lg:translate-x-0
+    lg:relative lg:inset-auto lg:translate-x-0
     {mobileOpen ? 'translate-x-0' : '-translate-x-full'}
     {collapsed ? 'w-16' : 'w-60'}"
 >
@@ -113,8 +113,8 @@
               data-tip={collapsed ? item.label : undefined}
               class="
                 flex min-h-11 items-center gap-3 rounded-lg px-3 py-2
-                text-sm font-medium transition-colors
-                {collapsed ? 'tooltip tooltip-right' : ''}
+                text-sm font-medium
+                {collapsed ? 'tooltip tooltip-right before:z-100' : ''}
                 {active
                 ? 'bg-primary/10 text-primary'
                 : `
diff --git a/src/lib/components/storage/BucketList.svelte b/src/lib/components/storage/BucketList.svelte
index 3dd09a5b..50a5b92c 100644
--- a/src/lib/components/storage/BucketList.svelte
+++ b/src/lib/components/storage/BucketList.svelte
@@ -83,7 +83,7 @@
 
 <nav
   class="
-    border-base-300 bg-base-100 flex w-48 shrink-0 flex-col overflow-hidden
+    border-base-300 bg-base-100 flex w-48 shrink-0 flex-col
     rounded-lg border
   "
   aria-label={m.storage_buckets_label()}
@@ -158,15 +158,15 @@
     <a
       href="/storage"
       data-sveltekit-preload-data="off"
-      class="btn btn-ghost btn-xs"
+      class="btn btn-ghost btn-xs tooltip tooltip-left"
       title={m.storage_view_all_buckets()}
-      aria-label={m.storage_view_all_buckets()}
+      data-tip={m.storage_view_all_buckets()}
     >
       <Icon icon="material-symbols:grid-view" class="size-3.5" aria-hidden="true" />
     </a>
   </div>
 
-  <ul class="flex-1 overflow-y-auto py-1" role="list">
+  <ul class="flex-1 py-1" role="list">
     {#if buckets.length === 0}
       <li class="text-base-content/40 px-3 py-4 text-center text-xs">
         {m.storage_buckets_empty()}
@@ -178,11 +178,12 @@
             href="/storage/{encodeURIComponent(bucket)}"
             data-sveltekit-preload-data="off"
             class="
-              hover:bg-base-200 flex items-center gap-2 px-3 py-1.5
-              text-sm
+              hover:bg-base-200 tooltip tooltip-right flex items-center gap-2
+              px-3 py-1.5 text-sm
               {activeBucket === bucket
               ? 'bg-primary/10 text-primary font-medium'
               : 'text-base-content'}"
+            data-tip={bucket}
             aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
           >
             <Icon

From 567da571e4535c1fc3e9b86981072755396ece82 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 19 May 2026 12:00:59 +0200
Subject: [PATCH 032/136] #108 Store S3 Bucket Credentials in localStorage
 (#117)

* #108 store s3 bucket credentials

* #108 save multiple connections, display connections on form

* #108 fix lint

* #108 control auto connect via env variable

* #108 add remove buttons to saved connections, add loading indicator

* #108 remove rightclick to forget connection

* #108 remove legacy key
---
 .env.test                                     |   1 +
 TECH_DEBT.md                                  |   8 +
 dev/setup.sh                                  |   4 +
 messages/de.json                              |   7 +
 messages/en.json                              |   7 +
 src/lib/client/feature-flags.ts               |  12 ++
 .../storage/StorageConnectForm.svelte         | 174 +++++++++++++++++-
 src/lib/storage/connection-storage.ts         |  64 +++++++
 src/routes/(app)/storage/+page.server.ts      |   2 +-
 9 files changed, 275 insertions(+), 4 deletions(-)
 create mode 100644 src/lib/client/feature-flags.ts
 create mode 100644 src/lib/storage/connection-storage.ts

diff --git a/.env.test b/.env.test
index 786a7210..fcdbaaf7 100644
--- a/.env.test
+++ b/.env.test
@@ -6,3 +6,4 @@ STACKABLE_UI_BASE_URL=http://localhost:4173
 STACKABLE_UI_TRINO_URL=http://localhost:8080
 STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
 ORIGIN=http://localhost:4173
+PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index a46d0986..3b8d358f 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -46,6 +46,14 @@ Trino error messages and Node.js exception messages are returned to the browser
 
 ---
 
+### S3 connection credentials stored in localStorage
+
+**File:** `src/lib/storage/connection-storage.ts`, `src/lib/components/storage/StorageConnectForm.svelte`
+
+S3 connection credentials (access key ID and secret access key) are persisted in plaintext `localStorage` so the browser can auto-reconnect after a page reload or server restart. `localStorage` is accessible to any JavaScript running on the page and is visible in browser DevTools, making it vulnerable to XSS. Acceptable for the current early stage where the alternative is users having to re-enter credentials after every server restart. Long-term fix: persist encrypted credentials server-side, tied to the authenticated session; send only a session token to the client.
+
+---
+
 ### In-memory storage connection state
 
 **File:** `src/lib/server/storage/user-connections.ts`
diff --git a/dev/setup.sh b/dev/setup.sh
index d779b3b4..f22138d2 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -210,6 +210,8 @@ STACKABLE_UI_TRINO_AUTH_TYPE=basic
 STACKABLE_UI_TRINO_AUTH_USERNAME=stackable-ui
 STACKABLE_UI_TRINO_AUTH_PASSWORD=stackable-ui-dev
 STACKABLE_UI_TRINO_TLS_INSECURE=true
+STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
+PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
 EOF
 else
   cat > "$ENV_FILE" <<EOF
@@ -218,6 +220,8 @@ STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
 STACKABLE_UI_OIDC_CLIENT_SECRET=${SECRET}
 STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
 STACKABLE_UI_BASE_URL=http://localhost:5173
+STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
+PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
 EOF
 fi
 
diff --git a/messages/de.json b/messages/de.json
index 7973e89c..a226d929 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -133,7 +133,14 @@
   "storage_connect_access_key": "Zugriffsschlüssel-ID",
   "storage_connect_secret_key": "Geheimer Zugriffsschlüssel",
   "storage_connect_submit": "Verbinden",
+  "storage_connect_reconnecting": "Verbindung zum Speicher wird wiederhergestellt…",
   "storage_connect_error": "Verbindung fehlgeschlagen — Endpunkt und Zugangsdaten prüfen.",
+  "storage_connect_saved": "Gespeicherte Verbindungen",
+  "storage_connect_no_saved": "Noch keine gespeicherten Verbindungen",
+  "storage_connect_forget": "Vergessen",
+  "storage_connect_forget_confirm": "{endpoint} aus den gespeicherten Verbindungen entfernen?",
+  "storage_connect_forget_cancel": "Abbrechen",
+  "storage_connect_forget_label": "Verbindung zu {endpoint} vergessen",
   "storage_disconnect": "Verbindung Trennen",
   "storage_buckets_label": "Buckets",
   "storage_view_all_buckets": "Alle Buckets anzeigen",
diff --git a/messages/en.json b/messages/en.json
index b663d655..8765634b 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -133,7 +133,14 @@
   "storage_connect_access_key": "Access key ID",
   "storage_connect_secret_key": "Secret access key",
   "storage_connect_submit": "Connect",
+  "storage_connect_reconnecting": "Reconnecting to storage…",
   "storage_connect_error": "Could not connect — check the endpoint and credentials.",
+  "storage_connect_saved": "Saved connections",
+  "storage_connect_no_saved": "No saved connections yet",
+  "storage_connect_forget": "Forget",
+  "storage_connect_forget_confirm": "Remove {endpoint} from saved connections?",
+  "storage_connect_forget_cancel": "Cancel",
+  "storage_connect_forget_label": "Forget connection to {endpoint}",
   "storage_disconnect": "Disconnect",
   "storage_buckets_label": "Buckets",
   "storage_view_all_buckets": "View all buckets",
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
new file mode 100644
index 00000000..5e77dbb1
--- /dev/null
+++ b/src/lib/client/feature-flags.ts
@@ -0,0 +1,12 @@
+// Client-accessible feature flags. These are embedded at build time via
+// SvelteKit's $env/static/public and are safe to expose to the browser.
+// All variables must be prefixed PUBLIC_.
+
+import { env } from '$env/dynamic/public';
+
+/** When `PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true`, the storage page
+ *  automatically reconnects to the most recently used connection when the
+ *  user navigates to `/storage`. Disabled by default — the user must choose
+ *  a connection manually. */
+export const storageAutoConnectEnabled =
+  (env.PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT ?? 'false') === 'true';
diff --git a/src/lib/components/storage/StorageConnectForm.svelte b/src/lib/components/storage/StorageConnectForm.svelte
index d66cc821..405c30a2 100644
--- a/src/lib/components/storage/StorageConnectForm.svelte
+++ b/src/lib/components/storage/StorageConnectForm.svelte
@@ -2,10 +2,21 @@
   import type { SuperValidated } from 'sveltekit-superforms';
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
+  import { onMount, tick } from 'svelte';
+  import Icon from '@iconify/svelte';
   import * as m from '$lib/paraglide/messages.js';
   import { StorageConnectionSchema } from '$lib/storage/schemas.js';
+  import {
+    saveConnectionLocally,
+    loadConnectionLocally,
+    loadAllConnectionsLocally,
+    removeConnectionLocally
+  } from '$lib/storage/connection-storage.js';
+  import { storageAutoConnectEnabled } from '$lib/client/feature-flags.js';
   import type { z } from 'zod';
 
+  type StoredConnection = z.infer<typeof StorageConnectionSchema>;
+
   interface Props {
     connectionForm: SuperValidated<z.infer<typeof StorageConnectionSchema>, string>;
   }
@@ -14,19 +25,151 @@
 
   const uid = $props.id();
 
+  let formRef: HTMLFormElement | null = $state(null);
+  let autoConnecting = $state(false);
+  let allConnections: StoredConnection[] = $state([]);
+  let connectionsLoaded = $state(false);
+
+  /** Connection pending the "Forget" confirmation. */
+  let forgetCandidate: StoredConnection | null = $state(null);
+
   const { form, errors, enhance, submitting, message } = superForm(connectionForm, {
-    validators: zod(StorageConnectionSchema)
+    validators: zod(StorageConnectionSchema),
+    onResult: ({ result }) => {
+      if (result.type === 'redirect') {
+        saveConnectionLocally($form);
+      } else {
+        autoConnecting = false;
+      }
+    }
+  });
+
+  /** Display label for a saved connection (hostname or "AWS S3"). */
+  function connectionLabel(conn: StoredConnection): string {
+    if (conn.endpoint) {
+      try {
+        return new URL(conn.endpoint).hostname;
+      } catch {
+        return conn.endpoint;
+      }
+    }
+    return 'AWS S3';
+  }
+
+  /** Fill the form with a saved connection and immediately submit. */
+  function selectConnection(conn: StoredConnection) {
+    $form.type = conn.type;
+    $form.endpoint = conn.endpoint ?? '';
+    $form.region = conn.region;
+    $form.accessKeyId = conn.accessKeyId ?? '';
+    $form.secretAccessKey = conn.secretAccessKey ?? '';
+    tick().then(() => formRef?.requestSubmit());
+  }
+
+  /** Forget a connection from local storage and refresh the list. */
+  function forgetConnection(conn: StoredConnection) {
+    removeConnectionLocally(conn);
+    allConnections = loadAllConnectionsLocally();
+    forgetCandidate = null;
+  }
+
+  onMount(() => {
+    allConnections = loadAllConnectionsLocally();
+    connectionsLoaded = true;
+    const params = new URLSearchParams(window.location.search);
+    if (!storageAutoConnectEnabled || params.has('disconnected')) return;
+    const saved = loadConnectionLocally();
+    if (saved) {
+      autoConnecting = true;
+      $form.type = saved.type;
+      $form.endpoint = saved.endpoint ?? '';
+      $form.region = saved.region;
+      $form.accessKeyId = saved.accessKeyId ?? '';
+      $form.secretAccessKey = saved.secretAccessKey ?? '';
+      tick().then(() => formRef?.requestSubmit());
+    }
   });
 </script>
 
 <div class="mx-auto max-w-md p-6">
-  <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
-  <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+  {#if autoConnecting}
+    <div class="flex flex-col items-center gap-3 py-8">
+      <span class="loading loading-spinner loading-md"></span>
+      <p class="text-base-content/60 text-sm">{m.storage_connect_reconnecting()}</p>
+    </div>
+  {/if}
+
+  <div class:hidden={autoConnecting}>
+    <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
+    <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+
+    <div
+      class="mb-6 h-24 {connectionsLoaded && allConnections.length === 0
+        ? 'bg-base-200 flex items-center justify-center rounded-xl'
+        : ''}"
+    >
+      {#if !connectionsLoaded}
+        <div class="flex h-full items-center justify-center">
+          <span class="loading loading-spinner loading-sm text-base-content/40"></span>
+        </div>
+      {:else if allConnections.length > 0}
+        <p class="text-base-content/50 mb-2 text-xs font-semibold tracking-wide uppercase">
+          {m.storage_connect_saved()}
+        </p>
+        <div
+          class="flex flex-nowrap gap-2 overflow-x-auto overflow-y-visible pt-2 pb-1"
+          role="list"
+          aria-label={m.storage_connect_saved()}
+        >
+          {#each allConnections as conn (conn.type + '|' + (conn.endpoint ?? '') + '|' + (conn.accessKeyId ?? ''))}
+            <div class="relative shrink-0" role="listitem">
+              <button
+                type="button"
+                onclick={() => selectConnection(conn)}
+                class="
+                  border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5
+                  focus-visible:outline-primary flex flex-col items-center gap-1.5 rounded-xl border
+                  p-3 text-center transition-colors
+                "
+                title={connectionLabel(conn)}
+              >
+                <Icon
+                  icon="material-symbols:storage"
+                  class="text-primary size-8"
+                  aria-hidden="true"
+                />
+                <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
+              </button>
+              <button
+                type="button"
+                aria-label={m.storage_connect_forget_label({ endpoint: connectionLabel(conn) })}
+                onclick={(e) => {
+                  e.stopPropagation();
+                  forgetCandidate = conn;
+                }}
+                class="
+                  border-base-300 bg-base-100 text-error hover:bg-error hover:text-error-content
+                  absolute -top-2 -right-2 flex size-5 items-center justify-center
+                  rounded-full border shadow-sm transition-colors
+                "
+              >
+                <Icon icon="material-symbols:close" class="size-3" aria-hidden="true" />
+              </button>
+            </div>
+          {/each}
+        </div>
+      {:else}
+        <p class="text-base-content/50 text-sm">{m.storage_connect_no_saved()}</p>
+      {/if}
+    </div>
+  </div>
 
   <form
+    bind:this={formRef}
     method="POST"
     action="?/connect"
     use:enhance
+    class:hidden={autoConnecting}
     class="
     flex flex-col gap-4
   "
@@ -139,3 +282,28 @@
     </button>
   </form>
 </div>
+
+{#if forgetCandidate}
+  <dialog open class="modal modal-open">
+    <div class="modal-box">
+      <p class="text-base-content font-medium">
+        {m.storage_connect_forget_confirm({ endpoint: connectionLabel(forgetCandidate) })}
+      </p>
+      <div class="modal-action">
+        <button type="button" class="btn btn-ghost btn-sm" onclick={() => (forgetCandidate = null)}>
+          {m.storage_connect_forget_cancel()}
+        </button>
+        <button
+          type="button"
+          class="btn btn-error btn-sm"
+          onclick={() => forgetConnection(forgetCandidate!)}
+        >
+          {m.storage_connect_forget()}
+        </button>
+      </div>
+    </div>
+    <form method="dialog" class="modal-backdrop">
+      <button onclick={() => (forgetCandidate = null)}>close</button>
+    </form>
+  </dialog>
+{/if}
diff --git a/src/lib/storage/connection-storage.ts b/src/lib/storage/connection-storage.ts
new file mode 100644
index 00000000..9bf1f3ea
--- /dev/null
+++ b/src/lib/storage/connection-storage.ts
@@ -0,0 +1,64 @@
+import type { z } from 'zod';
+import type { StorageConnectionSchema } from './schemas.js';
+
+type StoredConnection = z.infer<typeof StorageConnectionSchema>;
+
+const STORAGE_KEY = 'stackable_storage_connections';
+
+/** Unique key for deduplicating connections by type, endpoint, and access key. */
+function connectionKey(c: StoredConnection): string {
+  return `${c.type}|${c.endpoint ?? ''}|${c.accessKeyId ?? ''}`;
+}
+
+/**
+ * Load all stored connections, migrating from the legacy single-connection
+ * format if present. Returns connections oldest-first (most recent is last).
+ */
+function getConnections(): StoredConnection[] {
+  try {
+    const raw = localStorage.getItem(STORAGE_KEY);
+    if (!raw) return [];
+    return JSON.parse(raw) as StoredConnection[];
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Save a connection. If a connection with the same type, endpoint, and access
+ * key already exists it is replaced and moved to the end (most recently used).
+ */
+export function saveConnectionLocally(data: StoredConnection): void {
+  try {
+    const all = getConnections();
+    const key = connectionKey(data);
+    const filtered = all.filter((c) => connectionKey(c) !== key);
+    filtered.push(data);
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
+  } catch {
+    // localStorage may be unavailable (e.g. private browsing quota exceeded)
+  }
+}
+
+/** Return the most recently used connection (last in the list), or null. */
+export function loadConnectionLocally(): StoredConnection | null {
+  const all = getConnections();
+  return all.length > 0 ? all[all.length - 1] : null;
+}
+
+/** Return all stored connections in stored order (oldest first). */
+export function loadAllConnectionsLocally(): StoredConnection[] {
+  return getConnections();
+}
+
+/** Remove a specific connection from storage without clearing others. */
+export function removeConnectionLocally(data: StoredConnection): void {
+  try {
+    const all = getConnections();
+    const key = connectionKey(data);
+    const filtered = all.filter((c) => connectionKey(c) !== key);
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
+  } catch {
+    // localStorage may be unavailable
+  }
+}
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 53872a5f..9a7e8a29 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -64,6 +64,6 @@ export const actions: Actions = {
     const userId = getUserId(locals);
     clearConnection(userId);
     locals.logger.info({ user_id: userId }, 'user storage connection cleared');
-    throw redirect(303, '/storage');
+    throw redirect(303, '/storage?disconnected=1');
   }
 };

From 7625c66fca4ab7abbeccfa6ebc2c7437233ce7c7 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 20 May 2026 08:55:39 +0200
Subject: [PATCH 033/136] #146 Bugfix: Deleting Directories (#147)

* #146 fix deleting directories, remove directory and contents from recent locations/files

* #146 move pin and recency cleanup to delete.ts

* #146 add confirmation box special to deleting directories, bugfix deleting multiple files at once not handling multiple deletions
---
 messages/de.json                              |  2 ++
 messages/en.json                              |  2 ++
 .../storage/DeleteConfirmModal.svelte         | 27 ++++++++++++++++---
 .../components/storage/FileExplorer.svelte    |  2 +-
 src/lib/server/storage/hdfs-provider.ts       |  4 +++
 src/lib/server/storage/provider.ts            |  5 ++++
 src/lib/server/storage/s3-provider.ts         | 23 ++++++++++++++++
 src/lib/server/storage/service.ts             | 24 ++++++++++++++---
 src/lib/storage/delete.ts                     | 13 ++++++++-
 src/lib/stores/pinned-locations.svelte.ts     | 17 ++++++++++++
 src/lib/stores/recent-items.svelte.ts         | 27 +++++++++++++++++++
 11 files changed, 136 insertions(+), 10 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index a226d929..b32e1230 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -199,6 +199,8 @@
   "storage_delete_confirm_title_one": "\u201e{name}\u201c löschen?",
   "storage_delete_confirm_title_many": "{count} Elemente löschen?",
   "storage_delete_confirm_message": "Diese Aktion kann nicht rückgängig gemacht werden.",
+  "storage_delete_dir_warning_heading": "Alle Inhalte werden dauerhaft gelöscht",
+  "storage_delete_dir_warning_body": "Beim Löschen eines Ordners werden alle darin enthaltenen Dateien und Unterordner entfernt. Dies kann nicht rückgängig gemacht werden.",
   "storage_delete_confirm_button": "Endgültig löschen",
   "storage_delete_cancel": "Abbrechen",
   "storage_delete_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
diff --git a/messages/en.json b/messages/en.json
index 8765634b..6fa6e261 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -199,6 +199,8 @@
   "storage_delete_confirm_title_one": "Delete \"{name}\"?",
   "storage_delete_confirm_title_many": "Delete {count} items?",
   "storage_delete_confirm_message": "This action cannot be undone.",
+  "storage_delete_dir_warning_heading": "All contents will be permanently deleted",
+  "storage_delete_dir_warning_body": "Deleting a folder removes every file and subfolder inside it. This cannot be undone.",
   "storage_delete_confirm_button": "Delete permanently",
   "storage_delete_cancel": "Cancel",
   "storage_delete_error_not_connected": "No storage connection configured. Please connect first.",
diff --git a/src/lib/components/storage/DeleteConfirmModal.svelte b/src/lib/components/storage/DeleteConfirmModal.svelte
index 70db4e5c..e1dc1c10 100644
--- a/src/lib/components/storage/DeleteConfirmModal.svelte
+++ b/src/lib/components/storage/DeleteConfirmModal.svelte
@@ -14,19 +14,38 @@
 
   const count = $derived(keys.length);
   const firstName = $derived(keys[0]?.split('/').filter(Boolean).pop() ?? '');
+  const hasDirectories = $derived(keys.some((k) => k.endsWith('/')));
 </script>
 
 <Modal bind:open class="modal">
-  <div class="modal-box max-w-sm">
+  <div class="modal-box {hasDirectories ? 'max-w-md' : 'max-w-sm'}">
     <h3 class="text-error mb-3 flex items-center gap-2 text-lg font-bold">
       <Icon icon="material-symbols:delete-forever" class="size-5 shrink-0" aria-hidden="true" />
       {count === 1
         ? m.storage_delete_confirm_title_one({ name: firstName })
         : m.storage_delete_confirm_title_many({ count })}
     </h3>
-    <p class="text-base-content/80 text-sm">
-      {m.storage_delete_confirm_message()}
-    </p>
+
+    {#if hasDirectories}
+      <div class="border-error/40 bg-error/10 mb-4 rounded-lg border p-4" role="alert">
+        <p class="text-error mb-1 flex items-center gap-2 font-semibold">
+          <Icon
+            icon="material-symbols:warning-rounded"
+            class="size-5 shrink-0"
+            aria-hidden="true"
+          />
+          {m.storage_delete_dir_warning_heading()}
+        </p>
+        <p class="text-base-content/80 text-sm">
+          {m.storage_delete_dir_warning_body()}
+        </p>
+      </div>
+    {:else}
+      <p class="text-base-content/80 text-sm">
+        {m.storage_delete_confirm_message()}
+      </p>
+    {/if}
+
     <div class="modal-action mt-6">
       <button class="btn btn-ghost" onclick={onCancel}>
         {m.storage_delete_cancel()}
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 92063890..25aff6f4 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -191,7 +191,7 @@
     };
 
     if (action === 'delete') {
-      pendingDeleteKeys = effectiveSelectedKeys;
+      pendingDeleteKeys = [...selectedKeys];
       showDeleteModal = true;
       return;
     }
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 327fa26a..4427860d 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -37,4 +37,8 @@ export class HDFSStorageProvider implements StorageProvider {
   deleteObjects(_keys: string[]): Promise<DeleteObjectsResult> {
     throw new Error('HDFS not implemented');
   }
+
+  listAllKeys(_prefix: string): Promise<string[]> {
+    throw new Error('HDFS not implemented');
+  }
 }
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index bf488f16..a874c1a2 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -31,4 +31,9 @@ export interface StorageProvider {
   getMetadata(key: string): Promise<StorageMetadata>;
   exists(key: string): Promise<boolean>;
   deleteObjects(keys: string[]): Promise<DeleteObjectsResult>;
+  /**
+   * List all object keys under a prefix, recursively (no delimiter).
+   * Used to expand directory prefixes before deletion.
+   */
+  listAllKeys(prefix: string): Promise<string[]>;
 }
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index abfcd6f8..69af282f 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -147,4 +147,27 @@ export class S3StorageProvider implements StorageProvider {
     }
     return { failed };
   }
+
+  async listAllKeys(prefix: string): Promise<string[]> {
+    log.debug({ bucket: this.bucket, prefix }, 'listing all keys under prefix');
+    const keys: string[] = [];
+    let continuationToken: string | undefined;
+
+    do {
+      const output: ListObjectsV2CommandOutput = await this.client.send(
+        new ListObjectsV2Command({
+          Bucket: this.bucket,
+          Prefix: prefix,
+          ContinuationToken: continuationToken
+        })
+      );
+      for (const obj of output.Contents ?? []) {
+        if (obj.Key) keys.push(obj.Key);
+      }
+      continuationToken = output.IsTruncated ? output.NextContinuationToken : undefined;
+    } while (continuationToken);
+
+    log.debug({ bucket: this.bucket, prefix, key_count: keys.length }, 'listed all keys');
+    return keys;
+  }
 }
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index 8511b67e..59bded48 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -86,7 +86,8 @@ export async function getObjectMetadata(
   }
 }
 
-/** Delete one or more objects from the bucket. Returns a result listing any keys that failed. */
+/** Delete one or more objects from the bucket. Returns a result listing any keys that failed.
+ *  Directory keys (ending with '/') are expanded to all contained objects before deletion. */
 export async function deleteObjects(
   userId: string,
   bucket: string,
@@ -95,10 +96,25 @@ export async function deleteObjects(
   const provider = getProviderForUser(userId, bucket);
 
   try {
-    log.debug({ user_id: userId, bucket, key_count: keys.length }, 'deleting objects');
-    const result = await provider.deleteObjects(keys);
+    // Expand any directory prefixes (keys ending with '/') to their contents.
+    const dirPrefixes = keys.filter((k) => k.endsWith('/'));
+    const fileKeys = keys.filter((k) => !k.endsWith('/'));
+
+    let allKeys = [...fileKeys];
+    for (const prefix of dirPrefixes) {
+      log.debug({ user_id: userId, bucket, prefix }, 'expanding directory prefix for deletion');
+      const children = await provider.listAllKeys(prefix);
+      allKeys = allKeys.concat(children.length > 0 ? children : [prefix]);
+    }
+
+    if (allKeys.length === 0) {
+      return { failed: [] };
+    }
+
+    log.debug({ user_id: userId, bucket, key_count: allKeys.length }, 'deleting objects');
+    const result = await provider.deleteObjects(allKeys);
     log.info(
-      { user_id: userId, bucket, key_count: keys.length, failed_count: result.failed.length },
+      { user_id: userId, bucket, key_count: allKeys.length, failed_count: result.failed.length },
       'objects delete completed'
     );
     return result;
diff --git a/src/lib/storage/delete.ts b/src/lib/storage/delete.ts
index d7cc1490..ffebbc23 100644
--- a/src/lib/storage/delete.ts
+++ b/src/lib/storage/delete.ts
@@ -3,6 +3,8 @@
  */
 
 import type { DeleteObjectsResult } from '$lib/storage/types.js';
+import { unpinUnderDirectories } from '$lib/stores/pinned-locations.svelte.js';
+import { removeItemsUnderDirectories } from '$lib/stores/recent-items.svelte.js';
 
 export type DeleteErrorCode = 'not_connected' | 'access_denied' | 'server_error' | 'unknown';
 
@@ -38,5 +40,14 @@ export async function deleteObjects(bucket: string, keys: string[]): Promise<Del
     throw new DeleteError(mapStatusToCode(res.status), `Delete failed with status ${res.status}`);
   }
 
-  return (await res.json()) as DeleteObjectsResult;
+  const result = (await res.json()) as DeleteObjectsResult;
+
+  // Clean up pinned locations and recent items for any deleted directories.
+  const dirPrefixes = keys.filter((k) => k.endsWith('/'));
+  if (dirPrefixes.length > 0) {
+    unpinUnderDirectories(bucket, dirPrefixes);
+    removeItemsUnderDirectories(bucket, dirPrefixes);
+  }
+
+  return result;
 }
diff --git a/src/lib/stores/pinned-locations.svelte.ts b/src/lib/stores/pinned-locations.svelte.ts
index 416be9e5..45652f6b 100644
--- a/src/lib/stores/pinned-locations.svelte.ts
+++ b/src/lib/stores/pinned-locations.svelte.ts
@@ -45,6 +45,23 @@ export function isPinned(bucket: string, prefix: string): boolean {
   return pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix);
 }
 
+/**
+ * Remove all pinned locations that reside inside any of the given directory
+ * prefixes (keys ending with '/') within the given bucket.
+ * Called after a directory is deleted so stale pins are cleaned up.
+ */
+export function unpinUnderDirectories(bucket: string, dirPrefixes: string[]): void {
+  if (dirPrefixes.length === 0) return;
+  const underAny = (prefix: string) =>
+    dirPrefixes.some((p) => prefix === p || prefix.startsWith(p));
+  const before = pinnedLocations.length;
+  const keep = pinnedLocations.filter((pin) => !(pin.bucket === bucket && underAny(pin.prefix)));
+  if (keep.length !== before) {
+    pinnedLocations.splice(0, pinnedLocations.length, ...keep);
+    persist();
+  }
+}
+
 /** Returns the navigation href for a storage location (bucket + optional prefix). */
 export function storageHref(bucket: string, prefix: string): string {
   if (!prefix) return `/storage/${encodeURIComponent(bucket)}`;
diff --git a/src/lib/stores/recent-items.svelte.ts b/src/lib/stores/recent-items.svelte.ts
index cca64456..ee3804b8 100644
--- a/src/lib/stores/recent-items.svelte.ts
+++ b/src/lib/stores/recent-items.svelte.ts
@@ -115,3 +115,30 @@ export function fileHref(file: RecentFile): string {
 export function locationHref(loc: RecentLocation): string {
   return storageHref(loc.bucket, loc.prefix);
 }
+
+/**
+ * Remove all recent files and locations that reside inside any of the given
+ * directory prefixes (keys ending with '/') within the given bucket.
+ * Called after a directory is deleted so stale entries are cleaned up.
+ */
+export function removeItemsUnderDirectories(bucket: string, dirPrefixes: string[]): void {
+  if (dirPrefixes.length === 0) return;
+
+  const underAny = (path: string) => dirPrefixes.some((p) => path === p || path.startsWith(p));
+
+  const removedFiles = recentFiles.filter((f) => f.bucket === bucket && underAny(f.key)).length;
+  if (removedFiles > 0) {
+    const keep = recentFiles.filter((f) => !(f.bucket === bucket && underAny(f.key)));
+    recentFiles.splice(0, recentFiles.length, ...keep);
+    persist(LS_FILES, [...recentFiles]);
+  }
+
+  const removedLocs = recentLocations.filter(
+    (l) => l.bucket === bucket && underAny(l.prefix)
+  ).length;
+  if (removedLocs > 0) {
+    const keep = recentLocations.filter((l) => !(l.bucket === bucket && underAny(l.prefix)));
+    recentLocations.splice(0, recentLocations.length, ...keep);
+    persist(LS_LOCATIONS, [...recentLocations]);
+  }
+}

From 45f61ef702a21012f01aeb166fe4d56fd2307f02 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 20 May 2026 08:57:37 +0200
Subject: [PATCH 034/136] #138 add svelte best practices (#139)

---
 .github/skills/svelte-best-practices/SKILL.md | 177 +++++++++++
 .../references/$inspect.md                    |  53 ++++
 .../references/@attach.md                     | 166 +++++++++++
 .../references/@render.md                     |  35 +++
 .../references/await-expressions.md           | 180 ++++++++++++
 .../svelte-best-practices/references/bind.md  |  16 +
 .../svelte-best-practices/references/each.md  |  42 +++
 .../references/hydratable.md                  | 100 +++++++
 .../references/snippet.md                     | 276 ++++++++++++++++++
 .../references/svelte-reactivity.md           |  61 ++++
 10 files changed, 1106 insertions(+)
 create mode 100644 .github/skills/svelte-best-practices/SKILL.md
 create mode 100644 .github/skills/svelte-best-practices/references/$inspect.md
 create mode 100644 .github/skills/svelte-best-practices/references/@attach.md
 create mode 100644 .github/skills/svelte-best-practices/references/@render.md
 create mode 100644 .github/skills/svelte-best-practices/references/await-expressions.md
 create mode 100644 .github/skills/svelte-best-practices/references/bind.md
 create mode 100644 .github/skills/svelte-best-practices/references/each.md
 create mode 100644 .github/skills/svelte-best-practices/references/hydratable.md
 create mode 100644 .github/skills/svelte-best-practices/references/snippet.md
 create mode 100644 .github/skills/svelte-best-practices/references/svelte-reactivity.md

diff --git a/.github/skills/svelte-best-practices/SKILL.md b/.github/skills/svelte-best-practices/SKILL.md
new file mode 100644
index 00000000..420ec0bf
--- /dev/null
+++ b/.github/skills/svelte-best-practices/SKILL.md
@@ -0,0 +1,177 @@
+
+---
+name: svelte-best-practices
+description: Follow Svelte 5 and SvelteKit best practices for this repository.
+---
+
+## `$state`
+
+Only use the `$state` rune for variables that should be _reactive_ — in other words, variables that cause an `$effect`, `$derived` or template expression to update. Everything else can be a normal variable.
+
+Objects and arrays (`$state({...})` or `$state([...])`) are made deeply reactive, meaning mutation will trigger updates. This has a trade-off: in exchange for fine-grained reactivity, the objects must be proxied, which has performance overhead. In cases where you're dealing with large objects that are only ever reassigned (rather than mutated), use `$state.raw` instead. This is often the case with API responses, for example.
+
+## `$derived`
+
+To compute something from state, use `$derived` rather than `$effect`:
+
+```js
+// do this
+let square = $derived(num * num);
+
+// don't do this
+let square;
+
+$effect(() => {
+	square = num * num;
+});
+```
+
+> [!NOTE] `$derived` is given an expression, _not_ a function. If you need to use a function (because the expression is complex, for example) use `$derived.by`.
+
+Deriveds are writable — you can assign to them, just like `$state`, except that they will re-evaluate when their expression changes.
+
+If the derived expression is an object or array, it will be returned as-is — it is _not_ made deeply reactive. You can, however, use `$state` inside `$derived.by` in the rare cases that you need this.
+
+## `$effect`
+
+Effects are an escape hatch and should mostly be avoided. In particular, avoid updating state inside effects.
+
+- If you need to sync state to an external library such as D3, it is often neater to use [`{@attach ...}`](references/@attach.md)
+- If you need to run some code in response to user interaction, put the code directly in an event handler or use a [function binding](references/bind.md) as appropriate
+- If you need to log values for debugging purposes, use [`$inspect`](references/$inspect.md)
+- If you need to observe something external to Svelte, use [`createSubscriber`](references/svelte-reactivity.md)
+
+Never wrap the contents of an effect in `if (browser) {...}` or similar — effects do not run on the server.
+
+## `$props`
+
+Treat props as though they will change. For example, values that depend on props should usually use `$derived`:
+
+```js
+// @errors: 2451
+let { type } = $props();
+
+// do this
+let color = $derived(type === 'danger' ? 'red' : 'green');
+
+// don't do this — `color` will not update if `type` changes
+let color = type === 'danger' ? 'red' : 'green';
+```
+
+## `$inspect.trace`
+
+`$inspect.trace` is a debugging tool for reactivity. If something is not updating properly or running more than it should you can add `$inspect.trace(label)` as the first line of an `$effect` or `$derived.by` (or any function they call) to trace their dependencies and discover which one triggered an update.
+
+## Events
+
+Any element attribute starting with `on` is treated as an event listener:
+
+```svelte
+<button onclick={() => {...}}>click me</button>
+
+<!-- attribute shorthand also works -->
+<button {onclick}>...</button>
+
+<!-- so do spread attributes -->
+<button {...props}>...</button>
+```
+
+If you need to attach listeners to `window` or `document` you can use `<svelte:window>` and `<svelte:document>`:
+
+```svelte
+<svelte:window onkeydown={...} />
+<svelte:document onvisibilitychange={...} />
+```
+
+Avoid using `onMount` or `$effect` for this.
+
+## Snippets
+
+[Snippets](references/snippet.md) are a way to define reusable chunks of markup that can be instantiated with the [`{@render ...}`](references/@render.md) tag, or passed to components as props. They must be declared within the template.
+
+```svelte
+{#snippet greeting(name)}
+	<p>hello {name}!</p>
+{/snippet}
+
+{@render greeting('world')}
+```
+
+> [!NOTE] Snippets declared at the top level of a component (i.e. not inside elements or blocks) can be referenced inside `<script>`. A snippet that doesn't reference component state is also available in a `<script module>`, in which case it can be exported for use by other components.
+
+## Each blocks
+
+Prefer to use [keyed each blocks](references/each.md) — this improves performance by allowing Svelte to surgically insert or remove items rather than updating the DOM belonging to existing items.
+
+> [!NOTE] The key _must_ uniquely identify the object. Do not use the index as a key.
+
+Avoid destructuring if you need to mutate the item (with something like `bind:value={item.count}`, for example).
+
+## Using JavaScript variables in CSS
+
+If you have a JS variable that you want to use inside CSS you can set a CSS custom property with the `style:` directive.
+
+```svelte
+<div style:--columns={columns}>...</div>
+```
+
+You can then reference `var(--columns)` inside the component's `<style>`.
+
+## Styling child components
+
+The CSS in a component's `<style>` is scoped to that component. If a parent component needs to control the child's styles, the preferred way is to use CSS custom properties:
+
+```svelte
+<!-- Parent.svelte -->
+<Child --color="red" />
+
+<!-- Child.svelte -->
+<h1>Hello</h1>
+
+<style>
+	h1 {
+		color: var(--color);
+	}
+</style>
+```
+
+If this is impossible (for example, the child component comes from a library) you can use `:global` to override styles:
+
+```svelte
+<div>
+	<Child />
+</div>
+
+<style>
+	div :global {
+		h1 {
+			color: red;
+		}
+	}
+</style>
+```
+
+## Context
+
+Consider using context instead of declaring state in a shared module. This will scope the state to the part of the app that needs it, and eliminate the possibility of it leaking between users when server-side rendering.
+
+Use `createContext` rather than `setContext` and `getContext`, as it provides type safety.
+
+## Async Svelte
+
+If using version 5.36 or higher, you can use [await expressions](references/await-expressions.md) and [hydratable](references/hydratable.md) to use promises directly inside components. Note that these require the `experimental.async` option to be enabled in `svelte.config.js` as they are not yet considered fully stable.
+
+## Avoid legacy features
+
+Always use runes mode for new code, and avoid features that have more modern replacements:
+
+- use `$state` instead of implicit reactivity (e.g. `let count = 0; count += 1`)
+- use `$derived` and `$effect` instead of `$:` assignments and statements (but only use effects when there is no better solution)
+- use `$props` instead of `export let`, `$$props` and `$$restProps`
+- use `onclick={...}` instead of `on:click={...}`
+- use `{#snippet ...}` and `{@render ...}` instead of `<slot>` and `$$slots` and `<svelte:fragment>`
+- use `<DynamicComponent>` instead of `<svelte:component this={DynamicComponent}>`
+- use `import Self from './ThisComponent.svelte'` and `<Self>` instead of `<svelte:self>`
+- use classes with `$state` fields to share reactivity between components, instead of using stores
+- use `{@attach ...}` instead of `use:action`
+- use clsx-style arrays and objects in `class` attributes, instead of the `class:` directive
\ No newline at end of file
diff --git a/.github/skills/svelte-best-practices/references/$inspect.md b/.github/skills/svelte-best-practices/references/$inspect.md
new file mode 100644
index 00000000..31171fd7
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/$inspect.md
@@ -0,0 +1,53 @@
+> [!NOTE] `$inspect` only works during development. In a production build it becomes a noop.
+
+The `$inspect` rune is roughly equivalent to `console.log`, with the exception that it will re-run whenever its argument changes. `$inspect` tracks reactive state deeply, meaning that updating something inside an object or array using fine-grained reactivity will cause it to re-fire (demo:
+
+```svelte
+<script>
+	let count = $state(0);
+	let message = $state('hello');
+
+	$inspect(count, message); // will console.log when `count` or `message` change
+</script>
+
+<button onclick={() => count++}>Increment</button>
+<input bind:value={message} />
+```
+
+On updates, a stack trace will be printed, making it easy to find the origin of a state change (unless you're in the playground, due to technical limitations).
+
+## $inspect(...).with
+
+`$inspect` returns a property `with`, which you can invoke with a callback, which will then be invoked instead of `console.log`. The first argument to the callback is either `"init"` or `"update"`; subsequent arguments are the values passed to `$inspect` (demo:
+
+```svelte
+<script>
+	let count = $state(0);
+
+	$inspect(count).with((type, count) => {
+		if (type === 'update') {
+			debugger; // or `console.trace`, or whatever you want
+		}
+	});
+</script>
+
+<button onclick={() => count++}>Increment</button>
+```
+
+## $inspect.trace(...)
+
+This rune, added in 5.14, causes the surrounding function to be _traced_ in development. Any time the function re-runs as part of an [effect]($effect) or a [derived]($derived), information will be printed to the console about which pieces of reactive state caused the effect to fire.
+
+```svelte
+<script>
+	import { doSomeWork } from './elsewhere';
+
+	$effect(() => {
+		+++// $inspect.trace must be the first statement of a function body+++
+		+++$inspect.trace();+++
+		doSomeWork();
+	});
+</script>
+```
+
+`$inspect.trace` takes an optional first argument which will be used as the label.
diff --git a/.github/skills/svelte-best-practices/references/@attach.md b/.github/skills/svelte-best-practices/references/@attach.md
new file mode 100644
index 00000000..5c113b16
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/@attach.md
@@ -0,0 +1,166 @@
+Attachments are functions that run in an [effect]($effect) when an element is mounted to the DOM or when [state]($state) read inside the function updates.
+
+Optionally, they can return a function that is called before the attachment re-runs, or after the element is later removed from the DOM.
+
+> [!NOTE]
+> Attachments are available in Svelte 5.29 and newer.
+
+```svelte
+<!--- file: App.svelte --->
+<script>
+	/** @type {import('svelte/attachments').Attachment} */
+	function myAttachment(element) {
+		console.log(element.nodeName); // 'DIV'
+
+		return () => {
+			console.log('cleaning up');
+		};
+	}
+</script>
+
+<div {@attach myAttachment}>...</div>
+```
+
+An element can have any number of attachments.
+
+## Attachment factories
+
+A useful pattern is for a function, such as `tooltip` in this example, to _return_ an attachment (demo:
+
+```svelte
+<!--- file: App.svelte --->
+<script>
+	import tippy from 'tippy.js';
+
+	let content = $state('Hello!');
+
+	/**
+	 * @param {string} content
+	 * @returns {import('svelte/attachments').Attachment}
+	 */
+	function tooltip(content) {
+		return (element) => {
+			const tooltip = tippy(element, { content });
+			return tooltip.destroy;
+		};
+	}
+</script>
+
+<input bind:value={content} />
+
+<button {@attach tooltip(content)}> Hover me </button>
+```
+
+Since the `tooltip(content)` expression runs inside an [effect]($effect), the attachment will be destroyed and recreated whenever `content` changes. The same thing would happen for any state read _inside_ the attachment function when it first runs. (If this isn't what you want, see [Controlling when attachments re-run](#Controlling-when-attachments-re-run).)
+
+## Inline attachments
+
+Attachments can also be created inline (demo:
+
+```svelte
+<!--- file: App.svelte --->
+<canvas
+	width={32}
+	height={32}
+	{@attach (canvas) => {
+		const context = canvas.getContext('2d');
+
+		$effect(() => {
+			context.fillStyle = color;
+			context.fillRect(0, 0, canvas.width, canvas.height);
+		});
+	}}
+></canvas>
+```
+
+> [!NOTE]
+> The nested effect runs whenever `color` changes, while the outer effect (where `canvas.getContext(...)` is called) only runs once, since it doesn't read any reactive state.
+
+## Conditional attachments
+
+Falsy values like `false` or `undefined` are treated as no attachment, enabling conditional usage:
+
+```svelte
+<div {@attach enabled && myAttachment}>...</div>
+```
+
+## Passing attachments to components
+
+When used on a component, `{@attach ...}` will create a prop whose key is a [`Symbol`](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Symbol). If the component then [spreads](/tutorial/svelte/spread-props) props onto an element, the element will receive those attachments.
+
+This allows you to create _wrapper components_ that augment elements (demo:
+
+```svelte
+<!--- file: Button.svelte --->
+<script>
+	/** @type {import('svelte/elements').HTMLButtonAttributes} */
+	let { children, ...props } = $props();
+</script>
+
+<!-- `props` includes attachments -->
+<button {...props}>
+	{@render children?.()}
+</button>
+```
+
+```svelte
+<!--- file: App.svelte --->
+<script>
+	import tippy from 'tippy.js';
+	import Button from './Button.svelte';
+
+	let content = $state('Hello!');
+
+	/**
+	 * @param {string} content
+	 * @returns {import('svelte/attachments').Attachment}
+	 */
+	function tooltip(content) {
+		return (element) => {
+			const tooltip = tippy(element, { content });
+			return tooltip.destroy;
+		};
+	}
+</script>
+
+<input bind:value={content} />
+
+<Button {@attach tooltip(content)}>Hover me</Button>
+```
+
+## Controlling when attachments re-run
+
+Attachments, unlike [actions](use), are fully reactive: `{@attach foo(bar)}` will re-run on changes to `foo` _or_ `bar` (or any state read inside `foo`):
+
+```js
+// @errors: 7006 2304 2552
+function foo(bar) {
+	return (node) => {
+		veryExpensiveSetupWork(node);
+		update(node, bar);
+	};
+}
+```
+
+In the rare case that this is a problem (for example, if `foo` does expensive and unavoidable setup work) consider passing the data inside a function and reading it in a child effect:
+
+```js
+// @errors: 7006 2304 2552
+function foo(+++getBar+++) {
+	return (node) => {
+		veryExpensiveSetupWork(node);
+
++++		$effect(() => {
+			update(node, getBar());
+		});+++
+	}
+}
+```
+
+## Creating attachments programmatically
+
+To add attachments to an object that will be spread onto a component or element, use [`createAttachmentKey`](svelte-attachments#createAttachmentKey).
+
+## Converting actions to attachments
+
+If you're using a library that only provides actions, you can convert them to attachments with [`fromAction`](svelte-attachments#fromAction), allowing you to (for example) use them with components.
diff --git a/.github/skills/svelte-best-practices/references/@render.md b/.github/skills/svelte-best-practices/references/@render.md
new file mode 100644
index 00000000..2e606855
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/@render.md
@@ -0,0 +1,35 @@
+To render a [snippet](snippet), use a `{@render ...}` tag.
+
+```svelte
+{#snippet sum(a, b)}
+	<p>{a} + {b} = {a + b}</p>
+{/snippet}
+
+{@render sum(1, 2)}
+{@render sum(3, 4)}
+{@render sum(5, 6)}
+```
+
+The expression can be an identifier like `sum`, or an arbitrary JavaScript expression:
+
+```svelte
+{@render (cool ? coolSnippet : lameSnippet)()}
+```
+
+## Optional snippets
+
+If the snippet is potentially undefined — for example, because it's an incoming prop — then you can use optional chaining to only render it when it _is_ defined:
+
+```svelte
+{@render children?.()}
+```
+
+Alternatively, use an [`{#if ...}`](if) block with an `:else` clause to render fallback content:
+
+```svelte
+{#if children}
+	{@render children()}
+{:else}
+	<p>fallback content</p>
+{/if}
+```
diff --git a/.github/skills/svelte-best-practices/references/await-expressions.md b/.github/skills/svelte-best-practices/references/await-expressions.md
new file mode 100644
index 00000000..18c22316
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/await-expressions.md
@@ -0,0 +1,180 @@
+As of Svelte 5.36, you can use the `await` keyword inside your components in three places where it was previously unavailable:
+
+- at the top level of your component's `<script>`
+- inside `$derived(...)` declarations
+- inside your markup
+
+This feature is currently experimental, and you must opt in by adding the `experimental.async` option wherever you [configure](/docs/kit/configuration) Svelte, usually `svelte.config.js`:
+
+```js
+/// file: svelte.config.js
+export default {
+	compilerOptions: {
+		experimental: {
+			async: true,
+		},
+	},
+};
+```
+
+The experimental flag will be removed in Svelte 6.
+
+## Synchronized updates
+
+When an `await` expression depends on a particular piece of state, changes to that state will not be reflected in the UI until the asynchronous work has completed, so that the UI is not left in an inconsistent state. In other words, in an example like this...
+
+```svelte
+<script>
+	let a = $state(1);
+	let b = $state(2);
+
+	async function add(a, b) {
+		await new Promise((f) => setTimeout(f, 500)); // artificial delay
+		return a + b;
+	}
+</script>
+
+<input type="number" bind:value={a} />
+<input type="number" bind:value={b} />
+
+<p>{a} + {b} = {await add(a, b)}</p>
+```
+
+...if you increment `a`, the contents of the `<p>` will _not_ immediately update to read this —
+
+```html
+<p>2 + 2 = 3</p>
+```
+
+— instead, the text will update to `2 + 2 = 4` when `add(a, b)` resolves.
+
+Updates can overlap — a fast update will be reflected in the UI while an earlier slow update is still ongoing.
+
+## Concurrency
+
+Svelte will do as much asynchronous work as it can in parallel. For example if you have two `await` expressions in your markup...
+
+```svelte
+<p>{await one()}</p><p>{await two()}</p>
+```
+
+...both functions will run at the same time, as they are independent expressions, even though they are _visually_ sequential.
+
+This does not apply to sequential `await` expressions inside your `<script>` or inside async functions — these run like any other asynchronous JavaScript. An exception is that independent `$derived` expressions will update independently, even though they will run sequentially when they are first created:
+
+```js
+// these will run sequentially the first time,
+// but will update independently
+let a = $derived(await one());
+let b = $derived(await two());
+```
+
+> [!NOTE] If you write code like this, expect Svelte to give you an [`await_waterfall`](runtime-warnings#Client-warnings-await_waterfall) warning
+
+## Indicating loading states
+
+To render placeholder UI, you can wrap content in a `<svelte:boundary>` with a [`pending`](svelte-boundary#Properties-pending) snippet. This will be shown when the boundary is first created, but not for subsequent updates, which are globally coordinated.
+
+After the contents of a boundary have resolved for the first time and have replaced the `pending` snippet, you can detect subsequent async work with [`$effect.pending()`]($effect#$effect.pending). This is what you would use to display a "we're asynchronously validating your input" spinner next to a form field, for example.
+
+You can also use [`settled()`](svelte#settled) to get a promise that resolves when the current update is complete:
+
+```js
+import { tick, settled } from 'svelte';
+
+async function onclick() {
+	updating = true;
+
+	// without this, the change to `updating` will be
+	// grouped with the other changes, meaning it
+	// won't be reflected in the UI
+	await tick();
+
+	color = 'octarine';
+	answer = 42;
+
+	await settled();
+
+	// any updates affected by `color` or `answer`
+	// have now been applied
+	updating = false;
+}
+```
+
+## Error handling
+
+Errors in `await` expressions will bubble to the nearest [error boundary](svelte-boundary).
+
+## Server-side rendering
+
+Svelte supports asynchronous server-side rendering (SSR) with the `render(...)` API. To use it, simply await the return value:
+
+```js
+/// file: server.js
+import { render } from 'svelte/server';
+import App from './App.svelte';
+
+const { head, body } = +++await+++ render(App);
+```
+
+> [!NOTE] If you're using a framework like SvelteKit, this is done on your behalf.
+
+If a `<svelte:boundary>` with a `pending` snippet is encountered during SSR, that snippet will be rendered while the rest of the content is ignored. All `await` expressions encountered outside boundaries with `pending` snippets will resolve and render their contents prior to `await render(...)` returning.
+
+> [!NOTE] In the future, we plan to add a streaming implementation that renders the content in the background.
+
+## Forking
+
+The [`fork(...)`](svelte#fork) API, added in 5.42, makes it possible to run `await` expressions that you _expect_ to happen in the near future. This is mainly intended for frameworks like SvelteKit to implement preloading when (for example) users signal an intent to navigate.
+
+```svelte
+<script>
+	import { fork } from 'svelte';
+	import Menu from './Menu.svelte';
+
+	let open = $state(false);
+
+	/** @type {import('svelte').Fork | null} */
+	let pending = null;
+
+	function preload() {
+		pending ??= fork(() => {
+			open = true;
+		});
+	}
+
+	function discard() {
+		pending?.discard();
+		pending = null;
+	}
+</script>
+
+<button
+	onfocusin={preload}
+	onfocusout={discard}
+	onpointerenter={preload}
+	onpointerleave={discard}
+	onclick={() => {
+		pending?.commit();
+		pending = null;
+
+		// in case `pending` didn't exist
+		// (if it did, this is a no-op)
+		open = true;
+	}}>open menu</button
+>
+
+{#if open}
+	<!-- any async work inside this component will start
+	     as soon as the fork is created -->
+	<Menu onclose={() => (open = false)} />
+{/if}
+```
+
+## Caveats
+
+As an experimental feature, the details of how `await` is handled (and related APIs like `$effect.pending()`) are subject to breaking changes outside of a semver major release, though we intend to keep such changes to a bare minimum.
+
+## Breaking changes
+
+Effects run in a slightly different order when the `experimental.async` option is `true`. Specifically, _block_ effects like `{#if ...}` and `{#each ...}` now run before an `$effect.pre` or `beforeUpdate` in the same component, which means that in very rare situations.
diff --git a/.github/skills/svelte-best-practices/references/bind.md b/.github/skills/svelte-best-practices/references/bind.md
new file mode 100644
index 00000000..80b2f4c4
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/bind.md
@@ -0,0 +1,16 @@
+## Function bindings
+
+You can also use `bind:property={get, set}`, where `get` and `set` are functions, allowing you to perform validation and transformation:
+
+```svelte
+<input bind:value={() => value, (v) => (value = v.toLowerCase())} />
+```
+
+In the case of readonly bindings like [dimension bindings](#Dimensions), the `get` value should be `null`:
+
+```svelte
+<div bind:clientWidth={null, redraw} bind:clientHeight={null, redraw}>...</div>
+```
+
+> [!NOTE]
+> Function bindings are available in Svelte 5.9.0 and newer.
diff --git a/.github/skills/svelte-best-practices/references/each.md b/.github/skills/svelte-best-practices/references/each.md
new file mode 100644
index 00000000..283b754f
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/each.md
@@ -0,0 +1,42 @@
+## Keyed each blocks
+
+```svelte
+<!--- copy: false  --->
+{#each expression as name (key)}...{/each}
+```
+
+```svelte
+<!--- copy: false  --->
+{#each expression as name, index (key)}...{/each}
+```
+
+If a _key_ expression is provided — which must uniquely identify each list item — Svelte will use it to intelligently update the list when data changes by inserting, moving and deleting items, rather than adding or removing items at the end and updating the state in the middle.
+
+The key can be any object, but strings and numbers are recommended since they allow identity to persist when the objects themselves change.
+
+```svelte
+{#each items as item (item.id)}
+	<li>{item.name} x {item.qty}</li>
+{/each}
+
+<!-- or with additional index value -->
+{#each items as item, i (item.id)}
+	<li>{i + 1}: {item.name} x {item.qty}</li>
+{/each}
+```
+
+You can freely use destructuring and rest patterns in each blocks.
+
+```svelte
+{#each items as { id, name, qty }, i (id)}
+	<li>{i + 1}: {name} x {qty}</li>
+{/each}
+
+{#each objects as { id, ...rest }}
+	<li><span>{id}</span><MyComponent {...rest} /></li>
+{/each}
+
+{#each items as [id, ...rest]}
+	<li><span>{id}</span><MyComponent values={rest} /></li>
+{/each}
+```
diff --git a/.github/skills/svelte-best-practices/references/hydratable.md b/.github/skills/svelte-best-practices/references/hydratable.md
new file mode 100644
index 00000000..a7baf74d
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/hydratable.md
@@ -0,0 +1,100 @@
+In Svelte, when you want to render asynchronous content data on the server, you can simply `await` it. This is great! However, it comes with a pitfall: when hydrating that content on the client, Svelte has to redo the asynchronous work, which blocks hydration for however long it takes:
+
+```svelte
+<script>
+	import { getUser } from 'my-database-library';
+
+	// This will get the user on the server, render the user's name into the h1,
+	// and then, during hydration on the client, it will get the user _again_,
+	// blocking hydration until it's done.
+	const user = await getUser();
+</script>
+
+<h1>{user.name}</h1>
+```
+
+That's silly, though. If we've already done the hard work of getting the data on the server, we don't want to get it again during hydration on the client. `hydratable` is a low-level API built to solve this problem. You probably won't need this very often — it will be used behind the scenes by whatever datafetching library you use. For example, it powers [remote functions in SvelteKit](/docs/kit/remote-functions).
+
+To fix the example above:
+
+```svelte
+<script>
+	import { hydratable } from 'svelte';
+	import { getUser } from 'my-database-library';
+
+	// During server rendering, this will serialize and stash the result of `getUser`, associating
+	// it with the provided key and baking it into the `head` content. During hydration, it will
+	// look for the serialized version, returning it instead of running `getUser`. After hydration
+	// is done, if it's called again, it'll simply invoke `getUser`.
+	const user = await hydratable('user', () => getUser());
+</script>
+
+<h1>{user.name}</h1>
+```
+
+This API can also be used to provide access to random or time-based values that are stable between server rendering and hydration. For example, to get a random number that doesn't update on hydration:
+
+```ts
+import { hydratable } from 'svelte';
+const rand = hydratable('random', () => Math.random());
+```
+
+If you're a library author, be sure to prefix the keys of your `hydratable` values with the name of your library so that your keys don't conflict with other libraries.
+
+## Serialization
+
+All data returned from a `hydratable` function must be serializable. But this doesn't mean you're limited to JSON — Svelte uses [`devalue`](https://npmjs.com/package/devalue), which can serialize all sorts of things including `Map`, `Set`, `URL`, and `BigInt`. Check the documentation page for a full list. In addition to these, thanks to some Svelte magic, you can also fearlessly use promises:
+
+```svelte
+<script>
+	import { hydratable } from 'svelte';
+	const promises = hydratable('random', () => {
+		return {
+			one: Promise.resolve(1),
+			two: Promise.resolve(2),
+		};
+	});
+</script>
+
+{await promises.one}
+{await promises.two}
+```
+
+## CSP
+
+`hydratable` adds an inline `<script>` block to the `head` returned from `render`. If you're using [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) (CSP), this script will likely fail to run. You can provide a `nonce` to `render`:
+
+```js
+const nonce = crypto.randomUUID();
+
+const { head, body } = await render(App, {
+	csp: { nonce },
+});
+```
+
+This will add the `nonce` to the script block, on the assumption that you will later add the same nonce to the CSP header of the document that contains it:
+
+```js
+response.headers.set('Content-Security-Policy', `script-src 'nonce-${nonce}'`);
+```
+
+It's essential that a `nonce` — which, British slang definition aside, means 'number used once' — is only used when dynamically server rendering an individual response.
+
+If instead you are generating static HTML ahead of time, you must use hashes instead:
+
+```js
+const { head, body, hashes } = await render(App, {
+	csp: { hash: true },
+});
+```
+
+`hashes.script` will be an array of strings like `["sha256-abcd123"]`. As with `nonce`, the hashes should be used in your CSP header:
+
+```js
+response.headers.set(
+	'Content-Security-Policy',
+	`script-src ${hashes.script.map((hash) => `'${hash}'`).join(' ')}`,
+);
+```
+
+We recommend using `nonce` over hash if you can, as `hash` will interfere with streaming SSR in the future.
diff --git a/.github/skills/svelte-best-practices/references/snippet.md b/.github/skills/svelte-best-practices/references/snippet.md
new file mode 100644
index 00000000..f56bb0f8
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/snippet.md
@@ -0,0 +1,276 @@
+```svelte
+<!--- copy: false  --->
+{#snippet name()}...{/snippet}
+```
+
+```svelte
+<!--- copy: false  --->
+{#snippet name(param1, param2, paramN)}...{/snippet}
+```
+
+Snippets, and [render tags](@render), are a way to create reusable chunks of markup inside your components. Instead of writing duplicative code like this...
+
+```svelte
+{#each images as image}
+	{#if image.href}
+		<a href={image.href}>
+			<figure>
+				<img src={image.src} alt={image.caption} width={image.width} height={image.height} />
+				<figcaption>{image.caption}</figcaption>
+			</figure>
+		</a>
+	{:else}
+		<figure>
+			<img src={image.src} alt={image.caption} width={image.width} height={image.height} />
+			<figcaption>{image.caption}</figcaption>
+		</figure>
+	{/if}
+{/each}
+```
+
+...you can write this:
+
+```svelte
+{#snippet figure(image)}
+	<figure>
+		<img src={image.src} alt={image.caption} width={image.width} height={image.height} />
+		<figcaption>{image.caption}</figcaption>
+	</figure>
+{/snippet}
+
+{#each images as image}
+	{#if image.href}
+		<a href={image.href}>
+			{@render figure(image)}
+		</a>
+	{:else}
+		{@render figure(image)}
+	{/if}
+{/each}
+```
+
+Like function declarations, snippets can have an arbitrary number of parameters, which can have default values, and you can destructure each parameter. You cannot use rest parameters, however.
+
+## Snippet scope
+
+Snippets can be declared anywhere inside your component. They can reference values declared outside themselves, for example in the `<script>` tag or in `{#each ...}` blocks (demo...
+
+```svelte
+<script>
+	let { message = `it's great to see you!` } = $props();
+</script>
+
+{#snippet hello(name)}
+	<p>hello {name}! {message}!</p>
+{/snippet}
+
+{@render hello('alice')}
+{@render hello('bob')}
+```
+
+...and they are 'visible' to everything in the same lexical scope (i.e. siblings, and children of those siblings):
+
+```svelte
+<div>
+	{#snippet x()}
+		{#snippet y()}...{/snippet}
+
+		<!-- this is fine -->
+		{@render y()}
+	{/snippet}
+
+	<!-- this will error, as `y` is not in scope -->
+	{@render y()}
+</div>
+
+<!-- this will also error, as `x` is not in scope -->
+{@render x()}
+```
+
+Snippets can reference themselves and each other (demo:
+
+```svelte
+{#snippet blastoff()}
+	<span>🚀</span>
+{/snippet}
+
+{#snippet countdown(n)}
+	{#if n > 0}
+		<span>{n}...</span>
+		{@render countdown(n - 1)}
+	{:else}
+		{@render blastoff()}
+	{/if}
+{/snippet}
+
+{@render countdown(10)}
+```
+
+## Passing snippets to components
+
+### Explicit props
+
+Within the template, snippets are values just like any other. As such, they can be passed to components as props (demo:
+
+```svelte
+<script>
+	import Table from './Table.svelte';
+
+	const fruits = [
+		{ name: 'apples', qty: 5, price: 2 },
+		{ name: 'bananas', qty: 10, price: 1 },
+		{ name: 'cherries', qty: 20, price: 0.5 },
+	];
+</script>
+
+{#snippet header()}
+	<th>fruit</th>
+	<th>qty</th>
+	<th>price</th>
+	<th>total</th>
+{/snippet}
+
+{#snippet row(d)}
+	<td>{d.name}</td>
+	<td>{d.qty}</td>
+	<td>{d.price}</td>
+	<td>{d.qty * d.price}</td>
+{/snippet}
+
+<Table data={fruits} {header} {row} />
+```
+
+Think about it like passing content instead of data to a component. The concept is similar to slots in web components.
+
+### Implicit props
+
+As an authoring convenience, snippets declared directly _inside_ a component implicitly become props _on_ the component (demo:
+
+```svelte
+<!-- this is semantically the same as the above -->
+<Table data={fruits}>
+	{#snippet header()}
+		<th>fruit</th>
+		<th>qty</th>
+		<th>price</th>
+		<th>total</th>
+	{/snippet}
+
+	{#snippet row(d)}
+		<td>{d.name}</td>
+		<td>{d.qty}</td>
+		<td>{d.price}</td>
+		<td>{d.qty * d.price}</td>
+	{/snippet}
+</Table>
+```
+
+### Implicit `children` snippet
+
+Any content inside the component tags that is _not_ a snippet declaration implicitly becomes part of the `children` snippet (demo:
+
+```svelte
+<!--- file: App.svelte --->
+<Button>click me</Button>
+```
+
+```svelte
+<!--- file: Button.svelte --->
+<script>
+	let { children } = $props();
+</script>
+
+<!-- result will be <button>click me</button> -->
+<button>{@render children()}</button>
+```
+
+> [!NOTE] Note that you cannot have a prop called `children` if you also have content inside the component — for this reason, you should avoid having props with that name
+
+### Optional snippet props
+
+You can declare snippet props as being optional. You can either use optional chaining to not render anything if the snippet isn't set...
+
+```svelte
+<script>
+	let { children } = $props();
+</script>
+
+{@render children?.()}
+```
+
+...or use an `#if` block to render fallback content:
+
+```svelte
+<script>
+	let { children } = $props();
+</script>
+
+{#if children}
+	{@render children()}
+{:else}
+	fallback content
+{/if}
+```
+
+## Typing snippets
+
+Snippets implement the `Snippet` interface imported from `'svelte'`:
+
+```svelte
+<script lang="ts">
+	import type { Snippet } from 'svelte';
+
+	interface Props {
+		data: any[];
+		children: Snippet;
+		row: Snippet<[any]>;
+	}
+
+	let { data, children, row }: Props = $props();
+</script>
+```
+
+With this change, red squigglies will appear if you try and use the component without providing a `data` prop and a `row` snippet. Notice that the type argument provided to `Snippet` is a tuple, since snippets can have multiple parameters.
+
+We can tighten things up further by declaring a generic, so that `data` and `row` refer to the same type:
+
+```svelte
+<script lang="ts" generics="T">
+	import type { Snippet } from 'svelte';
+
+	let {
+		data,
+		children,
+		row,
+	}: {
+		data: T[];
+		children: Snippet;
+		row: Snippet<[T]>;
+	} = $props();
+</script>
+```
+
+## Exporting snippets
+
+Snippets declared at the top level of a `.svelte` file can be exported from a `<script module>` for use in other components, provided they don't reference any declarations in a non-module `<script>` (whether directly or indirectly, via other snippets) (demo:
+
+```svelte
+<script module>
+	export { add };
+</script>
+
+{#snippet add(a, b)}
+	{a} + {b} = {a + b}
+{/snippet}
+```
+
+> [!NOTE]
+> This requires Svelte 5.5.0 or newer
+
+## Programmatic snippets
+
+Snippets can be created programmatically with the [`createRawSnippet`](svelte#createRawSnippet) API. This is intended for advanced use cases.
+
+## Snippets and slots
+
+In Svelte 4, content can be passed to components using [slots](legacy-slots). Snippets are more powerful and flexible, and so slots have been deprecated in Svelte 5.
diff --git a/.github/skills/svelte-best-practices/references/svelte-reactivity.md b/.github/skills/svelte-best-practices/references/svelte-reactivity.md
new file mode 100644
index 00000000..262e3617
--- /dev/null
+++ b/.github/skills/svelte-best-practices/references/svelte-reactivity.md
@@ -0,0 +1,61 @@
+## createSubscriber
+
+<blockquote class="since note">
+
+Available since 5.7.0
+
+</blockquote>
+
+Returns a `subscribe` function that integrates external event-based systems with Svelte's reactivity.
+It's particularly useful for integrating with web APIs like `MediaQuery`, `IntersectionObserver`, or `WebSocket`.
+
+If `subscribe` is called inside an effect (including indirectly, for example inside a getter),
+the `start` callback will be called with an `update` function. Whenever `update` is called, the effect re-runs.
+
+If `start` returns a cleanup function, it will be called when the effect is destroyed.
+
+If `subscribe` is called in multiple effects, `start` will only be called once as long as the effects
+are active, and the returned teardown function will only be called when all effects are destroyed.
+
+It's best understood with an example. Here's an implementation of [`MediaQuery`](/docs/svelte/svelte-reactivity#MediaQuery):
+
+```js
+// @errors: 7031
+import { createSubscriber } from 'svelte/reactivity';
+import { on } from 'svelte/events';
+
+export class MediaQuery {
+	#query;
+	#subscribe;
+
+	constructor(query) {
+		this.#query = window.matchMedia(`(${query})`);
+
+		this.#subscribe = createSubscriber((update) => {
+			// when the `change` event occurs, re-run any effects that read `this.current`
+			const off = on(this.#query, 'change', update);
+
+			// stop listening when all the effects are destroyed
+			return () => off();
+		});
+	}
+
+	get current() {
+		// This makes the getter reactive, if read in an effect
+		this.#subscribe();
+
+		// Return the current state of the query, whether or not we're in an effect
+		return this.#query.matches;
+	}
+}
+```
+
+<div class="ts-block">
+
+```dts
+function createSubscriber(
+	start: (update: () => void) => (() => void) | void
+): () => void;
+```
+
+</div>

From d7ed9d09a4d8bbba4749b588eb6a18779d16acdc Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 20 May 2026 09:13:12 +0200
Subject: [PATCH 035/136] chore: remove package duplicates with npm dedupe

---
 package-lock.json | 70 ++++++++++++++++++++++-------------------------
 1 file changed, 32 insertions(+), 38 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index b3924792..870d3cae 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -3024,20 +3024,13 @@
       }
     },
     "node_modules/@smithy/core": {
-      "version": "3.23.17",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.23.17.tgz",
-      "integrity": "sha512-x7BlLbUFL8NWCGjMF9C+1N5cVCxcPa7g6Tv9B4A2luWx3be3oU8hQ96wIwxe/s7OhIzvoJH73HAUSg5JXVlEtQ==",
+      "version": "3.24.3",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
+      "integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-stream": "^4.5.25",
-        "@smithy/util-utf8": "^4.2.2",
-        "@smithy/uuid": "^1.1.2",
+        "@aws-crypto/crc32": "5.2.0",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3204,11 +3197,12 @@
       }
     },
     "node_modules/@smithy/is-array-buffer": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.2.2.tgz",
-      "integrity": "sha512-n6rQ4N8Jj4YTQO3YFrlgZuwKodf4zUFs7EJIWH86pSCWBaAtAGBFfCM7Wx6D2bBJ2xqFNxGBSrUWswT3M0VJow==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.3.3.tgz",
+      "integrity": "sha512-RRxYqjUa/n8dRVkbhyuiRarppLzt4H/AtMUEFmiHlDy8o4wrgqAdzxsk9naemzu6iX67ZV375fNmX7Q8dynGKw==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@smithy/core": "^3.24.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3457,9 +3451,9 @@
       }
     },
     "node_modules/@smithy/types": {
-      "version": "4.14.1",
-      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.1.tgz",
-      "integrity": "sha512-59b5HtSVrVR/eYNei3BUj3DCPKD/G7EtDDe7OEJE7i7FtQFugYo6MxbotS8mVJkLNVf8gYaAlEBwwtJ9HzhWSg==",
+      "version": "4.14.2",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.2.tgz",
+      "integrity": "sha512-P+otAxbV4CqBybp7EkcJCrig63yE2E7PuNVOmilVMRcx/O+QDzGULTrKsq4DV13gSfak9ObPrWaHl/9bL5YcWw==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -3521,12 +3515,12 @@
       }
     },
     "node_modules/@smithy/util-buffer-from": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.2.2.tgz",
-      "integrity": "sha512-FDXD7cvUoFWwN6vtQfEta540Y/YBe5JneK3SoZg9bThSoOAC/eGeYEua6RkBgKjGa/sz6Y+DuBZj3+YEY21y4Q==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.3.3.tgz",
+      "integrity": "sha512-5xlgilVaX96HdVlLZymKUa7vOTZtisOTxBJloM2J4PeRqyAWBeFIq0DnIxQISvwxT4rgJAvk7rHhB+GlCCKe8g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
+        "@smithy/core": "^3.24.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3663,12 +3657,12 @@
       }
     },
     "node_modules/@smithy/util-utf8": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.2.2.tgz",
-      "integrity": "sha512-75MeYpjdWRe8M5E3AW0O4Cx3UadweS+cwdXjwYGBW5h/gxxnbeZ877sLPX/ZJA9GVTlL/qG0dXP29JWFCD1Ayw==",
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.3.3.tgz",
+      "integrity": "sha512-c1QpRBn3aMsoqE64dd4Imgjy8Pynfw+eR7GkjElquxUFSnezwYVaOFm8JcYa+Bo/5ssbEyPKcT3+4bmrWYh6eQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
+        "@smithy/core": "^3.24.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -4460,9 +4454,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5381,9 +5375,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.14",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
+      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7299,9 +7293,9 @@
       }
     },
     "node_modules/hosted-git-info/node_modules/lru-cache": {
-      "version": "11.3.5",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.5.tgz",
-      "integrity": "sha512-NxVFwLAnrd9i7KUBxC4DrUhmgjzOs+1Qm50D3oF1/oL+r1NpZ4gA7xvG0/zJ8evR7zIKn4vLf7qTNduWFtCrRw==",
+      "version": "11.5.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.0.tgz",
+      "integrity": "sha512-5YgH9UJd7wVb9hIouI2adWpgqrrICkt070Dnj8EUY1+B4B2P9eRLPAkAAo6NICA7CEhOIeBHl46u9zSNpNu7zA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -11595,9 +11589,9 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "13.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.1.tgz",
-      "integrity": "sha512-9ezox2roIft6ExBVTVqibSd5dc5/47Sw/uY6b4SjQUT2TzQ0tltNquWA46y4xPQmdZYqvnio22SgWd41M86+jw==",
+      "version": "13.0.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.2.tgz",
+      "integrity": "sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",

From 1b37cfd835231e0ddb862f248d1fd0f06b277c89 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 20 May 2026 09:18:14 +0200
Subject: [PATCH 036/136] feat: Add support for path-style and VirtualHosted
 addressing in S3 connection configuration (#149)

---
 messages/de.json                              |  2 ++
 messages/en.json                              |  2 ++
 .../storage/StorageConnectForm.svelte         | 19 +++++++++++++++++++
 src/lib/server/storage/s3-client.ts           |  2 +-
 src/lib/server/storage/types.ts               |  2 ++
 src/lib/storage/schemas.ts                    |  1 +
 src/routes/(app)/storage/+page.server.ts      |  3 ++-
 7 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index b32e1230..76e7b546 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -129,6 +129,8 @@
   "storage_connect_endpoint": "Endpunkt-URL",
   "storage_connect_endpoint_placeholder": "https://minio.beispiel.de:9000",
   "storage_connect_endpoint_hint": "Leer lassen für AWS S3",
+  "storage_connect_path_style": "Path-Style-Adressierung verwenden",
+  "storage_connect_path_style_hint": "Für MinIO und die meisten selbst gehosteten S3-Anbieter aktivieren. Für Virtual-Hosted-Style deaktivieren.",
   "storage_connect_region": "Region",
   "storage_connect_access_key": "Zugriffsschlüssel-ID",
   "storage_connect_secret_key": "Geheimer Zugriffsschlüssel",
diff --git a/messages/en.json b/messages/en.json
index 6fa6e261..554cbaad 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -129,6 +129,8 @@
   "storage_connect_endpoint": "Endpoint URL",
   "storage_connect_endpoint_placeholder": "https://minio.example.com:9000",
   "storage_connect_endpoint_hint": "Leave blank to use AWS S3",
+  "storage_connect_path_style": "Use path-style addressing",
+  "storage_connect_path_style_hint": "Enable for MinIO and most self-hosted S3 providers. Disable for virtual-hosted-style access.",
   "storage_connect_region": "Region",
   "storage_connect_access_key": "Access key ID",
   "storage_connect_secret_key": "Secret access key",
diff --git a/src/lib/components/storage/StorageConnectForm.svelte b/src/lib/components/storage/StorageConnectForm.svelte
index 405c30a2..6a21d6cc 100644
--- a/src/lib/components/storage/StorageConnectForm.svelte
+++ b/src/lib/components/storage/StorageConnectForm.svelte
@@ -60,6 +60,7 @@
   function selectConnection(conn: StoredConnection) {
     $form.type = conn.type;
     $form.endpoint = conn.endpoint ?? '';
+    $form.pathStyle = conn.pathStyle ?? true;
     $form.region = conn.region;
     $form.accessKeyId = conn.accessKeyId ?? '';
     $form.secretAccessKey = conn.secretAccessKey ?? '';
@@ -83,6 +84,7 @@
       autoConnecting = true;
       $form.type = saved.type;
       $form.endpoint = saved.endpoint ?? '';
+      $form.pathStyle = saved.pathStyle ?? true;
       $form.region = saved.region;
       $form.accessKeyId = saved.accessKeyId ?? '';
       $form.secretAccessKey = saved.secretAccessKey ?? '';
@@ -211,6 +213,23 @@
       {/if}
     </div>
 
+    <!-- Path-style addressing -->
+    <div class="flex items-start justify-between gap-4">
+      <div>
+        <label for="{uid}-path-style" class="label text-sm font-medium">
+          {m.storage_connect_path_style()}
+        </label>
+        <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_path_style_hint()}</p>
+      </div>
+      <input
+        id="{uid}-path-style"
+        name="pathStyle"
+        type="checkbox"
+        class="toggle toggle-primary mt-1 shrink-0"
+        bind:checked={$form.pathStyle}
+      />
+    </div>
+
     <!-- Region -->
     <div>
       <label for="{uid}-region" class="label mb-1 text-sm font-medium">
diff --git a/src/lib/server/storage/s3-client.ts b/src/lib/server/storage/s3-client.ts
index aa40136b..50e75e89 100644
--- a/src/lib/server/storage/s3-client.ts
+++ b/src/lib/server/storage/s3-client.ts
@@ -6,7 +6,7 @@ export function createS3Client(config: S3ConnectionConfig): S3Client {
     region: config.region,
     ...(config.endpoint && {
       endpoint: config.endpoint,
-      forcePathStyle: true
+      forcePathStyle: config.pathStyle ?? true
     }),
     ...(config.accessKeyId &&
       config.secretAccessKey && {
diff --git a/src/lib/server/storage/types.ts b/src/lib/server/storage/types.ts
index 51f9eca4..46472f67 100644
--- a/src/lib/server/storage/types.ts
+++ b/src/lib/server/storage/types.ts
@@ -2,6 +2,8 @@
 export interface S3ConnectionConfig {
   type: 's3';
   endpoint?: string;
+  /** Use path-style addressing (true) or virtual-hosted style (false). Defaults to true. */
+  pathStyle?: boolean;
   region: string;
   accessKeyId?: string;
   secretAccessKey?: string;
diff --git a/src/lib/storage/schemas.ts b/src/lib/storage/schemas.ts
index 77bbe150..6678ccf3 100644
--- a/src/lib/storage/schemas.ts
+++ b/src/lib/storage/schemas.ts
@@ -4,6 +4,7 @@ export const StorageConnectionSchema = z
   .object({
     type: z.enum(['s3', 'hdfs']).default('s3'),
     endpoint: z.url({ message: 'Must be a valid URL' }).or(z.literal('')).optional(),
+    pathStyle: z.boolean().default(true),
     region: z.string().min(1).default('eu-central-1'),
     accessKeyId: z.string().optional(),
     secretAccessKey: z.string().optional()
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 9a7e8a29..48fdd74d 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -31,7 +31,7 @@ export const actions: Actions = {
     }
 
     const userId = getUserId(locals);
-    const { type, endpoint, region, accessKeyId, secretAccessKey } = form.data;
+    const { type, endpoint, pathStyle, region, accessKeyId, secretAccessKey } = form.data;
 
     if (type !== 's3') {
       return message(form, 'HDFS connections are not yet supported', { status: 400 });
@@ -40,6 +40,7 @@ export const actions: Actions = {
     const config: S3ConnectionConfig = {
       type: 's3',
       endpoint: endpoint || undefined,
+      pathStyle,
       region,
       accessKeyId: accessKeyId || undefined,
       secretAccessKey: secretAccessKey || undefined

From 110d588265be62e527690a7ab1a1b476750569e2 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 20 May 2026 09:52:33 +0200
Subject: [PATCH 037/136] #92 S3 File Browser: Upload (#141)

* feat: implement file upload feature with S3 integration

* fix: show new filename on rename

* refactor: remove mock S3 server and related E2E tests for file upload feature

* refactor: reduce duplicate code

* style: formatting and linting

* #92 add multiple files and directory upload, improve file rename checks on upload

* #144 remove trailing slash on directory name

* * #94 add delete action

* #94 refactor, implement delete action in hdfs provider

* #94 cleaned up types, use paraglide pluralisation

* * #118 add pinned access

* #118 add recently accessed file and locations

* #118 show loading spinner for quick navigation, use daisyui tooltips, limit recent access item count

* #118 show timestamp on hover, add preview action, add clickable label for recent locations

* #118 refactor timestamp tooltip into own component, add timestamp tooltip to file explorer files

* #131 fix download path for truncated previews, #118 add button to open context actions on pinned access

* #118 refactor suggested code from #126, show pin location menu above breadcrumb menu

* #118 fix timestamp string format, make timestamp display relative

* #118 add month and year suffixes to last modified timestamp display

* #118 fix visuals for pinned access entry width

* fix duplicate json

* fix: remove duplicate invalidateAll import in FileExplorer

* fix: remove s3-mock from playwright config

* remove test with wrong references

* fix: update eslint ignore patterns to include .github/skills directory

* fix: add exclude pattern for .github/skills directory in pre-commit config

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 .pre-commit-config.yaml                       |   2 +
 TECH_DEBT.md                                  |  16 +
 e2e/document-preview.spec.ts                  | 262 ------
 e2e/start-mock-s3.ts                          | 220 -----
 eslint.config.js                              |   2 +-
 messages/de.json                              |  44 +-
 messages/en.json                              |  42 +
 package-lock.json                             |  73 +-
 package.json                                  |   1 +
 playwright.config.ts                          |   5 -
 .../components/storage/FileExplorer.svelte    |  15 +-
 .../storage/StorageBreadcrumb.svelte          |  10 +-
 src/lib/components/storage/UploadModal.svelte | 769 ++++++++++++++++++
 src/lib/components/storage/actions/errors.ts  |   4 +
 src/lib/components/storage/actions/index.ts   |   3 +-
 src/lib/components/storage/actions/types.ts   |   1 +
 src/lib/components/storage/actions/upload.ts  |  13 +
 src/lib/server/storage/hdfs-provider.ts       |   9 +
 src/lib/server/storage/provider.ts            |   7 +
 src/lib/server/storage/s3-errors.ts           |   7 +
 src/lib/server/storage/s3-provider.ts         |  30 +
 src/lib/server/storage/service.ts             |  26 +
 src/lib/storage/upload.ts                     | 114 +++
 .../(app)/storage/api/download/+server.ts     |  24 +-
 src/routes/(app)/storage/api/params.ts        |  19 +
 .../(app)/storage/api/preview/+server.ts      |  30 +-
 .../(app)/storage/api/upload/+server.ts       |  50 ++
 27 files changed, 1244 insertions(+), 554 deletions(-)
 delete mode 100644 e2e/document-preview.spec.ts
 delete mode 100644 e2e/start-mock-s3.ts
 create mode 100644 src/lib/components/storage/UploadModal.svelte
 create mode 100644 src/lib/components/storage/actions/upload.ts
 create mode 100644 src/lib/storage/upload.ts
 create mode 100644 src/routes/(app)/storage/api/params.ts
 create mode 100644 src/routes/(app)/storage/api/upload/+server.ts

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index bdf3c2d9..5390f3ab 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,6 +2,8 @@
 default_language_version:
   node: system
 
+exclude: ^\.github/skills/
+
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 3b8d358f..1fdf9a50 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -165,3 +165,19 @@ No CSP headers are set anywhere. This leaves the app exposed to XSS in ways that
 **File:** `vite.config.ts`
 
 The dev server accepts requests from any host. This enables DNS rebinding attacks against local development environments. Should be restricted to `localhost` / `127.0.0.1` unless remote dev access is explicitly needed.
+
+---
+
+### Upload endpoint uses in-memory S3 credentials
+
+**File:** `src/routes/(app)/storage/api/upload/+server.ts`, `src/lib/server/storage/user-connections.ts`
+
+The upload endpoint reads S3 credentials from the same per-user in-memory connection map used by download and preview. This introduces no additional security risk beyond what is already documented in the "In-memory storage connection state" entry above. Long-term fix: same as that entry — persist encrypted credentials server-side.
+
+---
+
+### No server-side file size limit on uploads (v0)
+
+**File:** `src/routes/(app)/storage/api/upload/+server.ts`
+
+The upload endpoint imposes no maximum file size. S3's 5 TB single-object limit applies as a natural backstop. For v0 this is acceptable; large uploads will consume server-side streaming resources proportionally but do not buffer the body in memory (the stream is piped directly to the `@aws-sdk/lib-storage` Upload). Add a configurable `MAX_UPLOAD_BYTES` guard in a future iteration once typical object sizes are known.
diff --git a/e2e/document-preview.spec.ts b/e2e/document-preview.spec.ts
deleted file mode 100644
index 27d772a2..00000000
--- a/e2e/document-preview.spec.ts
+++ /dev/null
@@ -1,262 +0,0 @@
-/**
- * E2E tests for the document (file) preview feature in the S3 file browser.
- *
- * These tests use the mock S3 server (start-mock-s3.ts) which listens on
- * port 9191 and serves a set of fixture objects in the "test-bucket" bucket.
- *
- * Test flow per test:
- *   1. Navigate to /storage and fill-in + submit the connect form to
- *      establish a server-side session pointing at the mock S3.
- *   2. Navigate to the test-bucket listing.
- *   3. Click "Preview" on a file object.
- *   4. Assert the preview modal contents.
- */
-
-import { test, expect, type Page } from '@playwright/test';
-import { waitForHydration } from './helpers';
-
-const MOCK_S3_ENDPOINT = 'http://localhost:9191';
-const BUCKET = 'test-bucket';
-
-// ── Helpers ────────────────────────────────────────────────────────────────
-
-/** Connect to the mock S3 server by submitting the connect form on /storage. */
-async function connectToMockS3(page: Page) {
-  await page.goto('/storage');
-  await waitForHydration(page);
-
-  // Ensure the connect form is visible (not already connected)
-  const typeSelect = page.getByLabel('Backend type');
-  if (!(await typeSelect.isVisible())) {
-    // Already connected — disconnect first so we can re-connect with the right endpoint
-    await page.getByRole('button', { name: 'Disconnect' }).click();
-    await page.waitForURL('**/storage');
-    await waitForHydration(page);
-  }
-
-  await typeSelect.selectOption('s3');
-  await page.getByLabel('Endpoint URL').fill(MOCK_S3_ENDPOINT);
-  await page.getByLabel('Region').fill('us-east-1');
-  await page.getByLabel('Access key ID').fill('test-access-key');
-  await page.getByLabel('Secret access key').fill('test-secret-key');
-  await page.getByRole('button', { name: 'Connect' }).click();
-
-  // After successful connect, the page redirects back to /storage and shows the bucket grid
-  await page.waitForURL('**/storage');
-  await expect(page.getByText(BUCKET).first()).toBeVisible();
-}
-
-/** Navigate to the test-bucket listing and return when files are visible. */
-async function navigateToBucket(page: Page) {
-  await page.goto(`/storage/${BUCKET}`);
-  await waitForHydration(page);
-  // Wait for the file table to be rendered
-  await expect(page.getByRole('table')).toBeVisible();
-}
-
-/** Click the Preview action for a given filename (single-click to select, then toolbar button). */
-async function clickPreview(page: Page, filename: string) {
-  // Click the file row to select it
-  await page.getByRole('row', { name: new RegExp(filename, 'i') }).click();
-  // Click the Preview button in the selection toolbar
-  await page.getByRole('button', { name: 'Preview' }).first().click();
-}
-
-/** Click the Preview action from the context menu for a given filename. */
-async function rightClickPreview(page: Page, filename: string) {
-  await page.getByRole('row', { name: new RegExp(filename, 'i') }).click({ button: 'right' });
-  await page.getByRole('menuitem', { name: 'Preview' }).click();
-}
-
-// ── Tests ──────────────────────────────────────────────────────────────────
-
-test.describe('Document preview', () => {
-  test.use({ locale: 'en-US' });
-
-  test.beforeEach(async ({ page }) => {
-    await connectToMockS3(page);
-    await navigateToBucket(page);
-  });
-
-  test('preview modal opens for a text file and shows content', async ({ page }) => {
-    await clickPreview(page, 'hello.txt');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-
-    // Header shows filename
-    await expect(dialog.getByRole('heading', { name: 'hello.txt' })).toBeVisible();
-
-    // Content is rendered as text
-    await expect(dialog.locator('pre')).toContainText('Hello, World!');
-
-    // Close button works
-    await dialog.getByRole('button', { name: 'Close' }).last().click();
-    await expect(dialog).not.toBeVisible();
-  });
-
-  test('preview modal shows JSON with pretty-printing', async ({ page }) => {
-    await clickPreview(page, 'data.json');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-
-    await expect(dialog.getByRole('heading', { name: 'data.json' })).toBeVisible();
-    // JSON is pretty-printed
-    await expect(dialog.locator('pre')).toContainText('"name"');
-    await expect(dialog.locator('pre')).toContainText('"Alice"');
-  });
-
-  test('preview modal renders CSV as a table', async ({ page }) => {
-    await clickPreview(page, 'data.csv');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-
-    await expect(dialog.getByRole('heading', { name: 'data.csv' })).toBeVisible();
-
-    // CSV header row
-    const table = dialog.getByRole('table', { name: 'CSV preview' });
-    await expect(table).toBeVisible();
-    await expect(table.getByRole('columnheader', { name: 'id' })).toBeVisible();
-    await expect(table.getByRole('columnheader', { name: 'name' })).toBeVisible();
-    await expect(table.getByRole('columnheader', { name: 'role' })).toBeVisible();
-
-    // Data rows
-    await expect(table.getByRole('cell', { name: 'Alice' })).toBeVisible();
-    await expect(table.getByRole('cell', { name: 'Bob' })).toBeVisible();
-  });
-
-  test('preview modal renders image inline', async ({ page }) => {
-    await clickPreview(page, 'image.png');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-
-    await expect(dialog.getByRole('heading', { name: 'image.png' })).toBeVisible();
-
-    // Image is rendered
-    const img = dialog.locator('img');
-    await expect(img).toBeVisible();
-    await expect(img).toHaveAttribute('alt', /Preview of image\.png/i);
-  });
-
-  test('preview modal shows fallback for unsupported binary type', async ({ page }) => {
-    await clickPreview(page, 'archive.bin');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-
-    await expect(dialog.getByRole('heading', { name: 'archive.bin' })).toBeVisible();
-    // Binary fallback message
-    await expect(dialog.getByText('Binary content')).toBeVisible();
-
-    // Download link present
-    const downloadLink = dialog.getByRole('link', { name: 'Download full file' });
-    await expect(downloadLink).toBeVisible();
-  });
-
-  test('large text file shows truncation notice', async ({ page }) => {
-    await clickPreview(page, 'large.txt');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-
-    await expect(dialog.getByRole('heading', { name: 'large.txt' })).toBeVisible();
-
-    // Truncation notice in the subtitle
-    await expect(dialog.getByText(/Content truncated/i)).toBeVisible();
-
-    // Download full file button visible in footer
-    const downloadLink = dialog.getByRole('link', { name: 'Download full file' });
-    await expect(downloadLink).toBeVisible();
-  });
-
-  test('preview via context menu works', async ({ page }) => {
-    await rightClickPreview(page, 'hello.txt');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-    await expect(dialog.getByRole('heading', { name: 'hello.txt' })).toBeVisible();
-    await expect(dialog.locator('pre')).toContainText('Hello, World!');
-  });
-
-  test('preview modal shows error for access-denied object', async ({ page }) => {
-    // Intercept the preview API to simulate a 403 response
-    await page.route('**/storage/api/preview**', async (route) => {
-      await route.fulfill({
-        status: 403,
-        contentType: 'application/json',
-        body: JSON.stringify({ error: 'Access denied' })
-      });
-    });
-
-    await clickPreview(page, 'hello.txt');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-    await expect(dialog.getByRole('heading', { name: 'hello.txt' })).toBeVisible();
-    // Error state is shown
-    await expect(dialog.getByText('Preview failed')).toBeVisible();
-    await expect(
-      dialog.getByText('You do not have permission to preview this file.')
-    ).toBeVisible();
-    await dialog.getByRole('button', { name: 'Close' }).last().click();
-    await expect(dialog).not.toBeVisible();
-  });
-
-  test('preview API returns 401 when not connected', async ({ page }) => {
-    // Disconnect the S3 connection via the browser UI
-    await page.goto('/storage');
-    await waitForHydration(page);
-    const disconnectBtn = page.getByRole('button', { name: 'Disconnect' });
-    if (await disconnectBtn.isVisible()) {
-      await disconnectBtn.click();
-      await page.waitForURL('**/storage');
-    }
-
-    // Use the page's authenticated session (fetch runs in the browser context
-    // with the session cookie) — the storage layer should return 401 when there
-    // is no S3 connection configured for this user.
-    const status = await page.evaluate(async (url) => {
-      const res = await fetch(url);
-      return res.status;
-    }, `/storage/api/preview?bucket=${BUCKET}&key=hello.txt`);
-    expect(status).toBe(401);
-  });
-
-  test('preview button is enabled for a single selected file', async ({ page }) => {
-    // Select one file — the Preview button in the toolbar becomes enabled
-    await page.getByRole('row', { name: /hello\.txt/i }).click();
-    const previewBtn = page.getByRole('button', { name: 'Preview' }).first();
-    await expect(previewBtn).toBeEnabled();
-    await expect(previewBtn).toBeVisible();
-  });
-
-  /* Re-enable once we have a more robust parquet preview solution in place
-  test('preview modal renders parquet file as a table', async ({ page }) => {
-    await clickPreview(page, 'data.parquet');
-
-    const dialog = page.locator('dialog[open]');
-    await expect(dialog).toBeVisible();
-
-    await expect(dialog.getByRole('heading', { name: 'data.parquet' })).toBeVisible();
-
-    // Parquet is rendered as a CSV-style table
-    const table = dialog.getByRole('table', { name: 'CSV preview' });
-    await expect(table).toBeVisible();
-
-    // Column headers from the parquet schema
-    await expect(table.getByRole('columnheader', { name: 'id' })).toBeVisible();
-    await expect(table.getByRole('columnheader', { name: 'name' })).toBeVisible();
-    await expect(table.getByRole('columnheader', { name: 'role' })).toBeVisible();
-
-    // Data rows
-    await expect(table.getByRole('cell', { name: 'Alice' })).toBeVisible();
-    await expect(table.getByRole('cell', { name: 'Bob' })).toBeVisible();
-
-    // File size is shown in the header subtitle
-    await expect(dialog.locator('p').filter({ hasText: /B/ })).toBeVisible();
-  });
-  */
-});
diff --git a/e2e/start-mock-s3.ts b/e2e/start-mock-s3.ts
deleted file mode 100644
index f6277dad..00000000
--- a/e2e/start-mock-s3.ts
+++ /dev/null
@@ -1,220 +0,0 @@
-/**
- * Minimal S3-compatible mock server for E2E tests.
- *
- * Handles the subset of the S3 API that the storage provider uses:
- *   - ListBuckets    (GET /)
- *   - ListObjectsV2  (GET /<bucket>?list-type=2&...)
- *   - HeadObject     (HEAD /<bucket>/<key>)
- *   - GetObject      (GET  /<bucket>/<key>  — supports Range header)
- *
- * All operations use path-style addressing (forcePathStyle=true in the SDK).
- */
-
-import * as http from 'node:http';
-
-const PORT = 9191;
-const BUCKET = 'test-bucket';
-
-// ── Static file fixtures ───────────────────────────────────────────────────
-
-interface Fixture {
-  contentType: string;
-  content: Buffer;
-}
-
-const TEXT_CONTENT = Buffer.from('Hello, World!\nThis is a preview test file.', 'utf-8');
-const JSON_CONTENT = Buffer.from(
-  JSON.stringify({ name: 'Alice', role: 'engineer', team: 'data' }, null, 2),
-  'utf-8'
-);
-const CSV_CONTENT = Buffer.from(
-  ['id,name,role', '1,Alice,engineer', '2,Bob,analyst', '3,Carol,manager'].join('\n'),
-  'utf-8'
-);
-// Minimal 1×1 red PNG (68 bytes)
-const PNG_CONTENT = Buffer.from(
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwADhQGAWjR9awAAAABJRU5ErkJggg==',
-  'base64'
-);
-// Fake gzip header (non-UTF-8, binary)
-const BINARY_CONTENT = Buffer.from([0x1f, 0x8b, 0x08, 0x00, 0xde, 0xad, 0xbe, 0xef]);
-
-// Minimal GZIP-compressed parquet file: 5 rows × 3 columns (id, name, role).
-// Generated with pyarrow, write_page_index=True so OffsetIndex is present.
-// This is used to test the parquet preview flow end-to-end without a real S3.
-const PARQUET_CONTENT = Buffer.from(
-  'UEFSMRUEFSgVREwVChUAEgAAH4sIAAAAAAACA2NkYGBgAmJmIGYBYlYgBgCQqRgpFAAAABUAFRYVPiwV' +
-    'ChUQFQYVBgAAH4sIAAAAAAACA2NiYGDgYmRm7nBjAABD89dACwAAABUEFVAVakwVChUAEgAAH4sIAAAA' +
-    'AAACA2NlYGBwzMlMTmUGMpzyk1iBlHNiUX4OC5DhklgGFnctSwUASeUo8CgAAAAVABUWFT4sFQoVEBUG' +
-    'FQYAAB+LCAAAAAAAAgNjYmBg4GJkZu5wYwAAQ/PXQAsAAAAVBBVEFWJMFQYVABIAAB+LCAAAAAAAAgPj' +
-    'YGBgSM1Lz8xLTS1iB7IT8xJzKotLQMxcIDs9tQgA05P9siIAAAAVABUUFTwsFQoVEBUGFQYAAB+LCAAA' +
-    'AAAAAgNjYmBg4GJkYlZhBAB/FSRVCgAAABkRAhkYBAEAAAAZGAQFAAAAFQIZFgApJgAKABkRAhkYBUFs' +
-    'aWNlGRgDRXZlFQIZFgApJgAKABkRAhkYB2FuYWx5c3QZGAdtYW5hZ2VyFQIZFgApJgAKABkcFmgVYBYA' +
-    'AAAZHBbOAhVgFgAAGRYoABkcFqwEFV4WAAAZFkoAFQQZTDUAGAZzY2hlbWEVBgAVAiUCGAJpZAAVDCUC' +
-    'GARuYW1lJQBMHAAAABUMJQIYBHJvbGUlAEwcAAAAFgoZHBk8JgAcFQIZNQAGEBkYAmlkFQQWChZ8FsAB' +
-    'JmgmCBwYBAUAAAAYBAEAAAAWACgEBQAAABgEAQAAABERABksFQQVABUCABUAFRAVAgA8KQYZJgAKAAAW' +
-    'uAYVFBaKBRU2ACYAHBUMGTUABhAZGARuYW1lFQQWChakARbmASbOAibIARw2ACgDRXZlGAVBbGljZRER' +
-    'ABksFQQVABUCABUAFRAVAgA8FigZBhkmAAoAABbMBhUcFsAFFTYAJgAcFQwZNQAGEBkYBHJvbGUVBBYK' +
-    'FpYBFtwBJqwEJq4DHDYAKAdtYW5hZ2VyGAdhbmFseXN0EREAGSwVBBUAFQIAFQAVEBUCADwWShkGGSYA' +
-    'CgAAFugGFRwW9gUVQgAWtgMWCiYIFoIFABkcGAxBUlJPVzpzY2hlbWEYrAIvLy8vLzlnQUFBQVFBQUFB' +
-    'QUFBS0FBd0FCZ0FGQUFnQUNnQUFBQUFCQkFBTUFBQUFDQUFJQUFBQUJBQUlBQUFBQkFBQUFBTUFBQUJ3' +
-    'QUFBQU1BQUFBQVFBQUFDcy8vLy9BQUFCQlJBQUFBQVlBQUFBQkFBQUFBQUFBQUFFQUFBQWNtOXNaUUFB' +
-    'QUFEWS8vLy8xUC8vL3dBQUFRVVFBQUFBSEFBQUFBUUFBQUFBQUFBQUJBQUFBRzVoYldVQUFBQUFCQUFF' +
-    'QUFRQUFBQVFBQlFBQ0FBR0FBY0FEQUFBQUJBQUVBQUFBQUFBQVFJUUFBQUFIQUFBQUFRQUFBQUFBQUFB' +
-    'QWdBQUFHbGtBQUFJQUF3QUNBQUhBQWdBQUFBQUFBQUJJQUFBQUFBQUFBQT0AGCBwYXJxdWV0LWNwcC1h' +
-    'cnJvdyB2ZXJzaW9uIDI0LjAuMBk8HAAAHAAAHAAAANECAABQQVIx',
-  'base64'
-);
-
-const FIXTURES: Record<string, Fixture> = {
-  'hello.txt': { contentType: 'text/plain', content: TEXT_CONTENT },
-  'data.json': { contentType: 'application/json', content: JSON_CONTENT },
-  'data.csv': { contentType: 'text/csv', content: CSV_CONTENT },
-  'image.png': { contentType: 'image/png', content: PNG_CONTENT },
-  'archive.bin': { contentType: 'application/octet-stream', content: BINARY_CONTENT },
-  'data.parquet': {
-    contentType: 'application/vnd.apache.parquet',
-    content: PARQUET_CONTENT
-  },
-  // Large text file (> 256 KiB) — used to test truncation
-  'large.txt': {
-    contentType: 'text/plain',
-    content: Buffer.from('A'.repeat(300 * 1024), 'utf-8')
-  }
-};
-
-// ── XML helpers ────────────────────────────────────────────────────────────
-
-function listBucketsXml(): string {
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<ListAllMyBucketsResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Owner><ID>test-owner</ID><DisplayName>test</DisplayName></Owner>
-  <Buckets>
-    <Bucket>
-      <Name>${BUCKET}</Name>
-      <CreationDate>2026-01-01T00:00:00.000Z</CreationDate>
-    </Bucket>
-  </Buckets>
-</ListAllMyBucketsResult>`;
-}
-
-function listObjectsXml(prefix: string): string {
-  const entries = Object.entries(FIXTURES)
-    .filter(([key]) => key.startsWith(prefix))
-    .map(
-      ([key, f]) => `
-  <Contents>
-    <Key>${key}</Key>
-    <Size>${f.content.length}</Size>
-    <LastModified>2026-01-01T00:00:00.000Z</LastModified>
-    <ETag>"test-etag-${key}"</ETag>
-    <StorageClass>STANDARD</StorageClass>
-  </Contents>`
-    )
-    .join('');
-
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-  <Name>${BUCKET}</Name>
-  <Prefix>${prefix}</Prefix>
-  <Delimiter>/</Delimiter>
-  <MaxKeys>100</MaxKeys>
-  <IsTruncated>false</IsTruncated>
-  ${entries}
-</ListBucketResult>`;
-}
-
-function errorXml(code: string, message: string): string {
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<Error>
-  <Code>${code}</Code>
-  <Message>${message}</Message>
-</Error>`;
-}
-
-// ── Request handler ────────────────────────────────────────────────────────
-
-http
-  .createServer((req, res) => {
-    const url = new URL(req.url ?? '/', `http://localhost:${PORT}`);
-    const pathParts = url.pathname.slice(1).split('/');
-    const bucket = pathParts[0];
-    const key = pathParts.slice(1).join('/');
-
-    // ListBuckets: GET /
-    if (req.method === 'GET' && !bucket) {
-      res.writeHead(200, { 'Content-Type': 'application/xml' });
-      res.end(listBucketsXml());
-      return;
-    }
-
-    // ListObjectsV2: GET /<bucket>?list-type=2
-    if (req.method === 'GET' && bucket === BUCKET && !key && url.searchParams.has('list-type')) {
-      const prefix = url.searchParams.get('prefix') ?? '';
-      res.writeHead(200, { 'Content-Type': 'application/xml' });
-      res.end(listObjectsXml(prefix));
-      return;
-    }
-
-    // HeadObject / GetObject: HEAD or GET /<bucket>/<key>
-    if ((req.method === 'HEAD' || req.method === 'GET') && bucket === BUCKET && key) {
-      // Simulate 403 for a specific test key
-      if (key === 'no-access.txt') {
-        res.writeHead(403, { 'Content-Type': 'application/xml' });
-        res.end(errorXml('AccessDenied', 'Access Denied'));
-        return;
-      }
-
-      const fixture = FIXTURES[key];
-      if (!fixture) {
-        res.writeHead(404, { 'Content-Type': 'application/xml' });
-        res.end(errorXml('NoSuchKey', 'The specified key does not exist.'));
-        return;
-      }
-
-      // Parse Range header
-      const rangeHeader = req.headers['range'];
-      if (rangeHeader && req.method === 'GET') {
-        const match = /^bytes=(\d+)-(\d+)$/.exec(rangeHeader);
-        if (match) {
-          const start = parseInt(match[1], 10);
-          const end = Math.min(parseInt(match[2], 10), fixture.content.length - 1);
-          const chunk = fixture.content.slice(start, end + 1);
-          res.writeHead(206, {
-            'Content-Type': fixture.contentType,
-            'Content-Length': String(chunk.length),
-            'Content-Range': `bytes ${start}-${end}/${fixture.content.length}`,
-            'Accept-Ranges': 'bytes'
-          });
-          res.end(chunk);
-          return;
-        }
-      }
-
-      if (req.method === 'HEAD') {
-        res.writeHead(200, {
-          'Content-Type': fixture.contentType,
-          'Content-Length': String(fixture.content.length),
-          'Last-Modified': 'Wed, 01 Jan 2026 00:00:00 GMT',
-          ETag: `"test-etag-${key}"`
-        });
-        res.end();
-        return;
-      }
-
-      // Full GET
-      res.writeHead(200, {
-        'Content-Type': fixture.contentType,
-        'Content-Length': String(fixture.content.length),
-        'Last-Modified': 'Wed, 01 Jan 2026 00:00:00 GMT',
-        ETag: `"test-etag-${key}"`
-      });
-      res.end(fixture.content);
-      return;
-    }
-
-    // Fallback
-    res.writeHead(404, { 'Content-Type': 'application/xml' });
-    res.end(errorXml('NoSuchBucket', 'The specified bucket does not exist.'));
-  })
-  .listen(PORT, 'localhost', () => console.log(`Mock S3 on :${PORT}`));
diff --git a/eslint.config.js b/eslint.config.js
index 1e6f8cb6..d1f92c1d 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -12,7 +12,7 @@ const gitignorePath = fileURLToPath(new URL('./.gitignore', import.meta.url));
 
 export default ts.config(
   includeIgnoreFile(gitignorePath),
-  { ignores: ['src/lib/editor/generated/**'] },
+  { ignores: ['src/lib/editor/generated/**', '.github/skills/**'] },
   js.configs.recommended,
   ...ts.configs.recommended,
   ...svelte.configs.recommended,
diff --git a/messages/de.json b/messages/de.json
index 76e7b546..7b117e8a 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -246,7 +246,49 @@
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
-  "storage_context_menu_actions": "Actions",
+  "storage_context_menu_actions": "Aktionen",
+  "storage_action_upload": "Hochladen",
+  "storage_upload_title": "Hochladen",
+  "storage_upload_drop_prompt": "Dateien oder Ordner hier ablegen oder klicken zum Durchsuchen",
+  "storage_upload_select_files": "Dateien ausw\u00e4hlen",
+  "storage_upload_select_folder": "Ordner ausw\u00e4hlen",
+  "storage_upload_selected": "Ausgew\u00e4hlt: {name}",
+  "storage_upload_to_prefix": "Hochladen nach: {prefix}",
+  "storage_upload_total_size": "Gesamt: {size}",
+  "storage_upload_start": "Hochladen",
+  "storage_upload_checking": "Auf Konflikte pr\u00fcfen\u2026",
+  "storage_upload_conflicts_title": "Dateien bereits vorhanden",
+  "storage_upload_conflicts_desc": "W\u00e4hlen Sie f\u00fcr jede Konfliktdatei eine Aktion.",
+  "storage_upload_resolution_replace": "Ersetzen",
+  "storage_upload_resolution_skip": "\u00dcberspringen",
+  "storage_upload_resolution_rename": "Umbenennen",
+  "storage_upload_rename_label": "Neuer Dateiname",
+  "storage_upload_rename_same_name_error": "Bitte geben Sie einen anderen Namen ein oder w\u00e4hlen Sie Ersetzen bzw. \u00dcberspringen.",
+  "storage_upload_rename_confirm_action": "Namen best\u00e4tigen",
+  "storage_upload_rename_taken": "Dieser Name existiert bereits an diesem Speicherort. Bitte w\u00e4hlen Sie einen anderen Namen.",
+  "storage_upload_uploading": "Wird hochgeladen\u2026 {pct}%",
+  "storage_upload_status_queued": "ausstehend",
+  "storage_upload_status_done": "fertig",
+  "storage_upload_status_skipped": "\u00fcbersprungen",
+  "storage_upload_status_failed": "fehlgeschlagen",
+  "storage_upload_complete_title": "Upload abgeschlossen",
+  "storage_upload_complete_summary": "{uploaded} hochgeladen \u00b7 {skipped} \u00fcbersprungen \u00b7 {failed} fehlgeschlagen",
+  "storage_upload_done": "Fertig",
+  "storage_upload_success": "Datei erfolgreich hochgeladen.",
+  "storage_upload_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
+  "storage_upload_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung, hier hochzuladen.",
+  "storage_upload_error_no_such_bucket": "Bucket nicht gefunden.",
+  "storage_upload_error_invalid_part": "Upload fehlgeschlagen (Datenintegrit\u00e4tsfehler). Bitte erneut versuchen.",
+  "storage_upload_error_server_error": "Serverfehler aufgetreten. Bitte erneut versuchen.",
+  "storage_upload_error_unknown": "Unerwarteter Fehler. Bitte erneut versuchen.",
+  "storage_upload_overwrite_title": "Datei bereits vorhanden",
+  "storage_upload_overwrite_message": "Ein Objekt namens \u201e{name}\u201c ist bereits vorhanden. Was m\u00f6chten Sie tun?",
+  "storage_upload_overwrite_replace": "Ersetzen",
+  "storage_upload_overwrite_cancel": "Abbrechen",
+  "storage_upload_overwrite_rename": "Umbenennen",
+  "storage_upload_rename_confirm": "Mit diesem Namen hochladen",
+  "storage_upload_retry": "Erneut versuchen",
+  "storage_upload_close": "Schlie\u00dfen",
   "timestamp_just_now": "gerade eben",
   "timestamp_minutes_ago": [
     {
diff --git a/messages/en.json b/messages/en.json
index 554cbaad..402494cb 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -247,6 +247,48 @@
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
   "storage_context_menu_actions": "Actions",
+  "storage_action_upload": "Upload",
+  "storage_upload_title": "Upload",
+  "storage_upload_drop_prompt": "Drop files or a folder here, or click to browse",
+  "storage_upload_select_files": "Select files",
+  "storage_upload_select_folder": "Select folder",
+  "storage_upload_selected": "Selected: {name}",
+  "storage_upload_to_prefix": "Uploading to: {prefix}",
+  "storage_upload_total_size": "Total: {size}",
+  "storage_upload_start": "Upload",
+  "storage_upload_checking": "Checking for conflicts\u2026",
+  "storage_upload_conflicts_title": "Files already exist",
+  "storage_upload_conflicts_desc": "Choose what to do for each conflicting file.",
+  "storage_upload_resolution_replace": "Replace",
+  "storage_upload_resolution_skip": "Skip",
+  "storage_upload_resolution_rename": "Rename",
+  "storage_upload_rename_label": "New file name",
+  "storage_upload_rename_same_name_error": "Please enter a different name, or select Replace or Skip.",
+  "storage_upload_rename_confirm_action": "Confirm name",
+  "storage_upload_rename_taken": "This name already exists here. Please choose a different name.",
+  "storage_upload_uploading": "Uploading\u2026 {pct}%",
+  "storage_upload_status_queued": "queued",
+  "storage_upload_status_done": "done",
+  "storage_upload_status_skipped": "skipped",
+  "storage_upload_status_failed": "failed",
+  "storage_upload_complete_title": "Upload complete",
+  "storage_upload_complete_summary": "{uploaded} uploaded \u00b7 {skipped} skipped \u00b7 {failed} failed",
+  "storage_upload_done": "Done",
+  "storage_upload_success": "File uploaded successfully.",
+  "storage_upload_error_not_connected": "No storage connection configured. Please connect first.",
+  "storage_upload_error_access_denied": "Access denied. You do not have permission to upload here.",
+  "storage_upload_error_no_such_bucket": "Bucket not found.",
+  "storage_upload_error_invalid_part": "Upload failed due to a data integrity error. Please retry.",
+  "storage_upload_error_server_error": "A server error occurred. Please retry.",
+  "storage_upload_error_unknown": "An unexpected error occurred. Please retry.",
+  "storage_upload_overwrite_title": "File already exists",
+  "storage_upload_overwrite_message": "An object named \u201c{name}\u201d already exists in this location. What would you like to do?",
+  "storage_upload_overwrite_replace": "Replace",
+  "storage_upload_overwrite_cancel": "Cancel",
+  "storage_upload_overwrite_rename": "Rename",
+  "storage_upload_rename_confirm": "Upload with this name",
+  "storage_upload_retry": "Retry",
+  "storage_upload_close": "Close",
   "timestamp_just_now": "just now",
   "timestamp_minutes_ago": [
     {
diff --git a/package-lock.json b/package-lock.json
index 870d3cae..ccffa919 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,6 +10,7 @@
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-sdk/client-s3": "^3.1041.0",
+        "@aws-sdk/lib-storage": "^3.1045.0",
         "@internationalized/date": "^3.11.0",
         "antlr4-c3": "^3.4.4",
         "antlr4ng": "^3.0.16",
@@ -282,9 +283,9 @@
       }
     },
     "node_modules/@aws-sdk/client-s3": {
-      "version": "3.1041.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1041.0.tgz",
-      "integrity": "sha512-sQV14bIqslnBHuSlLMD+fc3pH+ajop6vnrFlJ4wM4JDqcYwVik4O+9srnZUrkesFw5y+CN0GfOQ06CAgtC4mjQ==",
+      "version": "3.1045.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1045.0.tgz",
+      "integrity": "sha512-fsuO3Y6t+3Ro9Bsg41DKj4Sfy53CGSrhnMldNplWmG8Tx0UbYk+YDa4RD1hVlJpERw4JBmPkl0+J9qlxMh1pcA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha1-browser": "5.2.0",
@@ -543,6 +544,38 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@aws-sdk/lib-storage": {
+      "version": "3.1045.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/lib-storage/-/lib-storage-3.1045.0.tgz",
+      "integrity": "sha512-F7dp2ST/83Iz6JTMMmUYEXxg7R1JDewfvzJeWWiDTwe0vLsg67JTN7OsBe6G8DWYbLQ+EyPWkyc3oFnxOjCVfg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/middleware-endpoint": "^4.4.32",
+        "@smithy/protocol-http": "^5.3.14",
+        "@smithy/smithy-client": "^4.12.13",
+        "@smithy/types": "^4.14.1",
+        "buffer": "5.6.0",
+        "events": "3.3.0",
+        "stream-browserify": "3.0.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      },
+      "peerDependencies": {
+        "@aws-sdk/client-s3": "^3.1045.0"
+      }
+    },
+    "node_modules/@aws-sdk/lib-storage/node_modules/buffer": {
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
+      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.0.2",
+        "ieee754": "^1.1.4"
+      }
+    },
     "node_modules/@aws-sdk/middleware-bucket-endpoint": {
       "version": "3.972.10",
       "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.10.tgz",
@@ -5057,7 +5090,6 @@
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
       "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -6619,6 +6651,15 @@
         "node": ">= 0.6"
       }
     },
+    "node_modules/events": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.x"
+      }
+    },
     "node_modules/expand-template": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
@@ -7417,7 +7458,6 @@
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
       "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -7432,8 +7472,7 @@
           "url": "https://feross.org/support"
         }
       ],
-      "license": "BSD-3-Clause",
-      "optional": true
+      "license": "BSD-3-Clause"
     },
     "node_modules/ignore": {
       "version": "5.3.2",
@@ -7476,7 +7515,6 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true,
       "license": "ISC"
     },
     "node_modules/ini": {
@@ -9924,9 +9962,7 @@
       "version": "3.6.2",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
       "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
-      "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "inherits": "^2.0.3",
         "string_decoder": "^1.1.1",
@@ -10643,13 +10679,21 @@
       "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
       "license": "MIT"
     },
+    "node_modules/stream-browserify": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/stream-browserify/-/stream-browserify-3.0.0.tgz",
+      "integrity": "sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==",
+      "license": "MIT",
+      "dependencies": {
+        "inherits": "~2.0.4",
+        "readable-stream": "^3.5.0"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
       "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
-      "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "safe-buffer": "~5.2.0"
       }
@@ -10658,7 +10702,6 @@
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
       "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "dev": true,
       "funding": [
         {
           "type": "github",
@@ -10673,8 +10716,7 @@
           "url": "https://feross.org/support"
         }
       ],
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/string-width": {
       "version": "5.1.2",
@@ -11585,7 +11627,6 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "dev": true,
       "license": "MIT"
     },
     "node_modules/uuid": {
diff --git a/package.json b/package.json
index 97f56c28..1e8c17a6 100644
--- a/package.json
+++ b/package.json
@@ -58,6 +58,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1041.0",
+    "@aws-sdk/lib-storage": "^3.1045.0",
     "@internationalized/date": "^3.11.0",
     "antlr4-c3": "^3.4.4",
     "antlr4ng": "^3.0.16",
diff --git a/playwright.config.ts b/playwright.config.ts
index bb12bf99..cd6ca402 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -29,11 +29,6 @@ export default defineConfig({
       url: 'http://localhost:8080',
       reuseExistingServer: true
     },
-    {
-      command: 'npx tsx e2e/start-mock-s3.ts',
-      url: 'http://localhost:9191',
-      reuseExistingServer: true
-    },
     {
       command: 'PORT=4173 node --env-file=.env.test build',
       url: baseURL,
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 25aff6f4..5dd2c1be 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -1,9 +1,11 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
+  import { invalidateAll } from '$app/navigation';
   import StorageBreadcrumb from './StorageBreadcrumb.svelte';
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
   import PreviewModal from './PreviewModal.svelte';
+  import UploadModal from './UploadModal.svelte';
   import Pagination from '$lib/components/Pagination.svelte';
   import type { StoragePage } from '$lib/storage/types.js';
   import { SvelteSet } from 'svelte/reactivity';
@@ -12,7 +14,6 @@
   import { getActionErrorMessage } from './actions/errors.js';
   import { addToast } from '$lib/stores/toast.svelte.js';
   import DeleteConfirmModal from './DeleteConfirmModal.svelte';
-  import { invalidateAll } from '$app/navigation';
 
   import { untrack } from 'svelte';
   import { navigating } from '$app/state';
@@ -169,6 +170,7 @@
   let pendingDeleteKeys = $state<string[]>([]);
   let showPreviewModal = $state(false);
   let previewKey = $state<string | null>(null);
+  let showUploadModal = $state(false);
 
   // ── Action dispatch ───────────────────────────────────────────────────────
 
@@ -208,6 +210,8 @@
         if (res?.previewKey) {
           previewKey = res.previewKey;
           showPreviewModal = true;
+        } else if (res?.openUpload) {
+          showUploadModal = true;
         } else if (res?.unimplemented) {
           addToast('warning', `${action} — not implemented`);
         }
@@ -222,6 +226,11 @@
     }
   }
 
+  function handleUploadSuccess() {
+    loading = true;
+    void invalidateAll();
+  }
+
   async function confirmDelete() {
     showDeleteModal = false;
     const keys = pendingDeleteKeys;
@@ -292,6 +301,7 @@
     {selectionMode}
     onNavigate={handleNavigate}
     onToggleSelectionMode={toggleSelectionMode}
+    onUpload={() => (showUploadModal = true)}
   />
 
   <div class="relative flex-1 overflow-y-auto">
@@ -371,3 +381,6 @@
 
 <!-- Preview modal -->
 <PreviewModal bind:open={showPreviewModal} {bucket} objectKey={previewKey} />
+
+<!-- Upload modal -->
+<UploadModal bind:open={showUploadModal} {bucket} {prefix} onSuccess={handleUploadSuccess} />
diff --git a/src/lib/components/storage/StorageBreadcrumb.svelte b/src/lib/components/storage/StorageBreadcrumb.svelte
index 18c971db..183087e1 100644
--- a/src/lib/components/storage/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/StorageBreadcrumb.svelte
@@ -16,6 +16,7 @@
     selectionMode: boolean;
     onNavigate: (prefix: string) => void;
     onToggleSelectionMode: () => void;
+    onUpload: () => void;
   }
 
   let {
@@ -25,7 +26,8 @@
     fileCount,
     selectionMode,
     onNavigate,
-    onToggleSelectionMode
+    onToggleSelectionMode,
+    onUpload
   }: Props = $props();
 
   const breadcrumbParts = $derived(
@@ -246,6 +248,12 @@
     {m.storage_select_toggle()}
   </button>
 
+  <!-- Upload button -->
+  <button class="btn btn-primary btn-xs gap-1" onclick={onUpload}>
+    <Icon icon="material-symbols:upload" class="size-3.5" aria-hidden="true" />
+    {m.storage_action_upload()}
+  </button>
+
   <!-- More options (pin current location) -->
   <div class="dropdown dropdown-end">
     <button
diff --git a/src/lib/components/storage/UploadModal.svelte b/src/lib/components/storage/UploadModal.svelte
new file mode 100644
index 00000000..8beb781c
--- /dev/null
+++ b/src/lib/components/storage/UploadModal.svelte
@@ -0,0 +1,769 @@
+<script lang="ts">
+  import Icon from '@iconify/svelte';
+  import prettyBytes from 'pretty-bytes';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
+
+  interface Props {
+    open: boolean;
+    bucket: string;
+    prefix: string;
+    onSuccess: () => void;
+  }
+
+  let { open = $bindable(false), bucket, prefix, onSuccess }: Props = $props();
+
+  const uid = $props.id();
+
+  // ── Types ──────────────────────────────────────────────────────────────────
+
+  type Resolution = 'replace' | 'skip' | 'rename';
+
+  /**
+   * Tracks the two-stage rename confirmation flow.
+   * idle      – rename not selected for this entry
+   * editing   – rename selected, text field is editable
+   * checking  – async conflict check in progress
+   * ok        – new name confirmed available
+   * conflict  – new name already exists in the bucket
+   */
+  type RenameState = 'idle' | 'editing' | 'checking' | 'ok' | 'conflict';
+
+  type FileEntry = {
+    id: string;
+    file: File;
+    /** Relative display path (without bucket prefix). */
+    displayPath: string;
+    /** Full object key in the bucket. */
+    targetKey: string;
+    conflict: boolean;
+    resolution: Resolution | null;
+    /** Editable filename when the user chooses to rename. */
+    customName: string;
+    renameState: RenameState;
+    status: 'pending' | 'uploading' | 'done' | 'error' | 'skipped';
+    progress: number;
+    errorMessage?: string;
+  };
+
+  type Phase = 'idle' | 'selected' | 'checking' | 'review' | 'uploading' | 'complete';
+
+  // ── State ──────────────────────────────────────────────────────────────────
+
+  let phase = $state<Phase>('idle');
+  let entries = $state<FileEntry[]>([]);
+  let dragOver = $state(false);
+  let fileInputEl: HTMLInputElement | null = $state(null);
+  let dirInputEl: HTMLInputElement | null = $state(null);
+
+  // Set webkitdirectory on the folder input (non-standard, but widely supported in Firefox/Chromium).
+  $effect(() => {
+    dirInputEl?.setAttribute('webkitdirectory', '');
+  });
+
+  // Reset when modal closes.
+  $effect(() => {
+    if (!open) {
+      phase = 'idle';
+      entries = [];
+      dragOver = false;
+    }
+  });
+
+  // ── Derived ────────────────────────────────────────────────────────────────
+
+  const conflictEntries = $derived(entries.filter((e) => e.conflict));
+  const hasUnresolved = $derived(conflictEntries.some((e) => e.resolution === null));
+  // All rename entries must be explicitly confirmed (renameState === 'ok') before uploading.
+  const hasUnconfirmedRename = $derived(
+    entries.some((e) => e.resolution === 'rename' && e.renameState !== 'ok')
+  );
+  const canProceed = $derived(!hasUnresolved && !hasUnconfirmedRename);
+
+  const totalSize = $derived(entries.reduce((sum, e) => sum + e.file.size, 0));
+  const uploadedCount = $derived(entries.filter((e) => e.status === 'done').length);
+  const skippedCount = $derived(entries.filter((e) => e.status === 'skipped').length);
+  const errorCount = $derived(entries.filter((e) => e.status === 'error').length);
+
+  // ── Key helpers ────────────────────────────────────────────────────────────
+
+  function buildTargetKey(relativePath: string): string {
+    return prefix ? `${prefix}${relativePath}` : relativePath;
+  }
+
+  /**
+   * Compute the final object key for an entry at upload time.
+   * For renamed entries, replaces only the filename segment, preserving any
+   * directory prefix within the key.
+   */
+  function resolvedKey(entry: FileEntry): string {
+    if (entry.resolution !== 'rename') return entry.targetKey;
+    const slash = entry.targetKey.lastIndexOf('/');
+    const dir = slash >= 0 ? entry.targetKey.slice(0, slash + 1) : '';
+    return dir + entry.customName.trim();
+  }
+
+  // ── Entry construction ─────────────────────────────────────────────────────
+
+  function makeEntries(pairs: { file: File; relativePath: string }[]): FileEntry[] {
+    return pairs.map(({ file, relativePath }) => ({
+      id: crypto.randomUUID(),
+      file,
+      displayPath: relativePath,
+      targetKey: buildTargetKey(relativePath),
+      conflict: false,
+      resolution: null,
+      customName: file.name,
+      renameState: 'idle',
+      status: 'pending',
+      progress: 0
+    }));
+  }
+
+  // ── File selection ─────────────────────────────────────────────────────────
+
+  function handleInputChange(e: Event) {
+    const list = (e.target as HTMLInputElement).files;
+    if (!list || list.length === 0) return;
+    const pairs = Array.from(list).map((f) => ({
+      file: f,
+      relativePath: f.webkitRelativePath || f.name
+    }));
+    entries = makeEntries(pairs);
+    phase = 'selected';
+    // Reset the input so the same selection can be re-triggered.
+    (e.target as HTMLInputElement).value = '';
+  }
+
+  function handleDragOver(e: DragEvent) {
+    e.preventDefault();
+    dragOver = true;
+  }
+
+  function handleDragLeave() {
+    dragOver = false;
+  }
+
+  async function handleDrop(e: DragEvent) {
+    e.preventDefault();
+    dragOver = false;
+    const dt = e.dataTransfer;
+    if (!dt) return;
+
+    let pairs: { file: File; relativePath: string }[];
+    try {
+      pairs = await collectDroppedFiles(dt);
+    } catch {
+      // Fallback if the FileSystem API is unavailable.
+      pairs = Array.from(dt.files).map((f) => ({ file: f, relativePath: f.name }));
+    }
+
+    if (pairs.length === 0) return;
+    entries = makeEntries(pairs);
+    phase = 'selected';
+  }
+
+  // ── Directory traversal ────────────────────────────────────────────────────
+
+  async function collectDroppedFiles(
+    dt: DataTransfer
+  ): Promise<{ file: File; relativePath: string }[]> {
+    // Collect FileSystemEntry for each dropped item once (single-use in some browsers).
+    const fsEntries = Array.from(dt.items).map((i) => i.webkitGetAsEntry?.() ?? null);
+
+    // If no directories are present, skip async traversal.
+    if (!fsEntries.some((e) => e?.isDirectory)) {
+      return Array.from(dt.files).map((f) => ({ file: f, relativePath: f.name }));
+    }
+
+    const results: { file: File; relativePath: string }[] = [];
+    for (const entry of fsEntries) {
+      if (entry) {
+        results.push(...(await traverseEntry(entry, '')));
+      }
+    }
+    return results;
+  }
+
+  async function traverseEntry(
+    entry: FileSystemEntry,
+    base: string
+  ): Promise<{ file: File; relativePath: string }[]> {
+    if (entry.isFile) {
+      return new Promise((resolve, reject) => {
+        (entry as FileSystemFileEntry).file(
+          (f) => resolve([{ file: f, relativePath: base + entry.name }]),
+          reject
+        );
+      });
+    }
+    if (entry.isDirectory) {
+      const reader = (entry as FileSystemDirectoryEntry).createReader();
+      const children = await drainReader(reader);
+      const newBase = base + entry.name + '/';
+      const nested = await Promise.all(children.map((c) => traverseEntry(c, newBase)));
+      return nested.flat();
+    }
+    return [];
+  }
+
+  async function drainReader(reader: FileSystemDirectoryReader): Promise<FileSystemEntry[]> {
+    const all: FileSystemEntry[] = [];
+    let batch: FileSystemEntry[];
+    do {
+      batch = await new Promise<FileSystemEntry[]>((res, rej) => reader.readEntries(res, rej));
+      all.push(...batch);
+    } while (batch.length > 0);
+    return all;
+  }
+
+  // ── Upload flow ────────────────────────────────────────────────────────────
+
+  async function startUploadFlow() {
+    if (phase !== 'selected') return;
+    phase = 'checking';
+
+    const results = await Promise.all(
+      entries.map(async (e) => {
+        try {
+          return { id: e.id, conflict: await checkObjectExists(bucket, e.targetKey) };
+        } catch {
+          return { id: e.id, conflict: false };
+        }
+      })
+    );
+
+    const conflictMap = new Map(results.map((r) => [r.id, r.conflict]));
+    entries = entries.map((e) => ({
+      ...e,
+      conflict: conflictMap.get(e.id) ?? false,
+      // Non-conflicting files get a placeholder resolution so they proceed to upload.
+      resolution: (conflictMap.get(e.id) ? null : 'replace') as Resolution | null
+    }));
+
+    if (entries.some((e) => e.conflict)) {
+      phase = 'review';
+    } else {
+      await doUploadAll();
+    }
+  }
+
+  async function confirmAndUpload() {
+    if (!canProceed) return;
+    await doUploadAll();
+  }
+
+  async function doUploadAll() {
+    phase = 'uploading';
+
+    // Mark skipped entries immediately.
+    entries = entries.map((e) =>
+      e.resolution === 'skip' ? { ...e, status: 'skipped' as const } : e
+    );
+
+    const toUpload = entries.filter((e) => e.status !== 'skipped');
+    const concurrency = 3;
+    for (let i = 0; i < toUpload.length; i += concurrency) {
+      await Promise.all(toUpload.slice(i, i + concurrency).map(doUploadEntry));
+    }
+
+    phase = 'complete';
+  }
+
+  async function doUploadEntry(entry: FileEntry) {
+    const key = resolvedKey(entry);
+    entries = entries.map((e) =>
+      e.id === entry.id ? { ...e, status: 'uploading' as const, progress: 0 } : e
+    );
+    try {
+      await uploadFile(bucket, key, entry.file, (pct) => {
+        entries = entries.map((e) => (e.id === entry.id ? { ...e, progress: pct } : e));
+      });
+      entries = entries.map((e) =>
+        e.id === entry.id ? { ...e, status: 'done' as const, progress: 100 } : e
+      );
+    } catch (err) {
+      const msg =
+        err instanceof UploadError ? mapUploadError(err) : m.storage_upload_error_unknown();
+      entries = entries.map((e) =>
+        e.id === entry.id ? { ...e, status: 'error' as const, errorMessage: msg } : e
+      );
+    }
+  }
+
+  // ── Resolution handlers ────────────────────────────────────────────────────
+
+  function setResolution(id: string, res: Resolution) {
+    entries = entries.map((e) =>
+      e.id === id
+        ? {
+            ...e,
+            resolution: res,
+            renameState: (res === 'rename' ? 'editing' : 'idle') as RenameState
+          }
+        : e
+    );
+  }
+
+  function setCustomName(id: string, name: string) {
+    // Any edit resets the confirmation state so the user must re-confirm.
+    entries = entries.map((e) =>
+      e.id === id ? { ...e, customName: name, renameState: 'editing' as const } : e
+    );
+  }
+
+  /**
+   * Two-stage rename button handler:
+   *   1st click (not in rename mode)  → enter edit mode
+   *   2nd click (editing / conflict)  → check new name against bucket
+   *   click when ok                   → re-enter edit mode
+   */
+  async function handleRenameButtonClick(id: string) {
+    const entry = entries.find((e) => e.id === id);
+    if (!entry) return;
+    if (entry.resolution !== 'rename') {
+      setResolution(id, 'rename');
+    } else if (entry.renameState === 'ok') {
+      entries = entries.map((e) => (e.id === id ? { ...e, renameState: 'editing' as const } : e));
+    } else if (entry.renameState === 'editing' || entry.renameState === 'conflict') {
+      await checkRename(id);
+    }
+  }
+
+  /** Check whether the renamed key already exists in the bucket. */
+  async function checkRename(id: string) {
+    const entry = entries.find((e) => e.id === id);
+    if (!entry || entry.resolution !== 'rename') return;
+    // Client-side guard: name must differ from original.
+    const newName = entry.customName.trim();
+    if (newName === '' || newName === entry.file.name) return;
+
+    entries = entries.map((e) => (e.id === id ? { ...e, renameState: 'checking' as const } : e));
+    const newKey = resolvedKey(entry);
+    try {
+      const exists = await checkObjectExists(bucket, newKey);
+      const nextState: RenameState = exists ? 'conflict' : 'ok';
+      entries = entries.map((e) => (e.id === id ? { ...e, renameState: nextState } : e));
+    } catch {
+      // On network error fall back to editing so the user can retry.
+      entries = entries.map((e) => (e.id === id ? { ...e, renameState: 'editing' as const } : e));
+    }
+  }
+
+  // ── Done / cancel ──────────────────────────────────────────────────────────
+
+  function handleDone() {
+    const hasUploads = uploadedCount > 0;
+    open = false;
+    if (hasUploads) onSuccess();
+  }
+
+  function handleCancel() {
+    if (phase === 'uploading') return;
+    phase = 'idle';
+    entries = [];
+    open = false;
+  }
+
+  // ── Error mapping ──────────────────────────────────────────────────────────
+
+  function mapUploadError(err: UploadError): string {
+    switch (err.code) {
+      case 'not_connected':
+        return m.storage_upload_error_not_connected();
+      case 'access_denied':
+        return m.storage_upload_error_access_denied();
+      case 'no_such_bucket':
+        return m.storage_upload_error_no_such_bucket();
+      case 'invalid_part':
+        return m.storage_upload_error_invalid_part();
+      case 'server_error':
+        return m.storage_upload_error_server_error();
+      default:
+        return m.storage_upload_error_unknown();
+    }
+  }
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box w-full max-w-lg">
+    <!-- Header -->
+    <div class="mb-4 flex items-center justify-between">
+      <h2 class="text-base-content text-lg font-semibold">
+        {m.storage_upload_title()}
+      </h2>
+      <button
+        class="btn btn-ghost btn-sm btn-square"
+        onclick={handleCancel}
+        disabled={phase === 'uploading'}
+        aria-label={m.storage_upload_close()}
+      >
+        <Icon icon="material-symbols:close" class="size-5" aria-hidden="true" />
+      </button>
+    </div>
+
+    <!-- Target prefix info -->
+    {#if prefix}
+      <p class="text-base-content/50 mb-3 truncate text-xs">
+        {m.storage_upload_to_prefix({ prefix })}
+      </p>
+    {/if}
+
+    <!-- ── idle: drag-and-drop zone ────────────────────────────────────── -->
+    {#if phase === 'idle'}
+      <!-- Hidden inputs: one for multiple files, one for a directory -->
+      <input
+        bind:this={fileInputEl}
+        id="{uid}-files"
+        type="file"
+        class="sr-only"
+        multiple
+        onchange={handleInputChange}
+        aria-label={m.storage_upload_select_files()}
+      />
+      <input
+        bind:this={dirInputEl}
+        id="{uid}-dir"
+        type="file"
+        class="sr-only"
+        onchange={handleInputChange}
+        aria-label={m.storage_upload_select_folder()}
+      />
+
+      <!-- Drop zone -->
+      <div
+        role="button"
+        tabindex="0"
+        class="
+          border-base-300 hover:border-primary/60 hover:bg-primary/5 mb-4 flex cursor-pointer
+          flex-col items-center justify-center gap-3 rounded-lg border-2 border-dashed px-6 py-12
+          transition-colors
+          {dragOver ? 'border-primary bg-primary/5' : ''}
+        "
+        aria-label={m.storage_upload_drop_prompt()}
+        onclick={() => fileInputEl?.click()}
+        onkeydown={(e) => (e.key === 'Enter' || e.key === ' ') && fileInputEl?.click()}
+        ondragover={handleDragOver}
+        ondragleave={handleDragLeave}
+        ondrop={handleDrop}
+      >
+        <Icon
+          icon="material-symbols:upload-file"
+          class="text-base-content/30 size-12"
+          aria-hidden="true"
+        />
+        <p class="text-base-content/60 text-center text-sm">
+          {m.storage_upload_drop_prompt()}
+        </p>
+      </div>
+
+      <!-- Picker buttons -->
+      <div class="flex justify-center gap-3">
+        <button class="btn btn-ghost btn-sm gap-1.5" onclick={() => fileInputEl?.click()}>
+          <Icon icon="material-symbols:file-copy-outline" class="size-4" aria-hidden="true" />
+          {m.storage_upload_select_files()}
+        </button>
+        <button class="btn btn-ghost btn-sm gap-1.5" onclick={() => dirInputEl?.click()}>
+          <Icon icon="material-symbols:folder-open" class="size-4" aria-hidden="true" />
+          {m.storage_upload_select_folder()}
+        </button>
+      </div>
+
+      <!-- ── selected: file list preview ──────────────────────────────────── -->
+    {:else if phase === 'selected'}
+      <ul
+        class="bg-base-200 divide-base-300 mb-3 max-h-64 divide-y overflow-y-auto rounded-lg"
+        aria-label={entries.length === 1
+          ? `1 ${m.storage_file()}`
+          : `${entries.length} ${m.storage_files()}`}
+      >
+        {#each entries as entry (entry.id)}
+          <li class="flex items-center gap-3 px-4 py-2.5">
+            <Icon
+              icon="material-symbols:draft"
+              class="text-primary size-5 shrink-0"
+              aria-hidden="true"
+            />
+            <span class="min-w-0 flex-1 truncate text-sm">{entry.displayPath}</span>
+            <span class="text-base-content/50 shrink-0 text-xs">{prettyBytes(entry.file.size)}</span
+            >
+          </li>
+        {/each}
+      </ul>
+      <p class="text-base-content/50 mb-4 text-xs">
+        {entries.length === 1 ? `1 ${m.storage_file()}` : `${entries.length} ${m.storage_files()}`}
+        &nbsp;&middot;&nbsp;{m.storage_upload_total_size({ size: prettyBytes(totalSize) })}
+      </p>
+      <div class="flex justify-end gap-2">
+        <button class="btn btn-ghost btn-sm" onclick={handleCancel}>
+          {m.storage_upload_overwrite_cancel()}
+        </button>
+        <button class="btn btn-primary btn-sm gap-1" onclick={startUploadFlow}>
+          <Icon icon="material-symbols:upload" class="size-4" aria-hidden="true" />
+          {m.storage_upload_start()}
+        </button>
+      </div>
+
+      <!-- ── checking ─────────────────────────────────────────────────────── -->
+    {:else if phase === 'checking'}
+      <div class="flex items-center justify-center gap-3 py-8" aria-live="polite">
+        <span class="loading loading-spinner loading-sm text-primary" aria-hidden="true"></span>
+        <span class="text-base-content/60 text-sm">{m.storage_upload_checking()}</span>
+      </div>
+
+      <!-- ── review: conflict resolution ──────────────────────────────────── -->
+    {:else if phase === 'review'}
+      <div class="mb-3 flex items-start gap-2">
+        <Icon
+          icon="material-symbols:warning"
+          class="text-warning mt-0.5 size-5 shrink-0"
+          aria-hidden="true"
+        />
+        <div>
+          <p class="text-base-content font-semibold">{m.storage_upload_conflicts_title()}</p>
+          <p class="text-base-content/60 mt-0.5 text-sm">{m.storage_upload_conflicts_desc()}</p>
+        </div>
+      </div>
+
+      <ul
+        class="border-base-300 mb-4 max-h-72 divide-y overflow-y-auto rounded-lg border"
+        aria-label={m.storage_upload_conflicts_title()}
+      >
+        {#each conflictEntries as entry (entry.id)}
+          {@const nameOnly = entry.targetKey.split('/').at(-1) ?? entry.file.name}
+          {@const badRename =
+            entry.resolution === 'rename' &&
+            (entry.customName.trim() === '' || entry.customName.trim() === entry.file.name)}
+          <li class="px-4 py-3">
+            <p class="text-base-content mb-2 truncate text-sm font-medium">
+              &ldquo;{nameOnly}&rdquo;
+            </p>
+            <!-- Resolution toggle buttons -->
+            <div
+              class="flex flex-wrap gap-1.5"
+              role="group"
+              aria-label="{m.storage_upload_conflicts_title()} — {nameOnly}"
+            >
+              <button
+                class="btn btn-xs {entry.resolution === 'replace' ? 'btn-warning' : 'btn-ghost'}"
+                onclick={() => setResolution(entry.id, 'replace')}
+                aria-pressed={entry.resolution === 'replace'}
+              >
+                {m.storage_upload_resolution_replace()}
+              </button>
+              <button
+                class="btn btn-xs {entry.resolution === 'skip' ? 'btn-neutral' : 'btn-ghost'}"
+                onclick={() => setResolution(entry.id, 'skip')}
+                aria-pressed={entry.resolution === 'skip'}
+              >
+                {m.storage_upload_resolution_skip()}
+              </button>
+              <button
+                class="btn btn-xs gap-1 {entry.resolution !== 'rename'
+                  ? 'btn-ghost'
+                  : entry.renameState === 'ok'
+                    ? 'btn-success'
+                    : entry.renameState === 'conflict'
+                      ? 'btn-error'
+                      : 'btn-primary'}"
+                onclick={() => handleRenameButtonClick(entry.id)}
+                aria-pressed={entry.resolution === 'rename'}
+                disabled={entry.renameState === 'checking'}
+              >
+                {#if entry.resolution === 'rename' && entry.renameState === 'checking'}
+                  <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+                {:else if entry.resolution === 'rename' && entry.renameState === 'ok'}
+                  <Icon icon="material-symbols:check" class="size-3" aria-hidden="true" />
+                {/if}
+                {#if entry.resolution === 'rename' && (entry.renameState === 'editing' || entry.renameState === 'conflict')}
+                  {m.storage_upload_rename_confirm_action()}
+                {:else}
+                  {m.storage_upload_resolution_rename()}
+                {/if}
+              </button>
+            </div>
+
+            <!-- Name field: real <input> only while editing; static display otherwise -->
+            <div class="mt-2">
+              {#if entry.resolution === 'rename' && (entry.renameState === 'editing' || entry.renameState === 'conflict')}
+                <label for="{uid}-rename-{entry.id}" class="label sr-only">
+                  {m.storage_upload_rename_label()}
+                </label>
+                <input
+                  id="{uid}-rename-{entry.id}"
+                  type="text"
+                  class="input input-sm w-full {badRename || entry.renameState === 'conflict'
+                    ? 'input-error'
+                    : ''}"
+                  value={entry.customName}
+                  oninput={(e) => setCustomName(entry.id, (e.target as HTMLInputElement).value)}
+                  onkeydown={(e) => e.key === 'Enter' && void checkRename(entry.id)}
+                  placeholder={m.storage_upload_rename_label()}
+                  aria-describedby={badRename || entry.renameState === 'conflict'
+                    ? `${uid}-rename-err-${entry.id}`
+                    : undefined}
+                />
+                {#if badRename}
+                  <p id="{uid}-rename-err-{entry.id}" class="text-error mt-1 text-xs" role="alert">
+                    {m.storage_upload_rename_same_name_error()}
+                  </p>
+                {:else if entry.renameState === 'conflict'}
+                  <p id="{uid}-rename-err-{entry.id}" class="text-error mt-1 text-xs" role="alert">
+                    {m.storage_upload_rename_taken()}
+                  </p>
+                {/if}
+              {:else}
+                <!-- Static display: not in rename mode, or confirmed/checking -->
+                <div class="text-base-content/50 mt-1 flex items-center gap-1 px-1 text-sm">
+                  <span class="min-w-0 flex-1 truncate">{entry.customName}</span>
+                  {#if entry.resolution === 'rename' && entry.renameState === 'ok'}
+                    <Icon
+                      icon="material-symbols:check-circle"
+                      class="text-success size-3.5 shrink-0"
+                      aria-hidden="true"
+                    />
+                  {/if}
+                </div>
+              {/if}
+            </div>
+          </li>
+        {/each}
+      </ul>
+
+      <div class="flex justify-end gap-2">
+        <button class="btn btn-ghost btn-sm" onclick={handleCancel}>
+          {m.storage_upload_overwrite_cancel()}
+        </button>
+        <button
+          class="btn btn-primary btn-sm gap-1"
+          onclick={confirmAndUpload}
+          disabled={!canProceed}
+          aria-disabled={!canProceed}
+        >
+          <Icon icon="material-symbols:upload" class="size-4" aria-hidden="true" />
+          {m.storage_upload_start()}
+        </button>
+      </div>
+
+      <!-- ── uploading ─────────────────────────────────────────────────────── -->
+    {:else if phase === 'uploading'}
+      <ul
+        class="border-base-300 mb-3 max-h-72 divide-y overflow-y-auto rounded-lg border"
+        aria-label={m.storage_upload_title()}
+        aria-live="polite"
+      >
+        {#each entries as entry (entry.id)}
+          {@const nameOnly =
+            entry.resolution === 'rename' && entry.customName.trim()
+              ? entry.customName.trim()
+              : (entry.targetKey.split('/').at(-1) ?? entry.file.name)}
+          <li class="px-4 py-2.5">
+            <div class="flex items-center gap-2 text-sm">
+              {#if entry.status === 'done'}
+                <Icon
+                  icon="material-symbols:check-circle"
+                  class="text-success size-4 shrink-0"
+                  aria-hidden="true"
+                />
+              {:else if entry.status === 'error'}
+                <Icon
+                  icon="material-symbols:error"
+                  class="text-error size-4 shrink-0"
+                  aria-hidden="true"
+                />
+              {:else if entry.status === 'skipped'}
+                <Icon
+                  icon="material-symbols:block"
+                  class="text-base-content/30 size-4 shrink-0"
+                  aria-hidden="true"
+                />
+              {:else if entry.status === 'uploading'}
+                <span
+                  class="loading loading-spinner loading-xs text-primary shrink-0"
+                  aria-hidden="true"
+                ></span>
+              {:else}
+                <Icon
+                  icon="material-symbols:schedule"
+                  class="text-base-content/30 size-4 shrink-0"
+                  aria-hidden="true"
+                />
+              {/if}
+              <span class="min-w-0 flex-1 truncate">{nameOnly}</span>
+              <span class="text-base-content/50 shrink-0 text-xs">
+                {#if entry.status === 'uploading'}
+                  {entry.progress}%
+                {:else if entry.status === 'done'}
+                  {m.storage_upload_status_done()}
+                {:else if entry.status === 'skipped'}
+                  {m.storage_upload_status_skipped()}
+                {:else if entry.status === 'error'}
+                  {m.storage_upload_status_failed()}
+                {:else}
+                  {m.storage_upload_status_queued()}
+                {/if}
+              </span>
+            </div>
+            {#if entry.status === 'uploading'}
+              <progress
+                class="progress progress-primary mt-1.5 w-full"
+                value={entry.progress}
+                max="100"
+                aria-valuenow={entry.progress}
+                aria-valuemin={0}
+                aria-valuemax={100}
+              ></progress>
+            {/if}
+            {#if entry.status === 'error' && entry.errorMessage}
+              <p class="text-error mt-1 text-xs">{entry.errorMessage}</p>
+            {/if}
+          </li>
+        {/each}
+      </ul>
+
+      <!-- ── complete ───────────────────────────────────────────────────────── -->
+    {:else if phase === 'complete'}
+      <div class="mb-4 flex items-center gap-3 py-2" role="status">
+        <Icon
+          icon="line-md:circle-filled-to-confirm-circle-filled-transition"
+          class="text-success size-10 shrink-0"
+          aria-hidden="true"
+        />
+        <div>
+          <p class="text-base-content font-semibold">{m.storage_upload_complete_title()}</p>
+          <p class="text-base-content/60 mt-0.5 text-sm">
+            {m.storage_upload_complete_summary({
+              uploaded: uploadedCount,
+              skipped: skippedCount,
+              failed: errorCount
+            })}
+          </p>
+        </div>
+      </div>
+
+      {#if errorCount > 0}
+        <ul
+          class="bg-error/10 mb-4 max-h-40 overflow-y-auto rounded-lg px-3 py-2"
+          aria-label={m.storage_upload_status_failed()}
+        >
+          {#each entries.filter((e) => e.status === 'error') as entry (entry.id)}
+            {@const errName =
+              entry.resolution === 'rename' && entry.customName.trim()
+                ? entry.customName.trim()
+                : (entry.targetKey.split('/').at(-1) ?? entry.file.name)}
+            <li class="text-error py-1 text-xs">
+              {errName}: {entry.errorMessage}
+            </li>
+          {/each}
+        </ul>
+      {/if}
+
+      <div class="flex justify-end">
+        <button class="btn btn-primary btn-sm" onclick={handleDone}>
+          {m.storage_upload_done()}
+        </button>
+      </div>
+    {/if}
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/actions/errors.ts b/src/lib/components/storage/actions/errors.ts
index 0568933f..27e7e170 100644
--- a/src/lib/components/storage/actions/errors.ts
+++ b/src/lib/components/storage/actions/errors.ts
@@ -12,6 +12,10 @@ export function getActionErrorMessage(err: ActionError): string {
       return m.storage_download_error_not_found();
     case 'server_error':
       return m.storage_download_error_server_error();
+    case 'no_such_bucket':
+      return m.storage_upload_error_no_such_bucket();
+    case 'invalid_part':
+      return m.storage_upload_error_invalid_part();
     default:
       return m.storage_download_error_unknown();
   }
diff --git a/src/lib/components/storage/actions/index.ts b/src/lib/components/storage/actions/index.ts
index 182e8649..b9a9322a 100644
--- a/src/lib/components/storage/actions/index.ts
+++ b/src/lib/components/storage/actions/index.ts
@@ -1,11 +1,12 @@
 import type { ActionContext, ActionResult, ActionName } from './types';
 import download from './download';
 import preview from './preview';
+import upload from './upload';
 import deleteAction from './delete';
 
 const actions: Record<ActionName, (ctx: ActionContext) => Promise<ActionResult>> = {
   download,
-  upload: async () => ({ unimplemented: true }),
+  upload,
   preview,
   delete: deleteAction
 };
diff --git a/src/lib/components/storage/actions/types.ts b/src/lib/components/storage/actions/types.ts
index d7da20a9..a9470e7c 100644
--- a/src/lib/components/storage/actions/types.ts
+++ b/src/lib/components/storage/actions/types.ts
@@ -2,6 +2,7 @@ export type ActionResult = {
   success?: true;
   unimplemented?: true;
   previewKey?: string;
+  openUpload?: true;
   failedKeys?: Array<{ key: string; message?: string }>;
 };
 
diff --git a/src/lib/components/storage/actions/upload.ts b/src/lib/components/storage/actions/upload.ts
new file mode 100644
index 00000000..41f9b9a9
--- /dev/null
+++ b/src/lib/components/storage/actions/upload.ts
@@ -0,0 +1,13 @@
+import type { ActionContext, ActionResult } from './types';
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export default async function uploadAction(_ctx: ActionContext): Promise<ActionResult> {
+  // The upload workflow is driven by UploadModal, which is opened directly
+  // by the StorageBreadcrumb toolbar button. This action handler returns
+  // openUpload so callers wiring through executeAction can also trigger it.
+  return { openUpload: true };
+}
+
+// Re-export upload utilities so UploadModal can import from a single location.
+export { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
+export type { UploadErrorCode } from '$lib/storage/upload.js';
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 4427860d..5861498a 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -34,6 +34,15 @@ export class HDFSStorageProvider implements StorageProvider {
     throw new Error('HDFS not implemented');
   }
 
+  putObject(
+    _key: string,
+    _body: ReadableStream | Buffer,
+    _contentType: string,
+    _contentLength?: number
+  ): Promise<void> {
+    throw new Error('HDFS not implemented');
+  }
+
   deleteObjects(_keys: string[]): Promise<DeleteObjectsResult> {
     throw new Error('HDFS not implemented');
   }
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index a874c1a2..6156762d 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -30,6 +30,13 @@ export interface StorageProvider {
   getObjectRange(key: string, start: number, end: number): Promise<ReadableStream>;
   getMetadata(key: string): Promise<StorageMetadata>;
   exists(key: string): Promise<boolean>;
+  /** Upload an object, using multipart upload for large files. */
+  putObject(
+    key: string,
+    body: ReadableStream | Buffer,
+    contentType: string,
+    contentLength?: number
+  ): Promise<void>;
   deleteObjects(keys: string[]): Promise<DeleteObjectsResult>;
   /**
    * List all object keys under a prefix, recursively (no delimiter).
diff --git a/src/lib/server/storage/s3-errors.ts b/src/lib/server/storage/s3-errors.ts
index 707f9f13..c9510e52 100644
--- a/src/lib/server/storage/s3-errors.ts
+++ b/src/lib/server/storage/s3-errors.ts
@@ -32,6 +32,13 @@ function accessDeniedMessage(context: Context): string {
   return context.key ? `Access denied to "${context.key}"` : 'Access denied';
 }
 
+/**
+ * Maps an S3 error to the appropriate SvelteKit HTTP error and throws it.
+ * If `err` is not an S3ServiceException it is re-thrown as-is so that
+ * unexpected errors are never swallowed.
+ *
+ * Always throws — callers do not need to throw the return value.
+ */
 export function mapS3ErrorToHttp(err: unknown, context: Context): never {
   if (!isS3ServiceException(err)) {
     throw err;
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 69af282f..d33a23cc 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -7,6 +7,7 @@ import {
   DeleteObjectsCommand,
   type ListObjectsV2CommandOutput
 } from '@aws-sdk/client-s3';
+import { Upload } from '@aws-sdk/lib-storage';
 import type { StorageProvider, ObjectDownload, DeleteObjectsResult } from './provider.js';
 import type { S3Config } from './types.js';
 import type { StoragePage, StorageObject, StorageMetadata } from '$lib/storage/types.js';
@@ -123,6 +124,35 @@ export class S3StorageProvider implements StorageProvider {
     }
   }
 
+  async putObject(
+    key: string,
+    body: ReadableStream | Buffer,
+    contentType: string,
+    contentLength?: number
+  ): Promise<void> {
+    log.debug(
+      { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
+      'uploading object'
+    );
+    const upload = new Upload({
+      client: this.client,
+      queueSize: 4,
+      partSize: 5 * 1024 * 1024,
+      params: {
+        Bucket: this.bucket,
+        Key: key,
+        Body: body,
+        ContentType: contentType,
+        ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
+      }
+    });
+    await upload.done();
+    log.info(
+      { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
+      'object uploaded'
+    );
+  }
+
   async deleteObjects(keys: string[]): Promise<DeleteObjectsResult> {
     log.debug({ bucket: this.bucket, key_count: keys.length }, 'deleting objects');
     const output = await this.client.send(
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index 59bded48..d7aae91d 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -86,6 +86,32 @@ export async function getObjectMetadata(
   }
 }
 
+/** Upload an object to the bucket, using multipart upload for large files. */
+export async function uploadObject(
+  userId: string,
+  bucket: string,
+  key: string,
+  body: ReadableStream | Buffer,
+  contentType: string,
+  contentLength?: number
+): Promise<void> {
+  const provider = getProviderForUser(userId, bucket);
+
+  try {
+    log.debug({ user_id: userId, bucket, key, content_type: contentType }, 'uploading object');
+    await provider.putObject(key, body, contentType, contentLength);
+    log.info(
+      { user_id: userId, bucket, key, content_type: contentType, content_length: contentLength },
+      'object uploaded'
+    );
+  } catch (err) {
+    if (err instanceof S3ServiceException) {
+      mapS3ErrorToHttp(err, { bucket, key, operation: 'putObject' });
+    }
+    throw err;
+  }
+}
+
 /** Delete one or more objects from the bucket. Returns a result listing any keys that failed.
  *  Directory keys (ending with '/') are expanded to all contained objects before deletion. */
 export async function deleteObjects(
diff --git a/src/lib/storage/upload.ts b/src/lib/storage/upload.ts
new file mode 100644
index 00000000..8865b144
--- /dev/null
+++ b/src/lib/storage/upload.ts
@@ -0,0 +1,114 @@
+/**
+ * Client-side utilities for uploading a single file to S3 via the server proxy.
+ *
+ * Strategy:
+ * - `checkObjectExists` performs a lightweight HEAD request against the download
+ *   endpoint to check whether an object with the target key already exists.
+ * - `uploadFile` uses XMLHttpRequest (not fetch) so that upload progress events
+ *   are available. fetch upload progress requires `duplex: 'half'` which is not
+ *   supported in Firefox.
+ * - The file is sent as the raw request body — no base64 or multipart encoding.
+ *   The server streams it directly to S3, preserving binary integrity.
+ */
+
+export type UploadErrorCode =
+  | 'not_connected'
+  | 'access_denied'
+  | 'no_such_bucket'
+  | 'invalid_part'
+  | 'server_error'
+  | 'unknown';
+
+export class UploadError extends Error {
+  constructor(
+    public readonly code: UploadErrorCode,
+    message: string
+  ) {
+    super(message);
+    this.name = 'UploadError';
+  }
+}
+
+function buildUploadUrl(bucket: string, key: string): string {
+  return `/storage/api/upload?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
+}
+
+function buildDownloadUrl(bucket: string, key: string): string {
+  return `/storage/api/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
+}
+
+function mapStatusToUploadCode(status: number): UploadErrorCode {
+  if (status === 403) return 'access_denied';
+  if (status === 404) return 'no_such_bucket';
+  if (status === 400) return 'invalid_part';
+  if (status === 401) return 'not_connected';
+  if (status >= 500) return 'server_error';
+  return 'unknown';
+}
+
+/**
+ * Check whether an object with the given key already exists in the bucket.
+ *
+ * Uses a HEAD request to the download endpoint (which calls HeadObject internally)
+ * so no object body is transferred. Returns `true` if the object exists, `false`
+ * if it does not. Throws `UploadError` for auth or server errors.
+ */
+export async function checkObjectExists(bucket: string, key: string): Promise<boolean> {
+  const url = buildDownloadUrl(bucket, key);
+  const res = await fetch(url, { method: 'HEAD' });
+  if (res.status === 200) return true;
+  if (res.status === 404) return false;
+  if (res.status === 401) throw new UploadError('not_connected', 'Not connected');
+  if (res.status === 403) throw new UploadError('access_denied', 'Access denied');
+  throw new UploadError('server_error', `Unexpected status ${res.status}`);
+}
+
+/**
+ * Upload a single file to the given bucket + key.
+ *
+ * Uses XMLHttpRequest so that `upload.onprogress` fires with byte-level progress.
+ * The File object is sent as the raw request body — the server proxies it to S3
+ * without buffering.
+ *
+ * @param onProgress - Called with a progress percentage (0–100) during upload.
+ * @throws {UploadError} on non-2xx responses.
+ */
+export function uploadFile(
+  bucket: string,
+  key: string,
+  file: File,
+  onProgress: (pct: number) => void
+): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    const url = buildUploadUrl(bucket, key);
+
+    xhr.upload.addEventListener('progress', (e) => {
+      if (e.lengthComputable) {
+        onProgress(Math.round((e.loaded / e.total) * 100));
+      }
+    });
+
+    xhr.addEventListener('load', () => {
+      if (xhr.status >= 200 && xhr.status < 300) {
+        onProgress(100);
+        resolve();
+        return;
+      }
+      const code = mapStatusToUploadCode(xhr.status);
+      reject(new UploadError(code, `Upload failed with status ${xhr.status}`));
+    });
+
+    xhr.addEventListener('error', () => {
+      reject(new UploadError('server_error', 'Network error during upload'));
+    });
+
+    xhr.addEventListener('abort', () => {
+      reject(new UploadError('unknown', 'Upload aborted'));
+    });
+
+    xhr.open('POST', url);
+    xhr.setRequestHeader('Content-Type', file.type || 'application/octet-stream');
+    xhr.send(file);
+  });
+}
diff --git a/src/routes/(app)/storage/api/download/+server.ts b/src/routes/(app)/storage/api/download/+server.ts
index c57b3bdc..0a2c984a 100644
--- a/src/routes/(app)/storage/api/download/+server.ts
+++ b/src/routes/(app)/storage/api/download/+server.ts
@@ -1,7 +1,7 @@
 import type { RequestHandler } from './$types';
-import { error } from '@sveltejs/kit';
 import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
 import { getUserId } from '$lib/server/auth-utils.js';
+import { requireBucketKey } from '../params.js';
 
 /** Derive the bare filename from a (possibly path-prefixed) object key. */
 function filenameFromKey(key: string): string {
@@ -17,16 +17,7 @@ function filenameFromKey(key: string): string {
  * buffering occurs.
  */
 export const GET: RequestHandler = async ({ locals, url }) => {
-  const bucket = url.searchParams.get('bucket');
-  if (!bucket || !bucket.trim()) {
-    throw error(400, 'Missing required query parameter: bucket');
-  }
-
-  const key = url.searchParams.get('key');
-  if (!key || !key.trim()) {
-    throw error(400, 'Missing required query parameter: key');
-  }
-
+  const { bucket, key } = requireBucketKey(url);
   const userId = getUserId(locals);
 
   locals.logger.debug({ bucket, key }, 'download request received');
@@ -66,16 +57,7 @@ export const GET: RequestHandler = async ({ locals, url }) => {
  * inline UI messages rather than browser download failures.
  */
 export const HEAD: RequestHandler = async ({ locals, url }) => {
-  const bucket = url.searchParams.get('bucket');
-  if (!bucket || !bucket.trim()) {
-    throw error(400, 'Missing required query parameter: bucket');
-  }
-
-  const key = url.searchParams.get('key');
-  if (!key || !key.trim()) {
-    throw error(400, 'Missing required query parameter: key');
-  }
-
+  const { bucket, key } = requireBucketKey(url);
   const userId = getUserId(locals);
 
   locals.logger.debug({ bucket, key }, 'download pre-flight check');
diff --git a/src/routes/(app)/storage/api/params.ts b/src/routes/(app)/storage/api/params.ts
new file mode 100644
index 00000000..f41993b5
--- /dev/null
+++ b/src/routes/(app)/storage/api/params.ts
@@ -0,0 +1,19 @@
+import { error } from '@sveltejs/kit';
+
+/**
+ * Extracts and validates the `bucket` and `key` query parameters from a
+ * storage API request URL. Throws a 400 error if either is absent or blank.
+ */
+export function requireBucketKey(url: URL): { bucket: string; key: string } {
+  const bucket = url.searchParams.get('bucket')?.trim();
+  if (!bucket) {
+    throw error(400, 'Missing required query parameter: bucket');
+  }
+
+  const key = url.searchParams.get('key')?.trim();
+  if (!key) {
+    throw error(400, 'Missing required query parameter: key');
+  }
+
+  return { bucket, key };
+}
diff --git a/src/routes/(app)/storage/api/preview/+server.ts b/src/routes/(app)/storage/api/preview/+server.ts
index 351e896e..fc5bc9bb 100644
--- a/src/routes/(app)/storage/api/preview/+server.ts
+++ b/src/routes/(app)/storage/api/preview/+server.ts
@@ -1,23 +1,18 @@
-import { error, json } from '@sveltejs/kit';
-import { S3ServiceException } from '@aws-sdk/client-s3';
+import { json } from '@sveltejs/kit';
 import { getUserId } from '$lib/server/auth-utils.js';
 import { getConnection } from '$lib/server/storage/service.js';
 import { StorageProviderFactory } from '$lib/server/storage/factory.js';
+import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 // import { parquetPreview } from '$lib/server/storage/preview/parquet.js';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
+import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from '@sveltejs/kit';
 
 export const GET: RequestHandler = async ({ url, locals }) => {
   const log = locals.logger;
   const userId = getUserId(locals);
-
-  const bucket = url.searchParams.get('bucket');
-  const key = url.searchParams.get('key');
-
-  if (!bucket || !key) {
-    return json({ error: 'Missing bucket or key parameter' }, { status: 400 });
-  }
+  const { bucket, key } = requireBucketKey(url);
 
   const connection = getConnection(userId);
   if (!connection) {
@@ -68,21 +63,6 @@ export const GET: RequestHandler = async ({ url, locals }) => {
 
     return await streamPreview(provider, key, contentType, totalSize, userId, log);
   } catch (err) {
-    if (err instanceof S3ServiceException) {
-      const code = err.name;
-      const status = err.$metadata?.httpStatusCode;
-      log.warn(
-        { user_id: userId, bucket, key, error_code: code, http_status: status },
-        'S3 error fetching preview'
-      );
-      if (code === 'AccessDenied' || status === 403) {
-        throw error(403, 'Access denied');
-      }
-      if (code === 'NoSuchKey' || status === 404) {
-        throw error(404, 'Object not found');
-      }
-      throw error(502, `Storage error: ${err.message}`);
-    }
-    throw err;
+    mapS3ErrorToHttp(err, { bucket, key, operation: 'preview' });
   }
 };
diff --git a/src/routes/(app)/storage/api/upload/+server.ts b/src/routes/(app)/storage/api/upload/+server.ts
new file mode 100644
index 00000000..696e97c2
--- /dev/null
+++ b/src/routes/(app)/storage/api/upload/+server.ts
@@ -0,0 +1,50 @@
+import { error } from '@sveltejs/kit';
+import { uploadObject } from '$lib/server/storage/service.js';
+import { getUserId } from '$lib/server/auth-utils.js';
+import { requireBucketKey } from '../params.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * POST /storage/api/upload?bucket=<bucket>&key=<object-key>
+ *
+ * Streams an uploaded file directly to S3 using multipart upload (via
+ * @aws-sdk/lib-storage). The request body is piped to the S3 SDK without
+ * buffering in server memory, regardless of file size.
+ *
+ * Assumptions (v0):
+ * - Credentials come from the in-memory per-user S3 connection config
+ *   (same as download/preview). No production credential vaulting.
+ * - No server-side file size limit is enforced; S3's 5 TB object limit applies.
+ * - A single Content-Type header value is trusted from the client and forwarded
+ *   to S3 as-is.
+ */
+export const POST: RequestHandler = async ({ locals, url, request }) => {
+  const log = locals.logger;
+  const userId = getUserId(locals);
+  const { bucket, key } = requireBucketKey(url);
+
+  if (!request.body) {
+    throw error(400, 'Missing request body');
+  }
+
+  const contentType = (request.headers.get('Content-Type') ?? 'application/octet-stream')
+    .split(';')[0]
+    .trim();
+
+  const rawLength = request.headers.get('Content-Length');
+  const contentLength = rawLength ? parseInt(rawLength, 10) : undefined;
+
+  log.debug(
+    { bucket, key, content_type: contentType, content_length: contentLength },
+    'upload request received'
+  );
+
+  await uploadObject(userId, bucket, key, request.body, contentType, contentLength);
+
+  log.info(
+    { bucket, key, content_type: contentType, content_length: contentLength },
+    'upload completed'
+  );
+
+  return new Response(null, { status: 201 });
+};

From b02c803af72794a5a7e17ba9c7f9be285c2de8a5 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 20 May 2026 09:57:03 +0200
Subject: [PATCH 038/136] chore: remove package duplicates with npm dedupe

---
 package-lock.json | 36 +++++-------------------------------
 1 file changed, 5 insertions(+), 31 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index ccffa919..10058c77 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -566,16 +566,6 @@
         "@aws-sdk/client-s3": "^3.1045.0"
       }
     },
-    "node_modules/@aws-sdk/lib-storage/node_modules/buffer": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
-      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
-      "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.0.2",
-        "ieee754": "^1.1.4"
-      }
-    },
     "node_modules/@aws-sdk/middleware-bucket-endpoint": {
       "version": "3.972.10",
       "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.10.tgz",
@@ -5428,29 +5418,13 @@
       }
     },
     "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
+      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
+        "base64-js": "^1.0.2",
+        "ieee754": "^1.1.4"
       }
     },
     "node_modules/bytes": {

From 98500e56805a503991111261c2aa4a7cc230ddae Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 21 May 2026 11:31:28 +0200
Subject: [PATCH 039/136] #130 improve various ux issues from this ticket
 (#150)

* #130 improve various ux issues from this ticket

* #130 improve various ux issues from this ticket part 2

* #130 add badge and icon to file count display

* chore: remove package duplicates with npm dedupe

* feat: Add support for path-style and VirtualHosted addressing in S3 connection configuration (#149)

* #92 S3 File Browser: Upload (#141)

* feat: implement file upload feature with S3 integration

* fix: show new filename on rename

* refactor: remove mock S3 server and related E2E tests for file upload feature

* refactor: reduce duplicate code

* style: formatting and linting

* #92 add multiple files and directory upload, improve file rename checks on upload

* #144 remove trailing slash on directory name

* * #94 add delete action

* #94 refactor, implement delete action in hdfs provider

* #94 cleaned up types, use paraglide pluralisation

* * #118 add pinned access

* #118 add recently accessed file and locations

* #118 show loading spinner for quick navigation, use daisyui tooltips, limit recent access item count

* #118 show timestamp on hover, add preview action, add clickable label for recent locations

* #118 refactor timestamp tooltip into own component, add timestamp tooltip to file explorer files

* #131 fix download path for truncated previews, #118 add button to open context actions on pinned access

* #118 refactor suggested code from #126, show pin location menu above breadcrumb menu

* #118 fix timestamp string format, make timestamp display relative

* #118 add month and year suffixes to last modified timestamp display

* #118 fix visuals for pinned access entry width

* fix duplicate json

* fix: remove duplicate invalidateAll import in FileExplorer

* fix: remove s3-mock from playwright config

* remove test with wrong references

* fix: update eslint ignore patterns to include .github/skills directory

* fix: add exclude pattern for .github/skills directory in pre-commit config

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>

* chore: remove package duplicates with npm dedupe

* #130 improve various ux issues from this ticket part 3

* #130 remove rename and move actions

* #130 add locale to file size display

* #130 centralize file size locale formatting

* #130 allow custom file size format options

* chore: remove unused import

* style: enhance item count badges with improved icon size and font weight

* Feat/s3 file browser button on breadcrumbs (#158)

* feat: add pin button to breadcrumbs for easy location management

* refactor: update pinButton snippet parameters for readability

* #130 add space-taking transition to pin hover and reduced motion attribute

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
---
 messages/de.json                              |  21 ++
 messages/en.json                              |  21 ++
 src/lib/components/Pagination.svelte          |   2 +-
 src/lib/components/storage/BucketList.svelte  |  64 +++---
 src/lib/components/storage/ContextMenu.svelte |  35 +--
 .../storage/DeleteConfirmModal.svelte         |   2 +-
 .../components/storage/FileExplorer.svelte    |  14 +-
 src/lib/components/storage/FileRow.svelte     |   7 +-
 src/lib/components/storage/FolderRow.svelte   |   6 +-
 src/lib/components/storage/ObjectTable.svelte |  15 +-
 .../components/storage/PreviewModal.svelte    |  59 +++--
 src/lib/components/storage/RecentItems.svelte |  24 +-
 .../storage/SelectionToolbar.svelte           |  27 +--
 .../storage/StorageBreadcrumb.svelte          | 209 ++++++++++++------
 src/lib/components/storage/UploadModal.svelte |   9 +-
 .../storage/preview/CsvPreview.svelte         |   2 +-
 .../storage/preview/FallbackPreview.svelte    |   2 +-
 .../storage/preview/ImagePreview.svelte       |  16 +-
 .../storage/preview/TextPreview.svelte        |   2 +-
 src/lib/storage/utils.ts                      |  13 ++
 src/routes/(app)/storage/+page.svelte         |   2 +-
 21 files changed, 350 insertions(+), 202 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 7b117e8a..7cb9177a 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -145,6 +145,7 @@
   "storage_connect_forget_label": "Verbindung zu {endpoint} vergessen",
   "storage_disconnect": "Verbindung Trennen",
   "storage_buckets_label": "Buckets",
+  "storage_buckets_subtitle": "Durchsuchen und verwalten Sie Ihre gespeicherten Objekte.",
   "storage_view_all_buckets": "Alle Buckets anzeigen",
   "storage_buckets_empty": "Keine Buckets gefunden",
   "storage_bucket_empty": "Dieser Bucket ist leer",
@@ -152,6 +153,26 @@
   "storage_folders": "Ordner",
   "storage_file": "Datei",
   "storage_files": "Dateien",
+  "storage_folder_count": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Ordner",
+        "countPlural=other": "{count} Ordner"
+      }
+    }
+  ],
+  "storage_file_count": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Datei",
+        "countPlural=other": "{count} Dateien"
+      }
+    }
+  ],
   "storage_select_toggle": "Auswahlmodus umschalten",
   "storage_paste": "{count} Element einfügen",
   "storage_paste_plural": "{count} Elemente einfügen",
diff --git a/messages/en.json b/messages/en.json
index 402494cb..3413884b 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -145,6 +145,7 @@
   "storage_connect_forget_label": "Forget connection to {endpoint}",
   "storage_disconnect": "Disconnect",
   "storage_buckets_label": "Buckets",
+  "storage_buckets_subtitle": "Browse and manage your stored objects.",
   "storage_view_all_buckets": "View all buckets",
   "storage_buckets_empty": "No buckets found",
   "storage_bucket_empty": "This bucket is empty",
@@ -152,6 +153,26 @@
   "storage_folders": "folders",
   "storage_file": "file",
   "storage_files": "files",
+  "storage_folder_count": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 folder",
+        "countPlural=other": "{count} folders"
+      }
+    }
+  ],
+  "storage_file_count": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 file",
+        "countPlural=other": "{count} files"
+      }
+    }
+  ],
   "storage_select_toggle": "Toggle selection mode",
   "storage_paste": "Paste {count} item",
   "storage_paste_plural": "Paste {count} items",
diff --git a/src/lib/components/Pagination.svelte b/src/lib/components/Pagination.svelte
index 615ed87a..df3e8847 100644
--- a/src/lib/components/Pagination.svelte
+++ b/src/lib/components/Pagination.svelte
@@ -201,7 +201,7 @@
         />
       </button>
       <button
-        class="btn btn-primary btn-sm"
+        class="btn btn-ghost btn-sm"
         onclick={onnext}
         disabled={!canGoNext}
         aria-label={m.pagination_next_page()}
diff --git a/src/lib/components/storage/BucketList.svelte b/src/lib/components/storage/BucketList.svelte
index 50a5b92c..a6ff550d 100644
--- a/src/lib/components/storage/BucketList.svelte
+++ b/src/lib/components/storage/BucketList.svelte
@@ -66,14 +66,14 @@
   ></div>
   <ul
     class="
-      menu menu-sm border-base-300 bg-base-100 fixed z-50 w-40 rounded-lg
+      menu menu-sm border-base-300 bg-base-100 fixed z-[60] w-40 rounded-lg
       border p-1 shadow-lg
     "
     role="menu"
     style="left: {unpinCtx.x}px; top: {unpinCtx.y}px;"
   >
     <li role="none">
-      <button role="menuitem" class="text-error justify-start" onclick={handleUnpin}>
+      <button role="menuitem" class="justify-start" onclick={handleUnpin}>
         <Icon icon="material-symbols:push-pin-outline" class="size-4 shrink-0" aria-hidden="true" />
         {m.storage_action_unpin()}
       </button>
@@ -100,42 +100,44 @@
         {#each pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
           {@const active = isPinnedActive(pin)}
           <li role="none" class="group relative">
-            <a
-              href={pinnedHref(pin)}
-              data-sveltekit-preload-data="off"
-              class="
+            <div class="tooltip tooltip-right relative z-50 w-full" data-tip={pinnedLabel(pin)}>
+              <a
+                href={pinnedHref(pin)}
+                data-sveltekit-preload-data="off"
+                class="
                 hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
                 pr-7 text-sm
                 {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}"
-              aria-current={active ? 'page' : undefined}
-              oncontextmenu={(e) => openUnpinMenu(e, pin)}
-            >
-              {#if pin.prefix === ''}
-                <Icon
-                  icon="mdi:bucket-outline"
-                  class="size-3.5 shrink-0 opacity-60"
-                  aria-hidden="true"
-                />
-              {:else}
-                <Icon
-                  icon="material-symbols:folder-outline"
-                  class="size-3.5 shrink-0 opacity-60"
-                  aria-hidden="true"
-                />
-              {/if}
-              <span class="truncate">{pinnedLabel(pin)}</span>
-            </a>
+                aria-current={active ? 'page' : undefined}
+                oncontextmenu={(e) => openUnpinMenu(e, pin)}
+              >
+                {#if pin.prefix === ''}
+                  <Icon
+                    icon="mdi:bucket-outline"
+                    class="size-3.5 shrink-0 opacity-60"
+                    aria-hidden="true"
+                  />
+                {:else}
+                  <Icon
+                    icon="material-symbols:folder-outline"
+                    class="size-3.5 shrink-0 opacity-60"
+                    aria-hidden="true"
+                  />
+                {/if}
+                <span class="truncate">{pinnedLabel(pin)}</span>
+              </a>
+            </div>
             <button
               class="
-                btn btn-ghost btn-xs absolute top-1/2 right-1 -translate-y-1/2 p-0
-                opacity-0 transition-opacity
+                btn btn-ghost btn-xs absolute top-1/2 right-1 z-[51] -translate-y-1/2
+                p-0 opacity-0 transition-opacity
                 group-hover:opacity-100 focus:opacity-100
               "
               onclick={(e) => openUnpinMenuFromButton(e, pin)}
               aria-label={m.storage_more_options()}
               title={m.storage_more_options()}
             >
-              <Icon icon="material-symbols:more-vert" class="size-3.5" aria-hidden="true" />
+              <Icon icon="material-symbols:more-horiz" class="size-3.5" aria-hidden="true" />
             </button>
           </li>
         {/each}
@@ -158,11 +160,15 @@
     <a
       href="/storage"
       data-sveltekit-preload-data="off"
-      class="btn btn-ghost btn-xs tooltip tooltip-left"
+      class="btn btn-ghost btn-xs group tooltip tooltip-right"
       title={m.storage_view_all_buckets()}
       data-tip={m.storage_view_all_buckets()}
     >
-      <Icon icon="material-symbols:grid-view" class="size-3.5" aria-hidden="true" />
+      <Icon
+        icon="material-symbols:grid-view"
+        class="group-hover:text-primary size-3.5 transition-colors"
+        aria-hidden="true"
+      />
     </a>
   </div>
 
diff --git a/src/lib/components/storage/ContextMenu.svelte b/src/lib/components/storage/ContextMenu.svelte
index d7ad9c10..08e1bed4 100644
--- a/src/lib/components/storage/ContextMenu.svelte
+++ b/src/lib/components/storage/ContextMenu.svelte
@@ -10,12 +10,22 @@
     canPreview: boolean;
     canDownload: boolean;
     canPin: boolean;
+    isAlreadyPinned?: boolean;
     onAction: (action: string) => void;
     onClose: () => void;
   }
 
-  let { x, y, selectionCount, canPreview, canDownload, canPin, onAction, onClose }: Props =
-    $props();
+  let {
+    x,
+    y,
+    selectionCount,
+    canPreview,
+    canDownload,
+    canPin,
+    isAlreadyPinned = false,
+    onAction,
+    onClose
+  }: Props = $props();
 
   let menuEl = $state<HTMLUListElement | null>(null);
 
@@ -55,30 +65,25 @@
       label: () => m.storage_action_preview(),
       disabled: () => !canPreview
     },
-    {
-      key: 'rename',
-      icon: 'material-symbols:edit',
-      label: () => m.storage_action_rename(),
-      disabled: () => selectionCount !== 1
-    },
     {
       key: 'download',
       icon: 'material-symbols:download',
       label: () => m.storage_action_download(),
       disabled: () => !canDownload
     },
-    {
-      key: 'move',
-      icon: 'material-symbols:drive-file-move',
-      label: () => m.storage_action_move(),
-      disabled: () => selectionCount === 0
-    },
     {
       key: 'pin',
       icon: 'material-symbols:push-pin-outline',
       label: () => m.storage_action_pin(),
       disabled: () => !canPin,
-      hidden: () => !canPin
+      hidden: () => !canPin || isAlreadyPinned
+    },
+    {
+      key: 'unpin',
+      icon: 'material-symbols:push-pin',
+      label: () => m.storage_action_unpin(),
+      disabled: () => !isAlreadyPinned,
+      hidden: () => !isAlreadyPinned
     }
   ];
 
diff --git a/src/lib/components/storage/DeleteConfirmModal.svelte b/src/lib/components/storage/DeleteConfirmModal.svelte
index e1dc1c10..b2e58bdd 100644
--- a/src/lib/components/storage/DeleteConfirmModal.svelte
+++ b/src/lib/components/storage/DeleteConfirmModal.svelte
@@ -50,7 +50,7 @@
       <button class="btn btn-ghost" onclick={onCancel}>
         {m.storage_delete_cancel()}
       </button>
-      <button class="btn btn-error" onclick={onConfirm}>
+      <button class="btn btn-outline btn-error" onclick={onConfirm}>
         <Icon icon="material-symbols:delete-forever" class="size-4" aria-hidden="true" />
         {m.storage_delete_confirm_button()}
       </button>
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
index 5dd2c1be..dc7d6870 100644
--- a/src/lib/components/storage/FileExplorer.svelte
+++ b/src/lib/components/storage/FileExplorer.svelte
@@ -18,7 +18,7 @@
   import { untrack } from 'svelte';
   import { navigating } from '$app/state';
   import { initPageSize, type PageSize } from '$lib/types/pagination.js';
-  import { pinLocation } from '$lib/stores/pinned-locations.svelte.js';
+  import { pinLocation, unpinLocation, isPinned } from '$lib/stores/pinned-locations.svelte.js';
   import { recordLocationVisit, recordFileVisit } from '$lib/stores/recent-items.svelte.js';
 
   interface Props {
@@ -152,6 +152,7 @@
   const ctxFileObj = $derived(ctxKey ? (files.find((f) => f.key === ctxKey) ?? null) : null);
   const ctxIsFile = $derived(ctxFileObj !== null);
   const canPin = $derived(ctxKey !== null && !ctxIsFile);
+  const ctxIsPinned = $derived(ctxKey !== null && !ctxIsFile && isPinned(bucket, ctxKey));
 
   function openContextMenu(e: MouseEvent, key: string) {
     e.preventDefault();
@@ -201,6 +202,8 @@
     try {
       if (action === 'pin') {
         pinLocation(bucket, ctxKey ?? prefix);
+      } else if (action === 'unpin') {
+        unpinLocation(bucket, ctxKey ?? prefix);
       } else if (action === 'download' || action === 'upload' || action === 'preview') {
         // Record file visit for the acted-on file(s)
         for (const f of effectiveSelectedFiles) {
@@ -270,8 +273,7 @@
     if (e.key === 'Delete' && selectedKeys.size > 0) {
       pendingDeleteKeys = [...selectedKeys];
       showDeleteModal = true;
-    } else if (e.key === 'F2' && selectedKeys.size === 1) handleAction('rename');
-    else if (e.key === 'Escape') {
+    } else if (e.key === 'Escape') {
       if (ctxMenu) {
         selectedKeys.delete(ctxKey!);
         ctxMenu = null;
@@ -304,11 +306,11 @@
     onUpload={() => (showUploadModal = true)}
   />
 
-  <div class="relative flex-1 overflow-y-auto">
+  <div class="relative min-h-0 flex-1 overflow-hidden">
     {#if loading || deleting}
       <div
         class="
-          bg-base-100/70 absolute inset-0 z-10 flex items-center justify-center
+          bg-base-100/70 absolute inset-0 z-20 flex items-center justify-center
         "
         aria-live="polite"
         aria-label={m.storage_loading()}
@@ -323,6 +325,7 @@
       {selectedKeys}
       {ctxKey}
       {showCheckboxes}
+      {selectionMode}
       {allSelected}
       {someSelected}
       onNavigate={handleNavigate}
@@ -363,6 +366,7 @@
       (ctxKey !== null && files.some((f) => f.key === ctxKey))}
     canDownload={selectedFiles.length > 0 || ctxIsFile}
     {canPin}
+    isAlreadyPinned={ctxIsPinned}
     onAction={handleAction}
     onClose={() => {
       ctxMenu = null;
diff --git a/src/lib/components/storage/FileRow.svelte b/src/lib/components/storage/FileRow.svelte
index 5664dc91..5c39e0eb 100644
--- a/src/lib/components/storage/FileRow.svelte
+++ b/src/lib/components/storage/FileRow.svelte
@@ -1,8 +1,7 @@
 <script lang="ts">
   import Icon from '@iconify/svelte';
-  import { fileIconKind, iconColors, keyToName } from '$lib/storage/utils.js';
+  import { fileIconKind, iconColors, keyToName, formatFileSize } from '$lib/storage/utils.js';
   import type { StorageObject } from '$lib/storage/types.js';
-  import prettyBytes from 'pretty-bytes';
   import TimestampDisplay from '$lib/components/storage/TimestampDisplay.svelte';
 
   interface Props {
@@ -29,7 +28,7 @@
     ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
     : selected
       ? 'bg-primary/10 hover:bg-primary/15'
-      : 'hover'}"
+      : 'hover:bg-base-200/60'}"
   onclick={(e) => onToggleSelect(file.key, e.ctrlKey || e.metaKey)}
   ondblclick={() => onAction('preview')}
   oncontextmenu={(e) => onContextMenu(e, file.key)}
@@ -74,7 +73,7 @@
       {/if}
     </div>
   </td>
-  <td class="text-right font-mono text-sm">{prettyBytes(file.size)}</td>
+  <td class="text-right font-mono text-sm">{formatFileSize(file.size)}</td>
   <td class="text-base-content/60 text-sm"
     ><TimestampDisplay date={file.lastModified} relative /></td
   >
diff --git a/src/lib/components/storage/FolderRow.svelte b/src/lib/components/storage/FolderRow.svelte
index f67c9214..d6ee9639 100644
--- a/src/lib/components/storage/FolderRow.svelte
+++ b/src/lib/components/storage/FolderRow.svelte
@@ -8,6 +8,7 @@
     selected: boolean;
     isCtx: boolean;
     showCheckboxes: boolean;
+    selectionMode: boolean;
     onNavigate: (prefix: string) => void;
     onToggleSelect: (key: string, force?: boolean) => void;
     onContextMenu: (e: MouseEvent, key: string) => void;
@@ -18,6 +19,7 @@
     selected,
     isCtx,
     showCheckboxes,
+    selectionMode,
     onNavigate,
     onToggleSelect,
     onContextMenu
@@ -31,9 +33,9 @@
     ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
     : selected
       ? 'bg-primary/10 hover:bg-primary/15'
-      : 'hover'}"
+      : 'hover:bg-base-200/60'}"
   onclick={(e) => {
-    if (showCheckboxes || e.ctrlKey || e.metaKey) {
+    if (selectionMode || e.ctrlKey || e.metaKey) {
       onToggleSelect(folder.key, true);
     } else {
       onNavigate(folder.key);
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
index ae71ab3b..9d383250 100644
--- a/src/lib/components/storage/ObjectTable.svelte
+++ b/src/lib/components/storage/ObjectTable.svelte
@@ -13,6 +13,7 @@
     selectedKeys: Set<string>;
     ctxKey: string | null;
     showCheckboxes: boolean;
+    selectionMode: boolean;
     allSelected: boolean;
     someSelected: boolean;
     onNavigate: (prefix: string, continuationToken?: string | null, pageSize?: number) => void;
@@ -29,6 +30,7 @@
     selectedKeys,
     ctxKey,
     showCheckboxes,
+    selectionMode,
     allSelected,
     someSelected,
     onNavigate,
@@ -44,10 +46,6 @@
       folders.filter((f) => selectedKeys.has(f.key)).length === 0
   );
   const selectedFileCount = $derived(files.filter((f) => selectedKeys.has(f.key)).length);
-  const canRename = $derived(
-    (selectedFileCount === 1 && folders.filter((f) => selectedKeys.has(f.key)).length === 0) ||
-      (folders.filter((f) => selectedKeys.has(f.key)).length === 1 && selectedFileCount === 0)
-  );
   const canDownload = $derived(
     selectedFileCount === 1 && folders.filter((f) => selectedKeys.has(f.key)).length === 0
   );
@@ -65,13 +63,13 @@
   }
 </script>
 
-<div class="overflow-x-auto">
+<div class="preview-scroll h-full overflow-x-auto overflow-y-auto">
   <table class="table-sm table">
-    <thead>
+    <thead class="bg-base-100 sticky top-0 z-10">
       <!-- Column headers -->
       <tr
         class="
-          bg-base-200/60 text-base-content/50 text-xs tracking-wide uppercase
+          bg-base-200 text-base-content/50 text-xs tracking-wide uppercase
         "
       >
         <th class="w-8 pr-0">
@@ -95,7 +93,7 @@
       </tr>
 
       <!-- Selection action toolbar -->
-      <SelectionToolbar {selectedCount} {canPreview} {canRename} {canDownload} {onAction} />
+      <SelectionToolbar {selectedCount} {canPreview} {canDownload} {onAction} />
     </thead>
 
     <tbody>
@@ -120,6 +118,7 @@
           selected={selectedKeys.has(folder.key)}
           isCtx={ctxKey === folder.key}
           {showCheckboxes}
+          {selectionMode}
           {onNavigate}
           {onToggleSelect}
           {onContextMenu}
diff --git a/src/lib/components/storage/PreviewModal.svelte b/src/lib/components/storage/PreviewModal.svelte
index bb801ad3..96b3baff 100644
--- a/src/lib/components/storage/PreviewModal.svelte
+++ b/src/lib/components/storage/PreviewModal.svelte
@@ -1,7 +1,6 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
   import Icon from '@iconify/svelte';
-  import prettyBytes from 'pretty-bytes';
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
   import TextPreview from './preview/TextPreview.svelte';
@@ -9,7 +8,7 @@
   import ImagePreview from './preview/ImagePreview.svelte';
   import PdfPreview from './preview/PdfPreview.svelte';
   import FallbackPreview from './preview/FallbackPreview.svelte';
-  import { keyToName } from '$lib/storage/utils.js';
+  import { keyToName, formatFileSize } from '$lib/storage/utils.js';
 
   interface Props {
     open: boolean;
@@ -49,6 +48,8 @@
   // Keeping it non-reactive prevents a read/write cycle inside the $effect below.
   let blobUrls: string[] = [];
   let maximized = $state(false);
+  let imageNaturalWidth = $state(0);
+  let imageNaturalHeight = $state(0);
 
   // Revoke blob URLs when the component is destroyed
   onDestroy(() => {
@@ -72,6 +73,8 @@
     if (!open) {
       revokeBlobUrls();
       preview = { kind: 'idle' };
+      imageNaturalWidth = 0;
+      imageNaturalHeight = 0;
     }
   });
 
@@ -229,26 +232,43 @@
           {filename}
         </h2>
         {#if preview.kind === 'text' || preview.kind === 'csv'}
-          <p class="text-base-content/50 mt-0.5 text-xs">
-            {prettyBytes(preview.totalSize)}
+          <div class="mt-1 flex flex-wrap items-center gap-1">
+            <span class="badge badge-neutral badge-sm font-mono"
+              >{formatFileSize(preview.totalSize)}</span
+            >
             {#if preview.truncated}
-              &mdash;
-              {m.storage_preview_truncated({ size: prettyBytes(preview.previewBytes) })}
+              <span class="badge badge-soft badge-warning badge-sm">
+                {m.storage_preview_truncated({
+                  size: formatFileSize(preview.previewBytes)
+                })}
+              </span>
             {/if}
-          </p>
+          </div>
         {:else if preview.kind === 'parquet'}
-          <p class="text-base-content/50 mt-0.5 text-xs">
-            {prettyBytes(preview.totalSize)}
+          <div class="mt-1 flex flex-wrap items-center gap-1">
+            <span class="badge badge-neutral badge-sm font-mono"
+              >{formatFileSize(preview.totalSize)}</span
+            >
             {#if preview.truncated}
-              &mdash;
-              {m.storage_preview_parquet_rows({
-                count: preview.previewRows,
-                total: preview.totalRows
-              })}
+              <span class="badge badge-soft badge-warning badge-sm">
+                {m.storage_preview_parquet_rows({
+                  count: preview.previewRows,
+                  total: preview.totalRows
+                })}
+              </span>
             {/if}
-          </p>
+          </div>
         {:else if preview.kind === 'image' || preview.kind === 'pdf'}
-          <p class="text-base-content/50 mt-0.5 text-xs">{prettyBytes(preview.totalSize)}</p>
+          <div class="mt-1 flex flex-wrap items-center gap-1">
+            <span class="badge badge-neutral badge-sm font-mono"
+              >{formatFileSize(preview.totalSize)}</span
+            >
+            {#if preview.kind === 'image' && imageNaturalWidth > 0}
+              <span class="badge badge-neutral badge-sm font-mono"
+                >{imageNaturalWidth} &times; {imageNaturalHeight} px</span
+              >
+            {/if}
+          </div>
         {/if}
       </div>
       <button
@@ -299,7 +319,12 @@
       {:else if preview.kind === 'parquet'}
         <CsvPreview text={preview.text} />
       {:else if preview.kind === 'image'}
-        <ImagePreview src={preview.blobUrl} name={filename} />
+        <ImagePreview
+          src={preview.blobUrl}
+          name={filename}
+          bind:naturalWidth={imageNaturalWidth}
+          bind:naturalHeight={imageNaturalHeight}
+        />
       {:else if preview.kind === 'pdf'}
         <PdfPreview src={preview.blobUrl} name={filename} />
       {:else if preview.kind === 'fallback'}
diff --git a/src/lib/components/storage/RecentItems.svelte b/src/lib/components/storage/RecentItems.svelte
index acda1080..3800cf0c 100644
--- a/src/lib/components/storage/RecentItems.svelte
+++ b/src/lib/components/storage/RecentItems.svelte
@@ -1,8 +1,8 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
   import Icon from '@iconify/svelte';
-  import prettyBytes from 'pretty-bytes';
   import * as m from '$lib/paraglide/messages.js';
+  import { formatFileSize } from '$lib/storage/utils.js';
   import {
     recentFiles,
     recentLocations,
@@ -65,12 +65,16 @@
             </div>
           </td>
           <td>
-            <span class="text-base-content/60 truncate text-xs">
+            <a
+              href={fileHref(file)}
+              data-sveltekit-preload-data="off"
+              class="text-base-content/60 hover:text-primary truncate text-xs"
+            >
               {fileLocation(file)}
-            </span>
+            </a>
           </td>
           <td class="text-base-content/60 text-xs whitespace-nowrap">
-            {prettyBytes(file.size)}
+            {formatFileSize(file.size)}
           </td>
           <td class="text-base-content/50 text-xs whitespace-nowrap">
             <TimestampDisplay date={file.visitedAt} relative tooltip="tooltip-left" />
@@ -148,9 +152,13 @@
             </div>
           </td>
           <td>
-            <span class="text-base-content/60 truncate text-xs">
+            <a
+              href={locationHref(loc)}
+              data-sveltekit-preload-data="off"
+              class="text-base-content/60 hover:text-primary truncate text-xs"
+            >
               {locationPath(loc)}
-            </span>
+            </a>
           </td>
           <td class="text-base-content/50 text-xs whitespace-nowrap">
             <TimestampDisplay date={loc.visitedAt} relative tooltip="tooltip-left" />
@@ -173,7 +181,7 @@
   </table>
 {/snippet}
 
-<section class="mt-8 flex min-h-0 flex-1 flex-col">
+<section class="card bg-base-100 border-base-300 mt-8 flex min-h-0 flex-1 flex-col border">
   <!-- Tab header -->
   <div role="tablist" class="tabs tabs-border mb-0">
     <button
@@ -194,7 +202,7 @@
     </button>
   </div>
 
-  <div class="border-base-300 min-h-0 flex-1 overflow-y-auto rounded-tr-lg rounded-b-lg border">
+  <div class="min-h-0 flex-1 overflow-y-auto">
     {#if activeTab === 'files'}
       {@render tabPanel(recentFiles.length === 0, m.storage_recent_empty_files(), filesTable)}
     {:else}
diff --git a/src/lib/components/storage/SelectionToolbar.svelte b/src/lib/components/storage/SelectionToolbar.svelte
index 1cb2e339..c379e59f 100644
--- a/src/lib/components/storage/SelectionToolbar.svelte
+++ b/src/lib/components/storage/SelectionToolbar.svelte
@@ -6,12 +6,11 @@
     /** Total number of selected items. */
     selectedCount: number;
     canPreview: boolean;
-    canRename: boolean;
     canDownload: boolean;
     onAction: (action: string) => void;
   }
 
-  let { selectedCount, canPreview, canRename, canDownload, onAction }: Props = $props();
+  let { selectedCount, canPreview, canDownload, onAction }: Props = $props();
 </script>
 
 <tr class="border-primary/20 bg-primary/5 border-t">
@@ -31,16 +30,6 @@
         {m.storage_action_preview()}
       </button>
 
-      <button
-        class="btn btn-ghost btn-xs gap-1"
-        title="{m.storage_action_rename()} (F2)"
-        onclick={() => onAction('rename')}
-        disabled={!canRename}
-      >
-        <Icon icon="material-symbols:edit" class="size-3.5" aria-hidden="true" />
-        {m.storage_action_rename()}
-      </button>
-
       <button
         class="btn btn-ghost btn-xs gap-1"
         title={m.storage_action_download()}
@@ -51,20 +40,10 @@
         {m.storage_action_download()}
       </button>
 
-      <button
-        class="btn btn-ghost btn-xs gap-1"
-        title={m.storage_action_move()}
-        onclick={() => onAction('move')}
-        disabled={selectedCount === 0}
-      >
-        <Icon icon="material-symbols:drive-file-move" class="size-3.5" aria-hidden="true" />
-        {m.storage_action_move()}
-      </button>
-
       <button
         class="
-          btn text-error btn-ghost btn-xs hover:bg-error/10
-          gap-1
+          btn btn-ghost btn-xs gap-1
+          {selectedCount > 0 ? 'text-error hover:bg-error/10' : ''}
         "
         title="{m.storage_action_delete()} (Del)"
         onclick={() => onAction('delete')}
diff --git a/src/lib/components/storage/StorageBreadcrumb.svelte b/src/lib/components/storage/StorageBreadcrumb.svelte
index 183087e1..2f862712 100644
--- a/src/lib/components/storage/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/StorageBreadcrumb.svelte
@@ -74,7 +74,7 @@
   ></div>
   <ul
     class="
-      menu menu-sm border-base-300 bg-base-100 fixed z-[60] w-48 rounded-lg
+      menu menu-sm border-base-300 bg-base-100 fixed z-60 w-48 rounded-lg
       border p-1 shadow-lg
     "
     role="menu"
@@ -83,7 +83,9 @@
     <li role="none">
       <button
         role="menuitem"
-        class="justify-start"
+        class="justify-start {isPinned(breadcrumbCtx.bucket, breadcrumbCtx.prefix)
+          ? 'text-error'
+          : ''}"
         onclick={() => {
           if (isPinned(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix)) {
             unpinLocation(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
@@ -108,6 +110,54 @@
   </ul>
 {/if}
 
+{#snippet pinButton(bucket: string, prefix: string)}
+  {@const pinned = isPinned(bucket, prefix)}
+  <span
+    class="
+      pointer-events-none w-0 shrink-0 overflow-hidden
+      group-hover:pointer-events-auto group-hover:w-5
+      motion-safe:transition-[width] motion-safe:duration-150 motion-safe:group-hover:delay-700
+    "
+  >
+    <button
+      class="
+          tooltip tooltip-bottom btn btn-ghost btn-xs group/pin z-60 size-5 p-0
+          {pinned ? 'hover:text-error' : 'hover:text-white'}
+        "
+      data-tip={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
+      aria-label={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
+      onclick={() => {
+        if (pinned) {
+          unpinLocation(bucket, prefix);
+        } else {
+          pinLocation(bucket, prefix);
+        }
+      }}
+    >
+      <span class="relative inline-flex size-3.5">
+        <span
+          class="absolute inset-0 flex items-center justify-center transition-opacity duration-150 group-hover/pin:opacity-0"
+        >
+          <Icon
+            icon={pinned ? 'material-symbols:push-pin' : 'material-symbols:push-pin-outline'}
+            class="size-3.5"
+            aria-hidden="true"
+          />
+        </span>
+        <span
+          class="absolute inset-0 flex items-center justify-center opacity-0 transition-opacity duration-150 group-hover/pin:opacity-100"
+        >
+          <Icon
+            icon={pinned ? 'material-symbols:push-pin-outline' : 'material-symbols:push-pin'}
+            class="size-3.5"
+            aria-hidden="true"
+          />
+        </span>
+      </span>
+    </button>
+  </span>
+{/snippet}
+
 <div class="border-base-300 flex items-center gap-3 border-b px-6 py-3">
   <!-- Breadcrumbs -->
   <nav
@@ -117,33 +167,39 @@
   "
   >
     {#if breadcrumbParts.length === 0}
-      <!-- svelte-ignore a11y_no_static_element_interactions -->
-      <span
-        class="
-          text-base-content flex shrink-0 items-center gap-1.5 rounded-sm px-1.5
-          py-0.5 font-medium
-        "
-        title={bucket}
-        aria-current="page"
-        oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
-      >
-        <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
-        {bucket}
+      <span class="group flex shrink-0 items-center gap-1">
+        <!-- svelte-ignore a11y_no_static_element_interactions -->
+        <span
+          class="
+            text-base-content flex shrink-0 items-center gap-1.5 rounded-sm px-1.5
+            py-0.5 font-medium
+          "
+          title={bucket}
+          aria-current="page"
+          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
+        >
+          <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
+          {bucket}
+        </span>
+        {@render pinButton(bucket, '')}
       </span>
     {:else}
-      <button
-        class="
-          text-base-content/70 hover:bg-base-200 hover:text-base-content flex shrink-0 items-center gap-1.5
-          rounded-sm px-1.5
-          py-0.5 transition-colors hover:cursor-pointer
-        "
-        title={bucket}
-        onclick={() => onNavigate('')}
-        oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
-      >
-        <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
-        {bucket}
-      </button>
+      <span class="group flex shrink-0 items-center gap-1">
+        <button
+          class="
+            text-base-content/70 hover:bg-base-200 hover:text-base-content flex shrink-0 items-center gap-1.5
+            rounded-sm px-1.5
+            py-0.5 transition-colors hover:cursor-pointer
+          "
+          title={bucket}
+          onclick={() => onNavigate('')}
+          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
+        >
+          <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
+          {bucket}
+        </button>
+        {@render pinButton(bucket, '')}
+      </span>
     {/if}
     {#if collapsedParts.length > 0}
       <Icon
@@ -175,16 +231,16 @@
         >
           {#each collapsedParts as part (part.prefix)}
             <li>
-              <button
-                class="
-                  text-sm
-                  hover:cursor-pointer
-                "
-                onclick={() => onNavigate(part.prefix)}
-                oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
-              >
-                {part.label}
-              </button>
+              <div class="group flex items-center justify-between gap-2">
+                <button
+                  class="flex-1 text-left text-sm hover:cursor-pointer"
+                  onclick={() => onNavigate(part.prefix)}
+                  oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
+                >
+                  {part.label}
+                </button>
+                {@render pinButton(bucket, part.prefix)}
+              </div>
             </li>
           {/each}
         </ul>
@@ -197,42 +253,55 @@
         class="text-base-content/30 size-4 shrink-0"
         aria-hidden="true"
       />
-      {#if isCurrent}
-        <!-- svelte-ignore a11y_no_static_element_interactions -->
-        <span
-          class="
-            text-base-content min-w-0 truncate rounded-sm px-1.5 py-0.5
-            font-medium
-          "
-          title={part.label}
-          aria-current="page"
-          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
-        >
-          {part.label}
-        </span>
-      {:else}
-        <button
-          class="
-            hover:bg-base-200 hover:text-base-content min-w-0 truncate rounded-sm px-1.5
-            py-0.5 transition-colors hover:cursor-pointer
-          "
-          title={part.label}
-          onclick={() => onNavigate(part.prefix)}
-          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
-        >
-          {part.label}
-        </button>
-      {/if}
+      <span class="group flex min-w-0 items-center gap-1">
+        {#if isCurrent}
+          <!-- svelte-ignore a11y_no_static_element_interactions -->
+          <span
+            class="
+              text-base-content min-w-0 truncate rounded-sm px-1.5 py-0.5
+              font-medium
+            "
+            title={part.label}
+            aria-current="page"
+            oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
+          >
+            {part.label}
+          </span>
+        {:else}
+          <button
+            class="
+              hover:bg-base-200 hover:text-base-content min-w-0 truncate rounded-sm px-1.5
+              py-0.5 transition-colors hover:cursor-pointer
+            "
+            title={part.label}
+            onclick={() => onNavigate(part.prefix)}
+            oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
+          >
+            {part.label}
+          </button>
+        {/if}
+        {@render pinButton(bucket, part.prefix)}
+      </span>
     {/each}
   </nav>
 
-  <!-- Item count badge -->
-  <span class="text-base-content/40 shrink-0 text-xs">
-    {folderCount}
-    {folderCount === 1 ? m.storage_folder() : m.storage_folders()},
-    {fileCount}
-    {fileCount === 1 ? m.storage_file() : m.storage_files()}
-  </span>
+  <!-- Item count badges -->
+  <div class="flex shrink-0 items-center gap-1.5">
+    <span
+      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-60 gap-1"
+      data-tip={m.storage_folder_count({ count: folderCount })}
+    >
+      <Icon icon="material-symbols:folder-outline" class="size-4" aria-hidden="true" />
+      <span class="font-bold">{folderCount}</span>
+    </span>
+    <span
+      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-60 gap-1"
+      data-tip={m.storage_file_count({ count: fileCount })}
+    >
+      <Icon icon="material-symbols:description-outline" class="size-4" aria-hidden="true" />
+      <span class="font-bold">{fileCount}</span>
+    </span>
+  </div>
 
   <!-- Multi-select toggle -->
   <button
diff --git a/src/lib/components/storage/UploadModal.svelte b/src/lib/components/storage/UploadModal.svelte
index 8beb781c..817c41f9 100644
--- a/src/lib/components/storage/UploadModal.svelte
+++ b/src/lib/components/storage/UploadModal.svelte
@@ -1,9 +1,9 @@
 <script lang="ts">
   import Icon from '@iconify/svelte';
-  import prettyBytes from 'pretty-bytes';
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
   import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
+  import { formatFileSize } from '$lib/storage/utils.js';
 
   interface Props {
     open: boolean;
@@ -486,14 +486,17 @@
               aria-hidden="true"
             />
             <span class="min-w-0 flex-1 truncate text-sm">{entry.displayPath}</span>
-            <span class="text-base-content/50 shrink-0 text-xs">{prettyBytes(entry.file.size)}</span
+            <span class="text-base-content/50 shrink-0 text-xs"
+              >{formatFileSize(entry.file.size)}</span
             >
           </li>
         {/each}
       </ul>
       <p class="text-base-content/50 mb-4 text-xs">
         {entries.length === 1 ? `1 ${m.storage_file()}` : `${entries.length} ${m.storage_files()}`}
-        &nbsp;&middot;&nbsp;{m.storage_upload_total_size({ size: prettyBytes(totalSize) })}
+        &nbsp;&middot;&nbsp;{m.storage_upload_total_size({
+          size: formatFileSize(totalSize)
+        })}
       </p>
       <div class="flex justify-end gap-2">
         <button class="btn btn-ghost btn-sm" onclick={handleCancel}>
diff --git a/src/lib/components/storage/preview/CsvPreview.svelte b/src/lib/components/storage/preview/CsvPreview.svelte
index 4a596fd6..8c4f3c27 100644
--- a/src/lib/components/storage/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/preview/CsvPreview.svelte
@@ -65,7 +65,7 @@
       </thead>
       <tbody>
         {#each rows as row, i (i)}
-          <tr class="hover">
+          <tr class="hover:bg-base-200 transition-colors">
             <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
             {#each headers as _h, j (j)}
               <td class="text-base-content/80 max-w-xs truncate text-xs">{row[j] ?? ''}</td>
diff --git a/src/lib/components/storage/preview/FallbackPreview.svelte b/src/lib/components/storage/preview/FallbackPreview.svelte
index 7c8a5483..ebaeff12 100644
--- a/src/lib/components/storage/preview/FallbackPreview.svelte
+++ b/src/lib/components/storage/preview/FallbackPreview.svelte
@@ -13,7 +13,7 @@
   let { contentType, downloadUrl, name, isBinary = false }: Props = $props();
 </script>
 
-<div class="flex flex-col items-center gap-4 p-8 text-center">
+<div class="flex min-h-full flex-col items-center justify-center gap-4 p-8 text-center">
   <Icon
     icon="material-symbols:file-present"
     class="text-base-content/30 size-16"
diff --git a/src/lib/components/storage/preview/ImagePreview.svelte b/src/lib/components/storage/preview/ImagePreview.svelte
index a33214c9..25eec623 100644
--- a/src/lib/components/storage/preview/ImagePreview.svelte
+++ b/src/lib/components/storage/preview/ImagePreview.svelte
@@ -5,28 +5,22 @@
     /** Object URL for the image blob. */
     src: string;
     name: string;
+    naturalWidth?: number;
+    naturalHeight?: number;
   }
 
-  let { src, name }: Props = $props();
-
-  let naturalWidth = $state(0);
-  let naturalHeight = $state(0);
+  let { src, name, naturalWidth = $bindable(0), naturalHeight = $bindable(0) }: Props = $props();
 </script>
 
-<div class="flex flex-col items-center gap-3 p-4">
+<div class="flex h-full items-center justify-center p-4">
   <img
     {src}
     alt={m.storage_preview_image_alt({ name })}
-    class="max-h-[60vh] max-w-full rounded object-contain shadow"
+    class="max-h-full max-w-full rounded object-contain shadow"
     onload={(e) => {
       const img = e.currentTarget as HTMLImageElement;
       naturalWidth = img.naturalWidth;
       naturalHeight = img.naturalHeight;
     }}
   />
-  {#if naturalWidth > 0}
-    <p class="text-base-content/50 text-xs">
-      {naturalWidth} &times; {naturalHeight}
-    </p>
-  {/if}
 </div>
diff --git a/src/lib/components/storage/preview/TextPreview.svelte b/src/lib/components/storage/preview/TextPreview.svelte
index 6930ac8c..6c4bb607 100644
--- a/src/lib/components/storage/preview/TextPreview.svelte
+++ b/src/lib/components/storage/preview/TextPreview.svelte
@@ -35,6 +35,6 @@
 </script>
 
 <pre
-  class="text-base-content/90 bg-base-200/50 min-h-0 rounded p-4 font-mono text-xs leading-relaxed whitespace-pre"
+  class="text-base-content/90 bg-base-200/50 min-h-full p-4 font-mono text-xs leading-relaxed whitespace-pre"
   data-language={language}
   aria-label="File content preview">{formatted}</pre>
diff --git a/src/lib/storage/utils.ts b/src/lib/storage/utils.ts
index 9ca5bc6b..5eaf4539 100644
--- a/src/lib/storage/utils.ts
+++ b/src/lib/storage/utils.ts
@@ -1,3 +1,7 @@
+import prettyBytes from 'pretty-bytes';
+import type { Options } from 'pretty-bytes';
+import { getLocale } from '$lib/paraglide/runtime.js';
+
 export type FileIconKind = 'image' | 'pdf' | 'code' | 'archive' | 'text' | 'document';
 
 const CODE_TYPES = new Set([
@@ -43,3 +47,12 @@ export function keyToName(key: string): string {
   const stripped = key.endsWith('/') ? key.slice(0, -1) : key;
   return stripped.split('/').at(-1) ?? key;
 }
+
+/** Format a byte count using the active UI locale. */
+export function formatFileSize(
+  bytes: number,
+  locale: string = getLocale(),
+  options: Options = { fixedWidth: 9 }
+): string {
+  return prettyBytes(bytes, { locale, ...options });
+}
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 12e24a76..db656384 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -20,7 +20,7 @@
       </div>
     {/if}
     <h1 class="mb-1 text-xl font-semibold">{m.storage_buckets_label()}</h1>
-    <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+    <p class="text-base-content/60 mb-6 text-sm">{m.storage_buckets_subtitle()}</p>
     <BucketGrid buckets={data.buckets} />
     <RecentItems />
   </div>

From 7d50dbdaba83a6a3d4acc265d7490b74c1934579 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 27 May 2026 12:51:54 +0200
Subject: [PATCH 040/136] Filebrowser: Refactor Filebrowser by using global
 state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>
---
 .env.example                                  |    3 +
 .vscode/extensions.json                       |   30 +
 .vscode/settings.json                         |   94 +
 AGENTS.md                                     |   20 +-
 TECH_DEBT.md                                  |   72 +-
 .../helm/stackable-ui/templates/_helpers.tpl  |    8 +-
 .../stackable-ui/templates/deployment.yaml    |    6 +
 deploy/helm/stackable-ui/values.yaml          |   14 +-
 dev/setup.sh                                  |   17 +-
 messages/de.json                              |    2 +-
 messages/en.json                              |    2 +-
 package-lock.json                             | 1848 +++++------------
 package.json                                  |    4 +-
 src/app.d.ts                                  |    2 +
 src/hooks.server.ts                           |    2 +-
 src/lib/components/Pagination.svelte          |   53 +-
 src/lib/components/ToastHost.svelte           |   22 +-
 .../components/layout/header/Header.svelte    |   15 +-
 .../layout/header/LanguageSwitcher.svelte     |    7 +-
 .../layout/header/ThemeToggle.svelte          |    7 +-
 .../components/layout/header/UserMenu.svelte  |   26 +-
 .../components/layout/sidebar/Sidebar.svelte  |   76 +-
 .../components/layout/sidebar/nav-items.ts    |    9 +-
 src/lib/components/storage/ContextMenu.svelte |  166 --
 .../components/storage/FileExplorer.svelte    |  390 ----
 src/lib/components/storage/FileRow.svelte     |   90 -
 src/lib/components/storage/ObjectTable.svelte |  156 --
 src/lib/components/storage/actions/delete.ts  |   21 -
 .../components/storage/actions/download.ts    |   19 -
 src/lib/components/storage/actions/index.ts   |   20 -
 src/lib/components/storage/actions/preview.ts |    8 -
 src/lib/components/storage/actions/types.ts   |   26 -
 src/lib/components/storage/actions/upload.ts  |   13 -
 .../storage/explorer/ContextMenu.svelte       |  161 ++
 .../storage/explorer/FileExplorer.svelte      |   70 +
 .../storage/explorer/FileRow.svelte           |   85 +
 .../storage/{ => explorer}/FolderRow.svelte   |   53 +-
 .../storage/explorer/ObjectTable.svelte       |   94 +
 .../{ => explorer}/SelectionToolbar.svelte    |   33 +-
 .../{ => explorer}/StorageBreadcrumb.svelte   |  227 +-
 .../storage/{ => landing}/BucketGrid.svelte   |   10 +-
 .../storage/{ => landing}/RecentItems.svelte  |   80 +-
 .../{ => landing}/StorageConnectForm.svelte   |   11 +-
 .../{ => modals}/DeleteConfirmModal.svelte    |   13 +-
 .../storage/{ => modals}/PreviewModal.svelte  |   54 +-
 .../storage/modals/StorageModals.svelte       |   68 +
 .../{ => modals}/preview/CsvPreview.svelte    |    0
 .../preview/FallbackPreview.svelte            |   13 +-
 .../{ => modals}/preview/ImagePreview.svelte  |    0
 .../{ => modals}/preview/PdfPreview.svelte    |    0
 .../{ => modals}/preview/TextPreview.svelte   |    0
 .../modals/upload/UploadConflictEntry.svelte  |  118 ++
 .../modals/upload/UploadDropzone.svelte       |  106 +
 .../modals/upload/UploadEntryStatus.svelte    |   64 +
 .../{ => modals/upload}/UploadModal.svelte    |  400 +---
 .../components/storage/modals/upload/types.ts |   34 +
 .../{ => shared}/TimestampDisplay.svelte      |    0
 .../storage/{ => sidebar}/BucketList.svelte   |  129 +-
 .../editor/completion/completion-provider.ts  |   35 +-
 src/lib/editor/completion/completion.test.ts  |   10 +
 src/lib/editor/completion/cursor-context.ts   |   15 +-
 src/lib/editor/completion/grammar-analysis.ts |   36 +-
 src/lib/editor/lexer-utils.ts                 |   26 +
 src/lib/server/feature-flags.ts               |    9 +-
 src/lib/server/storage/s3-provider.ts         |   25 +-
 src/lib/server/storage/service.ts             |    3 -
 src/lib/storage/bookmarks.svelte.ts           |   96 +
 src/lib/storage/context.ts                    |    4 +
 src/lib/storage/delete.ts                     |   53 -
 src/lib/storage/display-helpers.ts            |   68 +
 .../storage/actions => storage}/errors.ts     |   16 +-
 src/lib/storage/file-collection.ts            |   57 +
 src/lib/storage/persistence.ts                |   27 +
 src/lib/storage/state.svelte.ts               |  377 ++++
 src/lib/storage/types.ts                      |   60 +
 src/lib/stores/pinned-locations.svelte.ts     |   82 -
 src/lib/stores/recent-items.svelte.ts         |  144 --
 src/lib/types/navigation.ts                   |    4 +-
 src/routes/(app)/+layout.svelte               |   17 +-
 src/routes/(app)/storage/+error.svelte        |    4 +-
 src/routes/(app)/storage/+layout.svelte       |   18 +-
 src/routes/(app)/storage/+page.svelte         |   10 +-
 .../storage/[bucket]/[...prefix]/+page.svelte |   47 +-
 .../(app)/storage/api/delete/+server.ts       |    6 +-
 src/routes/(app)/storage/api/params.ts        |   15 +-
 .../(app)/storage/api/preview/+server.ts      |   22 +-
 src/routes/(app)/storage/validation.ts        |    1 -
 .../trino/completion/metadata/+server.ts      |    9 +-
 src/routes/auth/login/+page.svelte            |    4 +-
 src/routes/healthz/+server.ts                 |    3 +
 vite.config.ts                                |    2 +
 91 files changed, 2858 insertions(+), 3518 deletions(-)
 create mode 100644 .vscode/extensions.json
 create mode 100644 .vscode/settings.json
 delete mode 100644 src/lib/components/storage/ContextMenu.svelte
 delete mode 100644 src/lib/components/storage/FileExplorer.svelte
 delete mode 100644 src/lib/components/storage/FileRow.svelte
 delete mode 100644 src/lib/components/storage/ObjectTable.svelte
 delete mode 100644 src/lib/components/storage/actions/delete.ts
 delete mode 100644 src/lib/components/storage/actions/download.ts
 delete mode 100644 src/lib/components/storage/actions/index.ts
 delete mode 100644 src/lib/components/storage/actions/preview.ts
 delete mode 100644 src/lib/components/storage/actions/types.ts
 delete mode 100644 src/lib/components/storage/actions/upload.ts
 create mode 100644 src/lib/components/storage/explorer/ContextMenu.svelte
 create mode 100644 src/lib/components/storage/explorer/FileExplorer.svelte
 create mode 100644 src/lib/components/storage/explorer/FileRow.svelte
 rename src/lib/components/storage/{ => explorer}/FolderRow.svelte (51%)
 create mode 100644 src/lib/components/storage/explorer/ObjectTable.svelte
 rename src/lib/components/storage/{ => explorer}/SelectionToolbar.svelte (52%)
 rename src/lib/components/storage/{ => explorer}/StorageBreadcrumb.svelte (55%)
 rename src/lib/components/storage/{ => landing}/BucketGrid.svelte (74%)
 rename src/lib/components/storage/{ => landing}/RecentItems.svelte (69%)
 rename src/lib/components/storage/{ => landing}/StorageConnectForm.svelte (97%)
 rename src/lib/components/storage/{ => modals}/DeleteConfirmModal.svelte (81%)
 rename src/lib/components/storage/{ => modals}/PreviewModal.svelte (89%)
 create mode 100644 src/lib/components/storage/modals/StorageModals.svelte
 rename src/lib/components/storage/{ => modals}/preview/CsvPreview.svelte (100%)
 rename src/lib/components/storage/{ => modals}/preview/FallbackPreview.svelte (71%)
 rename src/lib/components/storage/{ => modals}/preview/ImagePreview.svelte (100%)
 rename src/lib/components/storage/{ => modals}/preview/PdfPreview.svelte (100%)
 rename src/lib/components/storage/{ => modals}/preview/TextPreview.svelte (100%)
 create mode 100644 src/lib/components/storage/modals/upload/UploadConflictEntry.svelte
 create mode 100644 src/lib/components/storage/modals/upload/UploadDropzone.svelte
 create mode 100644 src/lib/components/storage/modals/upload/UploadEntryStatus.svelte
 rename src/lib/components/storage/{ => modals/upload}/UploadModal.svelte (50%)
 create mode 100644 src/lib/components/storage/modals/upload/types.ts
 rename src/lib/components/storage/{ => shared}/TimestampDisplay.svelte (100%)
 rename src/lib/components/storage/{ => sidebar}/BucketList.svelte (59%)
 create mode 100644 src/lib/storage/bookmarks.svelte.ts
 create mode 100644 src/lib/storage/context.ts
 delete mode 100644 src/lib/storage/delete.ts
 create mode 100644 src/lib/storage/display-helpers.ts
 rename src/lib/{components/storage/actions => storage}/errors.ts (54%)
 create mode 100644 src/lib/storage/file-collection.ts
 create mode 100644 src/lib/storage/persistence.ts
 create mode 100644 src/lib/storage/state.svelte.ts
 delete mode 100644 src/lib/stores/pinned-locations.svelte.ts
 delete mode 100644 src/lib/stores/recent-items.svelte.ts
 delete mode 100644 src/routes/(app)/storage/validation.ts
 create mode 100644 src/routes/healthz/+server.ts

diff --git a/.env.example b/.env.example
index df350360..ad4aa269 100644
--- a/.env.example
+++ b/.env.example
@@ -30,3 +30,6 @@ STACKABLE_UI_OIDC_CLIENT_SECRET=your-client-secret
 # STACKABLE_UI_TRINO_AUTH_PASSWORD=secret
 # STACKABLE_UI_TRINO_TLS_INSECURE=false    # Set to "true" to skip TLS certificate verification
 # STACKABLE_UI_TRINO_TLS_CA_CERT=/path/to/ca.pem  # Custom CA certificate file
+
+# Feature flags
+# STACKABLE_UI_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
new file mode 100644
index 00000000..e7a944df
--- /dev/null
+++ b/.vscode/extensions.json
@@ -0,0 +1,30 @@
+{
+  "recommendations": [
+    // Core language support
+    "svelte.svelte-vscode",
+
+    // Formatting – reads the project's .prettierrc
+    "esbenp.prettier-vscode",
+
+    // Linting – uses the project's eslint.config.js (flat config)
+    "dbaeumer.vscode-eslint",
+
+    // Tailwind CSS IntelliSense: class suggestions, hover docs, v4 support
+    "bradlc.vscode-tailwindcss",
+
+    // E2E test runner UI (Playwright)
+    "ms-playwright.playwright",
+
+    // Unit test runner UI (Vitest)
+    "vitest.explorer",
+
+    // .env file syntax highlighting and IntelliSense
+    "mikestead.dotenv",
+
+    // YAML support for .pre-commit-config.yaml, Helm charts, dev/ files
+    "redhat.vscode-yaml",
+
+    // i18n management: surfaces missing/untranslated Paraglide message keys
+    "lokalise.i18n-ally"
+  ]
+}
diff --git a/.vscode/settings.json b/.vscode/settings.json
new file mode 100644
index 00000000..ecfae0d4
--- /dev/null
+++ b/.vscode/settings.json
@@ -0,0 +1,94 @@
+{
+  // ── TypeScript ────────────────────────────────────────────────────────────
+  // Use the workspace-local TypeScript so svelte-check, the editor, and the
+  // build all use the same version. The prompt only shows once per workspace.
+  "js/ts.tsdk.path": "node_modules/typescript/lib",
+  "js/ts.tsdk.promptToUseWorkspaceVersion": true,
+
+  // ── Formatter (Prettier) ─────────────────────────────────────────────────
+  // Project .prettierrc is the single source of truth and includes
+  // prettier-plugin-svelte and prettier-plugin-tailwindcss. Format on every
+  // explicit save so files are clean before the pre-commit lint check runs –
+  // equivalent to the `prettier --write` half of `npm run lint:fix`.
+  "editor.defaultFormatter": "esbenp.prettier-vscode",
+  "editor.formatOnSave": true,
+
+  // Route .svelte formatting through the Svelte extension so it applies the
+  // Svelte-aware Prettier plugin (configured in .prettierrc).
+  "[svelte]": {
+    "editor.defaultFormatter": "svelte.svelte-vscode",
+    // Trigger Tailwind class suggestions inside template attribute strings.
+    "editor.quickSuggestions": { "strings": true }
+  },
+
+  // ── ESLint ────────────────────────────────────────────────────────────────
+  // Project uses ESLint flat config (eslint.config.js).
+  "eslint.useFlatConfig": true,
+  "eslint.validate": ["javascript", "typescript", "svelte"],
+
+  // Run ESLint --fix on every explicit save. Together with formatOnSave above
+  // this is the per-save equivalent of `npm run lint:fix`, keeping the
+  // workspace clean before the pre-commit hook validates it.
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit",
+    // Disable VS Code's built-in organise-imports so it doesn't conflict with
+    // ESLint/Prettier import ordering.
+    "source.organizeImports": "never"
+  },
+
+  // ── Svelte language server ────────────────────────────────────────────────
+  // Enable the TypeScript language-server plugin for richer Svelte 5 / rune
+  // type-checking in the editor (mirrors what svelte-check does in CI).
+  "svelte.enable-ts-plugin": true,
+  // Default new <script> blocks to TypeScript (matches the whole codebase).
+  "svelte.plugin.svelte.defaultScriptLanguage": "ts",
+
+  // ── Tailwind CSS v4 ───────────────────────────────────────────────────────
+  // Tailwind v4 uses a CSS entry point instead of tailwind.config.js.
+  "tailwindCSS.experimental.configFile": "src/app.css",
+  // Enable class IntelliSense (suggestions + hover docs) inside Svelte files.
+  "tailwindCSS.includeLanguages": { "svelte": "html" },
+
+  // ── Editor ────────────────────────────────────────────────────────────────
+  "editor.tabSize": 2,
+  "editor.insertSpaces": true,
+  // Auto-rename matching HTML/Svelte tags on edit.
+  "editor.linkedEditing": true,
+  // Highlight only the active bracket-pair level to aid navigation in deeply
+  // nested Svelte templates.
+  "editor.guides.bracketPairs": "active",
+
+  // ── Files ─────────────────────────────────────────────────────────────────
+  // These mirror the pre-commit trailing-whitespace and end-of-file-fixer
+  // hooks so the editor enforces the same invariants before files are staged.
+  "files.trimTrailingWhitespace": true,
+  "files.insertFinalNewline": true,
+  "files.eol": "\n",
+
+  // ── Emmet ─────────────────────────────────────────────────────────────────
+  // Enable HTML abbreviation expansion inside Svelte templates.
+  "emmet.includeLanguages": { "svelte": "html" },
+
+  // ── i18n Ally (Paraglide) ─────────────────────────────────────────────────
+  // Point at the messages/ directory used by @inlang/paraglide-js. i18n Ally
+  // will surface missing/untranslated keys inline while editing.
+  "i18n-ally.localesPaths": ["messages"],
+  "i18n-ally.sourceLanguage": "en",
+  "i18n-ally.enabledFrameworks": ["svelte"],
+  "i18n-ally.keystyle": "flat",
+
+  // ── File & search exclusions ──────────────────────────────────────────────
+  // Hide generated/build artefacts from the Explorer and search results to
+  // reduce noise. The ANTLR-generated parser is large and never hand-edited.
+  "files.exclude": {
+    ".svelte-kit": true,
+    "build": true,
+    "src/lib/editor/generated": true
+  },
+  "search.exclude": {
+    ".svelte-kit/**": true,
+    "build/**": true,
+    "src/lib/editor/generated/**": true,
+    "package-lock.json": true
+  }
+}
diff --git a/AGENTS.md b/AGENTS.md
index 52c7f860..c6b6ddbc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -11,25 +11,7 @@ The application is designed with a **plugin/module architecture** so future Stac
 - **SvelteKit** with **Svelte 5** - Always use Svelte 5 syntax with runes (`$props`, `$state`, `$derived`, etc.)
 - **Tailwind CSS v4** - No tailwind.config.js file (uses CSS-based configuration)
 - **DaisyUI** - Use DaisyUI components/classes where possible for consistent UI - This is DaisyUI v5! A lot of classes you know about DON'T EXIST anymore. Check <https://daisyui.com/docs/upgrade/?lang=enj> if needed
-- **Icon Library** - Use Material UI icons for all icons in the application. Import icons from the Material UI icon library for consistency.
-
-  Example (project uses Iconify Material symbols):
-
-  ```svelte
-  <script lang="ts">
-    import Icon from '@iconify/svelte';
-  </script>
-
-  <!-- decorative icon -->
-  <Icon icon="material-symbols:warning" class="text-error h-6 w-6" aria-hidden="true" />
-
-  <!-- accessible icon with label -->
-  <span class="flex items-center gap-2">
-    <Icon icon="material-symbols:storage" class="h-4 w-4" aria-hidden="true" />
-    <span>Storage</span>
-  </span>
-  ```
-
+- **Icon Library** - Use **unplugin-icons** with the `material-symbols` icon set (`@iconify-json/material-symbols`). Import icons as virtual Svelte components: `import IconMenu from 'virtual:icons/material-symbols/menu'`.
 - **Monaco Editor** - SQL editor component (dynamic import, SSR-safe)
 - **ANTLR4** (antlr4ng) - Trino SQL parsing for syntax highlighting and code completion
 - **zod & superforms** - All forms are to use zod & superforms
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 1fdf9a50..1f8fb6d4 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -6,43 +6,19 @@ Tracked issues that are acceptable at the current early stage but must be addres
 
 ## Security
 
-### No authentication or authorisation on the Trino API route
-
-**File:** `src/routes/api/trino/query/+server.ts`, `src/hooks.server.ts`
-
-The `/api/trino/query` endpoint is completely unauthenticated. Any request — from any origin — can execute arbitrary SQL against any Trino instance. OIDC authentication is planned (env vars are wired up, `hooks.server.ts` has the right structure) but not yet implemented. Until auth middleware is in place there is also no per-user rate limiting or query quota.
-
----
-
-### Trino credentials stored in localStorage
-
-**File:** `src/routes/(app)/trino/+page.svelte:41–44`
-
-Username and password are persisted in plaintext localStorage. This is convenient for development (survives page reloads) but violates credential storage best practices — localStorage is accessible to any script on the page and visible in DevTools. Long-term the connection config should be stored server-side (tied to the authenticated session), with credentials never leaving the server after initial setup.
-
----
-
-### Credentials sent in every request body
-
-**File:** `src/routes/(app)/trino/+page.svelte:82–84`
-
-Because there is no server-side session yet, connection credentials (including password) are included in the JSON body of every `/api/trino/query` POST. Once server-side sessions exist the client should send only a session token, not raw credentials.
-
----
-
 ### Connection config is in-memory only
 
-**File:** `src/lib/server/trino.ts`
+**File:** `src/lib/server/trino/user-clients.ts`
 
-The active connection configuration (URL + credentials) is stored in a module-level variable. It is not persisted across server restarts and is not shared across multiple processes/instances. Acceptable for single-instance deployments during development. Long-term: persist to a session store or database, keyed by authenticated user.
+Per-user Trino connection configuration (URL + credentials) is stored in a module-level `Map`. It is not persisted across server restarts and is not shared across multiple processes/instances. Acceptable for single-instance deployments during development. Long-term: persist to a database keyed by authenticated user.
 
 ---
 
 ### Raw upstream error messages returned to the client
 
-**File:** `src/routes/api/trino/query/+server.ts:165, 181, 209`
+**File:** `src/lib/server/trino/queries.ts:176`
 
-Trino error messages and Node.js exception messages are returned to the browser without any sanitisation. Trino errors may expose schema details, table names, or internal query plans. These should be classified (query error vs. infrastructure error) and sanitised before being surfaced to users.
+Trino error messages are stored verbatim in `query.error` and surfaced through `buildSnapshot.error` to the client. Trino errors may expose schema details, table names, or internal query plans. These should be classified (query error vs. infrastructure error) and sanitised before being surfaced to users.
 
 ---
 
@@ -70,17 +46,17 @@ better-auth uses its built-in memory adapter for session and user storage. All s
 
 ---
 
-### Anonymous users share a single query slot
+### Anonymous users share a single Trino client
 
-**File:** `src/lib/server/query-store.ts`
+**File:** `src/lib/server/auth-utils.ts`, `src/lib/server/trino/user-clients.ts`
 
-When OIDC is disabled, all users are identified as `'anonymous'` and share a single active query slot. Submitting a new query cancels the previous one. Once OIDC is required in production this is a non-issue, but for development with multiple anonymous users it can cause unexpected cancellations.
+When OIDC is disabled, every unauthenticated request resolves to `userId = 'anonymous'`, so all anonymous users share the same per-user Trino client and connection. Saving a connection in one browser replaces it for all other anonymous sessions. Per-tab UUIDs still separate query state, but the underlying connection is global. Acceptable for single-user dev; a non-issue once OIDC is required in production.
 
 ---
 
 ### In-memory query store lost on server restart and prevents horizontal scaling
 
-**File:** `src/lib/server/query-store.ts`
+**File:** `src/lib/server/trino/queries.ts`
 
 All server-side query state (progress, rows, status) is held in a module-level `Map`. A server restart clears all state — running queries become orphaned in Trino and completed results are lost. Additionally, because the state is process-local, multiple server instances cannot share query state: a query started on instance A is invisible to instance B. Combined with the in-memory session store limitation (see above), the deployment is limited to a single replica. Acceptable during development; long-term this should be backed by Redis or a persistent store to enable horizontal scaling and resilience.
 
@@ -94,32 +70,16 @@ The Download action is intentionally restricted to a single file at a time. Mult
 
 ---
 
-### Completed query results are ephemeral (30-minute TTL)
+### Completed query results are ephemeral (default 30-minute TTL)
 
-**File:** `src/lib/server/query-store.ts`
+**File:** `src/lib/server/trino/queries.ts:20`
 
-Completed query snapshots (including result rows) are cleaned up after 30 minutes. If a user leaves and returns later, the results will be gone. Consider persisting results to disk or a cache with configurable TTL.
-
----
-
-### Status endpoint returns full rows array on each poll
-
-**File:** `src/routes/(app)/trino/api/query/status/+server.ts`
-
-The status endpoint returns the entire accumulated `rows` array on every poll request. With the 10k row cap this is acceptable, but for very wide result sets it is wasteful. A future optimisation could accept a `?rowOffset=N` parameter and return only new rows.
+Completed query snapshots (including result rows) are cleaned up after `STACKABLE_UI_QUERY_TTL` seconds (default 1800). If a user leaves and returns later, the results will be gone. Consider persisting results to disk or a cache with configurable TTL.
 
 ---
 
 ## API & Validation
 
-### API route request body not validated with Zod
-
-**File:** `src/routes/api/trino/query/+server.ts:83–103`
-
-`parseConnection` uses manual `typeof` checks instead of a Zod schema. The AGENTS.md guidelines require Zod for all validation. Additionally, `request.json()` is called without a try/catch — a malformed JSON body will throw an unhandled error rather than returning a 400.
-
----
-
 ### Client-side row accumulation has no memory bound
 
 **File:** `src/routes/(app)/trino/query-runner.svelte.ts`
@@ -132,7 +92,7 @@ The client accumulates all result rows in memory up to `MAX_CLIENT_ROWS` (10,000
 
 **File:** `src/routes/(app)/trino/+page.svelte`
 
-After saving a new connection, the previous query results remain visible until a new query is run. Consider calling `queryRunner.reset()` when the connection changes.
+After saving a new connection, the previous query results remain visible until a new query is run. Consider calling `runner.reset()` when the connection changes.
 
 ---
 
@@ -181,3 +141,11 @@ The upload endpoint reads S3 credentials from the same per-user in-memory connec
 **File:** `src/routes/(app)/storage/api/upload/+server.ts`
 
 The upload endpoint imposes no maximum file size. S3's 5 TB single-object limit applies as a natural backstop. For v0 this is acceptable; large uploads will consume server-side streaming resources proportionally but do not buffer the body in memory (the stream is piped directly to the `@aws-sdk/lib-storage` Upload). Add a configurable `MAX_UPLOAD_BYTES` guard in a future iteration once typical object sizes are known.
+
+---
+
+### No `/readyz` endpoint — readiness uses the trivial liveness probe
+
+**File:** `src/routes/healthz/+server.ts`, `deploy/helm/stackable-ui/values.yaml`
+
+Both `livenessProbe` and `readinessProbe` point at `/healthz`, which always returns 200. There is currently nothing meaningful to gate readiness on (better-auth uses an in-memory session store, OIDC discovery is fetched lazily on first auth call), so a separate `/readyz` would just be a placeholder. Once one of these lands — a real session store / DB, eager OIDC discovery, or a startup-time cache warm — split into `/healthz` (liveness, trivial) and `/readyz` (readiness, checking the new dependency), and update the helm probes accordingly.
diff --git a/deploy/helm/stackable-ui/templates/_helpers.tpl b/deploy/helm/stackable-ui/templates/_helpers.tpl
index 80e8388b..5c8cbd02 100644
--- a/deploy/helm/stackable-ui/templates/_helpers.tpl
+++ b/deploy/helm/stackable-ui/templates/_helpers.tpl
@@ -63,16 +63,18 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{/*
-Generate session secret
-*/}}
 {{- define "stackable-ui.sessionSecret" -}}
 {{- if .Values.sessionSecret }}
 {{- .Values.sessionSecret }}
 {{- else }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace (include "stackable-ui.fullname" .) }}
+{{- if and $existing $existing.data (index $existing.data "session-secret") }}
+{{- index $existing.data "session-secret" | b64dec }}
+{{- else }}
 {{- randAlphaNum 64 }}
 {{- end }}
 {{- end }}
+{{- end }}
 
 {{/*
 Image name
diff --git a/deploy/helm/stackable-ui/templates/deployment.yaml b/deploy/helm/stackable-ui/templates/deployment.yaml
index 6d948dc1..49c04bbe 100644
--- a/deploy/helm/stackable-ui/templates/deployment.yaml
+++ b/deploy/helm/stackable-ui/templates/deployment.yaml
@@ -58,6 +58,12 @@ spec:
               value: {{ .Values.config.nodeEnv | quote }}
             - name: PORT
               value: {{ .Values.service.targetPort | quote }}
+            - name: STACKABLE_UI_COMPLETION_ENABLED
+              value: {{ .Values.features.trino.completion.enabled | quote }}
+            {{- if .Values.logging.level }}
+            - name: LOG_LEVEL
+              value: {{ .Values.logging.level | quote }}
+            {{- end }}
             - name: STACKABLE_UI_SESSION_SECRET
               valueFrom:
                 secretKeyRef:
diff --git a/deploy/helm/stackable-ui/values.yaml b/deploy/helm/stackable-ui/values.yaml
index c772c2b4..c0678984 100644
--- a/deploy/helm/stackable-ui/values.yaml
+++ b/deploy/helm/stackable-ui/values.yaml
@@ -77,7 +77,7 @@ resources:
 
 livenessProbe:
   httpGet:
-    path: /
+    path: /healthz
     port: http
   initialDelaySeconds: 10
   periodSeconds: 30
@@ -86,7 +86,7 @@ livenessProbe:
 
 readinessProbe:
   httpGet:
-    path: /
+    path: /healthz
     port: http
   initialDelaySeconds: 5
   periodSeconds: 10
@@ -95,7 +95,7 @@ readinessProbe:
 
 startupProbe:
   httpGet:
-    path: /
+    path: /healthz
     port: http
   initialDelaySeconds: 5
   periodSeconds: 5
@@ -103,6 +103,14 @@ startupProbe:
 
 terminationGracePeriodSeconds: 30
 
+features:
+  trino:
+    completion:
+      enabled: true
+
+logging:
+  level: ""
+
 nodeSelector: {}
 
 tolerations: []
diff --git a/dev/setup.sh b/dev/setup.sh
index f22138d2..ceacc876 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -78,15 +78,19 @@ fi
 # InternalIP is not reachable from the host network, but NodePorts are exposed
 # on localhost. Probe both and use the first reachable URL.
 KEYCLOAK_BASE_URL=""
-for base in "http://${NODE_IP}:30080" "http://127.0.0.1:30080" "http://localhost:30080"; do
-  if curl -sf --max-time 2 "${base}/realms/master" >/dev/null 2>&1; then
-    KEYCLOAK_BASE_URL="$base"
-    break
-  fi
+deadline=$(( $(date +%s) + 120 ))
+while [ -z "$KEYCLOAK_BASE_URL" ] && [ "$(date +%s)" -lt "$deadline" ]; do
+  for base in "http://${NODE_IP}:30080" "http://127.0.0.1:30080" "http://localhost:30080"; do
+    if curl -sf --max-time 2 "${base}/realms/master" >/dev/null 2>&1; then
+      KEYCLOAK_BASE_URL="$base"
+      break
+    fi
+  done
+  [ -z "$KEYCLOAK_BASE_URL" ] && sleep 2
 done
 
 if [ -z "$KEYCLOAK_BASE_URL" ]; then
-  echo "ERROR: Could not reach Keycloak via NodePort 30080."
+  echo "ERROR: Could not reach Keycloak via NodePort 30080 within 120s."
   echo "Tried: http://${NODE_IP}:30080, http://127.0.0.1:30080, http://localhost:30080"
   exit 1
 fi
@@ -222,6 +226,7 @@ STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
 STACKABLE_UI_BASE_URL=http://localhost:5173
 STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
 PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
+
 EOF
 fi
 
diff --git a/messages/de.json b/messages/de.json
index 7cb9177a..39adb206 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -118,7 +118,7 @@
   "completion_detail_column": "Spalte",
   "completion_detail_column_in": "Spalte von {table}",
   "completion_detail_keyword": "Schlüsselwort",
-  "trino_export_csv_column_names": "Spaltennamen",
+  "completion_detail_function": "Funktion",
   "nav_storage": "Speicher",
   "page_title_storage": "Speicher",
   "storage_connect_title": "Mit Speicher verbinden",
diff --git a/messages/en.json b/messages/en.json
index 3413884b..7d877c82 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -118,7 +118,7 @@
   "completion_detail_column": "Column",
   "completion_detail_column_in": "Column of {table}",
   "completion_detail_keyword": "Keyword",
-  "trino_export_csv_column_names": "Column names",
+  "completion_detail_function": "Function",
   "nav_storage": "Storage",
   "page_title_storage": "Storage",
   "storage_connect_title": "Connect to storage",
diff --git a/package-lock.json b/package-lock.json
index 10058c77..8ff6cf77 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -27,7 +27,8 @@
         "@cyclonedx/cyclonedx-npm": "^4.2.1",
         "@eslint/compat": "^2.0.2",
         "@eslint/js": "^9.39.2",
-        "@iconify/svelte": "^5.2.1",
+        "@iconify-json/gravity-ui": "^1.2.12",
+        "@iconify-json/material-symbols": "^1.2.74",
         "@inlang/paraglide-js": "^2.12.0",
         "@playwright/test": "^1.58.2",
         "@sveltejs/adapter-node": "^5.5.3",
@@ -55,12 +56,27 @@
         "tailwindcss": "^4.2.1",
         "typescript": "^5.9.3",
         "typescript-eslint": "^8.56.1",
+        "unplugin-icons": "^23.0.1",
         "vite": "^7.3.1",
         "vitest": "^4.0.18",
         "vitest-browser-svelte": "^2.0.2",
         "zod": "^4.3.6"
       }
     },
+    "node_modules/@antfu/install-pkg": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-1.1.0.tgz",
+      "integrity": "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "package-manager-detector": "^1.3.0",
+        "tinyexec": "^1.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
     "node_modules/@ark/schema": {
       "version": "0.56.0",
       "resolved": "https://registry.npmjs.org/@ark/schema/-/schema-0.56.0.tgz",
@@ -119,44 +135,6 @@
         "tslib": "^2.6.2"
       }
     },
-    "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/is-array-buffer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
-      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/util-buffer-from": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
-      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/@aws-crypto/sha1-browser/node_modules/@smithy/util-utf8": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
-      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
     "node_modules/@aws-crypto/sha256-browser": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-browser/-/sha256-browser-5.2.0.tgz",
@@ -172,44 +150,6 @@
         "tslib": "^2.6.2"
       }
     },
-    "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/is-array-buffer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
-      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-buffer-from": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
-      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/@aws-crypto/sha256-browser/node_modules/@smithy/util-utf8": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
-      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
     "node_modules/@aws-crypto/sha256-js": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-js/-/sha256-js-5.2.0.tgz",
@@ -244,104 +184,29 @@
         "tslib": "^2.6.2"
       }
     },
-    "node_modules/@aws-crypto/util/node_modules/@smithy/is-array-buffer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
-      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/@aws-crypto/util/node_modules/@smithy/util-buffer-from": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
-      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
-    "node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
-      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
     "node_modules/@aws-sdk/client-s3": {
-      "version": "3.1045.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1045.0.tgz",
-      "integrity": "sha512-fsuO3Y6t+3Ro9Bsg41DKj4Sfy53CGSrhnMldNplWmG8Tx0UbYk+YDa4RD1hVlJpERw4JBmPkl0+J9qlxMh1pcA==",
+      "version": "3.1053.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1053.0.tgz",
+      "integrity": "sha512-/oGxoB6p1Nqs935Blt+v1o+anSCEf2n3RjIrcLz84i4cn2Gr+Z7JpDdUkG5+74r5ctqEPG7k/phTGbJ9fNKnHg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha1-browser": "5.2.0",
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/credential-provider-node": "^3.972.39",
-        "@aws-sdk/middleware-bucket-endpoint": "^3.972.10",
-        "@aws-sdk/middleware-expect-continue": "^3.972.10",
-        "@aws-sdk/middleware-flexible-checksums": "^3.974.16",
-        "@aws-sdk/middleware-host-header": "^3.972.10",
-        "@aws-sdk/middleware-location-constraint": "^3.972.10",
-        "@aws-sdk/middleware-logger": "^3.972.10",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
-        "@aws-sdk/middleware-sdk-s3": "^3.972.37",
-        "@aws-sdk/middleware-ssec": "^3.972.10",
-        "@aws-sdk/middleware-user-agent": "^3.972.38",
-        "@aws-sdk/region-config-resolver": "^3.972.13",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.25",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-endpoints": "^3.996.8",
-        "@aws-sdk/util-user-agent-browser": "^3.972.10",
-        "@aws-sdk/util-user-agent-node": "^3.973.24",
-        "@smithy/config-resolver": "^4.4.17",
-        "@smithy/core": "^3.23.17",
-        "@smithy/eventstream-serde-browser": "^4.2.14",
-        "@smithy/eventstream-serde-config-resolver": "^4.3.14",
-        "@smithy/eventstream-serde-node": "^4.2.14",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/hash-blob-browser": "^4.2.15",
-        "@smithy/hash-node": "^4.2.14",
-        "@smithy/hash-stream-node": "^4.2.14",
-        "@smithy/invalid-dependency": "^4.2.14",
-        "@smithy/md5-js": "^4.2.14",
-        "@smithy/middleware-content-length": "^4.2.14",
-        "@smithy/middleware-endpoint": "^4.4.32",
-        "@smithy/middleware-retry": "^4.5.7",
-        "@smithy/middleware-serde": "^4.2.20",
-        "@smithy/middleware-stack": "^4.2.14",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-body-length-node": "^4.2.3",
-        "@smithy/util-defaults-mode-browser": "^4.3.49",
-        "@smithy/util-defaults-mode-node": "^4.2.54",
-        "@smithy/util-endpoints": "^3.4.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/util-stream": "^4.5.25",
-        "@smithy/util-utf8": "^4.2.2",
-        "@smithy/util-waiter": "^4.3.0",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/credential-provider-node": "^3.972.44",
+        "@aws-sdk/middleware-bucket-endpoint": "^3.972.15",
+        "@aws-sdk/middleware-expect-continue": "^3.972.13",
+        "@aws-sdk/middleware-flexible-checksums": "^3.974.21",
+        "@aws-sdk/middleware-location-constraint": "^3.972.11",
+        "@aws-sdk/middleware-sdk-s3": "^3.972.42",
+        "@aws-sdk/middleware-ssec": "^3.972.11",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/fetch-http-handler": "^5.4.3",
+        "@smithy/node-http-handler": "^4.7.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -349,24 +214,18 @@
       }
     },
     "node_modules/@aws-sdk/core": {
-      "version": "3.974.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.8.tgz",
-      "integrity": "sha512-njR2qoG6ZuB0kvAS2FyICsFZJ6gmCcf2X/7JcD14sUvGDm26wiZ5BrA6LOiUxKFEF+IVe7kdroxyE00YlkiYsw==",
+      "version": "3.974.13",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.13.tgz",
+      "integrity": "sha512-+Y5/4tHki0uYgyx8eun146DegRVQBpdKGK5RbV0FTKJPpaKTchvqVxrrRFK6Wk0JksO4iAZKw3eqxGEIwtO98w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/xml-builder": "^3.972.22",
-        "@smithy/core": "^3.23.17",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/signature-v4": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/util-utf8": "^4.2.2",
+        "@aws-sdk/types": "^3.973.9",
+        "@aws-sdk/xml-builder": "^3.972.25",
+        "@aws/lambda-invoke-store": "^0.2.2",
+        "@smithy/core": "^3.24.3",
+        "@smithy/signature-v4": "^5.4.2",
+        "@smithy/types": "^4.14.2",
+        "bowser": "^2.11.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -374,12 +233,12 @@
       }
     },
     "node_modules/@aws-sdk/crc64-nvme": {
-      "version": "3.972.7",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/crc64-nvme/-/crc64-nvme-3.972.7.tgz",
-      "integrity": "sha512-QUagVVBbC8gODCF6e1aV0mE2TXWB9Opz4k8EJFdNrujUVQm5R4AjJa1mpOqzwOuROBzqJU9zawzig7M96L8Ejg==",
+      "version": "3.972.9",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/crc64-nvme/-/crc64-nvme-3.972.9.tgz",
+      "integrity": "sha512-P+QGozmXn2mZZI7sDgk+aUm+RTI61MPSFB+Ir2vjEjEbEsE4e7hYtzrDvAUxZy9ko81h53e11+F/GYlvwDkaOQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.1",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -387,15 +246,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-env": {
-      "version": "3.972.34",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.34.tgz",
-      "integrity": "sha512-XT0jtf8Fw9JE6ppsQeoNnZRiG+jqRixMT1v1ZR17G60UvVdsQmTG8nbEyHuEPfMxDXEhfdARaM/XiEhca4lGHQ==",
+      "version": "3.972.39",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.39.tgz",
+      "integrity": "sha512-29wX9zpAvEt1vcj0psha+y6ygBHy2V/S72mp6e7q0KARLWXq+pwE/lR6qGkwknQvruh52lXvlqZIga8Hdxkucw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -403,20 +262,17 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-http": {
-      "version": "3.972.36",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.36.tgz",
-      "integrity": "sha512-DPoGWfy7J7RKxvbf5kOKIGQkD2ek3dbKgzKIGrnLuvZBz5myU+Im/H6pmc14QcnFbqHMqxvtWSgRDSJW3qXLQg==",
+      "version": "3.972.41",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.41.tgz",
+      "integrity": "sha512-IA3CQTjtJkb6u1H4mE4936c8OPBMa9Jggtwe8U2Mqw/vvb/tZ5Ebd0mcZcX0uKWQhOyYo/+qNIwkV5Xh+FeJJA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-stream": "^4.5.25",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/fetch-http-handler": "^5.4.3",
+        "@smithy/node-http-handler": "^4.7.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -424,24 +280,23 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-ini": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.38.tgz",
-      "integrity": "sha512-oDzUBu2MGJFgoar05sPMCwSrhw44ASyccrHzj66vO69OZqi7I6hZZxXfuPLC8OCzW7C+sU+bI73XHij41yekgQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/credential-provider-env": "^3.972.34",
-        "@aws-sdk/credential-provider-http": "^3.972.36",
-        "@aws-sdk/credential-provider-login": "^3.972.38",
-        "@aws-sdk/credential-provider-process": "^3.972.34",
-        "@aws-sdk/credential-provider-sso": "^3.972.38",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.38",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/credential-provider-imds": "^4.2.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+      "version": "3.972.43",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.43.tgz",
+      "integrity": "sha512-4mzII+3mZEVXXE1xzrLQrCJL7/r62A63bA6SVzZoNL5rqCJghpf+xgGltVrIBBs0n+mOZBKrQl2tRREtvZ5l6A==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/credential-provider-env": "^3.972.39",
+        "@aws-sdk/credential-provider-http": "^3.972.41",
+        "@aws-sdk/credential-provider-login": "^3.972.43",
+        "@aws-sdk/credential-provider-process": "^3.972.39",
+        "@aws-sdk/credential-provider-sso": "^3.972.43",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.43",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/credential-provider-imds": "^4.3.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -449,18 +304,16 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-login": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.38.tgz",
-      "integrity": "sha512-g1NosS8qe4OF++G2UFCM5ovSkgipC7YYor5KCWatG0UoMSO5YFj9C8muePlyVmOBV/WTI16Jo3/s1NUo/o1Bww==",
+      "version": "3.972.43",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.43.tgz",
+      "integrity": "sha512-HG7kQCwXtbv3oBV61Ins0oNX8KKyvrMqqRkb6ZiAfQHbMuHaiNaEb2KnpKLPkNpqImSBK82UkVE/kaY6IfWikA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -468,22 +321,21 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-node": {
-      "version": "3.972.39",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.39.tgz",
-      "integrity": "sha512-HEswDQyxUtadoZ/bJsPPENHg7R0Lzym5LuMksJeHvqhCOpP+rtkDLKI4/ZChH4w3cf5kG8n6bZuI8PzajoiqMg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/credential-provider-env": "^3.972.34",
-        "@aws-sdk/credential-provider-http": "^3.972.36",
-        "@aws-sdk/credential-provider-ini": "^3.972.38",
-        "@aws-sdk/credential-provider-process": "^3.972.34",
-        "@aws-sdk/credential-provider-sso": "^3.972.38",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.38",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/credential-provider-imds": "^4.2.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+      "version": "3.972.44",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.44.tgz",
+      "integrity": "sha512-sDaBIT0yrNNIPfvlsiTCmANm07zKju+ipWODjEXgZlsjMeIJR3LVp7RDyAOzUoAsTbDfYKDWp+i5WrFiQP6rmQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/credential-provider-env": "^3.972.39",
+        "@aws-sdk/credential-provider-http": "^3.972.41",
+        "@aws-sdk/credential-provider-ini": "^3.972.43",
+        "@aws-sdk/credential-provider-process": "^3.972.39",
+        "@aws-sdk/credential-provider-sso": "^3.972.43",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.43",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/credential-provider-imds": "^4.3.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -491,16 +343,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-process": {
-      "version": "3.972.34",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.34.tgz",
-      "integrity": "sha512-T3IFs4EVmVi1dVN5RciFnklCANSzvrQd/VuHY9ThHSQmYkTogjcGkoJEr+oNUPQZnso52183088NqysMPji1/Q==",
+      "version": "3.972.39",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.39.tgz",
+      "integrity": "sha512-2k/amBifLd75eXNwgvPw/2lKYSQ3NhvHQgkVKVjfUq13/eJ3JRtHmznuFenn74OK3sSfp4SMy1YB2w+UVXoKqA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -508,18 +359,17 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-sso": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.38.tgz",
-      "integrity": "sha512-5ZxG+t0+3Q3QPh8KEjX6syskhgNf7I0MN7oGioTf6Lm1NTjfP7sIcYGNsthXC2qR8vcD3edNZwCr2ovfSSWuRA==",
+      "version": "3.972.43",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.43.tgz",
+      "integrity": "sha512-LPc3+Y4vhH1T4x6CMqwCM6hk5+SRf/Lwmgm8INm95wxTtIRHcMwQUVkDzWu4Iw/RSncxYM2BC01OrYbxOPZvyg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/token-providers": "3.1041.0",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/token-providers": "3.1052.0",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -527,17 +377,16 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-web-identity": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.38.tgz",
-      "integrity": "sha512-lYHFF30DGI20jZcYX8cm6Ns0V7f1dDN6g/MBDLTyD/5iw+bXs3yBr2iAiHDkx4RFU5JgsnZvCHYKiRVPRdmOgw==",
+      "version": "3.972.43",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.43.tgz",
+      "integrity": "sha512-wQtL34lUD/09VXjwAUo2T+I3aEXRDxMB3DKmTJL/Zj0Gi6sLDTrVhae1XVt01yzkquOWajI/sZW72JGDZ1ciTw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -545,15 +394,13 @@
       }
     },
     "node_modules/@aws-sdk/lib-storage": {
-      "version": "3.1045.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/lib-storage/-/lib-storage-3.1045.0.tgz",
-      "integrity": "sha512-F7dp2ST/83Iz6JTMMmUYEXxg7R1JDewfvzJeWWiDTwe0vLsg67JTN7OsBe6G8DWYbLQ+EyPWkyc3oFnxOjCVfg==",
+      "version": "3.1053.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/lib-storage/-/lib-storage-3.1053.0.tgz",
+      "integrity": "sha512-Y5fyrJ2Qln3lmU0I335no+zdyytpM7svvYOYadZiV2bXGDXEO26A8B+4iGW264GvBO4jnl/iPHVZ/hJIqXekAA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/middleware-endpoint": "^4.4.32",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "buffer": "5.6.0",
         "events": "3.3.0",
         "stream-browserify": "3.0.0",
@@ -563,21 +410,29 @@
         "node": ">=20.0.0"
       },
       "peerDependencies": {
-        "@aws-sdk/client-s3": "^3.1045.0"
+        "@aws-sdk/client-s3": "^3.1053.0"
+      }
+    },
+    "node_modules/@aws-sdk/lib-storage/node_modules/buffer": {
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
+      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.0.2",
+        "ieee754": "^1.1.4"
       }
     },
     "node_modules/@aws-sdk/middleware-bucket-endpoint": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.10.tgz",
-      "integrity": "sha512-Vbc2frZH7wXlMNd+ZZSXUEs/l1Sv8Jj4zUnIfwrYF5lwaLdXHZ9xx4U3rjUcaye3HRhFVc+E5DbBxpRAbB16BA==",
+      "version": "3.972.15",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.15.tgz",
+      "integrity": "sha512-O2HDANa+MrvbxpaRVQDiH3T13uAa9AkMjKyZmDygwauAmmvqZ5B0iRmKW+fuVGW6NPXuyXurFgIx69lSvmAWGA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-arn-parser": "^3.972.3",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-config-provider": "^4.2.2",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -585,14 +440,14 @@
       }
     },
     "node_modules/@aws-sdk/middleware-expect-continue": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-expect-continue/-/middleware-expect-continue-3.972.10.tgz",
-      "integrity": "sha512-2Yn0f1Qiq/DjxYR3wfI3LokXnjOhFM7Ssn4LTdFDIxRMCE6I32MAsVnhPX1cUZsuVA9tiZtwwhlSLAtFGxAZlQ==",
+      "version": "3.972.13",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-expect-continue/-/middleware-expect-continue-3.972.13.tgz",
+      "integrity": "sha512-sHiqIFg8o2ipT7t40B89Vj0ubSUtY6OSt/+Ee/OXhHch5K4+81zP2+QX8Lkc/nJ2QSmCySxOke7TEbmX69fe2g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -600,39 +455,19 @@
       }
     },
     "node_modules/@aws-sdk/middleware-flexible-checksums": {
-      "version": "3.974.16",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.974.16.tgz",
-      "integrity": "sha512-6ru8doI0/XzszqLIPXf0E/V7HhAw1Pu94010XCKYtBUfD0LxF0BuOzrUf8OQGR6j2o6wgKTHUniOmndQycHwCA==",
+      "version": "3.974.21",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.974.21.tgz",
+      "integrity": "sha512-alAu9heyiBK/OmRNXVxq8mmPTgeW2AQ6EYjRsI38kPZa1MZvt2Jh+BlGq7/GG9OVXOaEgD7DlGj/Lzfy5OmuEg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/crc32": "5.2.0",
         "@aws-crypto/crc32c": "5.2.0",
         "@aws-crypto/util": "5.2.0",
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/crc64-nvme": "^3.972.7",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/is-array-buffer": "^4.2.2",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-stream": "^4.5.25",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-host-header": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-host-header/-/middleware-host-header-3.972.10.tgz",
-      "integrity": "sha512-IJSsIMeVQ8MMCPbuh1AbltkFhLBLXn7aejzfX5YKT/VLDHn++Dcz8886tXckE+wQssyPUhaXrJhdakO2VilRhg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/crc64-nvme": "^3.972.9",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -640,43 +475,13 @@
       }
     },
     "node_modules/@aws-sdk/middleware-location-constraint": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-location-constraint/-/middleware-location-constraint-3.972.10.tgz",
-      "integrity": "sha512-rI3NZvJcEvjoD0+0PI0iUAwlPw2IlSlhyvgBK/3WkKJQE/YiKFedd9dMN2lVacdNxPNhxL/jzQaKQdrGtQagjQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-logger": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-logger/-/middleware-logger-3.972.10.tgz",
-      "integrity": "sha512-OOuGvvz1Dm20SjZo5oEBePFqxt5nf8AwkNDSyUHvD9/bfNASmstcYxFAHUowy4n6Io7mWUZ04JURZwSBvyQanQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-recursion-detection": {
       "version": "3.972.11",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-recursion-detection/-/middleware-recursion-detection-3.972.11.tgz",
-      "integrity": "sha512-+zz6f79Kj9V5qFK2P+D8Ehjnw4AhphAlCAsPjUqEcInA9umtSSKMrHbSagEeOIsDNuvVrH98bjRHcyQukTrhaQ==",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-location-constraint/-/middleware-location-constraint-3.972.11.tgz",
+      "integrity": "sha512-hkfspNUP4criAH6ton6BGKgnm5dZx+7bUOy1YqlTfejDeUPAM23D81q/IX+hdlS3KUsfwGz5ADTqZWKBEUpf4A==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@aws/lambda-invoke-store": "^0.2.2",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -684,24 +489,17 @@
       }
     },
     "node_modules/@aws-sdk/middleware-sdk-s3": {
-      "version": "3.972.37",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.37.tgz",
-      "integrity": "sha512-Km7M+i8DrLArVzrid1gfxeGhYHBd3uxvE77g0s5a52zPSVosxzQBnJ0gwWb6NIp/DOk8gsBMhi7V+cpJG0ndTA==",
+      "version": "3.972.42",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.42.tgz",
+      "integrity": "sha512-/xNqNGXv9LaxZd25L9VV4pnSOw9OdDNO4rAHamM+h3KQBSITljIH9vk3dveGga1I2j36lQd0rdG3gjNEXvtNew==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-arn-parser": "^3.972.3",
-        "@smithy/core": "^3.23.17",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/signature-v4": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-config-provider": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-stream": "^4.5.25",
-        "@smithy/util-utf8": "^4.2.2",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/signature-v4": "^5.4.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -709,32 +507,13 @@
       }
     },
     "node_modules/@aws-sdk/middleware-ssec": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-ssec/-/middleware-ssec-3.972.10.tgz",
-      "integrity": "sha512-Gli9A0u8EVVb+5bFDGS/QbSVg28w/wpEidg1ggVcSj65BDTdGR6punsOcVjqdiu1i42WHWo51MCvARPIIz9juw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-user-agent": {
-      "version": "3.972.38",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.972.38.tgz",
-      "integrity": "sha512-iz+B29TXcAZsJpwB+AwG/TTGA5l/VnmMZ2UxtiySOZjI6gCdmviXPwdgzcmuazMy16rXoPY4mYCGe7zdNKfx5A==",
+      "version": "3.972.11",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-ssec/-/middleware-ssec-3.972.11.tgz",
+      "integrity": "sha512-7PQvGNhtveKlvVqNahqWx5yrwxP7ecwAoB1dYBf8eKwfo2tzzCbNnW+q2nO3N066ktQaB4iBQbDRWtizm+amoQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-endpoints": "^3.996.8",
-        "@smithy/core": "^3.23.17",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-retry": "^4.3.6",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -742,65 +521,20 @@
       }
     },
     "node_modules/@aws-sdk/nested-clients": {
-      "version": "3.997.6",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.6.tgz",
-      "integrity": "sha512-WBDnqatJl+kGObpfmfSxqnXeYTu3Me8wx8WCtvoxX3pfWrrTv8I4WTMSSs7PZqcRcVh8WeUKMgGFjMG+52SR1w==",
+      "version": "3.997.11",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.11.tgz",
+      "integrity": "sha512-nWXXJ1r/r8N2Gw1pWolRgED38/A9A8DHR2ETWIv220zh4PZHcybbR4hUVWWktmNXTRHzDJwRluapHn0rZxuoqA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/middleware-host-header": "^3.972.10",
-        "@aws-sdk/middleware-logger": "^3.972.10",
-        "@aws-sdk/middleware-recursion-detection": "^3.972.11",
-        "@aws-sdk/middleware-user-agent": "^3.972.38",
-        "@aws-sdk/region-config-resolver": "^3.972.13",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.25",
-        "@aws-sdk/types": "^3.973.8",
-        "@aws-sdk/util-endpoints": "^3.996.8",
-        "@aws-sdk/util-user-agent-browser": "^3.972.10",
-        "@aws-sdk/util-user-agent-node": "^3.973.24",
-        "@smithy/config-resolver": "^4.4.17",
-        "@smithy/core": "^3.23.17",
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/hash-node": "^4.2.14",
-        "@smithy/invalid-dependency": "^4.2.14",
-        "@smithy/middleware-content-length": "^4.2.14",
-        "@smithy/middleware-endpoint": "^4.4.32",
-        "@smithy/middleware-retry": "^4.5.7",
-        "@smithy/middleware-serde": "^4.2.20",
-        "@smithy/middleware-stack": "^4.2.14",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-body-length-browser": "^4.2.2",
-        "@smithy/util-body-length-node": "^4.2.3",
-        "@smithy/util-defaults-mode-browser": "^4.3.49",
-        "@smithy/util-defaults-mode-node": "^4.2.54",
-        "@smithy/util-endpoints": "^3.4.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/region-config-resolver": {
-      "version": "3.972.13",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/region-config-resolver/-/region-config-resolver-3.972.13.tgz",
-      "integrity": "sha512-CvJ2ZIjK/jVD/lbOpowBVElJyC1YxLTIJ13yM0AEo0t2v7swOzGjSA6lJGH+DwZXQhcjUjoYwc8bVYCX5MDr1A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/config-resolver": "^4.4.17",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/fetch-http-handler": "^5.4.3",
+        "@smithy/node-http-handler": "^4.7.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -808,16 +542,15 @@
       }
     },
     "node_modules/@aws-sdk/signature-v4-multi-region": {
-      "version": "3.996.25",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.25.tgz",
-      "integrity": "sha512-+CMIt3e1VzlklAECmG+DtP1sV8iKq25FuA0OKpnJ4KA0kxUtd7CgClY7/RU6VzJBQwbN4EJ9Ue6plvqx1qGadw==",
+      "version": "3.996.28",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.28.tgz",
+      "integrity": "sha512-qs9z5LqXO/CZC2Lg9SGKpoLU8Rhi+m2pFKZqfO9pytX1clc0katqtsDNupJxFy0xT9wsZSPzM2v1y+/H/zfp5Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/middleware-sdk-s3": "^3.972.37",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/signature-v4": "^5.3.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/signature-v4": "^5.4.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -825,17 +558,16 @@
       }
     },
     "node_modules/@aws-sdk/token-providers": {
-      "version": "3.1041.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1041.0.tgz",
-      "integrity": "sha512-Th7kPI6YPtvJUcdznooXJMy+9rQWjmEF81LxaJssngBzuysK4a/x+l8kjm1zb7nYsUPbndnBdUnwng/3PLvtGw==",
+      "version": "3.1052.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1052.0.tgz",
+      "integrity": "sha512-QqZNB3so7UIDxZtroc85TQaLVxdZRFm0eWM1CSR2N+b06as9TOrilvrlTZuj3guYlxMs6yLOgGxnklJ5qMYtTw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.8",
-        "@aws-sdk/nested-clients": "^3.997.6",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -843,40 +575,12 @@
       }
     },
     "node_modules/@aws-sdk/types": {
-      "version": "3.973.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.8.tgz",
-      "integrity": "sha512-gjlAdtHMbtR9X5iIhVUvbVcy55KnznpC6bkDUWW9z915bi0ckdUr5cjf16Kp6xq0bP5HBD2xzgbL9F9Quv5vUw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/util-arn-parser": {
-      "version": "3.972.3",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-arn-parser/-/util-arn-parser-3.972.3.tgz",
-      "integrity": "sha512-HzSD8PMFrvgi2Kserxuff5VitNq2sgf3w9qxmskKDiDTThWfVteJxuCS9JXiPIPtmCrp+7N9asfIaVhBFORllA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/util-endpoints": {
-      "version": "3.996.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-endpoints/-/util-endpoints-3.996.8.tgz",
-      "integrity": "sha512-oOZHcRDihk5iEe5V25NVWg45b3qEA8OpHWVdU/XQh8Zj4heVPAJqWvMphQnU7LkufmUo10EpvFPZuQMiFLJK3g==",
+      "version": "3.973.9",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.9.tgz",
+      "integrity": "sha512-kuBfgQVdcz5Bmapc4A13YbpVw/pXkesfhetcFYwbntqas8sF41OHyd4o28+/TG2ZQdHBsv90Lsu5y6oitvYCdg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-endpoints": "^3.4.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -895,52 +599,15 @@
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/util-user-agent-browser": {
-      "version": "3.972.10",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-browser/-/util-user-agent-browser-3.972.10.tgz",
-      "integrity": "sha512-FAzqXvfEssGdSIz8ejatan0bOdx1qefBWKF/gWmVBXIP1HkS7v/wjjaqrAGGKvyihrXTXW00/2/1nTJtxpXz7g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/types": "^4.14.1",
-        "bowser": "^2.11.0",
-        "tslib": "^2.6.2"
-      }
-    },
-    "node_modules/@aws-sdk/util-user-agent-node": {
-      "version": "3.973.24",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.973.24.tgz",
-      "integrity": "sha512-ZWwlkjcIp7cEL8ZfTpTAPNkwx25p7xol0xlKoWVVf22+nsjwmLcHYtTPjIV1cSpmB/b6DaK4cb1fSkvCXHgRdw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/middleware-user-agent": "^3.972.38",
-        "@aws-sdk/types": "^3.973.8",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-config-provider": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      },
-      "peerDependencies": {
-        "aws-crt": ">=1.0.0"
-      },
-      "peerDependenciesMeta": {
-        "aws-crt": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@aws-sdk/xml-builder": {
-      "version": "3.972.22",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.22.tgz",
-      "integrity": "sha512-PMYKKtJd70IsSG0yHrdAbxBr+ZWBKLvzFZfD3/urxgf6hXVMzuU5M+3MJ5G67RpOmLBu1fAUN65SbWuKUCOlAA==",
+      "version": "3.972.25",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.25.tgz",
+      "integrity": "sha512-GH+Kjz4nPKWKHnsiQpnhP1MJdTGIcK4rAka6tzakgjjUkVgNsmPeEbbRAf09SzS1hjGu6duGHCBsxYke0BhHjQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@nodable/entities": "2.1.0",
-        "@smithy/types": "^4.14.1",
-        "fast-xml-parser": "5.7.2",
+        "@smithy/types": "^4.14.2",
+        "fast-xml-parser": "5.7.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -1907,20 +1574,24 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
-    "node_modules/@iconify/svelte": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/@iconify/svelte/-/svelte-5.2.1.tgz",
-      "integrity": "sha512-zHmsIPmnIhGd5gc95bNN5FL+GifwMZv7M2rlZEpa7IXYGFJm/XGHdWf6PWQa6OBoC+R69WyiPO9NAj5wjfjbow==",
+    "node_modules/@iconify-json/gravity-ui": {
+      "version": "1.2.12",
+      "resolved": "https://registry.npmjs.org/@iconify-json/gravity-ui/-/gravity-ui-1.2.12.tgz",
+      "integrity": "sha512-/66CorNnUoFs66nb8FJ+ZPq6Zog9NwR13ml90qijI0Hj3bVqQIdiWZ9npSyNWRgJe452LFmWZrdWQONYBbJ7XA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@iconify/types": "^2.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/cyberalien"
-      },
-      "peerDependencies": {
-        "svelte": ">5.0.0"
+        "@iconify/types": "*"
+      }
+    },
+    "node_modules/@iconify-json/material-symbols": {
+      "version": "1.2.74",
+      "resolved": "https://registry.npmjs.org/@iconify-json/material-symbols/-/material-symbols-1.2.74.tgz",
+      "integrity": "sha512-GKJcvvm8A25pkh3Z2M430olvP4hDpDKg2sg7cpVnesM4bT7rExH74ThtRLWjdB86qhkxT3XrMuHRJa8LFCRmSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@iconify/types": "*"
       }
     },
     "node_modules/@iconify/types": {
@@ -1930,6 +1601,18 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@iconify/utils": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.3.tgz",
+      "integrity": "sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@antfu/install-pkg": "^1.1.0",
+        "@iconify/types": "^2.0.0",
+        "import-meta-resolve": "^4.2.0"
+      }
+    },
     "node_modules/@inlang/paraglide-js": {
       "version": "2.12.0",
       "resolved": "https://registry.npmjs.org/@inlang/paraglide-js/-/paraglide-js-2.12.0.tgz",
@@ -2940,781 +2623,188 @@
       ],
       "license": "MIT",
       "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
-      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
-    },
-    "node_modules/@sideway/address": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
-      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true,
-      "dependencies": {
-        "@hapi/hoek": "^9.0.0"
-      }
-    },
-    "node_modules/@sideway/formula": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
-      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
-    "node_modules/@sideway/pinpoint": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
-      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
-    "node_modules/@sinclair/typebox": {
-      "version": "0.31.28",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.31.28.tgz",
-      "integrity": "sha512-/s55Jujywdw/Jpan+vsy6JZs1z2ZTGxTmbZTPiuSL2wz9mfzA2gN1zzaqmvfi4pq+uOt7Du85fkiwv5ymW84aQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@smithy/chunked-blob-reader": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/chunked-blob-reader/-/chunked-blob-reader-5.2.2.tgz",
-      "integrity": "sha512-St+kVicSyayWQca+I1rGitaOEH6uKgE8IUWoYnnEX26SWdWQcL6LvMSD19Lg+vYHKdT9B2Zuu7rd3i6Wnyb/iw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/chunked-blob-reader-native": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/@smithy/chunked-blob-reader-native/-/chunked-blob-reader-native-4.2.3.tgz",
-      "integrity": "sha512-jA5k5Udn7Y5717L86h4EIv06wIr3xn8GM1qHRi/Nf31annXcXHJjBKvgztnbn2TxH3xWrPBfgwHsOwZf0UmQWw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-base64": "^4.3.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/config-resolver": {
-      "version": "4.4.17",
-      "resolved": "https://registry.npmjs.org/@smithy/config-resolver/-/config-resolver-4.4.17.tgz",
-      "integrity": "sha512-TzDZcAnhTyAHbXVxWZo7/tEcrIeFq20IBk8So3OLOetWpR8EwY/yEqBMBFaJMeyEiREDq4NfEl+qO3OAUD+vbQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-config-provider": "^4.2.2",
-        "@smithy/util-endpoints": "^3.4.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/core": {
-      "version": "3.24.3",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.3.tgz",
-      "integrity": "sha512-Ep/7tPamGY8mgESE3LyLKtxJyy6U52WWAqr/3wial47Sj4u3PiIF73AOGI27UyLy9duTkhZbgzodOfLV4TduZg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-crypto/crc32": "5.2.0",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/credential-provider-imds": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.2.14.tgz",
-      "integrity": "sha512-Au28zBN48ZAoXdooGUHemuVBrkE+Ie6RPmGNIAJsFqj33Vhb6xAgRifUydZ2aY+M+KaMAETAlKk5NC5h1G7wpg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/eventstream-codec": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/eventstream-codec/-/eventstream-codec-4.2.14.tgz",
-      "integrity": "sha512-erZq0nOIpzfeZdCyzZjdJb4nVSKLUmSkaQUVkRGQTXs30gyUGeKnrYEg+Xe1W5gE3aReS7IgsvANwVPxSzY6Pw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-crypto/crc32": "5.2.0",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-hex-encoding": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/eventstream-serde-browser": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-browser/-/eventstream-serde-browser-4.2.14.tgz",
-      "integrity": "sha512-8IelTCtTctWRbb+0Dcy+C0aICh1qa0qWXqgjcXDmMuCvPJRnv26hiDZoAau2ILOniki65mCPKqOQs/BaWvO4CQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/eventstream-serde-universal": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/eventstream-serde-config-resolver": {
-      "version": "4.3.14",
-      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-config-resolver/-/eventstream-serde-config-resolver-4.3.14.tgz",
-      "integrity": "sha512-sqHiHpYRYo3FJlaIxD1J8PhbcmJAm7IuM16mVnwSkCToD7g00IBZzKuiLNMGmftULmEUX6/UAz8/NN5uMP8bVA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/eventstream-serde-node": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-node/-/eventstream-serde-node-4.2.14.tgz",
-      "integrity": "sha512-Ht/8BuGlKfFTy0H3+8eEu0vdpwGztCnaLLXtpXNdQqiR7Hj4vFScU3T436vRAjATglOIPjJXronY+1WxxNLSiw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/eventstream-serde-universal": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/eventstream-serde-universal": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/eventstream-serde-universal/-/eventstream-serde-universal-4.2.14.tgz",
-      "integrity": "sha512-lWyt4T2XQZUZgK3tQ3Wn0w3XBvZsK/vjTuJl6bXbnGZBHH0ZUSONTYiK9TgjTTzU54xQr3DRFwpjmhp0oLm3gg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/eventstream-codec": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/fetch-http-handler": {
-      "version": "5.3.17",
-      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.3.17.tgz",
-      "integrity": "sha512-bXOvQzaSm6MnmLaWA1elgfQcAtN4UP3vXqV97bHuoOrHQOJiLT3ds6o9eo5bqd0TJfRFpzdGnDQdW3FACiAVdw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/querystring-builder": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-base64": "^4.3.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/hash-blob-browser": {
-      "version": "4.2.15",
-      "resolved": "https://registry.npmjs.org/@smithy/hash-blob-browser/-/hash-blob-browser-4.2.15.tgz",
-      "integrity": "sha512-0PJ4Al3fg2nM4qKrAIxyNcApgqHAXcBkN8FeizOz69z0rb26uZ6lMESYtxegaTlXB5Hj84JfwMPavMrwDMjucA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/chunked-blob-reader": "^5.2.2",
-        "@smithy/chunked-blob-reader-native": "^4.2.3",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/hash-node": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/hash-node/-/hash-node-4.2.14.tgz",
-      "integrity": "sha512-8ZBDY2DD4wr+GGjTpPtiglEsqr0lUP+KHqgZcWczFf6qeZ/YRjMIOoQWVQlmwu7EtxKTd8YXD8lblmYcpBIA1g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-buffer-from": "^4.2.2",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/hash-stream-node": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/hash-stream-node/-/hash-stream-node-4.2.14.tgz",
-      "integrity": "sha512-tw4GANWkZPb6+BdD4Fgucqzey2+r73Z/GRo9zklsCdwrnxxumUV83ZIaBDdudV4Ylazw3EPTiJZhpX42105ruQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/invalid-dependency": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/invalid-dependency/-/invalid-dependency-4.2.14.tgz",
-      "integrity": "sha512-c21qJiTSb25xvvOp+H2TNZzPCngrvl5vIPqPB8zQ/DmJF4QWXO19x1dWfMJZ6wZuuWUPPm0gV8C0cU3+ifcWuw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/is-array-buffer": {
-      "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-4.3.3.tgz",
-      "integrity": "sha512-RRxYqjUa/n8dRVkbhyuiRarppLzt4H/AtMUEFmiHlDy8o4wrgqAdzxsk9naemzu6iX67ZV375fNmX7Q8dynGKw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/core": "^3.24.3",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/md5-js": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/md5-js/-/md5-js-4.2.14.tgz",
-      "integrity": "sha512-V2v0vx+h0iUSNG1Alt+GNBMSLGCrl9iVsdd+Ap67HPM9PN479x12V8LkuMoKImNZxn3MXeuyUjls+/7ZACZghA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/middleware-content-length": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-content-length/-/middleware-content-length-4.2.14.tgz",
-      "integrity": "sha512-xhHq7fX4/3lv5NHxLUk3OeEvl0xZ+Ek3qIbWaCL4f9JwgDZEclPBElljaZCAItdGPQl/kSM4LPMOpy1MYgprpw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/middleware-endpoint": {
-      "version": "4.4.32",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-endpoint/-/middleware-endpoint-4.4.32.tgz",
-      "integrity": "sha512-ZZkgyjnJppiZbIm6Qbx92pbXYi1uzenIvGhBSCDlc7NwuAkiqSgS75j1czAD25ZLs2FjMjYy1q7gyRVWG6JA0Q==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/core": "^3.23.17",
-        "@smithy/middleware-serde": "^4.2.20",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
-        "@smithy/url-parser": "^4.2.14",
-        "@smithy/util-middleware": "^4.2.14",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/middleware-retry": {
-      "version": "4.5.7",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-retry/-/middleware-retry-4.5.7.tgz",
-      "integrity": "sha512-bRt6ZImqVSeTk39Nm81K20ObIiAZ3WefY7G6+iz/0tZjs4dgRRjvRX2sgsH+zi6iDCRR/aQvQofLKxxz4rPBZg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/core": "^3.23.17",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/service-error-classification": "^4.3.1",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-retry": "^4.3.6",
-        "@smithy/uuid": "^1.1.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/middleware-serde": {
-      "version": "4.2.20",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-serde/-/middleware-serde-4.2.20.tgz",
-      "integrity": "sha512-Lx9JMO9vArPtiChE3wbEZ5akMIDQpWQtlu90lhACQmNOXcGXRbaDywMHDzuDZ2OkZzP+9wQfZi3YJT9F67zTQQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/core": "^3.23.17",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/middleware-stack": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/middleware-stack/-/middleware-stack-4.2.14.tgz",
-      "integrity": "sha512-2dvkUKLuFdKsCRmOE4Mn63co0Djtsm+JMh0bYZQupN1pJwMeE8FmQmRLLzzEMN0dnNi7CDCYYH8F0EVwWiPBeA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/node-config-provider": {
-      "version": "4.3.14",
-      "resolved": "https://registry.npmjs.org/@smithy/node-config-provider/-/node-config-provider-4.3.14.tgz",
-      "integrity": "sha512-S+gFjyo/weSVL0P1b9Ts8C/CwIfNCgUPikk3sl6QVsfE/uUuO+QsF+NsE/JkpvWqqyz1wg7HFdiaZuj5CoBMRg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/shared-ini-file-loader": "^4.4.9",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/node-http-handler": {
-      "version": "4.6.1",
-      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.6.1.tgz",
-      "integrity": "sha512-iB+orM4x3xrr57X3YaXazfKnntl0LHlZB1kcXSGzMV1Tt0+YwEjGlbjk/44qEGtBzXAz6yFDzkYTKSV6Pj2HUg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/querystring-builder": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/property-provider": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/property-provider/-/property-provider-4.2.14.tgz",
-      "integrity": "sha512-WuM31CgfsnQ/10i7NYr0PyxqknD72Y5uMfUMVSniPjbEPceiTErb4eIqJQ+pdxNEAUEWrewrGjIRjVbVHsxZiQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/protocol-http": {
-      "version": "5.3.14",
-      "resolved": "https://registry.npmjs.org/@smithy/protocol-http/-/protocol-http-5.3.14.tgz",
-      "integrity": "sha512-dN5F8kHx8RNU0r+pCwNmFZyz6ChjMkzShy/zup6MtkRmmix4vZzJdW+di7x//b1LiynIev88FM18ie+wwPcQtQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/querystring-builder": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/querystring-builder/-/querystring-builder-4.2.14.tgz",
-      "integrity": "sha512-XYA5Z0IqTeF+5XDdh4BBmSA0HvbgVZIyv4cmOoUheDNR57K1HgBp9ukUMx3Cr3XpDHHpLBnexPE3LAtDsZkj2A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-uri-escape": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/querystring-parser": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/querystring-parser/-/querystring-parser-4.2.14.tgz",
-      "integrity": "sha512-hr+YyqBD23GVvRxGGrcc/oOeNlK3PzT5Fu4dzrDXxzS1LpFiuL2PQQqKPs87M79aW7ziMs+nvB3qdw77SqE7Lw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/service-error-classification": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@smithy/service-error-classification/-/service-error-classification-4.3.1.tgz",
-      "integrity": "sha512-aUQuDGh760ts/8MU+APjIZhlLPKhIIfqyzZaJikLEIMrdxFvxuLYD0WxWzaYWpmLbQlXDe9p7EWM3HsBe0K6Gw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/shared-ini-file-loader": {
-      "version": "4.4.9",
-      "resolved": "https://registry.npmjs.org/@smithy/shared-ini-file-loader/-/shared-ini-file-loader-4.4.9.tgz",
-      "integrity": "sha512-495/V2I15SHgedSJoDPD23JuSfKAp726ZI1V0wtjB07Wh7q/0tri/0e0DLefZCHgxZonrGKt/OCTpAtP1wE1kQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/signature-v4": {
-      "version": "5.3.14",
-      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.3.14.tgz",
-      "integrity": "sha512-1D9Y/nmlVjCeSivCbhZ7hgEpmHyY1h0GvpSZt3l0xcD9JjmjVC1CHOozS6+Gh+/ldMH8JuJ6cujObQqfayAVFA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^4.2.2",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-hex-encoding": "^4.2.2",
-        "@smithy/util-middleware": "^4.2.14",
-        "@smithy/util-uri-escape": "^4.2.2",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/smithy-client": {
-      "version": "4.12.13",
-      "resolved": "https://registry.npmjs.org/@smithy/smithy-client/-/smithy-client-4.12.13.tgz",
-      "integrity": "sha512-y/Pcj1V9+qG98gyu1gvftHB7rDpdh+7kIBIggs55yGm3JdtBV8GT8IFF3a1qxZ79QnaJHX9GXzvBG6tAd+czJA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/core": "^3.23.17",
-        "@smithy/middleware-endpoint": "^4.4.32",
-        "@smithy/middleware-stack": "^4.2.14",
-        "@smithy/protocol-http": "^5.3.14",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-stream": "^4.5.25",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/types": {
-      "version": "4.14.2",
-      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.2.tgz",
-      "integrity": "sha512-P+otAxbV4CqBybp7EkcJCrig63yE2E7PuNVOmilVMRcx/O+QDzGULTrKsq4DV13gSfak9ObPrWaHl/9bL5YcWw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/url-parser": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/url-parser/-/url-parser-4.2.14.tgz",
-      "integrity": "sha512-p06BiBigJ8bTA3MgnOfCtDUWnAMY0YfedO/GRpmc7p+wg3KW8vbXy1xwSu5ASy0wV7rRYtlfZOIKH4XqfhjSQQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/querystring-parser": "^4.2.14",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@smithy/util-base64": {
-      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-base64/-/util-base64-4.3.2.tgz",
-      "integrity": "sha512-XRH6b0H/5A3SgblmMa5ErXQ2XKhfbQB+Fm/oyLZ2O2kCUrwgg55bU0RekmzAhuwOjA9qdN5VU2BprOvGGUkOOQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^4.2.2",
-        "@smithy/util-utf8": "^4.2.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
+      "os": [
+        "win32"
+      ]
     },
-    "node_modules/@smithy/util-body-length-browser": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-body-length-browser/-/util-body-length-browser-4.2.2.tgz",
-      "integrity": "sha512-JKCrLNOup3OOgmzeaKQwi4ZCTWlYR5H4Gm1r2uTMVBXoemo1UEghk5vtMi1xSu2ymgKVGW631e2fp9/R610ZjQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
+      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
     },
-    "node_modules/@smithy/util-body-length-node": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/@smithy/util-body-length-node/-/util-body-length-node-4.2.3.tgz",
-      "integrity": "sha512-ZkJGvqBzMHVHE7r/hcuCxlTY8pQr1kMtdsVPs7ex4mMU+EAbcXppfo5NmyxMYi2XU49eqaz56j2gsk4dHHPG/g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
+      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
     },
-    "node_modules/@smithy/util-buffer-from": {
-      "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-4.3.3.tgz",
-      "integrity": "sha512-5xlgilVaX96HdVlLZymKUa7vOTZtisOTxBJloM2J4PeRqyAWBeFIq0DnIxQISvwxT4rgJAvk7rHhB+GlCCKe8g==",
-      "license": "Apache-2.0",
+    "node_modules/@sideway/address": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
+      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true,
       "dependencies": {
-        "@smithy/core": "^3.24.3",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
+        "@hapi/hoek": "^9.0.0"
       }
     },
-    "node_modules/@smithy/util-config-provider": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-config-provider/-/util-config-provider-4.2.2.tgz",
-      "integrity": "sha512-dWU03V3XUprJwaUIFVv4iOnS1FC9HnMHDfUrlNDSh4315v0cWyaIErP8KiqGVbf5z+JupoVpNM7ZB3jFiTejvQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
+    "node_modules/@sideway/formula": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
+      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
     },
-    "node_modules/@smithy/util-defaults-mode-browser": {
-      "version": "4.3.49",
-      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.3.49.tgz",
-      "integrity": "sha512-a5bNrdiONYB/qE2BuKegvUMd/+ZDwdg4vsNuuSzYE8qs2EYAdK9CynL+Rzn29PbPiUqoz/cbpRbcLzD5lEevHw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
+    "node_modules/@sideway/pinpoint": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
+      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
     },
-    "node_modules/@smithy/util-defaults-mode-node": {
-      "version": "4.2.54",
-      "resolved": "https://registry.npmjs.org/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.2.54.tgz",
-      "integrity": "sha512-g1cvrJvOnzeJgEdf7AE4luI7gp6L8weE0y9a9wQUSGtjb8QRHDbCJYuE4Sy0SD9N8RrnNPFsPltAz/OSoBR9Zw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/config-resolver": "^4.4.17",
-        "@smithy/credential-provider-imds": "^4.2.14",
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/property-provider": "^4.2.14",
-        "@smithy/smithy-client": "^4.12.13",
-        "@smithy/types": "^4.14.1",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
+    "node_modules/@sinclair/typebox": {
+      "version": "0.31.28",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.31.28.tgz",
+      "integrity": "sha512-/s55Jujywdw/Jpan+vsy6JZs1z2ZTGxTmbZTPiuSL2wz9mfzA2gN1zzaqmvfi4pq+uOt7Du85fkiwv5ymW84aQ==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/@smithy/util-endpoints": {
-      "version": "3.4.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-endpoints/-/util-endpoints-3.4.2.tgz",
-      "integrity": "sha512-a55Tr+3OKld4TTtnT+RhKOQHyPxm3j/xL4OR83WBUhLJaKDS9dnJ7arRMOp3t31dcLhApwG9bgvrRXBHlLdIkg==",
+    "node_modules/@smithy/core": {
+      "version": "3.24.4",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
+      "integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/node-config-provider": "^4.3.14",
-        "@smithy/types": "^4.14.1",
+        "@aws-crypto/crc32": "5.2.0",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@smithy/util-hex-encoding": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-hex-encoding/-/util-hex-encoding-4.2.2.tgz",
-      "integrity": "sha512-Qcz3W5vuHK4sLQdyT93k/rfrUwdJ8/HZ+nMUOyGdpeGA1Wxt65zYwi3oEl9kOM+RswvYq90fzkNDahPS8K0OIg==",
+    "node_modules/@smithy/credential-provider-imds": {
+      "version": "4.3.4",
+      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
+      "integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@smithy/core": "^3.24.4",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@smithy/util-middleware": {
-      "version": "4.2.14",
-      "resolved": "https://registry.npmjs.org/@smithy/util-middleware/-/util-middleware-4.2.14.tgz",
-      "integrity": "sha512-1Su2vj9RYNDEv/V+2E+jXkkwGsgR7dc4sfHn9Z7ruzQHJIEni9zzw5CauvRXlFJfmgcqYP8fWa0dkh2Q2YaQyw==",
+    "node_modules/@smithy/fetch-http-handler": {
+      "version": "5.4.4",
+      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
+      "integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.1",
+        "@smithy/core": "^3.24.4",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@smithy/util-retry": {
-      "version": "4.3.8",
-      "resolved": "https://registry.npmjs.org/@smithy/util-retry/-/util-retry-4.3.8.tgz",
-      "integrity": "sha512-LUIxbTBi+OpvXpg91poGA6BdyoleMDLnfXjVDqyi2RvZmTveY5loE/FgYUBCR5LU2BThW2SoZRh8dTIIy38IPw==",
+    "node_modules/@smithy/is-array-buffer": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
+      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/service-error-classification": "^4.3.1",
-        "@smithy/types": "^4.14.1",
         "tslib": "^2.6.2"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@smithy/util-stream": {
-      "version": "4.5.25",
-      "resolved": "https://registry.npmjs.org/@smithy/util-stream/-/util-stream-4.5.25.tgz",
-      "integrity": "sha512-/PFpG4k8Ze8Ei+mMKj3oiPICYekthuzePZMgZbCqMiXIHHf4n2aZ4Ps0aSRShycFTGuj/J6XldmC0x0DwednIA==",
+    "node_modules/@smithy/node-http-handler": {
+      "version": "4.7.4",
+      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
+      "integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/fetch-http-handler": "^5.3.17",
-        "@smithy/node-http-handler": "^4.6.1",
-        "@smithy/types": "^4.14.1",
-        "@smithy/util-base64": "^4.3.2",
-        "@smithy/util-buffer-from": "^4.2.2",
-        "@smithy/util-hex-encoding": "^4.2.2",
-        "@smithy/util-utf8": "^4.2.2",
+        "@smithy/core": "^3.24.4",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@smithy/util-uri-escape": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@smithy/util-uri-escape/-/util-uri-escape-4.2.2.tgz",
-      "integrity": "sha512-2kAStBlvq+lTXHyAZYfJRb/DfS3rsinLiwb+69SstC9Vb0s9vNWkRwpnj918Pfi85mzi42sOqdV72OLxWAISnw==",
+    "node_modules/@smithy/signature-v4": {
+      "version": "5.4.4",
+      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
+      "integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@smithy/core": "^3.24.4",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@smithy/util-utf8": {
-      "version": "4.3.3",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-4.3.3.tgz",
-      "integrity": "sha512-c1QpRBn3aMsoqE64dd4Imgjy8Pynfw+eR7GkjElquxUFSnezwYVaOFm8JcYa+Bo/5ssbEyPKcT3+4bmrWYh6eQ==",
+    "node_modules/@smithy/types": {
+      "version": "4.14.2",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.2.tgz",
+      "integrity": "sha512-P+otAxbV4CqBybp7EkcJCrig63yE2E7PuNVOmilVMRcx/O+QDzGULTrKsq4DV13gSfak9ObPrWaHl/9bL5YcWw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.24.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=18.0.0"
       }
     },
-    "node_modules/@smithy/util-waiter": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-waiter/-/util-waiter-4.3.0.tgz",
-      "integrity": "sha512-JyjYmLAfS+pdxF92o4yLgEoy0zhayKTw73FU1aofLWwLcJw7iSqIY2exGmMTrl/lmZugP5p/zxdFSippJDfKWA==",
+    "node_modules/@smithy/util-buffer-from": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
+      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.1",
+        "@smithy/is-array-buffer": "^2.2.0",
         "tslib": "^2.6.2"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@smithy/uuid": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@smithy/uuid/-/uuid-1.1.2.tgz",
-      "integrity": "sha512-O/IEdcCUKkubz60tFbGA7ceITTAJsty+lBjNoorP4Z6XRqaFb/OjQjZODophEcuq68nKm6/0r+6/lLQ+XVpk8g==",
+    "node_modules/@smithy/util-utf8": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
+      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
       "license": "Apache-2.0",
       "dependencies": {
+        "@smithy/util-buffer-from": "^2.2.0",
         "tslib": "^2.6.2"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=14.0.0"
       }
     },
     "node_modules/@sqlite.org/sqlite-wasm": {
@@ -4477,9 +3567,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
+      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5397,9 +4487,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5418,13 +4508,29 @@
       }
     },
     "node_modules/buffer": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
-      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
+      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "base64-js": "^1.0.2",
-        "ieee754": "^1.1.4"
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.1.13"
       }
     },
     "node_modules/bytes": {
@@ -5685,8 +4791,7 @@
       "version": "0.2.4",
       "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
       "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/consola": {
       "version": "3.4.0",
@@ -6721,8 +5826,7 @@
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
       "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
-      "license": "MIT",
-      "peer": true
+      "license": "MIT"
     },
     "node_modules/extend": {
       "version": "3.0.2",
@@ -6818,9 +5922,9 @@
       "optional": true
     },
     "node_modules/fast-xml-builder": {
-      "version": "1.1.7",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.7.tgz",
-      "integrity": "sha512-Yh7/7rQuMXICNr0oMYDR2yHP6oUvmQsTToFeOWj/kIDhAwQ+c4Ol/lbcwOmEM5OHYQmh6S6EQSQ1sljCKP36bQ==",
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
+      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
       "funding": [
         {
           "type": "github",
@@ -6829,13 +5933,14 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "path-expression-matcher": "^1.1.3"
+        "path-expression-matcher": "^1.5.0",
+        "xml-naming": "^0.1.0"
       }
     },
     "node_modules/fast-xml-parser": {
-      "version": "5.7.2",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.2.tgz",
-      "integrity": "sha512-P7oW7tLbYnhOLQk/Gv7cZgzgMPP/XN03K02/Jy6Y/NHzyIAIpxuZIM/YqAkfiXFPxA2CTm7NtCijK9EDu09u2w==",
+      "version": "5.7.3",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.3.tgz",
+      "integrity": "sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg==",
       "funding": [
         {
           "type": "github",
@@ -6845,7 +5950,7 @@
       "license": "MIT",
       "dependencies": {
         "@nodable/entities": "^2.1.0",
-        "fast-xml-builder": "^1.1.5",
+        "fast-xml-builder": "^1.1.7",
         "path-expression-matcher": "^1.5.0",
         "strnum": "^2.2.3"
       },
@@ -7037,7 +6142,8 @@
     "node_modules/fzstd": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/fzstd/-/fzstd-0.1.1.tgz",
-      "integrity": "sha512-dkuVSOKKwh3eas5VkJy1AW1vFpet8TA/fGmVA5krThl8YcOVE/8ZIoEA1+U1vEn5ckxxhLirSdY837azmbaNHA=="
+      "integrity": "sha512-dkuVSOKKwh3eas5VkJy1AW1vFpet8TA/fGmVA5krThl8YcOVE/8ZIoEA1+U1vEn5ckxxhLirSdY837azmbaNHA==",
+      "license": "MIT"
     },
     "node_modules/generate-function": {
       "version": "2.3.1",
@@ -7308,9 +6414,9 @@
       }
     },
     "node_modules/hosted-git-info/node_modules/lru-cache": {
-      "version": "11.5.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.0.tgz",
-      "integrity": "sha512-5YgH9UJd7wVb9hIouI2adWpgqrrICkt070Dnj8EUY1+B4B2P9eRLPAkAAo6NICA7CEhOIeBHl46u9zSNpNu7zA==",
+      "version": "11.3.5",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.5.tgz",
+      "integrity": "sha512-NxVFwLAnrd9i7KUBxC4DrUhmgjzOs+1Qm50D3oF1/oL+r1NpZ4gA7xvG0/zJ8evR7zIKn4vLf7qTNduWFtCrRw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -7394,14 +6500,16 @@
       }
     },
     "node_modules/hyparquet": {
-      "version": "1.25.8",
-      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.25.8.tgz",
-      "integrity": "sha512-KYRKZCHBgEY9FOuqTe9m+zdrKBcTo9ZcaIUqG7SdZygv5hwrGD3C6wuTrGt07cbEkgO71UIih+KbojLKf3ENbg=="
+      "version": "1.26.0",
+      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.26.0.tgz",
+      "integrity": "sha512-yxUiViPZ+z5h+xdX4rA1G+k30jXoEsG9I2xEpjaM84imGznbKjZzxuZFsdzqg6C4LxNnnAlDFvzpk4uxQWTbTQ==",
+      "license": "MIT"
     },
     "node_modules/hyparquet-compressors": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/hyparquet-compressors/-/hyparquet-compressors-1.1.1.tgz",
       "integrity": "sha512-yx7aA3Rhj0YycbdV71+XznQSLAefa4cT0urpgNXy4aM6eSeCknaVDNne8y45Uz74Fb15yyXUzOStlceOJBan7A==",
+      "license": "MIT",
       "dependencies": {
         "fzstd": "0.1.1",
         "hysnappy": "1.0.0"
@@ -7410,7 +6518,8 @@
     "node_modules/hysnappy": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/hysnappy/-/hysnappy-1.0.0.tgz",
-      "integrity": "sha512-MNrC4NfwDGPb889O6gIfEtbvEZCSWUsSEhsz4Oq2FRcpGtXHfeVz3KciSPp5Pnnz1NjFMgDQNfxdJozymJEDDA=="
+      "integrity": "sha512-MNrC4NfwDGPb889O6gIfEtbvEZCSWUsSEhsz4Oq2FRcpGtXHfeVz3KciSPp5Pnnz1NjFMgDQNfxdJozymJEDDA==",
+      "license": "MIT"
     },
     "node_modules/iconv-lite": {
       "version": "0.7.2",
@@ -7475,6 +6584,17 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/import-meta-resolve": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/import-meta-resolve/-/import-meta-resolve-4.2.0.tgz",
+      "integrity": "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
+      }
+    },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
@@ -8084,6 +7204,24 @@
         "node": ">=10"
       }
     },
+    "node_modules/local-pkg": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/local-pkg/-/local-pkg-1.2.1.tgz",
+      "integrity": "sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mlly": "^1.7.4",
+        "pkg-types": "^2.3.0",
+        "quansync": "^0.2.11"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
     "node_modules/locate-character": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
@@ -8500,6 +7638,38 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/mlly": {
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.8.2.tgz",
+      "integrity": "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "acorn": "^8.16.0",
+        "pathe": "^2.0.3",
+        "pkg-types": "^1.3.1",
+        "ufo": "^1.6.3"
+      }
+    },
+    "node_modules/mlly/node_modules/confbox": {
+      "version": "0.1.8",
+      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.1.8.tgz",
+      "integrity": "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mlly/node_modules/pkg-types": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-1.3.1.tgz",
+      "integrity": "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "confbox": "^0.1.8",
+        "mlly": "^1.7.4",
+        "pathe": "^2.0.1"
+      }
+    },
     "node_modules/monaco-editor": {
       "version": "0.55.1",
       "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz",
@@ -9050,6 +8220,13 @@
       "license": "BlueOak-1.0.0",
       "optional": true
     },
+    "node_modules/package-manager-detector": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
+      "integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/packageurl-js": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
@@ -9276,7 +8453,6 @@
       "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.0.tgz",
       "integrity": "sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
         "confbox": "^0.2.2",
         "exsolve": "^1.0.7",
@@ -9815,6 +8991,23 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/quansync": {
+      "version": "0.2.11",
+      "resolved": "https://registry.npmjs.org/quansync/-/quansync-0.2.11.tgz",
+      "integrity": "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/antfu"
+        },
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/sxzz"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/quick-format-unescaped": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
@@ -10848,9 +10041,9 @@
       }
     },
     "node_modules/strnum": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz",
-      "integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
+      "integrity": "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==",
       "funding": [
         {
           "type": "github",
@@ -11488,6 +10681,13 @@
         "typescript": ">=4.8.4 <6.0.0"
       }
     },
+    "node_modules/ufo": {
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.4.tgz",
+      "integrity": "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/undici": {
       "version": "7.24.4",
       "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.4.tgz",
@@ -11580,6 +10780,43 @@
         "node": ">=18.12.0"
       }
     },
+    "node_modules/unplugin-icons": {
+      "version": "23.0.1",
+      "resolved": "https://registry.npmjs.org/unplugin-icons/-/unplugin-icons-23.0.1.tgz",
+      "integrity": "sha512-rv0XEJepajKzDLvRUWASM8K+8+/CCfZn2jtogXqg6RIp7kpatRc/aFrVJn8ANQA09e++lPEEv9yX8cC9enc+QQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@antfu/install-pkg": "^1.1.0",
+        "@iconify/utils": "^3.1.0",
+        "local-pkg": "^1.1.2",
+        "obug": "^2.1.1",
+        "unplugin": "^2.3.11"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "@svgr/core": ">=7.0.0",
+        "@svgx/core": "^1.0.1",
+        "@vue/compiler-sfc": "^3.0.2",
+        "svelte": "^3.0.0 || ^4.0.0 || ^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@svgr/core": {
+          "optional": true
+        },
+        "@svgx/core": {
+          "optional": true
+        },
+        "@vue/compiler-sfc": {
+          "optional": true
+        },
+        "svelte": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/uri-js": {
       "version": "4.4.1",
       "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
@@ -11604,9 +10841,9 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "13.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.2.tgz",
-      "integrity": "sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==",
+      "version": "13.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.1.tgz",
+      "integrity": "sha512-9ezox2roIft6ExBVTVqibSd5dc5/47Sw/uY6b4SjQUT2TzQ0tltNquWA46y4xPQmdZYqvnio22SgWd41M86+jw==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
@@ -12129,6 +11366,21 @@
         }
       }
     },
+    "node_modules/xml-naming": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
+      "integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/xmlbuilder2": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/xmlbuilder2/-/xmlbuilder2-4.0.3.tgz",
diff --git a/package.json b/package.json
index 1e8c17a6..0dab6aa3 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,8 @@
     "@cyclonedx/cyclonedx-npm": "^4.2.1",
     "@eslint/compat": "^2.0.2",
     "@eslint/js": "^9.39.2",
-    "@iconify/svelte": "^5.2.1",
+    "@iconify-json/gravity-ui": "^1.2.12",
+    "@iconify-json/material-symbols": "^1.2.74",
     "@inlang/paraglide-js": "^2.12.0",
     "@playwright/test": "^1.58.2",
     "@sveltejs/adapter-node": "^5.5.3",
@@ -51,6 +52,7 @@
     "tailwindcss": "^4.2.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.56.1",
+    "unplugin-icons": "^23.0.1",
     "vite": "^7.3.1",
     "vitest": "^4.0.18",
     "vitest-browser-svelte": "^2.0.2",
diff --git a/src/app.d.ts b/src/app.d.ts
index e5a74c6e..b5f6447a 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -1,6 +1,8 @@
 // See https://svelte.dev/docs/kit/types#app.d.ts
 // for information about these interfaces
 
+/// <reference types="unplugin-icons/types/svelte" />
+
 import type { auth } from '$lib/server/auth';
 
 declare global {
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 05555369..e0066ed7 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -42,7 +42,7 @@ const handleParaglide: Handle = ({ event, resolve }) =>
 const handleAuth: Handle = ({ event, resolve }) =>
   svelteKitHandler({ event, resolve, auth, building });
 
-const PUBLIC_PATHS = ['/auth/login', '/auth/logout', '/api/auth', '/metrics'];
+const PUBLIC_PATHS = ['/auth/login', '/auth/logout', '/api/auth', '/metrics', '/healthz'];
 
 const handleAuthGuard: Handle = async ({ event, resolve }) => {
   const session = await auth.api.getSession({ headers: event.request.headers });
diff --git a/src/lib/components/Pagination.svelte b/src/lib/components/Pagination.svelte
index df3e8847..5f44a114 100644
--- a/src/lib/components/Pagination.svelte
+++ b/src/lib/components/Pagination.svelte
@@ -1,5 +1,8 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import IconFirstPage from 'virtual:icons/material-symbols/first-page';
+  import IconChevronLeft from 'virtual:icons/material-symbols/chevron-left';
+  import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
+  import IconLastPage from 'virtual:icons/material-symbols/last-page';
   import * as m from '$lib/paraglide/messages.js';
   import { browser } from '$app/environment';
   import { ALLOWED_PAGE_SIZES, isPageSize, type PageSize } from '$lib/types/pagination.js';
@@ -109,11 +112,7 @@
             aria-label={m.pagination_first_page()}
             title={m.pagination_first_page()}
           >
-            <Icon
-              icon="material-symbols:first-page"
-              class="size-4 {canGoFirst ? '' : 'opacity-40'}"
-              aria-hidden="true"
-            />
+            <IconFirstPage class="size-4 {canGoFirst ? '' : 'opacity-40'}" aria-hidden="true" />
           </button>
           <button
             class="btn btn-ghost btn-xs"
@@ -122,11 +121,7 @@
             aria-label={m.pagination_prev_page()}
             title={m.pagination_prev_page()}
           >
-            <Icon
-              icon="material-symbols:chevron-left"
-              class="size-4 {canGoPrev ? '' : 'opacity-40'}"
-              aria-hidden="true"
-            />
+            <IconChevronLeft class="size-4 {canGoPrev ? '' : 'opacity-40'}" aria-hidden="true" />
           </button>
           <button
             class="btn btn-ghost btn-xs"
@@ -135,11 +130,7 @@
             aria-label={m.pagination_next_page()}
             title={m.pagination_next_page()}
           >
-            <Icon
-              icon="material-symbols:chevron-right"
-              class="size-4 {canGoNext ? '' : 'opacity-40'}"
-              aria-hidden="true"
-            />
+            <IconChevronRight class="size-4 {canGoNext ? '' : 'opacity-40'}" aria-hidden="true" />
           </button>
           {#if showLast}
             <button
@@ -149,11 +140,7 @@
               aria-label={m.pagination_last_page()}
               title={m.pagination_last_page()}
             >
-              <Icon
-                icon="material-symbols:last-page"
-                class="size-4 {canGoLast ? '' : 'opacity-40'}"
-                aria-hidden="true"
-              />
+              <IconLastPage class="size-4 {canGoLast ? '' : 'opacity-40'}" aria-hidden="true" />
             </button>
           {/if}
         </nav>
@@ -181,11 +168,7 @@
         aria-label={m.pagination_first_page()}
         title={m.pagination_first_page()}
       >
-        <Icon
-          icon="material-symbols:first-page"
-          class="size-4 {canGoFirst ? '' : 'opacity-40'}"
-          aria-hidden="true"
-        />
+        <IconFirstPage class="size-4 {canGoFirst ? '' : 'opacity-40'}" aria-hidden="true" />
       </button>
       <button
         class="btn btn-ghost btn-sm"
@@ -194,11 +177,7 @@
         aria-label={m.pagination_prev_page()}
         title={m.pagination_prev_page()}
       >
-        <Icon
-          icon="material-symbols:chevron-left"
-          class="size-4 {canGoPrev ? '' : 'opacity-40'}"
-          aria-hidden="true"
-        />
+        <IconChevronLeft class="size-4 {canGoPrev ? '' : 'opacity-40'}" aria-hidden="true" />
       </button>
       <button
         class="btn btn-ghost btn-sm"
@@ -207,11 +186,7 @@
         aria-label={m.pagination_next_page()}
         title={m.pagination_next_page()}
       >
-        <Icon
-          icon="material-symbols:chevron-right"
-          class="size-4 {canGoNext ? '' : 'opacity-40'}"
-          aria-hidden="true"
-        />
+        <IconChevronRight class="size-4 {canGoNext ? '' : 'opacity-40'}" aria-hidden="true" />
       </button>
       {#if showLast}
         <button
@@ -221,11 +196,7 @@
           aria-label={m.pagination_last_page()}
           title={m.pagination_last_page()}
         >
-          <Icon
-            icon="material-symbols:last-page"
-            class="size-4 {canGoLast ? '' : 'opacity-40'}"
-            aria-hidden="true"
-          />
+          <IconLastPage class="size-4 {canGoLast ? '' : 'opacity-40'}" aria-hidden="true" />
         </button>
       {/if}
     </nav>
diff --git a/src/lib/components/ToastHost.svelte b/src/lib/components/ToastHost.svelte
index 4b4a3b91..e215f7da 100644
--- a/src/lib/components/ToastHost.svelte
+++ b/src/lib/components/ToastHost.svelte
@@ -1,12 +1,17 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import type { Component } from 'svelte';
+  import IconInfo from 'virtual:icons/material-symbols/info';
+  import IconCheckCircle from 'virtual:icons/material-symbols/check-circle';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
+  import IconError from 'virtual:icons/material-symbols/error';
+  import IconClose from 'virtual:icons/material-symbols/close';
   import { toasts, removeToast, type ToastType } from '$lib/stores/toast.svelte.js';
 
-  const iconMap: Record<ToastType, string> = {
-    info: 'material-symbols:info',
-    success: 'material-symbols:check-circle',
-    warning: 'material-symbols:warning',
-    error: 'material-symbols:error'
+  const iconMap: Record<ToastType, Component> = {
+    info: IconInfo,
+    success: IconCheckCircle,
+    warning: IconWarning,
+    error: IconError
   };
 
   const alertClassMap: Record<ToastType, string> = {
@@ -20,18 +25,19 @@
 <!-- Positioned fixed at the bottom-end corner, above everything -->
 <div class="toast toast-end toast-bottom z-100 gap-2" aria-live="polite" aria-atomic="false">
   {#each toasts as toast (toast.id)}
+    {@const ToastIcon = iconMap[toast.type]}
     <div
       role="alert"
       class="alert {alertClassMap[toast.type]} flex max-w-sm items-start gap-2 shadow-lg"
     >
-      <Icon icon={iconMap[toast.type]} class="mt-0.5 h-5 w-5 shrink-0" aria-hidden="true" />
+      <ToastIcon class="mt-0.5 h-5 w-5 shrink-0" aria-hidden="true" />
       <span class="flex-1 text-sm">{toast.message}</span>
       <button
         class="btn btn-ghost btn-xs ml-1 shrink-0"
         aria-label="Dismiss"
         onclick={() => removeToast(toast.id)}
       >
-        <Icon icon="material-symbols:close" class="h-4 w-4" aria-hidden="true" />
+        <IconClose class="h-4 w-4" aria-hidden="true" />
       </button>
     </div>
   {/each}
diff --git a/src/lib/components/layout/header/Header.svelte b/src/lib/components/layout/header/Header.svelte
index e73d9a41..fcb1c685 100644
--- a/src/lib/components/layout/header/Header.svelte
+++ b/src/lib/components/layout/header/Header.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
-  import Icon from '@iconify/svelte';
+  import IconMenu from 'virtual:icons/material-symbols/menu';
   import LanguageSwitcher from './LanguageSwitcher.svelte';
   import ThemeToggle from './ThemeToggle.svelte';
   import UserMenu from './UserMenu.svelte';
@@ -20,24 +20,17 @@
 </script>
 
 <header
-  class="
-    border-base-300 bg-base-100 flex h-16 shrink-0 items-center gap-4 border-b
-    px-4
-    lg:px-6
-  "
+  class="border-base-300 bg-base-100 flex h-16 shrink-0 items-center gap-4 border-b px-4 lg:px-6"
 >
   <!-- Mobile menu button -->
   <button
-    class="
-      btn btn-square btn-ghost btn-sm
-      lg:hidden
-    "
+    class="btn btn-ghost btn-sm btn-square lg:hidden"
     onclick={onToggleMobile}
     aria-label={mobileOpen ? m.header_close_nav() : m.header_open_nav()}
     aria-expanded={mobileOpen}
     aria-controls="sidebar"
   >
-    <Icon icon="material-symbols:menu" class="size-5" aria-hidden="true" />
+    <IconMenu class="h-5 w-5" aria-hidden="true" />
   </button>
 
   <h1 class="text-base-content text-lg font-semibold">{title}</h1>
diff --git a/src/lib/components/layout/header/LanguageSwitcher.svelte b/src/lib/components/layout/header/LanguageSwitcher.svelte
index d4f42eed..445e0044 100644
--- a/src/lib/components/layout/header/LanguageSwitcher.svelte
+++ b/src/lib/components/layout/header/LanguageSwitcher.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import { getLocale, setLocale, locales } from '$lib/paraglide/runtime.js';
-  import Icon from '@iconify/svelte';
+  import IconLanguage from 'virtual:icons/material-symbols/language';
+  import IconCheck from 'virtual:icons/material-symbols/check';
 
   type LocaleMeta = {
     code: (typeof locales)[number];
@@ -36,7 +37,7 @@
     ? `${m.language_label()}: ${currentLocaleMeta.label()}`
     : m.language_label()}
 >
-  <Icon icon="material-symbols:language" class="size-5" aria-hidden="true" />
+  <IconLanguage class="h-5 w-5" aria-hidden="true" />
   {#if showLabel}
     <span class="text-sm font-medium">{currentLocaleMeta.label()}</span>
   {/if}
@@ -60,7 +61,7 @@
       >
         <span>{locale.label()}</span>
         {#if isActive}
-          <Icon icon="material-symbols:check" class="size-4" aria-hidden="true" />
+          <IconCheck class="h-4 w-4" aria-hidden="true" />
         {/if}
       </button>
     </li>
diff --git a/src/lib/components/layout/header/ThemeToggle.svelte b/src/lib/components/layout/header/ThemeToggle.svelte
index 17916a5a..9286d392 100644
--- a/src/lib/components/layout/header/ThemeToggle.svelte
+++ b/src/lib/components/layout/header/ThemeToggle.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
   import { browser } from '$app/environment';
-  import Icon from '@iconify/svelte';
   import * as m from '$lib/paraglide/messages.js';
+  import IconLightMode from 'virtual:icons/material-symbols/light-mode';
+  import IconDarkMode from 'virtual:icons/material-symbols/dark-mode';
 
   function prefersDark(): boolean {
     if (!browser) return false;
@@ -26,8 +27,8 @@
   aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
 >
   {#if dark}
-    <Icon icon="material-symbols:dark-mode" class="size-5" aria-hidden="true" />
+    <IconLightMode class="h-5 w-5" aria-hidden="true" />
   {:else}
-    <Icon icon="material-symbols:light-mode" class="size-5" aria-hidden="true" />
+    <IconDarkMode class="h-5 w-5" aria-hidden="true" />
   {/if}
 </button>
diff --git a/src/lib/components/layout/header/UserMenu.svelte b/src/lib/components/layout/header/UserMenu.svelte
index d6cc55ed..0641b735 100644
--- a/src/lib/components/layout/header/UserMenu.svelte
+++ b/src/lib/components/layout/header/UserMenu.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
-  import Icon from '@iconify/svelte';
+  import IconLogout from 'virtual:icons/material-symbols/logout';
   import type { User } from '$lib/types/auth.js';
 
   let { user }: { user: User } = $props();
@@ -18,21 +18,12 @@
 </script>
 
 <div class="dropdown dropdown-end">
-  <button tabindex="0" class="btn btn-circle btn-ghost" aria-label={m.header_user_menu()}>
+  <button tabindex="0" class="btn btn-ghost btn-circle" aria-label={m.header_user_menu()}>
     {#if user.image}
-      <img
-        src={user.image}
-        alt={user.name ?? ''}
-        class="
-        size-8 rounded-full object-cover
-      "
-      />
+      <img src={user.image} alt={user.name ?? ''} class="h-8 w-8 rounded-full object-cover" />
     {:else}
       <span
-        class="
-          bg-primary/10 text-primary flex size-8 items-center justify-center
-          rounded-full text-xs font-semibold
-        "
+        class="bg-primary/10 text-primary flex h-8 w-8 items-center justify-center rounded-full text-xs font-semibold"
         aria-hidden="true"
       >
         {initials}
@@ -42,19 +33,16 @@
   <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
   <ul
     tabindex="0"
-    class="
-      dropdown-content menu border-base-300 bg-base-100 z-10 w-56 rounded-lg
-      border p-1 shadow-lg
-    "
+    class="dropdown-content menu bg-base-100 border-base-300 z-10 w-56 rounded-lg border p-1 shadow-lg"
   >
     <li class="px-3 py-2">
       <p class="text-base-content truncate text-sm font-semibold">{user.name}</p>
       <p class="text-base-content/60 truncate text-xs">{user.email}</p>
     </li>
-    <!-- <li><hr class="border-base-300 my-1" /></li> -->
+    <li><hr class="border-base-300 my-1" /></li>
     <li class="mt-4">
       <a href="/auth/logout" class="text-sm">
-        <Icon icon="material-symbols:logout" class="size-4" aria-hidden="true" />
+        <IconLogout class="h-4 w-4" aria-hidden="true" />
         {m.header_sign_out()}
       </a>
     </li>
diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index 5909262c..2ae05a16 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -1,7 +1,9 @@
 <script lang="ts">
   import { page } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
-  import Icon from '@iconify/svelte';
+  import type { Component } from 'svelte';
+  import IconChevronLeft from 'virtual:icons/material-symbols/chevron-left';
+  import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
   import type { NavItem } from '$lib/types/navigation.js';
   import { getNavSections } from './nav-items.js';
 
@@ -39,18 +41,14 @@
   let sidebarEl: HTMLElement | undefined = $state();
 </script>
 
-{#snippet navIcon(name: string)}
-  {@const iconName = `material-symbols:${name}`}
-  <Icon icon={iconName} class="size-5 shrink-0" aria-hidden="true" />
+{#snippet navIcon(IconComponent: Component)}
+  <IconComponent class="h-5 w-5 shrink-0" aria-hidden="true" />
 {/snippet}
 
 <!-- Mobile backdrop -->
 {#if mobileOpen}
   <button
-    class="
-      fixed inset-0 z-40 bg-black/30 backdrop-blur-sm
-      lg:hidden
-    "
+    class="fixed inset-0 z-40 bg-black/30 backdrop-blur-sm lg:hidden"
     onclick={() => (mobileOpen = false)}
     aria-label={m.sidebar_close_nav()}
     tabindex="-1"
@@ -62,20 +60,15 @@
   bind:this={sidebarEl}
   id="sidebar"
   aria-label={m.sidebar_label()}
-  class="
-    border-base-300 bg-base-100 fixed inset-y-0 left-0 z-50 flex flex-col
-    border-r transition-[transform,width] duration-200 ease-out
-    lg:relative lg:inset-auto lg:translate-x-0
+  class="border-base-300 bg-base-200 fixed inset-y-0 left-0 z-50 flex flex-col border-r
+    transition-[transform,width] duration-200 ease-out
+    lg:relative lg:inset-auto lg:z-auto lg:translate-x-0
     {mobileOpen ? 'translate-x-0' : '-translate-x-full'}
     {collapsed ? 'w-16' : 'w-60'}"
 >
   <!-- Brand -->
-  <div
-    class="
-    border-base-300 flex h-16 shrink-0 items-center gap-3 border-b px-4
-  "
-  >
-    <img src="/stackable-logo-bimi-v2.svg" alt="" class="size-7 shrink-0" />
+  <div class="border-base-300 flex h-16 shrink-0 items-center gap-3 border-b px-4">
+    <img src="/stackable-logo-bimi-v2.svg" alt="" class="h-7 w-7 shrink-0" />
     {#if !collapsed}
       <span class="text-base-content text-lg font-bold tracking-tight">Stackable</span>
     {/if}
@@ -83,7 +76,7 @@
 
   <!-- Navigation -->
   <nav
-    class="flex-1 px-3 py-4 {collapsed ? 'overflow-visible' : 'overflow-x-hidden overflow-y-auto'}"
+    class="flex-1 overflow-x-hidden overflow-y-auto px-3 py-4"
     aria-label={m.sidebar_nav_label()}
   >
     {#each sections as section, sectionIdx (section.title)}
@@ -92,12 +85,7 @@
       {/if}
 
       {#if !collapsed}
-        <div
-          class="
-            text-base-content/60 mb-2 px-3 text-xs font-semibold tracking-wider
-            uppercase
-          "
-        >
+        <div class="text-base-content/60 mb-2 px-3 text-xs font-semibold tracking-wider uppercase">
           {section.title}
         </div>
       {/if}
@@ -110,17 +98,11 @@
               href={item.href}
               onclick={(e) => handleNavClick(e, item)}
               onkeydown={(e) => handleNavKeydown(e, item)}
-              data-tip={collapsed ? item.label : undefined}
-              class="
-                flex min-h-11 items-center gap-3 rounded-lg px-3 py-2
-                text-sm font-medium
-                {collapsed ? 'tooltip tooltip-right before:z-100' : ''}
+              title={collapsed ? item.label : undefined}
+              class="flex min-h-[44px] items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium transition-colors
                 {active
                 ? 'bg-primary/10 text-primary'
-                : `
-                  text-base-content/70
-                  hover:bg-base-content/5 hover:text-base-content
-                `}
+                : 'text-base-content/70 hover:bg-base-content/5 hover:text-base-content'}
                 {item.disabled ? 'opacity-40' : ''}
                 {collapsed ? 'justify-center' : ''}"
               aria-current={active ? 'page' : undefined}
@@ -131,11 +113,7 @@
                 <span class="truncate">{item.label}</span>
                 {#if item.badge}
                   <span
-                    class="
-                      bg-base-300 text-base-content/60 ml-auto rounded-md px-1.5 py-0.5
-                      text-xs font-semibold tracking-wider
-                      uppercase
-                    "
+                    class="bg-base-300 text-base-content/60 ml-auto rounded-md px-1.5 py-0.5 text-xs font-semibold tracking-wider uppercase"
                   >
                     {item.badge}
                   </span>
@@ -149,26 +127,18 @@
   </nav>
 
   <!-- Footer: collapse toggle (desktop only) -->
-  <div
-    class="
-      border-base-300 hidden shrink-0 border-t p-3
-      lg:block
-    "
-  >
+  <div class="border-base-300 hidden shrink-0 border-t p-3 lg:block">
     <button
       onclick={() => (collapsed = !collapsed)}
-      data-tip={collapsed ? m.sidebar_expand() : undefined}
-      class="
-        text-base-content/60 hover:bg-base-content/5 hover:text-base-content flex w-full items-center gap-3 rounded-lg px-3
-        py-2 text-sm
-        font-medium transition-colors hover:cursor-pointer
-        {collapsed ? 'tooltip tooltip-right justify-center' : ''}"
+      class="text-base-content/60 hover:bg-base-content/5 hover:text-base-content flex w-full items-center gap-3 rounded-lg px-3 py-2
+        text-sm font-medium transition-colors hover:cursor-pointer
+        {collapsed ? 'justify-center' : ''}"
       aria-label={collapsed ? m.sidebar_expand() : m.sidebar_collapse()}
     >
       {#if collapsed}
-        <Icon icon="material-symbols:chevron-right" class="size-4 shrink-0" aria-hidden="true" />
+        <IconChevronRight class="h-4 w-4 shrink-0" aria-hidden="true" />
       {:else}
-        <Icon icon="material-symbols:chevron-left" class="size-4 shrink-0" aria-hidden="true" />
+        <IconChevronLeft class="h-4 w-4 shrink-0" aria-hidden="true" />
         <span>{m.sidebar_collapse_label()}</span>
       {/if}
     </button>
diff --git a/src/lib/components/layout/sidebar/nav-items.ts b/src/lib/components/layout/sidebar/nav-items.ts
index 311c9b67..07b938f1 100644
--- a/src/lib/components/layout/sidebar/nav-items.ts
+++ b/src/lib/components/layout/sidebar/nav-items.ts
@@ -1,5 +1,8 @@
 import * as m from '$lib/paraglide/messages.js';
 import type { NavItem, NavSection } from '$lib/types/navigation.js';
+import IconDashboard from 'virtual:icons/material-symbols/dashboard';
+import IconDatabase from 'virtual:icons/material-symbols/database';
+import IconFolder from 'virtual:icons/material-symbols/folder';
 
 export type { NavItem, NavSection };
 
@@ -14,7 +17,7 @@ export function getNavSections(flags: NavFlags = {}): NavSection[] {
     {
       label: m.nav_trino(),
       href: '/trino',
-      icon: 'database'
+      icon: IconDatabase
     }
   ];
 
@@ -22,14 +25,14 @@ export function getNavSections(flags: NavFlags = {}): NavSection[] {
     dataToolsItems.push({
       label: m.nav_storage(),
       href: '/storage',
-      icon: 'folder'
+      icon: IconFolder
     });
   }
 
   return [
     {
       title: m.nav_platform(),
-      items: [{ label: m.nav_dashboard(), href: '/', icon: 'dashboard' }]
+      items: [{ label: m.nav_dashboard(), href: '/', icon: IconDashboard }]
     },
     {
       title: m.nav_data_tools(),
diff --git a/src/lib/components/storage/ContextMenu.svelte b/src/lib/components/storage/ContextMenu.svelte
deleted file mode 100644
index 08e1bed4..00000000
--- a/src/lib/components/storage/ContextMenu.svelte
+++ /dev/null
@@ -1,166 +0,0 @@
-<script lang="ts">
-  import { onMount } from 'svelte';
-  import Icon from '@iconify/svelte';
-  import * as m from '$lib/paraglide/messages.js';
-
-  interface Props {
-    x: number;
-    y: number;
-    selectionCount: number;
-    canPreview: boolean;
-    canDownload: boolean;
-    canPin: boolean;
-    isAlreadyPinned?: boolean;
-    onAction: (action: string) => void;
-    onClose: () => void;
-  }
-
-  let {
-    x,
-    y,
-    selectionCount,
-    canPreview,
-    canDownload,
-    canPin,
-    isAlreadyPinned = false,
-    onAction,
-    onClose
-  }: Props = $props();
-
-  let menuEl = $state<HTMLUListElement | null>(null);
-
-  // Adjust position so menu stays within viewport
-  const adjustedPos = $derived.by(() => {
-    if (!menuEl) return { left: x, top: y };
-    const rect = menuEl.getBoundingClientRect();
-    return {
-      left: x + rect.width > window.innerWidth ? x - rect.width : x,
-      top: y + rect.height > window.innerHeight ? y - rect.height : y
-    };
-  });
-
-  function emit(action: string) {
-    onAction(action);
-    onClose();
-  }
-
-  function handleKeydown(e: KeyboardEvent) {
-    if (e.key === 'Escape') onClose();
-  }
-
-  function handleOutsideClick(e: MouseEvent) {
-    if (menuEl && !menuEl.contains(e.target as Node)) onClose();
-  }
-
-  onMount(() => {
-    menuEl?.focus();
-    document.addEventListener('click', handleOutsideClick, true);
-    return () => document.removeEventListener('click', handleOutsideClick, true);
-  });
-
-  const actions = [
-    {
-      key: 'preview',
-      icon: 'material-symbols:visibility',
-      label: () => m.storage_action_preview(),
-      disabled: () => !canPreview
-    },
-    {
-      key: 'download',
-      icon: 'material-symbols:download',
-      label: () => m.storage_action_download(),
-      disabled: () => !canDownload
-    },
-    {
-      key: 'pin',
-      icon: 'material-symbols:push-pin-outline',
-      label: () => m.storage_action_pin(),
-      disabled: () => !canPin,
-      hidden: () => !canPin || isAlreadyPinned
-    },
-    {
-      key: 'unpin',
-      icon: 'material-symbols:push-pin',
-      label: () => m.storage_action_unpin(),
-      disabled: () => !isAlreadyPinned,
-      hidden: () => !isAlreadyPinned
-    }
-  ];
-
-  const dangerActions = [
-    {
-      key: 'delete',
-      icon: 'material-symbols:delete',
-      label: () => m.storage_action_delete(),
-      disabled: () => selectionCount === 0,
-      class: 'text-error'
-    }
-  ];
-</script>
-
-<svelte:window onkeydown={handleKeydown} />
-
-<ul
-  bind:this={menuEl}
-  class="
-    menu menu-sm border-base-300 bg-base-100 absolute z-50 w-48 rounded-lg
-    border p-1 shadow-lg
-  "
-  role="menu"
-  tabindex="-1"
-  style="left: {adjustedPos.left}px; top: {adjustedPos.top}px;"
->
-  <li class="menu-title p-0" role="none">
-    <div class="menu-title flex items-center justify-between py-1 pr-0 pl-2">
-      <span class="text-base-content/70 text-xs font-medium">
-        {m.storage_context_menu_actions()}
-      </span>
-
-      <button
-        type="button"
-        role="menuitem"
-        class="btn btn-ghost btn-xs"
-        aria-label="Close"
-        onclick={onclose}
-      >
-        <Icon icon="mdi:close" class="size-4" aria-hidden="true" />
-      </button>
-    </div>
-  </li>
-
-  {#each actions as act (act.key)}
-    {#if !act.hidden?.()}
-      {@const disabled = act.disabled()}
-      <li role="none" class:menu-disabled={disabled}>
-        <button
-          role="menuitem"
-          class="justify-start"
-          onclick={() => emit(act.key)}
-          {disabled}
-          aria-disabled={disabled}
-        >
-          <Icon icon={act.icon} class="mr-2 size-4 shrink-0" aria-hidden="true" />
-          {act.label()}
-        </button>
-      </li>
-    {/if}
-  {/each}
-
-  {#each dangerActions as act (act.key)}
-    <li role="none">
-      <button
-        role="menuitem"
-        class={'justify-start ' + (act.class ?? '')}
-        onclick={() => emit(act.key)}
-        disabled={act.disabled()}
-      >
-        <Icon
-          icon={act.icon}
-          class={'mr-2 h-4 w-4 shrink-0 ' + (act.class ?? '')}
-          aria-hidden="true"
-        />
-        {act.label()}
-      </button>
-    </li>
-  {/each}
-</ul>
diff --git a/src/lib/components/storage/FileExplorer.svelte b/src/lib/components/storage/FileExplorer.svelte
deleted file mode 100644
index dc7d6870..00000000
--- a/src/lib/components/storage/FileExplorer.svelte
+++ /dev/null
@@ -1,390 +0,0 @@
-<script lang="ts">
-  import * as m from '$lib/paraglide/messages.js';
-  import { invalidateAll } from '$app/navigation';
-  import StorageBreadcrumb from './StorageBreadcrumb.svelte';
-  import ObjectTable from './ObjectTable.svelte';
-  import ContextMenu from './ContextMenu.svelte';
-  import PreviewModal from './PreviewModal.svelte';
-  import UploadModal from './UploadModal.svelte';
-  import Pagination from '$lib/components/Pagination.svelte';
-  import type { StoragePage } from '$lib/storage/types.js';
-  import { SvelteSet } from 'svelte/reactivity';
-  import { executeAction } from './actions/index.js';
-  import { ActionError } from './actions/types.js';
-  import { getActionErrorMessage } from './actions/errors.js';
-  import { addToast } from '$lib/stores/toast.svelte.js';
-  import DeleteConfirmModal from './DeleteConfirmModal.svelte';
-
-  import { untrack } from 'svelte';
-  import { navigating } from '$app/state';
-  import { initPageSize, type PageSize } from '$lib/types/pagination.js';
-  import { pinLocation, unpinLocation, isPinned } from '$lib/stores/pinned-locations.svelte.js';
-  import { recordLocationVisit, recordFileVisit } from '$lib/stores/recent-items.svelte.js';
-
-  interface Props {
-    bucket: string;
-    objects: StoragePage;
-    prefix: string;
-    onNavigate: (
-      prefix: string,
-      continuationToken?: string | null,
-      pageSize?: number | null
-    ) => void;
-  }
-
-  let { bucket, objects, prefix, onNavigate }: Props = $props();
-
-  // ── Derived folder/file lists ─────────────────────────────────────────────
-  const folders = $derived(objects.objects.filter((o) => o.isDirectory));
-  const files = $derived(objects.objects.filter((o) => !o.isDirectory));
-
-  // ── Selection state ───────────────────────────────────────────────────────
-  let selectedKeys = $state<Set<string>>(new Set<string>());
-  let selectionMode = $state(false);
-
-  // Stack of previous continuation tokens for deterministic "Prev" navigation.
-  let prevTokens = $state<(string | null)[]>([]);
-
-  const STORAGE_KEY = 'storage_page_size';
-
-  let pageSize = $state<PageSize>(initPageSize(STORAGE_KEY));
-
-  // Clear selection on navigation
-  $effect(() => {
-    void prefix;
-    selectedKeys = new SvelteSet<string>();
-  });
-
-  // Record location visit whenever the current bucket/prefix changes.
-  // untrack() prevents the store reads inside recordLocationVisit from
-  // creating a dependency that would cause this effect to re-run on every write.
-  $effect(() => {
-    const b = bucket;
-    const p = prefix;
-    untrack(() => recordLocationVisit(b, p));
-  });
-
-  function toggleSelectionMode() {
-    selectionMode = !selectionMode;
-    if (!selectionMode) selectedKeys = new SvelteSet<string>();
-  }
-
-  function toggleSelect(key: string, force = false) {
-    if (force || selectionMode) {
-      if (force && !selectionMode) selectionMode = true;
-      const next = new SvelteSet<string>(selectedKeys);
-      if (next.has(key)) next.delete(key);
-      else next.add(key);
-      selectedKeys = next;
-    } else {
-      selectedKeys = new SvelteSet<string>([key]);
-    }
-  }
-
-  function selectAll(checked: boolean) {
-    if (checked) {
-      selectedKeys = new SvelteSet<string>([
-        ...folders.map((f) => f.key),
-        ...files.map((f) => f.key)
-      ]);
-    } else {
-      selectedKeys = new SvelteSet<string>();
-    }
-  }
-
-  const totalItemCount = $derived(folders.length + files.length);
-  const allSelected = $derived(totalItemCount > 0 && selectedKeys.size >= totalItemCount);
-  const someSelected = $derived(selectedKeys.size > 0 && selectedKeys.size < totalItemCount);
-  const showCheckboxes = $derived(selectionMode || selectedKeys.size > 0);
-
-  const selectedFiles = $derived(files.filter((f) => selectedKeys.has(f.key)));
-  const selectedFolders = $derived(folders.filter((f) => selectedKeys.has(f.key)));
-
-  const currentPage = $derived(prevTokens.length + 1);
-
-  // ── Loading state ─────────────────────────────────────────────────────────
-  let loading = $state(false);
-  let deleting = $state(false); // true while the delete API call is in flight
-
-  // Show loading overlay for any navigation (including sidebar/grid links).
-  $effect(() => {
-    if (navigating) loading = true;
-  });
-
-  // Clear loading when new objects arrive from the server
-  $effect(() => {
-    void objects;
-    loading = false;
-  });
-
-  function handleNavigate(prefix: string) {
-    loading = true;
-    prevTokens = [];
-    onNavigate(prefix, null, pageSize);
-  }
-
-  function handlePageNavigate(token: string | null) {
-    // push current page token so we can go back deterministically
-    prevTokens = [...prevTokens, objects.continuationToken ?? null];
-    loading = true;
-    onNavigate(prefix, token, pageSize);
-  }
-
-  function goFirst() {
-    prevTokens = [];
-    loading = true;
-    onNavigate(prefix, null, pageSize);
-  }
-
-  function goPrev() {
-    const copy = [...prevTokens];
-    const last = copy.pop() ?? null;
-    prevTokens = copy;
-    loading = true;
-    onNavigate(prefix, last, pageSize);
-  }
-
-  // ── Context menu ──────────────────────────────────────────────────────────
-  let ctxMenu = $state<{ x: number; y: number } | null>(null);
-
-  let ctxKey = $state<string | null>(null);
-
-  const ctxFileObj = $derived(ctxKey ? (files.find((f) => f.key === ctxKey) ?? null) : null);
-  const ctxIsFile = $derived(ctxFileObj !== null);
-  const canPin = $derived(ctxKey !== null && !ctxIsFile);
-  const ctxIsPinned = $derived(ctxKey !== null && !ctxIsFile && isPinned(bucket, ctxKey));
-
-  function openContextMenu(e: MouseEvent, key: string) {
-    e.preventDefault();
-    e.stopPropagation();
-
-    if (!selectedKeys.has(key)) {
-      selectedKeys = selectedKeys.size === 0 ? new SvelteSet<string>([key]) : selectedKeys.add(key);
-    }
-
-    ctxKey = key;
-    ctxMenu = { x: e.clientX, y: e.clientY };
-  }
-
-  // ── Modal state ───────────────────────────────────────────────────────────
-  let showDeleteModal = $state(false);
-  let pendingDeleteKeys = $state<string[]>([]);
-  let showPreviewModal = $state(false);
-  let previewKey = $state<string | null>(null);
-  let showUploadModal = $state(false);
-
-  // ── Action dispatch ───────────────────────────────────────────────────────
-
-  async function handleAction(action: string) {
-    const ctxFile = ctxKey && files.find((f) => f.key === ctxKey) ? ctxKey : null;
-    const key = ctxFile ?? selectedFiles[0]?.key;
-
-    // Effective selection for context actions:
-    const effectiveSelectedFiles = ctxFile
-      ? [files.find((f) => f.key === ctxFile)!]
-      : selectedFiles;
-
-    const effectiveSelectedKeys = ctxFile ? [ctxFile] : [...selectedKeys];
-
-    const ctx = {
-      bucket,
-      key,
-      selectedKeys: effectiveSelectedKeys,
-      selectedFiles: effectiveSelectedFiles
-    };
-
-    if (action === 'delete') {
-      pendingDeleteKeys = [...selectedKeys];
-      showDeleteModal = true;
-      return;
-    }
-
-    try {
-      if (action === 'pin') {
-        pinLocation(bucket, ctxKey ?? prefix);
-      } else if (action === 'unpin') {
-        unpinLocation(bucket, ctxKey ?? prefix);
-      } else if (action === 'download' || action === 'upload' || action === 'preview') {
-        // Record file visit for the acted-on file(s)
-        for (const f of effectiveSelectedFiles) {
-          recordFileVisit(bucket, f.key, f.size);
-        }
-        const res = await executeAction(action, ctx);
-        if (res?.previewKey) {
-          previewKey = res.previewKey;
-          showPreviewModal = true;
-        } else if (res?.openUpload) {
-          showUploadModal = true;
-        } else if (res?.unimplemented) {
-          addToast('warning', `${action} — not implemented`);
-        }
-      } else {
-        addToast('warning', `${action} — not implemented`);
-      }
-    } catch (err: unknown) {
-      addToast(
-        'error',
-        err instanceof ActionError ? getActionErrorMessage(err) : m.storage_download_error_unknown()
-      );
-    }
-  }
-
-  function handleUploadSuccess() {
-    loading = true;
-    void invalidateAll();
-  }
-
-  async function confirmDelete() {
-    showDeleteModal = false;
-    const keys = pendingDeleteKeys;
-    pendingDeleteKeys = [];
-    deleting = true;
-    try {
-      const result = await executeAction('delete', { bucket, selectedKeys: keys });
-      if (result.failedKeys && result.failedKeys.length > 0) {
-        addToast('warning', m.storage_delete_partial_failure({ count: result.failedKeys.length }));
-      }
-      selectedKeys = new SvelteSet<string>();
-      selectionMode = false;
-      loading = true;
-      await invalidateAll();
-    } catch (err: unknown) {
-      loading = false;
-      let msg = m.storage_delete_error_unknown();
-      if (err instanceof ActionError) {
-        if (err.code === 'not_connected') msg = m.storage_delete_error_not_connected();
-        else if (err.code === 'access_denied') msg = m.storage_delete_error_access_denied();
-        else if (err.code === 'server_error') msg = m.storage_delete_error_server_error();
-      }
-      addToast('error', msg);
-    } finally {
-      deleting = false;
-    }
-  }
-
-  function cancelDelete() {
-    showDeleteModal = false;
-    pendingDeleteKeys = [];
-  }
-
-  // ── Keyboard shortcuts ────────────────────────────────────────────────────
-  function handleGlobalKeydown(e: KeyboardEvent) {
-    if (showDeleteModal) return;
-    if (e.key === 'Delete' && selectedKeys.size > 0) {
-      pendingDeleteKeys = [...selectedKeys];
-      showDeleteModal = true;
-    } else if (e.key === 'Escape') {
-      if (ctxMenu) {
-        selectedKeys.delete(ctxKey!);
-        ctxMenu = null;
-        ctxKey = null;
-      }
-      selectionMode = false;
-      selectedKeys = new SvelteSet<string>();
-    }
-  }
-</script>
-
-<svelte:window onkeydown={handleGlobalKeydown} />
-
-<!-- svelte-ignore a11y_click_events_have_key_events -->
-<!-- svelte-ignore a11y_no_static_element_interactions -->
-<div
-  class="bg-base-100 flex flex-1 flex-col overflow-hidden"
-  onclick={(e) => {
-    if (!(e.target as HTMLElement).closest('tr')) selectedKeys = new SvelteSet<string>();
-  }}
->
-  <StorageBreadcrumb
-    {bucket}
-    {prefix}
-    folderCount={folders.length}
-    fileCount={files.length}
-    {selectionMode}
-    onNavigate={handleNavigate}
-    onToggleSelectionMode={toggleSelectionMode}
-    onUpload={() => (showUploadModal = true)}
-  />
-
-  <div class="relative min-h-0 flex-1 overflow-hidden">
-    {#if loading || deleting}
-      <div
-        class="
-          bg-base-100/70 absolute inset-0 z-20 flex items-center justify-center
-        "
-        aria-live="polite"
-        aria-label={m.storage_loading()}
-      >
-        <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
-      </div>
-    {/if}
-    <ObjectTable
-      {prefix}
-      {folders}
-      {files}
-      {selectedKeys}
-      {ctxKey}
-      {showCheckboxes}
-      {selectionMode}
-      {allSelected}
-      {someSelected}
-      onNavigate={handleNavigate}
-      onSelectAll={selectAll}
-      onToggleSelect={toggleSelect}
-      onContextMenu={openContextMenu}
-      onAction={handleAction}
-    />
-  </div>
-
-  <!-- Fixed pagination bar at bottom -->
-  <div class="border-base-200/40 bg-base-100 sticky bottom-0 z-10 border-t px-4 py-3">
-    <Pagination
-      bind:pageSize
-      storageKey="storage_page_size"
-      pageSizeLabel={m.storage_page_size()}
-      infoLabel="{m.storage_page()} {currentPage}"
-      current={prevTokens.length}
-      hasNext={objects.hasNextPage}
-      onfirst={goFirst}
-      onprev={goPrev}
-      onnext={() => handlePageNavigate(objects.nextContinuationToken ?? null)}
-      onpagesizechange={() => {
-        prevTokens = [];
-        goFirst();
-      }}
-    />
-  </div>
-</div>
-
-<!-- Context menu -->
-{#if ctxMenu}
-  <ContextMenu
-    x={ctxMenu.x}
-    y={ctxMenu.y}
-    selectionCount={selectedKeys.size}
-    canPreview={(selectedFiles.length === 1 && selectedFolders.length === 0) ||
-      (ctxKey !== null && files.some((f) => f.key === ctxKey))}
-    canDownload={selectedFiles.length > 0 || ctxIsFile}
-    {canPin}
-    isAlreadyPinned={ctxIsPinned}
-    onAction={handleAction}
-    onClose={() => {
-      ctxMenu = null;
-      ctxKey = null;
-    }}
-  />
-{/if}
-
-<!-- Delete confirmation modal -->
-<DeleteConfirmModal
-  bind:open={showDeleteModal}
-  keys={pendingDeleteKeys}
-  onConfirm={confirmDelete}
-  onCancel={cancelDelete}
-/>
-
-<!-- Preview modal -->
-<PreviewModal bind:open={showPreviewModal} {bucket} objectKey={previewKey} />
-
-<!-- Upload modal -->
-<UploadModal bind:open={showUploadModal} {bucket} {prefix} onSuccess={handleUploadSuccess} />
diff --git a/src/lib/components/storage/FileRow.svelte b/src/lib/components/storage/FileRow.svelte
deleted file mode 100644
index 5c39e0eb..00000000
--- a/src/lib/components/storage/FileRow.svelte
+++ /dev/null
@@ -1,90 +0,0 @@
-<script lang="ts">
-  import Icon from '@iconify/svelte';
-  import { fileIconKind, iconColors, keyToName, formatFileSize } from '$lib/storage/utils.js';
-  import type { StorageObject } from '$lib/storage/types.js';
-  import TimestampDisplay from '$lib/components/storage/TimestampDisplay.svelte';
-
-  interface Props {
-    file: StorageObject;
-    selected: boolean;
-    isCtx: boolean;
-    showCheckboxes: boolean;
-    onToggleSelect: (key: string, force?: boolean) => void;
-    onContextMenu: (e: MouseEvent, key: string) => void;
-    onAction: (action: string) => void;
-  }
-
-  let { file, selected, isCtx, showCheckboxes, onToggleSelect, onContextMenu, onAction }: Props =
-    $props();
-
-  const kind = $derived(fileIconKind(file.contentType));
-  const color = $derived(iconColors[kind]);
-</script>
-
-<tr
-  class="
-    group cursor-pointer select-none
-    {isCtx
-    ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
-    : selected
-      ? 'bg-primary/10 hover:bg-primary/15'
-      : 'hover:bg-base-200/60'}"
-  onclick={(e) => onToggleSelect(file.key, e.ctrlKey || e.metaKey)}
-  ondblclick={() => onAction('preview')}
-  oncontextmenu={(e) => onContextMenu(e, file.key)}
->
-  <td class="pr-0">
-    <input
-      type="checkbox"
-      class="checkbox checkbox-xs {!showCheckboxes ? 'pointer-events-none invisible' : ''}"
-      checked={selected}
-      onchange={() => onToggleSelect(file.key, true)}
-      onclick={(e) => e.stopPropagation()}
-      disabled={!showCheckboxes}
-      aria-label="Select {keyToName(file.key)}"
-    />
-  </td>
-  <td>
-    <div class="flex items-center gap-2.5">
-      {#if kind === 'image'}
-        <Icon icon="material-symbols:image" class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {:else if kind === 'code'}
-        <Icon icon="material-symbols:code" class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {:else if kind === 'archive'}
-        <Icon icon="material-symbols:archive" class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {:else if kind === 'pdf'}
-        <Icon
-          icon="material-symbols:picture-as-pdf"
-          class="size-5 shrink-0 {color}"
-          aria-hidden="true"
-        />
-      {:else}
-        <Icon
-          icon="material-symbols:description"
-          class="size-5 shrink-0 {color}"
-          aria-hidden="true"
-        />
-      {/if}
-      <span class="truncate">{keyToName(file.key)}</span>
-      {#if file.contentType}
-        <span class="badge badge-ghost badge-sm ml-1 shrink-0 text-[10px] opacity-50">
-          {file.contentType.split('/').at(-1) ?? ''}
-        </span>
-      {/if}
-    </div>
-  </td>
-  <td class="text-right font-mono text-sm">{formatFileSize(file.size)}</td>
-  <td class="text-base-content/60 text-sm"
-    ><TimestampDisplay date={file.lastModified} relative /></td
-  >
-  <td class="w-10 py-0 pr-2 text-right">
-    <button
-      class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
-      title="Actions"
-      aria-label="Actions for {keyToName(file.key)}"
-      onclick={(e) => onContextMenu(e, file.key)}
-    >
-      <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
-    </button>
-  </td>
-</tr>
diff --git a/src/lib/components/storage/ObjectTable.svelte b/src/lib/components/storage/ObjectTable.svelte
deleted file mode 100644
index 9d383250..00000000
--- a/src/lib/components/storage/ObjectTable.svelte
+++ /dev/null
@@ -1,156 +0,0 @@
-<script lang="ts">
-  import * as m from '$lib/paraglide/messages.js';
-  import Icon from '@iconify/svelte';
-  import SelectionToolbar from './SelectionToolbar.svelte';
-  import FolderRow from './FolderRow.svelte';
-  import FileRow from './FileRow.svelte';
-  import type { StorageObject } from '$lib/storage/types.js';
-
-  interface Props {
-    prefix: string;
-    folders: StorageObject[];
-    files: StorageObject[];
-    selectedKeys: Set<string>;
-    ctxKey: string | null;
-    showCheckboxes: boolean;
-    selectionMode: boolean;
-    allSelected: boolean;
-    someSelected: boolean;
-    onNavigate: (prefix: string, continuationToken?: string | null, pageSize?: number) => void;
-    onSelectAll: (checked: boolean) => void;
-    onToggleSelect: (key: string, force?: boolean) => void;
-    onContextMenu: (e: MouseEvent, key: string) => void;
-    onAction: (action: string) => void;
-  }
-
-  let {
-    prefix,
-    folders,
-    files,
-    selectedKeys,
-    ctxKey,
-    showCheckboxes,
-    selectionMode,
-    allSelected,
-    someSelected,
-    onNavigate,
-    onSelectAll,
-    onToggleSelect,
-    onContextMenu,
-    onAction
-  }: Props = $props();
-
-  const selectedCount = $derived(selectedKeys.size);
-  const canPreview = $derived(
-    files.filter((f) => selectedKeys.has(f.key)).length === 1 &&
-      folders.filter((f) => selectedKeys.has(f.key)).length === 0
-  );
-  const selectedFileCount = $derived(files.filter((f) => selectedKeys.has(f.key)).length);
-  const canDownload = $derived(
-    selectedFileCount === 1 && folders.filter((f) => selectedKeys.has(f.key)).length === 0
-  );
-
-  let selectAllEl = $state<HTMLInputElement | null>(null);
-  $effect(() => {
-    if (selectAllEl) selectAllEl.indeterminate = someSelected;
-  });
-
-  function navigateUp() {
-    if (!prefix) return;
-    const withoutTrailing = prefix.slice(0, -1);
-    const lastSlash = withoutTrailing.lastIndexOf('/');
-    onNavigate(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
-  }
-</script>
-
-<div class="preview-scroll h-full overflow-x-auto overflow-y-auto">
-  <table class="table-sm table">
-    <thead class="bg-base-100 sticky top-0 z-10">
-      <!-- Column headers -->
-      <tr
-        class="
-          bg-base-200 text-base-content/50 text-xs tracking-wide uppercase
-        "
-      >
-        <th class="w-8 pr-0">
-          <input
-            type="checkbox"
-            class="
-              checkbox checkbox-xs
-              {!showCheckboxes ? `pointer-events-none invisible` : ''}"
-            bind:this={selectAllEl}
-            checked={allSelected}
-            onchange={(e) => onSelectAll(e.currentTarget.checked)}
-            onclick={(e) => e.stopPropagation()}
-            disabled={!showCheckboxes}
-            aria-label="Select all"
-          />
-        </th>
-        <th class="w-7/12 font-semibold">{m.storage_header_name()}</th>
-        <th class="w-2/12 text-right font-semibold">{m.storage_header_size()}</th>
-        <th class="w-3/12 font-semibold">{m.storage_header_last_modified()}</th>
-        <th class="w-10"></th>
-      </tr>
-
-      <!-- Selection action toolbar -->
-      <SelectionToolbar {selectedCount} {canPreview} {canDownload} {onAction} />
-    </thead>
-
-    <tbody>
-      <!-- Parent directory row -->
-      {#if prefix}
-        <tr class="hover cursor-pointer" onclick={navigateUp}>
-          <td class="pr-0"></td>
-          <td colspan={3}>
-            <div class="text-base-content/50 flex items-center gap-2">
-              <Icon icon="material-symbols:arrow-back" class="size-4 shrink-0" aria-hidden="true" />
-              <span class="tracking-widest italic" aria-label={m.storage_parent_dir()}>...</span>
-            </div>
-          </td>
-          <td></td>
-        </tr>
-      {/if}
-
-      <!-- Folders -->
-      {#each folders as folder (folder.key)}
-        <FolderRow
-          {folder}
-          selected={selectedKeys.has(folder.key)}
-          isCtx={ctxKey === folder.key}
-          {showCheckboxes}
-          {selectionMode}
-          {onNavigate}
-          {onToggleSelect}
-          {onContextMenu}
-        />
-      {/each}
-
-      <!-- Files -->
-      {#each files as file (file.key)}
-        <FileRow
-          {file}
-          selected={selectedKeys.has(file.key)}
-          isCtx={ctxKey === file.key}
-          {showCheckboxes}
-          {onToggleSelect}
-          {onContextMenu}
-          {onAction}
-        />
-      {/each}
-
-      <!-- Empty folder -->
-      {#if folders.length === 0 && files.length === 0}
-        <tr>
-          <td colspan={5} class="text-base-content/40 py-16 text-center">
-            <Icon
-              icon="material-symbols:folder-open"
-              class="mx-auto mb-3 size-10 opacity-30"
-              aria-hidden="true"
-            />
-            {m.storage_bucket_empty()}
-          </td>
-        </tr>
-      {/if}
-    </tbody>
-  </table>
-</div>
diff --git a/src/lib/components/storage/actions/delete.ts b/src/lib/components/storage/actions/delete.ts
deleted file mode 100644
index ecdf3cfa..00000000
--- a/src/lib/components/storage/actions/delete.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-import type { ActionContext, ActionResult } from './types';
-import { ActionError } from './types';
-import { deleteObjects as clientDelete, DeleteError } from '$lib/storage/delete.js';
-
-export default async function (ctx: ActionContext): Promise<ActionResult> {
-  const keys = ctx.selectedKeys ?? (ctx.key ? [ctx.key] : []);
-  if (!keys.length) throw new ActionError('no_key', 'No keys specified for deletion');
-
-  try {
-    const result = await clientDelete(ctx.bucket, keys);
-    return {
-      success: true,
-      failedKeys: result.failed.map((f) => ({ key: f.key, message: f.message }))
-    };
-  } catch (err: unknown) {
-    if (err instanceof DeleteError) {
-      throw new ActionError(err.code, err.message);
-    }
-    throw err;
-  }
-}
diff --git a/src/lib/components/storage/actions/download.ts b/src/lib/components/storage/actions/download.ts
deleted file mode 100644
index c9bad028..00000000
--- a/src/lib/components/storage/actions/download.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-import type { ActionContext, ActionResult } from './types';
-import { ActionError } from './types';
-import { downloadObject as clientDownload, DownloadError } from '$lib/storage/download.js';
-
-export default async function downloadAction(ctx: ActionContext): Promise<ActionResult> {
-  const key = ctx.key ?? ctx.selectedFiles?.[0]?.key;
-  if (!key) throw new ActionError('no_key', 'No key specified for download');
-
-  try {
-    await clientDownload(ctx.bucket, key);
-    return { success: true };
-  } catch (err: unknown) {
-    if (err instanceof DownloadError) {
-      // map DownloadError to ActionError so callers only need to handle ActionError
-      throw new ActionError(err.code, err.message);
-    }
-    throw err;
-  }
-}
diff --git a/src/lib/components/storage/actions/index.ts b/src/lib/components/storage/actions/index.ts
deleted file mode 100644
index b9a9322a..00000000
--- a/src/lib/components/storage/actions/index.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import type { ActionContext, ActionResult, ActionName } from './types';
-import download from './download';
-import preview from './preview';
-import upload from './upload';
-import deleteAction from './delete';
-
-const actions: Record<ActionName, (ctx: ActionContext) => Promise<ActionResult>> = {
-  download,
-  upload,
-  preview,
-  delete: deleteAction
-};
-
-export async function executeAction(name: ActionName, ctx: ActionContext): Promise<ActionResult> {
-  const handler = actions[name];
-  if (!handler) return { unimplemented: true };
-  return await handler(ctx);
-}
-
-export { actions };
diff --git a/src/lib/components/storage/actions/preview.ts b/src/lib/components/storage/actions/preview.ts
deleted file mode 100644
index ad3337c1..00000000
--- a/src/lib/components/storage/actions/preview.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import type { ActionContext, ActionResult } from './types';
-import { ActionError } from './types';
-
-export default async function previewAction(ctx: ActionContext): Promise<ActionResult> {
-  const key = ctx.key ?? ctx.selectedFiles?.[0]?.key;
-  if (!key) throw new ActionError('no_key', 'No key specified for preview');
-  return { previewKey: key };
-}
diff --git a/src/lib/components/storage/actions/types.ts b/src/lib/components/storage/actions/types.ts
deleted file mode 100644
index a9470e7c..00000000
--- a/src/lib/components/storage/actions/types.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-export type ActionResult = {
-  success?: true;
-  unimplemented?: true;
-  previewKey?: string;
-  openUpload?: true;
-  failedKeys?: Array<{ key: string; message?: string }>;
-};
-
-export type ActionName = 'download' | 'upload' | 'preview' | 'delete';
-
-export class ActionError extends Error {
-  constructor(
-    public readonly code: string,
-    message: string
-  ) {
-    super(message);
-    this.name = 'ActionError';
-  }
-}
-
-export type ActionContext = {
-  bucket: string;
-  key?: string;
-  selectedKeys?: string[];
-  selectedFiles?: Array<{ key: string }>;
-};
diff --git a/src/lib/components/storage/actions/upload.ts b/src/lib/components/storage/actions/upload.ts
deleted file mode 100644
index 41f9b9a9..00000000
--- a/src/lib/components/storage/actions/upload.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import type { ActionContext, ActionResult } from './types';
-
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-export default async function uploadAction(_ctx: ActionContext): Promise<ActionResult> {
-  // The upload workflow is driven by UploadModal, which is opened directly
-  // by the StorageBreadcrumb toolbar button. This action handler returns
-  // openUpload so callers wiring through executeAction can also trigger it.
-  return { openUpload: true };
-}
-
-// Re-export upload utilities so UploadModal can import from a single location.
-export { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
-export type { UploadErrorCode } from '$lib/storage/upload.js';
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
new file mode 100644
index 00000000..59976dbb
--- /dev/null
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -0,0 +1,161 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import type { Component } from 'svelte';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconVisibility from 'virtual:icons/material-symbols/visibility';
+  import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
+  import IconPushPin from 'virtual:icons/material-symbols/push-pin';
+  import IconDelete from 'virtual:icons/material-symbols/delete';
+  import * as m from '$lib/paraglide/messages.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import type { ActionName } from '$lib/storage/types.js';
+
+  const storage = getStorageState();
+
+  // Position and derived state from context
+  const x = $derived(storage.contextMenu?.x ?? 0);
+  const y = $derived(storage.contextMenu?.y ?? 0);
+  const selectionCount = $derived(storage.selectedKeys.size);
+  const canPreview = $derived(
+    (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0) ||
+      (storage.contextMenu !== null && storage.ctxIsFile)
+  );
+  const canDownload = $derived(storage.selectedFiles.length > 0 || storage.ctxIsFile);
+
+  let menuEl = $state<HTMLUListElement | null>(null);
+
+  // Adjust position so menu stays within viewport
+  const adjustedPos = $derived.by(() => {
+    if (!menuEl) return { left: x, top: y };
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left: x + rect.width > window.innerWidth ? x - rect.width : x,
+      top: y + rect.height > window.innerHeight ? y - rect.height : y
+    };
+  });
+
+  function emit(action: string) {
+    storage.executeAction(action as ActionName);
+    storage.contextMenu = null;
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (e.key === 'Escape') storage.closeContextMenu();
+  }
+
+  function handleOutsideClick(e: MouseEvent) {
+    if (menuEl && !menuEl.contains(e.target as Node)) storage.closeContextMenu();
+  }
+
+  onMount(() => {
+    menuEl?.focus();
+    document.addEventListener('click', handleOutsideClick, true);
+    return () => document.removeEventListener('click', handleOutsideClick, true);
+  });
+
+  const actions = $derived([
+    {
+      key: 'preview' as ActionName,
+      icon: IconVisibility as Component,
+      label: m.storage_action_preview(),
+      disabled: !canPreview,
+      hidden: false
+    },
+    {
+      key: 'download' as ActionName,
+      icon: IconDownload as Component,
+      label: m.storage_action_download(),
+      disabled: !canDownload,
+      hidden: false
+    },
+    {
+      key: 'pin' as ActionName,
+      icon: IconPushPinOutline as Component,
+      label: m.storage_action_pin(),
+      disabled: !storage.canPin,
+      hidden: !storage.canPin || storage.ctxIsPinned
+    },
+    {
+      key: 'unpin' as ActionName,
+      icon: IconPushPin as Component,
+      label: m.storage_action_unpin(),
+      disabled: !storage.ctxIsPinned,
+      hidden: !storage.ctxIsPinned
+    }
+  ]);
+
+  const dangerActions = $derived([
+    {
+      key: 'delete' as ActionName,
+      icon: IconDelete as Component,
+      label: m.storage_action_delete(),
+      disabled: selectionCount === 0,
+      class: 'text-error'
+    }
+  ]);
+</script>
+
+<svelte:window onkeydown={handleKeydown} />
+
+<ul
+  bind:this={menuEl}
+  class="
+    menu menu-sm border-base-300 bg-base-100 absolute z-50 w-48 rounded-lg
+    border p-1 shadow-lg
+  "
+  role="menu"
+  tabindex="-1"
+  style="left: {adjustedPos.left}px; top: {adjustedPos.top}px;"
+>
+  <li class="menu-title p-0" role="none">
+    <div class="menu-title flex items-center justify-between py-1 pr-0 pl-2">
+      <span class="text-base-content/70 text-xs font-medium">
+        {m.storage_context_menu_actions()}
+      </span>
+
+      <button
+        type="button"
+        role="menuitem"
+        class="btn btn-ghost btn-xs"
+        aria-label="Close"
+        onclick={() => storage.closeContextMenu()}
+      >
+        <IconClose class="size-4" aria-hidden="true" />
+      </button>
+    </div>
+  </li>
+
+  {#each actions as act (act.key)}
+    {#if !act.hidden}
+      {@const ActIcon = act.icon}
+      <li role="none" class:menu-disabled={act.disabled}>
+        <button
+          role="menuitem"
+          class="justify-start"
+          onclick={() => emit(act.key)}
+          disabled={act.disabled}
+          aria-disabled={act.disabled}
+        >
+          <ActIcon class="mr-2 size-4 shrink-0" aria-hidden="true" />
+          {act.label}
+        </button>
+      </li>
+    {/if}
+  {/each}
+
+  {#each dangerActions as act (act.key)}
+    {@const ActIcon = act.icon}
+    <li role="none">
+      <button
+        role="menuitem"
+        class={'justify-start ' + (act.class ?? '')}
+        onclick={() => emit(act.key)}
+        disabled={act.disabled}
+      >
+        <ActIcon class={'mr-2 h-4 w-4 shrink-0 ' + (act.class ?? '')} aria-hidden="true" />
+        {act.label}
+      </button>
+    </li>
+  {/each}
+</ul>
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
new file mode 100644
index 00000000..b9da50f1
--- /dev/null
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -0,0 +1,70 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import { untrack } from 'svelte';
+  import { navigating } from '$app/state';
+  import { getStorageState } from '$lib/storage/context.js';
+  import StorageBreadcrumb from './StorageBreadcrumb.svelte';
+  import ObjectTable from './ObjectTable.svelte';
+  import ContextMenu from './ContextMenu.svelte';
+  import StorageModals from '../modals/StorageModals.svelte';
+  import Pagination from '$lib/components/Pagination.svelte';
+
+  const storage = getStorageState();
+
+  // Record location visit whenever the current bucket/prefix changes.
+  $effect(() => {
+    const b = storage.bucket;
+    const p = storage.prefix;
+    if (b) untrack(() => storage.bookmarks.recordLocationVisit(b, p));
+  });
+</script>
+
+<svelte:window onkeydown={storage.handleKeydown} />
+
+<div class="bg-base-100 flex flex-1 flex-col overflow-hidden">
+  <StorageBreadcrumb />
+
+  <!-- svelte-ignore a11y_click_events_have_key_events -->
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div
+    class="relative min-h-0 flex-1 overflow-hidden"
+    onclick={(e) => {
+      if (!(e.target as HTMLElement).closest('tr')) storage.clearSelection();
+    }}
+  >
+    {#if storage.loading || storage.deleting || navigating.to}
+      <div
+        class="bg-base-100/70 absolute inset-0 z-20 flex items-center justify-center"
+        aria-live="polite"
+        aria-label={m.storage_loading()}
+      >
+        <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
+      </div>
+    {/if}
+    <ObjectTable />
+  </div>
+
+  <!-- Fixed pagination bar at bottom -->
+  <div class="border-base-200/40 bg-base-100 sticky bottom-0 z-10 border-t px-4 py-3">
+    <Pagination
+      bind:pageSize={storage.pageSize}
+      storageKey="storage_page_size"
+      pageSizeLabel={m.storage_page_size()}
+      infoLabel="{m.storage_page()} {storage.currentPage}"
+      current={storage.prevTokens.length}
+      hasNext={storage.objects.hasNextPage}
+      onfirst={storage.navigateFirst}
+      onprev={storage.navigatePrev}
+      onnext={storage.navigateNext}
+      onpagesizechange={storage.onPageSizeChange}
+    />
+  </div>
+</div>
+
+<!-- Context menu -->
+{#if storage.contextMenu}
+  <ContextMenu />
+{/if}
+
+<!-- Modals -->
+<StorageModals />
diff --git a/src/lib/components/storage/explorer/FileRow.svelte b/src/lib/components/storage/explorer/FileRow.svelte
new file mode 100644
index 00000000..777475af
--- /dev/null
+++ b/src/lib/components/storage/explorer/FileRow.svelte
@@ -0,0 +1,85 @@
+<script lang="ts">
+  import IconImage from 'virtual:icons/material-symbols/image';
+  import IconCode from 'virtual:icons/material-symbols/code';
+  import IconArchive from 'virtual:icons/material-symbols/archive';
+  import IconPictureAsPdf from 'virtual:icons/material-symbols/picture-as-pdf';
+  import IconDescription from 'virtual:icons/material-symbols/description';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import { fileIconKind, iconColors, keyToName, formatFileSize } from '$lib/storage/utils.js';
+  import type { StorageObject } from '$lib/storage/types.js';
+  import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
+  import { getStorageState } from '$lib/storage/context.js';
+
+  interface Props {
+    file: StorageObject;
+  }
+
+  let { file }: Props = $props();
+
+  const storage = getStorageState();
+
+  const selected = $derived(storage.selectedKeys.has(file.key));
+  const isCtx = $derived(storage.contextMenu?.key === file.key);
+  const kind = $derived(fileIconKind(file.contentType));
+  const color = $derived(iconColors[kind]);
+</script>
+
+<tr
+  class="
+    group cursor-pointer select-none
+    {isCtx
+    ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
+    : selected
+      ? 'bg-primary/10 hover:bg-primary/15'
+      : 'hover:bg-base-200/60'}"
+  onclick={(e) => storage.toggleSelect(file.key, e.ctrlKey || e.metaKey)}
+  ondblclick={() => storage.executeAction('preview')}
+  oncontextmenu={(e) => storage.openContextMenu(e, file.key)}
+>
+  <td class="pr-0">
+    <input
+      type="checkbox"
+      class="checkbox checkbox-xs {!storage.showCheckboxes ? 'pointer-events-none invisible' : ''}"
+      checked={selected}
+      onchange={() => storage.toggleSelect(file.key, true)}
+      onclick={(e) => e.stopPropagation()}
+      disabled={!storage.showCheckboxes}
+      aria-label="Select {keyToName(file.key)}"
+    />
+  </td>
+  <td>
+    <div class="flex items-center gap-2.5">
+      {#if kind === 'image'}
+        <IconImage class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {:else if kind === 'code'}
+        <IconCode class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {:else if kind === 'archive'}
+        <IconArchive class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {:else if kind === 'pdf'}
+        <IconPictureAsPdf class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {:else}
+        <IconDescription class="size-5 shrink-0 {color}" aria-hidden="true" />
+      {/if}
+      <span class="truncate">{keyToName(file.key)}</span>
+      {#if file.contentType}
+        <span class="badge badge-ghost badge-sm ml-1 shrink-0 text-[10px] opacity-50">
+          {file.contentType.split('/').at(-1) ?? ''}
+        </span>
+      {/if}
+    </div>
+  </td>
+  <td class="text-right font-mono text-sm">{formatFileSize(file.size)}</td>
+  <td class="text-base-content/60 text-sm"
+    ><TimestampDisplay date={file.lastModified} relative /></td
+  >
+  <td class="w-10 py-0 pr-2 text-right">
+    <button
+      class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
+      title="Actions"
+      aria-label="Actions for {keyToName(file.key)}"
+      onclick={(e) => storage.openContextMenu(e, file.key)}
+    >
+      <IconMoreHoriz class="size-4" aria-hidden="true" />
+    </button>
+  </td>
+</tr>
diff --git a/src/lib/components/storage/FolderRow.svelte b/src/lib/components/storage/explorer/FolderRow.svelte
similarity index 51%
rename from src/lib/components/storage/FolderRow.svelte
rename to src/lib/components/storage/explorer/FolderRow.svelte
index d6ee9639..5ec0645c 100644
--- a/src/lib/components/storage/FolderRow.svelte
+++ b/src/lib/components/storage/explorer/FolderRow.svelte
@@ -1,29 +1,20 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import IconFolder from 'virtual:icons/material-symbols/folder';
   import { keyToName } from '$lib/storage/utils.js';
   import type { StorageObject } from '$lib/storage/types.js';
+  import { getStorageState } from '$lib/storage/context.js';
 
   interface Props {
     folder: StorageObject;
-    selected: boolean;
-    isCtx: boolean;
-    showCheckboxes: boolean;
-    selectionMode: boolean;
-    onNavigate: (prefix: string) => void;
-    onToggleSelect: (key: string, force?: boolean) => void;
-    onContextMenu: (e: MouseEvent, key: string) => void;
   }
 
-  let {
-    folder,
-    selected,
-    isCtx,
-    showCheckboxes,
-    selectionMode,
-    onNavigate,
-    onToggleSelect,
-    onContextMenu
-  }: Props = $props();
+  let { folder }: Props = $props();
+
+  const storage = getStorageState();
+
+  const selected = $derived(storage.selectedKeys.has(folder.key));
+  const isCtx = $derived(storage.contextMenu?.key === folder.key);
 </script>
 
 <tr
@@ -35,37 +26,33 @@
       ? 'bg-primary/10 hover:bg-primary/15'
       : 'hover:bg-base-200/60'}"
   onclick={(e) => {
-    if (selectionMode || e.ctrlKey || e.metaKey) {
-      onToggleSelect(folder.key, true);
+    if (storage.selectionMode || e.ctrlKey || e.metaKey) {
+      storage.toggleSelect(folder.key, true);
     } else {
-      onNavigate(folder.key);
+      storage.navigate(folder.key);
     }
   }}
   ondblclick={(e) => {
     if (e.ctrlKey || e.metaKey) {
-      onNavigate(folder.key);
+      storage.navigate(folder.key);
     }
   }}
-  oncontextmenu={(e) => onContextMenu(e, folder.key)}
+  oncontextmenu={(e) => storage.openContextMenu(e, folder.key)}
 >
   <td class="pr-0">
     <input
       type="checkbox"
-      class="checkbox checkbox-xs {!showCheckboxes ? 'pointer-events-none invisible' : ''}"
+      class="checkbox checkbox-xs {!storage.showCheckboxes ? 'pointer-events-none invisible' : ''}"
       checked={selected}
-      onchange={() => onToggleSelect(folder.key, true)}
+      onchange={() => storage.toggleSelect(folder.key, true)}
       onclick={(e) => e.stopPropagation()}
-      disabled={!showCheckboxes}
+      disabled={!storage.showCheckboxes}
       aria-label="Select {keyToName(folder.key)}"
     />
   </td>
   <td>
     <div class="flex items-center gap-2.5">
-      <Icon
-        icon="material-symbols:folder"
-        class="text-warning size-5 shrink-0"
-        aria-hidden="true"
-      />
+      <IconFolder class="text-warning size-5 shrink-0" aria-hidden="true" />
       <span class="font-medium">{keyToName(folder.key)}</span>
     </div>
   </td>
@@ -76,9 +63,9 @@
       class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
       title="Actions"
       aria-label="Actions for {keyToName(folder.key)}"
-      onclick={(e) => onContextMenu(e, folder.key)}
+      onclick={(e) => storage.openContextMenu(e, folder.key)}
     >
-      <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
+      <IconMoreHoriz class="size-4" aria-hidden="true" />
     </button>
   </td>
 </tr>
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
new file mode 100644
index 00000000..6ad99bef
--- /dev/null
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -0,0 +1,94 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import IconArrowBack from 'virtual:icons/material-symbols/arrow-back';
+  import IconFolderOpen from 'virtual:icons/material-symbols/folder-open';
+  import SelectionToolbar from './SelectionToolbar.svelte';
+  import FolderRow from './FolderRow.svelte';
+  import FileRow from './FileRow.svelte';
+  import { getStorageState } from '$lib/storage/context.js';
+
+  const storage = getStorageState();
+
+  let selectAllEl = $state<HTMLInputElement | null>(null);
+  $effect(() => {
+    if (selectAllEl) selectAllEl.indeterminate = storage.someSelected;
+  });
+
+  function navigateUp() {
+    if (!storage.prefix) return;
+    const withoutTrailing = storage.prefix.slice(0, -1);
+    const lastSlash = withoutTrailing.lastIndexOf('/');
+    storage.navigate(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
+  }
+</script>
+
+<div class="preview-scroll h-full overflow-x-auto overflow-y-auto">
+  <table class="table-sm table">
+    <thead class="bg-base-100 sticky top-0 z-10">
+      <!-- Column headers -->
+      <tr
+        class="
+          bg-base-200 text-base-content/50 text-xs tracking-wide uppercase
+        "
+      >
+        <th class="w-8 pr-0">
+          <input
+            type="checkbox"
+            class="
+              checkbox checkbox-xs
+              {!storage.showCheckboxes ? `pointer-events-none invisible` : ''}"
+            bind:this={selectAllEl}
+            checked={storage.allSelected}
+            onchange={(e) => storage.selectAll(e.currentTarget.checked)}
+            onclick={(e) => e.stopPropagation()}
+            disabled={!storage.showCheckboxes}
+            aria-label="Select all"
+          />
+        </th>
+        <th class="w-7/12 font-semibold">{m.storage_header_name()}</th>
+        <th class="w-2/12 text-right font-semibold">{m.storage_header_size()}</th>
+        <th class="w-3/12 font-semibold">{m.storage_header_last_modified()}</th>
+        <th class="w-10"></th>
+      </tr>
+
+      <!-- Selection action toolbar -->
+      <SelectionToolbar />
+    </thead>
+
+    <tbody>
+      <!-- Parent directory row -->
+      {#if storage.prefix}
+        <tr class="hover cursor-pointer" onclick={navigateUp}>
+          <td class="pr-0"></td>
+          <td colspan={3}>
+            <div class="text-base-content/50 flex items-center gap-2">
+              <IconArrowBack class="size-4 shrink-0" aria-hidden="true" />
+              <span class="tracking-widest italic" aria-label={m.storage_parent_dir()}>...</span>
+            </div>
+          </td>
+          <td></td>
+        </tr>
+      {/if}
+
+      <!-- Folders -->
+      {#each storage.folders as folder (folder.key)}
+        <FolderRow {folder} />
+      {/each}
+
+      <!-- Files -->
+      {#each storage.files as file (file.key)}
+        <FileRow {file} />
+      {/each}
+
+      <!-- Empty folder -->
+      {#if storage.folders.length === 0 && storage.files.length === 0}
+        <tr>
+          <td colspan={5} class="text-base-content/40 py-16 text-center">
+            <IconFolderOpen class="mx-auto mb-3 size-10 opacity-30" aria-hidden="true" />
+            {m.storage_bucket_empty()}
+          </td>
+        </tr>
+      {/if}
+    </tbody>
+  </table>
+</div>
diff --git a/src/lib/components/storage/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
similarity index 52%
rename from src/lib/components/storage/SelectionToolbar.svelte
rename to src/lib/components/storage/explorer/SelectionToolbar.svelte
index c379e59f..8ce2a545 100644
--- a/src/lib/components/storage/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -1,16 +1,19 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import IconVisibility from 'virtual:icons/material-symbols/visibility';
+  import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconDelete from 'virtual:icons/material-symbols/delete';
   import * as m from '$lib/paraglide/messages.js';
+  import { getStorageState } from '$lib/storage/context.js';
 
-  interface Props {
-    /** Total number of selected items. */
-    selectedCount: number;
-    canPreview: boolean;
-    canDownload: boolean;
-    onAction: (action: string) => void;
-  }
+  const storage = getStorageState();
 
-  let { selectedCount, canPreview, canDownload, onAction }: Props = $props();
+  const selectedCount = $derived(storage.selectedKeys.size);
+  const canPreview = $derived(
+    storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0
+  );
+  const canDownload = $derived(
+    storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0
+  );
 </script>
 
 <tr class="border-primary/20 bg-primary/5 border-t">
@@ -23,20 +26,20 @@
       <button
         class="btn btn-ghost btn-xs gap-1"
         title={m.storage_action_preview()}
-        onclick={() => onAction('preview')}
+        onclick={() => storage.executeAction('preview')}
         disabled={!canPreview}
       >
-        <Icon icon="material-symbols:visibility" class="size-3.5" aria-hidden="true" />
+        <IconVisibility class="size-3.5" aria-hidden="true" />
         {m.storage_action_preview()}
       </button>
 
       <button
         class="btn btn-ghost btn-xs gap-1"
         title={m.storage_action_download()}
-        onclick={() => onAction('download')}
+        onclick={() => storage.executeAction('download')}
         disabled={!canDownload}
       >
-        <Icon icon="material-symbols:download" class="size-3.5" aria-hidden="true" />
+        <IconDownload class="size-3.5" aria-hidden="true" />
         {m.storage_action_download()}
       </button>
 
@@ -46,10 +49,10 @@
           {selectedCount > 0 ? 'text-error hover:bg-error/10' : ''}
         "
         title="{m.storage_action_delete()} (Del)"
-        onclick={() => onAction('delete')}
+        onclick={() => storage.executeAction('delete')}
         disabled={selectedCount === 0}
       >
-        <Icon icon="material-symbols:delete" class="size-3.5" aria-hidden="true" />
+        <IconDelete class="size-3.5" aria-hidden="true" />
         {m.storage_action_delete()}
       </button>
     </div>
diff --git a/src/lib/components/storage/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
similarity index 55%
rename from src/lib/components/storage/StorageBreadcrumb.svelte
rename to src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 2f862712..36754dfb 100644
--- a/src/lib/components/storage/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -1,38 +1,24 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
+  import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
+  import IconDescriptionOutline from 'virtual:icons/material-symbols/description-outline';
+  import IconCheckBox from 'virtual:icons/material-symbols/check-box';
+  import IconCheckBoxOutlineBlank from 'virtual:icons/material-symbols/check-box-outline-blank';
+  import IconUpload from 'virtual:icons/material-symbols/upload';
+  import IconMoreVert from 'virtual:icons/material-symbols/more-vert';
+  import IconPushPin from 'virtual:icons/material-symbols/push-pin';
+  import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
   import * as m from '$lib/paraglide/messages.js';
-  import {
-    pinLocation,
-    unpinLocation,
-    isPinned,
-    type StorageLocation
-  } from '$lib/stores/pinned-locations.svelte.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import type { StorageLocation } from '$lib/storage/types.js';
 
-  interface Props {
-    bucket: string;
-    prefix: string;
-    folderCount: number;
-    fileCount: number;
-    selectionMode: boolean;
-    onNavigate: (prefix: string) => void;
-    onToggleSelectionMode: () => void;
-    onUpload: () => void;
-  }
-
-  let {
-    bucket,
-    prefix,
-    folderCount,
-    fileCount,
-    selectionMode,
-    onNavigate,
-    onToggleSelectionMode,
-    onUpload
-  }: Props = $props();
+  const storage = getStorageState();
 
   const breadcrumbParts = $derived(
-    prefix
-      ? prefix
+    storage.prefix
+      ? storage.prefix
           .slice(0, -1)
           .split('/')
           .map((label, i, parts) => ({
@@ -50,7 +36,7 @@
     breadcrumbParts.length > MAX_TAIL ? breadcrumbParts.slice(-MAX_TAIL) : breadcrumbParts
   );
 
-  const currentIsPinned = $derived(isPinned(bucket, prefix));
+  const currentIsPinned = $derived(storage.bookmarks.isPinned(storage.bucket, storage.prefix));
 
   // ── Breadcrumb label context menu (right-click to pin / unpin) ───────────
   let breadcrumbCtx = $state<({ x: number; y: number } & StorageLocation) | null>(null);
@@ -66,6 +52,11 @@
 </script>
 
 {#if breadcrumbCtx}
+  {@const breadcrumbIsPinned = storage.bookmarks.isPinned(
+    breadcrumbCtx.bucket,
+    breadcrumbCtx.prefix
+  )}
+  {@const BreadcrumbPinIcon = breadcrumbIsPinned ? IconPushPin : IconPushPinOutline}
   <!-- svelte-ignore a11y_no_static_element_interactions -->
   <div
     class="fixed inset-0 z-40"
@@ -83,35 +74,27 @@
     <li role="none">
       <button
         role="menuitem"
-        class="justify-start {isPinned(breadcrumbCtx.bucket, breadcrumbCtx.prefix)
-          ? 'text-error'
-          : ''}"
+        class="justify-start {breadcrumbIsPinned ? 'text-error' : ''}"
         onclick={() => {
-          if (isPinned(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix)) {
-            unpinLocation(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
+          if (storage.bookmarks.isPinned(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix)) {
+            storage.bookmarks.unpin(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
           } else {
-            pinLocation(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
+            storage.bookmarks.pin(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
           }
           closeBreadcrumbCtx();
         }}
       >
-        <Icon
-          icon={isPinned(breadcrumbCtx.bucket, breadcrumbCtx.prefix)
-            ? 'material-symbols:push-pin'
-            : 'material-symbols:push-pin-outline'}
-          class="size-4 shrink-0"
-          aria-hidden="true"
-        />
-        {isPinned(breadcrumbCtx.bucket, breadcrumbCtx.prefix)
-          ? m.storage_action_unpin()
-          : m.storage_action_pin()}
+        <BreadcrumbPinIcon class="size-4 shrink-0" aria-hidden="true" />
+        {breadcrumbIsPinned ? m.storage_action_unpin() : m.storage_action_pin()}
       </button>
     </li>
   </ul>
 {/if}
 
 {#snippet pinButton(bucket: string, prefix: string)}
-  {@const pinned = isPinned(bucket, prefix)}
+  {@const pinned = storage.bookmarks.isPinned(bucket, prefix)}
+  {@const PinIcon = pinned ? IconPushPin : IconPushPinOutline}
+  {@const UnpinIcon = pinned ? IconPushPinOutline : IconPushPin}
   <span
     class="
       pointer-events-none w-0 shrink-0 overflow-hidden
@@ -128,9 +111,9 @@
       aria-label={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
       onclick={() => {
         if (pinned) {
-          unpinLocation(bucket, prefix);
+          storage.bookmarks.unpin(bucket, prefix);
         } else {
-          pinLocation(bucket, prefix);
+          storage.bookmarks.pin(bucket, prefix);
         }
       }}
     >
@@ -138,20 +121,12 @@
         <span
           class="absolute inset-0 flex items-center justify-center transition-opacity duration-150 group-hover/pin:opacity-0"
         >
-          <Icon
-            icon={pinned ? 'material-symbols:push-pin' : 'material-symbols:push-pin-outline'}
-            class="size-3.5"
-            aria-hidden="true"
-          />
+          <PinIcon class="size-3.5" aria-hidden="true" />
         </span>
         <span
           class="absolute inset-0 flex items-center justify-center opacity-0 transition-opacity duration-150 group-hover/pin:opacity-100"
         >
-          <Icon
-            icon={pinned ? 'material-symbols:push-pin-outline' : 'material-symbols:push-pin'}
-            class="size-3.5"
-            aria-hidden="true"
-          />
+          <UnpinIcon class="size-3.5" aria-hidden="true" />
         </span>
       </span>
     </button>
@@ -174,14 +149,14 @@
             text-base-content flex shrink-0 items-center gap-1.5 rounded-sm px-1.5
             py-0.5 font-medium
           "
-          title={bucket}
+          title={storage.bucket}
           aria-current="page"
-          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
+          oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, '')}
         >
-          <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
-          {bucket}
+          <IconStorage class="size-4" aria-hidden="true" />
+          {storage.bucket}
         </span>
-        {@render pinButton(bucket, '')}
+        {@render pinButton(storage.bucket, '')}
       </span>
     {:else}
       <span class="group flex shrink-0 items-center gap-1">
@@ -191,22 +166,18 @@
             rounded-sm px-1.5
             py-0.5 transition-colors hover:cursor-pointer
           "
-          title={bucket}
-          onclick={() => onNavigate('')}
-          oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, '')}
+          title={storage.bucket}
+          onclick={() => storage.navigate('')}
+          oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, '')}
         >
-          <Icon icon="material-symbols:storage" class="size-4" aria-hidden="true" />
-          {bucket}
+          <IconStorage class="size-4" aria-hidden="true" />
+          {storage.bucket}
         </button>
-        {@render pinButton(bucket, '')}
+        {@render pinButton(storage.bucket, '')}
       </span>
     {/if}
     {#if collapsedParts.length > 0}
-      <Icon
-        icon="material-symbols:chevron-right"
-        class="text-base-content/30 size-4 shrink-0"
-        aria-hidden="true"
-      />
+      <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
       <div class="dropdown">
         <button
           tabindex="0"
@@ -218,7 +189,7 @@
           aria-label={m.storage_breadcrumb_more()}
           aria-haspopup="listbox"
         >
-          <Icon icon="material-symbols:more-horiz" class="size-4" aria-hidden="true" />
+          <IconMoreHoriz class="size-4" aria-hidden="true" />
         </button>
         <ul
           tabindex="0"
@@ -234,12 +205,12 @@
               <div class="group flex items-center justify-between gap-2">
                 <button
                   class="flex-1 text-left text-sm hover:cursor-pointer"
-                  onclick={() => onNavigate(part.prefix)}
-                  oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
+                  onclick={() => storage.navigate(part.prefix)}
+                  oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
                 >
                   {part.label}
                 </button>
-                {@render pinButton(bucket, part.prefix)}
+                {@render pinButton(storage.bucket, part.prefix)}
               </div>
             </li>
           {/each}
@@ -248,11 +219,7 @@
     {/if}
     {#each visibleParts as part, i (part.prefix)}
       {@const isCurrent = i === visibleParts.length - 1}
-      <Icon
-        icon="material-symbols:chevron-right"
-        class="text-base-content/30 size-4 shrink-0"
-        aria-hidden="true"
-      />
+      <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
       <span class="group flex min-w-0 items-center gap-1">
         {#if isCurrent}
           <!-- svelte-ignore a11y_no_static_element_interactions -->
@@ -263,7 +230,7 @@
             "
             title={part.label}
             aria-current="page"
-            oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
+            oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
           >
             {part.label}
           </span>
@@ -274,13 +241,13 @@
               py-0.5 transition-colors hover:cursor-pointer
             "
             title={part.label}
-            onclick={() => onNavigate(part.prefix)}
-            oncontextmenu={(e) => openBreadcrumbCtx(e, bucket, part.prefix)}
+            onclick={() => storage.navigate(part.prefix)}
+            oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
           >
             {part.label}
           </button>
         {/if}
-        {@render pinButton(bucket, part.prefix)}
+        {@render pinButton(storage.bucket, part.prefix)}
       </span>
     {/each}
   </nav>
@@ -289,37 +256,44 @@
   <div class="flex shrink-0 items-center gap-1.5">
     <span
       class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-60 gap-1"
-      data-tip={m.storage_folder_count({ count: folderCount })}
+      data-tip={m.storage_folder_count({ count: storage.folders.length })}
     >
-      <Icon icon="material-symbols:folder-outline" class="size-4" aria-hidden="true" />
-      <span class="font-bold">{folderCount}</span>
+      <IconFolderOutline class="size-4" aria-hidden="true" />
+      <span class="font-bold">{storage.folders.length}</span>
     </span>
     <span
       class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-60 gap-1"
-      data-tip={m.storage_file_count({ count: fileCount })}
+      data-tip={m.storage_file_count({ count: storage.files.length })}
     >
-      <Icon icon="material-symbols:description-outline" class="size-4" aria-hidden="true" />
-      <span class="font-bold">{fileCount}</span>
+      <IconDescriptionOutline class="size-4" aria-hidden="true" />
+      <span class="font-bold">{storage.files.length}</span>
     </span>
   </div>
 
   <!-- Multi-select toggle -->
   <button
-    class={'btn btn-ghost btn-xs gap-1 ' + (selectionMode ? 'bg-success/20 text-success' : '')}
+    class={'btn btn-ghost btn-xs gap-1 ' +
+      (storage.selectionMode ? 'bg-success/20 text-success' : '')}
     title={m.storage_select_toggle()}
-    aria-pressed={selectionMode}
-    onclick={onToggleSelectionMode}
+    aria-pressed={storage.selectionMode}
+    onclick={() => storage.toggleSelectionMode()}
   >
-    <span class={'swap swap-rotate ' + (selectionMode ? 'swap-active' : '')} aria-hidden="true">
-      <Icon icon="material-symbols:check-box" class="swap-on size-3.5" />
-      <Icon icon="material-symbols:check-box-outline-blank" class="swap-off size-3.5" />
+    <span
+      class={'swap swap-rotate ' + (storage.selectionMode ? 'swap-active' : '')}
+      aria-hidden="true"
+    >
+      <IconCheckBox class="swap-on size-3.5" />
+      <IconCheckBoxOutlineBlank class="swap-off size-3.5" />
     </span>
     {m.storage_select_toggle()}
   </button>
 
   <!-- Upload button -->
-  <button class="btn btn-primary btn-xs gap-1" onclick={onUpload}>
-    <Icon icon="material-symbols:upload" class="size-3.5" aria-hidden="true" />
+  <button
+    class="btn btn-primary btn-xs gap-1"
+    onclick={() => storage.openModal('upload', { bucket: storage.bucket, prefix: storage.prefix })}
+  >
+    <IconUpload class="size-3.5" aria-hidden="true" />
     {m.storage_action_upload()}
   </button>
 
@@ -332,7 +306,7 @@
       aria-label={m.storage_more_options()}
       aria-haspopup="menu"
     >
-      <Icon icon="material-symbols:more-vert" class="size-3.5" aria-hidden="true" />
+      <IconMoreVert class="size-3.5" aria-hidden="true" />
     </button>
     <ul
       tabindex="0"
@@ -343,26 +317,31 @@
       "
     >
       <li role="none">
-        <button
-          role="menuitem"
-          class="justify-start text-sm"
-          onclick={() => {
-            if (currentIsPinned) {
-              unpinLocation(bucket, prefix);
-            } else {
-              pinLocation(bucket, prefix);
-            }
-          }}
-        >
-          <Icon
-            icon={currentIsPinned
-              ? 'material-symbols:push-pin'
-              : 'material-symbols:push-pin-outline'}
-            class="size-4 shrink-0"
-            aria-hidden="true"
-          />
-          {currentIsPinned ? m.storage_action_unpin() : m.storage_action_pin()}
-        </button>
+        {#if currentIsPinned}
+          {@const PinIcon2 = IconPushPin}
+          <button
+            role="menuitem"
+            class="justify-start text-sm"
+            onclick={() => {
+              storage.bookmarks.unpin(storage.bucket, storage.prefix);
+            }}
+          >
+            <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
+            {m.storage_action_unpin()}
+          </button>
+        {:else}
+          {@const PinIcon2 = IconPushPinOutline}
+          <button
+            role="menuitem"
+            class="justify-start text-sm"
+            onclick={() => {
+              storage.bookmarks.pin(storage.bucket, storage.prefix);
+            }}
+          >
+            <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
+            {m.storage_action_pin()}
+          </button>
+        {/if}
       </li>
     </ul>
   </div>
diff --git a/src/lib/components/storage/BucketGrid.svelte b/src/lib/components/storage/landing/BucketGrid.svelte
similarity index 74%
rename from src/lib/components/storage/BucketGrid.svelte
rename to src/lib/components/storage/landing/BucketGrid.svelte
index 8cca881a..d21ca364 100644
--- a/src/lib/components/storage/BucketGrid.svelte
+++ b/src/lib/components/storage/landing/BucketGrid.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import IconBucket from 'virtual:icons/gravity-ui/bucket';
   import * as m from '$lib/paraglide/messages.js';
+  import { resolve } from '$app/paths';
 
   interface Props {
     buckets?: string[];
@@ -21,7 +22,10 @@
     {#each buckets as bucket (bucket)}
       <div class="tooltip tooltip-bottom" data-tip={bucket}>
         <a
-          href="/storage/{encodeURIComponent(bucket)}"
+          href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+            bucket: encodeURIComponent(bucket),
+            prefix: ''
+          })}
           data-sveltekit-preload-data="off"
           class="
               border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 flex flex-col items-center
@@ -29,7 +33,7 @@
               text-center transition-colors
             "
         >
-          <Icon icon="mdi:bucket-outline" class="text-warning size-10" aria-hidden="true" />
+          <IconBucket class="text-warning size-10" aria-hidden="true" />
           <span class="w-full truncate text-sm font-medium">{bucket}</span>
         </a>
       </div>
diff --git a/src/lib/components/storage/RecentItems.svelte b/src/lib/components/storage/landing/RecentItems.svelte
similarity index 69%
rename from src/lib/components/storage/RecentItems.svelte
rename to src/lib/components/storage/landing/RecentItems.svelte
index 3800cf0c..58622dfd 100644
--- a/src/lib/components/storage/RecentItems.svelte
+++ b/src/lib/components/storage/landing/RecentItems.svelte
@@ -1,20 +1,26 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
-  import Icon from '@iconify/svelte';
+  import IconArrowForward from 'virtual:icons/material-symbols/arrow-forward';
+  import IconDescriptionOutline from 'virtual:icons/material-symbols/description-outline';
+  import IconPreviewOutline from 'virtual:icons/material-symbols/preview-outline';
+  import IconFolderOpenOutline from 'virtual:icons/material-symbols/folder-open-outline';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
+  import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
   import * as m from '$lib/paraglide/messages.js';
   import { formatFileSize } from '$lib/storage/utils.js';
+  import { getStorageState } from '$lib/storage/context.js';
   import {
-    recentFiles,
-    recentLocations,
     fileName,
+    fileHref,
     fileLocation,
+    locationHref,
     locationName,
-    locationPath,
-    fileHref,
-    locationHref
-  } from '$lib/stores/recent-items.svelte.js';
-  import PreviewModal from '$lib/components/storage/PreviewModal.svelte';
-  import TimestampDisplay from '$lib/components/storage/TimestampDisplay.svelte';
+    locationPath
+  } from '$lib/storage/display-helpers.js';
+  import PreviewModal from '$lib/components/storage/modals/PreviewModal.svelte';
+  import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
+
+  const storage = getStorageState();
 
   type Tab = 'files' | 'locations';
   let activeTab = $state<Tab>('files');
@@ -52,24 +58,22 @@
       </tr>
     </thead>
     <tbody>
-      {#each recentFiles as file (file.bucket + '::' + file.key)}
+      {#each storage.bookmarks.recentFiles as file (file.bucket + '::' + file.key)}
         <tr class="hover">
           <td>
             <div class="flex items-center gap-2">
-              <Icon
-                icon="material-symbols:description-outline"
-                class="text-primary size-4 shrink-0"
-                aria-hidden="true"
-              />
+              <IconDescriptionOutline class="text-primary size-4 shrink-0" aria-hidden="true" />
               <span class="font-medium">{fileName(file.key)}</span>
             </div>
           </td>
           <td>
+            <!-- eslint-disable svelte/no-navigation-without-resolve -->
             <a
               href={fileHref(file)}
               data-sveltekit-preload-data="off"
               class="text-base-content/60 hover:text-primary truncate text-xs"
             >
+              <!-- eslint-enable svelte/no-navigation-without-resolve -->
               {fileLocation(file)}
             </a>
           </td>
@@ -87,25 +91,19 @@
                   aria-label="{m.storage_recent_preview_file()} — {fileName(file.key)}"
                   onclick={() => openPreview(file.bucket, file.key)}
                 >
-                  <Icon
-                    icon="material-symbols:preview-outline"
-                    class="size-3.5"
-                    aria-hidden="true"
-                  />
+                  <IconPreviewOutline class="size-3.5" aria-hidden="true" />
                 </button>
               </div>
               <div class="tooltip tooltip-left" data-tip={m.storage_recent_open_folder()}>
+                <!-- eslint-disable svelte/no-navigation-without-resolve -->
                 <a
                   href={fileHref(file)}
                   data-sveltekit-preload-data="off"
                   class="btn btn-ghost btn-xs"
                   aria-label="{m.storage_recent_open_folder()} — {fileName(file.key)}"
                 >
-                  <Icon
-                    icon="material-symbols:folder-open-outline"
-                    class="size-3.5"
-                    aria-hidden="true"
-                  />
+                  <!-- eslint-enable svelte/no-navigation-without-resolve -->
+                  <IconFolderOpenOutline class="size-3.5" aria-hidden="true" />
                 </a>
               </div>
             </div>
@@ -127,36 +125,32 @@
       </tr>
     </thead>
     <tbody>
-      {#each recentLocations as loc (loc.bucket + '::' + loc.prefix)}
+      {#each storage.bookmarks.recentLocations as loc (loc.bucket + '::' + loc.prefix)}
         <tr class="hover">
           <td>
             <div class="flex items-center gap-2">
               {#if loc.prefix === ''}
-                <Icon
-                  icon="mdi:bucket-outline"
-                  class="text-warning size-4 shrink-0"
-                  aria-hidden="true"
-                />
+                <IconStorage class="text-warning size-4 shrink-0" aria-hidden="true" />
               {:else}
-                <Icon
-                  icon="material-symbols:folder-outline"
-                  class="text-warning size-4 shrink-0"
-                  aria-hidden="true"
-                />
+                <IconFolderOutline class="text-warning size-4 shrink-0" aria-hidden="true" />
               {/if}
+              <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <a
                 href={locationHref(loc)}
                 data-sveltekit-preload-data="off"
                 class="hover:text-primary font-medium">{locationName(loc)}</a
               >
+              <!-- eslint-enable svelte/no-navigation-without-resolve -->
             </div>
           </td>
           <td>
+            <!-- eslint-disable svelte/no-navigation-without-resolve -->
             <a
               href={locationHref(loc)}
               data-sveltekit-preload-data="off"
               class="text-base-content/60 hover:text-primary truncate text-xs"
             >
+              <!-- eslint-enable svelte/no-navigation-without-resolve -->
               {locationPath(loc)}
             </a>
           </td>
@@ -165,13 +159,15 @@
           </td>
           <td>
             <div class="tooltip tooltip-left" data-tip={m.storage_recent_go_to_location()}>
+              <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <a
                 href={locationHref(loc)}
                 data-sveltekit-preload-data="off"
                 class="btn btn-ghost btn-xs"
                 aria-label="{m.storage_recent_go_to_location()} — {locationName(loc)}"
               >
-                <Icon icon="material-symbols:arrow-forward" class="size-3.5" aria-hidden="true" />
+                <!-- eslint-enable svelte/no-navigation-without-resolve -->
+                <IconArrowForward class="size-3.5" aria-hidden="true" />
               </a>
             </div>
           </td>
@@ -185,6 +181,7 @@
   <!-- Tab header -->
   <div role="tablist" class="tabs tabs-border mb-0">
     <button
+      type="button"
       role="tab"
       class="tab {activeTab === 'files' ? 'tab-active' : ''}"
       aria-selected={activeTab === 'files'}
@@ -193,6 +190,7 @@
       {m.storage_recent_files()}
     </button>
     <button
+      type="button"
       role="tab"
       class="tab {activeTab === 'locations' ? 'tab-active' : ''}"
       aria-selected={activeTab === 'locations'}
@@ -204,10 +202,14 @@
 
   <div class="min-h-0 flex-1 overflow-y-auto">
     {#if activeTab === 'files'}
-      {@render tabPanel(recentFiles.length === 0, m.storage_recent_empty_files(), filesTable)}
+      {@render tabPanel(
+        storage.bookmarks.recentFiles.length === 0,
+        m.storage_recent_empty_files(),
+        filesTable
+      )}
     {:else}
       {@render tabPanel(
-        recentLocations.length === 0,
+        storage.bookmarks.recentLocations.length === 0,
         m.storage_recent_empty_locations(),
         locationsTable
       )}
diff --git a/src/lib/components/storage/StorageConnectForm.svelte b/src/lib/components/storage/landing/StorageConnectForm.svelte
similarity index 97%
rename from src/lib/components/storage/StorageConnectForm.svelte
rename to src/lib/components/storage/landing/StorageConnectForm.svelte
index 6a21d6cc..020da40b 100644
--- a/src/lib/components/storage/StorageConnectForm.svelte
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte
@@ -3,7 +3,8 @@
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
   import { onMount, tick } from 'svelte';
-  import Icon from '@iconify/svelte';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
   import * as m from '$lib/paraglide/messages.js';
   import { StorageConnectionSchema } from '$lib/storage/schemas.js';
   import {
@@ -135,11 +136,7 @@
                 "
                 title={connectionLabel(conn)}
               >
-                <Icon
-                  icon="material-symbols:storage"
-                  class="text-primary size-8"
-                  aria-hidden="true"
-                />
+                <IconStorage class="text-primary size-8" aria-hidden="true" />
                 <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
               </button>
               <button
@@ -155,7 +152,7 @@
                   rounded-full border shadow-sm transition-colors
                 "
               >
-                <Icon icon="material-symbols:close" class="size-3" aria-hidden="true" />
+                <IconClose class="size-3" aria-hidden="true" />
               </button>
             </div>
           {/each}
diff --git a/src/lib/components/storage/DeleteConfirmModal.svelte b/src/lib/components/storage/modals/DeleteConfirmModal.svelte
similarity index 81%
rename from src/lib/components/storage/DeleteConfirmModal.svelte
rename to src/lib/components/storage/modals/DeleteConfirmModal.svelte
index b2e58bdd..8e9a98ca 100644
--- a/src/lib/components/storage/DeleteConfirmModal.svelte
+++ b/src/lib/components/storage/modals/DeleteConfirmModal.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import Modal from '$lib/components/Modal.svelte';
-  import Icon from '@iconify/svelte';
+  import IconDeleteForever from 'virtual:icons/material-symbols/delete-forever';
+  import IconWarningRounded from 'virtual:icons/material-symbols/warning-rounded';
   import * as m from '$lib/paraglide/messages.js';
 
   interface Props {
@@ -20,7 +21,7 @@
 <Modal bind:open class="modal">
   <div class="modal-box {hasDirectories ? 'max-w-md' : 'max-w-sm'}">
     <h3 class="text-error mb-3 flex items-center gap-2 text-lg font-bold">
-      <Icon icon="material-symbols:delete-forever" class="size-5 shrink-0" aria-hidden="true" />
+      <IconDeleteForever class="size-5 shrink-0" aria-hidden="true" />
       {count === 1
         ? m.storage_delete_confirm_title_one({ name: firstName })
         : m.storage_delete_confirm_title_many({ count })}
@@ -29,11 +30,7 @@
     {#if hasDirectories}
       <div class="border-error/40 bg-error/10 mb-4 rounded-lg border p-4" role="alert">
         <p class="text-error mb-1 flex items-center gap-2 font-semibold">
-          <Icon
-            icon="material-symbols:warning-rounded"
-            class="size-5 shrink-0"
-            aria-hidden="true"
-          />
+          <IconWarningRounded class="size-5 shrink-0" aria-hidden="true" />
           {m.storage_delete_dir_warning_heading()}
         </p>
         <p class="text-base-content/80 text-sm">
@@ -51,7 +48,7 @@
         {m.storage_delete_cancel()}
       </button>
       <button class="btn btn-outline btn-error" onclick={onConfirm}>
-        <Icon icon="material-symbols:delete-forever" class="size-4" aria-hidden="true" />
+        <IconDeleteForever class="size-4" aria-hidden="true" />
         {m.storage_delete_confirm_button()}
       </button>
     </div>
diff --git a/src/lib/components/storage/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
similarity index 89%
rename from src/lib/components/storage/PreviewModal.svelte
rename to src/lib/components/storage/modals/PreviewModal.svelte
index 96b3baff..1b1fea02 100644
--- a/src/lib/components/storage/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -1,6 +1,10 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
-  import Icon from '@iconify/svelte';
+  import IconCloseFullscreen from 'virtual:icons/material-symbols/close-fullscreen';
+  import IconOpenInFull from 'virtual:icons/material-symbols/open-in-full';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconErrorOutline from 'virtual:icons/material-symbols/error-outline';
+  import IconDownload from 'virtual:icons/material-symbols/download';
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
   import TextPreview from './preview/TextPreview.svelte';
@@ -9,6 +13,7 @@
   import PdfPreview from './preview/PdfPreview.svelte';
   import FallbackPreview from './preview/FallbackPreview.svelte';
   import { keyToName, formatFileSize } from '$lib/storage/utils.js';
+  import { resolve } from '$app/paths';
 
   interface Props {
     open: boolean;
@@ -207,7 +212,8 @@
   const filename = $derived(objectKey ? keyToName(objectKey) : '');
 
   function buildDownloadUrl(key: string, bkt: string): string {
-    return `/storage/api/download?${new URLSearchParams({ bucket: bkt, key })}`;
+    const params = new URLSearchParams({ bucket: bkt, key });
+    return `${resolve('/storage/api/download')}?${params}`;
   }
 
   function close() {
@@ -271,23 +277,31 @@
           </div>
         {/if}
       </div>
-      <button
-        class="btn btn-ghost btn-sm btn-square"
-        onclick={toggleMaximized}
-        aria-label={maximized ? 'Restore' : 'Maximise'}
-      >
-        <Icon
-          icon={maximized ? 'material-symbols:close-fullscreen' : 'material-symbols:open-in-full'}
-          class="size-4"
-          aria-hidden="true"
-        />
-      </button>
+      {#if maximized}
+        {@const MaximizeIcon = IconCloseFullscreen}
+        <button
+          class="btn btn-ghost btn-sm btn-square"
+          onclick={toggleMaximized}
+          aria-label="Restore"
+        >
+          <MaximizeIcon class="size-4" aria-hidden="true" />
+        </button>
+      {:else}
+        {@const MaximizeIcon = IconOpenInFull}
+        <button
+          class="btn btn-ghost btn-sm btn-square"
+          onclick={toggleMaximized}
+          aria-label="Maximise"
+        >
+          <MaximizeIcon class="size-4" aria-hidden="true" />
+        </button>
+      {/if}
       <button
         class="btn btn-ghost btn-sm btn-square"
         onclick={close}
         aria-label={m.storage_preview_close()}
       >
-        <Icon icon="material-symbols:close" class="size-5" aria-hidden="true" />
+        <IconClose class="size-5" aria-hidden="true" />
       </button>
     </div>
 
@@ -304,11 +318,7 @@
         </div>
       {:else if preview.kind === 'error'}
         <div class="flex flex-col items-center gap-3 p-8 text-center" role="alert">
-          <Icon
-            icon="material-symbols:error-outline"
-            class="text-error size-12"
-            aria-hidden="true"
-          />
+          <IconErrorOutline class="text-error size-12" aria-hidden="true" />
           <p class="text-base-content font-semibold">{m.storage_preview_error_title()}</p>
           <p class="text-base-content/60 text-sm">{preview.message}</p>
         </div>
@@ -344,18 +354,20 @@
           <a
             href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
             download={filename}
+            rel="external"
             class="btn btn-ghost btn-sm gap-1.5"
           >
-            <Icon icon="material-symbols:download" class="size-4" aria-hidden="true" />
+            <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
           </a>
         {:else if preview.kind === 'image' || preview.kind === 'pdf'}
           <a
             href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
             download={filename}
+            rel="external"
             class="btn btn-ghost btn-sm gap-1.5"
           >
-            <Icon icon="material-symbols:download" class="size-4" aria-hidden="true" />
+            <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
           </a>
         {/if}
diff --git a/src/lib/components/storage/modals/StorageModals.svelte b/src/lib/components/storage/modals/StorageModals.svelte
new file mode 100644
index 00000000..a3d8f9f0
--- /dev/null
+++ b/src/lib/components/storage/modals/StorageModals.svelte
@@ -0,0 +1,68 @@
+<script lang="ts">
+  import { getStorageState } from '$lib/storage/context.js';
+  import DeleteConfirmModal from './DeleteConfirmModal.svelte';
+  import PreviewModal from './PreviewModal.svelte';
+  import UploadModal from './upload/UploadModal.svelte';
+
+  const storage = getStorageState();
+
+  // Local open state for modals that can close themselves (click-outside, etc.)
+  // These start as true when mounted and sync back to storage state when closed.
+  let previewOpen = $state(true);
+  let uploadOpen = $state(true);
+  let deleteOpen = $state(true);
+
+  // Reset local state when modal type changes
+  $effect(() => {
+    if (storage.activeModal) {
+      previewOpen = true;
+      uploadOpen = true;
+      deleteOpen = true;
+    }
+  });
+
+  // Sync modal close-via-UI back to state
+  $effect(() => {
+    if (!previewOpen && storage.activeModal?.type === 'preview') {
+      storage.closeModal();
+    }
+  });
+
+  $effect(() => {
+    if (!uploadOpen && storage.activeModal?.type === 'upload') {
+      storage.closeModal();
+    }
+  });
+
+  $effect(() => {
+    if (!deleteOpen && storage.activeModal?.type === 'delete') {
+      storage.closeModal();
+    }
+  });
+</script>
+
+{#if storage.activeModal?.type === 'delete'}
+  <DeleteConfirmModal
+    bind:open={deleteOpen}
+    keys={storage.activeModal.payload.keys}
+    onConfirm={storage.confirmDelete}
+    onCancel={storage.cancelDelete}
+  />
+{/if}
+
+{#if storage.activeModal?.type === 'preview'}
+  <PreviewModal
+    bind:open={previewOpen}
+    bucket={storage.bucket}
+    objectKey={storage.activeModal.payload.key}
+  />
+{/if}
+
+{#if storage.activeModal?.type === 'upload'}
+  <UploadModal
+    bind:open={uploadOpen}
+    bucket={storage.activeModal.payload.bucket}
+    prefix={storage.activeModal.payload.prefix}
+    onSuccess={storage.handleUploadSuccess}
+  />
+{/if}
diff --git a/src/lib/components/storage/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
similarity index 100%
rename from src/lib/components/storage/preview/CsvPreview.svelte
rename to src/lib/components/storage/modals/preview/CsvPreview.svelte
diff --git a/src/lib/components/storage/preview/FallbackPreview.svelte b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
similarity index 71%
rename from src/lib/components/storage/preview/FallbackPreview.svelte
rename to src/lib/components/storage/modals/preview/FallbackPreview.svelte
index ebaeff12..78751213 100644
--- a/src/lib/components/storage/preview/FallbackPreview.svelte
+++ b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconFilePresent from 'virtual:icons/material-symbols/file-present';
   import * as m from '$lib/paraglide/messages.js';
 
   interface Props {
@@ -14,11 +15,7 @@
 </script>
 
 <div class="flex min-h-full flex-col items-center justify-center gap-4 p-8 text-center">
-  <Icon
-    icon="material-symbols:file-present"
-    class="text-base-content/30 size-16"
-    aria-hidden="true"
-  />
+  <IconFilePresent class="text-base-content/30 size-16" aria-hidden="true" />
   <div>
     <p class="text-base-content font-semibold">
       {isBinary ? m.storage_preview_binary_title() : m.storage_preview_unsupported_title()}
@@ -30,8 +27,8 @@
       <p class="text-base-content/40 mt-1 font-mono text-xs">{contentType}</p>
     {/if}
   </div>
-  <a href={downloadUrl} download={name} class="btn btn-primary btn-sm gap-2">
-    <Icon icon="material-symbols:download" class="size-4" aria-hidden="true" />
+  <a href={downloadUrl} download={name} rel="external" class="btn btn-primary btn-sm gap-2">
+    <IconDownload class="size-4" aria-hidden="true" />
     {m.storage_preview_download_full()}
   </a>
 </div>
diff --git a/src/lib/components/storage/preview/ImagePreview.svelte b/src/lib/components/storage/modals/preview/ImagePreview.svelte
similarity index 100%
rename from src/lib/components/storage/preview/ImagePreview.svelte
rename to src/lib/components/storage/modals/preview/ImagePreview.svelte
diff --git a/src/lib/components/storage/preview/PdfPreview.svelte b/src/lib/components/storage/modals/preview/PdfPreview.svelte
similarity index 100%
rename from src/lib/components/storage/preview/PdfPreview.svelte
rename to src/lib/components/storage/modals/preview/PdfPreview.svelte
diff --git a/src/lib/components/storage/preview/TextPreview.svelte b/src/lib/components/storage/modals/preview/TextPreview.svelte
similarity index 100%
rename from src/lib/components/storage/preview/TextPreview.svelte
rename to src/lib/components/storage/modals/preview/TextPreview.svelte
diff --git a/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte b/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte
new file mode 100644
index 00000000..68fc270a
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte
@@ -0,0 +1,118 @@
+<script lang="ts">
+  import IconCheck from 'virtual:icons/material-symbols/check';
+  import IconCheckCircle from 'virtual:icons/material-symbols/check-circle';
+  import * as m from '$lib/paraglide/messages.js';
+  import type { FileEntry, Resolution } from './types.js';
+
+  interface Props {
+    entry: FileEntry;
+    onSetResolution: (resolution: Resolution) => void;
+    onSetCustomName: (name: string) => void;
+    onRenameButtonClick: () => void;
+    onCheckRename: () => void;
+  }
+
+  let { entry, onSetResolution, onSetCustomName, onRenameButtonClick, onCheckRename }: Props =
+    $props();
+
+  const uid = $props.id();
+
+  let nameOnly = $derived(entry.targetKey.split('/').at(-1) ?? entry.file.name);
+  let badRename = $derived(
+    entry.resolution === 'rename' &&
+      (entry.customName.trim() === '' || entry.customName.trim() === entry.file.name)
+  );
+</script>
+
+<li class="px-4 py-3">
+  <p class="text-base-content mb-2 truncate text-sm font-medium">
+    &ldquo;{nameOnly}&rdquo;
+  </p>
+  <!-- Resolution toggle buttons -->
+  <div
+    class="flex flex-wrap gap-1.5"
+    role="group"
+    aria-label="{m.storage_upload_conflicts_title()} — {nameOnly}"
+  >
+    <button
+      type="button"
+      class="btn btn-xs {entry.resolution === 'replace' ? 'btn-warning' : 'btn-ghost'}"
+      onclick={() => onSetResolution('replace')}
+      aria-pressed={entry.resolution === 'replace'}
+    >
+      {m.storage_upload_resolution_replace()}
+    </button>
+    <button
+      type="button"
+      class="btn btn-xs {entry.resolution === 'skip' ? 'btn-neutral' : 'btn-ghost'}"
+      onclick={() => onSetResolution('skip')}
+      aria-pressed={entry.resolution === 'skip'}
+    >
+      {m.storage_upload_resolution_skip()}
+    </button>
+    <button
+      type="button"
+      class="btn btn-xs gap-1 {entry.resolution !== 'rename'
+        ? 'btn-ghost'
+        : entry.renameState === 'ok'
+          ? 'btn-success'
+          : entry.renameState === 'conflict'
+            ? 'btn-error'
+            : 'btn-primary'}"
+      onclick={onRenameButtonClick}
+      aria-pressed={entry.resolution === 'rename'}
+      disabled={entry.renameState === 'checking'}
+    >
+      {#if entry.resolution === 'rename' && entry.renameState === 'checking'}
+        <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+      {:else if entry.resolution === 'rename' && entry.renameState === 'ok'}
+        <IconCheck class="size-3" aria-hidden="true" />
+      {/if}
+      {#if entry.resolution === 'rename' && (entry.renameState === 'editing' || entry.renameState === 'conflict')}
+        {m.storage_upload_rename_confirm_action()}
+      {:else}
+        {m.storage_upload_resolution_rename()}
+      {/if}
+    </button>
+  </div>
+
+  <!-- Name field: real <input> only while editing; static display otherwise -->
+  <div class="mt-2">
+    {#if entry.resolution === 'rename' && (entry.renameState === 'editing' || entry.renameState === 'conflict')}
+      <label for="{uid}-rename-{entry.id}" class="label sr-only">
+        {m.storage_upload_rename_label()}
+      </label>
+      <input
+        id="{uid}-rename-{entry.id}"
+        type="text"
+        class="input input-sm w-full {badRename || entry.renameState === 'conflict'
+          ? 'input-error'
+          : ''}"
+        value={entry.customName}
+        oninput={(e) => onSetCustomName((e.target as HTMLInputElement).value)}
+        onkeydown={(e) => e.key === 'Enter' && void onCheckRename()}
+        placeholder={m.storage_upload_rename_label()}
+        aria-describedby={badRename || entry.renameState === 'conflict'
+          ? `${uid}-rename-err-${entry.id}`
+          : undefined}
+      />
+      {#if badRename}
+        <p id="{uid}-rename-err-{entry.id}" class="text-error mt-1 text-xs" role="alert">
+          {m.storage_upload_rename_same_name_error()}
+        </p>
+      {:else if entry.renameState === 'conflict'}
+        <p id="{uid}-rename-err-{entry.id}" class="text-error mt-1 text-xs" role="alert">
+          {m.storage_upload_rename_taken()}
+        </p>
+      {/if}
+    {:else}
+      <!-- Static display: not in rename mode, or confirmed/checking -->
+      <div class="text-base-content/50 mt-1 flex items-center gap-1 px-1 text-sm">
+        <span class="min-w-0 flex-1 truncate">{entry.customName}</span>
+        {#if entry.resolution === 'rename' && entry.renameState === 'ok'}
+          <IconCheckCircle class="text-success size-3.5 shrink-0" aria-hidden="true" />
+        {/if}
+      </div>
+    {/if}
+  </div>
+</li>
diff --git a/src/lib/components/storage/modals/upload/UploadDropzone.svelte b/src/lib/components/storage/modals/upload/UploadDropzone.svelte
new file mode 100644
index 00000000..30e9ac46
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/UploadDropzone.svelte
@@ -0,0 +1,106 @@
+<script lang="ts">
+  import IconUploadFile from 'virtual:icons/material-symbols/upload-file';
+  import IconFileCopyOutline from 'virtual:icons/material-symbols/file-copy-outline';
+  import IconFolderOpen from 'virtual:icons/material-symbols/folder-open';
+  import * as m from '$lib/paraglide/messages.js';
+  import { collectDroppedFiles } from '$lib/storage/file-collection.js';
+
+  interface Props {
+    onFilesSelected: (pairs: { file: File; relativePath: string }[]) => void;
+  }
+
+  let { onFilesSelected }: Props = $props();
+  const uid = $props.id();
+
+  let dragOver = $state(false);
+  let fileInputEl: HTMLInputElement | null = $state(null);
+  let dirInputEl: HTMLInputElement | null = $state(null);
+
+  $effect(() => {
+    dirInputEl?.setAttribute('webkitdirectory', '');
+  });
+
+  function handleInputChange(e: Event) {
+    const list = (e.target as HTMLInputElement).files;
+    if (!list || list.length === 0) return;
+    const pairs = Array.from(list).map((f) => ({
+      file: f,
+      relativePath: f.webkitRelativePath || f.name
+    }));
+    onFilesSelected(pairs);
+    (e.target as HTMLInputElement).value = '';
+  }
+
+  async function handleDrop(e: DragEvent) {
+    e.preventDefault();
+    dragOver = false;
+    const dt = e.dataTransfer;
+    if (!dt) return;
+
+    let pairs: { file: File; relativePath: string }[];
+    try {
+      pairs = await collectDroppedFiles(dt);
+    } catch {
+      pairs = Array.from(dt.files).map((f) => ({ file: f, relativePath: f.name }));
+    }
+
+    if (pairs.length === 0) return;
+    onFilesSelected(pairs);
+  }
+</script>
+
+<input
+  bind:this={fileInputEl}
+  id="{uid}-files"
+  type="file"
+  class="sr-only"
+  multiple
+  onchange={handleInputChange}
+  aria-label={m.storage_upload_select_files()}
+/>
+<input
+  bind:this={dirInputEl}
+  id="{uid}-dir"
+  type="file"
+  class="sr-only"
+  onchange={handleInputChange}
+  aria-label={m.storage_upload_select_folder()}
+/>
+
+<div
+  role="button"
+  tabindex="0"
+  class="border-base-300 hover:border-primary/60 hover:bg-primary/5 mb-4 flex cursor-pointer flex-col items-center justify-center gap-3 rounded-lg border-2 border-dashed px-6 py-12 transition-colors {dragOver
+    ? 'border-primary bg-primary/5'
+    : ''}"
+  ondragover={(e) => {
+    e.preventDefault();
+    dragOver = true;
+  }}
+  ondragleave={() => {
+    dragOver = false;
+  }}
+  ondrop={handleDrop}
+  onclick={() => fileInputEl?.click()}
+  onkeydown={(e) => {
+    if (e.key === 'Enter' || e.key === ' ') {
+      e.preventDefault();
+      fileInputEl?.click();
+    }
+  }}
+  aria-label={m.storage_upload_drop_prompt()}
+>
+  <IconUploadFile class="text-base-content/30 size-12" aria-hidden="true" />
+  <p class="text-base-content/60 text-center text-sm">{m.storage_upload_drop_prompt()}</p>
+</div>
+
+<div class="flex justify-center gap-3">
+  <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={() => fileInputEl?.click()}>
+    <IconFileCopyOutline class="size-4" aria-hidden="true" />
+    {m.storage_upload_select_files()}
+  </button>
+  <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={() => dirInputEl?.click()}>
+    <IconFolderOpen class="size-4" aria-hidden="true" />
+    {m.storage_upload_select_folder()}
+  </button>
+</div>
diff --git a/src/lib/components/storage/modals/upload/UploadEntryStatus.svelte b/src/lib/components/storage/modals/upload/UploadEntryStatus.svelte
new file mode 100644
index 00000000..16a6c88e
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/UploadEntryStatus.svelte
@@ -0,0 +1,64 @@
+<script lang="ts">
+  import IconError from 'virtual:icons/material-symbols/error';
+  import IconCheckCircle from 'virtual:icons/material-symbols/check-circle';
+  import IconBlock from 'virtual:icons/material-symbols/block';
+  import IconSchedule from 'virtual:icons/material-symbols/schedule';
+  import * as m from '$lib/paraglide/messages.js';
+  import type { FileEntry } from './types.js';
+
+  interface Props {
+    entry: FileEntry;
+  }
+
+  let { entry }: Props = $props();
+
+  let nameOnly = $derived(
+    entry.resolution === 'rename' && entry.customName.trim()
+      ? entry.customName.trim()
+      : (entry.targetKey.split('/').at(-1) ?? entry.file.name)
+  );
+</script>
+
+<li class="px-4 py-2.5">
+  <div class="flex items-center gap-2 text-sm">
+    {#if entry.status === 'done'}
+      <IconCheckCircle class="text-success size-4 shrink-0" aria-hidden="true" />
+    {:else if entry.status === 'error'}
+      <IconError class="text-error size-4 shrink-0" aria-hidden="true" />
+    {:else if entry.status === 'skipped'}
+      <IconBlock class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+    {:else if entry.status === 'uploading'}
+      <span class="loading loading-spinner loading-xs text-primary shrink-0" aria-hidden="true"
+      ></span>
+    {:else}
+      <IconSchedule class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+    {/if}
+    <span class="min-w-0 flex-1 truncate">{nameOnly}</span>
+    <span class="text-base-content/50 shrink-0 text-xs">
+      {#if entry.status === 'uploading'}
+        {entry.progress}%
+      {:else if entry.status === 'done'}
+        {m.storage_upload_status_done()}
+      {:else if entry.status === 'skipped'}
+        {m.storage_upload_status_skipped()}
+      {:else if entry.status === 'error'}
+        {m.storage_upload_status_failed()}
+      {:else}
+        {m.storage_upload_status_queued()}
+      {/if}
+    </span>
+  </div>
+  {#if entry.status === 'uploading'}
+    <progress
+      class="progress progress-primary mt-1.5 w-full"
+      value={entry.progress}
+      max="100"
+      aria-valuenow={entry.progress}
+      aria-valuemin={0}
+      aria-valuemax={100}
+    ></progress>
+  {/if}
+  {#if entry.status === 'error' && entry.errorMessage}
+    <p class="text-error mt-1 text-xs">{entry.errorMessage}</p>
+  {/if}
+</li>
diff --git a/src/lib/components/storage/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
similarity index 50%
rename from src/lib/components/storage/UploadModal.svelte
rename to src/lib/components/storage/modals/upload/UploadModal.svelte
index 817c41f9..57f1ac18 100644
--- a/src/lib/components/storage/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -1,9 +1,17 @@
 <script lang="ts">
-  import Icon from '@iconify/svelte';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconDraft from 'virtual:icons/material-symbols/draft';
+  import IconUpload from 'virtual:icons/material-symbols/upload';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
+  import IconCheckCircle from 'virtual:icons/material-symbols/check-circle';
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
   import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
   import { formatFileSize } from '$lib/storage/utils.js';
+  import UploadDropzone from './UploadDropzone.svelte';
+  import UploadConflictEntry from './UploadConflictEntry.svelte';
+  import UploadEntryStatus from './UploadEntryStatus.svelte';
+  import type { FileEntry, Phase, Resolution, RenameState } from './types.js';
 
   interface Props {
     open: boolean;
@@ -14,60 +22,16 @@
 
   let { open = $bindable(false), bucket, prefix, onSuccess }: Props = $props();
 
-  const uid = $props.id();
-
-  // ── Types ──────────────────────────────────────────────────────────────────
-
-  type Resolution = 'replace' | 'skip' | 'rename';
-
-  /**
-   * Tracks the two-stage rename confirmation flow.
-   * idle      – rename not selected for this entry
-   * editing   – rename selected, text field is editable
-   * checking  – async conflict check in progress
-   * ok        – new name confirmed available
-   * conflict  – new name already exists in the bucket
-   */
-  type RenameState = 'idle' | 'editing' | 'checking' | 'ok' | 'conflict';
-
-  type FileEntry = {
-    id: string;
-    file: File;
-    /** Relative display path (without bucket prefix). */
-    displayPath: string;
-    /** Full object key in the bucket. */
-    targetKey: string;
-    conflict: boolean;
-    resolution: Resolution | null;
-    /** Editable filename when the user chooses to rename. */
-    customName: string;
-    renameState: RenameState;
-    status: 'pending' | 'uploading' | 'done' | 'error' | 'skipped';
-    progress: number;
-    errorMessage?: string;
-  };
-
-  type Phase = 'idle' | 'selected' | 'checking' | 'review' | 'uploading' | 'complete';
-
   // ── State ──────────────────────────────────────────────────────────────────
 
   let phase = $state<Phase>('idle');
   let entries = $state<FileEntry[]>([]);
-  let dragOver = $state(false);
-  let fileInputEl: HTMLInputElement | null = $state(null);
-  let dirInputEl: HTMLInputElement | null = $state(null);
-
-  // Set webkitdirectory on the folder input (non-standard, but widely supported in Firefox/Chromium).
-  $effect(() => {
-    dirInputEl?.setAttribute('webkitdirectory', '');
-  });
 
   // Reset when modal closes.
   $effect(() => {
     if (!open) {
       phase = 'idle';
       entries = [];
-      dragOver = false;
     }
   });
 
@@ -121,103 +85,13 @@
     }));
   }
 
-  // ── File selection ─────────────────────────────────────────────────────────
-
-  function handleInputChange(e: Event) {
-    const list = (e.target as HTMLInputElement).files;
-    if (!list || list.length === 0) return;
-    const pairs = Array.from(list).map((f) => ({
-      file: f,
-      relativePath: f.webkitRelativePath || f.name
-    }));
-    entries = makeEntries(pairs);
-    phase = 'selected';
-    // Reset the input so the same selection can be re-triggered.
-    (e.target as HTMLInputElement).value = '';
-  }
-
-  function handleDragOver(e: DragEvent) {
-    e.preventDefault();
-    dragOver = true;
-  }
-
-  function handleDragLeave() {
-    dragOver = false;
-  }
-
-  async function handleDrop(e: DragEvent) {
-    e.preventDefault();
-    dragOver = false;
-    const dt = e.dataTransfer;
-    if (!dt) return;
-
-    let pairs: { file: File; relativePath: string }[];
-    try {
-      pairs = await collectDroppedFiles(dt);
-    } catch {
-      // Fallback if the FileSystem API is unavailable.
-      pairs = Array.from(dt.files).map((f) => ({ file: f, relativePath: f.name }));
-    }
+  // ── File selection (from UploadDropzone) ───────────────────────────────────
 
-    if (pairs.length === 0) return;
+  function handleFilesSelected(pairs: { file: File; relativePath: string }[]) {
     entries = makeEntries(pairs);
     phase = 'selected';
   }
 
-  // ── Directory traversal ────────────────────────────────────────────────────
-
-  async function collectDroppedFiles(
-    dt: DataTransfer
-  ): Promise<{ file: File; relativePath: string }[]> {
-    // Collect FileSystemEntry for each dropped item once (single-use in some browsers).
-    const fsEntries = Array.from(dt.items).map((i) => i.webkitGetAsEntry?.() ?? null);
-
-    // If no directories are present, skip async traversal.
-    if (!fsEntries.some((e) => e?.isDirectory)) {
-      return Array.from(dt.files).map((f) => ({ file: f, relativePath: f.name }));
-    }
-
-    const results: { file: File; relativePath: string }[] = [];
-    for (const entry of fsEntries) {
-      if (entry) {
-        results.push(...(await traverseEntry(entry, '')));
-      }
-    }
-    return results;
-  }
-
-  async function traverseEntry(
-    entry: FileSystemEntry,
-    base: string
-  ): Promise<{ file: File; relativePath: string }[]> {
-    if (entry.isFile) {
-      return new Promise((resolve, reject) => {
-        (entry as FileSystemFileEntry).file(
-          (f) => resolve([{ file: f, relativePath: base + entry.name }]),
-          reject
-        );
-      });
-    }
-    if (entry.isDirectory) {
-      const reader = (entry as FileSystemDirectoryEntry).createReader();
-      const children = await drainReader(reader);
-      const newBase = base + entry.name + '/';
-      const nested = await Promise.all(children.map((c) => traverseEntry(c, newBase)));
-      return nested.flat();
-    }
-    return [];
-  }
-
-  async function drainReader(reader: FileSystemDirectoryReader): Promise<FileSystemEntry[]> {
-    const all: FileSystemEntry[] = [];
-    let batch: FileSystemEntry[];
-    do {
-      batch = await new Promise<FileSystemEntry[]>((res, rej) => reader.readEntries(res, rej));
-      all.push(...batch);
-    } while (batch.length > 0);
-    return all;
-  }
-
   // ── Upload flow ────────────────────────────────────────────────────────────
 
   async function startUploadFlow() {
@@ -399,7 +273,7 @@
         disabled={phase === 'uploading'}
         aria-label={m.storage_upload_close()}
       >
-        <Icon icon="material-symbols:close" class="size-5" aria-hidden="true" />
+        <IconClose class="size-5" aria-hidden="true" />
       </button>
     </div>
 
@@ -412,63 +286,7 @@
 
     <!-- ── idle: drag-and-drop zone ────────────────────────────────────── -->
     {#if phase === 'idle'}
-      <!-- Hidden inputs: one for multiple files, one for a directory -->
-      <input
-        bind:this={fileInputEl}
-        id="{uid}-files"
-        type="file"
-        class="sr-only"
-        multiple
-        onchange={handleInputChange}
-        aria-label={m.storage_upload_select_files()}
-      />
-      <input
-        bind:this={dirInputEl}
-        id="{uid}-dir"
-        type="file"
-        class="sr-only"
-        onchange={handleInputChange}
-        aria-label={m.storage_upload_select_folder()}
-      />
-
-      <!-- Drop zone -->
-      <div
-        role="button"
-        tabindex="0"
-        class="
-          border-base-300 hover:border-primary/60 hover:bg-primary/5 mb-4 flex cursor-pointer
-          flex-col items-center justify-center gap-3 rounded-lg border-2 border-dashed px-6 py-12
-          transition-colors
-          {dragOver ? 'border-primary bg-primary/5' : ''}
-        "
-        aria-label={m.storage_upload_drop_prompt()}
-        onclick={() => fileInputEl?.click()}
-        onkeydown={(e) => (e.key === 'Enter' || e.key === ' ') && fileInputEl?.click()}
-        ondragover={handleDragOver}
-        ondragleave={handleDragLeave}
-        ondrop={handleDrop}
-      >
-        <Icon
-          icon="material-symbols:upload-file"
-          class="text-base-content/30 size-12"
-          aria-hidden="true"
-        />
-        <p class="text-base-content/60 text-center text-sm">
-          {m.storage_upload_drop_prompt()}
-        </p>
-      </div>
-
-      <!-- Picker buttons -->
-      <div class="flex justify-center gap-3">
-        <button class="btn btn-ghost btn-sm gap-1.5" onclick={() => fileInputEl?.click()}>
-          <Icon icon="material-symbols:file-copy-outline" class="size-4" aria-hidden="true" />
-          {m.storage_upload_select_files()}
-        </button>
-        <button class="btn btn-ghost btn-sm gap-1.5" onclick={() => dirInputEl?.click()}>
-          <Icon icon="material-symbols:folder-open" class="size-4" aria-hidden="true" />
-          {m.storage_upload_select_folder()}
-        </button>
-      </div>
+      <UploadDropzone onFilesSelected={handleFilesSelected} />
 
       <!-- ── selected: file list preview ──────────────────────────────────── -->
     {:else if phase === 'selected'}
@@ -480,11 +298,7 @@
       >
         {#each entries as entry (entry.id)}
           <li class="flex items-center gap-3 px-4 py-2.5">
-            <Icon
-              icon="material-symbols:draft"
-              class="text-primary size-5 shrink-0"
-              aria-hidden="true"
-            />
+            <IconDraft class="text-primary size-5 shrink-0" aria-hidden="true" />
             <span class="min-w-0 flex-1 truncate text-sm">{entry.displayPath}</span>
             <span class="text-base-content/50 shrink-0 text-xs"
               >{formatFileSize(entry.file.size)}</span
@@ -503,7 +317,7 @@
           {m.storage_upload_overwrite_cancel()}
         </button>
         <button class="btn btn-primary btn-sm gap-1" onclick={startUploadFlow}>
-          <Icon icon="material-symbols:upload" class="size-4" aria-hidden="true" />
+          <IconUpload class="size-4" aria-hidden="true" />
           {m.storage_upload_start()}
         </button>
       </div>
@@ -518,11 +332,7 @@
       <!-- ── review: conflict resolution ──────────────────────────────────── -->
     {:else if phase === 'review'}
       <div class="mb-3 flex items-start gap-2">
-        <Icon
-          icon="material-symbols:warning"
-          class="text-warning mt-0.5 size-5 shrink-0"
-          aria-hidden="true"
-        />
+        <IconWarning class="text-warning mt-0.5 size-5 shrink-0" aria-hidden="true" />
         <div>
           <p class="text-base-content font-semibold">{m.storage_upload_conflicts_title()}</p>
           <p class="text-base-content/60 mt-0.5 text-sm">{m.storage_upload_conflicts_desc()}</p>
@@ -534,103 +344,13 @@
         aria-label={m.storage_upload_conflicts_title()}
       >
         {#each conflictEntries as entry (entry.id)}
-          {@const nameOnly = entry.targetKey.split('/').at(-1) ?? entry.file.name}
-          {@const badRename =
-            entry.resolution === 'rename' &&
-            (entry.customName.trim() === '' || entry.customName.trim() === entry.file.name)}
-          <li class="px-4 py-3">
-            <p class="text-base-content mb-2 truncate text-sm font-medium">
-              &ldquo;{nameOnly}&rdquo;
-            </p>
-            <!-- Resolution toggle buttons -->
-            <div
-              class="flex flex-wrap gap-1.5"
-              role="group"
-              aria-label="{m.storage_upload_conflicts_title()} — {nameOnly}"
-            >
-              <button
-                class="btn btn-xs {entry.resolution === 'replace' ? 'btn-warning' : 'btn-ghost'}"
-                onclick={() => setResolution(entry.id, 'replace')}
-                aria-pressed={entry.resolution === 'replace'}
-              >
-                {m.storage_upload_resolution_replace()}
-              </button>
-              <button
-                class="btn btn-xs {entry.resolution === 'skip' ? 'btn-neutral' : 'btn-ghost'}"
-                onclick={() => setResolution(entry.id, 'skip')}
-                aria-pressed={entry.resolution === 'skip'}
-              >
-                {m.storage_upload_resolution_skip()}
-              </button>
-              <button
-                class="btn btn-xs gap-1 {entry.resolution !== 'rename'
-                  ? 'btn-ghost'
-                  : entry.renameState === 'ok'
-                    ? 'btn-success'
-                    : entry.renameState === 'conflict'
-                      ? 'btn-error'
-                      : 'btn-primary'}"
-                onclick={() => handleRenameButtonClick(entry.id)}
-                aria-pressed={entry.resolution === 'rename'}
-                disabled={entry.renameState === 'checking'}
-              >
-                {#if entry.resolution === 'rename' && entry.renameState === 'checking'}
-                  <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
-                {:else if entry.resolution === 'rename' && entry.renameState === 'ok'}
-                  <Icon icon="material-symbols:check" class="size-3" aria-hidden="true" />
-                {/if}
-                {#if entry.resolution === 'rename' && (entry.renameState === 'editing' || entry.renameState === 'conflict')}
-                  {m.storage_upload_rename_confirm_action()}
-                {:else}
-                  {m.storage_upload_resolution_rename()}
-                {/if}
-              </button>
-            </div>
-
-            <!-- Name field: real <input> only while editing; static display otherwise -->
-            <div class="mt-2">
-              {#if entry.resolution === 'rename' && (entry.renameState === 'editing' || entry.renameState === 'conflict')}
-                <label for="{uid}-rename-{entry.id}" class="label sr-only">
-                  {m.storage_upload_rename_label()}
-                </label>
-                <input
-                  id="{uid}-rename-{entry.id}"
-                  type="text"
-                  class="input input-sm w-full {badRename || entry.renameState === 'conflict'
-                    ? 'input-error'
-                    : ''}"
-                  value={entry.customName}
-                  oninput={(e) => setCustomName(entry.id, (e.target as HTMLInputElement).value)}
-                  onkeydown={(e) => e.key === 'Enter' && void checkRename(entry.id)}
-                  placeholder={m.storage_upload_rename_label()}
-                  aria-describedby={badRename || entry.renameState === 'conflict'
-                    ? `${uid}-rename-err-${entry.id}`
-                    : undefined}
-                />
-                {#if badRename}
-                  <p id="{uid}-rename-err-{entry.id}" class="text-error mt-1 text-xs" role="alert">
-                    {m.storage_upload_rename_same_name_error()}
-                  </p>
-                {:else if entry.renameState === 'conflict'}
-                  <p id="{uid}-rename-err-{entry.id}" class="text-error mt-1 text-xs" role="alert">
-                    {m.storage_upload_rename_taken()}
-                  </p>
-                {/if}
-              {:else}
-                <!-- Static display: not in rename mode, or confirmed/checking -->
-                <div class="text-base-content/50 mt-1 flex items-center gap-1 px-1 text-sm">
-                  <span class="min-w-0 flex-1 truncate">{entry.customName}</span>
-                  {#if entry.resolution === 'rename' && entry.renameState === 'ok'}
-                    <Icon
-                      icon="material-symbols:check-circle"
-                      class="text-success size-3.5 shrink-0"
-                      aria-hidden="true"
-                    />
-                  {/if}
-                </div>
-              {/if}
-            </div>
-          </li>
+          <UploadConflictEntry
+            {entry}
+            onSetResolution={(res) => setResolution(entry.id, res)}
+            onSetCustomName={(name) => setCustomName(entry.id, name)}
+            onRenameButtonClick={() => handleRenameButtonClick(entry.id)}
+            onCheckRename={() => checkRename(entry.id)}
+          />
         {/each}
       </ul>
 
@@ -644,7 +364,7 @@
           disabled={!canProceed}
           aria-disabled={!canProceed}
         >
-          <Icon icon="material-symbols:upload" class="size-4" aria-hidden="true" />
+          <IconUpload class="size-4" aria-hidden="true" />
           {m.storage_upload_start()}
         </button>
       </div>
@@ -657,82 +377,14 @@
         aria-live="polite"
       >
         {#each entries as entry (entry.id)}
-          {@const nameOnly =
-            entry.resolution === 'rename' && entry.customName.trim()
-              ? entry.customName.trim()
-              : (entry.targetKey.split('/').at(-1) ?? entry.file.name)}
-          <li class="px-4 py-2.5">
-            <div class="flex items-center gap-2 text-sm">
-              {#if entry.status === 'done'}
-                <Icon
-                  icon="material-symbols:check-circle"
-                  class="text-success size-4 shrink-0"
-                  aria-hidden="true"
-                />
-              {:else if entry.status === 'error'}
-                <Icon
-                  icon="material-symbols:error"
-                  class="text-error size-4 shrink-0"
-                  aria-hidden="true"
-                />
-              {:else if entry.status === 'skipped'}
-                <Icon
-                  icon="material-symbols:block"
-                  class="text-base-content/30 size-4 shrink-0"
-                  aria-hidden="true"
-                />
-              {:else if entry.status === 'uploading'}
-                <span
-                  class="loading loading-spinner loading-xs text-primary shrink-0"
-                  aria-hidden="true"
-                ></span>
-              {:else}
-                <Icon
-                  icon="material-symbols:schedule"
-                  class="text-base-content/30 size-4 shrink-0"
-                  aria-hidden="true"
-                />
-              {/if}
-              <span class="min-w-0 flex-1 truncate">{nameOnly}</span>
-              <span class="text-base-content/50 shrink-0 text-xs">
-                {#if entry.status === 'uploading'}
-                  {entry.progress}%
-                {:else if entry.status === 'done'}
-                  {m.storage_upload_status_done()}
-                {:else if entry.status === 'skipped'}
-                  {m.storage_upload_status_skipped()}
-                {:else if entry.status === 'error'}
-                  {m.storage_upload_status_failed()}
-                {:else}
-                  {m.storage_upload_status_queued()}
-                {/if}
-              </span>
-            </div>
-            {#if entry.status === 'uploading'}
-              <progress
-                class="progress progress-primary mt-1.5 w-full"
-                value={entry.progress}
-                max="100"
-                aria-valuenow={entry.progress}
-                aria-valuemin={0}
-                aria-valuemax={100}
-              ></progress>
-            {/if}
-            {#if entry.status === 'error' && entry.errorMessage}
-              <p class="text-error mt-1 text-xs">{entry.errorMessage}</p>
-            {/if}
-          </li>
+          <UploadEntryStatus {entry} />
         {/each}
       </ul>
 
       <!-- ── complete ───────────────────────────────────────────────────────── -->
     {:else if phase === 'complete'}
       <div class="mb-4 flex items-center gap-3 py-2" role="status">
-        <Icon
-          icon="line-md:circle-filled-to-confirm-circle-filled-transition"
-          class="text-success size-10 shrink-0"
-          aria-hidden="true"
-        />
+        <IconCheckCircle class="text-success size-10 shrink-0" aria-hidden="true" />
         <div>
           <p class="text-base-content font-semibold">{m.storage_upload_complete_title()}</p>
           <p class="text-base-content/60 mt-0.5 text-sm">
diff --git a/src/lib/components/storage/modals/upload/types.ts b/src/lib/components/storage/modals/upload/types.ts
new file mode 100644
index 00000000..61bd2321
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/types.ts
@@ -0,0 +1,34 @@
+/**
+ * Shared types for the upload modal sub-components.
+ */
+
+export type Resolution = 'replace' | 'skip' | 'rename';
+
+/**
+ * Tracks the two-stage rename confirmation flow.
+ * idle      - rename not selected for this entry
+ * editing   - rename selected, text field is editable
+ * checking  - async conflict check in progress
+ * ok        - new name confirmed available
+ * conflict  - new name already exists in the bucket
+ */
+export type RenameState = 'idle' | 'editing' | 'checking' | 'ok' | 'conflict';
+
+export type FileEntry = {
+  id: string;
+  file: File;
+  /** Relative display path (without bucket prefix). */
+  displayPath: string;
+  /** Full object key in the bucket. */
+  targetKey: string;
+  conflict: boolean;
+  resolution: Resolution | null;
+  /** Editable filename when the user chooses to rename. */
+  customName: string;
+  renameState: RenameState;
+  status: 'pending' | 'uploading' | 'done' | 'error' | 'skipped';
+  progress: number;
+  errorMessage?: string;
+};
+
+export type Phase = 'idle' | 'selected' | 'checking' | 'review' | 'uploading' | 'complete';
diff --git a/src/lib/components/storage/TimestampDisplay.svelte b/src/lib/components/storage/shared/TimestampDisplay.svelte
similarity index 100%
rename from src/lib/components/storage/TimestampDisplay.svelte
rename to src/lib/components/storage/shared/TimestampDisplay.svelte
diff --git a/src/lib/components/storage/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
similarity index 59%
rename from src/lib/components/storage/BucketList.svelte
rename to src/lib/components/storage/sidebar/BucketList.svelte
index a6ff550d..30e2742a 100644
--- a/src/lib/components/storage/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -1,21 +1,19 @@
 <script lang="ts">
   import { page } from '$app/state';
-  import Icon from '@iconify/svelte';
+  import { resolve } from '$app/paths';
+  import { beforeNavigate } from '$app/navigation';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
+  import IconBucket from 'virtual:icons/gravity-ui/bucket';
+  import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
+  import IconGridView from 'virtual:icons/material-symbols/grid-view';
   import * as m from '$lib/paraglide/messages.js';
-  import {
-    pinnedLocations,
-    unpinLocation,
-    pinnedLabel,
-    pinnedHref,
-    type PinnedLocation,
-    type StorageLocation
-  } from '$lib/stores/pinned-locations.svelte.js';
-
-  interface Props {
-    buckets: string[];
-  }
+  import { getStorageState } from '$lib/storage/context.js';
+  import type { PinnedLocation, StorageLocation } from '$lib/storage/types.js';
+  import { pinnedLabel, pinnedHref } from '$lib/storage/display-helpers.js';
 
-  let { buckets }: Props = $props();
+  const storage = getStorageState();
 
   // Detect the active bucket from the URL so the highlight stays on when
   // navigating into any sub-prefix within the bucket.
@@ -31,11 +29,20 @@
 
   // ── Unpin context menu ────────────────────────────────────────────────────
   let unpinCtx = $state<({ x: number; y: number } & StorageLocation) | null>(null);
+  let menuEl = $state<HTMLUListElement | null>(null);
 
-  function openUnpinMenu(e: MouseEvent, pin: PinnedLocation) {
-    e.preventDefault();
-    e.stopPropagation();
-    unpinCtx = { x: e.clientX, y: e.clientY, bucket: pin.bucket, prefix: pin.prefix };
+  const adjustedPos = $derived.by(() => {
+    if (!unpinCtx) return { left: 0, top: 0 };
+    if (!menuEl) return { left: unpinCtx.x, top: unpinCtx.y };
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left: unpinCtx.x + rect.width > window.innerWidth ? unpinCtx.x - rect.width : unpinCtx.x,
+      top: unpinCtx.y + rect.height > window.innerHeight ? unpinCtx.y - rect.height : unpinCtx.y
+    };
+  });
+
+  function handleOutsideClick(e: MouseEvent) {
+    if (unpinCtx && menuEl && !menuEl.contains(e.target as Node)) closeUnpinMenu();
   }
 
   function openUnpinMenuFromButton(e: MouseEvent, pin: PinnedLocation) {
@@ -48,33 +55,54 @@
   function closeUnpinMenu() {
     unpinCtx = null;
   }
+  beforeNavigate(closeUnpinMenu);
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (unpinCtx && e.key === 'Escape') closeUnpinMenu();
+  }
 
   function handleUnpin() {
     if (unpinCtx) {
-      unpinLocation(unpinCtx.bucket, unpinCtx.prefix);
+      storage.bookmarks.unpin(unpinCtx.bucket, unpinCtx.prefix);
       closeUnpinMenu();
     }
   }
 </script>
 
+<svelte:window onkeydown={handleKeydown} />
+<svelte:document onclick={handleOutsideClick} />
+
 {#if unpinCtx}
-  <!-- svelte-ignore a11y_no_static_element_interactions -->
-  <div
-    class="fixed inset-0 z-40"
-    onmousedown={closeUnpinMenu}
-    onkeydown={(e) => e.key === 'Escape' && closeUnpinMenu()}
-  ></div>
   <ul
+    bind:this={menuEl}
+    {@attach (node) => node.focus()}
     class="
-      menu menu-sm border-base-300 bg-base-100 fixed z-[60] w-40 rounded-lg
+      menu menu-sm border-base-300 bg-base-100 fixed z-150 w-48 rounded-lg
       border p-1 shadow-lg
     "
     role="menu"
-    style="left: {unpinCtx.x}px; top: {unpinCtx.y}px;"
+    tabindex="-1"
+    style="left: {adjustedPos.left}px; top: {adjustedPos.top}px;"
   >
+    <li class="menu-title p-0" role="none">
+      <div class="menu-title flex items-center justify-between py-1 pr-0 pl-2">
+        <span class="text-base-content/70 text-xs font-medium">
+          {m.storage_context_menu_actions()}
+        </span>
+        <button
+          type="button"
+          role="menuitem"
+          class="btn btn-ghost btn-xs"
+          aria-label={m.storage_preview_close()}
+          onclick={closeUnpinMenu}
+        >
+          <IconClose class="size-4" aria-hidden="true" />
+        </button>
+      </div>
+    </li>
     <li role="none">
       <button role="menuitem" class="justify-start" onclick={handleUnpin}>
-        <Icon icon="material-symbols:push-pin-outline" class="size-4 shrink-0" aria-hidden="true" />
+        <IconPushPinOutline class="mr-2 size-4 shrink-0" aria-hidden="true" />
         {m.storage_action_unpin()}
       </button>
     </li>
@@ -89,7 +117,7 @@
   aria-label={m.storage_buckets_label()}
 >
   <!-- Pinned Access section -->
-  {#if pinnedLocations.length > 0}
+  {#if storage.bookmarks.pinnedLocations.length > 0}
     <div class="border-base-300 border-b">
       <div class="flex items-center px-3 py-2">
         <span class="text-base-content/50 text-xs font-semibold tracking-wide uppercase">
@@ -97,10 +125,11 @@
         </span>
       </div>
       <ul class="py-1" role="list">
-        {#each pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
+        {#each storage.bookmarks.pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
           {@const active = isPinnedActive(pin)}
           <li role="none" class="group relative">
             <div class="tooltip tooltip-right relative z-50 w-full" data-tip={pinnedLabel(pin)}>
+              <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <a
                 href={pinnedHref(pin)}
                 data-sveltekit-preload-data="off"
@@ -109,27 +138,19 @@
                 pr-7 text-sm
                 {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}"
                 aria-current={active ? 'page' : undefined}
-                oncontextmenu={(e) => openUnpinMenu(e, pin)}
               >
+                <!-- eslint-enable svelte/no-navigation-without-resolve -->
                 {#if pin.prefix === ''}
-                  <Icon
-                    icon="mdi:bucket-outline"
-                    class="size-3.5 shrink-0 opacity-60"
-                    aria-hidden="true"
-                  />
+                  <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
                 {:else}
-                  <Icon
-                    icon="material-symbols:folder-outline"
-                    class="size-3.5 shrink-0 opacity-60"
-                    aria-hidden="true"
-                  />
+                  <IconFolderOutline class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
                 {/if}
                 <span class="truncate">{pinnedLabel(pin)}</span>
               </a>
             </div>
             <button
               class="
-                btn btn-ghost btn-xs absolute top-1/2 right-1 z-[51] -translate-y-1/2
+                btn btn-ghost btn-xs absolute top-1/2 right-1 z-60 -translate-y-1/2
                 p-0 opacity-0 transition-opacity
                 group-hover:opacity-100 focus:opacity-100
               "
@@ -137,7 +158,7 @@
               aria-label={m.storage_more_options()}
               title={m.storage_more_options()}
             >
-              <Icon icon="material-symbols:more-horiz" class="size-3.5" aria-hidden="true" />
+              <IconMoreHoriz class="size-3.5" aria-hidden="true" />
             </button>
           </li>
         {/each}
@@ -158,14 +179,13 @@
       {m.storage_buckets_label()}
     </span>
     <a
-      href="/storage"
+      href={resolve('/storage')}
       data-sveltekit-preload-data="off"
-      class="btn btn-ghost btn-xs group tooltip tooltip-right"
+      class="btn btn-ghost btn-xs group tooltip tooltip-right z-60"
       title={m.storage_view_all_buckets()}
       data-tip={m.storage_view_all_buckets()}
     >
-      <Icon
-        icon="material-symbols:grid-view"
+      <IconGridView
         class="group-hover:text-primary size-3.5 transition-colors"
         aria-hidden="true"
       />
@@ -173,15 +193,18 @@
   </div>
 
   <ul class="flex-1 py-1" role="list">
-    {#if buckets.length === 0}
+    {#if storage.buckets.length === 0}
       <li class="text-base-content/40 px-3 py-4 text-center text-xs">
         {m.storage_buckets_empty()}
       </li>
     {:else}
-      {#each buckets as bucket (bucket)}
+      {#each storage.buckets as bucket (bucket)}
         <li role="none">
           <a
-            href="/storage/{encodeURIComponent(bucket)}"
+            href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+              bucket: encodeURIComponent(bucket),
+              prefix: ''
+            })}
             data-sveltekit-preload-data="off"
             class="
               hover:bg-base-200 tooltip tooltip-right flex items-center gap-2
@@ -192,11 +215,7 @@
             data-tip={bucket}
             aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
           >
-            <Icon
-              icon="mdi:bucket-outline"
-              class="size-3.5 shrink-0 opacity-60"
-              aria-hidden="true"
-            />
+            <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
             <span class="truncate">{bucket}</span>
           </a>
         </li>
diff --git a/src/lib/editor/completion/completion-provider.ts b/src/lib/editor/completion/completion-provider.ts
index fdc39b34..df16bfce 100644
--- a/src/lib/editor/completion/completion-provider.ts
+++ b/src/lib/editor/completion/completion-provider.ts
@@ -391,8 +391,8 @@ async function appendColumnItems(
     return true;
   });
 
-  await Promise.all(
-    unique.map(async (r) => {
+  await Promise.all([
+    ...unique.map(async (r) => {
       try {
         const resolved = resolveAlias(r, defaults);
         if (!resolved) return;
@@ -420,6 +420,33 @@ async function appendColumnItems(
         // Ignore individual failures (e.g. mistyped table names) so we can still
         // offer columns from the other valid relations in scope.
       }
-    })
-  );
+    }),
+    appendFunctionItems(monaco, out, range)
+  ]);
+}
+
+/** Built-in Trino functions. Callable anywhere a primary expression is, so
+ *  surfaced alongside the bare-column slot. The snippet inserts `name($0)`
+ *  and parks the cursor between the parens for immediate argument typing.
+ *  Builds via `makeItem` and then overrides `insertText` / `insertTextRules`. */
+async function appendFunctionItems(
+  monaco: typeof Monaco,
+  out: Monaco.languages.CompletionItem[],
+  range: Monaco.IRange
+): Promise<void> {
+  const fns = await fetchNames({ level: 'functions' });
+  for (const fn of fns) {
+    out.push({
+      ...makeItem(
+        fn,
+        monaco.languages.CompletionItemKind.Function,
+        'functions',
+        range,
+        m.completion_detail_function(),
+        '2_'
+      ),
+      insertText: `${fn}($0)`,
+      insertTextRules: monaco.languages.CompletionItemInsertTextRule.InsertAsSnippet
+    });
+  }
 }
diff --git a/src/lib/editor/completion/completion.test.ts b/src/lib/editor/completion/completion.test.ts
index 113c32e6..2e4f888b 100644
--- a/src/lib/editor/completion/completion.test.ts
+++ b/src/lib/editor/completion/completion.test.ts
@@ -120,6 +120,16 @@ describe('analyseCompletion — repair of malformed SQL', () => {
     // The WHERE position is a column slot.
     expect(analysis.identifierKind).toBe('column');
   });
+
+  it('classifies a relation slot inside a subquery with no closing paren', () => {
+    const analysis = analyseCompletion(at('SELECT (SELECT * FROM |'));
+    expect(analysis.identifierKind).toBe('relation');
+  });
+
+  it('classifies a column slot inside a subquery with no closing paren', () => {
+    const analysis = analyseCompletion(at('SELECT (SELECT |'));
+    expect(analysis.identifierKind).toBe('column');
+  });
 });
 
 describe('analyseCompletion — alias map', () => {
diff --git a/src/lib/editor/completion/cursor-context.ts b/src/lib/editor/completion/cursor-context.ts
index 151e4bc9..1a9b6669 100644
--- a/src/lib/editor/completion/cursor-context.ts
+++ b/src/lib/editor/completion/cursor-context.ts
@@ -9,7 +9,7 @@ import {
   DOT,
   IDENTIFIER_TOKENS,
   LPAREN,
-  RPAREN,
+  parenGroupEndPosition,
   readQualifiedName
 } from '../lexer-utils.js';
 import { unquoteIdentifier } from '../identifiers.js';
@@ -35,19 +35,6 @@ function partsToAlias(parts: string[]): RelationAlias | null {
   return { catalog: parts[0], schema: parts[1], table: parts[2] };
 }
 
-/** Returns the position after the matching `)` of a balanced `(…)` group.
- *  Returns whether the group was successfully closed. */
-function parenGroupEndPosition(tokens: Token[], start: number): { pos: number; closed: boolean } {
-  let depth = 1;
-  let pos = start + 1;
-  while (pos < tokens.length && depth > 0) {
-    if (tokens[pos].type === LPAREN) depth++;
-    else if (tokens[pos].type === RPAREN) depth--;
-    pos++;
-  }
-  return { pos, closed: depth === 0 };
-}
-
 /** If `pos` points at an `(`, skip past the matching `)` and return the
  *  position after it. Otherwise return `pos` unchanged. */
 function skipOptionalParenGroup(tokens: Token[], pos: number): number {
diff --git a/src/lib/editor/completion/grammar-analysis.ts b/src/lib/editor/completion/grammar-analysis.ts
index d3d520ba..8df5de7b 100644
--- a/src/lib/editor/completion/grammar-analysis.ts
+++ b/src/lib/editor/completion/grammar-analysis.ts
@@ -1,10 +1,8 @@
-// Grammar-driven answers for "what is legal at the cursor?". Runs
-// antlr4-c3's CodeCompletionCore against the partial SQL up to the cursor
-// and classifies the slot as relation / column / keyword-only via
-// preferred rules. When c3 reports nothing reachable because the mid-edit
-// SQL is malformed (e.g. `SELECT FROM ...`), a repair loop iterates:
-// ANTLR's error listener flags extraneous keyword tokens, we inject a
-// phantom identifier before each, and retry.
+// Classifies the cursor slot (relation / column / keyword-only) via
+// antlr4-c3's CodeCompletionCore against the partial SQL. Two recovery
+// passes cope with mid-edit input: scope reduction recurses on the inner
+// SQL when the cursor is inside an unmatched `(`, and a repair loop
+// injects phantom identifiers before extraneous keywords flagged by ANTLR.
 
 import {
   ATNSimulator,
@@ -18,7 +16,7 @@ import { CodeCompletionCore } from 'antlr4-c3';
 import { SqlBaseLexer } from '../generated/SqlBaseLexer.js';
 import { SqlBaseParser } from '../generated/SqlBaseParser.js';
 import { tokenMap } from '../tokenMap.js';
-import { DOT } from '../lexer-utils.js';
+import { DOT, lexSql, unclosedParenOffset } from '../lexer-utils.js';
 
 export type IdentifierKind = 'relation' | 'column' | null;
 
@@ -147,7 +145,6 @@ function analyseGrammarAt(
   return { keywords: [...keywords].sort(), identifierKind, isUnparseable };
 }
 
-/** Lex+parse `sql` and run the c3 grammar analysis at its final token. */
 function parseAndAnalyse(sql: string, extendingPrevious: boolean): GrammarAnalysis {
   try {
     const { parser } = buildParser(sql);
@@ -158,8 +155,6 @@ function parseAndAnalyse(sql: string, extendingPrevious: boolean): GrammarAnalys
   }
 }
 
-/** Index of the last non-EOF token on the default channel. Falls back to 0
- *  for empty / whitespace-only input so c3 has a valid anchor. */
 function lastDefaultChannelTokenIndex(parser: SqlBaseParser): number {
   const tokens = (parser.inputStream as CommonTokenStream).getTokens();
   for (let i = tokens.length - 1; i >= 0; i--) {
@@ -245,16 +240,25 @@ function repairWithParserErrors(sql: string): string | null {
   return patched;
 }
 
-/** Append a phantom token if the cursor isn't already inside a partial word,
- *  run the grammar analysis, and iterate the repair pass while c3 reports
- *  nothing reachable. The loop terminates as soon as repair can't change the
- *  string further — each successful pass strictly grows the input by
- *  inserting a phantom, so this is guaranteed to halt. */
+/** Run the grammar analysis at the cursor, recovering from common mid-edit
+ *  shapes via scope reduction (cursor inside an unmatched `(`) and repair
+ *  (extraneous keyword inserted phantom). The repair loop halts because
+ *  each iteration strictly grows the input by at least one phantom. */
 export function analyseAtCursor(
   sqlUpToCursor: string,
   prefix: { prefixParts: string[]; wordAtCursor: string },
   tokensUpToCursor: Token[]
 ): GrammarAnalysis {
+  // If the cursor sits inside an unmatched `(` (scalar subquery, IN-subquery,
+  // CTE body, …), recurse on just the inner SQL. c3's preferred-rule walk
+  // would otherwise stop at the outer wrapping `primaryExpression` and never
+  // surface the inner FROM/SELECT slot.
+  const innerStart = unclosedParenOffset(tokensUpToCursor);
+  if (innerStart !== null) {
+    const innerSql = sqlUpToCursor.slice(innerStart + 1);
+    return analyseAtCursor(innerSql, prefix, lexSql(innerSql));
+  }
+
   const midWord = prefix.wordAtCursor !== '';
   const afterDot = tokensUpToCursor[tokensUpToCursor.length - 1]?.type === DOT;
 
diff --git a/src/lib/editor/lexer-utils.ts b/src/lib/editor/lexer-utils.ts
index 686ef708..9cc903e0 100644
--- a/src/lib/editor/lexer-utils.ts
+++ b/src/lib/editor/lexer-utils.ts
@@ -37,6 +37,32 @@ export function lexSql(sql: string): Token[] {
   return tokens;
 }
 
+/** Returns the position after the matching `)` of a balanced `(…)` group.
+ *  Returns whether the group was successfully closed. */
+export function parenGroupEndPosition(
+  tokens: Token[],
+  start: number
+): { pos: number; closed: boolean } {
+  let depth = 1;
+  let pos = start + 1;
+  while (pos < tokens.length && depth > 0) {
+    if (tokens[pos].type === LPAREN) depth++;
+    else if (tokens[pos].type === RPAREN) depth--;
+    pos++;
+  }
+  return { pos, closed: depth === 0 };
+}
+
+/** Char position of the innermost unmatched `(`, or null if every `(` closes. */
+export function unclosedParenOffset(tokens: Token[]): number | null {
+  const stack: number[] = [];
+  for (const t of tokens) {
+    if (t.type === LPAREN) stack.push(t.start);
+    else if (t.type === RPAREN && stack.length > 0) stack.pop();
+  }
+  return stack.length > 0 ? stack[stack.length - 1] : null;
+}
+
 /** Read a dotted qualified name (a.b.c) starting at `start`, returning the
  *  unquoted parts and the index of the token after the name. Stops at the
  *  first non-identifier token, or at a trailing dot not followed by an
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 53e543b8..c10257e0 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -3,10 +3,11 @@
 
 import { env } from '$env/dynamic/private';
 
-/** When `STACKABLE_UI_COMPLETION_ENABLED=true`, the SQL editor's
- *  code-completion provider is registered and the metadata endpoint
- *  accepts requests. Useful to enable enhanced SQL editing features. */
-export const completionEnabled = env.STACKABLE_UI_COMPLETION_ENABLED === 'true';
+/** When `STACKABLE_UI_COMPLETION_ENABLED=false`, the SQL editor's
+ *  code-completion provider is not registered and the metadata endpoint
+ *  refuses requests. Useful to fall back to plain syntax highlighting if
+ *  completion misbehaves or generates undesirable load on Trino. */
+export const completionEnabled = env.STACKABLE_UI_COMPLETION_ENABLED !== 'false';
 
 /** When `STACKABLE_UI_STORAGE_BROWSER_ENABLED=true`, the S3/HDFS file
  *  browser is shown in the sidebar and routes under `/storage` become
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index d33a23cc..e6fac66f 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -30,7 +30,7 @@ export class S3StorageProvider implements StorageProvider {
     pageSize: number,
     continuationToken?: string | null
   ): Promise<StoragePage> {
-    log.debug({ bucket: this.bucket, prefix, page_size: pageSize }, 'listing objects');
+    log.trace({ bucket: this.bucket, prefix, page_size: pageSize }, 'S3 ListObjectsV2');
 
     const output: ListObjectsV2CommandOutput = await this.client.send(
       new ListObjectsV2Command({
@@ -73,7 +73,7 @@ export class S3StorageProvider implements StorageProvider {
   }
 
   async getObject(key: string): Promise<ObjectDownload> {
-    log.debug({ bucket: this.bucket, key }, 'getting object');
+    log.trace({ bucket: this.bucket, key }, 'S3 GetObject');
     const output = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
     if (!output.Body) {
       throw new Error(`Object ${key} has no body`);
@@ -87,7 +87,7 @@ export class S3StorageProvider implements StorageProvider {
   }
 
   async getObjectRange(key: string, start: number, end: number): Promise<ReadableStream> {
-    log.debug({ bucket: this.bucket, key, start, end }, 'getting object range');
+    log.trace({ bucket: this.bucket, key, start, end }, 'S3 GetObject (range)');
     const output = await this.client.send(
       new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
     );
@@ -98,7 +98,7 @@ export class S3StorageProvider implements StorageProvider {
   }
 
   async getMetadata(key: string): Promise<StorageMetadata> {
-    log.debug({ bucket: this.bucket, key }, 'getting object metadata');
+    log.trace({ bucket: this.bucket, key }, 'S3 HeadObject');
     const output = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
     return {
       size: output.ContentLength ?? 0,
@@ -130,9 +130,9 @@ export class S3StorageProvider implements StorageProvider {
     contentType: string,
     contentLength?: number
   ): Promise<void> {
-    log.debug(
+    log.trace(
       { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
-      'uploading object'
+      'S3 Upload'
     );
     const upload = new Upload({
       client: this.client,
@@ -147,14 +147,10 @@ export class S3StorageProvider implements StorageProvider {
       }
     });
     await upload.done();
-    log.info(
-      { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
-      'object uploaded'
-    );
   }
 
   async deleteObjects(keys: string[]): Promise<DeleteObjectsResult> {
-    log.debug({ bucket: this.bucket, key_count: keys.length }, 'deleting objects');
+    log.trace({ bucket: this.bucket, key_count: keys.length }, 'S3 DeleteObjects');
     const output = await this.client.send(
       new DeleteObjectsCommand({
         Bucket: this.bucket,
@@ -179,7 +175,7 @@ export class S3StorageProvider implements StorageProvider {
   }
 
   async listAllKeys(prefix: string): Promise<string[]> {
-    log.debug({ bucket: this.bucket, prefix }, 'listing all keys under prefix');
+    log.trace({ bucket: this.bucket, prefix }, 'S3 ListObjectsV2 (recursive)');
     const keys: string[] = [];
     let continuationToken: string | undefined;
 
@@ -197,7 +193,10 @@ export class S3StorageProvider implements StorageProvider {
       continuationToken = output.IsTruncated ? output.NextContinuationToken : undefined;
     } while (continuationToken);
 
-    log.debug({ bucket: this.bucket, prefix, key_count: keys.length }, 'listed all keys');
+    log.trace(
+      { bucket: this.bucket, prefix, key_count: keys.length },
+      'recursive listing complete'
+    );
     return keys;
   }
 }
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index d7aae91d..c4550e94 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -1,6 +1,5 @@
 import { S3ServiceException, ListBucketsCommand } from '@aws-sdk/client-s3';
 import { getUserConnection, setUserConnection, clearUserConnection } from './user-connections.js';
-import type { S3ConnectionConfig } from './types.js';
 import { createS3Client } from './s3-client.js';
 import { mapS3ErrorToHttp } from './s3-errors.js';
 import { getProviderForUser } from './utils.js';
@@ -151,5 +150,3 @@ export async function deleteObjects(
     throw err;
   }
 }
-
-export type { S3ConnectionConfig };
diff --git a/src/lib/storage/bookmarks.svelte.ts b/src/lib/storage/bookmarks.svelte.ts
new file mode 100644
index 00000000..0e7be970
--- /dev/null
+++ b/src/lib/storage/bookmarks.svelte.ts
@@ -0,0 +1,96 @@
+import type { PinnedLocation, RecentFile, RecentLocation } from './types.js';
+import {
+  LS_PINS,
+  LS_RECENT_FILES,
+  LS_RECENT_LOCATIONS,
+  MAX_RECENT,
+  loadFromStorage,
+  persistToStorage
+} from './persistence.js';
+import { SvelteDate } from 'svelte/reactivity';
+
+export class BookmarksState {
+  pinnedLocations = $state<PinnedLocation[]>(loadFromStorage<PinnedLocation>(LS_PINS));
+  recentFiles = $state<RecentFile[]>(loadFromStorage<RecentFile>(LS_RECENT_FILES));
+  recentLocations = $state<RecentLocation[]>(
+    loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter((l) => Boolean(l.bucket))
+  );
+
+  pin(bucket: string, prefix: string): void {
+    if (this.pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix)) return;
+    this.pinnedLocations.push({ bucket, prefix });
+    this.persistPins();
+  }
+
+  unpin(bucket: string, prefix: string): void {
+    const idx = this.pinnedLocations.findIndex((p) => p.bucket === bucket && p.prefix === prefix);
+    if (idx !== -1) {
+      this.pinnedLocations.splice(idx, 1);
+      this.persistPins();
+    }
+  }
+
+  isPinned(bucket: string, prefix: string): boolean {
+    return this.pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix);
+  }
+
+  unpinUnderDirectories(bucket: string, dirPrefixes: string[]): void {
+    if (dirPrefixes.length === 0) return;
+    const underAny = (prefix: string) =>
+      dirPrefixes.some((p) => prefix === p || prefix.startsWith(p));
+    const before = this.pinnedLocations.length;
+    const keep = this.pinnedLocations.filter(
+      (pin) => !(pin.bucket === bucket && underAny(pin.prefix))
+    );
+    if (keep.length !== before) {
+      this.pinnedLocations.splice(0, this.pinnedLocations.length, ...keep);
+      this.persistPins();
+    }
+  }
+
+  private persistPins(): void {
+    persistToStorage(LS_PINS, [...this.pinnedLocations]);
+  }
+
+  recordFileVisit(bucket: string, key: string, size: number): void {
+    const idx = this.recentFiles.findIndex((f) => f.bucket === bucket && f.key === key);
+    const entry: RecentFile = { key, bucket, size, visitedAt: new SvelteDate().toISOString() };
+    if (idx !== -1) this.recentFiles.splice(idx, 1);
+    this.recentFiles.unshift(entry);
+    if (this.recentFiles.length > MAX_RECENT) this.recentFiles.splice(MAX_RECENT);
+    persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+  }
+
+  recordLocationVisit(bucket: string, prefix: string): void {
+    if (!bucket) return;
+    const idx = this.recentLocations.findIndex((l) => l.bucket === bucket && l.prefix === prefix);
+    const entry: RecentLocation = { bucket, prefix, visitedAt: new SvelteDate().toISOString() };
+    if (idx !== -1) this.recentLocations.splice(idx, 1);
+    this.recentLocations.unshift(entry);
+    if (this.recentLocations.length > MAX_RECENT) this.recentLocations.splice(MAX_RECENT);
+    persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
+  }
+
+  removeItemsUnderDirectories(bucket: string, dirPrefixes: string[]): void {
+    if (dirPrefixes.length === 0) return;
+    const underAny = (path: string) => dirPrefixes.some((p) => path === p || path.startsWith(p));
+
+    const removedFiles = this.recentFiles.filter(
+      (f) => f.bucket === bucket && underAny(f.key)
+    ).length;
+    if (removedFiles > 0) {
+      const keep = this.recentFiles.filter((f) => !(f.bucket === bucket && underAny(f.key)));
+      this.recentFiles.splice(0, this.recentFiles.length, ...keep);
+      persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+    }
+
+    const removedLocs = this.recentLocations.filter(
+      (l) => l.bucket === bucket && underAny(l.prefix)
+    ).length;
+    if (removedLocs > 0) {
+      const keep = this.recentLocations.filter((l) => !(l.bucket === bucket && underAny(l.prefix)));
+      this.recentLocations.splice(0, this.recentLocations.length, ...keep);
+      persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
+    }
+  }
+}
diff --git a/src/lib/storage/context.ts b/src/lib/storage/context.ts
new file mode 100644
index 00000000..989b4317
--- /dev/null
+++ b/src/lib/storage/context.ts
@@ -0,0 +1,4 @@
+import { createContext } from 'svelte';
+import type { StorageState } from './state.svelte.js';
+
+export const [getStorageState, setStorageState] = createContext<StorageState>();
diff --git a/src/lib/storage/delete.ts b/src/lib/storage/delete.ts
deleted file mode 100644
index ffebbc23..00000000
--- a/src/lib/storage/delete.ts
+++ /dev/null
@@ -1,53 +0,0 @@
-/**
- * Client-side utility for deleting one or more S3 objects via the server proxy.
- */
-
-import type { DeleteObjectsResult } from '$lib/storage/types.js';
-import { unpinUnderDirectories } from '$lib/stores/pinned-locations.svelte.js';
-import { removeItemsUnderDirectories } from '$lib/stores/recent-items.svelte.js';
-
-export type DeleteErrorCode = 'not_connected' | 'access_denied' | 'server_error' | 'unknown';
-
-export class DeleteError extends Error {
-  constructor(
-    public readonly code: DeleteErrorCode,
-    message: string
-  ) {
-    super(message);
-    this.name = 'DeleteError';
-  }
-}
-
-function mapStatusToCode(status: number): DeleteErrorCode {
-  if (status === 401) return 'not_connected';
-  if (status === 403) return 'access_denied';
-  if (status >= 500) return 'server_error';
-  return 'unknown';
-}
-
-/**
- * Delete one or more S3 objects.
- *
- * Resolves with `failed` listing any objects the server could not delete
- * (partial S3 failures). Throws a `DeleteError` only on transport/auth errors.
- */
-export async function deleteObjects(bucket: string, keys: string[]): Promise<DeleteObjectsResult> {
-  const params = new URLSearchParams({ bucket });
-  for (const key of keys) params.append('keys', key);
-
-  const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE' });
-  if (!res.ok) {
-    throw new DeleteError(mapStatusToCode(res.status), `Delete failed with status ${res.status}`);
-  }
-
-  const result = (await res.json()) as DeleteObjectsResult;
-
-  // Clean up pinned locations and recent items for any deleted directories.
-  const dirPrefixes = keys.filter((k) => k.endsWith('/'));
-  if (dirPrefixes.length > 0) {
-    unpinUnderDirectories(bucket, dirPrefixes);
-    removeItemsUnderDirectories(bucket, dirPrefixes);
-  }
-
-  return result;
-}
diff --git a/src/lib/storage/display-helpers.ts b/src/lib/storage/display-helpers.ts
new file mode 100644
index 00000000..d9e4874f
--- /dev/null
+++ b/src/lib/storage/display-helpers.ts
@@ -0,0 +1,68 @@
+import { resolve } from '$app/paths';
+import type { ResolvedPathname } from '$app/types';
+import type { PinnedLocation, RecentFile, RecentLocation } from './types.js';
+
+const STORAGE_ROUTE = '/(app)/storage/[bucket]/[...prefix]' as const;
+
+// ── URL helpers ──────────────────────────────────────────────────────────────
+
+export function storageHref(bucket: string, prefix: string): ResolvedPathname {
+  const encodedBucket = encodeURIComponent(bucket);
+  const encodedPrefix = prefix
+    ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+    : '';
+  return resolve(STORAGE_ROUTE, { bucket: encodedBucket, prefix: encodedPrefix });
+}
+
+// ── Pinned location helpers ──────────────────────────────────────────────────
+
+export function pinnedLabel(pin: PinnedLocation): string {
+  if (!pin.prefix) return pin.bucket;
+  const parts = pin.prefix.split('/').filter(Boolean);
+  return parts[parts.length - 1] ?? pin.bucket;
+}
+
+export function pinnedHref(pin: PinnedLocation): ResolvedPathname {
+  return storageHref(pin.bucket, pin.prefix);
+}
+
+// ── Recent file helpers ──────────────────────────────────────────────────────
+
+export function fileName(key: string): string {
+  const parts = key.split('/').filter(Boolean);
+  return parts[parts.length - 1] ?? key;
+}
+
+export function fileLocation(file: RecentFile): string {
+  const parts = file.key.split('/').filter(Boolean);
+  parts.pop();
+  return parts.length > 0 ? `${file.bucket} / ${parts.join(' / ')}` : file.bucket;
+}
+
+export function fileHref(file: RecentFile): ResolvedPathname {
+  const parts = file.key.split('/').filter(Boolean);
+  parts.pop();
+  const encodedPrefix = parts.map(encodeURIComponent).join('/');
+  return resolve(STORAGE_ROUTE, {
+    bucket: encodeURIComponent(file.bucket),
+    prefix: encodedPrefix
+  });
+}
+
+// ── Recent location helpers ──────────────────────────────────────────────────
+
+export function locationName(loc: RecentLocation): string {
+  if (!loc.prefix) return loc.bucket;
+  const parts = loc.prefix.split('/').filter(Boolean);
+  return parts[parts.length - 1] ?? loc.bucket;
+}
+
+export function locationPath(loc: RecentLocation): string {
+  if (!loc.prefix) return loc.bucket;
+  const parts = loc.prefix.split('/').filter(Boolean);
+  return `${loc.bucket} / ${parts.join(' / ')}`;
+}
+
+export function locationHref(loc: RecentLocation): ResolvedPathname {
+  return storageHref(loc.bucket, loc.prefix);
+}
diff --git a/src/lib/components/storage/actions/errors.ts b/src/lib/storage/errors.ts
similarity index 54%
rename from src/lib/components/storage/actions/errors.ts
rename to src/lib/storage/errors.ts
index 27e7e170..58f32852 100644
--- a/src/lib/components/storage/actions/errors.ts
+++ b/src/lib/storage/errors.ts
@@ -1,7 +1,19 @@
 import * as m from '$lib/paraglide/messages.js';
-import type { ActionError } from './types.js';
 
-/** Map an ActionError to a localised user-facing string. */
+// ── ActionError ──────────────────────────────────────────────────────────────
+
+export class ActionError extends Error {
+  constructor(
+    public readonly code: string,
+    message: string
+  ) {
+    super(message);
+    this.name = 'ActionError';
+  }
+}
+
+// ── Error message mapping ────────────────────────────────────────────────────
+
 export function getActionErrorMessage(err: ActionError): string {
   switch (err.code) {
     case 'not_connected':
diff --git a/src/lib/storage/file-collection.ts b/src/lib/storage/file-collection.ts
new file mode 100644
index 00000000..248a026b
--- /dev/null
+++ b/src/lib/storage/file-collection.ts
@@ -0,0 +1,57 @@
+/**
+ * File collection utilities for drag-and-drop uploads.
+ * Handles directory traversal via the FileSystem API for folder drops.
+ */
+
+export type FilePair = { file: File; relativePath: string };
+
+/**
+ * Collect files from a DataTransfer (drop event), traversing directories
+ * if the FileSystem API is available.
+ */
+export async function collectDroppedFiles(dt: DataTransfer): Promise<FilePair[]> {
+  // Collect FileSystemEntry for each dropped item once (single-use in some browsers).
+  const fsEntries = Array.from(dt.items).map((i) => i.webkitGetAsEntry?.() ?? null);
+
+  // If no directories are present, skip async traversal.
+  if (!fsEntries.some((e) => e?.isDirectory)) {
+    return Array.from(dt.files).map((f) => ({ file: f, relativePath: f.name }));
+  }
+
+  const results: FilePair[] = [];
+  for (const entry of fsEntries) {
+    if (entry) {
+      results.push(...(await traverseEntry(entry, '')));
+    }
+  }
+  return results;
+}
+
+async function traverseEntry(entry: FileSystemEntry, base: string): Promise<FilePair[]> {
+  if (entry.isFile) {
+    return new Promise((resolve, reject) => {
+      (entry as FileSystemFileEntry).file(
+        (f) => resolve([{ file: f, relativePath: base + entry.name }]),
+        reject
+      );
+    });
+  }
+  if (entry.isDirectory) {
+    const reader = (entry as FileSystemDirectoryEntry).createReader();
+    const children = await drainReader(reader);
+    const newBase = base + entry.name + '/';
+    const nested = await Promise.all(children.map((c) => traverseEntry(c, newBase)));
+    return nested.flat();
+  }
+  return [];
+}
+
+async function drainReader(reader: FileSystemDirectoryReader): Promise<FileSystemEntry[]> {
+  const all: FileSystemEntry[] = [];
+  let batch: FileSystemEntry[];
+  do {
+    batch = await new Promise<FileSystemEntry[]>((res, rej) => reader.readEntries(res, rej));
+    all.push(...batch);
+  } while (batch.length > 0);
+  return all;
+}
diff --git a/src/lib/storage/persistence.ts b/src/lib/storage/persistence.ts
new file mode 100644
index 00000000..0c17b21d
--- /dev/null
+++ b/src/lib/storage/persistence.ts
@@ -0,0 +1,27 @@
+import { browser } from '$app/environment';
+
+// ── localStorage keys ────────────────────────────────────────────────────────
+
+export const LS_PINS = 'pinned_storage_locations';
+export const LS_RECENT_FILES = 'recent_storage_files';
+export const LS_RECENT_LOCATIONS = 'recent_storage_locations';
+
+export const MAX_RECENT = 15;
+
+// ── Utilities ────────────────────────────────────────────────────────────────
+
+export function loadFromStorage<T>(key: string): T[] {
+  if (!browser) return [];
+  try {
+    const raw = localStorage.getItem(key);
+    return raw ? (JSON.parse(raw) as T[]) : [];
+  } catch {
+    return [];
+  }
+}
+
+export function persistToStorage(key: string, data: unknown[]): void {
+  if (browser) {
+    localStorage.setItem(key, JSON.stringify(data));
+  }
+}
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
new file mode 100644
index 00000000..c9955a11
--- /dev/null
+++ b/src/lib/storage/state.svelte.ts
@@ -0,0 +1,377 @@
+import { SvelteSet, SvelteURLSearchParams } from 'svelte/reactivity';
+import { invalidateAll } from '$app/navigation';
+import * as m from '$lib/paraglide/messages.js';
+import type { StoragePage, StorageObject } from '$lib/storage/types.js';
+import type {
+  ActiveModal,
+  ModalType,
+  ModalPayloads,
+  ContextMenuState,
+  NavigateFn,
+  ActionName
+} from '$lib/storage/types.js';
+import { initPageSize, type PageSize } from '$lib/types/pagination.js';
+import { downloadObject, DownloadError } from '$lib/storage/download.js';
+import { addToast } from '$lib/stores/toast.svelte.js';
+import { ActionError, getActionErrorMessage } from './errors.js';
+import { BookmarksState } from './bookmarks.svelte.js';
+
+export class StorageState {
+  // ── Core data (synced from server load) ──
+  bucket = $state('');
+  prefix = $state('');
+  objects = $state.raw<StoragePage>({
+    objects: [],
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  });
+  buckets = $state<string[]>([]);
+  connected = $state(false);
+
+  // ── Derived views ──
+  folders = $derived(this.objects.objects.filter((o: StorageObject) => o.isDirectory));
+  files = $derived(this.objects.objects.filter((o: StorageObject) => !o.isDirectory));
+  totalItemCount = $derived(this.folders.length + this.files.length);
+
+  // ── Selection ──
+  selectedKeys = $state(new SvelteSet<string>());
+  selectionMode = $state(false);
+
+  allSelected = $derived(this.totalItemCount > 0 && this.selectedKeys.size >= this.totalItemCount);
+  someSelected = $derived(
+    this.selectedKeys.size > 0 && this.selectedKeys.size < this.totalItemCount
+  );
+  showCheckboxes = $derived(this.selectionMode || this.selectedKeys.size > 0);
+  selectedFiles = $derived(this.files.filter((f: StorageObject) => this.selectedKeys.has(f.key)));
+  selectedFolders = $derived(
+    this.folders.filter((f: StorageObject) => this.selectedKeys.has(f.key))
+  );
+
+  // ── Modal ──
+  activeModal = $state<ActiveModal | null>(null);
+
+  // ── Context menu ──
+  contextMenu = $state<ContextMenuState | null>(null);
+
+  get ctxFileObj(): StorageObject | null {
+    if (!this.contextMenu) return null;
+    return this.files.find((f: StorageObject) => f.key === this.contextMenu!.key) ?? null;
+  }
+  get ctxIsFile(): boolean {
+    return this.ctxFileObj !== null;
+  }
+  get canPin(): boolean {
+    return this.contextMenu !== null && !this.ctxIsFile;
+  }
+  get ctxIsPinned(): boolean {
+    if (!this.contextMenu || this.ctxIsFile) return false;
+    return this.bookmarks.isPinned(this.bucket, this.contextMenu.key);
+  }
+
+  // ── Loading ──
+  loading = $state(false);
+  deleting = $state(false);
+
+  // ── Pagination ──
+  prevTokens = $state<(string | null)[]>([]);
+  pageSize = $state<PageSize>(initPageSize('storage_page_size'));
+  currentPage = $derived(this.prevTokens.length + 1);
+
+  // ── Composed sub-state ──
+  bookmarks = new BookmarksState();
+
+  // ── Navigation handler (injected by page component) ──
+  private _onNavigate: NavigateFn = () => {};
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Constructor
+  // ────────────────────────────────────────────────────────────────────────────
+
+  constructor(options?: { connected?: boolean; buckets?: string[] }) {
+    if (options?.connected !== undefined) this.connected = options.connected;
+    if (options?.buckets) this.buckets = options.buckets;
+  }
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Server data sync
+  // ────────────────────────────────────────────────────────────────────────────
+
+  syncFromServer(bucket: string, prefix: string, objects: StoragePage): void {
+    this.bucket = bucket;
+    this.prefix = prefix;
+    this.objects = objects;
+    this.loading = false;
+    // Clear selection on navigation
+    this.selectedKeys = new SvelteSet<string>();
+  }
+
+  setNavigationHandler(fn: NavigateFn): void {
+    this._onNavigate = fn;
+  }
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Selection
+  // ────────────────────────────────────────────────────────────────────────────
+
+  toggleSelect = (key: string, force = false): void => {
+    if (force || this.selectionMode) {
+      if (force && !this.selectionMode) this.selectionMode = true;
+      const next = new SvelteSet<string>(this.selectedKeys);
+      if (next.has(key)) next.delete(key);
+      else next.add(key);
+      this.selectedKeys = next;
+    } else {
+      this.selectedKeys = new SvelteSet<string>([key]);
+    }
+  };
+
+  selectAll = (checked: boolean): void => {
+    if (checked) {
+      this.selectedKeys = new SvelteSet<string>([
+        ...this.folders.map((f: StorageObject) => f.key),
+        ...this.files.map((f: StorageObject) => f.key)
+      ]);
+    } else {
+      this.selectedKeys = new SvelteSet<string>();
+    }
+  };
+
+  clearSelection = (): void => {
+    this.selectedKeys = new SvelteSet<string>();
+    this.selectionMode = false;
+  };
+
+  toggleSelectionMode = (): void => {
+    this.selectionMode = !this.selectionMode;
+    if (!this.selectionMode) this.selectedKeys = new SvelteSet<string>();
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Navigation
+  // ────────────────────────────────────────────────────────────────────────────
+
+  navigate = (prefix: string): void => {
+    this.loading = true;
+    this.prevTokens = [];
+    this._onNavigate(prefix, null, this.pageSize);
+  };
+
+  navigateNext = (): void => {
+    this.prevTokens = [...this.prevTokens, this.objects.continuationToken ?? null];
+    this.loading = true;
+    this._onNavigate(this.prefix, this.objects.nextContinuationToken ?? null, this.pageSize);
+  };
+
+  navigatePrev = (): void => {
+    const copy = [...this.prevTokens];
+    const last = copy.pop() ?? null;
+    this.prevTokens = copy;
+    this.loading = true;
+    this._onNavigate(this.prefix, last, this.pageSize);
+  };
+
+  navigateFirst = (): void => {
+    this.prevTokens = [];
+    this.loading = true;
+    this._onNavigate(this.prefix, null, this.pageSize);
+  };
+
+  onPageSizeChange = (): void => {
+    this.prevTokens = [];
+    this.navigateFirst();
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Modal management
+  // ────────────────────────────────────────────────────────────────────────────
+
+  openModal = <T extends ModalType>(type: T, payload: ModalPayloads[T]): void => {
+    this.activeModal = { type, payload } as ActiveModal;
+  };
+
+  closeModal = (): void => {
+    this.activeModal = null;
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Context menu
+  // ────────────────────────────────────────────────────────────────────────────
+
+  openContextMenu = (e: MouseEvent, key: string): void => {
+    e.preventDefault();
+    e.stopPropagation();
+
+    if (!this.selectedKeys.has(key)) {
+      if (this.selectedKeys.size === 0) {
+        this.selectedKeys = new SvelteSet<string>([key]);
+      } else {
+        this.selectedKeys.add(key);
+      }
+    }
+
+    this.contextMenu = { x: e.clientX, y: e.clientY, key };
+  };
+
+  closeContextMenu = (): void => {
+    if (this.contextMenu) {
+      this.selectedKeys.delete(this.contextMenu.key);
+    }
+    this.contextMenu = null;
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Actions
+  // ────────────────────────────────────────────────────────────────────────────
+
+  executeAction = async (action: ActionName): Promise<void> => {
+    const ctxKey = this.contextMenu?.key ?? null;
+    const ctxFile =
+      ctxKey && this.files.find((f: StorageObject) => f.key === ctxKey) ? ctxKey : null;
+    const key = ctxFile ?? this.selectedFiles[0]?.key;
+
+    const effectiveSelectedFiles = ctxFile
+      ? [this.files.find((f: StorageObject) => f.key === ctxFile)!]
+      : this.selectedFiles;
+
+    switch (action) {
+      case 'delete':
+        this.openModal('delete', { keys: [...this.selectedKeys] });
+        return;
+
+      case 'upload':
+        this.openModal('upload', { bucket: this.bucket, prefix: this.prefix });
+        return;
+
+      case 'preview':
+        if (!key) {
+          addToast('warning', 'No file selected for preview');
+          return;
+        }
+        for (const f of effectiveSelectedFiles) {
+          this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
+        }
+        this.openModal('preview', { key });
+        return;
+
+      case 'download':
+        if (!key) {
+          addToast('warning', 'No file selected for download');
+          return;
+        }
+        for (const f of effectiveSelectedFiles) {
+          this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
+        }
+        try {
+          await downloadObject(this.bucket, key);
+        } catch (err: unknown) {
+          if (err instanceof DownloadError) {
+            addToast('error', getActionErrorMessage(new ActionError(err.code, err.message)));
+          } else {
+            addToast('error', m.storage_download_error_unknown());
+          }
+        }
+        return;
+
+      case 'pin':
+        this.bookmarks.pin(this.bucket, ctxKey ?? this.prefix);
+        return;
+
+      case 'unpin':
+        this.bookmarks.unpin(this.bucket, ctxKey ?? this.prefix);
+        return;
+    }
+  };
+
+  confirmDelete = async (): Promise<void> => {
+    const modal = this.activeModal;
+    if (!modal || modal.type !== 'delete') return;
+
+    const keys = modal.payload.keys;
+    this.closeModal();
+    this.deleting = true;
+
+    try {
+      const result = await this.performDelete(this.bucket, keys);
+      if (result.failed && result.failed.length > 0) {
+        addToast('warning', m.storage_delete_partial_failure({ count: result.failed.length }));
+      }
+      this.selectedKeys = new SvelteSet<string>();
+      this.selectionMode = false;
+      this.loading = true;
+      await invalidateAll();
+    } catch (err: unknown) {
+      this.loading = false;
+      let msg = m.storage_delete_error_unknown();
+      if (err instanceof ActionError) {
+        if (err.code === 'not_connected') msg = m.storage_delete_error_not_connected();
+        else if (err.code === 'access_denied') msg = m.storage_delete_error_access_denied();
+        else if (err.code === 'server_error') msg = m.storage_delete_error_server_error();
+      }
+      addToast('error', msg);
+    } finally {
+      this.deleting = false;
+    }
+  };
+
+  cancelDelete = (): void => {
+    this.closeModal();
+  };
+
+  handleUploadSuccess = (): void => {
+    this.closeModal();
+    this.loading = true;
+    void invalidateAll();
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Keyboard shortcuts
+  // ────────────────────────────────────────────────────────────────────────────
+
+  handleKeydown = (e: KeyboardEvent): void => {
+    if (this.activeModal?.type === 'delete') return;
+    if (e.key === 'Delete' && this.selectedKeys.size > 0) {
+      this.openModal('delete', { keys: [...this.selectedKeys] });
+    } else if (e.key === 'Escape') {
+      if (this.contextMenu) {
+        this.closeContextMenu();
+      }
+      this.clearSelection();
+    }
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Private: Delete implementation
+  // ────────────────────────────────────────────────────────────────────────────
+
+  private async performDelete(
+    bucket: string,
+    keys: string[]
+  ): Promise<{ failed: Array<{ key: string; code?: string; message?: string }> }> {
+    const params = new SvelteURLSearchParams({ bucket });
+    for (const key of keys) params.append('keys', key);
+
+    const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE' });
+    if (!res.ok) {
+      let code: string;
+      if (res.status === 401) code = 'not_connected';
+      else if (res.status === 403) code = 'access_denied';
+      else if (res.status >= 500) code = 'server_error';
+      else code = 'unknown';
+      throw new ActionError(code, `Delete failed with status ${res.status}`);
+    }
+
+    const result = (await res.json()) as {
+      failed: Array<{ key: string; code?: string; message?: string }>;
+    };
+
+    // Clean up pinned locations and recent items for deleted directories
+    const dirPrefixes = keys.filter((k) => k.endsWith('/'));
+    if (dirPrefixes.length > 0) {
+      this.bookmarks.unpinUnderDirectories(bucket, dirPrefixes);
+      this.bookmarks.removeItemsUnderDirectories(bucket, dirPrefixes);
+    }
+
+    return result;
+  }
+}
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index 0629c950..c8975115 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -1,3 +1,63 @@
+// ── Modal types ─────────────────────────────────────────────────────────────
+
+export type ModalType = 'delete' | 'preview' | 'upload';
+
+export interface ModalPayloads {
+  delete: { keys: string[] };
+  preview: { key: string };
+  upload: { bucket: string; prefix: string };
+}
+
+export type ActiveModal = {
+  [K in ModalType]: { type: K; payload: ModalPayloads[K] };
+}[ModalType];
+
+// ── Context menu ─────────────────────────────────────────────────────────────
+
+export interface ContextMenuState {
+  x: number;
+  y: number;
+  key: string;
+}
+
+// ── Navigation ───────────────────────────────────────────────────────────────
+
+export type NavigateFn = (
+  prefix: string,
+  continuationToken?: string | null,
+  pageSize?: number | null
+) => void;
+
+// ── Action names ─────────────────────────────────────────────────────────────
+
+export type ActionName = 'download' | 'upload' | 'preview' | 'delete' | 'pin' | 'unpin';
+
+// ── Storage locations ────────────────────────────────────────────────────────
+
+export interface StorageLocation {
+  bucket: string;
+  prefix: string;
+}
+
+export type PinnedLocation = StorageLocation;
+
+// ── Recent items ─────────────────────────────────────────────────────────────
+
+export interface RecentFile {
+  key: string;
+  bucket: string;
+  size: number;
+  visitedAt: string;
+}
+
+export interface RecentLocation {
+  bucket: string;
+  prefix: string;
+  visitedAt: string;
+}
+
+// ── Storage objects ──────────────────────────────────────────────────────────
+
 /** A single object (file or directory) returned from a storage listing. */
 export interface StorageObject {
   key: string;
diff --git a/src/lib/stores/pinned-locations.svelte.ts b/src/lib/stores/pinned-locations.svelte.ts
deleted file mode 100644
index 45652f6b..00000000
--- a/src/lib/stores/pinned-locations.svelte.ts
+++ /dev/null
@@ -1,82 +0,0 @@
-/** A storage location: a bucket plus an optional path prefix. */
-export interface StorageLocation {
-  bucket: string;
-  /** Empty string = bucket root; otherwise a slash-terminated path, e.g. 'folder/sub/'. */
-  prefix: string;
-}
-
-export type PinnedLocation = StorageLocation;
-
-const STORAGE_KEY = 'pinned_storage_locations';
-
-function loadPinned(): PinnedLocation[] {
-  if (typeof localStorage === 'undefined') return [];
-  try {
-    const raw = localStorage.getItem(STORAGE_KEY);
-    return raw ? (JSON.parse(raw) as PinnedLocation[]) : [];
-  } catch {
-    return [];
-  }
-}
-
-export const pinnedLocations = $state<PinnedLocation[]>(loadPinned());
-
-function persist() {
-  if (typeof localStorage !== 'undefined') {
-    localStorage.setItem(STORAGE_KEY, JSON.stringify([...pinnedLocations]));
-  }
-}
-
-export function pinLocation(bucket: string, prefix: string): void {
-  if (pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix)) return;
-  pinnedLocations.push({ bucket, prefix });
-  persist();
-}
-
-export function unpinLocation(bucket: string, prefix: string): void {
-  const idx = pinnedLocations.findIndex((p) => p.bucket === bucket && p.prefix === prefix);
-  if (idx !== -1) {
-    pinnedLocations.splice(idx, 1);
-    persist();
-  }
-}
-
-export function isPinned(bucket: string, prefix: string): boolean {
-  return pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix);
-}
-
-/**
- * Remove all pinned locations that reside inside any of the given directory
- * prefixes (keys ending with '/') within the given bucket.
- * Called after a directory is deleted so stale pins are cleaned up.
- */
-export function unpinUnderDirectories(bucket: string, dirPrefixes: string[]): void {
-  if (dirPrefixes.length === 0) return;
-  const underAny = (prefix: string) =>
-    dirPrefixes.some((p) => prefix === p || prefix.startsWith(p));
-  const before = pinnedLocations.length;
-  const keep = pinnedLocations.filter((pin) => !(pin.bucket === bucket && underAny(pin.prefix)));
-  if (keep.length !== before) {
-    pinnedLocations.splice(0, pinnedLocations.length, ...keep);
-    persist();
-  }
-}
-
-/** Returns the navigation href for a storage location (bucket + optional prefix). */
-export function storageHref(bucket: string, prefix: string): string {
-  if (!prefix) return `/storage/${encodeURIComponent(bucket)}`;
-  const encoded = prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/');
-  return `/storage/${encodeURIComponent(bucket)}/${encoded}`;
-}
-
-/** Returns the display label for a pinned location. */
-export function pinnedLabel(pin: PinnedLocation): string {
-  if (!pin.prefix) return pin.bucket;
-  const parts = pin.prefix.split('/').filter(Boolean);
-  return parts[parts.length - 1] ?? pin.bucket;
-}
-
-/** Returns the navigation href for a pinned location. */
-export function pinnedHref(pin: PinnedLocation): string {
-  return storageHref(pin.bucket, pin.prefix);
-}
diff --git a/src/lib/stores/recent-items.svelte.ts b/src/lib/stores/recent-items.svelte.ts
deleted file mode 100644
index ee3804b8..00000000
--- a/src/lib/stores/recent-items.svelte.ts
+++ /dev/null
@@ -1,144 +0,0 @@
-import { storageHref } from './pinned-locations.svelte.js';
-
-const MAX_RECENT = 15;
-const LS_FILES = 'recent_storage_files';
-const LS_LOCATIONS = 'recent_storage_locations';
-
-// ── Types ─────────────────────────────────────────────────────────────────
-
-export interface RecentFile {
-  /** Full object key within the bucket. */
-  key: string;
-  bucket: string;
-  /** File size in bytes. */
-  size: number;
-  /** ISO string so it survives JSON round-trip. */
-  visitedAt: string;
-}
-
-export interface RecentLocation {
-  bucket: string;
-  /** Trailing-slash prefix, empty string = bucket root. */
-  prefix: string;
-  visitedAt: string;
-}
-
-// ── Persistence helpers ───────────────────────────────────────────────────
-
-function load<T>(key: string): T[] {
-  if (typeof localStorage === 'undefined') return [];
-  try {
-    const raw = localStorage.getItem(key);
-    return raw ? (JSON.parse(raw) as T[]) : [];
-  } catch {
-    return [];
-  }
-}
-
-function persist(key: string, data: unknown[]): void {
-  if (typeof localStorage !== 'undefined') {
-    localStorage.setItem(key, JSON.stringify(data));
-  }
-}
-
-// ── Reactive state ────────────────────────────────────────────────────────
-
-export const recentFiles = $state<RecentFile[]>(load<RecentFile>(LS_FILES));
-export const recentLocations = $state<RecentLocation[]>(load<RecentLocation>(LS_LOCATIONS));
-
-// ── Mutators ──────────────────────────────────────────────────────────────
-
-export function recordFileVisit(bucket: string, key: string, size: number): void {
-  const idx = recentFiles.findIndex((f) => f.bucket === bucket && f.key === key);
-  // eslint-disable-next-line svelte/prefer-svelte-reactivity
-  const entry: RecentFile = { key, bucket, size, visitedAt: new Date().toISOString() };
-  if (idx !== -1) {
-    recentFiles.splice(idx, 1);
-  }
-  recentFiles.unshift(entry);
-  if (recentFiles.length > MAX_RECENT) recentFiles.splice(MAX_RECENT);
-  persist(LS_FILES, [...recentFiles]);
-}
-
-export function recordLocationVisit(bucket: string, prefix: string): void {
-  const idx = recentLocations.findIndex((l) => l.bucket === bucket && l.prefix === prefix);
-  // eslint-disable-next-line svelte/prefer-svelte-reactivity
-  const entry: RecentLocation = { bucket, prefix, visitedAt: new Date().toISOString() };
-  if (idx !== -1) {
-    recentLocations.splice(idx, 1);
-  }
-  recentLocations.unshift(entry);
-  if (recentLocations.length > MAX_RECENT) recentLocations.splice(MAX_RECENT);
-  persist(LS_LOCATIONS, [...recentLocations]);
-}
-
-// ── Derived display helpers ───────────────────────────────────────────────
-
-/** Display name for a file key (last path segment). */
-export function fileName(key: string): string {
-  const parts = key.split('/').filter(Boolean);
-  return parts[parts.length - 1] ?? key;
-}
-
-/** Human-readable location path for a recent file: "bucket / folder / …" */
-export function fileLocation(file: RecentFile): string {
-  const parts = file.key.split('/').filter(Boolean);
-  parts.pop(); // remove filename
-  return parts.length > 0 ? `${file.bucket} / ${parts.join(' / ')}` : file.bucket;
-}
-
-/** Display name for a location: last path segment or bucket name. */
-export function locationName(loc: RecentLocation): string {
-  if (!loc.prefix) return loc.bucket;
-  const parts = loc.prefix.split('/').filter(Boolean);
-  return parts[parts.length - 1] ?? loc.bucket;
-}
-
-/** Full breadcrumb path for a location. */
-export function locationPath(loc: RecentLocation): string {
-  if (!loc.prefix) return loc.bucket;
-  const parts = loc.prefix.split('/').filter(Boolean);
-  return `${loc.bucket} / ${parts.join(' / ')}`;
-}
-
-/** Navigation href for a recent file (goes to its parent folder). */
-export function fileHref(file: RecentFile): string {
-  const parts = file.key.split('/').filter(Boolean);
-  parts.pop();
-  const encoded = parts.map(encodeURIComponent).join('/');
-  return encoded
-    ? `/storage/${encodeURIComponent(file.bucket)}/${encoded}`
-    : `/storage/${encodeURIComponent(file.bucket)}`;
-}
-
-/** Navigation href for a recent location. */
-export function locationHref(loc: RecentLocation): string {
-  return storageHref(loc.bucket, loc.prefix);
-}
-
-/**
- * Remove all recent files and locations that reside inside any of the given
- * directory prefixes (keys ending with '/') within the given bucket.
- * Called after a directory is deleted so stale entries are cleaned up.
- */
-export function removeItemsUnderDirectories(bucket: string, dirPrefixes: string[]): void {
-  if (dirPrefixes.length === 0) return;
-
-  const underAny = (path: string) => dirPrefixes.some((p) => path === p || path.startsWith(p));
-
-  const removedFiles = recentFiles.filter((f) => f.bucket === bucket && underAny(f.key)).length;
-  if (removedFiles > 0) {
-    const keep = recentFiles.filter((f) => !(f.bucket === bucket && underAny(f.key)));
-    recentFiles.splice(0, recentFiles.length, ...keep);
-    persist(LS_FILES, [...recentFiles]);
-  }
-
-  const removedLocs = recentLocations.filter(
-    (l) => l.bucket === bucket && underAny(l.prefix)
-  ).length;
-  if (removedLocs > 0) {
-    const keep = recentLocations.filter((l) => !(l.bucket === bucket && underAny(l.prefix)));
-    recentLocations.splice(0, recentLocations.length, ...keep);
-    persist(LS_LOCATIONS, [...recentLocations]);
-  }
-}
diff --git a/src/lib/types/navigation.ts b/src/lib/types/navigation.ts
index 2d765198..cc1d4078 100644
--- a/src/lib/types/navigation.ts
+++ b/src/lib/types/navigation.ts
@@ -1,7 +1,9 @@
+import type { Component } from 'svelte';
+
 export type NavItem = {
   label: string;
   href: string;
-  icon: string;
+  icon: Component;
   disabled?: boolean;
   badge?: string;
 };
diff --git a/src/routes/(app)/+layout.svelte b/src/routes/(app)/+layout.svelte
index 1715f43a..f538f0f6 100644
--- a/src/routes/(app)/+layout.svelte
+++ b/src/routes/(app)/+layout.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { browser } from '$app/environment';
   import { page } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
   import Sidebar from '$lib/components/layout/sidebar/Sidebar.svelte';
@@ -7,9 +8,23 @@
 
   let { children, data } = $props();
 
-  let sidebarCollapsed = $state(false);
+  function getInitialCollapsed(): boolean {
+    if (!browser) return false;
+    try {
+      return localStorage.getItem('sidebar_collapsed') === 'true';
+    } catch {
+      return false;
+    }
+  }
+
+  let sidebarCollapsed = $state(getInitialCollapsed());
   let mobileOpen = $state(false);
 
+  $effect(() => {
+    if (!browser) return;
+    localStorage.setItem('sidebar_collapsed', String(sidebarCollapsed));
+  });
+
   const pageTitles: Record<string, () => string> = {
     '/': m.page_title_dashboard,
     '/trino': m.page_title_trino
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
index 2c221b3c..e91a40b5 100644
--- a/src/routes/(app)/storage/+error.svelte
+++ b/src/routes/(app)/storage/+error.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { page } from '$app/state';
   import { resolve } from '$app/paths';
-  import Icon from '@iconify/svelte';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
   import * as m from '$lib/paraglide/messages.js';
 
   const bucket = $derived(page.params.bucket ?? '');
@@ -29,7 +29,7 @@
     "
     aria-hidden="true"
   >
-    <Icon icon="line-md:alert" class="size-10" aria-hidden="true" />
+    <IconWarning class="size-10" aria-hidden="true" />
   </div>
 
   <div>
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index ad79d409..603be1f7 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -1,12 +1,26 @@
 <script lang="ts">
-  import BucketList from '$lib/components/storage/BucketList.svelte';
+  import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
+  import { StorageState } from '$lib/storage/state.svelte.js';
+  import { setStorageState } from '$lib/storage/context.js';
 
   let { children, data } = $props();
+
+  const storage = new StorageState({
+    connected: data.connected,
+    buckets: data.buckets
+  });
+  setStorageState(storage);
+
+  // Keep layout-level data in sync when SvelteKit re-runs the load function
+  $effect(() => {
+    storage.connected = data.connected;
+    storage.buckets = data.buckets;
+  });
 </script>
 
 {#if data.connected}
   <div class="flex h-full min-h-0 gap-4">
-    <BucketList buckets={data.buckets} />
+    <BucketList />
     <div class="flex min-w-0 flex-1 flex-col">
       {@render children()}
     </div>
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index db656384..c674b0c2 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -1,11 +1,13 @@
 <script lang="ts">
   import { navigating } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
-  import BucketGrid from '$lib/components/storage/BucketGrid.svelte';
-  import StorageConnectForm from '$lib/components/storage/StorageConnectForm.svelte';
-  import RecentItems from '$lib/components/storage/RecentItems.svelte';
+  import { getStorageState } from '$lib/storage/context.js';
+  import BucketGrid from '$lib/components/storage/landing/BucketGrid.svelte';
+  import StorageConnectForm from '$lib/components/storage/landing/StorageConnectForm.svelte';
+  import RecentItems from '$lib/components/storage/landing/RecentItems.svelte';
 
   let { data } = $props();
+  const storage = getStorageState();
 </script>
 
 {#if data.connected}
@@ -21,7 +23,7 @@
     {/if}
     <h1 class="mb-1 text-xl font-semibold">{m.storage_buckets_label()}</h1>
     <p class="text-base-content/60 mb-6 text-sm">{m.storage_buckets_subtitle()}</p>
-    <BucketGrid buckets={data.buckets} />
+    <BucketGrid buckets={storage.buckets} />
     <RecentItems />
   </div>
 {:else}
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index b5049759..ef43e0db 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -1,38 +1,35 @@
 <script lang="ts">
   import { goto } from '$app/navigation';
   import { resolve } from '$app/paths';
-  import FileExplorer from '$lib/components/storage/FileExplorer.svelte';
+  import { getStorageState } from '$lib/storage/context.js';
+  import FileExplorer from '$lib/components/storage/explorer/FileExplorer.svelte';
 
   let { data } = $props();
+  const storage = getStorageState();
 
-  function handleNavigate(
-    prefix: string,
-    continuationToken: string | null = null,
-    pageSize: number | null = null
-  ) {
+  // Inject navigation handler — page owns URL construction
+  storage.setNavigationHandler((prefix, continuationToken, pageSize) => {
     const encodedPrefix = prefix
       ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';
 
-    const parts: string[] = [];
-    if (continuationToken)
-      parts.push(`continuationToken=${encodeURIComponent(String(continuationToken))}`);
-    if (pageSize) parts.push(`pageSize=${encodeURIComponent(String(pageSize))}`);
+    const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
+      bucket: encodeURIComponent(data.bucket),
+      prefix: encodedPrefix
+    });
 
-    const query = parts.length ? `?${parts.join('&')}` : '';
-    goto(
-      resolve('/(app)/storage/[bucket]/[...prefix]', {
-        bucket: encodeURIComponent(data.bucket),
-        prefix: encodedPrefix
-      }) + query,
-      { replaceState: false }
-    );
-  }
+    const url = new URL(basePath, location.origin);
+    if (continuationToken) url.searchParams.set('continuationToken', String(continuationToken));
+    if (pageSize) url.searchParams.set('pageSize', String(pageSize));
+
+    // eslint-disable-next-line svelte/no-navigation-without-resolve -- base path is built with resolve(); URL object is needed to append query params
+    goto(url, { replaceState: false });
+  });
+
+  // Sync server data into state whenever SvelteKit load runs
+  $effect(() => {
+    storage.syncFromServer(data.bucket, data.prefix, data.objects);
+  });
 </script>
 
-<FileExplorer
-  bucket={data.bucket}
-  objects={data.objects}
-  prefix={data.prefix}
-  onNavigate={handleNavigate}
-/>
+<FileExplorer />
diff --git a/src/routes/(app)/storage/api/delete/+server.ts b/src/routes/(app)/storage/api/delete/+server.ts
index 066534f3..174e84b4 100644
--- a/src/routes/(app)/storage/api/delete/+server.ts
+++ b/src/routes/(app)/storage/api/delete/+server.ts
@@ -2,6 +2,7 @@ import type { RequestHandler } from './$types';
 import { error } from '@sveltejs/kit';
 import { deleteObjects } from '$lib/server/storage/service.js';
 import { getUserId } from '$lib/server/auth-utils.js';
+import { requireBucket } from '../params.js';
 
 /**
  * DELETE /storage/api/delete?bucket=<bucket>&keys=<key1>&keys=<key2>&...
@@ -10,10 +11,7 @@ import { getUserId } from '$lib/server/auth-utils.js';
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
  */
 export const DELETE: RequestHandler = async ({ locals, url }) => {
-  const bucket = url.searchParams.get('bucket');
-  if (!bucket || !bucket.trim()) {
-    throw error(400, 'Missing required query parameter: bucket');
-  }
+  const bucket = requireBucket(url);
 
   const keys = url.searchParams.getAll('keys');
   if (!keys.length) {
diff --git a/src/routes/(app)/storage/api/params.ts b/src/routes/(app)/storage/api/params.ts
index f41993b5..3d6cbd53 100644
--- a/src/routes/(app)/storage/api/params.ts
+++ b/src/routes/(app)/storage/api/params.ts
@@ -1,14 +1,23 @@
 import { error } from '@sveltejs/kit';
 
 /**
- * Extracts and validates the `bucket` and `key` query parameters from a
- * storage API request URL. Throws a 400 error if either is absent or blank.
+ * Extracts and validates the `bucket` query parameter from a storage API
+ * request URL. Throws a 400 error if absent or blank.
  */
-export function requireBucketKey(url: URL): { bucket: string; key: string } {
+export function requireBucket(url: URL): string {
   const bucket = url.searchParams.get('bucket')?.trim();
   if (!bucket) {
     throw error(400, 'Missing required query parameter: bucket');
   }
+  return bucket;
+}
+
+/**
+ * Extracts and validates the `bucket` and `key` query parameters from a
+ * storage API request URL. Throws a 400 error if either is absent or blank.
+ */
+export function requireBucketKey(url: URL): { bucket: string; key: string } {
+  const bucket = requireBucket(url);
 
   const key = url.searchParams.get('key')?.trim();
   if (!key) {
diff --git a/src/routes/(app)/storage/api/preview/+server.ts b/src/routes/(app)/storage/api/preview/+server.ts
index fc5bc9bb..193ad363 100644
--- a/src/routes/(app)/storage/api/preview/+server.ts
+++ b/src/routes/(app)/storage/api/preview/+server.ts
@@ -1,28 +1,19 @@
-import { json } from '@sveltejs/kit';
+import { S3ServiceException } from '@aws-sdk/client-s3';
 import { getUserId } from '$lib/server/auth-utils.js';
-import { getConnection } from '$lib/server/storage/service.js';
-import { StorageProviderFactory } from '$lib/server/storage/factory.js';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
+import { getProviderForUser } from '$lib/server/storage/utils.js';
 // import { parquetPreview } from '$lib/server/storage/preview/parquet.js';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { requireBucketKey } from '../params.js';
-import type { RequestHandler } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
 
 export const GET: RequestHandler = async ({ url, locals }) => {
   const log = locals.logger;
   const userId = getUserId(locals);
   const { bucket, key } = requireBucketKey(url);
 
-  const connection = getConnection(userId);
-  if (!connection) {
-    return json({ error: 'No storage connection configured' }, { status: 401 });
-  }
-  if (connection.type !== 's3') {
-    return json({ error: 'Storage backend not supported for preview' }, { status: 400 });
-  }
-
-  const provider = StorageProviderFactory.create({ ...connection, bucket });
+  const provider = getProviderForUser(userId, bucket);
 
   try {
     const metadata = await provider.getMetadata(key);
@@ -63,6 +54,9 @@ export const GET: RequestHandler = async ({ url, locals }) => {
 
     return await streamPreview(provider, key, contentType, totalSize, userId, log);
   } catch (err) {
-    mapS3ErrorToHttp(err, { bucket, key, operation: 'preview' });
+    if (err instanceof S3ServiceException) {
+      mapS3ErrorToHttp(err, { bucket, key, operation: 'preview' });
+    }
+    throw err;
   }
 };
diff --git a/src/routes/(app)/storage/validation.ts b/src/routes/(app)/storage/validation.ts
deleted file mode 100644
index eae24d5d..00000000
--- a/src/routes/(app)/storage/validation.ts
+++ /dev/null
@@ -1 +0,0 @@
-export { StorageConnectionSchema } from '$lib/storage/schemas.js';
diff --git a/src/routes/(app)/trino/completion/metadata/+server.ts b/src/routes/(app)/trino/completion/metadata/+server.ts
index cc9e70ce..a34f0a90 100644
--- a/src/routes/(app)/trino/completion/metadata/+server.ts
+++ b/src/routes/(app)/trino/completion/metadata/+server.ts
@@ -76,7 +76,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
       opts.schema = schema;
       break;
     case 'functions':
-      sql = 'SELECT DISTINCT lower("Function") FROM (SHOW FUNCTIONS) ORDER BY 1';
+      sql = 'SHOW FUNCTIONS';
       break;
   }
 
@@ -101,7 +101,12 @@ export const GET: RequestHandler = async ({ url, locals }) => {
       return json(entries);
     }
 
-    const names = rows.map((r) => String((r as string[])[0]));
+    let names = rows.map((r) => String((r as string[])[0]));
+    if (level === 'functions') {
+      // Dedupe: SHOW FUNCTIONS returns one row per overload, so a function
+      // with N argument signatures would otherwise appear N times.
+      names = [...new Set(names)].sort();
+    }
     log.debug(
       { level, catalog, schema, table, count: names.length },
       'completion metadata fetched'
diff --git a/src/routes/auth/login/+page.svelte b/src/routes/auth/login/+page.svelte
index ecdbe3e3..64bca586 100644
--- a/src/routes/auth/login/+page.svelte
+++ b/src/routes/auth/login/+page.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import { authClient } from '$lib/auth-client.js';
-  import Icon from '@iconify/svelte';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
 
   let { data } = $props();
 
@@ -56,7 +56,7 @@
 
       {#if error}
         <div role="alert" class="alert alert-error mt-2 w-full text-sm">
-          <Icon icon="line-md:alert" class="size-5" aria-hidden="true" />
+          <IconWarning class="size-5" aria-hidden="true" />
           <span>{error}</span>
         </div>
       {/if}
diff --git a/src/routes/healthz/+server.ts b/src/routes/healthz/+server.ts
new file mode 100644
index 00000000..bc4e70ed
--- /dev/null
+++ b/src/routes/healthz/+server.ts
@@ -0,0 +1,3 @@
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = () => new Response('ok', { status: 200 });
diff --git a/vite.config.ts b/vite.config.ts
index 869b6550..4d7346d3 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -1,6 +1,7 @@
 import { paraglideVitePlugin } from '@inlang/paraglide-js';
 import tailwindcss from '@tailwindcss/vite';
 import { sveltekit } from '@sveltejs/kit/vite';
+import Icons from 'unplugin-icons/vite';
 import { defineConfig } from 'vitest/config';
 import { playwright } from '@vitest/browser-playwright';
 
@@ -8,6 +9,7 @@ export default defineConfig({
   plugins: [
     tailwindcss(),
     sveltekit(),
+    Icons({ compiler: 'svelte' }),
     paraglideVitePlugin({
       project: './project.inlang',
       outdir: './src/lib/paraglide',

From 2d810273b1ed48d5c7a1e0fff6823e9cd82cf1f7 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 29 May 2026 14:14:37 +0200
Subject: [PATCH 041/136] #135 Add s3 Garage instance for e2e tests (#162)

* #135 add garage instance to GitHub workflow for e2e tests

* #135 fix yaml lint

* #135 fix docker command in action

* #135 fix docker options in action

* #135 fix yaml format

* #135 refactor GitHub action for s3 deployment with code fixes

* #135 fix missing entrypoint in container

* #135 remove format use on s3 creation

* #135 add e2e tests that require a bucket

* #135 allow local starting of s3 e2e tests, fix lint

* #135 fix lint

* #135 move garage.toml to permanent repository

* #135 create keys and bucket via curl

* #135 fix lint

* #135 fix lint

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* Implement Garage S3 deployment and configuration for E2E testing

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>
---
 .github/workflows/pr_checks.yaml     |  42 +++++++-
 .gitignore                           |   3 +
 .prettierignore                      |   1 +
 dev/garage/Chart.yaml                |   7 ++
 dev/garage/garage.toml               |  18 ++++
 dev/garage/templates/configmap.yaml  |   9 ++
 dev/garage/templates/deployment.yaml |  62 ++++++++++++
 dev/garage/templates/service.yaml    |  19 ++++
 dev/garage/values.yaml               |  12 +++
 dev/setup.sh                         |  68 ++++++++++++-
 e2e/global-setup.ts                  |  20 ++++
 e2e/init-garage-s3.sh                | 138 +++++++++++++++++++++++++++
 e2e/run-garage-tests.sh              |  15 +++
 e2e/storage-s3.spec.ts               |  93 ++++++++++++++++++
 package.json                         |   1 +
 15 files changed, 501 insertions(+), 7 deletions(-)
 create mode 100644 dev/garage/Chart.yaml
 create mode 100644 dev/garage/garage.toml
 create mode 100644 dev/garage/templates/configmap.yaml
 create mode 100644 dev/garage/templates/deployment.yaml
 create mode 100644 dev/garage/templates/service.yaml
 create mode 100644 dev/garage/values.yaml
 create mode 100755 e2e/init-garage-s3.sh
 create mode 100755 e2e/run-garage-tests.sh
 create mode 100644 e2e/storage-s3.spec.ts

diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index 7891c544..96f59ad5 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -47,9 +47,10 @@ jobs:
       - name: Run pre-commit
         uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
 
-  tests:
-    name: E2E Tests
+  e2e-with-garage:
+    name: E2E Tests with Garage S3
     runs-on: ubuntu-latest
+
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -68,5 +69,38 @@ jobs:
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium firefox
 
-      - name: Run E2E tests
-        run: npm run test:e2e
+      - name: Start Garage S3 and initialize bucket
+        run: |
+          # GitHub Actions services now support entrypoint + command, but we still
+          # start Garage manually here because service containers are created before
+          # actions/checkout runs. The upstream Garage image contains only the
+          # /garage binary (no /bin/sh), so the service cannot wait for the checked-
+          # out e2e/garage.toml to appear before it starts.
+          docker run -d --name garage \
+            -p 3900:3900 \
+            -p 3902:3902 \
+            -e GARAGE_CONFIG_FILE=/workspace/dev/garage/garage.toml \
+            -v "$PWD:/workspace" \
+            --entrypoint /garage \
+            oci.stackable.tech/stackable/dxflrs/garage:v2.3.0 \
+            server --single-node
+
+          # Wait for the S3 API to become available
+          for _ in $(seq 1 30); do
+            if curl -s http://localhost:3900 >/dev/null 2>&1; then
+              break
+            fi
+            sleep 1
+          done
+
+          GARAGE_ADMIN_TOKEN='stackable-ui-e2e-admin-token' \
+            S3_ENDPOINT='http://localhost:3900' \
+            S3_CONFIG_PATH="$PWD/s3-config.json" \
+            ./e2e/init-garage-s3.sh
+
+      - name: Run E2E tests with Garage
+        run: npm run test:e2e:garage
+
+      - name: Debug - print config
+        run: cat s3-config.json
+        if: failure()
diff --git a/.gitignore b/.gitignore
index 727c3e98..19a911ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,3 +39,6 @@ e2e/.auth
 # Paraglide
 src/lib/paraglide
 project.inlang/cache/
+# Garage
+.garage.log
+s3-config.json
diff --git a/.prettierignore b/.prettierignore
index 2c9b97f9..f15b4ea9 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -29,3 +29,4 @@ node_modules/
 
 # Helm templates
 deploy/helm/
+dev/garage/
diff --git a/dev/garage/Chart.yaml b/dev/garage/Chart.yaml
new file mode 100644
index 00000000..936174b0
--- /dev/null
+++ b/dev/garage/Chart.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v2
+name: garage
+description: Minimal Garage S3-compatible object store for local dev and E2E testing
+type: application
+version: 0.1.0
+appVersion: '2.3.0'
diff --git a/dev/garage/garage.toml b/dev/garage/garage.toml
new file mode 100644
index 00000000..3b70aef8
--- /dev/null
+++ b/dev/garage/garage.toml
@@ -0,0 +1,18 @@
+metadata_dir = "/tmp/stackable-ui/meta"
+data_dir = "/tmp/stackable-ui/data"
+db_engine = "sqlite"
+
+replication_factor = 1
+
+rpc_bind_addr = "127.0.0.1:3901"
+rpc_public_addr = "127.0.0.1:3901"
+rpc_secret = "2eef98a70ab343ba9dadf3809f38d63a2333a9f38909a3f3d3f3d3f3d3f3d3f3"
+
+[admin]
+api_bind_addr = "[::]:3902"
+admin_token = "stackable-ui-e2e-admin-token"
+
+[s3_api]
+s3_region = "garage"
+api_bind_addr = "[::]:3900"
+root_domain = ".s3.garage.localhost"
diff --git a/dev/garage/templates/configmap.yaml b/dev/garage/templates/configmap.yaml
new file mode 100644
index 00000000..988b8bc8
--- /dev/null
+++ b/dev/garage/templates/configmap.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: garage-config
+  namespace: default
+data:
+  garage.toml: |-
+    {{- .Files.Get "garage.toml" | nindent 4 }}
diff --git a/dev/garage/templates/deployment.yaml b/dev/garage/templates/deployment.yaml
new file mode 100644
index 00000000..46ca06a7
--- /dev/null
+++ b/dev/garage/templates/deployment.yaml
@@ -0,0 +1,62 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: garage
+  namespace: default
+  labels:
+    app: garage
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: garage
+  template:
+    metadata:
+      labels:
+        app: garage
+    spec:
+      containers:
+        - name: garage
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          command: ['/garage']
+          args:
+            - server
+            - --single-node
+          ports:
+            - name: s3
+              containerPort: 3900
+              protocol: TCP
+            - name: rpc
+              containerPort: 3901
+              protocol: TCP
+            - name: admin
+              containerPort: 3902
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /etc/garage.toml
+              subPath: garage.toml
+              readOnly: true
+            - name: data
+              mountPath: /tmp/stackable-ui
+          readinessProbe:
+            tcpSocket:
+              port: 3900
+            initialDelaySeconds: 3
+            periodSeconds: 3
+            failureThreshold: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+      volumes:
+        - name: config
+          configMap:
+            name: garage-config
+        - name: data
+          emptyDir: {}
diff --git a/dev/garage/templates/service.yaml b/dev/garage/templates/service.yaml
new file mode 100644
index 00000000..3efbce67
--- /dev/null
+++ b/dev/garage/templates/service.yaml
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage
+  namespace: default
+spec:
+  type: NodePort
+  selector:
+    app: garage
+  ports:
+    - name: s3
+      port: 3900
+      targetPort: 3900
+      nodePort: {{ .Values.nodePorts.s3 }}
+    - name: admin
+      port: 3902
+      targetPort: 3902
+      nodePort: {{ .Values.nodePorts.admin }}
diff --git a/dev/garage/values.yaml b/dev/garage/values.yaml
new file mode 100644
index 00000000..701197a9
--- /dev/null
+++ b/dev/garage/values.yaml
@@ -0,0 +1,12 @@
+---
+image:
+  repository: oci.stackable.tech/stackable/dxflrs/garage
+  tag: v2.3.0
+  pullPolicy: IfNotPresent
+
+# NodePort values for host access.
+# S3 API is exposed on nodePorts.s3; the admin API on nodePorts.admin.
+# RPC (3901) is internal only and not exposed.
+nodePorts:
+  s3: 30900
+  admin: 30902
diff --git a/dev/setup.sh b/dev/setup.sh
index ceacc876..6ecd476e 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -4,10 +4,12 @@
 set -euo pipefail
 
 SKIP_TRINO=false
+SKIP_GARAGE=false
 for arg in "$@"; do
   case "$arg" in
     --skip-trino) SKIP_TRINO=true ;;
-    *) echo "Unknown argument: $arg"; echo "Usage: $0 [--skip-trino]"; exit 1 ;;
+    --skip-garage) SKIP_GARAGE=true ;;
+    *) echo "Unknown argument: $arg"; echo "Usage: $0 [--skip-trino] [--skip-garage]"; exit 1 ;;
   esac
 done
 
@@ -19,6 +21,9 @@ echo "=== Stackable UI dev environment setup ==="
 if [[ "$SKIP_TRINO" == true ]]; then
   echo "(Trino deployment skipped via --skip-trino)"
 fi
+if [[ "$SKIP_GARAGE" == true ]]; then
+  echo "(Garage deployment skipped via --skip-garage)"
+fi
 echo ""
 
 # ------------------------------------------------------------------
@@ -74,6 +79,18 @@ if [[ "$SKIP_TRINO" == false ]]; then
   sed "s/\${NODE_IP}/$NODE_IP/g" "$SCRIPT_DIR/trino.yaml" | kubectl apply -f -
 fi
 
+# ------------------------------------------------------------------
+# 5b. Deploy Garage S3 (via Helm)
+# ------------------------------------------------------------------
+if [[ "$SKIP_GARAGE" == false ]]; then
+  echo ""
+  echo "Deploying Garage S3..."
+  helm upgrade --install garage "$SCRIPT_DIR/garage" \
+    --namespace default \
+    --wait \
+    --timeout 60s
+fi
+
 # On some local Kubernetes distributions (e.g. Rancher Desktop k3s), the node's
 # InternalIP is not reachable from the host network, but NodePorts are exposed
 # on localhost. Probe both and use the first reachable URL.
@@ -177,7 +194,47 @@ else
 fi
 
 # ------------------------------------------------------------------
-# 7. Write .env.development
+# 7. Initialise Garage S3 (create bucket + access key, write s3-config.json)
+# ------------------------------------------------------------------
+if [[ "$SKIP_GARAGE" == false ]]; then
+  echo ""
+  echo "Initialising Garage S3..."
+
+  GARAGE_ADMIN_PORT=30902
+  GARAGE_S3_PORT=30900
+  GARAGE_BASE_URL=""
+  deadline=$(( $(date +%s) + 60 ))
+  while [ -z "$GARAGE_BASE_URL" ] && [ "$(date +%s)" -lt "$deadline" ]; do
+    for base in "http://${NODE_IP}:${GARAGE_ADMIN_PORT}" "http://127.0.0.1:${GARAGE_ADMIN_PORT}" "http://localhost:${GARAGE_ADMIN_PORT}"; do
+      if curl -sf --max-time 2 -H "Authorization: Bearer stackable-ui-e2e-admin-token" "${base}/v2/ListBuckets" >/dev/null 2>&1; then
+        GARAGE_BASE_URL="$base"
+        break
+      fi
+    done
+    [ -z "$GARAGE_BASE_URL" ] && sleep 2
+  done
+
+  if [ -z "$GARAGE_BASE_URL" ]; then
+    echo "ERROR: Could not reach Garage admin API via NodePort ${GARAGE_ADMIN_PORT} within 60s."
+    echo "Tried: http://${NODE_IP}:${GARAGE_ADMIN_PORT}, http://127.0.0.1:${GARAGE_ADMIN_PORT}, http://localhost:${GARAGE_ADMIN_PORT}"
+    exit 1
+  fi
+
+  # Derive the matching S3 base URL from the same host
+  GARAGE_HOST=$(echo "$GARAGE_BASE_URL" | sed 's|http://||; s|:[0-9]*$||')
+  GARAGE_S3_URL="http://${GARAGE_HOST}:${GARAGE_S3_PORT}"
+
+  GARAGE_ADMIN_TOKEN=stackable-ui-e2e-admin-token \
+    S3_ENDPOINT="$GARAGE_S3_URL" \
+    GARAGE_ADMIN_URL="$GARAGE_BASE_URL" \
+    S3_CONFIG_PATH="$PROJECT_DIR/s3-config.json" \
+    "$SCRIPT_DIR/../e2e/init-garage-s3.sh"
+
+  echo "Wrote s3-config.json (S3 endpoint: ${GARAGE_S3_URL})"
+fi
+
+# ------------------------------------------------------------------
+# 8. Write .env.development
 # ------------------------------------------------------------------
 echo ""
 SESSION_SECRET=$(openssl rand -hex 32)
@@ -233,7 +290,7 @@ fi
 echo "Wrote $ENV_FILE"
 
 # ------------------------------------------------------------------
-# 8. Wait for Trino to be ready
+# 9. Wait for Trino to be ready
 # ------------------------------------------------------------------
 if [[ "$SKIP_TRINO" == false ]]; then
   echo ""
@@ -263,6 +320,11 @@ else
   echo "Trino was skipped. Add STACKABLE_UI_TRINO_* vars to $ENV_FILE manually when ready."
   echo ""
 fi
+if [[ "$SKIP_GARAGE" == false ]]; then
+  echo "Garage S3:      http://${NODE_IP}:30900  (admin: http://${NODE_IP}:30902)"
+  echo "  Credentials written to s3-config.json for E2E tests."
+  echo ""
+fi
 echo "Test users (OIDC):"
 echo "  alice / alicealice"
 echo "  bob   / bobbob"
diff --git a/e2e/global-setup.ts b/e2e/global-setup.ts
index 8edb915a..9cc99243 100644
--- a/e2e/global-setup.ts
+++ b/e2e/global-setup.ts
@@ -1,5 +1,25 @@
+import fs from 'node:fs';
 import path from 'path';
 
 export default async function globalSetup() {
   process.loadEnvFile(path.join(import.meta.dirname, '..', '.env.test'));
+
+  // Optionally load S3 credentials written by the Garage setup step in CI.
+  // When present, storage S3 tests run; when absent, they are skipped.
+  const s3ConfigPath = path.join(import.meta.dirname, '..', 's3-config.json');
+  if (fs.existsSync(s3ConfigPath)) {
+    const raw = fs.readFileSync(s3ConfigPath, 'utf-8');
+    const cfg = JSON.parse(raw) as {
+      awsEndpoint: string;
+      awsRegion: string;
+      awsAccessKeyId: string;
+      awsSecretAccessKey: string;
+      bucket: string;
+    };
+    process.env.S3_TEST_ENDPOINT = cfg.awsEndpoint;
+    process.env.S3_TEST_REGION = cfg.awsRegion;
+    process.env.S3_TEST_ACCESS_KEY_ID = cfg.awsAccessKeyId;
+    process.env.S3_TEST_SECRET_ACCESS_KEY = cfg.awsSecretAccessKey;
+    process.env.S3_TEST_BUCKET = cfg.bucket;
+  }
 }
diff --git a/e2e/init-garage-s3.sh b/e2e/init-garage-s3.sh
new file mode 100755
index 00000000..89d93b66
--- /dev/null
+++ b/e2e/init-garage-s3.sh
@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+: "${GARAGE_ADMIN_URL:=http://127.0.0.1:3902}"
+: "${GARAGE_ADMIN_TOKEN:?GARAGE_ADMIN_TOKEN must be set}"
+: "${S3_ENDPOINT:=http://127.0.0.1:3900}"
+: "${S3_REGION:=garage}"
+: "${S3_BUCKET:=test-bucket}"
+: "${S3_CONFIG_PATH:=s3-config.json}"
+: "${S3_ACCESS_KEY_NAME:=e2e-test-app}"
+
+json_get() {
+  local field="$1"
+
+  node -e '
+    const fs = require("fs");
+    const data = JSON.parse(fs.readFileSync(0, "utf8"));
+    const value = process.argv[1].split(".").reduce((current, key) => current?.[key], data);
+    if (value === undefined || value === null) {
+      process.exit(1);
+    }
+    process.stdout.write(String(value));
+  ' "$field"
+}
+
+json_find_bucket_id_by_alias() {
+  local bucket_name="$1"
+
+  node -e '
+    const fs = require("fs");
+    const bucketName = process.argv[1];
+    const items = JSON.parse(fs.readFileSync(0, "utf8"));
+    const bucket = items.find((item) => Array.isArray(item.globalAliases) && item.globalAliases.includes(bucketName));
+    if (bucket?.id) {
+      process.stdout.write(bucket.id);
+    }
+  ' "$bucket_name"
+}
+
+json_find_key_id_by_name() {
+  local key_name="$1"
+
+  node -e '
+    const fs = require("fs");
+    const keyName = process.argv[1];
+    const items = JSON.parse(fs.readFileSync(0, "utf8"));
+    const key = items.find((item) => item?.name === keyName && item?.expired === false);
+    if (key?.id) {
+      process.stdout.write(key.id);
+    }
+  ' "$key_name"
+}
+
+admin_post() {
+  local path="$1"
+  local payload="$2"
+
+  curl -fsS \
+    -X POST \
+    -H "Authorization: Bearer $GARAGE_ADMIN_TOKEN" \
+    -H 'Content-Type: application/json' \
+    --data "$payload" \
+    "$GARAGE_ADMIN_URL$path"
+}
+
+admin_get() {
+  local path="$1"
+
+  curl -fsS \
+    -H "Authorization: Bearer $GARAGE_ADMIN_TOKEN" \
+    "$GARAGE_ADMIN_URL$path"
+}
+
+get_bucket_id() {
+  local bucket_name="$1"
+
+  admin_get '/v2/ListBuckets' | json_find_bucket_id_by_alias "$bucket_name"
+}
+
+get_key_id() {
+  local key_name="$1"
+
+  admin_get '/v2/ListKeys' | json_find_key_id_by_name "$key_name"
+}
+
+get_key_info() {
+  local access_key_id="$1"
+
+  admin_get "/v2/GetKeyInfo?id=$access_key_id&showSecretKey=true"
+}
+
+create_bucket() {
+  local bucket_name="$1"
+
+  admin_post '/v2/CreateBucket' "{\"globalAlias\":\"$bucket_name\"}"
+}
+
+create_access_key() {
+  local key_name="$1"
+
+  admin_post '/v2/CreateKey' "{\"name\":\"$key_name\",\"neverExpires\":true}"
+}
+
+allow_bucket_key() {
+  local bucket_id="$1"
+  local access_key_id="$2"
+
+  admin_post '/v2/AllowBucketKey' "{\"bucketId\":\"$bucket_id\",\"accessKeyId\":\"$access_key_id\",\"permissions\":{\"owner\":true,\"read\":true,\"write\":true}}"
+}
+
+bucket_id=$(get_bucket_id "$S3_BUCKET")
+if [[ -z "$bucket_id" ]]; then
+  bucket_response=$(create_bucket "$S3_BUCKET")
+  bucket_id=$(printf '%s' "$bucket_response" | json_get 'id')
+fi
+
+access_key_id=$(get_key_id "$S3_ACCESS_KEY_NAME")
+if [[ -z "$access_key_id" ]]; then
+  key_response=$(create_access_key "$S3_ACCESS_KEY_NAME")
+  access_key_id=$(printf '%s' "$key_response" | json_get 'accessKeyId')
+  secret_access_key=$(printf '%s' "$key_response" | json_get 'secretAccessKey')
+else
+  key_response=$(get_key_info "$access_key_id")
+  secret_access_key=$(printf '%s' "$key_response" | json_get 'secretAccessKey')
+fi
+
+allow_bucket_key "$bucket_id" "$access_key_id" >/dev/null
+
+cat > "$S3_CONFIG_PATH" <<EOF
+{
+  "awsEndpoint": "$S3_ENDPOINT",
+  "awsRegion": "$S3_REGION",
+  "awsAccessKeyId": "$access_key_id",
+  "awsSecretAccessKey": "$secret_access_key",
+  "bucket": "$S3_BUCKET"
+}
+EOF
diff --git a/e2e/run-garage-tests.sh b/e2e/run-garage-tests.sh
new file mode 100755
index 00000000..f4c26278
--- /dev/null
+++ b/e2e/run-garage-tests.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+S3_CONFIG_PATH="$ROOT_DIR/s3-config.json"
+
+if [[ ! -f "$S3_CONFIG_PATH" ]]; then
+  echo 's3-config.json was not found.' >&2
+  echo 'Run dev/setup.sh to deploy Garage to your kind cluster (it writes s3-config.json).' >&2
+  exit 1
+fi
+
+node --env-file=.env.test node_modules/.bin/vite build
+node_modules/.bin/playwright test "$@"
diff --git a/e2e/storage-s3.spec.ts b/e2e/storage-s3.spec.ts
new file mode 100644
index 00000000..f7e7710d
--- /dev/null
+++ b/e2e/storage-s3.spec.ts
@@ -0,0 +1,93 @@
+import { test, expect } from '@playwright/test';
+import { waitForHydration } from './helpers.js';
+
+declare const process: {
+  env: Record<string, string | undefined>;
+};
+
+/**
+ * Live S3 integration tests against a real Garage instance.
+ *
+ * These tests only run when s3-config.json exists in the project root —
+ * written by the "Start Garage S3 and initialize bucket" CI step. They are
+ * automatically skipped in all other environments.
+ *
+ * The global setup (global-setup.ts) reads s3-config.json and exposes its
+ * values as S3_TEST_* environment variables.
+ */
+test.describe('Storage S3 (Garage)', () => {
+  test.use({ locale: 'en-US' });
+
+  async function openConnectForm(page: import('@playwright/test').Page) {
+    await page.goto('/storage?disconnected=1');
+    await waitForHydration(page);
+
+    const disconnectButton = page.getByRole('button', { name: 'Disconnect' });
+    if (await disconnectButton.isVisible().catch(() => false)) {
+      await disconnectButton.click();
+    }
+
+    await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
+  }
+
+  test('connects to Garage S3 bucket and lists buckets', async ({ page }) => {
+    test.skip(
+      !process.env.S3_TEST_ENDPOINT,
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+
+    const endpoint = process.env.S3_TEST_ENDPOINT!;
+    const region = process.env.S3_TEST_REGION!;
+    const accessKeyId = process.env.S3_TEST_ACCESS_KEY_ID!;
+    const secretAccessKey = process.env.S3_TEST_SECRET_ACCESS_KEY!;
+    const bucket = process.env.S3_TEST_BUCKET!;
+
+    await openConnectForm(page);
+
+    // Fill in the connection form
+    await page.getByLabel('Endpoint URL').fill(endpoint);
+    await page.getByLabel('Region').fill(region);
+    await page.getByLabel('Access key ID').fill(accessKeyId);
+    await page.getByLabel('Secret access key').fill(secretAccessKey);
+
+    // Path-style addressing is on by default (required for Garage) — verify it is checked
+    await expect(page.getByLabel('Use path-style addressing')).toBeChecked();
+
+    await page.getByRole('button', { name: 'Connect' }).click();
+
+    // After a successful connection the app redirects to /storage and shows the bucket list
+    await expect(page).toHaveURL('/storage');
+    const main = page.locator('main');
+    await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
+
+    // The bucket created during Garage setup must appear in the list
+    await expect(main.getByRole('link', { name: bucket, exact: true })).toBeVisible();
+  });
+
+  test('disconnects from Garage S3', async ({ page }) => {
+    test.skip(
+      !process.env.S3_TEST_ENDPOINT,
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+
+    const endpoint = process.env.S3_TEST_ENDPOINT!;
+    const region = process.env.S3_TEST_REGION!;
+    const accessKeyId = process.env.S3_TEST_ACCESS_KEY_ID!;
+    const secretAccessKey = process.env.S3_TEST_SECRET_ACCESS_KEY!;
+
+    // First connect
+    await openConnectForm(page);
+    await page.getByLabel('Endpoint URL').fill(endpoint);
+    await page.getByLabel('Region').fill(region);
+    await page.getByLabel('Access key ID').fill(accessKeyId);
+    await page.getByLabel('Secret access key').fill(secretAccessKey);
+    await page.getByRole('button', { name: 'Connect' }).click();
+    await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
+
+    // Then disconnect
+    await page.getByRole('button', { name: 'Disconnect' }).click();
+
+    // Should return to the connect form
+    await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
+  });
+});
diff --git a/package.json b/package.json
index 0dab6aa3..50e7d5ca 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,7 @@
     "lint:fix": "prettier --write --ignore-path .prettierignore . && eslint . --fix",
     "test:unit": "vitest run",
     "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && playwright test",
+    "test:e2e:garage": "./e2e/run-garage-tests.sh",
     "test:e2e:ui": "playwright test --ui",
     "generate:antlr": "cd src/lib/editor/grammar && antlr-ng -v -l -Dlanguage=TypeScript -o ../generated SqlBase.g4 && node patch-generated.mjs"
   },

From 134b88fcf61785e2a70a9d7b2933df5767442f97 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 1 Jun 2026 08:23:59 +0200
Subject: [PATCH 042/136] #135 Add E2E Tests to S3 File Browser (#166)

* #135 add garage instance to GitHub workflow for e2e tests

* #135 fix yaml lint

* #135 fix docker command in action

* #135 fix docker options in action

* #135 fix yaml format

* #135 refactor GitHub action for s3 deployment with code fixes

* #135 fix missing entrypoint in container

* #135 remove format use on s3 creation

* #135 add e2e tests that require a bucket

* #135 allow local starting of s3 e2e tests, fix lint

* #135 fix lint

* #135 move garage.toml to permanent repository

* #135 create keys and bucket via curl

* #135 fix lint

* #135 fix lint

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* #135 add e2e tests for s3 file browser

* #135 add coverage report in markdown

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* #135 fix lint

* Implement Garage S3 deployment and configuration for E2E testing

* #135 fix lint

* #135 refactor e2e directory structure, split storage test file into smaller files

* #135 fix lint

* #135 fix lint

* #135 fix missing admin token in s3 config for tests

* #135 add e2e tests for csv and image previews

* #135 Delete E2E_COVERAGE.md

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .env.test                               |   2 +
 e2e/{ => auth}/auth.setup.ts            |   4 +-
 e2e/{ => auth}/auth.spec.ts             |   0
 e2e/i18n.spec.ts                        |   2 +-
 e2e/init-garage-s3.sh                   |   9 +-
 e2e/run-garage-tests.sh                 |   6 +-
 e2e/smoke.spec.ts                       |   2 +-
 e2e/storage/browsing.spec.ts            | 146 +++++++++++
 e2e/storage/connection.spec.ts          | 106 ++++++++
 e2e/storage/context-menu.spec.ts        |  96 ++++++++
 e2e/storage/delete.spec.ts              | 122 ++++++++++
 e2e/storage/download.spec.ts            |  83 +++++++
 e2e/storage/helpers.ts                  | 169 +++++++++++++
 e2e/storage/permissions.spec.ts         | 135 +++++++++++
 e2e/storage/preview.spec.ts             | 306 ++++++++++++++++++++++++
 e2e/storage/recent-items.spec.ts        |  69 ++++++
 e2e/storage/upload.spec.ts              | 199 +++++++++++++++
 e2e/support/garage.ts                   | 287 ++++++++++++++++++++++
 e2e/{ => support}/global-setup.ts       |  14 +-
 e2e/{ => support}/helpers.ts            |   0
 e2e/{ => support}/mock-oidc-server.ts   |   0
 e2e/{ => support}/start-mock-oidc.ts    |   0
 e2e/{ => support}/start-mock-trino.ts   |   0
 e2e/support/storage-upload-fixtures.ts  | 133 ++++++++++
 e2e/{ => trino}/catalog-browser.spec.ts |   2 +-
 e2e/{ => trino}/connection-form.spec.ts |   2 +-
 e2e/{ => trino}/trino-tabs.spec.ts      |   2 +-
 e2e/{ => trino}/trino.spec.ts           |   2 +-
 package-lock.json                       |  18 ++
 package.json                            |   1 +
 playwright.config.ts                    |   6 +-
 31 files changed, 1907 insertions(+), 16 deletions(-)
 rename e2e/{ => auth}/auth.setup.ts (87%)
 rename e2e/{ => auth}/auth.spec.ts (100%)
 create mode 100644 e2e/storage/browsing.spec.ts
 create mode 100644 e2e/storage/connection.spec.ts
 create mode 100644 e2e/storage/context-menu.spec.ts
 create mode 100644 e2e/storage/delete.spec.ts
 create mode 100644 e2e/storage/download.spec.ts
 create mode 100644 e2e/storage/helpers.ts
 create mode 100644 e2e/storage/permissions.spec.ts
 create mode 100644 e2e/storage/preview.spec.ts
 create mode 100644 e2e/storage/recent-items.spec.ts
 create mode 100644 e2e/storage/upload.spec.ts
 create mode 100644 e2e/support/garage.ts
 rename e2e/{ => support}/global-setup.ts (58%)
 rename e2e/{ => support}/helpers.ts (100%)
 rename e2e/{ => support}/mock-oidc-server.ts (100%)
 rename e2e/{ => support}/start-mock-oidc.ts (100%)
 rename e2e/{ => support}/start-mock-trino.ts (100%)
 create mode 100644 e2e/support/storage-upload-fixtures.ts
 rename e2e/{ => trino}/catalog-browser.spec.ts (99%)
 rename e2e/{ => trino}/connection-form.spec.ts (99%)
 rename e2e/{ => trino}/trino-tabs.spec.ts (99%)
 rename e2e/{ => trino}/trino.spec.ts (99%)

diff --git a/.env.test b/.env.test
index fcdbaaf7..97f83472 100644
--- a/.env.test
+++ b/.env.test
@@ -7,3 +7,5 @@ STACKABLE_UI_TRINO_URL=http://localhost:8080
 STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
 ORIGIN=http://localhost:4173
 PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
+GARAGE_ADMIN_URL=http://localhost:30902
+GARAGE_ADMIN_TOKEN=stackable-ui-e2e-admin-token
diff --git a/e2e/auth.setup.ts b/e2e/auth/auth.setup.ts
similarity index 87%
rename from e2e/auth.setup.ts
rename to e2e/auth/auth.setup.ts
index 91526c92..748bcd9e 100644
--- a/e2e/auth.setup.ts
+++ b/e2e/auth/auth.setup.ts
@@ -1,6 +1,6 @@
 import { test as setup, expect } from '@playwright/test';
 import path from 'path';
-import { waitForHydration } from './helpers.js';
+import { waitForHydration } from '../support/helpers.js';
 
 // Each Playwright project runs its own auth setup, producing a unique
 // session. The mock OIDC server issues a different `sub` per token so
@@ -8,7 +8,7 @@ import { waitForHydration } from './helpers.js';
 // in-memory Trino connection store is keyed by userId).
 
 setup('authenticate via mock OIDC', async ({ page }, testInfo) => {
-  const authFile = path.join(import.meta.dirname, `.auth/user-${testInfo.project.name}.json`);
+  const authFile = path.join(import.meta.dirname, `../.auth/user-${testInfo.project.name}.json`);
 
   // Navigate to the app — auth guard redirects to /auth/login
   await page.goto('/');
diff --git a/e2e/auth.spec.ts b/e2e/auth/auth.spec.ts
similarity index 100%
rename from e2e/auth.spec.ts
rename to e2e/auth/auth.spec.ts
diff --git a/e2e/i18n.spec.ts b/e2e/i18n.spec.ts
index 54074c1f..73b9ce29 100644
--- a/e2e/i18n.spec.ts
+++ b/e2e/i18n.spec.ts
@@ -1,7 +1,7 @@
 import { test, expect } from '@playwright/test';
 import fs from 'fs';
 import path from 'path';
-import { waitForHydration } from './helpers';
+import { waitForHydration } from './support/helpers';
 
 /** Load the saved auth storage state, optionally stripping the locale cookie. */
 function loadAuthState(projectName: string, { withoutLocale = false } = {}) {
diff --git a/e2e/init-garage-s3.sh b/e2e/init-garage-s3.sh
index 89d93b66..dc2b9bb0 100755
--- a/e2e/init-garage-s3.sh
+++ b/e2e/init-garage-s3.sh
@@ -9,6 +9,9 @@ set -euo pipefail
 : "${S3_BUCKET:=test-bucket}"
 : "${S3_CONFIG_PATH:=s3-config.json}"
 : "${S3_ACCESS_KEY_NAME:=e2e-test-app}"
+: "${S3_PERMISSION_OWNER:=true}"
+: "${S3_PERMISSION_READ:=true}"
+: "${S3_PERMISSION_WRITE:=true}"
 
 json_get() {
   local field="$1"
@@ -106,7 +109,7 @@ allow_bucket_key() {
   local bucket_id="$1"
   local access_key_id="$2"
 
-  admin_post '/v2/AllowBucketKey' "{\"bucketId\":\"$bucket_id\",\"accessKeyId\":\"$access_key_id\",\"permissions\":{\"owner\":true,\"read\":true,\"write\":true}}"
+  admin_post '/v2/AllowBucketKey' "{\"bucketId\":\"$bucket_id\",\"accessKeyId\":\"$access_key_id\",\"permissions\":{\"owner\":$S3_PERMISSION_OWNER,\"read\":$S3_PERMISSION_READ,\"write\":$S3_PERMISSION_WRITE}}"
 }
 
 bucket_id=$(get_bucket_id "$S3_BUCKET")
@@ -133,6 +136,8 @@ cat > "$S3_CONFIG_PATH" <<EOF
   "awsRegion": "$S3_REGION",
   "awsAccessKeyId": "$access_key_id",
   "awsSecretAccessKey": "$secret_access_key",
-  "bucket": "$S3_BUCKET"
+  "bucket": "$S3_BUCKET",
+  "garageAdminUrl": "$GARAGE_ADMIN_URL",
+  "garageAdminToken": "$GARAGE_ADMIN_TOKEN"
 }
 EOF
diff --git a/e2e/run-garage-tests.sh b/e2e/run-garage-tests.sh
index f4c26278..d5683b22 100755
--- a/e2e/run-garage-tests.sh
+++ b/e2e/run-garage-tests.sh
@@ -12,4 +12,8 @@ if [[ ! -f "$S3_CONFIG_PATH" ]]; then
 fi
 
 node --env-file=.env.test node_modules/.bin/vite build
-node_modules/.bin/playwright test "$@"
+# Run non-storage tests with full parallelism.
+node_modules/.bin/playwright test e2e/auth/ e2e/trino/ e2e/smoke.spec.ts e2e/i18n.spec.ts "$@"
+# Storage tests share a server-side S3 session per user and cannot run in
+# parallel within the same browser project. Run them serially.
+node_modules/.bin/playwright test e2e/storage/ --workers=1 "$@"
diff --git a/e2e/smoke.spec.ts b/e2e/smoke.spec.ts
index 77e97478..271256ef 100644
--- a/e2e/smoke.spec.ts
+++ b/e2e/smoke.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from '@playwright/test';
-import { waitForHydration } from './helpers';
+import { waitForHydration } from './support/helpers';
 
 test.describe('Smoke tests', () => {
   test.use({ locale: 'en-US' });
diff --git a/e2e/storage/browsing.spec.ts b/e2e/storage/browsing.spec.ts
new file mode 100644
index 00000000..701632d3
--- /dev/null
+++ b/e2e/storage/browsing.spec.ts
@@ -0,0 +1,146 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  putDirectoryMarker,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Browsing', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('browses nested folders, uses breadcrumbs, and shows empty folders', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'browse');
+    const cleanupKeys = [
+      `${prefix}notes.txt`,
+      `${prefix}reports/2026/q1.csv`,
+      `${prefix}reports/2026/q2.csv`,
+      `${prefix}empty-folder/`
+    ];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}notes.txt`, 'root note');
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}reports/2026/q1.csv`,
+        'quarter,revenue\n1,100\n',
+        'text/csv'
+      );
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}reports/2026/q2.csv`,
+        'quarter,revenue\n2,200\n',
+        'text/csv'
+      );
+      await putDirectoryMarker(client, credentials.bucket, `${prefix}empty-folder/`);
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await expect(rowByName(page, 'notes.txt')).toBeVisible();
+      await expect(rowByName(page, 'reports')).toBeVisible();
+      await expect(rowByName(page, 'empty-folder')).toBeVisible();
+
+      await rowByName(page, 'reports').click();
+      await expect(rowByName(page, '2026')).toBeVisible();
+
+      await rowByName(page, '2026').click();
+      await expect(rowByName(page, 'q1.csv')).toBeVisible();
+      await expect(rowByName(page, 'q2.csv')).toBeVisible();
+
+      await page.getByRole('button', { name: 'reports' }).click();
+      await expect(rowByName(page, '2026')).toBeVisible();
+      await expect(rowByName(page, 'q1.csv')).not.toBeVisible();
+
+      await rowByName(page, '...').click();
+      await expect(rowByName(page, 'empty-folder')).toBeVisible();
+
+      await rowByName(page, 'empty-folder').click();
+      await expect(page.getByText('This bucket is empty')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('paginates bucket listings', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'paginate');
+    const cleanupKeys: string[] = [];
+
+    try {
+      for (let index = 1; index <= 30; index += 1) {
+        const fileName = `file-${String(index).padStart(2, '0')}.txt`;
+        const key = `${prefix}${fileName}`;
+        cleanupKeys.push(key);
+        await putTextObject(client, credentials.bucket, key, `content ${index}`);
+      }
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await expect(page.getByText('Page 1', { exact: true })).toBeVisible();
+      await expect(rowByName(page, 'file-01.txt')).toBeVisible();
+      await expect(rowByName(page, 'file-26.txt')).not.toBeVisible();
+
+      await page.getByRole('button', { name: 'Next page' }).click();
+      await expect(page.getByText('Page 2', { exact: true })).toBeVisible();
+      await expect(rowByName(page, 'file-26.txt')).toBeVisible();
+      await expect(rowByName(page, 'file-01.txt')).not.toBeVisible();
+
+      await page.getByRole('button', { name: 'Previous page' }).click();
+      await expect(page.getByText('Page 1', { exact: true })).toBeVisible();
+      await expect(rowByName(page, 'file-01.txt')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('changes the page size and shows more items per page', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'page-size');
+    const cleanupKeys: string[] = [];
+
+    try {
+      for (let index = 1; index <= 30; index += 1) {
+        const key = `${prefix}item-${String(index).padStart(2, '0')}.txt`;
+        cleanupKeys.push(key);
+        await putTextObject(client, credentials.bucket, key, `item ${index}`);
+      }
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await expect(page.getByText('Page 1', { exact: true })).toBeVisible();
+      await expect(rowByName(page, 'item-01.txt')).toBeVisible();
+      await expect(rowByName(page, 'item-26.txt')).not.toBeVisible();
+
+      await page.getByLabel('Items per page').selectOption('50');
+
+      await expect(page.getByText('Page 1', { exact: true })).toBeVisible();
+      await expect(rowByName(page, 'item-01.txt')).toBeVisible();
+      await expect(rowByName(page, 'item-26.txt')).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Next page' })).toBeDisabled();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
new file mode 100644
index 00000000..d314dde3
--- /dev/null
+++ b/e2e/storage/connection.spec.ts
@@ -0,0 +1,106 @@
+import { test, expect } from '@playwright/test';
+import { hasGarageCredentials, requireGarageCredentials } from '../support/garage.js';
+import { connectToStorage, openConnectForm, bucketRoute } from './helpers.js';
+
+test.describe('Storage S3 — Connection', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('connects to Garage S3 bucket and lists buckets', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await connectToStorage(page, credentials);
+
+    await expect(page).toHaveURL('/storage');
+    const main = page.locator('main');
+    await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
+    await expect(main.getByRole('link', { name: credentials.bucket, exact: true })).toBeVisible();
+  });
+
+  test('shows an error for invalid Garage credentials', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await openConnectForm(page);
+    await page.getByLabel('Endpoint URL').fill(credentials.endpoint);
+    await page.getByLabel('Region').fill(credentials.region);
+    await page.getByLabel('Access key ID').fill(credentials.accessKeyId);
+    await page.getByLabel('Secret access key').fill(`${credentials.secretAccessKey}-wrong`);
+    await page.getByRole('button', { name: 'Connect' }).click();
+
+    await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
+    await expect(
+      page.getByText('Could not connect — check the endpoint and credentials.')
+    ).toBeVisible();
+  });
+
+  test('disconnects from Garage S3', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await connectToStorage(page, credentials);
+    await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
+
+    await page.getByRole('button', { name: 'Disconnect' }).click();
+    await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
+  });
+
+  test('saves a connection and reconnects from the saved connections list', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await openConnectForm(page);
+
+    const savedList = page.getByRole('list', { name: 'Saved connections' });
+    await expect(savedList).toBeVisible();
+
+    await savedList.getByRole('listitem').first().getByRole('button').first().click();
+
+    await expect(page).toHaveURL('/storage');
+    await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
+  });
+
+  test('forgets a saved connection via the remove button', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await openConnectForm(page);
+
+    const savedList = page.getByRole('list', { name: 'Saved connections' });
+    await expect(savedList).toBeVisible();
+
+    await savedList.getByRole('listitem').first().getByRole('button').last().click();
+
+    await expect(page.getByRole('button', { name: 'Forget', exact: true })).toBeVisible();
+    await page.getByRole('button', { name: 'Forget', exact: true }).click();
+
+    await expect(savedList).not.toBeVisible();
+    await expect(page.getByText('No saved connections yet')).toBeVisible();
+  });
+
+  test('clicking a bucket tile in the grid navigates to the bucket explorer', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    const bucketLink = page
+      .locator('main')
+      .getByRole('link', { name: credentials.bucket, exact: true });
+    await expect(bucketLink).toBeVisible();
+    await bucketLink.click();
+
+    await expect(page).toHaveURL(bucketRoute(credentials.bucket));
+    await expect(page.locator('nav[aria-label="breadcrumb"] [aria-current="page"]')).toContainText(
+      credentials.bucket
+    );
+  });
+});
diff --git a/e2e/storage/context-menu.spec.ts b/e2e/storage/context-menu.spec.ts
new file mode 100644
index 00000000..3d01da59
--- /dev/null
+++ b/e2e/storage/context-menu.spec.ts
@@ -0,0 +1,96 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  objectExists,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Context Menu', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('context menu appears on right-click and shows file actions', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'ctx-menu');
+    const cleanupKeys = [`${prefix}ctx-file.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}ctx-file.txt`, 'menu test');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'ctx-file.txt').click({ button: 'right' });
+
+      const menu = page.getByRole('menu');
+      await expect(menu).toBeVisible();
+      await expect(menu.getByRole('menuitem', { name: 'Preview' })).toBeEnabled();
+      await expect(menu.getByRole('menuitem', { name: 'Download' })).toBeEnabled();
+      await expect(menu.getByRole('menuitem', { name: 'Delete' })).toBeEnabled();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('context menu closes when the Escape key is pressed', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'ctx-escape');
+    const cleanupKeys = [`${prefix}escape-test.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}escape-test.txt`, 'escape test');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'escape-test.txt').click({ button: 'right' });
+      await expect(page.getByRole('menu')).toBeVisible();
+
+      await page.keyboard.press('Escape');
+
+      await expect(page.getByRole('menu')).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('deletes a single file via context menu', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'ctx-delete');
+    const cleanupKeys = [`${prefix}ctx-del.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}ctx-del.txt`, 'delete me');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'ctx-del.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+      await expect(page.getByRole('button', { name: 'Delete permanently' })).toBeVisible();
+      await page.getByRole('button', { name: 'Delete permanently' }).click();
+
+      await expect(page.getByText('This bucket is empty')).toBeVisible();
+      await expect(await objectExists(client, credentials.bucket, `${prefix}ctx-del.txt`)).toBe(
+        false
+      );
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/delete.spec.ts b/e2e/storage/delete.spec.ts
new file mode 100644
index 00000000..2df45115
--- /dev/null
+++ b/e2e/storage/delete.spec.ts
@@ -0,0 +1,122 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  objectExists,
+  putDirectoryMarker,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Delete & Selection', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('deletes files and folders recursively', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'delete');
+    const cleanupKeys = [`${prefix}remove-me.txt`, `${prefix}archive/nested.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}remove-me.txt`, 'remove');
+      await putTextObject(client, credentials.bucket, `${prefix}archive/nested.txt`, 'nested');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      await page.getByLabel('Select remove-me.txt').check();
+      await page.getByLabel('Select archive').check();
+
+      await page.getByRole('button', { name: 'Delete' }).click();
+      await expect(page.getByText('All contents will be permanently deleted')).toBeVisible();
+      await page.getByRole('button', { name: 'Delete permanently' }).click();
+
+      await expect(page.getByText('This bucket is empty')).toBeVisible();
+      await expect(await objectExists(client, credentials.bucket, `${prefix}remove-me.txt`)).toBe(
+        false
+      );
+      await expect(
+        await objectExists(client, credentials.bucket, `${prefix}archive/nested.txt`)
+      ).toBe(false);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('cancel delete does not remove the selected file', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'cancel-delete');
+    const cleanupKeys = [`${prefix}keep-me.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}keep-me.txt`, 'do not delete');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await expect(rowByName(page, 'keep-me.txt')).toBeVisible();
+
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      await page.getByLabel('Select keep-me.txt').check();
+      await page.getByRole('button', { name: 'Delete' }).click();
+
+      await expect(page.getByText('This action cannot be undone.')).toBeVisible();
+
+      await page.getByRole('button', { name: 'Cancel' }).click();
+
+      await expect(page.getByText('This action cannot be undone.')).not.toBeVisible();
+      await expect(rowByName(page, 'keep-me.txt')).toBeVisible();
+      await expect(await objectExists(client, credentials.bucket, `${prefix}keep-me.txt`)).toBe(
+        true
+      );
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('selects all items and deselects them with the header checkbox', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'select-all');
+    const cleanupKeys = [`${prefix}alpha.txt`, `${prefix}beta.txt`, `${prefix}sub/`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}alpha.txt`, 'a');
+      await putTextObject(client, credentials.bucket, `${prefix}beta.txt`, 'b');
+      await putDirectoryMarker(client, credentials.bucket, `${prefix}sub/`);
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+
+      const selectAll = page.getByLabel('Select all');
+      await selectAll.check();
+
+      await expect(page.getByLabel('Select alpha.txt')).toBeChecked();
+      await expect(page.getByLabel('Select beta.txt')).toBeChecked();
+      await expect(page.getByLabel('Select sub')).toBeChecked();
+
+      await selectAll.uncheck();
+
+      await expect(page.getByLabel('Select alpha.txt')).not.toBeChecked();
+      await expect(page.getByLabel('Select beta.txt')).not.toBeChecked();
+      await expect(page.getByLabel('Select sub')).not.toBeChecked();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/download.spec.ts b/e2e/storage/download.spec.ts
new file mode 100644
index 00000000..5c9f1037
--- /dev/null
+++ b/e2e/storage/download.spec.ts
@@ -0,0 +1,83 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Download', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('downloads a file via the selection toolbar', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'dl-toolbar');
+    const cleanupKeys = [`${prefix}download-me.txt`];
+
+    try {
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}download-me.txt`,
+        'download content'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      await page.getByLabel('Select download-me.txt').check();
+
+      const [download] = await Promise.all([
+        page.waitForEvent('download'),
+        page.getByRole('button', { name: 'Download', exact: true }).click()
+      ]);
+
+      expect(download.suggestedFilename()).toBe('download-me.txt');
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('downloads a file via the context menu', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'dl-ctx');
+    const cleanupKeys = [`${prefix}ctx-download.txt`];
+
+    try {
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}ctx-download.txt`,
+        'ctx download content'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'ctx-download.txt').click({ button: 'right' });
+
+      const [download] = await Promise.all([
+        page.waitForEvent('download'),
+        page.getByRole('menuitem', { name: 'Download' }).click()
+      ]);
+
+      expect(download.suggestedFilename()).toBe('ctx-download.txt');
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
new file mode 100644
index 00000000..744a9246
--- /dev/null
+++ b/e2e/storage/helpers.ts
@@ -0,0 +1,169 @@
+import {
+  DeleteObjectsCommand,
+  GetObjectCommand,
+  HeadObjectCommand,
+  PutObjectCommand,
+  S3Client
+} from '@aws-sdk/client-s3';
+import { expect, type Page, type TestInfo } from '@playwright/test';
+import { type GarageCredentials } from '../support/garage.js';
+import { waitForHydration } from '../support/helpers.js';
+
+export function uniquePrefix(testInfo: TestInfo, scope: string): string {
+  const slug = scope
+    .replace(/[^a-z0-9]+/gi, '-')
+    .replace(/^-+|-+$/g, '')
+    .toLowerCase();
+  return `${slug}-${testInfo.project.name.toLowerCase()}-${crypto.randomUUID()}/`;
+}
+
+export function uniqueBucketName(testInfo: TestInfo, scope: string): string {
+  const slug = scope
+    .replace(/[^a-z0-9]+/gi, '-')
+    .replace(/^-+|-+$/g, '')
+    .toLowerCase();
+  return `garage-${slug}-${testInfo.project.name.toLowerCase()}-${crypto.randomUUID().slice(0, 8)}`;
+}
+
+export function bucketRoute(bucket: string, prefix = ''): string {
+  if (!prefix) {
+    return `/storage/${encodeURIComponent(bucket)}`;
+  }
+
+  const trimmed = prefix.replace(/\/$/, '');
+  const encoded = trimmed
+    .split('/')
+    .filter(Boolean)
+    .map((segment) => encodeURIComponent(segment))
+    .join('/');
+
+  return `/storage/${encodeURIComponent(bucket)}/${encoded}`;
+}
+
+export async function openConnectForm(page: Page) {
+  await page.goto('/');
+  if (new URL(page.url()).pathname.startsWith('/auth/login')) {
+    await waitForHydration(page);
+    await page.getByRole('button', { name: /sign in with sso/i }).click();
+    await expect(page).toHaveURL('/');
+    await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
+  }
+
+  await page.goto('/storage?disconnected=1');
+  await waitForHydration(page);
+
+  const connectHeading = page.getByRole('heading', { name: 'Connect to storage' });
+  const disconnectButton = page.getByRole('button', { name: 'Disconnect' });
+  if (
+    !(await connectHeading.isVisible().catch(() => false)) &&
+    (await disconnectButton.isVisible().catch(() => false))
+  ) {
+    await disconnectButton.click();
+  }
+
+  await expect(connectHeading).toBeVisible();
+}
+
+export async function connectToStorage(page: Page, credentials: GarageCredentials) {
+  await openConnectForm(page);
+  await page.getByLabel('Endpoint URL').fill(credentials.endpoint);
+  await page.getByLabel('Region').fill(credentials.region);
+  await page.getByLabel('Access key ID').fill(credentials.accessKeyId);
+  await page.getByLabel('Secret access key').fill(credentials.secretAccessKey);
+  await expect(page.getByLabel('Use path-style addressing')).toBeChecked();
+  await page.getByRole('button', { name: 'Connect' }).click();
+}
+
+export async function connectAndOpenPrefix(
+  page: Page,
+  credentials: GarageCredentials,
+  prefix = ''
+) {
+  await connectToStorage(page, credentials);
+  await expect(page).toHaveURL('/storage');
+  await page.goto(bucketRoute(credentials.bucket, prefix));
+  await waitForHydration(page);
+}
+
+export async function putTextObject(
+  client: S3Client,
+  bucket: string,
+  key: string,
+  body: string,
+  contentType = 'text/plain'
+) {
+  await client.send(
+    new PutObjectCommand({
+      Bucket: bucket,
+      Key: key,
+      Body: body,
+      ContentType: contentType
+    })
+  );
+}
+
+export async function putDirectoryMarker(client: S3Client, bucket: string, key: string) {
+  await client.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: '' }));
+}
+
+export async function deleteKnownKeys(client: S3Client, bucket: string, keys: string[]) {
+  const existingKeys = Array.from(new Set(keys.filter(Boolean)));
+
+  if (existingKeys.length === 0) {
+    return;
+  }
+
+  for (let index = 0; index < existingKeys.length; index += 1000) {
+    const chunk = existingKeys.slice(index, index + 1000);
+    await client.send(
+      new DeleteObjectsCommand({
+        Bucket: bucket,
+        Delete: {
+          Objects: chunk.map((key) => ({ Key: key })),
+          Quiet: true
+        }
+      })
+    );
+  }
+}
+
+export async function objectExists(
+  client: S3Client,
+  bucket: string,
+  key: string
+): Promise<boolean> {
+  try {
+    await client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function getObjectText(
+  client: S3Client,
+  bucket: string,
+  key: string
+): Promise<string> {
+  const output = await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+  if (!output.Body) {
+    throw new Error(`Object ${key} has no body`);
+  }
+
+  return output.Body.transformToString();
+}
+
+export function rowByName(page: Page, name: string) {
+  return page.locator('tbody tr', { hasText: name }).first();
+}
+
+export function modalBox(page: Page) {
+  return page.locator('.modal-box').last();
+}
+
+export async function headObject(client: S3Client, bucket: string, key: string) {
+  return client.send(new HeadObjectCommand({ Bucket: bucket, Key: key }));
+}
+
+// Re-export expect for convenience
+export { expect };
diff --git a/e2e/storage/permissions.spec.ts b/e2e/storage/permissions.spec.ts
new file mode 100644
index 00000000..11cbec95
--- /dev/null
+++ b/e2e/storage/permissions.spec.ts
@@ -0,0 +1,135 @@
+import { test, expect } from '@playwright/test';
+import {
+  createGarageBucketCredentials,
+  createS3Client,
+  hasGarageAdmin,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import { createTextUploadFixture } from '../support/storage-upload-fixtures.js';
+import {
+  connectAndOpenPrefix,
+  connectToStorage,
+  deleteKnownKeys,
+  getObjectText,
+  modalBox,
+  objectExists,
+  putTextObject,
+  rowByName,
+  uniqueBucketName,
+  bucketRoute
+} from './helpers.js';
+
+test.describe('Storage S3 — Permissions', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('surfaces real Garage permission errors for a read-only bucket', async ({
+    page
+  }, testInfo) => {
+    test.skip(
+      !hasGarageAdmin(),
+      'Skipped: Garage admin API is unavailable for per-test bucket setup'
+    );
+
+    const baseCredentials = requireGarageCredentials();
+    const adminClient = createS3Client(baseCredentials);
+    const restrictedBucket = uniqueBucketName(testInfo, 'readonly');
+    const restrictedCredentials = await createGarageBucketCredentials(baseCredentials, {
+      bucketName: restrictedBucket,
+      keyName: `readonly-${testInfo.project.name}-${crypto.randomUUID()}`,
+      permissions: { owner: false, read: true, write: false },
+      ownerAccessKeyId: baseCredentials.accessKeyId
+    });
+    const uploadFixture = createTextUploadFixture(`${testInfo.title}-readonly-upload`);
+    const existingKey = 'existing.txt';
+    const blockedKey = uploadFixture.name;
+
+    try {
+      await putTextObject(adminClient, restrictedBucket, existingKey, 'keep me');
+
+      await connectAndOpenPrefix(page, restrictedCredentials);
+      await expect(rowByName(page, existingKey)).toBeVisible();
+
+      await page.getByRole('button', { name: 'Upload' }).click();
+      const uploadModal = modalBox(page);
+      await uploadModal.locator('input[aria-label="Select files"]').setInputFiles(uploadFixture);
+      await uploadModal.getByRole('button', { name: 'Upload' }).click();
+      await expect(uploadModal.getByText('Upload complete')).toBeVisible();
+      await expect(
+        uploadModal.getByText('Access denied. You do not have permission to upload here.')
+      ).toBeVisible();
+      await uploadModal.getByRole('button', { name: 'Done' }).click();
+      await expect(await objectExists(adminClient, restrictedBucket, blockedKey)).toBe(false);
+
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      await page.getByLabel(`Select ${existingKey}`).check();
+      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete permanently' }).click();
+
+      const errorToast = page
+        .getByRole('alert')
+        .filter({ hasText: 'Access denied. You do not have permission to delete this item.' });
+      await expect(errorToast).toBeVisible();
+      await expect(rowByName(page, existingKey)).toBeVisible();
+      await expect(await getObjectText(adminClient, restrictedBucket, existingKey)).toBe('keep me');
+    } finally {
+      await deleteKnownKeys(adminClient, restrictedBucket, [existingKey, blockedKey]);
+    }
+  });
+
+  test('shows access denied error when browsing a write-only bucket', async ({
+    page
+  }, testInfo) => {
+    test.skip(
+      !hasGarageAdmin(),
+      'Skipped: Garage admin API is unavailable for per-test bucket setup'
+    );
+
+    const baseCredentials = requireGarageCredentials();
+    const writeonlyBucket = uniqueBucketName(testInfo, 'writeonly');
+    const writeonlyCredentials = await createGarageBucketCredentials(baseCredentials, {
+      bucketName: writeonlyBucket,
+      keyName: `writeonly-${testInfo.project.name}-${crypto.randomUUID()}`,
+      permissions: { owner: false, read: false, write: true },
+      ownerAccessKeyId: baseCredentials.accessKeyId
+    });
+
+    await connectToStorage(page, writeonlyCredentials);
+    await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
+
+    await page.goto(bucketRoute(writeonlyBucket));
+
+    await expect(page.getByText('403')).toBeVisible();
+    await expect(page.getByText('You do not have permission to access the bucket')).toBeVisible();
+    await expect(page.getByRole('link', { name: 'Back to storage' })).toBeVisible();
+  });
+
+  test('shows access denied error when browsing a no-access bucket', async ({ page }, testInfo) => {
+    test.skip(
+      !hasGarageAdmin(),
+      'Skipped: Garage admin API is unavailable for per-test bucket setup'
+    );
+
+    const baseCredentials = requireGarageCredentials();
+    const noAccessBucket = uniqueBucketName(testInfo, 'noaccess');
+    const noAccessCredentials = await createGarageBucketCredentials(baseCredentials, {
+      bucketName: noAccessBucket,
+      keyName: `noaccess-${testInfo.project.name}-${crypto.randomUUID()}`,
+      permissions: { owner: false, read: false, write: false },
+      ownerAccessKeyId: baseCredentials.accessKeyId
+    });
+
+    await connectToStorage(page, noAccessCredentials);
+    await page.goto(bucketRoute(noAccessBucket));
+
+    await expect(page.getByText('403')).toBeVisible();
+    await expect(page.getByText('You do not have permission to access the bucket')).toBeVisible();
+  });
+});
diff --git a/e2e/storage/preview.spec.ts b/e2e/storage/preview.spec.ts
new file mode 100644
index 00000000..e07fc162
--- /dev/null
+++ b/e2e/storage/preview.spec.ts
@@ -0,0 +1,306 @@
+import { PutObjectCommand } from '@aws-sdk/client-s3';
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Preview', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('previews text files from the object table', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview');
+    const cleanupKeys = [`${prefix}preview.txt`];
+
+    try {
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}preview.txt`,
+        'Preview line one\nPreview line two\n'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'preview.txt').dblclick();
+      await expect(page.getByRole('heading', { name: 'preview.txt' })).toBeVisible();
+      await expect(page.getByText('Preview line one')).toBeVisible();
+      await expect(page.getByText('Preview line two')).toBeVisible();
+
+      await page.getByRole('button', { name: 'Close' }).last().click();
+      await expect(page.getByRole('heading', { name: 'preview.txt' })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('shows fallback preview for a known binary file type', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-zip');
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: Buffer.from([0x50, 0x4b, 0x03, 0x04, 0x00, 0x00]),
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'archive.zip').dblclick();
+
+      await expect(page.getByRole('heading', { name: 'archive.zip' })).toBeVisible();
+      await expect(page.getByText('Preview unavailable')).toBeVisible();
+      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('shows binary fallback preview for non-decodable binary content', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-bin');
+    const cleanupKeys = [`${prefix}data.bin`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}data.bin`,
+          Body: Buffer.from([0x80, 0x81, 0x82, 0x83, 0xff, 0xfe, 0x00, 0x01]),
+          ContentType: 'application/octet-stream'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'data.bin').dblclick();
+
+      await expect(page.getByRole('heading', { name: 'data.bin' })).toBeVisible();
+      await expect(page.getByText('Binary content')).toBeVisible();
+      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('shows a PDF preview for PDF files', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-pdf');
+    const cleanupKeys = [`${prefix}document.pdf`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}document.pdf`,
+          Body: Buffer.from('%PDF-1.4\n%%EOF\n'),
+          ContentType: 'application/pdf'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'document.pdf').dblclick();
+
+      await expect(page.getByRole('heading', { name: 'document.pdf' })).toBeVisible();
+      await expect(page.getByTitle('Preview of document.pdf')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews image files with alt text, file size, and download link', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-img');
+    const cleanupKeys = [`${prefix}diagram.svg`];
+
+    try {
+      const svg = `<svg xmlns="http://www.w3.org/2000/svg" width="200" height="100" viewBox="0 0 200 100">
+  <rect width="200" height="100" fill="#4f46e5" />
+  <text x="100" y="55" text-anchor="middle" fill="#fff" font-size="16">Test Image</text>
+</svg>`;
+
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}diagram.svg`,
+          Body: Buffer.from(svg),
+          ContentType: 'image/svg+xml'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'diagram.svg').dblclick();
+
+      // Modal heading
+      await expect(page.getByRole('heading', { name: 'diagram.svg' })).toBeVisible();
+
+      // Image rendered with accessible alt text
+      await expect(page.getByAltText('Preview of diagram.svg')).toBeVisible();
+
+      // File size badge is displayed
+      await expect(page.locator('.badge', { hasText: /B$/ })).toBeVisible();
+
+      // Download link is available
+      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+
+      // Close button works
+      await page.getByRole('button', { name: 'Close' }).last().click();
+      await expect(page.getByRole('heading', { name: 'diagram.svg' })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews CSV files with table headers and data rows', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-csv');
+    const cleanupKeys = [`${prefix}report.csv`];
+
+    try {
+      const csvContent = [
+        'name,city,score',
+        'Alice,Berlin,95',
+        'Bob,Munich,88',
+        'Charlie,Hamburg,72'
+      ].join('\n');
+
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}report.csv`,
+        csvContent,
+        'text/csv'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'report.csv').dblclick();
+
+      // Modal heading
+      await expect(page.getByRole('heading', { name: 'report.csv' })).toBeVisible();
+
+      // CSV table is rendered with correct aria label
+      const table = page.getByRole('table', { name: 'CSV preview' });
+      await expect(table).toBeVisible();
+
+      // Headers are present
+      await expect(table.locator('th', { hasText: 'name' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'city' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'score' })).toBeVisible();
+
+      // Data rows are present
+      await expect(table.locator('td', { hasText: 'Alice' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'Berlin' })).toBeVisible();
+      await expect(table.locator('td', { hasText: '95' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'Bob' })).toBeVisible();
+
+      // File size badge is displayed
+      await expect(page.locator('.badge', { hasText: /B$/ })).toBeVisible();
+
+      // Close button works
+      await page.getByRole('button', { name: 'Close' }).last().click();
+      await expect(page.getByRole('heading', { name: 'report.csv' })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews CSV files with quoted fields containing commas', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-csv-quoted');
+    const cleanupKeys = [`${prefix}addresses.csv`];
+
+    try {
+      const csvContent = [
+        'name,address,country',
+        '"Smith, John","123 Main St, Apt 4",Germany',
+        '"Doe, Jane","456 Oak Ave",Austria'
+      ].join('\n');
+
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}addresses.csv`,
+        csvContent,
+        'text/csv'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'addresses.csv').dblclick();
+
+      await expect(page.getByRole('heading', { name: 'addresses.csv' })).toBeVisible();
+
+      const table = page.getByRole('table', { name: 'CSV preview' });
+      await expect(table).toBeVisible();
+
+      // Quoted fields with commas are parsed correctly
+      await expect(table.locator('td', { hasText: 'Smith, John' })).toBeVisible();
+      await expect(table.locator('td', { hasText: '123 Main St, Apt 4' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'Germany' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('closes preview modal when the Escape key is pressed', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-escape');
+    const cleanupKeys = [`${prefix}escape.txt`];
+
+    try {
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}escape.txt`,
+        'press escape to close'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'escape.txt').dblclick();
+      await expect(page.getByRole('heading', { name: 'escape.txt' })).toBeVisible();
+
+      await page.keyboard.press('Escape');
+
+      await expect(page.getByRole('heading', { name: 'escape.txt' })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
new file mode 100644
index 00000000..a71f059a
--- /dev/null
+++ b/e2e/storage/recent-items.spec.ts
@@ -0,0 +1,69 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import { waitForHydration } from '../support/helpers.js';
+import {
+  bucketRoute,
+  connectAndOpenPrefix,
+  connectToStorage,
+  deleteKnownKeys,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Recent Items', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('tracks recently visited locations in the Recent Locations tab', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await connectToStorage(page, credentials);
+    await page.goto(bucketRoute(credentials.bucket));
+    await waitForHydration(page);
+
+    await page.goto('/storage');
+    await waitForHydration(page);
+
+    await page.getByRole('tab', { name: 'Recent Locations' }).click();
+
+    await expect(
+      page.locator('tbody').getByRole('link', { name: credentials.bucket }).first()
+    ).toBeVisible();
+  });
+
+  test('tracks recently accessed files in the Recent Files tab', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'recent-files');
+    const cleanupKeys = [`${prefix}recent.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}recent.txt`, 'recently accessed');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'recent.txt').dblclick();
+      await expect(page.getByRole('heading', { name: 'recent.txt' })).toBeVisible();
+      await page.getByRole('button', { name: 'Close' }).last().click();
+
+      await page.goto('/storage');
+      await waitForHydration(page);
+
+      const filesTab = page.getByRole('tab', { name: 'Recent Files' });
+      await expect(filesTab).toBeVisible();
+      await expect(page.locator('tbody').getByText('recent.txt')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/upload.spec.ts b/e2e/storage/upload.spec.ts
new file mode 100644
index 00000000..079f9816
--- /dev/null
+++ b/e2e/storage/upload.spec.ts
@@ -0,0 +1,199 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  createCsvUploadFixture,
+  createImageUploadFixture,
+  createTextUploadFixture
+} from '../support/storage-upload-fixtures.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  getObjectText,
+  headObject,
+  modalBox,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Upload', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('uploads realistic faker-generated text, csv, and image files', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'faker-upload');
+    const textFixture = createTextUploadFixture(`${testInfo.title}-text`);
+    const csvFixture = createCsvUploadFixture(`${testInfo.title}-csv`);
+    const imageFixture = createImageUploadFixture(`${testInfo.title}-image`);
+    const cleanupKeys = [
+      `${prefix}${textFixture.name}`,
+      `${prefix}${csvFixture.name}`,
+      `${prefix}${imageFixture.name}`
+    ];
+
+    try {
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await page.getByRole('button', { name: 'Upload' }).click();
+      const uploadModal = modalBox(page);
+      await uploadModal
+        .locator('input[aria-label="Select files"]')
+        .setInputFiles([textFixture, csvFixture, imageFixture]);
+      await uploadModal.getByRole('button', { name: 'Upload' }).click();
+      await expect(uploadModal.getByText('Upload complete')).toBeVisible();
+      await expect(uploadModal.getByText('3 uploaded · 0 skipped · 0 failed')).toBeVisible();
+      await uploadModal.getByRole('button', { name: 'Done' }).click();
+
+      await expect(rowByName(page, textFixture.name)).toBeVisible();
+      await expect(rowByName(page, csvFixture.name)).toBeVisible();
+      await expect(rowByName(page, imageFixture.name)).toBeVisible();
+
+      await expect(
+        await getObjectText(client, credentials.bucket, `${prefix}${textFixture.name}`)
+      ).toContain(textFixture.expectedSnippet);
+      await expect(
+        await getObjectText(client, credentials.bucket, `${prefix}${csvFixture.name}`)
+      ).toContain(csvFixture.expectedCell);
+
+      await expect(
+        (await headObject(client, credentials.bucket, `${prefix}${textFixture.name}`)).ContentType
+      ).toBe('text/plain');
+      await expect(
+        (await headObject(client, credentials.bucket, `${prefix}${csvFixture.name}`)).ContentType
+      ).toBe('text/csv');
+      await expect(
+        (await headObject(client, credentials.bucket, `${prefix}${imageFixture.name}`)).ContentType
+      ).toBe('image/svg+xml');
+
+      await rowByName(page, textFixture.name).dblclick();
+      await expect(page.getByRole('heading', { name: textFixture.name })).toBeVisible();
+      await expect(page.getByText(textFixture.expectedSnippet)).toBeVisible();
+      await page.getByRole('button', { name: 'Close' }).last().click();
+
+      await rowByName(page, csvFixture.name).dblclick();
+      await expect(page.getByRole('heading', { name: csvFixture.name })).toBeVisible();
+      await expect(page.getByText(csvFixture.expectedCell)).toBeVisible();
+      await page.getByRole('button', { name: 'Close' }).last().click();
+
+      await rowByName(page, imageFixture.name).dblclick();
+      await expect(page.getByRole('heading', { name: imageFixture.name })).toBeVisible();
+      await expect(page.getByAltText(`Preview of ${imageFixture.name}`)).toBeVisible();
+      await page.getByRole('button', { name: 'Close' }).last().click();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('uploads files and resolves replace, skip, and rename conflicts', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'upload');
+    const cleanupKeys = [
+      `${prefix}replace.txt`,
+      `${prefix}skip.txt`,
+      `${prefix}taken.txt`,
+      `${prefix}already-here.txt`,
+      `${prefix}renamed.txt`,
+      `${prefix}fresh.txt`
+    ];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}replace.txt`, 'old replace');
+      await putTextObject(client, credentials.bucket, `${prefix}skip.txt`, 'old skip');
+      await putTextObject(client, credentials.bucket, `${prefix}taken.txt`, 'old taken');
+      await putTextObject(client, credentials.bucket, `${prefix}already-here.txt`, 'taken target');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await page.getByRole('button', { name: 'Upload' }).click();
+      const uploadModal = modalBox(page);
+      await uploadModal.locator('input[aria-label="Select files"]').setInputFiles([
+        {
+          name: 'replace.txt',
+          mimeType: 'text/plain',
+          buffer: Buffer.from('new replace')
+        },
+        {
+          name: 'skip.txt',
+          mimeType: 'text/plain',
+          buffer: Buffer.from('new skip')
+        },
+        {
+          name: 'taken.txt',
+          mimeType: 'text/plain',
+          buffer: Buffer.from('new taken')
+        },
+        {
+          name: 'fresh.txt',
+          mimeType: 'text/plain',
+          buffer: Buffer.from('brand new')
+        }
+      ]);
+
+      await uploadModal.getByRole('button', { name: 'Upload' }).click();
+      await expect(uploadModal.getByText('Files already exist')).toBeVisible();
+
+      await uploadModal
+        .locator('li', { hasText: 'replace.txt' })
+        .getByRole('button', { name: 'Replace' })
+        .click();
+      await uploadModal
+        .locator('li', { hasText: 'skip.txt' })
+        .getByRole('button', { name: 'Skip' })
+        .click();
+
+      const renameItem = uploadModal.locator('li', { hasText: 'taken.txt' });
+      await renameItem.getByRole('button', { name: 'Rename' }).click();
+      await renameItem.getByLabel('New file name').fill('already-here.txt');
+      await renameItem.getByRole('button', { name: 'Confirm name' }).click();
+      await expect(
+        renameItem.getByText('This name already exists here. Please choose a different name.')
+      ).toBeVisible();
+
+      await renameItem.getByLabel('New file name').fill('renamed.txt');
+      await renameItem.getByRole('button', { name: 'Confirm name' }).click();
+
+      await uploadModal.getByRole('button', { name: 'Upload' }).click();
+      await expect(uploadModal.getByText('Upload complete')).toBeVisible();
+      await expect(uploadModal.getByText('3 uploaded · 1 skipped · 0 failed')).toBeVisible();
+      await uploadModal.getByRole('button', { name: 'Done' }).click();
+
+      await expect(rowByName(page, 'fresh.txt')).toBeVisible();
+      await expect(rowByName(page, 'renamed.txt')).toBeVisible();
+
+      await expect(await getObjectText(client, credentials.bucket, `${prefix}replace.txt`)).toBe(
+        'new replace'
+      );
+      await expect(await getObjectText(client, credentials.bucket, `${prefix}skip.txt`)).toBe(
+        'old skip'
+      );
+      await expect(await getObjectText(client, credentials.bucket, `${prefix}taken.txt`)).toBe(
+        'old taken'
+      );
+      await expect(await getObjectText(client, credentials.bucket, `${prefix}renamed.txt`)).toBe(
+        'new taken'
+      );
+      await expect(await getObjectText(client, credentials.bucket, `${prefix}fresh.txt`)).toBe(
+        'brand new'
+      );
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/support/garage.ts b/e2e/support/garage.ts
new file mode 100644
index 00000000..3d4142b0
--- /dev/null
+++ b/e2e/support/garage.ts
@@ -0,0 +1,287 @@
+import { S3Client } from '@aws-sdk/client-s3';
+
+declare const process: {
+  env: Record<string, string | undefined>;
+};
+
+export type GarageCredentials = {
+  endpoint: string;
+  region: string;
+  accessKeyId: string;
+  secretAccessKey: string;
+  bucket: string;
+};
+
+export type GarageBucketPermissions = {
+  owner: boolean;
+  read: boolean;
+  write: boolean;
+};
+
+type JsonRecord = Record<string, unknown>;
+
+const ADMIN_LIST_KEYS = ['items', 'results', 'data', 'buckets', 'keys'];
+
+function asRecord(value: unknown): JsonRecord | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return null;
+  }
+
+  return value as JsonRecord;
+}
+
+function readString(value: unknown, keys: string[]): string | null {
+  const record = asRecord(value);
+  if (!record) {
+    return null;
+  }
+
+  for (const key of keys) {
+    const candidate = record[key];
+    if (typeof candidate === 'string' && candidate.length > 0) {
+      return candidate;
+    }
+  }
+
+  return null;
+}
+
+function readStringArray(value: unknown, keys: string[]): string[] {
+  const record = asRecord(value);
+  if (!record) {
+    return [];
+  }
+
+  for (const key of keys) {
+    const candidate = record[key];
+    if (Array.isArray(candidate)) {
+      return candidate.filter((item): item is string => typeof item === 'string');
+    }
+  }
+
+  return [];
+}
+
+function extractAdminList(value: unknown): JsonRecord[] {
+  if (Array.isArray(value)) {
+    return value.map((item) => asRecord(item)).filter((item): item is JsonRecord => item !== null);
+  }
+
+  const record = asRecord(value);
+  if (!record) {
+    return [];
+  }
+
+  for (const key of ADMIN_LIST_KEYS) {
+    const candidate = record[key];
+    if (Array.isArray(candidate)) {
+      return candidate
+        .map((item) => asRecord(item))
+        .filter((item): item is JsonRecord => item !== null);
+    }
+  }
+
+  return [];
+}
+
+function requireGarageAdminConfig() {
+  const adminUrl = process.env.GARAGE_ADMIN_URL;
+  const adminToken = process.env.GARAGE_ADMIN_TOKEN;
+
+  if (!adminUrl || !adminToken) {
+    throw new Error('Garage admin API is not available for this test run');
+  }
+
+  return { adminUrl, adminToken };
+}
+
+async function adminGet(path: string): Promise<unknown> {
+  const { adminUrl, adminToken } = requireGarageAdminConfig();
+  const response = await fetch(`${adminUrl}${path}`, {
+    headers: {
+      Authorization: `Bearer ${adminToken}`
+    }
+  });
+
+  if (!response.ok) {
+    throw new Error(`Garage admin GET ${path} failed with ${response.status}`);
+  }
+
+  return response.json();
+}
+
+async function adminPost(path: string, body: unknown): Promise<unknown> {
+  const { adminUrl, adminToken } = requireGarageAdminConfig();
+  const response = await fetch(`${adminUrl}${path}`, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${adminToken}`,
+      'Content-Type': 'application/json'
+    },
+    body: JSON.stringify(body)
+  });
+
+  if (!response.ok) {
+    throw new Error(`Garage admin POST ${path} failed with ${response.status}`);
+  }
+
+  return response.json();
+}
+
+async function findBucketId(bucketName: string): Promise<string | null> {
+  const buckets = extractAdminList(await adminGet('/v2/ListBuckets'));
+
+  for (const bucket of buckets) {
+    const aliases = readStringArray(bucket, ['globalAliases', 'global_aliases']);
+    const directAlias = readString(bucket, ['globalAlias', 'global_alias']);
+
+    if (aliases.includes(bucketName) || directAlias === bucketName) {
+      return readString(bucket, ['id', 'bucketId', 'bucket_id']);
+    }
+  }
+
+  return null;
+}
+
+async function ensureBucket(bucketName: string): Promise<string> {
+  const existingId = await findBucketId(bucketName);
+  if (existingId) {
+    return existingId;
+  }
+
+  const created = await adminPost('/v2/CreateBucket', { globalAlias: bucketName });
+  const createdId = readString(created, ['id', 'bucketId', 'bucket_id']);
+
+  if (createdId) {
+    return createdId;
+  }
+
+  const refreshedId = await findBucketId(bucketName);
+  if (!refreshedId) {
+    throw new Error(`Garage bucket ${bucketName} was not found in admin API`);
+  }
+
+  return refreshedId;
+}
+
+async function findKeyId(keyName: string): Promise<string | null> {
+  const keys = extractAdminList(await adminGet('/v2/ListKeys'));
+
+  for (const key of keys) {
+    const currentName = readString(key, ['name']);
+    const expired = key.expired;
+
+    if (currentName === keyName && expired !== true) {
+      return readString(key, ['id', 'accessKeyId', 'access_key_id']);
+    }
+  }
+
+  return null;
+}
+
+async function ensureAccessKey(keyName: string): Promise<{
+  accessKeyId: string;
+  secretAccessKey: string;
+}> {
+  const existingId = await findKeyId(keyName);
+
+  if (!existingId) {
+    const created = await adminPost('/v2/CreateKey', { name: keyName, neverExpires: true });
+    const accessKeyId = readString(created, ['accessKeyId', 'access_key_id', 'id']);
+    const secretAccessKey = readString(created, ['secretAccessKey', 'secret_access_key']);
+
+    if (!accessKeyId || !secretAccessKey) {
+      throw new Error(`Garage key ${keyName} was created without credentials`);
+    }
+
+    return { accessKeyId, secretAccessKey };
+  }
+
+  const info = await adminGet(
+    `/v2/GetKeyInfo?id=${encodeURIComponent(existingId)}&showSecretKey=true`
+  );
+  const accessKeyId = readString(info, ['accessKeyId', 'access_key_id', 'id']) ?? existingId;
+  const secretAccessKey = readString(info, ['secretAccessKey', 'secret_access_key']);
+
+  if (!secretAccessKey) {
+    throw new Error(`Garage key ${keyName} does not expose a secret access key`);
+  }
+
+  return { accessKeyId, secretAccessKey };
+}
+
+export function hasGarageCredentials(): boolean {
+  return Boolean(
+    process.env.S3_TEST_ENDPOINT &&
+    process.env.S3_TEST_REGION &&
+    process.env.S3_TEST_ACCESS_KEY_ID &&
+    process.env.S3_TEST_SECRET_ACCESS_KEY &&
+    process.env.S3_TEST_BUCKET
+  );
+}
+
+export function hasGarageAdmin(): boolean {
+  return Boolean(process.env.GARAGE_ADMIN_URL && process.env.GARAGE_ADMIN_TOKEN);
+}
+
+export function requireGarageCredentials(): GarageCredentials {
+  const endpoint = process.env.S3_TEST_ENDPOINT;
+  const region = process.env.S3_TEST_REGION;
+  const accessKeyId = process.env.S3_TEST_ACCESS_KEY_ID;
+  const secretAccessKey = process.env.S3_TEST_SECRET_ACCESS_KEY;
+  const bucket = process.env.S3_TEST_BUCKET;
+
+  if (!endpoint || !region || !accessKeyId || !secretAccessKey || !bucket) {
+    throw new Error('Garage S3 test configuration is incomplete');
+  }
+
+  return { endpoint, region, accessKeyId, secretAccessKey, bucket };
+}
+
+export function createS3Client(credentials: GarageCredentials): S3Client {
+  return new S3Client({
+    endpoint: credentials.endpoint,
+    region: credentials.region,
+    forcePathStyle: true,
+    credentials: {
+      accessKeyId: credentials.accessKeyId,
+      secretAccessKey: credentials.secretAccessKey
+    }
+  });
+}
+
+export async function createGarageBucketCredentials(
+  baseCredentials: GarageCredentials,
+  options: {
+    bucketName: string;
+    keyName: string;
+    permissions: GarageBucketPermissions;
+    /** Also grant owner+write access to this existing key ID (e.g. for seeding/cleanup). */
+    ownerAccessKeyId?: string;
+  }
+): Promise<GarageCredentials> {
+  const bucketId = await ensureBucket(options.bucketName);
+  const key = await ensureAccessKey(options.keyName);
+
+  await adminPost('/v2/AllowBucketKey', {
+    bucketId,
+    accessKeyId: key.accessKeyId,
+    permissions: options.permissions
+  });
+
+  if (options.ownerAccessKeyId && options.ownerAccessKeyId !== key.accessKeyId) {
+    await adminPost('/v2/AllowBucketKey', {
+      bucketId,
+      accessKeyId: options.ownerAccessKeyId,
+      permissions: { owner: true, read: true, write: true }
+    });
+  }
+
+  return {
+    endpoint: baseCredentials.endpoint,
+    region: baseCredentials.region,
+    accessKeyId: key.accessKeyId,
+    secretAccessKey: key.secretAccessKey,
+    bucket: options.bucketName
+  };
+}
diff --git a/e2e/global-setup.ts b/e2e/support/global-setup.ts
similarity index 58%
rename from e2e/global-setup.ts
rename to e2e/support/global-setup.ts
index 9cc99243..3754ac1b 100644
--- a/e2e/global-setup.ts
+++ b/e2e/support/global-setup.ts
@@ -2,11 +2,13 @@ import fs from 'node:fs';
 import path from 'path';
 
 export default async function globalSetup() {
-  process.loadEnvFile(path.join(import.meta.dirname, '..', '.env.test'));
+  process.loadEnvFile(path.join(import.meta.dirname, '../..', '.env.test'));
 
   // Optionally load S3 credentials written by the Garage setup step in CI.
   // When present, storage S3 tests run; when absent, they are skipped.
-  const s3ConfigPath = path.join(import.meta.dirname, '..', 's3-config.json');
+  // The admin URL/token from s3-config.json override .env.test values so that
+  // the permissions tests connect to the correct Garage admin port in CI.
+  const s3ConfigPath = path.join(import.meta.dirname, '../..', 's3-config.json');
   if (fs.existsSync(s3ConfigPath)) {
     const raw = fs.readFileSync(s3ConfigPath, 'utf-8');
     const cfg = JSON.parse(raw) as {
@@ -15,11 +17,19 @@ export default async function globalSetup() {
       awsAccessKeyId: string;
       awsSecretAccessKey: string;
       bucket: string;
+      garageAdminUrl?: string;
+      garageAdminToken?: string;
     };
     process.env.S3_TEST_ENDPOINT = cfg.awsEndpoint;
     process.env.S3_TEST_REGION = cfg.awsRegion;
     process.env.S3_TEST_ACCESS_KEY_ID = cfg.awsAccessKeyId;
     process.env.S3_TEST_SECRET_ACCESS_KEY = cfg.awsSecretAccessKey;
     process.env.S3_TEST_BUCKET = cfg.bucket;
+    if (cfg.garageAdminUrl) {
+      process.env.GARAGE_ADMIN_URL = cfg.garageAdminUrl;
+    }
+    if (cfg.garageAdminToken) {
+      process.env.GARAGE_ADMIN_TOKEN = cfg.garageAdminToken;
+    }
   }
 }
diff --git a/e2e/helpers.ts b/e2e/support/helpers.ts
similarity index 100%
rename from e2e/helpers.ts
rename to e2e/support/helpers.ts
diff --git a/e2e/mock-oidc-server.ts b/e2e/support/mock-oidc-server.ts
similarity index 100%
rename from e2e/mock-oidc-server.ts
rename to e2e/support/mock-oidc-server.ts
diff --git a/e2e/start-mock-oidc.ts b/e2e/support/start-mock-oidc.ts
similarity index 100%
rename from e2e/start-mock-oidc.ts
rename to e2e/support/start-mock-oidc.ts
diff --git a/e2e/start-mock-trino.ts b/e2e/support/start-mock-trino.ts
similarity index 100%
rename from e2e/start-mock-trino.ts
rename to e2e/support/start-mock-trino.ts
diff --git a/e2e/support/storage-upload-fixtures.ts b/e2e/support/storage-upload-fixtures.ts
new file mode 100644
index 00000000..22a51fb7
--- /dev/null
+++ b/e2e/support/storage-upload-fixtures.ts
@@ -0,0 +1,133 @@
+import { faker } from '@faker-js/faker';
+
+type UploadFixture = {
+  name: string;
+  mimeType: string;
+  buffer: Buffer;
+};
+
+export type TextUploadFixture = UploadFixture & {
+  expectedSnippet: string;
+  fullText: string;
+};
+
+export type CsvUploadFixture = UploadFixture & {
+  expectedCell: string;
+  csvText: string;
+};
+
+export type ImageUploadFixture = UploadFixture & {
+  title: string;
+};
+
+function seedFromText(input: string): number {
+  let hash = 0;
+  for (const char of input) {
+    hash = (hash * 31 + char.charCodeAt(0)) >>> 0;
+  }
+  return hash;
+}
+
+function slugify(value: string): string {
+  return value
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 48);
+}
+
+function escapeXml(value: string): string {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&apos;');
+}
+
+function seeded<T>(seedKey: string, factory: () => T): T {
+  faker.seed(seedFromText(seedKey));
+  return factory();
+}
+
+export function createTextUploadFixture(seedKey: string): TextUploadFixture {
+  return seeded(seedKey, () => {
+    const author = faker.person.fullName();
+    const project = faker.commerce.productName();
+    const summary = faker.company.catchPhrase();
+    const body = faker.lorem.paragraphs({ min: 2, max: 4 }, '\n\n');
+    const snippet = faker.lorem.sentence();
+    const fullText = [
+      `Author: ${author}`,
+      `Project: ${project}`,
+      `Summary: ${summary}`,
+      '',
+      snippet,
+      '',
+      body
+    ].join('\n');
+
+    return {
+      name: `${slugify(project)}-briefing.txt`,
+      mimeType: 'text/plain',
+      buffer: Buffer.from(fullText),
+      expectedSnippet: snippet,
+      fullText
+    };
+  });
+}
+
+export function createCsvUploadFixture(seedKey: string): CsvUploadFixture {
+  return seeded(seedKey, () => {
+    const rows = Array.from({ length: 5 }, () => ({
+      customer: faker.person.fullName(),
+      email: faker.internet.email(),
+      city: faker.location.city(),
+      spend: faker.finance.amount({ min: 120, max: 9500, dec: 2 })
+    }));
+
+    const header = 'customer,email,city,annual_spend';
+    const lines = rows.map((row) => `${row.customer},${row.email},${row.city},${row.spend}`);
+    const csvText = [header, ...lines].join('\n');
+
+    return {
+      name: `${slugify(faker.company.name())}-customers.csv`,
+      mimeType: 'text/csv',
+      buffer: Buffer.from(csvText),
+      expectedCell: rows[0].customer,
+      csvText
+    };
+  });
+}
+
+export function createImageUploadFixture(seedKey: string): ImageUploadFixture {
+  return seeded(seedKey, () => {
+    const title = faker.company.catchPhrase();
+    const accent = faker.color.rgb({ prefix: '#' });
+    const accentSoft = faker.color.rgb({ prefix: '#' });
+    const cardId = faker.string.alphanumeric({ casing: 'upper', length: 8 });
+    const owner = faker.person.fullName();
+    const svg = `
+<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="630" viewBox="0 0 1200 630">
+  <defs>
+    <linearGradient id="bg" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0%" stop-color="${accent}" />
+      <stop offset="100%" stop-color="${accentSoft}" />
+    </linearGradient>
+  </defs>
+  <rect width="1200" height="630" rx="40" fill="url(#bg)" />
+  <rect x="64" y="64" width="1072" height="502" rx="32" fill="rgba(255,255,255,0.12)" />
+  <text x="96" y="156" fill="#ffffff" font-family="Verdana, sans-serif" font-size="34">Release card ${escapeXml(cardId)}</text>
+  <text x="96" y="252" fill="#ffffff" font-family="Verdana, sans-serif" font-size="76" font-weight="700">${escapeXml(title)}</text>
+  <text x="96" y="330" fill="#f6f7fb" font-family="Verdana, sans-serif" font-size="30">Prepared by ${escapeXml(owner)}</text>
+  <text x="96" y="520" fill="#f6f7fb" font-family="Verdana, sans-serif" font-size="28">${escapeXml(faker.company.buzzPhrase())}</text>
+</svg>`.trim();
+
+    return {
+      name: `${slugify(title)}.svg`,
+      mimeType: 'image/svg+xml',
+      buffer: Buffer.from(svg),
+      title
+    };
+  });
+}
diff --git a/e2e/catalog-browser.spec.ts b/e2e/trino/catalog-browser.spec.ts
similarity index 99%
rename from e2e/catalog-browser.spec.ts
rename to e2e/trino/catalog-browser.spec.ts
index 73ba0a31..be0180ed 100644
--- a/e2e/catalog-browser.spec.ts
+++ b/e2e/trino/catalog-browser.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from '@playwright/test';
-import { waitForHydration, ensureCatalogBrowserOpen, setTabSql } from './helpers';
+import { waitForHydration, ensureCatalogBrowserOpen, setTabSql } from '../support/helpers';
 
 test.describe('Catalog browser', () => {
   test.use({ locale: 'en-US' });
diff --git a/e2e/connection-form.spec.ts b/e2e/trino/connection-form.spec.ts
similarity index 99%
rename from e2e/connection-form.spec.ts
rename to e2e/trino/connection-form.spec.ts
index 736579c3..3b66f2b7 100644
--- a/e2e/connection-form.spec.ts
+++ b/e2e/trino/connection-form.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from '@playwright/test';
-import { waitForHydration } from './helpers';
+import { waitForHydration } from '../support/helpers';
 
 /**
  * Tests for the Trino connection form.
diff --git a/e2e/trino-tabs.spec.ts b/e2e/trino/trino-tabs.spec.ts
similarity index 99%
rename from e2e/trino-tabs.spec.ts
rename to e2e/trino/trino-tabs.spec.ts
index 0dc2a6d1..1dd01b26 100644
--- a/e2e/trino-tabs.spec.ts
+++ b/e2e/trino/trino-tabs.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from '@playwright/test';
-import { waitForHydration, waitForQueryComplete, setTabState } from './helpers';
+import { waitForHydration, waitForQueryComplete, setTabState } from '../support/helpers';
 
 test.describe('Trino editor tabs', () => {
   test.use({ locale: 'en-US' });
diff --git a/e2e/trino.spec.ts b/e2e/trino/trino.spec.ts
similarity index 99%
rename from e2e/trino.spec.ts
rename to e2e/trino/trino.spec.ts
index b4a12fb9..4d5180db 100644
--- a/e2e/trino.spec.ts
+++ b/e2e/trino/trino.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from '@playwright/test';
-import { waitForHydration, waitForQueryComplete, setTabSql } from './helpers';
+import { waitForHydration, waitForQueryComplete, setTabSql } from '../support/helpers';
 
 test.describe('Trino query editor', () => {
   test.use({ locale: 'en-US' });
diff --git a/package-lock.json b/package-lock.json
index 8ff6cf77..b058c3dc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -27,6 +27,7 @@
         "@cyclonedx/cyclonedx-npm": "^4.2.1",
         "@eslint/compat": "^2.0.2",
         "@eslint/js": "^9.39.2",
+        "@faker-js/faker": "^10.4.0",
         "@iconify-json/gravity-ui": "^1.2.12",
         "@iconify-json/material-symbols": "^1.2.74",
         "@inlang/paraglide-js": "^2.12.0",
@@ -1490,6 +1491,23 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/@faker-js/faker": {
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-10.4.0.tgz",
+      "integrity": "sha512-sDBWI3yLy8EcDzgobvJTWq1MJYzAkQdpjXuPukga9wXonhpMRvd1Izuo2Qgwey2OiEoRIBr35RMU9HJRoOHzpw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fakerjs"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0",
+        "npm": ">=10"
+      }
+    },
     "node_modules/@hapi/hoek": {
       "version": "9.3.0",
       "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
diff --git a/package.json b/package.json
index 50e7d5ca..52472e59 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "@cyclonedx/cyclonedx-npm": "^4.2.1",
     "@eslint/compat": "^2.0.2",
     "@eslint/js": "^9.39.2",
+    "@faker-js/faker": "^10.4.0",
     "@iconify-json/gravity-ui": "^1.2.12",
     "@iconify-json/material-symbols": "^1.2.74",
     "@inlang/paraglide-js": "^2.12.0",
diff --git a/playwright.config.ts b/playwright.config.ts
index cd6ca402..e0b51c08 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -7,7 +7,7 @@ const chromiumExecutablePath = process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH;
 export default defineConfig({
   testDir: path.join(import.meta.dirname, 'e2e'),
   outputDir: path.join(import.meta.dirname, 'e2e/test-results'),
-  globalSetup: path.join(import.meta.dirname, 'e2e/global-setup.ts'),
+  globalSetup: path.join(import.meta.dirname, 'e2e/support/global-setup.ts'),
   timeout: 60_000,
   retries: 2,
   expect: {
@@ -20,12 +20,12 @@ export default defineConfig({
   },
   webServer: [
     {
-      command: 'npx tsx e2e/start-mock-oidc.ts',
+      command: 'npx tsx e2e/support/start-mock-oidc.ts',
       url: 'http://localhost:9090/.well-known/openid-configuration',
       reuseExistingServer: true
     },
     {
-      command: 'npx tsx e2e/start-mock-trino.ts',
+      command: 'npx tsx e2e/support/start-mock-trino.ts',
       url: 'http://localhost:8080',
       reuseExistingServer: true
     },

From b6ab288dc06030216c543c68baaeaaae55ee4a48 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 1 Jun 2026 14:05:36 +0200
Subject: [PATCH 043/136] #93 fix non translated error message, #89 remove
 unnecessary key handler

---
 messages/de.json                              |  2 ++
 messages/en.json                              |  2 ++
 .../storage/explorer/FileExplorer.svelte      | 23 ++++++++++++-------
 src/lib/storage/state.svelte.ts               |  4 ++--
 4 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 39adb206..e6e2d1a8 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -178,6 +178,8 @@
   "storage_paste_plural": "{count} Elemente einfügen",
   "storage_selected": "{count} ausgewählt",
   "storage_action_preview": "Vorschau",
+  "storage_action_preview_no_selection": "Keine Datei für die Vorschau ausgewählt.",
+  "storage_action_download_no_selection": "Keine Datei für den Download ausgewählt.",
   "storage_action_rename": "Umbenennen",
   "storage_action_download": "Herunterladen",
   "storage_action_cut": "Ausschneiden",
diff --git a/messages/en.json b/messages/en.json
index 7d877c82..d088c75a 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -178,6 +178,8 @@
   "storage_paste_plural": "Paste {count} items",
   "storage_selected": "{count} selected",
   "storage_action_preview": "Preview",
+  "storage_action_preview_no_selection": "No file selected for preview.",
+  "storage_action_download_no_selection": "No file selected for download.",
   "storage_action_rename": "Rename",
   "storage_action_download": "Download",
   "storage_action_cut": "Cut",
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index b9da50f1..615cf043 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -17,6 +17,20 @@
     const p = storage.prefix;
     if (b) untrack(() => storage.bookmarks.recordLocationVisit(b, p));
   });
+
+  // Clicking anywhere inside the object-list container that is not a table row
+  // clears the current selection. Keyboard users already have Escape via the
+  // svelte:window handler below, so no key handler is needed here.
+  let objectListEl: HTMLDivElement;
+  $effect(() => {
+    function handleClick(e: MouseEvent) {
+      if (objectListEl.contains(e.target as Node) && !(e.target as HTMLElement).closest('tr')) {
+        storage.clearSelection();
+      }
+    }
+    document.addEventListener('click', handleClick);
+    return () => document.removeEventListener('click', handleClick);
+  });
 </script>
 
 <svelte:window onkeydown={storage.handleKeydown} />
@@ -24,14 +38,7 @@
 <div class="bg-base-100 flex flex-1 flex-col overflow-hidden">
   <StorageBreadcrumb />
 
-  <!-- svelte-ignore a11y_click_events_have_key_events -->
-  <!-- svelte-ignore a11y_no_static_element_interactions -->
-  <div
-    class="relative min-h-0 flex-1 overflow-hidden"
-    onclick={(e) => {
-      if (!(e.target as HTMLElement).closest('tr')) storage.clearSelection();
-    }}
-  >
+  <div bind:this={objectListEl} class="relative min-h-0 flex-1 overflow-hidden">
     {#if storage.loading || storage.deleting || navigating.to}
       <div
         class="bg-base-100/70 absolute inset-0 z-20 flex items-center justify-center"
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index c9955a11..89597e33 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -245,7 +245,7 @@ export class StorageState {
 
       case 'preview':
         if (!key) {
-          addToast('warning', 'No file selected for preview');
+          addToast('warning', m.storage_action_preview_no_selection());
           return;
         }
         for (const f of effectiveSelectedFiles) {
@@ -256,7 +256,7 @@ export class StorageState {
 
       case 'download':
         if (!key) {
-          addToast('warning', 'No file selected for download');
+          addToast('warning', m.storage_action_download_no_selection());
           return;
         }
         for (const f of effectiveSelectedFiles) {

From d3aecd65c892379329b3e67b50c872c3158f4cc0 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 2 Jun 2026 08:33:21 +0200
Subject: [PATCH 044/136] Feat/add component tests (#170)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* #135 add garage instance to GitHub workflow for e2e tests

* #135 fix yaml lint

* #135 fix docker command in action

* #135 fix docker options in action

* #135 fix yaml format

* #135 refactor GitHub action for s3 deployment with code fixes

* #135 fix missing entrypoint in container

* #135 remove format use on s3 creation

* #135 add e2e tests that require a bucket

* #135 allow local starting of s3 e2e tests, fix lint

* #135 fix lint

* #135 move garage.toml to permanent repository

* #135 create keys and bucket via curl

* #135 fix lint

* #135 fix lint

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* #135 add e2e tests for s3 file browser

* fix: Deployment issues with Helm (#152)

* fix deployment issues with Helm

* allow configuring origin and proxy in helm chart

* refactor values.yaml & use secretKeyRefs instead of clear-text secrets

* #135 add coverage report in markdown

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* #135 fix lint

* Implement Garage S3 deployment and configuration for E2E testing

* chore: update deprecated actions (#165)

* #135 fix lint

* test: add component tests

* tests: fix linting errors and improve coverage

* #135 refactor e2e directory structure, split storage test file into smaller files

* #135 fix lint

* #135 fix lint

* #135 fix missing admin token in s3 config for tests

* tests: increase coverage in unit tests for storage feature

* fix: use prod only dependencies for SBOM generation (#176)

* fix unit test error

* add unit test step

* add playwright install

* fix warnings and errors in tests

* add sync step before running tests

* remove e2e_coverage.md

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>
---
 .github/workflows/pr_checks.yaml              |  48 +-
 .gitignore                                    |   4 +
 .pre-commit-config.yaml                       |   7 +-
 .prettierignore                               |   3 +
 deploy/helm/stackable-ui/README.md            |  40 +-
 deploy/helm/stackable-ui/templates/NOTES.txt  |  31 -
 .../helm/stackable-ui/templates/_helpers.tpl  |   5 +-
 .../stackable-ui/templates/configmap.yaml     |  21 +-
 .../stackable-ui/templates/deployment.yaml    |  54 +-
 .../helm/stackable-ui/templates/secret.yaml   |   6 +-
 deploy/helm/stackable-ui/values.yaml          |  77 ++-
 dev/helm/values.yaml                          |  22 +
 dev/setup.sh                                  |  13 +-
 docker/Dockerfile                             |  32 +-
 package-lock.json                             | 195 ++++++
 package.json                                  |   1 +
 src/lib/components/catalog/CatalogTree.svelte |   1 +
 .../layout/header/ThemeToggle.svelte.spec.ts  |  23 +-
 .../explorer/ContextMenu.svelte.spec.ts       | 239 +++++++
 .../explorer/FileExplorer.svelte.spec.ts      | 186 ++++++
 .../storage/explorer/FileRow.svelte.spec.ts   | 284 ++++++++
 .../storage/explorer/FolderRow.svelte.spec.ts | 209 ++++++
 .../explorer/ObjectTable.svelte.spec.ts       | 170 +++++
 .../explorer/SelectionToolbar.svelte.spec.ts  | 150 +++++
 .../explorer/StorageBreadcrumb.svelte.spec.ts | 458 +++++++++++++
 .../__tests__/ContextMenuWrapper.svelte       |  15 +
 .../explorer/__tests__/ContextWrapper.svelte  |  16 +
 .../__tests__/FileExplorerWrapper.svelte      |  15 +
 .../explorer/__tests__/FileRowWrapper.svelte  |  21 +
 .../__tests__/FolderRowWrapper.svelte         |  21 +
 .../__tests__/ObjectTableWrapper.svelte       |  15 +
 .../__tests__/SelectionToolbarWrapper.svelte  |  19 +
 .../__tests__/StorageBreadcrumbWrapper.svelte |  15 +
 .../storage/landing/BucketGrid.svelte.spec.ts |  85 +++
 .../landing/RecentItems.svelte.spec.ts        | 231 +++++++
 .../storage/landing/StorageConnectForm.svelte |  21 +-
 .../landing/StorageConnectForm.svelte.spec.ts | 507 +++++++++++++++
 .../__tests__/RecentItemsWrapper.svelte       |  15 +
 .../modals/DeleteConfirmModal.svelte.spec.ts  | 163 +++++
 .../modals/PreviewModal.svelte.spec.ts        | 615 ++++++++++++++++++
 .../modals/StorageModals.svelte.spec.ts       | 139 ++++
 .../modals/preview/CsvPreview.svelte.spec.ts  | 102 +++
 .../preview/FallbackPreview.svelte.spec.ts    |  67 ++
 .../preview/ImagePreview.svelte.spec.ts       |  58 ++
 .../modals/preview/PdfPreview.svelte.spec.ts  |  44 ++
 .../modals/preview/TextPreview.svelte.spec.ts | 117 ++++
 .../upload/UploadConflictEntry.svelte.spec.ts | 284 ++++++++
 .../upload/UploadDropzone.svelte.spec.ts      | 389 +++++++++++
 .../upload/UploadEntryStatus.svelte.spec.ts   | 148 +++++
 .../modals/upload/UploadModal.svelte.spec.ts  | 590 +++++++++++++++++
 .../shared/TimestampDisplay.svelte.spec.ts    | 141 ++++
 .../storage/sidebar/BucketList.svelte.spec.ts | 344 ++++++++++
 .../__tests__/BucketListWrapper.svelte        |  15 +
 .../sidebar/__tests__/page-helper.svelte.ts   |  34 +
 src/lib/server/storage/factory.test.ts        |  36 +
 src/lib/server/storage/hdfs-provider.test.ts  |  99 +++
 src/lib/server/storage/preview/binary.test.ts |  33 +
 src/lib/server/storage/preview/stream.test.ts |  69 ++
 src/lib/server/storage/s3-client.test.ts      |  64 ++
 src/lib/server/storage/s3-errors.test.ts      |  65 ++
 src/lib/server/storage/s3-provider.test.ts    | 511 +++++++++++++++
 src/lib/server/storage/service.test.ts        | 261 ++++++++
 .../server/storage/user-connections.test.ts   |  67 ++
 src/lib/server/storage/utils.test.ts          |  42 ++
 src/routes/(app)/page.svelte.spec.ts          |  24 +
 src/routes/(app)/storage/+layout.svelte       |  12 +-
 .../[bucket]/[...prefix]/page.server.test.ts  |  62 ++
 .../(app)/storage/api/delete/server.test.ts   |  56 ++
 .../(app)/storage/api/download/server.test.ts |  73 +++
 src/routes/(app)/storage/api/params.test.ts   |  48 ++
 .../(app)/storage/api/preview/server.test.ts  |  98 +++
 .../(app)/storage/api/upload/server.test.ts   |  78 +++
 .../(app)/storage/layout.server.test.ts       |  69 ++
 src/routes/(app)/storage/page.server.test.ts  | 146 +++++
 src/routes/(app)/trino/+page.svelte           |  61 +-
 vite.config.ts                                |   5 +
 76 files changed, 8357 insertions(+), 147 deletions(-)
 delete mode 100644 deploy/helm/stackable-ui/templates/NOTES.txt
 create mode 100644 dev/helm/values.yaml
 create mode 100644 src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts
 create mode 100644 src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts
 create mode 100644 src/lib/components/storage/explorer/FileRow.svelte.spec.ts
 create mode 100644 src/lib/components/storage/explorer/FolderRow.svelte.spec.ts
 create mode 100644 src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts
 create mode 100644 src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts
 create mode 100644 src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
 create mode 100644 src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/ContextWrapper.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/FileRowWrapper.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/FolderRowWrapper.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/ObjectTableWrapper.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/SelectionToolbarWrapper.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
 create mode 100644 src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
 create mode 100644 src/lib/components/storage/landing/RecentItems.svelte.spec.ts
 create mode 100644 src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
 create mode 100644 src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte
 create mode 100644 src/lib/components/storage/modals/DeleteConfirmModal.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/StorageModals.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/preview/ImagePreview.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/preview/TextPreview.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/upload/UploadEntryStatus.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
 create mode 100644 src/lib/components/storage/shared/TimestampDisplay.svelte.spec.ts
 create mode 100644 src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
 create mode 100644 src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte
 create mode 100644 src/lib/components/storage/sidebar/__tests__/page-helper.svelte.ts
 create mode 100644 src/lib/server/storage/factory.test.ts
 create mode 100644 src/lib/server/storage/hdfs-provider.test.ts
 create mode 100644 src/lib/server/storage/preview/binary.test.ts
 create mode 100644 src/lib/server/storage/preview/stream.test.ts
 create mode 100644 src/lib/server/storage/s3-client.test.ts
 create mode 100644 src/lib/server/storage/s3-errors.test.ts
 create mode 100644 src/lib/server/storage/s3-provider.test.ts
 create mode 100644 src/lib/server/storage/service.test.ts
 create mode 100644 src/lib/server/storage/user-connections.test.ts
 create mode 100644 src/lib/server/storage/utils.test.ts
 create mode 100644 src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
 create mode 100644 src/routes/(app)/storage/api/delete/server.test.ts
 create mode 100644 src/routes/(app)/storage/api/download/server.test.ts
 create mode 100644 src/routes/(app)/storage/api/params.test.ts
 create mode 100644 src/routes/(app)/storage/api/preview/server.test.ts
 create mode 100644 src/routes/(app)/storage/api/upload/server.test.ts
 create mode 100644 src/routes/(app)/storage/layout.server.test.ts
 create mode 100644 src/routes/(app)/storage/page.server.test.ts

diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index 96f59ad5..14a448ab 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -42,10 +42,54 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
       - name: Install Helm
-        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+
+      - name: Setup Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.12'
+
+      - name: Cache pre-commit
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ env.pythonLocation }}-${{ hashFiles('.pre-commit-config.yaml') }}
+
+      - name: Install pre-commit
+        run: python -m pip install pre-commit
 
       - name: Run pre-commit
-        uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+        run: pre-commit run --all-files --show-diff-on-failure --color=always
+
+  unit-tests:
+    name: Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
+        with:
+          node-version-file: '.node-version'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium
+
+      - name: Compile Paraglide messages
+        run: npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide
+
+      - name: Sync SvelteKit
+        run: npx svelte-kit sync
+
+      - name: Run unit tests
+        run: npm run test:unit
 
   e2e-with-garage:
     name: E2E Tests with Garage S3
diff --git a/.gitignore b/.gitignore
index 19a911ca..871677f2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,6 +33,10 @@ dist/
 .claude/settings.local.json
 .claude/CLAUDE.local.md
 
+# Vitest coverage reports
+coverage/
+coverage/*
+
 # Playwright
 e2e/test-results
 e2e/.auth
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 5390f3ab..c2dd1aab 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -72,7 +72,12 @@ repos:
       - id: helm-template
         name: helm template
         language: system
-        entry: bash -c 'helm template test deploy/helm/stackable-ui > /dev/null'
+        entry: >-
+          bash -c '
+          helm template test deploy/helm/stackable-ui
+          --set auth.oidc.discoveryUrl=https://stub
+          --set auth.oidc.clientId=stub
+          --set auth.oidc.clientSecret.secretKeyRef.name=stub > /dev/null'
         stages: [pre-commit, pre-merge-commit]
         pass_filenames: false
         files: ^deploy/helm/
diff --git a/.prettierignore b/.prettierignore
index f15b4ea9..6dbc7f7c 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -24,6 +24,9 @@ project.inlang/
 .parcel-cache/
 node_modules/
 
+# Vitest Coverage reports
+coverage/
+
 # Database migrations
 /drizzle/
 
diff --git a/deploy/helm/stackable-ui/README.md b/deploy/helm/stackable-ui/README.md
index e38bc5a4..156e3761 100644
--- a/deploy/helm/stackable-ui/README.md
+++ b/deploy/helm/stackable-ui/README.md
@@ -70,17 +70,55 @@ The following table lists the configurable parameters of the Stackable UI chart
 | `ingress.hosts` | Ingress hosts configuration | See values.yaml |
 | `ingress.tls` | Ingress TLS configuration | `[]` |
 
+### Reverse Proxy Parameters
+
+| Parameter | Description | Default |
+| --- | --- | --- |
+| `origin` | Public origin for SvelteKit CSRF check. Leave empty when relying on forwarded headers. | `http://localhost:3000` |
+| `proxy.protocolHeader` | Trusted forwarded protocol header (e.g. `x-forwarded-proto`). | `""` |
+| `proxy.hostHeader` | Trusted forwarded host header (e.g. `x-forwarded-host`). | `""` |
+
 ### Application Configuration
 
 | Parameter | Description | Default |
 | --- | --- | --- |
 | `config.nodeEnv` | Node.js environment | `production` |
 
+### Authentication Parameters
+
+OIDC is the only supported auth mechanism. Disable for local testing.
+
+| Parameter | Description | Default |
+| --- | --- | --- |
+| `auth.baseUrl` | Publicly accessible base URL of the app (used for OIDC callbacks). | `http://localhost:3000` |
+| `auth.oidc.enabled` | Enable OIDC authentication. Disable to deploy without auth. | `true` |
+| `auth.oidc.discoveryUrl` | OIDC `.well-known/openid-configuration` URL. Required when enabled. | `""` |
+| `auth.oidc.clientId` | OIDC client ID. Required when enabled. | `""` |
+| `auth.oidc.clientSecret.secretKeyRef.name` | Name of the Secret holding the OIDC client secret. Required when enabled. | `""` |
+| `auth.oidc.clientSecret.secretKeyRef.key` | Key inside the Secret. | `oidc-client-secret` |
+| `auth.oidc.usernameClaim` | OIDC claim used as the username for Trino impersonation. | `preferred_username` |
+
+### Trino Connection Parameters
+
+Optional pre-configured Trino endpoint. When `trino.url` is set, the in-app connection form is hidden.
+
+| Parameter | Description | Default |
+| --- | --- | --- |
+| `trino.url` | Trino coordinator URL. | `""` |
+| `trino.auth.type` | `"none"` or `"basic"`. | `""` |
+| `trino.auth.username` | Username for basic auth. | `""` |
+| `trino.auth.password.secretKeyRef.name` | Name of the Secret holding the Trino password. Required when `type=basic`. | `""` |
+| `trino.auth.password.secretKeyRef.key` | Key inside the Secret. | `trino-auth-password` |
+| `trino.tls.insecure` | Skip TLS certificate verification. | `false` |
+| `trino.tls.caCert` | Path to a custom CA certificate file. | `""` |
+| `trino.tls.secretClass` | Stackable SecretClass that provides the Trino CA certificate. | `""` |
+
 ### Security Parameters
 
 | Parameter | Description | Default |
 | --- | --- | --- |
-| `sessionSecret` | Session secret for signing cookies | `""` (auto-generated) |
+| `sessionSecret.secretKeyRef.name` | Name of a Secret holding a stable session secret. Auto-generated if empty. | `""` |
+| `sessionSecret.secretKeyRef.key` | Key inside the Secret. | `session-secret` |
 | `podSecurityContext` | Pod security context | See values.yaml |
 | `securityContext` | Container security context | See values.yaml |
 
diff --git a/deploy/helm/stackable-ui/templates/NOTES.txt b/deploy/helm/stackable-ui/templates/NOTES.txt
deleted file mode 100644
index e3366ce4..00000000
--- a/deploy/helm/stackable-ui/templates/NOTES.txt
+++ /dev/null
@@ -1,31 +0,0 @@
-Thank you for installing {{ .Chart.Name }}!
-
-Your release is named {{ .Release.Name }}.
-
-To access the Stackable UI:
-
-{{- if .Values.ingress.enabled }}
-{{- range $host := .Values.ingress.hosts }}
-  {{- range .paths }}
-  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
-  {{- end }}
-{{- end }}
-{{- else if contains "NodePort" .Values.service.type }}
-  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "stackable-ui.fullname" . }})
-  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
-  echo http://$NODE_IP:$NODE_PORT
-{{- else if contains "LoadBalancer" .Values.service.type }}
-     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
-           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "stackable-ui.fullname" . }}'
-  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "stackable-ui.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
-  echo http://$SERVICE_IP:{{ .Values.service.port }}
-{{- else if contains "ClusterIP" .Values.service.type }}
-  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "stackable-ui.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
-  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
-  echo "Visit http://127.0.0.1:8080 to use your application"
-  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
-{{- end }}
-
-For more information about the Stackable Unified Data Platform UI, visit:
-  https://docs.stackable.tech/
-  https://github.com/stackabletech/stackable-ui
diff --git a/deploy/helm/stackable-ui/templates/_helpers.tpl b/deploy/helm/stackable-ui/templates/_helpers.tpl
index 5c8cbd02..03935687 100644
--- a/deploy/helm/stackable-ui/templates/_helpers.tpl
+++ b/deploy/helm/stackable-ui/templates/_helpers.tpl
@@ -64,8 +64,9 @@ Create the name of the service account to use
 {{- end }}
 
 {{- define "stackable-ui.sessionSecret" -}}
-{{- if .Values.sessionSecret }}
-{{- .Values.sessionSecret }}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace (include "stackable-ui.fullname" .) }}
+{{- if and $existing $existing.data (index $existing.data "session-secret") }}
+{{- index $existing.data "session-secret" | b64dec }}
 {{- else }}
 {{- $existing := lookup "v1" "Secret" .Release.Namespace (include "stackable-ui.fullname" .) }}
 {{- if and $existing $existing.data (index $existing.data "session-secret") }}
diff --git a/deploy/helm/stackable-ui/templates/configmap.yaml b/deploy/helm/stackable-ui/templates/configmap.yaml
index 47970e31..678733a2 100644
--- a/deploy/helm/stackable-ui/templates/configmap.yaml
+++ b/deploy/helm/stackable-ui/templates/configmap.yaml
@@ -5,15 +5,20 @@ metadata:
   labels:
     {{- include "stackable-ui.labels" . | nindent 4 }}
 data:
-  oidc-discovery-url: {{ .Values.auth.discoveryUrl | quote }}
-  oidc-client-id: {{ .Values.auth.clientId | quote }}
   base-url: {{ .Values.auth.baseUrl | quote }}
-  {{- if .Values.trino.url }}
-  trino-url: {{ .Values.trino.url | quote }}
+  {{- with .Values.origin }}
+  origin: {{ . | quote }}
   {{- end }}
-  {{- if .Values.trino.authType }}
-  trino-auth-type: {{ .Values.trino.authType | quote }}
+  {{- if .Values.auth.oidc.enabled }}
+  oidc-discovery-url: {{ required "auth.oidc.discoveryUrl is required when OIDC is enabled" .Values.auth.oidc.discoveryUrl | quote }}
+  oidc-client-id: {{ required "auth.oidc.clientId is required when OIDC is enabled" .Values.auth.oidc.clientId | quote }}
   {{- end }}
-  {{- if .Values.trino.authUsername }}
-  trino-auth-username: {{ .Values.trino.authUsername | quote }}
+  {{- with .Values.trino.url }}
+  trino-url: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.trino.auth.type }}
+  trino-auth-type: {{ . | quote }}
+  {{- end }}
+  {{- with .Values.trino.auth.username }}
+  trino-auth-username: {{ . | quote }}
   {{- end }}
diff --git a/deploy/helm/stackable-ui/templates/deployment.yaml b/deploy/helm/stackable-ui/templates/deployment.yaml
index 49c04bbe..f0c62ef8 100644
--- a/deploy/helm/stackable-ui/templates/deployment.yaml
+++ b/deploy/helm/stackable-ui/templates/deployment.yaml
@@ -67,18 +67,41 @@ spec:
             - name: STACKABLE_UI_SESSION_SECRET
               valueFrom:
                 secretKeyRef:
+                  {{- if .Values.sessionSecret.secretKeyRef.name }}
+                  name: {{ .Values.sessionSecret.secretKeyRef.name | quote }}
+                  key: {{ .Values.sessionSecret.secretKeyRef.key | quote }}
+                  {{- else }}
                   name: {{ include "stackable-ui.fullname" . }}
                   key: session-secret
+                  {{- end }}
+            {{- if .Values.auth.oidc.enabled }}
             - name: STACKABLE_UI_OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
-                  key: oidc-client-secret
+                  name: {{ required "auth.oidc.clientSecret.secretKeyRef.name is required when OIDC is enabled" .Values.auth.oidc.clientSecret.secretKeyRef.name | quote }}
+                  key: {{ .Values.auth.oidc.clientSecret.secretKeyRef.key | quote }}
+            {{- end }}
             - name: STACKABLE_UI_BASE_URL
               valueFrom:
                 configMapKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: base-url
+            {{- if .Values.origin }}
+            - name: ORIGIN
+              valueFrom:
+                configMapKeyRef:
+                  name: {{ include "stackable-ui.fullname" . }}
+                  key: origin
+            {{- end }}
+            {{- with .Values.proxy.protocolHeader }}
+            - name: PROTOCOL_HEADER
+              value: {{ . | quote }}
+            {{- end }}
+            {{- with .Values.proxy.hostHeader }}
+            - name: HOST_HEADER
+              value: {{ . | quote }}
+            {{- end }}
+            {{- if .Values.auth.oidc.enabled }}
             - name: STACKABLE_UI_OIDC_DISCOVERY_URL
               valueFrom:
                 configMapKeyRef:
@@ -89,9 +112,8 @@ spec:
                 configMapKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: oidc-client-id
-            {{- if .Values.auth.usernameClaim }}
             - name: STACKABLE_UI_OIDC_USERNAME_CLAIM
-              value: {{ .Values.auth.usernameClaim | quote }}
+              value: {{ .Values.auth.oidc.usernameClaim | quote }}
             {{- end }}
             {{- if .Values.trino.url }}
             - name: STACKABLE_UI_TRINO_URL
@@ -100,42 +122,42 @@ spec:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: trino-url
             {{- end }}
-            {{- if .Values.trino.authType }}
+            {{- if .Values.trino.auth.type }}
             - name: STACKABLE_UI_TRINO_AUTH_TYPE
               valueFrom:
                 configMapKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: trino-auth-type
             {{- end }}
-            {{- if .Values.trino.authUsername }}
+            {{- if .Values.trino.auth.username }}
             - name: STACKABLE_UI_TRINO_AUTH_USERNAME
               valueFrom:
                 configMapKeyRef:
                   name: {{ include "stackable-ui.fullname" . }}
                   key: trino-auth-username
             {{- end }}
-            {{- if .Values.trino.authPassword }}
+            {{- if eq .Values.trino.auth.type "basic" }}
             - name: STACKABLE_UI_TRINO_AUTH_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
-                  key: trino-auth-password
+                  name: {{ required "trino.auth.password.secretKeyRef.name is required for basic auth" .Values.trino.auth.password.secretKeyRef.name | quote }}
+                  key: {{ .Values.trino.auth.password.secretKeyRef.key | quote }}
             {{- end }}
-            {{- if .Values.trino.tlsInsecure }}
+            {{- if .Values.trino.tls.insecure }}
             - name: STACKABLE_UI_TRINO_TLS_INSECURE
               value: "true"
             {{- end }}
-            {{- if .Values.trino.tlsCaCert }}
+            {{- if .Values.trino.tls.caCert }}
             - name: STACKABLE_UI_TRINO_TLS_CA_CERT
-              value: {{ .Values.trino.tlsCaCert | quote }}
-            {{- else if .Values.trino.tlsSecretClass }}
+              value: {{ .Values.trino.tls.caCert | quote }}
+            {{- else if .Values.trino.tls.secretClass }}
             - name: STACKABLE_UI_TRINO_TLS_CA_CERT
               value: /stackable/trino-tls/ca.crt
             {{- end }}
           volumeMounts:
             - name: tmp
               mountPath: /tmp
-            {{- if .Values.trino.tlsSecretClass }}
+            {{- if .Values.trino.tls.secretClass }}
             - name: trino-tls
               mountPath: /stackable/trino-tls
               readOnly: true
@@ -143,13 +165,13 @@ spec:
       volumes:
         - name: tmp
           emptyDir: {}
-        {{- if .Values.trino.tlsSecretClass }}
+        {{- if .Values.trino.tls.secretClass }}
         - name: trino-tls
           ephemeral:
             volumeClaimTemplate:
               metadata:
                 annotations:
-                  secrets.stackable.tech/class: {{ .Values.trino.tlsSecretClass | quote }}
+                  secrets.stackable.tech/class: {{ .Values.trino.tls.secretClass | quote }}
                   secrets.stackable.tech/scope: pod
               spec:
                 storageClassName: secrets.stackable.tech
diff --git a/deploy/helm/stackable-ui/templates/secret.yaml b/deploy/helm/stackable-ui/templates/secret.yaml
index 1b60f975..73a7b4e6 100644
--- a/deploy/helm/stackable-ui/templates/secret.yaml
+++ b/deploy/helm/stackable-ui/templates/secret.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.sessionSecret.secretKeyRef.name }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -7,7 +8,4 @@ metadata:
 type: Opaque
 stringData:
   session-secret: {{ include "stackable-ui.sessionSecret" . | quote }}
-  oidc-client-secret: {{ .Values.auth.clientSecret | quote }}
-  {{- if .Values.trino.authPassword }}
-  trino-auth-password: {{ .Values.trino.authPassword | quote }}
-  {{- end }}
+{{- end }}
diff --git a/deploy/helm/stackable-ui/values.yaml b/deploy/helm/stackable-ui/values.yaml
index c0678984..2632791a 100644
--- a/deploy/helm/stackable-ui/values.yaml
+++ b/deploy/helm/stackable-ui/values.yaml
@@ -122,25 +122,39 @@ config:
   # Node.js environment
   nodeEnv: production
 
-# Session secret for signing cookies (auto-generated if not provided)
-sessionSecret: ""
+# Session secret for signing cookies. Chart auto-generates one if secretKeyRef.name is empty.
+sessionSecret:
+  secretKeyRef:
+    name: ""
+    key: session-secret
 
-# OIDC authentication configuration
+# SvelteKit CSRF origin
+origin: "http://localhost:3000"
+
+# Forwarded-header trust (set when behind a proxy/ingress/gateway/mesh)
+proxy: {}
+  # protocolHeader: x-forwarded-proto
+  # hostHeader: x-forwarded-host
+
+# Authentication configuration
 auth:
-  # The publicly accessible base URL of this application (used for OIDC callback URLs)
-  # Required. Example: https://stackable-ui.example.com
-  baseUrl: ""
-  # OIDC discovery URL (the full .well-known/openid-configuration URL)
-  # Required. Example: https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
-  discoveryUrl: ""
-  # Client ID registered in the OIDC provider
-  # Required.
-  clientId: ""
-  # Client secret registered in the OIDC provider
-  # Required.
-  clientSecret: ""
-  # OIDC claim used as the username for Trino impersonation (default: preferred_username)
-  usernameClaim: ""
+  # Publicly accessible base URL (used for OIDC callback URLs)
+  baseUrl: "http://localhost:3000"
+  oidc:
+    # Disable to deploy without authentication (e.g. local testing).
+    enabled: true
+    # OIDC discovery URL (the full .well-known/openid-configuration URL)
+    # Required when enabled. Example: https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
+    discoveryUrl: ""
+    # Client ID registered in the OIDC provider. Required when enabled.
+    clientId: ""
+    # Required when enabled.
+    clientSecret:
+      secretKeyRef:
+        name: ""
+        key: oidc-client-secret
+    # OIDC claim used as the username for Trino impersonation.
+    usernameClaim: preferred_username
 
 # Optional: Pre-configure the Trino connection for all users.
 # When trino.url is set, the connection form is hidden and the specified
@@ -148,15 +162,20 @@ auth:
 trino:
   # Trino coordinator URL (e.g. https://trino.example.com:8443)
   url: ""
-  # Authentication type: "none" or "basic"
-  authType: ""
-  # Credentials for basic auth
-  authUsername: ""
-  authPassword: ""
-  # TLS certificate verification
-  tlsInsecure: false
-  # Path to a custom CA certificate file (mounted via extraVolumes)
-  tlsCaCert: ""
-  # Stackable SecretClass name for provisioning the Trino CA certificate.
-  # The Secret Operator mounts ca.crt into /stackable/trino-tls.
-  tlsSecretClass: ""
+  auth:
+    # Authentication type: "none" or "basic"
+    type: ""
+    username: ""
+    # Required when type is "basic".
+    password:
+      secretKeyRef:
+        name: ""
+        key: trino-auth-password
+  tls:
+    # Skip TLS certificate verification
+    insecure: false
+    # Path to a custom CA certificate file (mounted via extraVolumes)
+    caCert: ""
+    # Stackable SecretClass name for provisioning the Trino CA certificate.
+    # The Secret Operator mounts ca.crt into /stackable/trino-tls.
+    secretClass: ""
diff --git a/dev/helm/values.yaml b/dev/helm/values.yaml
new file mode 100644
index 00000000..7483ed8a
--- /dev/null
+++ b/dev/helm/values.yaml
@@ -0,0 +1,22 @@
+---
+auth:
+  baseUrl: 'http://localhost:3000'
+  oidc:
+    discoveryUrl: 'http://172.18.0.2:30080/realms/stackable/.well-known/openid-configuration'
+    clientId: 'stackable-ui'
+    clientSecret:
+      secretKeyRef:
+        name: stackable-ui-credentials
+        key: oidc-client-secret
+
+trino:
+  url: 'https://trino-coordinator-default-headless:8443'
+  auth:
+    type: 'basic'
+    username: 'stackable-ui'
+    password:
+      secretKeyRef:
+        name: stackable-ui-credentials
+        key: trino-auth-password
+  tls:
+    insecure: true
diff --git a/dev/setup.sh b/dev/setup.sh
index 6ecd476e..cc3ac9ba 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -283,14 +283,23 @@ STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
 STACKABLE_UI_BASE_URL=http://localhost:5173
 STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
 PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
-
 EOF
 fi
 
 echo "Wrote $ENV_FILE"
 
 # ------------------------------------------------------------------
-# 9. Wait for Trino to be ready
+# 9. Create Kubernetes Secret for the Helm chart
+# ------------------------------------------------------------------
+echo ""
+echo "Creating stackable-ui-credentials Secret..."
+kubectl delete secret stackable-ui-credentials --ignore-not-found
+kubectl create secret generic stackable-ui-credentials \
+  --from-literal=oidc-client-secret="$SECRET" \
+  --from-literal=trino-auth-password=stackable-ui-dev
+
+# ------------------------------------------------------------------
+# 10. Wait for Trino to be ready
 # ------------------------------------------------------------------
 if [[ "$SKIP_TRINO" == false ]]; then
   echo ""
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 59690a7b..bcd92b3b 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -34,7 +34,7 @@ RUN NODEJS_VERSION=$(cat /tmp/.node-version) && \
         | tar -xzf - --strip-components=1 -C /usr/local
 
 #
-# Build stage - compiles the SvelteKit application
+# Build stage - compiles the SvelteKit application with full dependencies
 #
 FROM base AS builder
 
@@ -63,12 +63,28 @@ COPY svelte.config.js tsconfig.json vite.config.ts ./
 # builder stage.
 RUN STACKABLE_UI_SESSION_SECRET="build-time-placeholder" \
     STACKABLE_UI_BASE_URL="http://localhost:3000" \
-    npm run build && \
-    npx @cyclonedx/cyclonedx-npm --omit dev --output-file /build/stackable-ui.cdx.json
+    npm run build
+
+#
+# Production dependencies stage - clean prod-only install
+#
+FROM base AS prod-deps
+
+WORKDIR /build
+
+COPY package.json package-lock.json .npmrc ./
 
 # Install only production dependencies; --ignore-scripts skips the prepare script
 # (which would fail because antlr-ng is a devDependency and not available here)
-RUN --mount=type=cache,target=/root/.npm npm ci --omit dev --ignore-scripts
+RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev --ignore-scripts
+
+#
+# SBOM stage - generate CycloneDX from the clean prod-only dependency tree
+#
+FROM prod-deps AS sbom
+
+RUN npm ls --omit=dev && \
+    npx @cyclonedx/cyclonedx-npm --omit dev --output-file /build/stackable-ui.cdx.json
 
 #
 # Production stage - minimal runtime image
@@ -99,10 +115,10 @@ RUN microdnf install -y shadow-utils && \
 WORKDIR /stackable/app
 
 # Copy built application from builder stage
-COPY --from=builder --chown=${STACKABLE_USER_UID}:0 /build/build ./build
-COPY --from=builder --chown=${STACKABLE_USER_UID}:0 /build/node_modules ./node_modules
-COPY --from=builder --chown=${STACKABLE_USER_UID}:0 /build/package.json ./
-COPY --from=builder --chown=${STACKABLE_USER_UID}:0 /build/stackable-ui.cdx.json ./stackable-ui.cdx.json
+COPY --from=builder   --chown=${STACKABLE_USER_UID}:0 /build/build ./build
+COPY --from=prod-deps --chown=${STACKABLE_USER_UID}:0 /build/node_modules ./node_modules
+COPY --from=prod-deps --chown=${STACKABLE_USER_UID}:0 /build/package.json ./
+COPY --from=sbom      --chown=${STACKABLE_USER_UID}:0 /build/stackable-ui.cdx.json ./stackable-ui.cdx.json
 COPY --chown=${STACKABLE_USER_UID}:0 LICENSE /licenses/LICENSE
 RUN chmod -R g=u /stackable/app
 
diff --git a/package-lock.json b/package-lock.json
index b058c3dc..3fc40c49 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -38,6 +38,7 @@
         "@tailwindcss/vite": "^4.2.1",
         "@types/node": "^24",
         "@vitest/browser-playwright": "^4.0.18",
+        "@vitest/coverage-v8": "^4.0.18",
         "antlr-ng": "^1.0.10",
         "daisyui": "^5.5.19",
         "eslint": "^9.39.2",
@@ -624,6 +625,42 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/types": "^7.29.7"
+      },
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
     "node_modules/@babel/runtime": {
       "version": "7.28.6",
       "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
@@ -635,6 +672,30 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@babel/types": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@bcoe/v8-coverage": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz",
+      "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/@better-auth/utils": {
       "version": "0.3.1",
       "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
@@ -3757,6 +3818,37 @@
         }
       }
     },
+    "node_modules/@vitest/coverage-v8": {
+      "version": "4.0.18",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.0.18.tgz",
+      "integrity": "sha512-7i+N2i0+ME+2JFZhfuz7Tg/FqKtilHjGyGvoHYQ6iLV0zahbsJ9sljC9OcFcPDbhYKCet+sG8SsVqlyGvPflZg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@bcoe/v8-coverage": "^1.0.2",
+        "@vitest/utils": "4.0.18",
+        "ast-v8-to-istanbul": "^0.3.10",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-reports": "^3.2.0",
+        "magicast": "^0.5.1",
+        "obug": "^2.1.1",
+        "std-env": "^3.10.0",
+        "tinyrainbow": "^3.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@vitest/browser": "4.0.18",
+        "vitest": "4.0.18"
+      },
+      "peerDependenciesMeta": {
+        "@vitest/browser": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@vitest/expect": {
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz",
@@ -4148,6 +4240,28 @@
         "node": ">=12"
       }
     },
+    "node_modules/ast-v8-to-istanbul": {
+      "version": "0.3.12",
+      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-0.3.12.tgz",
+      "integrity": "sha512-BRRC8VRZY2R4Z4lFIL35MwNXmwVqBityvOIwETtsCSwvjl0IdgFsy9NhdaA6j74nUdtJJlIypeRhpDam19Wq3g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.31",
+        "estree-walker": "^3.0.3",
+        "js-tokens": "^10.0.0"
+      }
+    },
+    "node_modules/ast-v8-to-istanbul/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
     "node_modules/atomic-sleep": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
@@ -6441,6 +6555,13 @@
         "node": "20 || >=22"
       }
     },
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/http-cache-semantics": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
@@ -6757,6 +6878,45 @@
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "license": "ISC"
     },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/jackspeak": {
       "version": "3.4.3",
       "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
@@ -6824,6 +6984,13 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/js-tokens": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
+      "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/js-yaml": {
       "version": "4.1.1",
       "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
@@ -7328,6 +7495,34 @@
         "@jridgewell/sourcemap-codec": "^1.5.5"
       }
     },
+    "node_modules/magicast": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.3.tgz",
+      "integrity": "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.3",
+        "@babel/types": "^7.29.0",
+        "source-map-js": "^1.2.1"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/make-fetch-happen": {
       "version": "14.0.3",
       "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
diff --git a/package.json b/package.json
index 52472e59..2618a504 100644
--- a/package.json
+++ b/package.json
@@ -35,6 +35,7 @@
     "@tailwindcss/vite": "^4.2.1",
     "@types/node": "^24",
     "@vitest/browser-playwright": "^4.0.18",
+    "@vitest/coverage-v8": "^4.0.18",
     "antlr-ng": "^1.0.10",
     "daisyui": "^5.5.19",
     "eslint": "^9.39.2",
diff --git a/src/lib/components/catalog/CatalogTree.svelte b/src/lib/components/catalog/CatalogTree.svelte
index 6a913eba..b9640542 100644
--- a/src/lib/components/catalog/CatalogTree.svelte
+++ b/src/lib/components/catalog/CatalogTree.svelte
@@ -169,6 +169,7 @@
       aria-selected="false"
       class="select-none"
     >
+      <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
       <div
         class="hover:bg-base-200 flex items-center gap-1 rounded px-1 py-0.5 text-sm {leaf
           ? ''
diff --git a/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts b/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
index 52736536..96fe8fa2 100644
--- a/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
+++ b/src/lib/components/layout/header/ThemeToggle.svelte.spec.ts
@@ -1,9 +1,12 @@
 import { page } from 'vitest/browser';
-import { describe, expect, it } from 'vitest';
+import { afterEach, describe, expect, it } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import ThemeToggle from './ThemeToggle.svelte';
 
 describe('ThemeToggle', () => {
+  afterEach(() => {
+    localStorage.removeItem('theme');
+  });
   it('should render a toggle button', async () => {
     render(ThemeToggle);
 
@@ -37,4 +40,22 @@ describe('ThemeToggle', () => {
     const themeRestored = document.documentElement.getAttribute('data-theme');
     expect(themeRestored).toBe(themeBefore);
   });
+
+  it('should initialise in dark mode when localStorage has theme=dark', async () => {
+    localStorage.setItem('theme', 'dark');
+    render(ThemeToggle);
+
+    const control = page.getByRole('button');
+    await expect.element(control).toHaveAttribute('aria-label', 'Switch to light mode');
+    expect(document.documentElement.getAttribute('data-theme')).toBe('dark');
+  });
+
+  it('should initialise in light mode when localStorage has theme=light', async () => {
+    localStorage.setItem('theme', 'light');
+    render(ThemeToggle);
+
+    const control = page.getByRole('button');
+    await expect.element(control).toHaveAttribute('aria-label', 'Switch to dark mode');
+    expect(document.documentElement.getAttribute('data-theme')).toBe('light');
+  });
 });
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts b/src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts
new file mode 100644
index 00000000..9a8fd11d
--- /dev/null
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts
@@ -0,0 +1,239 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import { SvelteSet } from 'svelte/reactivity';
+import ContextMenuWrapper from './__tests__/ContextMenuWrapper.svelte';
+import type { StorageObject } from '$lib/storage/types.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+function makeFile(key: string): StorageObject {
+  return {
+    key,
+    size: faker.number.int({ min: 100, max: 10_000_000 }),
+    lastModified: faker.date.recent(),
+    isDirectory: false,
+    contentType: 'application/octet-stream'
+  };
+}
+
+function makeFolder(key: string): StorageObject {
+  return {
+    key,
+    size: 0,
+    lastModified: faker.date.recent(),
+    isDirectory: true,
+    contentType: undefined
+  };
+}
+
+function createState(
+  objects: StorageObject[] = [],
+  opts: { contextMenu?: { x: number; y: number; key: string }; selectedKeys?: string[] } = {}
+): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = '';
+  state.objects = {
+    objects,
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  };
+  if (opts.contextMenu) state.contextMenu = opts.contextMenu;
+  if (opts.selectedKeys) state.selectedKeys = new SvelteSet(opts.selectedKeys);
+  return state;
+}
+
+describe('ContextMenu', () => {
+  it('should render menu with role="menu"', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    render(ContextMenuWrapper, { state });
+
+    await expect.element(page.getByRole('menu')).toBeInTheDocument();
+  });
+
+  it('should show action buttons', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    render(ContextMenuWrapper, { state });
+
+    await expect.element(page.getByRole('menuitem', { name: 'Preview' })).toBeInTheDocument();
+    await expect.element(page.getByRole('menuitem', { name: 'Download' })).toBeInTheDocument();
+    await expect.element(page.getByRole('menuitem', { name: 'Delete' })).toBeInTheDocument();
+  });
+
+  it('should disable preview when context is a folder', async () => {
+    const folder = makeFolder('docs/');
+    const state = createState([folder], {
+      contextMenu: { x: 100, y: 100, key: 'docs/' },
+      selectedKeys: ['docs/']
+    });
+    render(ContextMenuWrapper, { state });
+
+    const previewBtn = page.getByRole('menuitem', { name: 'Preview' });
+    await expect.element(previewBtn).toHaveAttribute('disabled');
+  });
+
+  it('should disable download when context is a folder with no selected files', async () => {
+    const folder = makeFolder('docs/');
+    const state = createState([folder], {
+      contextMenu: { x: 100, y: 100, key: 'docs/' },
+      selectedKeys: ['docs/']
+    });
+    render(ContextMenuWrapper, { state });
+
+    const downloadBtn = page.getByRole('menuitem', { name: 'Download' });
+    await expect.element(downloadBtn).toHaveAttribute('disabled');
+  });
+
+  it('should enable download when context is a file', async () => {
+    const file = makeFile('report.pdf');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'report.pdf' },
+      selectedKeys: ['report.pdf']
+    });
+    render(ContextMenuWrapper, { state });
+
+    const downloadBtn = page.getByRole('menuitem', { name: 'Download' });
+    await expect.element(downloadBtn).not.toHaveAttribute('disabled');
+  });
+
+  it('should close menu when close button is clicked', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    const spy = vi.spyOn(state, 'closeContextMenu');
+    render(ContextMenuWrapper, { state });
+
+    await page.getByRole('menuitem', { name: 'Close' }).click();
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('should close menu on Escape key', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    const spy = vi.spyOn(state, 'closeContextMenu');
+    render(ContextMenuWrapper, { state });
+
+    document.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }));
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('should execute action when action button is clicked', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    const spy = vi.spyOn(state, 'executeAction');
+    render(ContextMenuWrapper, { state });
+
+    await page.getByRole('menuitem', { name: 'Delete' }).click();
+    expect(spy).toHaveBeenCalledWith('delete');
+  });
+
+  it('should position menu at context menu coordinates', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 200, y: 150, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    render(ContextMenuWrapper, { state });
+
+    const menu = page.getByRole('menu');
+    await expect.element(menu).toBeInTheDocument();
+  });
+
+  it('should adjust position when menu overflows viewport bottom', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: window.innerHeight - 10, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    render(ContextMenuWrapper, { state });
+
+    const menu = page.getByRole('menu');
+    await expect.element(menu).toBeInTheDocument();
+    const el = menu.element() as HTMLElement;
+    const top = parseInt(el.style.top);
+    expect(top).toBeLessThan(window.innerHeight - 10);
+  });
+
+  it('should not close menu when clicking inside it', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    const spy = vi.spyOn(state, 'closeContextMenu');
+    render(ContextMenuWrapper, { state });
+
+    const menu = page.getByRole('menu');
+    await menu.click();
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  it('should execute action when clicking an enabled action button (preview)', async () => {
+    const file = makeFile('photo.png');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'photo.png' },
+      selectedKeys: ['photo.png']
+    });
+    const spy = vi.spyOn(state, 'executeAction');
+    render(ContextMenuWrapper, { state });
+
+    await page.getByRole('menuitem', { name: 'Preview' }).click();
+    expect(spy).toHaveBeenCalledWith('preview');
+  });
+
+  it('should execute download action', async () => {
+    const file = makeFile('data.csv');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'data.csv' },
+      selectedKeys: ['data.csv']
+    });
+    const spy = vi.spyOn(state, 'executeAction');
+    render(ContextMenuWrapper, { state });
+
+    await page.getByRole('menuitem', { name: 'Download' }).click();
+    expect(spy).toHaveBeenCalledWith('download');
+  });
+
+  it('should not close menu on non-Escape key', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    const spy = vi.spyOn(state, 'closeContextMenu');
+    render(ContextMenuWrapper, { state });
+
+    document.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true }));
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  it('should disable delete when no items are selected', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: []
+    });
+    render(ContextMenuWrapper, { state });
+
+    const deleteBtn = page.getByRole('menuitem', { name: 'Delete' });
+    await expect.element(deleteBtn).toHaveAttribute('disabled');
+  });
+});
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts b/src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts
new file mode 100644
index 00000000..a412b677
--- /dev/null
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts
@@ -0,0 +1,186 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import { SvelteSet } from 'svelte/reactivity';
+import FileExplorerWrapper from './__tests__/FileExplorerWrapper.svelte';
+import type { StorageObject } from '$lib/storage/types.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+function makeFile(key: string): StorageObject {
+  return {
+    key,
+    size: faker.number.int({ min: 100, max: 10_000_000 }),
+    lastModified: faker.date.recent(),
+    isDirectory: false,
+    contentType: 'application/octet-stream'
+  };
+}
+
+function createState(
+  objects: StorageObject[] = [],
+  opts: {
+    prefix?: string;
+    loading?: boolean;
+    deleting?: boolean;
+    selectedKeys?: string[];
+    contextMenu?: { x: number; y: number; key: string };
+  } = {}
+): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = opts.prefix ?? '';
+  state.objects = {
+    objects,
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  };
+  if (opts.loading) state.loading = true;
+  if (opts.deleting) state.deleting = true;
+  if (opts.selectedKeys) state.selectedKeys = new SvelteSet(opts.selectedKeys);
+  if (opts.contextMenu) state.contextMenu = opts.contextMenu;
+  return state;
+}
+
+describe('FileExplorer', () => {
+  it('should render the object table', async () => {
+    const state = createState([makeFile('hello.txt')]);
+    render(FileExplorerWrapper, { state });
+
+    await expect.element(page.getByText('hello.txt')).toBeInTheDocument();
+  });
+
+  it('should show loading overlay when loading', async () => {
+    const state = createState([], { loading: true });
+    render(FileExplorerWrapper, { state });
+
+    await expect.element(page.getByLabelText('Loading')).toBeInTheDocument();
+  });
+
+  it('should show loading overlay when deleting', async () => {
+    const state = createState([], { deleting: true });
+    render(FileExplorerWrapper, { state });
+
+    await expect.element(page.getByLabelText('Loading')).toBeInTheDocument();
+  });
+
+  it('should render context menu when contextMenu state is set', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], {
+      contextMenu: { x: 100, y: 100, key: 'test.txt' },
+      selectedKeys: ['test.txt']
+    });
+    render(FileExplorerWrapper, { state });
+
+    // The context menu has a specific class w-48
+    await expect.element(page.getByText('Actions')).toBeInTheDocument();
+  });
+
+  it('should not render context menu actions when contextMenu state is null', async () => {
+    const state = createState([makeFile('test.txt')]);
+    render(FileExplorerWrapper, { state });
+
+    // Context menu title "Actions" should not be present
+    expect(page.getByText('Actions').elements().length).toBe(0);
+  });
+
+  it('should render pagination', async () => {
+    const state = createState([makeFile('test.txt')]);
+    render(FileExplorerWrapper, { state });
+
+    await expect.element(page.getByText('Page 1')).toBeInTheDocument();
+  });
+
+  it('should handle Delete key to open delete modal', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], { selectedKeys: ['test.txt'] });
+    const spy = vi.spyOn(state, 'openModal');
+    render(FileExplorerWrapper, { state });
+
+    window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Delete', bubbles: true }));
+    expect(spy).toHaveBeenCalledWith('delete', { keys: ['test.txt'] });
+  });
+
+  it('should handle Escape key to clear selection', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], { selectedKeys: ['test.txt'] });
+    const spy = vi.spyOn(state, 'clearSelection');
+    render(FileExplorerWrapper, { state });
+
+    window.dispatchEvent(new KeyboardEvent('keydown', { key: 'Escape', bubbles: true }));
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('should render breadcrumb', async () => {
+    const state = createState([], { prefix: 'docs/reports/' });
+    render(FileExplorerWrapper, { state });
+
+    await expect.element(page.getByText('docs')).toBeInTheDocument();
+  });
+
+  it('should clear selection when clicking outside a table row', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], { selectedKeys: ['test.txt'] });
+    const spy = vi.spyOn(state, 'clearSelection');
+    const { container } = render(FileExplorerWrapper, { state });
+
+    // Find the relative container div and click it
+    const wrapper = container.querySelector('.relative.min-h-0') as HTMLElement;
+    wrapper.click();
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('should not clear selection when clicking on a table row', async () => {
+    const file = makeFile('test.txt');
+    const state = createState([file], { selectedKeys: ['test.txt'] });
+    const spy = vi.spyOn(state, 'clearSelection');
+    render(FileExplorerWrapper, { state });
+
+    // Click on an element inside a <tr>
+    const row = document.querySelector('tr td') as HTMLElement;
+    if (row) {
+      row.click();
+      expect(spy).not.toHaveBeenCalled();
+    }
+  });
+
+  it('should call pagination navigation callbacks', async () => {
+    const files = [makeFile('test.txt')];
+    const state = createState(files);
+    state.objects.hasNextPage = true;
+    state.prevTokens = ['token1'];
+    const spyFirst = vi.spyOn(state, 'navigateFirst');
+    const spyPrev = vi.spyOn(state, 'navigatePrev');
+    const spyNext = vi.spyOn(state, 'navigateNext');
+    render(FileExplorerWrapper, { state });
+
+    // Click the "next" pagination button
+    const nextBtn = page.getByRole('button', { name: 'Next page' });
+    await nextBtn.click();
+    expect(spyNext).toHaveBeenCalled();
+
+    // Click the "previous" pagination button
+    const prevBtn = page.getByRole('button', { name: 'Previous page' });
+    await prevBtn.click();
+    expect(spyPrev).toHaveBeenCalled();
+
+    // Click the "first" pagination button
+    const firstBtn = page.getByRole('button', { name: 'First page' });
+    await firstBtn.click();
+    expect(spyFirst).toHaveBeenCalled();
+  });
+
+  it('should call onPageSizeChange when page size changes', async () => {
+    const state = createState([makeFile('test.txt')]);
+    const spy = vi.spyOn(state, 'onPageSizeChange');
+    render(FileExplorerWrapper, { state });
+
+    // Find and interact with the page size select
+    const select = page.getByRole('combobox');
+    if (select.elements().length > 0) {
+      await select.selectOptions('50');
+      expect(spy).toHaveBeenCalled();
+    }
+  });
+});
diff --git a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
new file mode 100644
index 00000000..e8acb5e5
--- /dev/null
+++ b/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
@@ -0,0 +1,284 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import { SvelteSet } from 'svelte/reactivity';
+import FileRowWrapper from './__tests__/FileRowWrapper.svelte';
+import type { StorageObject } from '$lib/storage/types.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+function makeFile(overrides: Partial<StorageObject> = {}): StorageObject {
+  return {
+    key: overrides.key ?? `folder/${faker.system.fileName()}`,
+    size: overrides.size ?? faker.number.int({ min: 0, max: 1_000_000_000 }),
+    lastModified: overrides.lastModified ?? faker.date.recent(),
+    isDirectory: false,
+    contentType:
+      overrides.contentType ??
+      faker.helpers.arrayElement([
+        'image/png',
+        'application/pdf',
+        'application/json',
+        'application/zip',
+        'text/plain',
+        undefined
+      ])
+  };
+}
+
+function createState(
+  files: StorageObject[] = [],
+  opts: { selectionMode?: boolean; selectedKeys?: string[] } = {}
+): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = '';
+  state.objects = {
+    objects: files,
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  };
+  if (opts.selectionMode) state.selectionMode = true;
+  if (opts.selectedKeys) state.selectedKeys = new SvelteSet(opts.selectedKeys);
+  return state;
+}
+
+describe('FileRow', () => {
+  it('should render the file name', async () => {
+    const file = makeFile({ key: 'docs/report.pdf', contentType: 'application/pdf' });
+    const state = createState([file]);
+    render(FileRowWrapper, { state, file });
+
+    await expect.element(page.getByText('report.pdf')).toBeInTheDocument();
+  });
+
+  it('should render the file size', async () => {
+    const file = makeFile({ key: 'test.txt', size: 1024, contentType: 'text/plain' });
+    const state = createState([file]);
+    render(FileRowWrapper, { state, file });
+
+    await expect.element(page.getByText(/1.*kB/)).toBeInTheDocument();
+  });
+
+  it('should render content type badge', async () => {
+    const file = makeFile({ key: 'data.json', contentType: 'application/json' });
+    const state = createState([file]);
+    render(FileRowWrapper, { state, file });
+
+    await expect.element(page.getByText('json', { exact: true })).toBeInTheDocument();
+  });
+
+  it('should not render badge when contentType is undefined', async () => {
+    const file = makeFile({ key: 'unknown-file', contentType: undefined });
+    const state = createState([file]);
+    render(FileRowWrapper, { state, file });
+
+    await expect.element(page.getByText('unknown-file')).toBeInTheDocument();
+  });
+
+  it('should show checkbox when showCheckboxes is true', async () => {
+    const file = makeFile({ key: 'file.txt', contentType: 'text/plain' });
+    const state = createState([file], { selectionMode: true });
+    render(FileRowWrapper, { state, file });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select file.txt' });
+    await expect.element(checkbox).toBeInTheDocument();
+    await expect.element(checkbox).not.toBeDisabled();
+  });
+
+  it('should have disabled checkbox when showCheckboxes is false', async () => {
+    const file = makeFile({ key: 'file.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    render(FileRowWrapper, { state, file });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select file.txt' });
+    await expect.element(checkbox).toBeDisabled();
+  });
+
+  it('should highlight row when selected', async () => {
+    const file = makeFile({ key: 'selected.txt', contentType: 'text/plain' });
+    const state = createState([file], { selectedKeys: ['selected.txt'] });
+    render(FileRowWrapper, { state, file });
+
+    const row = page.getByRole('row');
+    await expect.element(row).toHaveClass(/bg-primary/);
+  });
+
+  it('should have aria-label on actions button', async () => {
+    const file = makeFile({ key: 'path/my-file.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    render(FileRowWrapper, { state, file });
+
+    const btn = page.getByRole('button', { name: 'Actions for my-file.txt' });
+    await expect.element(btn).toBeInTheDocument();
+  });
+
+  it('should call toggleSelect on click', async () => {
+    const file = makeFile({ key: 'click.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    const spy = vi.spyOn(state, 'toggleSelect');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByRole('row').click();
+    expect(spy).toHaveBeenCalledWith('click.txt', false);
+  });
+
+  it('should call executeAction preview on double click', async () => {
+    const file = makeFile({ key: 'dbl.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    const spy = vi.spyOn(state, 'executeAction');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByRole('row').dblClick();
+    expect(spy).toHaveBeenCalledWith('preview');
+  });
+
+  it('should call openContextMenu on right click', async () => {
+    const file = makeFile({ key: 'ctx.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    const spy = vi.spyOn(state, 'openContextMenu');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByText('ctx.txt').click({ button: 'right' });
+    expect(spy).toHaveBeenCalled();
+  });
+
+  describe('icon selection based on content type', () => {
+    it('should render file with image content type', async () => {
+      const file = makeFile({ key: 'holiday-photo.png', contentType: 'image/png' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('holiday-photo.png')).toBeInTheDocument();
+      await expect.element(page.getByText('png', { exact: true })).toBeInTheDocument();
+    });
+
+    it('should render file with pdf content type', async () => {
+      const file = makeFile({ key: 'document.pdf', contentType: 'application/pdf' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('pdf', { exact: true })).toBeInTheDocument();
+    });
+
+    it('should render file with code content type', async () => {
+      const file = makeFile({ key: 'config.json', contentType: 'application/json' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('json', { exact: true })).toBeInTheDocument();
+    });
+
+    it('should render file with archive content type', async () => {
+      const file = makeFile({ key: 'backup.zip', contentType: 'application/zip' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('zip', { exact: true })).toBeInTheDocument();
+    });
+  });
+
+  it('should highlight row when context menu is open for this file', async () => {
+    const file = makeFile({ key: 'ctx-active.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    state.contextMenu = { x: 100, y: 100, key: 'ctx-active.txt' };
+    render(FileRowWrapper, { state, file });
+
+    const row = page.getByRole('row');
+    await expect.element(row).toHaveClass(/bg-base-300/);
+  });
+
+  it('should call toggleSelect with multi=true on ctrl+click', async () => {
+    const file = makeFile({ key: 'ctrl.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    const spy = vi.spyOn(state, 'toggleSelect');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByRole('row').click({ modifiers: ['ControlOrMeta'] });
+    expect(spy).toHaveBeenCalledWith('ctrl.txt', true);
+  });
+
+  it('should call toggleSelect on checkbox change', async () => {
+    const file = makeFile({ key: 'check.txt', contentType: 'text/plain' });
+    const state = createState([file], { selectionMode: true });
+    const spy = vi.spyOn(state, 'toggleSelect');
+    render(FileRowWrapper, { state, file });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select check.txt' });
+    await checkbox.click();
+    expect(spy).toHaveBeenCalledWith('check.txt', true);
+  });
+
+  it('should call openContextMenu on actions button click', async () => {
+    const file = makeFile({ key: 'actions.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    const spy = vi.spyOn(state, 'openContextMenu');
+    render(FileRowWrapper, { state, file });
+
+    const btn = page.getByRole('button', { name: 'Actions for actions.txt' });
+    await btn.click();
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('should not highlight as selected when context menu is active', async () => {
+    const file = makeFile({ key: 'both.txt', contentType: 'text/plain' });
+    const state = createState([file], { selectedKeys: ['both.txt'] });
+    state.contextMenu = { x: 0, y: 0, key: 'both.txt' };
+    render(FileRowWrapper, { state, file });
+
+    const row = page.getByRole('row');
+    await expect.element(row).toHaveClass(/bg-base-300/);
+  });
+
+  it('should apply default hover style when neither selected nor context menu', async () => {
+    const file = makeFile({ key: 'plain.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    render(FileRowWrapper, { state, file });
+
+    const row = page.getByRole('row');
+    await expect.element(row).not.toHaveClass(/bg-primary/);
+    await expect.element(row).not.toHaveClass(/bg-base-300/);
+  });
+
+  describe('edge cases', () => {
+    it('should handle zero-byte files', async () => {
+      const file = makeFile({ key: 'empty.txt', size: 0, contentType: 'text/plain' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('0 B')).toBeInTheDocument();
+    });
+
+    it('should handle very large files', async () => {
+      const file = makeFile({ key: 'huge.bin', size: 5_000_000_000_000, contentType: undefined });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText(/[0-9].*TB/)).toBeInTheDocument();
+    });
+
+    it('should handle file names with special characters', async () => {
+      const name = 'file with spaces & (special).txt';
+      const file = makeFile({ key: `path/${name}`, contentType: 'text/plain' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText(name)).toBeInTheDocument();
+    });
+
+    it('should handle deeply nested paths', async () => {
+      const file = makeFile({ key: 'a/b/c/d/e/f/deep.csv', contentType: 'text/csv' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('deep.csv')).toBeInTheDocument();
+    });
+
+    it('should handle contentType with trailing slash gracefully', async () => {
+      const file = makeFile({ key: 'weird.bin', contentType: 'application/' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('weird.bin')).toBeInTheDocument();
+    });
+
+    it('should handle unicode file names', async () => {
+      const file = makeFile({ key: 'données/résumé.txt', contentType: 'text/plain' });
+      const state = createState([file]);
+      render(FileRowWrapper, { state, file });
+      await expect.element(page.getByText('résumé.txt')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte.spec.ts b/src/lib/components/storage/explorer/FolderRow.svelte.spec.ts
new file mode 100644
index 00000000..1b5d4a3d
--- /dev/null
+++ b/src/lib/components/storage/explorer/FolderRow.svelte.spec.ts
@@ -0,0 +1,209 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import { SvelteSet } from 'svelte/reactivity';
+import FolderRowWrapper from './__tests__/FolderRowWrapper.svelte';
+import type { StorageObject } from '$lib/storage/types.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+function makeFolder(key: string): StorageObject {
+  return {
+    key,
+    size: 0,
+    lastModified: faker.date.recent(),
+    isDirectory: true,
+    contentType: undefined
+  };
+}
+
+function createState(
+  folders: StorageObject[] = [],
+  opts: { selectionMode?: boolean; selectedKeys?: string[] } = {}
+): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = '';
+  state.objects = {
+    objects: folders,
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  };
+  if (opts.selectionMode) state.selectionMode = true;
+  if (opts.selectedKeys) state.selectedKeys = new SvelteSet(opts.selectedKeys);
+  return state;
+}
+
+describe('FolderRow', () => {
+  it('should render the folder name', async () => {
+    const folder = makeFolder('documents/');
+    const state = createState([folder]);
+    render(FolderRowWrapper, { state, folder });
+
+    await expect.element(page.getByText('documents')).toBeInTheDocument();
+  });
+
+  it('should show dash for size and last modified', async () => {
+    const folder = makeFolder('data/');
+    const state = createState([folder]);
+    render(FolderRowWrapper, { state, folder });
+
+    const dashes = page.getByText('—');
+    expect(dashes.elements().length).toBe(2);
+  });
+
+  it('should navigate on click when not in selection mode', async () => {
+    const folder = makeFolder('photos/');
+    const state = createState([folder]);
+    const spy = vi.spyOn(state, 'navigate');
+    render(FolderRowWrapper, { state, folder });
+
+    await page.getByRole('row').click();
+    expect(spy).toHaveBeenCalledWith('photos/');
+  });
+
+  it('should toggle selection on click in selection mode', async () => {
+    const folder = makeFolder('photos/');
+    const state = createState([folder], { selectionMode: true });
+    const spy = vi.spyOn(state, 'toggleSelect');
+    render(FolderRowWrapper, { state, folder });
+
+    await page.getByRole('row').click();
+    expect(spy).toHaveBeenCalledWith('photos/', true);
+  });
+
+  it('should call openContextMenu on right click', async () => {
+    const folder = makeFolder('logs/');
+    const state = createState([folder]);
+    const spy = vi.spyOn(state, 'openContextMenu');
+    render(FolderRowWrapper, { state, folder });
+
+    await page.getByText('logs').click({ button: 'right' });
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('should show checkbox when showCheckboxes is true', async () => {
+    const folder = makeFolder('backup/');
+    const state = createState([folder], { selectionMode: true });
+    render(FolderRowWrapper, { state, folder });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select backup' });
+    await expect.element(checkbox).toBeInTheDocument();
+    await expect.element(checkbox).not.toBeDisabled();
+  });
+
+  it('should have disabled checkbox when showCheckboxes is false', async () => {
+    const folder = makeFolder('backup/');
+    const state = createState([folder]);
+    render(FolderRowWrapper, { state, folder });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select backup' });
+    await expect.element(checkbox).toBeDisabled();
+  });
+
+  it('should highlight row when selected', async () => {
+    const folder = makeFolder('selected/');
+    const state = createState([folder], { selectedKeys: ['selected/'], selectionMode: true });
+    render(FolderRowWrapper, { state, folder });
+
+    const row = page.getByRole('row');
+    await expect.element(row).toHaveClass(/bg-primary/);
+  });
+
+  it('should have aria-label on actions button', async () => {
+    const folder = makeFolder('my-folder/');
+    const state = createState([folder]);
+    render(FolderRowWrapper, { state, folder });
+
+    const btn = page.getByRole('button', { name: 'Actions for my-folder' });
+    await expect.element(btn).toBeInTheDocument();
+  });
+
+  it('should toggle selection on ctrl+click when not in selection mode', async () => {
+    const folder = makeFolder('photos/');
+    const state = createState([folder]);
+    const spy = vi.spyOn(state, 'toggleSelect');
+    render(FolderRowWrapper, { state, folder });
+
+    await page.getByRole('row').click({ modifiers: ['ControlOrMeta'] });
+    expect(spy).toHaveBeenCalledWith('photos/', true);
+  });
+
+  it('should navigate on double-click with ctrl/meta key', async () => {
+    const folder = makeFolder('photos/');
+    const state = createState([folder], { selectionMode: true });
+    const spy = vi.spyOn(state, 'navigate');
+    render(FolderRowWrapper, { state, folder });
+
+    const row = page.getByRole('row').element();
+    row.dispatchEvent(new MouseEvent('dblclick', { bubbles: true, ctrlKey: true }));
+    expect(spy).toHaveBeenCalledWith('photos/');
+  });
+
+  it('should not navigate on double-click without ctrl/meta key', async () => {
+    const folder = makeFolder('photos/');
+    const state = createState([folder]);
+    const spy = vi.spyOn(state, 'navigate');
+    render(FolderRowWrapper, { state, folder });
+
+    spy.mockClear();
+    const row = page.getByRole('row').element();
+    row.dispatchEvent(new MouseEvent('dblclick', { bubbles: true }));
+    // ondblclick without modifier does nothing, so navigate should not be called from dblclick
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  it('should highlight row when context menu is open for this folder', async () => {
+    const folder = makeFolder('ctx-folder/');
+    const state = createState([folder]);
+    state.contextMenu = { key: 'ctx-folder/', x: 0, y: 0 };
+    render(FolderRowWrapper, { state, folder });
+
+    const row = page.getByRole('row');
+    await expect.element(row).toHaveClass(/bg-base-300/);
+  });
+
+  it('should open context menu when actions button is clicked', async () => {
+    const folder = makeFolder('my-folder/');
+    const state = createState([folder]);
+    const spy = vi.spyOn(state, 'openContextMenu');
+    render(FolderRowWrapper, { state, folder });
+
+    await page.getByRole('button', { name: 'Actions for my-folder' }).click();
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('should toggle selection when checkbox is changed', async () => {
+    const folder = makeFolder('check-folder/');
+    const state = createState([folder], { selectionMode: true });
+    const spy = vi.spyOn(state, 'toggleSelect');
+    render(FolderRowWrapper, { state, folder });
+
+    await page.getByRole('checkbox', { name: 'Select check-folder' }).click();
+    expect(spy).toHaveBeenCalledWith('check-folder/', true);
+  });
+
+  describe('edge cases', () => {
+    it('should handle folder names with special characters', async () => {
+      const folder = makeFolder('path/my folder (2)/');
+      const state = createState([folder]);
+      render(FolderRowWrapper, { state, folder });
+      await expect.element(page.getByText('my folder (2)')).toBeInTheDocument();
+    });
+
+    it('should handle deeply nested folders', async () => {
+      const folder = makeFolder('a/b/c/d/e/deep-folder/');
+      const state = createState([folder]);
+      render(FolderRowWrapper, { state, folder });
+      await expect.element(page.getByText('deep-folder')).toBeInTheDocument();
+    });
+
+    it('should handle unicode folder names', async () => {
+      const folder = makeFolder('données/résumés/');
+      const state = createState([folder]);
+      render(FolderRowWrapper, { state, folder });
+      await expect.element(page.getByText('résumés')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts b/src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts
new file mode 100644
index 00000000..e3024235
--- /dev/null
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts
@@ -0,0 +1,170 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import { SvelteSet } from 'svelte/reactivity';
+import ObjectTableWrapper from './__tests__/ObjectTableWrapper.svelte';
+import type { StorageObject } from '$lib/storage/types.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+function makeFolder(key: string): StorageObject {
+  return {
+    key,
+    size: 0,
+    lastModified: faker.date.recent(),
+    isDirectory: true,
+    contentType: undefined
+  };
+}
+
+function makeFile(key: string, size?: number): StorageObject {
+  return {
+    key,
+    size: size ?? faker.number.int({ min: 100, max: 10_000_000 }),
+    lastModified: faker.date.recent(),
+    isDirectory: false,
+    contentType: 'application/octet-stream'
+  };
+}
+
+function createState(
+  objects: StorageObject[] = [],
+  opts: { prefix?: string; selectionMode?: boolean; selectedKeys?: string[] } = {}
+): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = opts.prefix ?? '';
+  state.objects = {
+    objects,
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  };
+  if (opts.selectionMode) state.selectionMode = true;
+  if (opts.selectedKeys) state.selectedKeys = new SvelteSet(opts.selectedKeys);
+  return state;
+}
+
+describe('ObjectTable', () => {
+  it('should render column headers', async () => {
+    const state = createState();
+    render(ObjectTableWrapper, { state });
+
+    await expect.element(page.getByText('Name')).toBeInTheDocument();
+    await expect.element(page.getByText('Size')).toBeInTheDocument();
+    await expect.element(page.getByText('Last modified')).toBeInTheDocument();
+  });
+
+  it('should render select-all checkbox', async () => {
+    const state = createState([makeFile('test.txt')], { selectionMode: true });
+    render(ObjectTableWrapper, { state });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select all' });
+    await expect.element(checkbox).toBeInTheDocument();
+  });
+
+  it('should show empty state when no items', async () => {
+    const state = createState([]);
+    render(ObjectTableWrapper, { state });
+
+    await expect.element(page.getByText('This bucket is empty')).toBeInTheDocument();
+  });
+
+  it('should show parent directory row when prefix is set', async () => {
+    const state = createState([], { prefix: 'docs/' });
+    render(ObjectTableWrapper, { state });
+
+    await expect.element(page.getByText('...')).toBeInTheDocument();
+  });
+
+  it('should not show parent directory row when prefix is empty', async () => {
+    const state = createState([makeFile('file.txt')]);
+    render(ObjectTableWrapper, { state });
+
+    expect(page.getByText('...').elements().length).toBe(0);
+  });
+
+  it('should render folders and files', async () => {
+    const objects = [makeFolder('photos/'), makeFile('readme.txt')];
+    const state = createState(objects);
+    render(ObjectTableWrapper, { state });
+
+    await expect.element(page.getByText('photos')).toBeInTheDocument();
+    await expect.element(page.getByText('readme.txt')).toBeInTheDocument();
+  });
+
+  it('should navigate up when clicking parent dir row', async () => {
+    const state = createState([], { prefix: 'a/b/' });
+    const spy = vi.spyOn(state, 'navigate');
+    render(ObjectTableWrapper, { state });
+
+    await page.getByText('...').click();
+    expect(spy).toHaveBeenCalledWith('a/');
+  });
+
+  it('should navigate to root when clicking parent dir from single-level prefix', async () => {
+    const state = createState([], { prefix: 'docs/' });
+    const spy = vi.spyOn(state, 'navigate');
+    render(ObjectTableWrapper, { state });
+
+    await page.getByText('...').click();
+    expect(spy).toHaveBeenCalledWith('');
+  });
+
+  it('should call selectAll when select-all checkbox is checked', async () => {
+    const objects = [makeFile('a.txt'), makeFile('b.txt')];
+    const state = createState(objects, { selectionMode: true });
+    const spy = vi.spyOn(state, 'selectAll');
+    render(ObjectTableWrapper, { state });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select all' });
+    await checkbox.click();
+    expect(spy).toHaveBeenCalledWith(true);
+  });
+
+  it('should disable select-all checkbox when not in selection mode', async () => {
+    const state = createState([makeFile('a.txt')]);
+    render(ObjectTableWrapper, { state });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select all' });
+    await expect.element(checkbox).toBeDisabled();
+  });
+
+  it('should render many items', async () => {
+    const objects = Array.from({ length: 50 }, (_, i) => makeFile(`file-${i}.txt`));
+    const state = createState(objects);
+    render(ObjectTableWrapper, { state });
+
+    await expect.element(page.getByText('file-0.txt')).toBeInTheDocument();
+    await expect.element(page.getByText('file-49.txt')).toBeInTheDocument();
+  });
+
+  it('should not show empty state when only files exist (no folders)', async () => {
+    const state = createState([makeFile('only-file.txt')]);
+    render(ObjectTableWrapper, { state });
+
+    await expect.element(page.getByText('only-file.txt')).toBeInTheDocument();
+    expect(page.getByText('This bucket is empty').elements().length).toBe(0);
+  });
+
+  it('should not show empty state when only folders exist (no files)', async () => {
+    const state = createState([makeFolder('images/')]);
+    render(ObjectTableWrapper, { state });
+
+    await expect.element(page.getByText('images')).toBeInTheDocument();
+    expect(page.getByText('This bucket is empty').elements().length).toBe(0);
+  });
+
+  it('should set indeterminate state on select-all checkbox when some items are selected', async () => {
+    const objects = [makeFile('a.txt'), makeFile('b.txt')];
+    const state = createState(objects, {
+      selectionMode: true,
+      selectedKeys: ['a.txt']
+    });
+    render(ObjectTableWrapper, { state });
+
+    const checkbox = page.getByRole('checkbox', { name: 'Select all' });
+    await expect.element(checkbox).toBeInTheDocument();
+    // someSelected should be true, making indeterminate true
+  });
+});
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts b/src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts
new file mode 100644
index 00000000..e37f7750
--- /dev/null
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts
@@ -0,0 +1,150 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { SvelteSet } from 'svelte/reactivity';
+import SelectionToolbarWrapper from './__tests__/SelectionToolbarWrapper.svelte';
+import type { StorageObject } from '$lib/storage/types.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+function makeFile(key: string): StorageObject {
+  return {
+    key,
+    size: 1024,
+    lastModified: new Date(),
+    isDirectory: false,
+    contentType: 'text/plain'
+  };
+}
+
+function makeFolder(key: string): StorageObject {
+  return { key, size: 0, lastModified: new Date(), isDirectory: true, contentType: undefined };
+}
+
+function createState(objects: StorageObject[] = [], selectedKeys: string[] = []): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = '';
+  state.objects = { objects, hasNextPage: false, currentPage: 1, pageSize: 25 };
+  state.selectedKeys = new SvelteSet(selectedKeys);
+  state.selectionMode = true;
+  return state;
+}
+
+describe('SelectionToolbar', () => {
+  it('should show selected count', async () => {
+    const files = [makeFile('a.txt'), makeFile('b.txt')];
+    const state = createState(files, ['a.txt', 'b.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    await expect.element(page.getByText('2 selected')).toBeInTheDocument();
+  });
+
+  it('should enable preview button when exactly 1 file selected', async () => {
+    const files = [makeFile('a.txt')];
+    const state = createState(files, ['a.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Preview/ });
+    await expect.element(btn).not.toBeDisabled();
+  });
+
+  it('should disable preview button when folder is selected', async () => {
+    const objects = [makeFile('a.txt'), makeFolder('dir/')];
+    const state = createState(objects, ['a.txt', 'dir/']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Preview/ });
+    await expect.element(btn).toBeDisabled();
+  });
+
+  it('should disable preview when multiple files selected', async () => {
+    const files = [makeFile('a.txt'), makeFile('b.txt')];
+    const state = createState(files, ['a.txt', 'b.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Preview/ });
+    await expect.element(btn).toBeDisabled();
+  });
+
+  it('should enable download button when exactly 1 file selected', async () => {
+    const files = [makeFile('a.txt')];
+    const state = createState(files, ['a.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Download/ });
+    await expect.element(btn).not.toBeDisabled();
+  });
+
+  it('should disable download when folder selected', async () => {
+    const objects = [makeFolder('dir/')];
+    const state = createState(objects, ['dir/']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Download/ });
+    await expect.element(btn).toBeDisabled();
+  });
+
+  it('should enable delete button when items are selected', async () => {
+    const files = [makeFile('a.txt')];
+    const state = createState(files, ['a.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Delete/ });
+    await expect.element(btn).not.toBeDisabled();
+  });
+
+  it('should disable delete button when nothing selected', async () => {
+    const state = createState([makeFile('a.txt')], []);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Delete/ });
+    await expect.element(btn).toBeDisabled();
+  });
+
+  it('should not apply error styling to delete button when nothing selected', async () => {
+    const state = createState([makeFile('a.txt')], []);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Delete/ });
+    await expect.element(btn).not.toHaveClass('text-error');
+  });
+
+  it('should apply error styling to delete button when items are selected', async () => {
+    const files = [makeFile('a.txt')];
+    const state = createState(files, ['a.txt']);
+    render(SelectionToolbarWrapper, { state });
+
+    const btn = page.getByRole('button', { name: /Delete/ });
+    await expect.element(btn).toHaveClass('text-error');
+  });
+
+  it('should call executeAction preview on preview click', async () => {
+    const files = [makeFile('a.txt')];
+    const state = createState(files, ['a.txt']);
+    const spy = vi.spyOn(state, 'executeAction');
+    render(SelectionToolbarWrapper, { state });
+
+    await page.getByRole('button', { name: /Preview/ }).click();
+    expect(spy).toHaveBeenCalledWith('preview');
+  });
+
+  it('should call executeAction download on download click', async () => {
+    const files = [makeFile('a.txt')];
+    const state = createState(files, ['a.txt']);
+    const spy = vi.spyOn(state, 'executeAction');
+    render(SelectionToolbarWrapper, { state });
+
+    await page.getByRole('button', { name: /Download/ }).click();
+    expect(spy).toHaveBeenCalledWith('download');
+  });
+
+  it('should call executeAction delete on delete click', async () => {
+    const files = [makeFile('a.txt'), makeFile('b.txt')];
+    const state = createState(files, ['a.txt', 'b.txt']);
+    const spy = vi.spyOn(state, 'executeAction');
+    render(SelectionToolbarWrapper, { state });
+
+    await page.getByRole('button', { name: /Delete/ }).click();
+    expect(spy).toHaveBeenCalledWith('delete');
+  });
+});
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
new file mode 100644
index 00000000..44e0a6d8
--- /dev/null
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
@@ -0,0 +1,458 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import StorageBreadcrumbWrapper from './__tests__/StorageBreadcrumbWrapper.svelte';
+import { StorageState } from '$lib/storage/state.svelte.js';
+import type { StorageObject } from '$lib/storage/types.js';
+
+function makeFolders(count: number): StorageObject[] {
+  return Array.from({ length: count }, (_, i) => ({
+    key: `folder${i}/`,
+    size: 0,
+    lastModified: faker.date.recent(),
+    isDirectory: true,
+    contentType: undefined
+  }));
+}
+
+function makeFiles(count: number): StorageObject[] {
+  return Array.from({ length: count }, (_, i) => ({
+    key: `file${i}.txt`,
+    size: faker.number.int({ min: 100, max: 10000 }),
+    lastModified: faker.date.recent(),
+    isDirectory: false,
+    contentType: 'text/plain'
+  }));
+}
+
+function createState(
+  opts: {
+    bucket?: string;
+    prefix?: string;
+    folders?: StorageObject[];
+    files?: StorageObject[];
+    selectionMode?: boolean;
+    pinned?: Array<{ bucket: string; prefix: string }>;
+  } = {}
+): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = opts.bucket ?? 'test-bucket';
+  state.prefix = opts.prefix ?? '';
+  const objects = [...(opts.folders ?? []), ...(opts.files ?? [])];
+  state.objects = {
+    objects,
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  };
+  if (opts.selectionMode) state.selectionMode = true;
+  if (opts.pinned) {
+    for (const p of opts.pinned) {
+      state.bookmarks.pin(p.bucket, p.prefix);
+    }
+  }
+  return state;
+}
+
+describe('StorageBreadcrumb', () => {
+  describe('root level (no prefix)', () => {
+    it('should render breadcrumb nav', async () => {
+      const state = createState();
+      render(StorageBreadcrumbWrapper, { state });
+
+      await expect
+        .element(page.getByRole('navigation', { name: 'breadcrumb' }))
+        .toBeInTheDocument();
+    });
+
+    it('should show bucket name with aria-current at root', async () => {
+      const state = createState({ bucket: 'my-bucket' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const current = page.getByText('my-bucket');
+      await expect.element(current).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('navigation', { name: 'breadcrumb' }).getByText('my-bucket'))
+        .toHaveAttribute('aria-current', 'page');
+    });
+
+    it('should show folder and file count badges', async () => {
+      const state = createState({ folders: makeFolders(3), files: makeFiles(5) });
+      render(StorageBreadcrumbWrapper, { state });
+
+      await expect.element(page.getByText('3')).toBeInTheDocument();
+      await expect.element(page.getByText('5')).toBeInTheDocument();
+    });
+  });
+
+  describe('single level prefix', () => {
+    it('should show clickable bucket and current folder', async () => {
+      const state = createState({ bucket: 'data', prefix: 'reports/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      // Bucket should be a button (clickable)
+      const bucketBtn = page.getByRole('navigation', { name: 'breadcrumb' }).getByRole('button');
+      await expect.element(bucketBtn.first()).toBeInTheDocument();
+      // Current folder should have aria-current
+      await expect.element(page.getByText('reports')).toHaveAttribute('aria-current', 'page');
+    });
+  });
+
+  describe('deep nesting (collapsed breadcrumbs)', () => {
+    it('should collapse parts when more than 2 levels deep', async () => {
+      // prefix = "alpha/bravo/charlie/delta/" -> 4 parts, should collapse first 2, show last 2
+      const state = createState({ prefix: 'alpha/bravo/charlie/delta/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      // The "..." (more) button should appear
+      await expect
+        .element(
+          page
+            .getByRole('navigation', { name: 'breadcrumb' })
+            .getByRole('button', { name: /more/i })
+        )
+        .toBeInTheDocument();
+      // Last two segments visible
+      await expect.element(page.getByText('charlie')).toBeInTheDocument();
+      await expect.element(page.getByText('delta')).toBeInTheDocument();
+    });
+
+    it('should show 5+ levels with collapse', async () => {
+      const state = createState({ prefix: 'one/two/three/four/five/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      // Only last 2 visible directly
+      await expect.element(page.getByText('four')).toBeInTheDocument();
+      await expect.element(page.getByText('five')).toHaveAttribute('aria-current', 'page');
+    });
+  });
+
+  describe('selection mode toggle', () => {
+    it('should render toggle button with aria-pressed=false by default', async () => {
+      const state = createState();
+      render(StorageBreadcrumbWrapper, { state });
+
+      const toggle = page.getByRole('button', { name: /selection/i });
+      await expect.element(toggle).toHaveAttribute('aria-pressed', 'false');
+    });
+
+    it('should call toggleSelectionMode on click', async () => {
+      const state = createState();
+      const spy = vi.spyOn(state, 'toggleSelectionMode');
+      render(StorageBreadcrumbWrapper, { state });
+
+      await page.getByRole('button', { name: /selection/i }).click();
+      expect(spy).toHaveBeenCalled();
+    });
+
+    it('should reflect active selection mode', async () => {
+      const state = createState({ selectionMode: true });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const toggle = page.getByRole('button', { name: /selection/i });
+      await expect.element(toggle).toHaveAttribute('aria-pressed', 'true');
+    });
+  });
+
+  describe('upload button', () => {
+    it('should render upload button', async () => {
+      const state = createState();
+      render(StorageBreadcrumbWrapper, { state });
+
+      await expect.element(page.getByRole('button', { name: /upload/i })).toBeInTheDocument();
+    });
+
+    it('should call openModal on upload click', async () => {
+      const state = createState({ bucket: 'mybucket', prefix: 'data/' });
+      const spy = vi.spyOn(state, 'openModal');
+      render(StorageBreadcrumbWrapper, { state });
+
+      await page.getByRole('button', { name: /upload/i }).click();
+      expect(spy).toHaveBeenCalledWith('upload', { bucket: 'mybucket', prefix: 'data/' });
+    });
+  });
+
+  describe('special characters in paths', () => {
+    it('should handle paths with spaces', async () => {
+      const state = createState({ prefix: 'my folder/sub dir/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      await expect.element(page.getByText('my folder')).toBeInTheDocument();
+      await expect.element(page.getByText('sub dir')).toBeInTheDocument();
+    });
+
+    it('should handle paths with unicode', async () => {
+      const state = createState({ prefix: 'données/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      await expect.element(page.getByText('données')).toBeInTheDocument();
+    });
+  });
+
+  describe('pin/unpin', () => {
+    it('should show pin option in more options menu', async () => {
+      const state = createState();
+      render(StorageBreadcrumbWrapper, { state });
+
+      // The more options button exists
+      const moreBtn = page.getByRole('button', { name: /more options/i });
+      await expect.element(moreBtn).toBeInTheDocument();
+    });
+
+    it('should show unpin when current location is pinned', async () => {
+      const state = createState({
+        bucket: 'test-bucket',
+        prefix: 'data/',
+        pinned: [{ bucket: 'test-bucket', prefix: 'data/' }]
+      });
+      render(StorageBreadcrumbWrapper, { state });
+
+      // The more menu should contain unpin
+      const menuItems = page.getByRole('menuitem');
+      await expect.element(menuItems.first()).toBeInTheDocument();
+    });
+
+    it('should call pin via more options menu when not pinned', async () => {
+      const state = createState({ bucket: 'test-bucket', prefix: 'data/' });
+      const spy = vi.spyOn(state.bookmarks, 'pin');
+      render(StorageBreadcrumbWrapper, { state });
+
+      // Open the dropdown by focusing/clicking the trigger
+      const moreBtn = page.getByRole('button', { name: /more options/i });
+      await moreBtn.click();
+
+      // DaisyUI dropdown uses focus to show content; click the menuitem
+      const menuItems = page.getByRole('menuitem');
+      // Force the click by using element()
+      const el = menuItems.first();
+      await el.click();
+
+      // If DaisyUI dropdown prevents click, try direct dispatch
+      if (!spy.mock.calls.length) {
+        const domEl = (await el.element()) as HTMLElement;
+        domEl.click();
+      }
+      expect(spy).toHaveBeenCalledWith('test-bucket', 'data/');
+    });
+
+    it('should call unpin via more options menu when pinned', async () => {
+      const state = createState({
+        bucket: 'test-bucket',
+        prefix: 'data/',
+        pinned: [{ bucket: 'test-bucket', prefix: 'data/' }]
+      });
+      const spy = vi.spyOn(state.bookmarks, 'unpin');
+      render(StorageBreadcrumbWrapper, { state });
+
+      // Open the dropdown first
+      const moreBtn = page.getByRole('button', { name: /more options/i });
+      await moreBtn.click();
+
+      const menuItem = page.getByRole('menuitem');
+      await menuItem.first().click();
+      expect(spy).toHaveBeenCalledWith('test-bucket', 'data/');
+    });
+  });
+
+  describe('navigation clicks', () => {
+    it('should navigate to root when clicking bucket button with prefix', async () => {
+      const state = createState({ bucket: 'data', prefix: 'reports/' });
+      const spy = vi.spyOn(state, 'navigate');
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      const bucketBtn = nav.getByRole('button').first();
+      await bucketBtn.click();
+      expect(spy).toHaveBeenCalledWith('');
+    });
+
+    it('should navigate when clicking a collapsed part', async () => {
+      const state = createState({ prefix: 'alpha/bravo/charlie/delta/' });
+      const spy = vi.spyOn(state, 'navigate');
+      render(StorageBreadcrumbWrapper, { state });
+
+      // Click 'alpha' in the collapsed dropdown
+      const alphaBtn = page.getByText('alpha');
+      await alphaBtn.click();
+      expect(spy).toHaveBeenCalledWith('alpha/');
+    });
+
+    it('should navigate when clicking a non-current visible part', async () => {
+      // 3 levels: "a/b/c/" -> visibleParts = all 3 (<=MAX_TAIL is false, 3>2), so last 2 visible
+      // Actually with MAX_TAIL=2, 3 parts -> collapsed=[a], visible=[b,c]
+      // b is non-current, c is current
+      const state = createState({ prefix: 'aaa/bbb/ccc/' });
+      const spy = vi.spyOn(state, 'navigate');
+      render(StorageBreadcrumbWrapper, { state });
+
+      await page.getByText('bbb').click();
+      expect(spy).toHaveBeenCalledWith('aaa/bbb/');
+    });
+
+    it('should not navigate when clicking the current (last) part', async () => {
+      const state = createState({ prefix: 'reports/' });
+      const spy = vi.spyOn(state, 'navigate');
+      render(StorageBreadcrumbWrapper, { state });
+
+      // Current part is a span, not a button - clicking should not navigate
+      const current = page.getByText('reports');
+      await expect.element(current).toHaveAttribute('aria-current', 'page');
+      expect(spy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('inline pin buttons', () => {
+    it('should pin bucket at root level via inline pin button', async () => {
+      const state = createState({ bucket: 'test-bucket' });
+      const spy = vi.spyOn(state.bookmarks, 'pin');
+      render(StorageBreadcrumbWrapper, { state });
+
+      const pinBtn = page.getByRole('button', { name: /pin/i }).first();
+      await pinBtn.click();
+      expect(spy).toHaveBeenCalledWith('test-bucket', '');
+    });
+
+    it('should unpin bucket at root level via inline pin button when pinned', async () => {
+      const state = createState({
+        bucket: 'test-bucket',
+        pinned: [{ bucket: 'test-bucket', prefix: '' }]
+      });
+      const spy = vi.spyOn(state.bookmarks, 'unpin');
+      render(StorageBreadcrumbWrapper, { state });
+
+      const pinBtn = page.getByRole('button', { name: /unpin/i }).first();
+      await pinBtn.click();
+      expect(spy).toHaveBeenCalledWith('test-bucket', '');
+    });
+  });
+
+  describe('breadcrumb context menu', () => {
+    it('should open context menu on right-click of bucket at root', async () => {
+      const state = createState({ bucket: 'test-bucket' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      const bucketEl = nav.getByText('test-bucket');
+      await bucketEl.click({ button: 'right' });
+
+      // Context menu should appear with a pin/unpin menuitem
+      const menuItem = page.getByRole('menuitem');
+      await expect.element(menuItem.first()).toBeInTheDocument();
+    });
+
+    it('should pin via context menu when not pinned', async () => {
+      const state = createState({ bucket: 'test-bucket' });
+      const spy = vi.spyOn(state.bookmarks, 'pin');
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      const bucketEl = nav.getByText('test-bucket');
+      await bucketEl.click({ button: 'right' });
+
+      const menuItem = page.getByRole('menuitem');
+      await menuItem.first().click();
+      expect(spy).toHaveBeenCalledWith('test-bucket', '');
+    });
+
+    it('should unpin via context menu when pinned', async () => {
+      const state = createState({
+        bucket: 'test-bucket',
+        pinned: [{ bucket: 'test-bucket', prefix: '' }]
+      });
+      const spy = vi.spyOn(state.bookmarks, 'unpin');
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      const bucketEl = nav.getByText('test-bucket');
+      await bucketEl.click({ button: 'right' });
+
+      const menuItem = page.getByRole('menuitem');
+      await menuItem.first().click();
+      expect(spy).toHaveBeenCalledWith('test-bucket', '');
+    });
+
+    it('should close context menu when clicking outside', async () => {
+      const state = createState({ bucket: 'test-bucket' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      const bucketEl = nav.getByText('test-bucket');
+      await bucketEl.click({ button: 'right' });
+
+      // Context menu should be open - it's the fixed-position menu
+      const ctxMenuItems = page.getByRole('menuitem');
+      await expect.element(ctxMenuItems.first()).toBeInTheDocument();
+
+      // The backdrop is a fixed inset-0 div that's a sibling before the context menu
+      // Dispatch mousedown on it to trigger closeBreadcrumbCtx
+      const menuEl = (await ctxMenuItems.first().element()) as HTMLElement;
+      const menuUl = menuEl.closest('ul[role="menu"]')!;
+      const backdrop = menuUl.previousElementSibling as HTMLElement;
+      backdrop.dispatchEvent(new MouseEvent('mousedown', { bubbles: true }));
+
+      // Context menu should be closed - menuitem from ctx menu should be gone
+      // The only remaining menuitem should be from the more options dropdown
+      await expect.element(page.getByRole('menuitem')).toBeInTheDocument(); // the one in more options
+    });
+
+    it('should open context menu on right-click of bucket with prefix', async () => {
+      const state = createState({ bucket: 'data', prefix: 'reports/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      const bucketBtn = nav.getByText('data');
+      await bucketBtn.click({ button: 'right' });
+
+      const menuItem = page.getByRole('menuitem');
+      await expect.element(menuItem.first()).toBeInTheDocument();
+    });
+
+    it('should open context menu on right-click of current folder', async () => {
+      const state = createState({ bucket: 'data', prefix: 'reports/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const currentEl = page.getByText('reports');
+      await currentEl.click({ button: 'right' });
+
+      const menuItem = page.getByRole('menuitem');
+      await expect.element(menuItem.first()).toBeInTheDocument();
+    });
+
+    it('should open context menu on right-click of non-current visible part', async () => {
+      const state = createState({ prefix: 'aaa/bbb/ccc/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const partEl = page.getByText('bbb');
+      await partEl.click({ button: 'right' });
+
+      const menuItem = page.getByRole('menuitem');
+      await expect.element(menuItem.first()).toBeInTheDocument();
+    });
+
+    it('should open context menu on right-click of collapsed part', async () => {
+      const state = createState({ prefix: 'alpha/bravo/charlie/delta/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      const partEl = page.getByText('alpha');
+      await partEl.click({ button: 'right' });
+
+      const menuItem = page.getByRole('menuitem');
+      await expect.element(menuItem.first()).toBeInTheDocument();
+    });
+  });
+
+  describe('exactly MAX_TAIL levels', () => {
+    it('should show all parts without collapse for exactly 2 levels', async () => {
+      const state = createState({ prefix: 'aaa/bbb/' });
+      render(StorageBreadcrumbWrapper, { state });
+
+      await expect.element(page.getByText('aaa')).toBeInTheDocument();
+      await expect.element(page.getByText('bbb')).toHaveAttribute('aria-current', 'page');
+      // No collapse button
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      const moreBtn = nav.getByRole('button', { name: /more/i });
+      await expect.element(moreBtn).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte b/src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte
new file mode 100644
index 00000000..8307de87
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte
@@ -0,0 +1,15 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import ContextMenu from '../ContextMenu.svelte';
+
+  interface Props {
+    state: StorageState;
+  }
+
+  let { state }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<ContextMenu />
diff --git a/src/lib/components/storage/explorer/__tests__/ContextWrapper.svelte b/src/lib/components/storage/explorer/__tests__/ContextWrapper.svelte
new file mode 100644
index 00000000..4e200081
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/ContextWrapper.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import type { Snippet } from 'svelte';
+
+  interface Props {
+    state: StorageState;
+    children: Snippet;
+  }
+
+  let { state, children }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+{@render children()}
diff --git a/src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte b/src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte
new file mode 100644
index 00000000..7106df4f
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte
@@ -0,0 +1,15 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import FileExplorer from '../FileExplorer.svelte';
+
+  interface Props {
+    state: StorageState;
+  }
+
+  let { state }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<FileExplorer />
diff --git a/src/lib/components/storage/explorer/__tests__/FileRowWrapper.svelte b/src/lib/components/storage/explorer/__tests__/FileRowWrapper.svelte
new file mode 100644
index 00000000..0c4823f5
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/FileRowWrapper.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import type { StorageObject } from '$lib/storage/types.js';
+  import FileRow from '../FileRow.svelte';
+
+  interface Props {
+    state: StorageState;
+    file: StorageObject;
+  }
+
+  let { state, file }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<table>
+  <tbody>
+    <FileRow {file} />
+  </tbody>
+</table>
diff --git a/src/lib/components/storage/explorer/__tests__/FolderRowWrapper.svelte b/src/lib/components/storage/explorer/__tests__/FolderRowWrapper.svelte
new file mode 100644
index 00000000..7fc6718c
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/FolderRowWrapper.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import type { StorageObject } from '$lib/storage/types.js';
+  import FolderRow from '../FolderRow.svelte';
+
+  interface Props {
+    state: StorageState;
+    folder: StorageObject;
+  }
+
+  let { state, folder }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<table>
+  <tbody>
+    <FolderRow {folder} />
+  </tbody>
+</table>
diff --git a/src/lib/components/storage/explorer/__tests__/ObjectTableWrapper.svelte b/src/lib/components/storage/explorer/__tests__/ObjectTableWrapper.svelte
new file mode 100644
index 00000000..24d47f5e
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/ObjectTableWrapper.svelte
@@ -0,0 +1,15 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import ObjectTable from '../ObjectTable.svelte';
+
+  interface Props {
+    state: StorageState;
+  }
+
+  let { state }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<ObjectTable />
diff --git a/src/lib/components/storage/explorer/__tests__/SelectionToolbarWrapper.svelte b/src/lib/components/storage/explorer/__tests__/SelectionToolbarWrapper.svelte
new file mode 100644
index 00000000..a6bfaa05
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/SelectionToolbarWrapper.svelte
@@ -0,0 +1,19 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import SelectionToolbar from '../SelectionToolbar.svelte';
+
+  interface Props {
+    state: StorageState;
+  }
+
+  let { state }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<table>
+  <thead>
+    <SelectionToolbar />
+  </thead>
+</table>
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
new file mode 100644
index 00000000..073599f2
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
@@ -0,0 +1,15 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import StorageBreadcrumb from '../StorageBreadcrumb.svelte';
+
+  interface Props {
+    state: StorageState;
+  }
+
+  let { state }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<StorageBreadcrumb />
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
new file mode 100644
index 00000000..fb093e5f
--- /dev/null
+++ b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
@@ -0,0 +1,85 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import BucketGrid from './BucketGrid.svelte';
+
+describe('BucketGrid', () => {
+  it('should show empty message when no buckets provided', async () => {
+    render(BucketGrid);
+    await expect.element(page.getByText('No buckets found')).toBeInTheDocument();
+  });
+
+  it('should show empty message when buckets array is empty', async () => {
+    render(BucketGrid, { buckets: [] });
+    await expect.element(page.getByText('No buckets found')).toBeInTheDocument();
+  });
+
+  it('should render bucket links when buckets are provided', async () => {
+    const buckets = ['my-bucket', 'other-bucket'];
+    render(BucketGrid, { buckets });
+
+    const links = page.getByRole('link');
+    await expect.element(links.nth(0)).toBeInTheDocument();
+    await expect.element(links.nth(1)).toBeInTheDocument();
+  });
+
+  it('should display bucket name in each link', async () => {
+    const buckets = ['data-lake', 'backups'];
+    render(BucketGrid, { buckets });
+
+    await expect.element(page.getByText('data-lake')).toBeInTheDocument();
+    await expect.element(page.getByText('backups')).toBeInTheDocument();
+  });
+
+  it('should encode bucket names in href', async () => {
+    const buckets = ['bucket with spaces'];
+    render(BucketGrid, { buckets });
+
+    const link = page.getByRole('link');
+    await expect
+      .element(link)
+      .toHaveAttribute('href', expect.stringContaining('bucket%20with%20spaces'));
+  });
+
+  it('should handle special characters in bucket names', async () => {
+    const buckets = ['my-bucket/special', 'name+plus', 'unicode-ñ-ü'];
+    render(BucketGrid, { buckets });
+
+    await expect.element(page.getByText('my-bucket/special')).toBeInTheDocument();
+    await expect.element(page.getByText('name+plus')).toBeInTheDocument();
+    await expect.element(page.getByText('unicode-ñ-ü')).toBeInTheDocument();
+  });
+
+  it('should have tooltip with bucket name', async () => {
+    const buckets = ['tooltip-bucket'];
+    render(BucketGrid, { buckets });
+
+    const tooltip = page.getByText('tooltip-bucket').element().closest('[data-tip]');
+    expect(tooltip?.getAttribute('data-tip')).toBe('tooltip-bucket');
+  });
+
+  it('should render a large number of buckets', async () => {
+    const buckets = Array.from({ length: 100 }, () => faker.string.alphanumeric(10));
+    render(BucketGrid, { buckets });
+
+    const links = page.getByRole('link');
+    await expect.element(links.nth(99)).toBeInTheDocument();
+  });
+
+  it('should handle very long bucket names', async () => {
+    const longName = faker.string.alphanumeric(200);
+    render(BucketGrid, { buckets: [longName] });
+
+    await expect.element(page.getByText(longName)).toBeInTheDocument();
+  });
+
+  it('should handle unicode bucket names', async () => {
+    const buckets = ['日本語バケット', '中文桶', 'émojis-🪣'];
+    render(BucketGrid, { buckets });
+
+    await expect.element(page.getByText('日本語バケット')).toBeInTheDocument();
+    await expect.element(page.getByText('中文桶')).toBeInTheDocument();
+    await expect.element(page.getByText('émojis-🪣')).toBeInTheDocument();
+  });
+});
diff --git a/src/lib/components/storage/landing/RecentItems.svelte.spec.ts b/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
new file mode 100644
index 00000000..a84e92cf
--- /dev/null
+++ b/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
@@ -0,0 +1,231 @@
+import { page } from 'vitest/browser';
+import { beforeEach, describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import RecentItemsWrapper from './__tests__/RecentItemsWrapper.svelte';
+import { StorageState } from '$lib/storage/state.svelte.js';
+import type { RecentFile, RecentLocation } from '$lib/storage/types.js';
+
+function makeRecentFile(overrides: Partial<RecentFile> = {}): RecentFile {
+  return {
+    key: overrides.key ?? `folder/${faker.system.fileName()}`,
+    bucket: overrides.bucket ?? 'test-bucket',
+    size: overrides.size ?? faker.number.int({ min: 100, max: 1_000_000 }),
+    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString()
+  };
+}
+
+function makeRecentLocation(overrides: Partial<RecentLocation> = {}): RecentLocation {
+  return {
+    bucket: overrides.bucket ?? 'test-bucket',
+    prefix: overrides.prefix ?? `${faker.word.noun()}/`,
+    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString()
+  };
+}
+
+function createState(
+  opts: {
+    recentFiles?: RecentFile[];
+    recentLocations?: RecentLocation[];
+  } = {}
+): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = '';
+  if (opts.recentFiles) {
+    for (const f of opts.recentFiles) {
+      state.bookmarks.recentFiles.push(f);
+    }
+  }
+  if (opts.recentLocations) {
+    for (const l of opts.recentLocations) {
+      state.bookmarks.recentLocations.push(l);
+    }
+  }
+  return state;
+}
+
+describe('RecentItems', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  describe('tab interface', () => {
+    it('should render tablist with two tabs', async () => {
+      const state = createState();
+      render(RecentItemsWrapper, { state });
+
+      await expect.element(page.getByRole('tablist')).toBeInTheDocument();
+      const tabs = page.getByRole('tab');
+      await expect.element(tabs.nth(0)).toBeInTheDocument();
+      await expect.element(tabs.nth(1)).toBeInTheDocument();
+    });
+
+    it('should have files tab selected by default', async () => {
+      const state = createState();
+      render(RecentItemsWrapper, { state });
+
+      const filesTab = page.getByRole('tab').first();
+      await expect.element(filesTab).toHaveAttribute('aria-selected', 'true');
+    });
+
+    it('should switch to locations tab on click', async () => {
+      const state = createState({ recentLocations: [makeRecentLocation()] });
+      render(RecentItemsWrapper, { state });
+
+      const locationsTab = page.getByRole('tab').nth(1);
+      await locationsTab.click();
+      await expect.element(locationsTab).toHaveAttribute('aria-selected', 'true');
+    });
+  });
+
+  describe('files tab', () => {
+    it('should show empty state when no recent files', async () => {
+      const state = createState();
+      render(RecentItemsWrapper, { state });
+
+      await expect.element(page.getByText(/no recent/i)).toBeInTheDocument();
+    });
+
+    it('should show file name in table', async () => {
+      const state = createState({ recentFiles: [makeRecentFile({ key: 'docs/report.pdf' })] });
+      render(RecentItemsWrapper, { state });
+
+      await expect.element(page.getByText('report.pdf')).toBeInTheDocument();
+    });
+
+    it('should show file size', async () => {
+      const state = createState({ recentFiles: [makeRecentFile({ key: 'a.txt', size: 2048 })] });
+      render(RecentItemsWrapper, { state });
+
+      await expect.element(page.getByText(/2.*kB/)).toBeInTheDocument();
+    });
+
+    it('should show multiple files', async () => {
+      const files = [
+        makeRecentFile({ key: 'one.txt', bucket: 'b1' }),
+        makeRecentFile({ key: 'two.csv', bucket: 'b2' }),
+        makeRecentFile({ key: 'three.json', bucket: 'b3' })
+      ];
+      const state = createState({ recentFiles: files });
+      render(RecentItemsWrapper, { state });
+
+      await expect.element(page.getByText('one.txt')).toBeInTheDocument();
+      await expect.element(page.getByText('two.csv')).toBeInTheDocument();
+      await expect.element(page.getByText('three.json')).toBeInTheDocument();
+    });
+
+    it('should have preview button with aria-label', async () => {
+      const state = createState({ recentFiles: [makeRecentFile({ key: 'data/file.txt' })] });
+      render(RecentItemsWrapper, { state });
+
+      const previewBtn = page.getByRole('button', { name: /preview.*file\.txt/i });
+      await expect.element(previewBtn).toBeInTheDocument();
+    });
+
+    it('should have open folder link with aria-label', async () => {
+      const state = createState({ recentFiles: [makeRecentFile({ key: 'data/file.txt' })] });
+      render(RecentItemsWrapper, { state });
+
+      const folderLink = page.getByRole('link', { name: /open folder.*file\.txt/i });
+      await expect.element(folderLink).toBeInTheDocument();
+    });
+  });
+
+  describe('locations tab', () => {
+    it('should show empty state when no recent locations', async () => {
+      const state = createState();
+      render(RecentItemsWrapper, { state });
+
+      await page.getByRole('tab').nth(1).click();
+      await expect.element(page.getByText(/no recent/i)).toBeInTheDocument();
+    });
+
+    it('should show location name', async () => {
+      const state = createState({
+        recentLocations: [makeRecentLocation({ bucket: 'data-lake', prefix: 'reports/' })]
+      });
+      render(RecentItemsWrapper, { state });
+
+      await page.getByRole('tab').nth(1).click();
+      await expect
+        .element(page.getByRole('link', { name: 'reports', exact: true }))
+        .toBeInTheDocument();
+    });
+
+    it('should show bucket name for root locations', async () => {
+      const state = createState({
+        recentLocations: [makeRecentLocation({ bucket: 'my-bucket', prefix: '' })]
+      });
+      render(RecentItemsWrapper, { state });
+
+      await page.getByRole('tab').nth(1).click();
+      const link = page.getByRole('link', { name: 'my-bucket', exact: true });
+      await expect.element(link.first()).toBeInTheDocument();
+    });
+
+    it('should show navigate link with aria-label', async () => {
+      const state = createState({
+        recentLocations: [makeRecentLocation({ bucket: 'b', prefix: 'pathdir/' })]
+      });
+      render(RecentItemsWrapper, { state });
+
+      await page.getByRole('tab').nth(1).click();
+      const navLink = page.getByRole('link', { name: /go to.*pathdir/i });
+      await expect.element(navLink).toBeInTheDocument();
+    });
+
+    it('should show multiple locations', async () => {
+      const locs = [
+        makeRecentLocation({ bucket: 'b1', prefix: 'alpha/' }),
+        makeRecentLocation({ bucket: 'b2', prefix: 'beta/' })
+      ];
+      const state = createState({ recentLocations: locs });
+      render(RecentItemsWrapper, { state });
+
+      await page.getByRole('tab').nth(1).click();
+      await expect
+        .element(page.getByRole('link', { name: 'alpha', exact: true }))
+        .toBeInTheDocument();
+      await expect
+        .element(page.getByRole('link', { name: 'beta', exact: true }))
+        .toBeInTheDocument();
+    });
+  });
+
+  describe('preview modal', () => {
+    it('should open preview modal when preview button is clicked', async () => {
+      const state = createState({
+        recentFiles: [makeRecentFile({ key: 'docs/report.pdf', bucket: 'my-bucket' })]
+      });
+      render(RecentItemsWrapper, { state });
+
+      const previewBtn = page.getByRole('button', { name: /preview.*report\.pdf/i });
+      await previewBtn.click();
+
+      // The PreviewModal should now be open (rendered as a dialog)
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+  });
+
+  describe('tab switching', () => {
+    it('should switch back to files tab after viewing locations', async () => {
+      const state = createState({
+        recentFiles: [makeRecentFile({ key: 'file.txt' })],
+        recentLocations: [makeRecentLocation({ prefix: 'data/' })]
+      });
+      render(RecentItemsWrapper, { state });
+
+      // Switch to locations
+      const locationsTab = page.getByRole('tab').nth(1);
+      await locationsTab.click();
+      await expect.element(locationsTab).toHaveAttribute('aria-selected', 'true');
+
+      // Switch back to files
+      const filesTab = page.getByRole('tab').first();
+      await filesTab.click();
+      await expect.element(filesTab).toHaveAttribute('aria-selected', 'true');
+      await expect.element(page.getByText('file.txt')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte b/src/lib/components/storage/landing/StorageConnectForm.svelte
index 020da40b..7341b8ef 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte
@@ -2,7 +2,7 @@
   import type { SuperValidated } from 'sveltekit-superforms';
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
-  import { onMount, tick } from 'svelte';
+  import { onMount, tick, untrack } from 'svelte';
   import IconClose from 'virtual:icons/material-symbols/close';
   import IconStorage from 'virtual:icons/material-symbols/storage';
   import * as m from '$lib/paraglide/messages.js';
@@ -34,16 +34,19 @@
   /** Connection pending the "Forget" confirmation. */
   let forgetCandidate: StoredConnection | null = $state(null);
 
-  const { form, errors, enhance, submitting, message } = superForm(connectionForm, {
-    validators: zod(StorageConnectionSchema),
-    onResult: ({ result }) => {
-      if (result.type === 'redirect') {
-        saveConnectionLocally($form);
-      } else {
-        autoConnecting = false;
+  const { form, errors, enhance, submitting, message } = superForm(
+    untrack(() => connectionForm),
+    {
+      validators: zod(StorageConnectionSchema),
+      onResult: ({ result }) => {
+        if (result.type === 'redirect') {
+          saveConnectionLocally($form);
+        } else {
+          autoConnecting = false;
+        }
       }
     }
-  });
+  );
 
   /** Display label for a saved connection (hostname or "AWS S3"). */
   function connectionLabel(conn: StoredConnection): string {
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
new file mode 100644
index 00000000..26cd521e
--- /dev/null
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
@@ -0,0 +1,507 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import type { ComponentProps } from 'svelte';
+import StorageConnectForm from './StorageConnectForm.svelte';
+
+type ConnectionFormProp = ComponentProps<typeof StorageConnectForm>['connectionForm'];
+
+// Mock feature flags to disable auto-connect
+vi.mock('$lib/client/feature-flags.js', () => ({
+  storageAutoConnectEnabled: false
+}));
+
+// Mock connection-storage module
+vi.mock('$lib/storage/connection-storage.js', () => ({
+  saveConnectionLocally: vi.fn(),
+  loadConnectionLocally: vi.fn(() => null),
+  loadAllConnectionsLocally: vi.fn(() => []),
+  removeConnectionLocally: vi.fn()
+}));
+
+// Mock paraglide messages
+vi.mock('$lib/paraglide/messages.js', () => ({
+  storage_connect_title: () => 'Connect to Storage',
+  storage_connect_subtitle: () => 'Enter your connection details',
+  storage_connect_reconnecting: () => 'Reconnecting...',
+  storage_connect_saved: () => 'Saved connections',
+  storage_connect_no_saved: () => 'No saved connections yet',
+  storage_connect_type: () => 'Backend type',
+  storage_connect_type_s3: () => 'Amazon S3',
+  storage_connect_type_hdfs: () => 'HDFS',
+  storage_connect_endpoint: () => 'Endpoint URL',
+  storage_connect_endpoint_placeholder: () => 'https://s3.example.com',
+  storage_connect_endpoint_hint: () => 'Leave empty for AWS S3',
+  storage_connect_path_style: () => 'Path-style addressing',
+  storage_connect_path_style_hint: () => 'Use path-style URLs',
+  storage_connect_region: () => 'Region',
+  storage_connect_access_key: () => 'Access key ID',
+  storage_connect_secret_key: () => 'Secret access key',
+  storage_connect_submit: () => 'Connect',
+  storage_connect_forget_label: ({ endpoint }: { endpoint: string }) => `Forget ${endpoint}`,
+  storage_connect_forget_confirm: ({ endpoint }: { endpoint: string }) =>
+    `Forget connection to ${endpoint}?`,
+  storage_connect_forget_cancel: () => 'Cancel',
+  storage_connect_forget: () => 'Forget'
+}));
+
+function createMockForm(overrides: Record<string, unknown> = {}): ConnectionFormProp {
+  return {
+    valid: true,
+    posted: false,
+    errors: {},
+    data: {
+      type: 's3' as const,
+      endpoint: '',
+      pathStyle: true,
+      region: 'eu-central-1',
+      accessKeyId: '',
+      secretAccessKey: ''
+    },
+    id: 'test-form',
+    constraints: {},
+    shape: {},
+    message: undefined,
+    tainted: undefined,
+    ...overrides
+  } as unknown as ConnectionFormProp;
+}
+
+describe('StorageConnectForm', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('should render the form title and subtitle', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('Connect to Storage')).toBeInTheDocument();
+    await expect.element(page.getByText('Enter your connection details')).toBeInTheDocument();
+  });
+
+  it('should render all form fields with labels', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByLabelText('Backend type')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Endpoint URL')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Path-style addressing')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Region')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Access key ID')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Secret access key')).toBeInTheDocument();
+  });
+
+  it('should render backend type as a select with S3 option', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const select = page.getByLabelText('Backend type');
+    await expect.element(select).toBeInTheDocument();
+    await expect.element(page.getByText('Amazon S3')).toBeInTheDocument();
+    await expect.element(page.getByText('HDFS')).toBeInTheDocument();
+  });
+
+  it('should render endpoint as url input', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const input = page.getByLabelText('Endpoint URL');
+    await expect.element(input).toHaveAttribute('type', 'url');
+  });
+
+  it('should render path-style as a checkbox', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const toggle = page.getByLabelText('Path-style addressing');
+    await expect.element(toggle).toHaveAttribute('type', 'checkbox');
+  });
+
+  it('should render secret access key as password input', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const input = page.getByLabelText('Secret access key');
+    await expect.element(input).toHaveAttribute('type', 'password');
+  });
+
+  it('should render connect button', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByRole('button', { name: 'Connect' })).toBeInTheDocument();
+  });
+
+  it('should show no saved connections message when none exist', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('No saved connections yet')).toBeInTheDocument();
+  });
+
+  it('should show saved connections when present', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://minio.example.com',
+        pathStyle: true,
+        region: 'us-east-1',
+        accessKeyId: 'AKIA123',
+        secretAccessKey: 'secret'
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('minio.example.com')).toBeInTheDocument();
+  });
+
+  it('should show forget button for saved connections', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://s3.test.io',
+        pathStyle: true,
+        region: 'eu-west-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect
+      .element(page.getByRole('button', { name: 'Forget s3.test.io' }))
+      .toBeInTheDocument();
+  });
+
+  it('should open forget confirmation dialog when forget button clicked', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://s3.remove.io',
+        pathStyle: true,
+        region: 'eu-west-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const forgetBtn = page.getByRole('button', { name: 'Forget s3.remove.io' });
+    await forgetBtn.click();
+
+    await expect.element(page.getByText('Forget connection to s3.remove.io?')).toBeInTheDocument();
+    await expect.element(page.getByRole('button', { name: 'Cancel' })).toBeInTheDocument();
+    await expect
+      .element(page.getByRole('button', { name: 'Forget', exact: true }))
+      .toBeInTheDocument();
+  });
+
+  it('should show multiple saved connections', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://first.example.com',
+        pathStyle: true,
+        region: 'us-east-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      },
+      {
+        type: 's3',
+        endpoint: 'https://second.example.com',
+        pathStyle: false,
+        region: 'eu-west-1',
+        accessKeyId: faker.string.alphanumeric(20),
+        secretAccessKey: faker.string.alphanumeric(40)
+      },
+      {
+        type: 's3',
+        endpoint: '',
+        pathStyle: false,
+        region: 'us-west-2',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('first.example.com')).toBeInTheDocument();
+    await expect.element(page.getByText('second.example.com')).toBeInTheDocument();
+    await expect.element(page.getByText('AWS S3', { exact: true })).toBeInTheDocument();
+  });
+
+  it('should render saved connections in a list role', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://listed.example.com',
+        pathStyle: true,
+        region: 'us-east-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByRole('list')).toBeInTheDocument();
+    await expect.element(page.getByRole('listitem')).toBeInTheDocument();
+  });
+
+  it('should render endpoint hint text', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('Leave empty for AWS S3')).toBeInTheDocument();
+  });
+
+  it('should render form with POST method', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const form = page.getByRole('button', { name: 'Connect' }).element().closest('form');
+    expect(form?.getAttribute('method')).toBe('POST');
+  });
+
+  it('should close forget dialog when cancel is clicked', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://s3.cancel.io',
+        pathStyle: true,
+        region: 'eu-west-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await page.getByRole('button', { name: 'Forget s3.cancel.io' }).click();
+    await expect.element(page.getByText('Forget connection to s3.cancel.io?')).toBeInTheDocument();
+
+    await page.getByRole('button', { name: 'Cancel', exact: true }).click();
+    await expect
+      .element(page.getByText('Forget connection to s3.cancel.io?'))
+      .not.toBeInTheDocument();
+  });
+
+  it('should remove connection when forget is confirmed', async () => {
+    const { loadAllConnectionsLocally, removeConnectionLocally } =
+      await import('$lib/storage/connection-storage.js');
+    const conn = {
+      type: 's3' as const,
+      endpoint: 'https://s3.forget.io',
+      pathStyle: true,
+      region: 'eu-west-1',
+      accessKeyId: '',
+      secretAccessKey: ''
+    };
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([conn]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await page.getByRole('button', { name: 'Forget s3.forget.io' }).click();
+    // After clicking forget, mock returns empty list
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([]);
+    await page.getByRole('button', { name: 'Forget', exact: true }).click();
+
+    expect(removeConnectionLocally).toHaveBeenCalledWith(conn);
+    await expect.element(page.getByText('No saved connections yet')).toBeInTheDocument();
+  });
+
+  it('should show connection label with invalid URL as raw endpoint', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'not-a-valid-url',
+        pathStyle: true,
+        region: 'us-east-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('not-a-valid-url')).toBeInTheDocument();
+  });
+
+  it('should show AWS S3 label when endpoint is undefined', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: undefined,
+        pathStyle: false,
+        region: 'us-west-2',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('AWS S3', { exact: true })).toBeInTheDocument();
+  });
+
+  it('should display endpoint error when form has endpoint errors', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({
+        errors: { endpoint: ['Must be a valid URL'] }
+      })
+    });
+
+    await expect.element(page.getByText('Must be a valid URL')).toBeInTheDocument();
+    const input = page.getByLabelText('Endpoint URL');
+    const classes = input.element().className;
+    expect(classes).toContain('input-error');
+  });
+
+  it('should display region error when form has region errors', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({
+        errors: { region: ['Region is required'] }
+      })
+    });
+
+    await expect.element(page.getByText('Region is required')).toBeInTheDocument();
+    const input = page.getByLabelText('Region');
+    expect(input.element().className).toContain('input-error');
+  });
+
+  it('should display accessKeyId error', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({
+        errors: { accessKeyId: ['Access key ID is required when secret access key is provided'] }
+      })
+    });
+
+    await expect
+      .element(page.getByText('Access key ID is required when secret access key is provided'))
+      .toBeInTheDocument();
+    const input = page.getByLabelText('Access key ID');
+    expect(input.element().className).toContain('input-error');
+  });
+
+  it('should display secretAccessKey error', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({
+        errors: {
+          secretAccessKey: ['Secret access key is required when access key ID is provided']
+        }
+      })
+    });
+
+    await expect
+      .element(page.getByText('Secret access key is required when access key ID is provided'))
+      .toBeInTheDocument();
+    const input = page.getByLabelText('Secret access key');
+    expect(input.element().className).toContain('input-error');
+  });
+
+  it('should display server message when present', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({
+        message: 'Connection refused: unable to reach endpoint'
+      })
+    });
+
+    await expect
+      .element(page.getByText('Connection refused: unable to reach endpoint'))
+      .toBeInTheDocument();
+  });
+
+  it('should fill form fields when a saved connection is clicked', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://s3.select.io',
+        pathStyle: false,
+        region: 'ap-southeast-1',
+        accessKeyId: 'AKIASELECT',
+        secretAccessKey: 'secretselect'
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    // Click the saved connection button
+    await page.getByRole('button', { name: 's3.select.io', exact: true }).click();
+
+    // Verify form fields are filled
+    await expect.element(page.getByLabelText('Endpoint URL')).toHaveValue('https://s3.select.io');
+    await expect.element(page.getByLabelText('Region')).toHaveValue('ap-southeast-1');
+    await expect.element(page.getByLabelText('Access key ID')).toHaveValue('AKIASELECT');
+    await expect.element(page.getByLabelText('Secret access key')).toHaveValue('secretselect');
+  });
+
+  it('should show saved connections heading when connections exist', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://heading.example.com',
+        pathStyle: true,
+        region: 'us-east-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await expect.element(page.getByText('Saved connections')).toBeInTheDocument();
+  });
+
+  it('should display multiple field errors simultaneously', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({
+        errors: {
+          endpoint: ['Must be a valid URL'],
+          region: ['Region is required'],
+          accessKeyId: ['Access key required'],
+          secretAccessKey: ['Secret key required']
+        },
+        message: 'Validation failed'
+      })
+    });
+
+    await expect.element(page.getByText('Must be a valid URL')).toBeInTheDocument();
+    await expect.element(page.getByText('Region is required')).toBeInTheDocument();
+    await expect.element(page.getByText('Access key required')).toBeInTheDocument();
+    await expect.element(page.getByText('Secret key required')).toBeInTheDocument();
+    await expect.element(page.getByText('Validation failed')).toBeInTheDocument();
+  });
+
+  it('should close forget dialog via backdrop button', async () => {
+    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
+    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
+      {
+        type: 's3',
+        endpoint: 'https://s3.backdrop.io',
+        pathStyle: true,
+        region: 'eu-west-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    ]);
+
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    await page.getByRole('button', { name: 'Forget s3.backdrop.io' }).click();
+    await expect
+      .element(page.getByText('Forget connection to s3.backdrop.io?'))
+      .toBeInTheDocument();
+
+    // Click the backdrop close button
+    await page.getByRole('button', { name: 'close' }).click();
+    await expect
+      .element(page.getByText('Forget connection to s3.backdrop.io?'))
+      .not.toBeInTheDocument();
+  });
+});
diff --git a/src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte b/src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte
new file mode 100644
index 00000000..4f3cf0eb
--- /dev/null
+++ b/src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte
@@ -0,0 +1,15 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import RecentItems from '../RecentItems.svelte';
+
+  interface Props {
+    state: StorageState;
+  }
+
+  let { state }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<RecentItems />
diff --git a/src/lib/components/storage/modals/DeleteConfirmModal.svelte.spec.ts b/src/lib/components/storage/modals/DeleteConfirmModal.svelte.spec.ts
new file mode 100644
index 00000000..f94f91e3
--- /dev/null
+++ b/src/lib/components/storage/modals/DeleteConfirmModal.svelte.spec.ts
@@ -0,0 +1,163 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import DeleteConfirmModal from './DeleteConfirmModal.svelte';
+
+const defaultProps = {
+  open: true,
+  keys: ['file.txt'],
+  onConfirm: () => {},
+  onCancel: () => {}
+};
+
+describe('DeleteConfirmModal', () => {
+  describe('single file deletion', () => {
+    it('should show heading with file name for single key', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: ['report.csv'] });
+
+      await expect
+        .element(page.getByRole('heading', { name: /Delete "report.csv"/ }))
+        .toBeInTheDocument();
+    });
+
+    it('should show confirmation message', async () => {
+      render(DeleteConfirmModal, defaultProps);
+
+      await expect.element(page.getByText('This action cannot be undone.')).toBeInTheDocument();
+    });
+
+    it('should extract filename from path', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: ['path/to/deep/file.txt'] });
+
+      await expect
+        .element(page.getByRole('heading', { name: /Delete "file.txt"/ }))
+        .toBeInTheDocument();
+    });
+  });
+
+  describe('multiple file deletion', () => {
+    it('should show count in heading for multiple keys', async () => {
+      const keys = ['a.txt', 'b.txt', 'c.txt'];
+      render(DeleteConfirmModal, { ...defaultProps, keys });
+
+      await expect
+        .element(page.getByRole('heading', { name: /Delete 3 items/ }))
+        .toBeInTheDocument();
+    });
+
+    it('should handle large number of keys', async () => {
+      const keys = Array.from({ length: 50 }, () => faker.system.fileName());
+      render(DeleteConfirmModal, { ...defaultProps, keys });
+
+      await expect
+        .element(page.getByRole('heading', { name: /Delete 50 items/ }))
+        .toBeInTheDocument();
+    });
+  });
+
+  describe('directory warning', () => {
+    it('should show warning when keys include directories', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: ['folder/'] });
+
+      await expect
+        .element(page.getByText('All contents will be permanently deleted'))
+        .toBeInTheDocument();
+    });
+
+    it('should show warning body text for directories', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: ['data/subfolder/'] });
+
+      await expect
+        .element(page.getByText(/Deleting a folder removes every file/))
+        .toBeInTheDocument();
+    });
+
+    it('should not show warning for regular files', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: ['file.txt'] });
+
+      const warning = page.getByText('All contents will be permanently deleted');
+      await expect.element(warning).not.toBeInTheDocument();
+    });
+
+    it('should show warning when mix of files and directories', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: ['file.txt', 'folder/'] });
+
+      await expect
+        .element(page.getByText('All contents will be permanently deleted'))
+        .toBeInTheDocument();
+    });
+
+    it('should have alert role on warning', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: ['folder/'] });
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+
+  describe('button interactions', () => {
+    it('should render cancel and delete buttons', async () => {
+      render(DeleteConfirmModal, defaultProps);
+
+      await expect.element(page.getByRole('button', { name: /Cancel/i })).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('button', { name: /Delete permanently/i }))
+        .toBeInTheDocument();
+    });
+
+    it('should call onConfirm when delete button is clicked', async () => {
+      const onConfirm = vi.fn();
+      render(DeleteConfirmModal, { ...defaultProps, onConfirm });
+
+      await page.getByRole('button', { name: /Delete permanently/i }).click();
+      expect(onConfirm).toHaveBeenCalledOnce();
+    });
+
+    it('should call onCancel when cancel button is clicked', async () => {
+      const onCancel = vi.fn();
+      render(DeleteConfirmModal, { ...defaultProps, onCancel });
+
+      await page.getByRole('button', { name: /Cancel/i }).click();
+      expect(onCancel).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe('edge cases with empty keys', () => {
+    it('should fallback to empty name when key is an empty string', async () => {
+      render(DeleteConfirmModal, { ...defaultProps, keys: [''] });
+
+      // firstName falls back to '' via the ?? '' branch
+      await expect.element(page.getByRole('heading', { name: /Delete ""/ })).toBeInTheDocument();
+    });
+  });
+
+  describe('edge cases with faker', () => {
+    it('should handle keys with special characters', async () => {
+      const keys = ['file (1).txt', 'data [backup].csv', "name's file.doc"];
+      render(DeleteConfirmModal, { ...defaultProps, keys });
+
+      await expect
+        .element(page.getByRole('heading', { name: /Delete 3 items/ }))
+        .toBeInTheDocument();
+    });
+
+    it('should handle deeply nested directory paths', async () => {
+      const keys = ['a/b/c/d/e/f/g/'];
+      render(DeleteConfirmModal, { ...defaultProps, keys });
+
+      await expect.element(page.getByRole('heading', { name: /Delete "g"/ })).toBeInTheDocument();
+    });
+
+    it('should handle keys generated by faker', async () => {
+      const keys = Array.from(
+        { length: 5 },
+        () => `${faker.system.directoryPath()}/${faker.system.fileName()}`
+      );
+      render(DeleteConfirmModal, { ...defaultProps, keys });
+
+      await expect
+        .element(page.getByRole('heading', { name: /Delete 5 items/ }))
+        .toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
new file mode 100644
index 00000000..9dfa4408
--- /dev/null
+++ b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
@@ -0,0 +1,615 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import PreviewModal from './PreviewModal.svelte';
+
+// Mock $app/paths
+vi.mock('$app/paths', () => ({
+  resolve: (path: string) => path
+}));
+
+const defaultProps = {
+  open: true,
+  bucket: faker.word.noun(),
+  objectKey: 'path/to/document.txt'
+};
+
+/** Helper to create a mock Response with given content-type and headers */
+function mockFetchResponse(
+  body: BodyInit | null,
+  options: {
+    contentType?: string;
+    format?: string;
+    truncated?: boolean;
+    totalSize?: number;
+    previewBytes?: number;
+    totalRows?: number;
+    previewRows?: number;
+    renderable?: boolean;
+    status?: number;
+  } = {}
+) {
+  const headers: Record<string, string> = {
+    'Content-Type': options.contentType ?? 'text/plain',
+    'X-Preview-Format': options.format ?? 'text',
+    'X-Preview-Truncated': String(options.truncated ?? false),
+    'X-Preview-Total-Size': String(options.totalSize ?? 0),
+    'X-Preview-Bytes': String(options.previewBytes ?? 0)
+  };
+  if (options.totalRows !== undefined) {
+    headers['X-Preview-Total-Rows'] = String(options.totalRows);
+  }
+  if (options.previewRows !== undefined) {
+    headers['X-Preview-Preview-Rows'] = String(options.previewRows);
+  }
+  if (options.renderable === false) {
+    headers['X-Preview-Renderable'] = 'false';
+  }
+  return new Response(body, { status: options.status ?? 200, headers });
+}
+
+describe('PreviewModal', () => {
+  beforeEach(() => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn().mockResolvedValue(
+        mockFetchResponse('Hello world', {
+          contentType: 'text/plain',
+          totalSize: 11,
+          previewBytes: 11
+        })
+      )
+    );
+  });
+
+  describe('initial render', () => {
+    it('should render a dialog when open', async () => {
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+
+    it('should show the filename in the heading', async () => {
+      render(PreviewModal, { ...defaultProps, objectKey: 'folder/report.csv' });
+
+      await expect.element(page.getByText('report.csv')).toBeInTheDocument();
+    });
+
+    it('should show loading state initially', async () => {
+      vi.stubGlobal('fetch', vi.fn().mockReturnValue(new Promise(() => {})));
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('Loading preview…')).toBeInTheDocument();
+    });
+  });
+
+  describe('when open is false', () => {
+    it('should not render dialog content', async () => {
+      render(PreviewModal, { ...defaultProps, open: false });
+
+      const heading = page.getByRole('heading');
+      await expect.element(heading).not.toBeInTheDocument();
+    });
+  });
+
+  describe('close button', () => {
+    it('should have a close button', async () => {
+      render(PreviewModal, defaultProps);
+
+      const closeBtn = page.getByRole('button', { name: /close/i });
+      await expect.element(closeBtn).toBeInTheDocument();
+    });
+  });
+
+  describe('maximize toggle', () => {
+    it('should have a maximise button', async () => {
+      render(PreviewModal, defaultProps);
+
+      const maxBtn = page.getByRole('button', { name: /maximise/i });
+      await expect.element(maxBtn).toBeInTheDocument();
+    });
+
+    it('should switch to restore button after clicking maximise', async () => {
+      render(PreviewModal, defaultProps);
+
+      await page.getByRole('button', { name: /maximise/i }).click();
+
+      await expect.element(page.getByRole('button', { name: /restore/i })).toBeInTheDocument();
+    });
+
+    it('should toggle back to maximise after clicking restore', async () => {
+      render(PreviewModal, defaultProps);
+
+      await page.getByRole('button', { name: /maximise/i }).click();
+      await page.getByRole('button', { name: /restore/i }).click();
+
+      await expect.element(page.getByRole('button', { name: /maximise/i })).toBeInTheDocument();
+    });
+  });
+
+  describe('text preview', () => {
+    it('should render text content after fetch completes', async () => {
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('Hello world')).toBeInTheDocument();
+    });
+
+    it('should show file size badge', async () => {
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('11 B')).toBeInTheDocument();
+    });
+
+    it('should show truncated badge when content is truncated', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('Truncated content...', {
+            contentType: 'text/plain',
+            truncated: true,
+            totalSize: 50000,
+            previewBytes: 1024
+          })
+        )
+      );
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('Truncated content...')).toBeInTheDocument();
+      // Should show both total size and truncated warning badges
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+
+    it('should show download full button when truncated', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('Partial content', {
+            contentType: 'text/plain',
+            truncated: true,
+            totalSize: 50000,
+            previewBytes: 1024
+          })
+        )
+      );
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('Partial content')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+
+    it('should show a close button in the footer', async () => {
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('Hello world')).toBeInTheDocument();
+      // Footer close button
+      const closeBtns = page.getByRole('button', { name: /close/i });
+      await expect.element(closeBtns.first()).toBeInTheDocument();
+    });
+  });
+
+  describe('CSV preview', () => {
+    it('should render CSV preview for text/csv content type', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('name,value\nfoo,1\nbar,2', {
+            contentType: 'text/csv',
+            totalSize: 30,
+            previewBytes: 30
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/test.csv' });
+
+      await expect.element(page.getByText('30 B')).toBeInTheDocument();
+    });
+
+    it('should render CSV preview for application/csv content type', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('a,b\n1,2', {
+            contentType: 'application/csv',
+            totalSize: 10,
+            previewBytes: 10
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/test.dat' });
+
+      await expect.element(page.getByText('10 B')).toBeInTheDocument();
+    });
+
+    it('should render CSV preview for application/vnd.ms-excel content type', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('col1,col2\nval1,val2', {
+            contentType: 'application/vnd.ms-excel',
+            totalSize: 20,
+            previewBytes: 20
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/test.xls' });
+
+      await expect.element(page.getByText('20 B')).toBeInTheDocument();
+    });
+
+    it('should render CSV preview based on .csv file extension', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('x,y\n1,2', {
+            contentType: 'application/octet-stream',
+            totalSize: 8,
+            previewBytes: 8
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.csv' });
+
+      await expect.element(page.getByText('8 B')).toBeInTheDocument();
+    });
+
+    it('should show truncated badge for truncated CSV', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('a,b\n1,2', {
+            contentType: 'text/csv',
+            truncated: true,
+            totalSize: 100000,
+            previewBytes: 2048
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/big.csv' });
+
+      await expect.element(page.getByText('big.csv')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('parquet preview', () => {
+    it('should render parquet preview when format header is parquet', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('col1,col2\nval1,val2', {
+            contentType: 'text/csv',
+            format: 'parquet',
+            truncated: false,
+            totalSize: 5000,
+            totalRows: 100,
+            previewRows: 50
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
+
+      await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
+      // Parquet shows a size badge in the header
+      await expect.element(page.getByText('val1')).toBeInTheDocument();
+    });
+
+    it('should show row count badge when parquet is truncated', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('col1,col2\nval1,val2', {
+            contentType: 'text/csv',
+            format: 'parquet',
+            truncated: true,
+            totalSize: 50000,
+            totalRows: 10000,
+            previewRows: 500
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
+
+      await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
+      await expect.element(page.getByText('val1')).toBeInTheDocument();
+    });
+  });
+
+  describe('image preview', () => {
+    it('should render image preview for image content type', async () => {
+      const pngBytes = new Uint8Array([137, 80, 78, 71, 13, 10, 26, 10]);
+      const blob = new Blob([pngBytes], { type: 'image/png' });
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'image/png',
+              'X-Preview-Total-Size': '8192'
+            }
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'images/photo.png' });
+
+      await expect.element(page.getByText('photo.png')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+
+    it('should render image preview for image/jpeg', async () => {
+      const jpgBytes = new Uint8Array([0xff, 0xd8, 0xff, 0xe0]);
+      const blob = new Blob([jpgBytes], { type: 'image/jpeg' });
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'image/jpeg',
+              'X-Preview-Total-Size': '4096'
+            }
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'images/photo.jpg' });
+
+      await expect.element(page.getByText('photo.jpg')).toBeInTheDocument();
+    });
+  });
+
+  describe('PDF preview', () => {
+    it('should render PDF preview for application/pdf', async () => {
+      const pdfBytes = new Uint8Array([0x25, 0x50, 0x44, 0x46]);
+      const blob = new Blob([pdfBytes], { type: 'application/pdf' });
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'application/pdf',
+              'X-Preview-Total-Size': '16384'
+            }
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'docs/report.pdf' });
+
+      await expect.element(page.getByText('report.pdf')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('fallback preview', () => {
+    it('should render fallback when X-Preview-Renderable is false', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          mockFetchResponse('', {
+            contentType: 'application/zip',
+            renderable: false
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'archive.zip' });
+
+      // Fallback should not show a footer with download/close buttons
+      // Wait for the preview to load
+      await expect.element(page.getByText('archive.zip')).toBeInTheDocument();
+    });
+
+    it('should render fallback for binary content that fails UTF-8 decode', async () => {
+      // Create bytes that are invalid UTF-8 (not a CSV/TSV extension)
+      const binaryBytes = new Uint8Array([0x80, 0x81, 0x82, 0x83, 0xff, 0xfe, 0xfd]);
+      const blob = new Blob([binaryBytes]);
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'application/octet-stream',
+              'X-Preview-Format': 'raw',
+              'X-Preview-Truncated': 'false',
+              'X-Preview-Total-Size': '7',
+              'X-Preview-Bytes': '7'
+            }
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.bin' });
+
+      // Should eventually show fallback (no footer since fallback kind)
+      await expect.element(page.getByText('file.bin')).toBeInTheDocument();
+    });
+  });
+
+  describe('error state', () => {
+    it('should show error when fetch fails', async () => {
+      vi.stubGlobal('fetch', vi.fn().mockRejectedValue(new Error('Network error')));
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should show access denied for 403', async () => {
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('{}', { status: 403 })));
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should show not found for 404', async () => {
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue(new Response('{}', { status: 404 })));
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should show generic error for other status codes', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi
+          .fn()
+          .mockResolvedValue(
+            new Response(JSON.stringify({ error: 'Server is down' }), { status: 500 })
+          )
+      );
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should handle non-JSON error response body', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(new Response('Not JSON at all', { status: 500 }))
+      );
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+
+  describe('UTF-16 BOM detection', () => {
+    it('should decode UTF-16 LE BOM content', async () => {
+      // UTF-16 LE BOM (0xFF 0xFE) followed by "Hi" in UTF-16 LE
+      const bytes = new Uint8Array([0xff, 0xfe, 0x48, 0x00, 0x69, 0x00]);
+      const blob = new Blob([bytes]);
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'text/plain',
+              'X-Preview-Format': 'text',
+              'X-Preview-Truncated': 'false',
+              'X-Preview-Total-Size': '6',
+              'X-Preview-Bytes': '6'
+            }
+          })
+        )
+      );
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('Hi')).toBeInTheDocument();
+    });
+
+    it('should decode UTF-16 BE BOM content', async () => {
+      // UTF-16 BE BOM (0xFE 0xFF) followed by "OK" in UTF-16 BE
+      const bytes = new Uint8Array([0xfe, 0xff, 0x00, 0x4f, 0x00, 0x4b]);
+      const blob = new Blob([bytes]);
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'text/plain',
+              'X-Preview-Format': 'text',
+              'X-Preview-Truncated': 'false',
+              'X-Preview-Total-Size': '6',
+              'X-Preview-Bytes': '6'
+            }
+          })
+        )
+      );
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByText('OK')).toBeInTheDocument();
+    });
+  });
+
+  describe('Windows-1252 fallback for CSV', () => {
+    it('should decode CSV with Windows-1252 when UTF-8 fails', async () => {
+      // Create bytes with 0xe4 (ä in Windows-1252) which is invalid as standalone UTF-8
+      const bytes = new Uint8Array([0x4e, 0x61, 0x6d, 0x65, 0x0a, 0xe4]); // "Name\nä"
+      const blob = new Blob([bytes]);
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'text/csv',
+              'X-Preview-Format': 'text',
+              'X-Preview-Truncated': 'false',
+              'X-Preview-Total-Size': '6',
+              'X-Preview-Bytes': '6'
+            }
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.csv' });
+
+      // Should still show the filename (the content is decoded as Windows-1252)
+      await expect.element(page.getByText('file.csv')).toBeInTheDocument();
+    });
+
+    it('should decode TSV with Windows-1252 when UTF-8 fails', async () => {
+      const bytes = new Uint8Array([0x41, 0x09, 0x42, 0x0a, 0xe4, 0x09, 0xfc]); // "A\tB\nä\tü"
+      const blob = new Blob([bytes]);
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          new Response(blob, {
+            status: 200,
+            headers: {
+              'Content-Type': 'text/plain',
+              'X-Preview-Format': 'text',
+              'X-Preview-Truncated': 'false',
+              'X-Preview-Total-Size': '7',
+              'X-Preview-Bytes': '7'
+            }
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.tsv' });
+
+      await expect.element(page.getByText('file.tsv')).toBeInTheDocument();
+    });
+  });
+
+  describe('accessibility', () => {
+    it('should have a dialog role', async () => {
+      render(PreviewModal, defaultProps);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+
+    it('should have aria-label on close button', async () => {
+      render(PreviewModal, defaultProps);
+
+      const closeBtn = page.getByRole('button', { name: /close/i });
+      await expect.element(closeBtn).toBeInTheDocument();
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle null objectKey', async () => {
+      render(PreviewModal, { ...defaultProps, objectKey: null });
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+
+    it('should handle deeply nested object key', async () => {
+      render(PreviewModal, {
+        ...defaultProps,
+        objectKey: 'a/b/c/d/e/f/deeply-nested-file.json'
+      });
+
+      await expect.element(page.getByText('deeply-nested-file.json')).toBeInTheDocument();
+    });
+
+    it('should handle object key with special characters', async () => {
+      render(PreviewModal, {
+        ...defaultProps,
+        objectKey: 'data/file (copy).txt'
+      });
+
+      await expect.element(page.getByText('file (copy).txt')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/StorageModals.svelte.spec.ts b/src/lib/components/storage/modals/StorageModals.svelte.spec.ts
new file mode 100644
index 00000000..877b38cf
--- /dev/null
+++ b/src/lib/components/storage/modals/StorageModals.svelte.spec.ts
@@ -0,0 +1,139 @@
+import { page, userEvent } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import type { StorageState } from '$lib/storage/state.svelte.js';
+import StorageModals from './StorageModals.svelte';
+
+// Mock $app/paths for PreviewModal
+vi.mock('$app/paths', () => ({
+  resolve: (path: string) => path
+}));
+
+// Mock upload module
+vi.mock('$lib/storage/upload.js', () => ({
+  checkObjectExists: vi.fn().mockResolvedValue(false),
+  uploadFile: vi.fn().mockResolvedValue(undefined),
+  UploadError: class UploadError extends Error {
+    code: string;
+    constructor(code: string, message: string) {
+      super(message);
+      this.code = code;
+    }
+  }
+}));
+
+function createMockStorageState(activeModal: unknown = null): StorageState {
+  return {
+    bucket: 'test-bucket',
+    prefix: '',
+    activeModal,
+    closeModal: vi.fn(),
+    confirmDelete: vi.fn(),
+    cancelDelete: vi.fn(),
+    handleUploadSuccess: vi.fn()
+  } as unknown as StorageState;
+}
+
+// Mock the storage context
+vi.mock('$lib/storage/context.js', () => ({
+  getStorageState: vi.fn()
+}));
+
+import { getStorageState } from '$lib/storage/context.js';
+
+describe('StorageModals', () => {
+  describe('no active modal', () => {
+    it('should not render any modal when activeModal is null', async () => {
+      vi.mocked(getStorageState).mockReturnValue(createMockStorageState(null));
+      render(StorageModals);
+
+      const dialog = page.getByRole('dialog');
+      await expect.element(dialog).not.toBeInTheDocument();
+    });
+  });
+
+  describe('delete modal', () => {
+    it('should render DeleteConfirmModal when activeModal type is delete', async () => {
+      vi.mocked(getStorageState).mockReturnValue(
+        createMockStorageState({
+          type: 'delete',
+          payload: { keys: ['file.txt'] }
+        })
+      );
+      render(StorageModals);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+      await expect.element(page.getByRole('heading', { name: /delete/i })).toBeInTheDocument();
+    });
+
+    it('should call closeModal when delete dialog is closed via Escape', async () => {
+      const mockState = createMockStorageState({
+        type: 'delete',
+        payload: { keys: ['file.txt'] }
+      });
+      vi.mocked(getStorageState).mockReturnValue(mockState);
+      render(StorageModals);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+      await userEvent.keyboard('{Escape}');
+      await expect.poll(() => mockState.closeModal).toHaveBeenCalled();
+    });
+  });
+
+  describe('preview modal', () => {
+    it('should render PreviewModal when activeModal type is preview', async () => {
+      vi.stubGlobal('fetch', vi.fn().mockReturnValue(new Promise(() => {})));
+      vi.mocked(getStorageState).mockReturnValue(
+        createMockStorageState({
+          type: 'preview',
+          payload: { key: 'path/to/file.txt' }
+        })
+      );
+      render(StorageModals);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+      await expect.element(page.getByText('file.txt')).toBeInTheDocument();
+    });
+
+    it('should call closeModal when preview dialog is closed via Escape', async () => {
+      vi.stubGlobal('fetch', vi.fn().mockReturnValue(new Promise(() => {})));
+      const mockState = createMockStorageState({
+        type: 'preview',
+        payload: { key: 'path/to/file.txt' }
+      });
+      vi.mocked(getStorageState).mockReturnValue(mockState);
+      render(StorageModals);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+      await userEvent.keyboard('{Escape}');
+      await expect.poll(() => mockState.closeModal).toHaveBeenCalled();
+    });
+  });
+
+  describe('upload modal', () => {
+    it('should render UploadModal when activeModal type is upload', async () => {
+      vi.mocked(getStorageState).mockReturnValue(
+        createMockStorageState({
+          type: 'upload',
+          payload: { bucket: 'my-bucket', prefix: 'data/' }
+        })
+      );
+      render(StorageModals);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+
+    it('should call closeModal when upload dialog is closed via Escape', async () => {
+      const mockState = createMockStorageState({
+        type: 'upload',
+        payload: { bucket: 'my-bucket', prefix: 'data/' }
+      });
+      vi.mocked(getStorageState).mockReturnValue(mockState);
+      render(StorageModals);
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+      await userEvent.keyboard('{Escape}');
+      await expect.poll(() => mockState.closeModal).toHaveBeenCalled();
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
new file mode 100644
index 00000000..96a56808
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
@@ -0,0 +1,102 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import CsvPreview from './CsvPreview.svelte';
+
+describe('CsvPreview', () => {
+  it('should show empty state when text is empty', async () => {
+    render(CsvPreview, { text: '' });
+
+    const table = page.getByRole('table');
+    await expect.element(table).not.toBeInTheDocument();
+  });
+
+  it('should render a table with headers and rows', async () => {
+    const text = 'Name,Email,City\nAlice,alice@example.com,Berlin\nBob,bob@example.com,Munich';
+    render(CsvPreview, { text });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+    await expect.element(page.getByText('Name')).toBeInTheDocument();
+    await expect.element(page.getByText('Email')).toBeInTheDocument();
+    await expect
+      .element(page.getByRole('cell', { name: 'Alice', exact: true }))
+      .toBeInTheDocument();
+    await expect.element(page.getByText('bob@example.com')).toBeInTheDocument();
+  });
+
+  it('should handle quoted fields with commas', async () => {
+    const text = 'Name,Address\n"Smith, John","123 Main St, Apt 4"';
+    render(CsvPreview, { text });
+
+    await expect.element(page.getByText('Smith, John')).toBeInTheDocument();
+    await expect.element(page.getByText('123 Main St, Apt 4')).toBeInTheDocument();
+  });
+
+  it('should handle escaped quotes', async () => {
+    const text = 'Name,Quote\nAlice,"She said ""hello"""';
+    render(CsvPreview, { text });
+
+    await expect.element(page.getByText('She said "hello"')).toBeInTheDocument();
+  });
+
+  it('should handle empty cells', async () => {
+    const text = 'A,B,C\n1,,3\n,,';
+    render(CsvPreview, { text });
+
+    await expect.element(page.getByText('1')).toBeInTheDocument();
+    await expect.element(page.getByText('3')).toBeInTheDocument();
+  });
+
+  it('should truncate at 250 rows and show notice', async () => {
+    const header = 'Name,Email';
+    const rows = Array.from(
+      { length: 300 },
+      () => `${faker.person.firstName()},${faker.internet.email()}`
+    );
+    const text = [header, ...rows].join('\n');
+    render(CsvPreview, { text });
+
+    // Should show truncation notice
+    const notice = page.getByText(/250/);
+    await expect.element(notice).toBeInTheDocument();
+  });
+
+  it('should not show truncation notice for <= 250 rows', async () => {
+    const header = 'Name,Email';
+    const rows = Array.from(
+      { length: 10 },
+      () => `${faker.person.firstName()},${faker.internet.email()}`
+    );
+    const text = [header, ...rows].join('\n');
+    render(CsvPreview, { text });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+  });
+
+  it('should render empty string for missing columns (row shorter than headers)', async () => {
+    const text = 'A,B,C\n1';
+    render(CsvPreview, { text });
+
+    // Row has only 1 field but 3 headers, so columns B and C should render as empty via ?? ''
+    await expect.element(page.getByRole('cell', { name: '1', exact: true })).toBeInTheDocument();
+    // There should be 3 cells in the body row
+    const rows = page.getByRole('row');
+    // row 0 is header, row 1 is data
+    const dataCells = rows.nth(1).getByRole('cell');
+    await expect.element(dataCells.nth(0)).toHaveTextContent('1');
+    await expect.element(dataCells.nth(1)).toHaveTextContent('');
+    await expect.element(dataCells.nth(2)).toHaveTextContent('');
+  });
+
+  it('should handle header-only CSV', async () => {
+    const text = 'Name,Email,City';
+    render(CsvPreview, { text });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+    await expect.element(page.getByText('Name')).toBeInTheDocument();
+  });
+});
diff --git a/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
new file mode 100644
index 00000000..726db3b1
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
@@ -0,0 +1,67 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import FallbackPreview from './FallbackPreview.svelte';
+
+describe('FallbackPreview', () => {
+  const baseProps = {
+    contentType: 'application/octet-stream',
+    downloadUrl: '/download/file.bin',
+    name: 'file.bin'
+  };
+
+  it('should show unsupported title when isBinary is false', async () => {
+    render(FallbackPreview, { ...baseProps, isBinary: false });
+
+    // Find the download link as a reliable anchor
+    const link = page.getByRole('link');
+    await expect.element(link).toBeInTheDocument();
+    await expect.element(link).toHaveAttribute('download', 'file.bin');
+  });
+
+  it('should show binary title when isBinary is true', async () => {
+    render(FallbackPreview, { ...baseProps, isBinary: true });
+
+    const link = page.getByRole('link');
+    await expect.element(link).toBeInTheDocument();
+  });
+
+  it('should render download link with correct attributes', async () => {
+    render(FallbackPreview, { ...baseProps });
+
+    const link = page.getByRole('link');
+    await expect.element(link).toHaveAttribute('href', '/download/file.bin');
+    await expect.element(link).toHaveAttribute('download', 'file.bin');
+  });
+
+  it('should show contentType in mono text', async () => {
+    const contentType = 'application/x-custom-binary';
+    render(FallbackPreview, { ...baseProps, contentType });
+
+    await expect.element(page.getByText(contentType)).toBeInTheDocument();
+  });
+
+  it('should handle various MIME types', async () => {
+    const mimeType = faker.system.mimeType();
+    render(FallbackPreview, { ...baseProps, contentType: mimeType });
+
+    await expect.element(page.getByText(mimeType)).toBeInTheDocument();
+  });
+
+  it('should handle long filenames', async () => {
+    const name = `${faker.string.alphanumeric(100)}.dat`;
+    render(FallbackPreview, { ...baseProps, name });
+
+    const link = page.getByRole('link');
+    await expect.element(link).toHaveAttribute('download', name);
+  });
+
+  it('should handle special characters in names', async () => {
+    const name = 'file (copy) [2].bin';
+    render(FallbackPreview, { ...baseProps, name });
+
+    const link = page.getByRole('link');
+    await expect.element(link).toHaveAttribute('download', name);
+  });
+});
diff --git a/src/lib/components/storage/modals/preview/ImagePreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/ImagePreview.svelte.spec.ts
new file mode 100644
index 00000000..d5e8fdde
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/ImagePreview.svelte.spec.ts
@@ -0,0 +1,58 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import ImagePreview from './ImagePreview.svelte';
+
+describe('ImagePreview', () => {
+  it('should render an img element with correct alt text', async () => {
+    const name = 'photo.png';
+    render(ImagePreview, { src: 'blob:http://localhost/fake-id', name });
+
+    const img = page.getByRole('img');
+    await expect.element(img).toBeInTheDocument();
+    await expect.element(img).toHaveAttribute('alt');
+  });
+
+  it('should have the expected CSS classes', async () => {
+    render(ImagePreview, { src: 'blob:http://localhost/fake-id', name: 'test.jpg' });
+
+    const img = page.getByRole('img');
+    await expect.element(img).toHaveClass('max-h-full max-w-full rounded object-contain shadow');
+  });
+
+  it('should set the src attribute', async () => {
+    const src = 'blob:http://localhost/abc-123';
+    render(ImagePreview, { src, name: 'image.png' });
+
+    const img = page.getByRole('img');
+    await expect.element(img).toHaveAttribute('src', src);
+  });
+
+  it('should update naturalWidth and naturalHeight on load', async () => {
+    // 1x1 red pixel PNG as a data URL so the image actually loads
+    const src =
+      'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8/5+hHgAHggJ/PchI7wAAAABJRU5ErkJggg==';
+    render(ImagePreview, { src, name: 'pixel.png' });
+
+    const img = page.getByRole('img');
+    // Wait for the image to load and the onload handler to fire
+    await expect.element(img).toHaveAttribute('src', src);
+
+    // Wait for naturalWidth to be set (image loaded)
+    await expect
+      .poll(() => {
+        const el = document.querySelector('img') as HTMLImageElement;
+        return el?.naturalWidth;
+      })
+      .toBeGreaterThan(0);
+  });
+
+  it('should handle various file names', async () => {
+    const name = `${faker.string.alphanumeric(20)}.${faker.helpers.arrayElement(['png', 'jpg', 'gif', 'webp'])}`;
+    render(ImagePreview, { src: 'blob:http://localhost/id', name });
+
+    const img = page.getByRole('img');
+    await expect.element(img).toBeInTheDocument();
+  });
+});
diff --git a/src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts
new file mode 100644
index 00000000..ac061992
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts
@@ -0,0 +1,44 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import PdfPreview from './PdfPreview.svelte';
+
+describe('PdfPreview', () => {
+  it('should render an iframe', async () => {
+    render(PdfPreview, { src: 'blob:http://localhost/fake-pdf', name: 'report.pdf' });
+
+    const iframe = page.getByTitle(/report\.pdf/);
+    await expect.element(iframe).toBeInTheDocument();
+  });
+
+  it('should have correct CSS classes', async () => {
+    render(PdfPreview, { src: 'blob:http://localhost/fake-pdf', name: 'doc.pdf' });
+
+    const iframe = page.getByTitle(/doc\.pdf/);
+    await expect.element(iframe).toHaveClass('h-full w-full rounded border-0');
+  });
+
+  it('should set the src attribute', async () => {
+    const src = 'blob:http://localhost/pdf-123';
+    render(PdfPreview, { src, name: 'file.pdf' });
+
+    const iframe = page.getByTitle(/file\.pdf/);
+    await expect.element(iframe).toHaveAttribute('src', src);
+  });
+
+  it('should have an aria-label', async () => {
+    render(PdfPreview, { src: 'blob:http://localhost/id', name: 'test.pdf' });
+
+    const iframe = page.getByTitle(/test\.pdf/);
+    await expect.element(iframe).toHaveAttribute('aria-label');
+  });
+
+  it('should handle various file names', async () => {
+    const name = `${faker.system.fileName()}.pdf`;
+    render(PdfPreview, { src: 'blob:http://localhost/id', name });
+
+    const iframe = page.getByTitle(new RegExp(name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
+    await expect.element(iframe).toBeInTheDocument();
+  });
+});
diff --git a/src/lib/components/storage/modals/preview/TextPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/TextPreview.svelte.spec.ts
new file mode 100644
index 00000000..8ec5609e
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/TextPreview.svelte.spec.ts
@@ -0,0 +1,117 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import TextPreview from './TextPreview.svelte';
+
+describe('TextPreview', () => {
+  it('should render a pre element with aria-label', async () => {
+    render(TextPreview, { text: 'hello world', contentType: 'text/plain' });
+
+    await expect.element(page.getByLabelText('File content preview')).toBeInTheDocument();
+  });
+
+  it('should set data-language to text for plain text', async () => {
+    render(TextPreview, { text: 'hello', contentType: 'text/plain' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'text');
+  });
+
+  it('should detect and format JSON', async () => {
+    const obj = { name: faker.person.fullName(), age: faker.number.int({ min: 18, max: 80 }) };
+    const raw = JSON.stringify(obj);
+    render(TextPreview, { text: raw, contentType: 'application/json' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'json');
+    // Should be pretty-printed (has newlines with indentation)
+    await expect.element(pre).toHaveTextContent(obj.name);
+  });
+
+  it('should detect JSON for text/json content type', async () => {
+    render(TextPreview, { text: '{"a":1}', contentType: 'text/json' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'json');
+  });
+
+  it('should detect JSON for +json suffix', async () => {
+    render(TextPreview, { text: '{"a":1}', contentType: 'application/vnd.api+json' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'json');
+  });
+
+  it('should show raw text for invalid JSON', async () => {
+    const invalid = '{not valid json: }}}';
+    render(TextPreview, { text: invalid, contentType: 'application/json' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveTextContent(invalid);
+  });
+
+  it('should detect CSS language', async () => {
+    render(TextPreview, { text: 'body { color: red; }', contentType: 'text/css' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'css');
+  });
+
+  it('should detect HTML language', async () => {
+    render(TextPreview, { text: '<h1>Hello</h1>', contentType: 'text/html' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'html');
+  });
+
+  it('should detect JavaScript language', async () => {
+    render(TextPreview, { text: 'const x = 1;', contentType: 'text/javascript' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'javascript');
+  });
+
+  it('should detect JavaScript for application/javascript', async () => {
+    render(TextPreview, { text: 'const x = 1;', contentType: 'application/javascript' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'javascript');
+  });
+
+  it('should detect CSV as text language', async () => {
+    render(TextPreview, { text: 'a,b,c', contentType: 'text/csv' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'text');
+  });
+
+  it('should detect application/csv as text language', async () => {
+    render(TextPreview, { text: 'a,b,c', contentType: 'application/csv' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'text');
+  });
+
+  it('should detect markdown language', async () => {
+    render(TextPreview, { text: '# Title', contentType: 'text/markdown' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveAttribute('data-language', 'markdown');
+  });
+
+  it('should handle empty text', async () => {
+    render(TextPreview, { text: '', contentType: 'text/plain' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toBeInTheDocument();
+  });
+
+  it('should handle special characters', async () => {
+    const text = '<script>alert("xss")</script> & "quotes"';
+    render(TextPreview, { text, contentType: 'text/plain' });
+
+    const pre = page.getByLabelText('File content preview');
+    await expect.element(pre).toHaveTextContent(text);
+  });
+});
diff --git a/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts
new file mode 100644
index 00000000..e6f8aebd
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts
@@ -0,0 +1,284 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import UploadConflictEntry from './UploadConflictEntry.svelte';
+import type { FileEntry } from './types.js';
+
+function makeEntry(overrides: Partial<FileEntry> = {}): FileEntry {
+  const name = overrides.file?.name ?? faker.system.fileName();
+  return {
+    id: faker.string.uuid(),
+    file: new File(['content'], name),
+    displayPath: name,
+    targetKey: `path/to/${name}`,
+    conflict: true,
+    resolution: null,
+    customName: name,
+    renameState: 'idle',
+    status: 'pending',
+    progress: 0,
+    ...overrides
+  };
+}
+
+const defaultCallbacks = {
+  onSetResolution: vi.fn(),
+  onSetCustomName: vi.fn(),
+  onRenameButtonClick: vi.fn(),
+  onCheckRename: vi.fn()
+};
+
+describe('UploadConflictEntry', () => {
+  describe('rendering', () => {
+    it('should show the file name in quotes', async () => {
+      const entry = makeEntry({ targetKey: 'folder/report.csv' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByText(/\u201Creport.csv\u201D/)).toBeInTheDocument();
+    });
+
+    it('should show a button group with Replace, Skip, Rename', async () => {
+      const entry = makeEntry();
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByRole('group')).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: 'Replace' })).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: 'Skip' })).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: 'Rename' })).toBeInTheDocument();
+    });
+
+    it('should handle long filenames', async () => {
+      const longName = faker.string.alpha(200) + '.txt';
+      const entry = makeEntry({ targetKey: `deep/nested/${longName}` });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByText(new RegExp(longName.slice(0, 20)))).toBeInTheDocument();
+    });
+  });
+
+  describe('resolution buttons', () => {
+    it('should mark Replace as pressed when resolution is replace', async () => {
+      const entry = makeEntry({ resolution: 'replace' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      const btn = page.getByRole('button', { name: 'Replace' });
+      await expect.element(btn).toHaveAttribute('aria-pressed', 'true');
+    });
+
+    it('should mark Skip as pressed when resolution is skip', async () => {
+      const entry = makeEntry({ resolution: 'skip' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      const btn = page.getByRole('button', { name: 'Skip' });
+      await expect.element(btn).toHaveAttribute('aria-pressed', 'true');
+    });
+
+    it('should call onSetResolution with replace when Replace is clicked', async () => {
+      const onSetResolution = vi.fn();
+      const entry = makeEntry();
+      render(UploadConflictEntry, { entry, ...defaultCallbacks, onSetResolution });
+
+      await page.getByRole('button', { name: 'Replace' }).click();
+      expect(onSetResolution).toHaveBeenCalledWith('replace');
+    });
+
+    it('should call onSetResolution with skip when Skip is clicked', async () => {
+      const onSetResolution = vi.fn();
+      const entry = makeEntry();
+      render(UploadConflictEntry, { entry, ...defaultCallbacks, onSetResolution });
+
+      await page.getByRole('button', { name: 'Skip' }).click();
+      expect(onSetResolution).toHaveBeenCalledWith('skip');
+    });
+
+    it('should call onRenameButtonClick when Rename is clicked', async () => {
+      const onRenameButtonClick = vi.fn();
+      const entry = makeEntry();
+      render(UploadConflictEntry, { entry, ...defaultCallbacks, onRenameButtonClick });
+
+      await page.getByRole('button', { name: 'Rename' }).click();
+      expect(onRenameButtonClick).toHaveBeenCalled();
+    });
+  });
+
+  describe('rename state', () => {
+    it('should show loading spinner when renameState is checking', async () => {
+      const entry = makeEntry({ resolution: 'rename', renameState: 'checking' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      const btn = page.getByRole('button', { name: /Rename/ });
+      await expect.element(btn).toBeDisabled();
+    });
+
+    it('should show input field when renameState is editing', async () => {
+      const entry = makeEntry({ resolution: 'rename', renameState: 'editing' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect
+        .element(page.getByRole('textbox', { name: 'New file name' }))
+        .toBeInTheDocument();
+    });
+
+    it('should show input field when renameState is conflict', async () => {
+      const entry = makeEntry({ resolution: 'rename', renameState: 'conflict' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect
+        .element(page.getByRole('textbox', { name: 'New file name' }))
+        .toBeInTheDocument();
+    });
+
+    it('should show error when renameState is conflict', async () => {
+      const file = new File(['x'], 'original.txt');
+      const entry = makeEntry({
+        file,
+        resolution: 'rename',
+        renameState: 'conflict',
+        customName: 'different-name.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect
+        .element(page.getByRole('alert'))
+        .toHaveTextContent('This name already exists here.');
+    });
+
+    it('should show error when customName is empty (badRename)', async () => {
+      const entry = makeEntry({
+        resolution: 'rename',
+        renameState: 'editing',
+        customName: '  '
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should show error when customName matches original file name', async () => {
+      const file = new File(['x'], 'original.txt');
+      const entry = makeEntry({
+        file,
+        resolution: 'rename',
+        renameState: 'editing',
+        customName: 'original.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should call onCheckRename when Enter is pressed in input', async () => {
+      const onCheckRename = vi.fn();
+      const entry = makeEntry({
+        resolution: 'rename',
+        renameState: 'editing',
+        customName: 'new-name.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks, onCheckRename });
+
+      const input = page.getByRole('textbox', { name: 'New file name' });
+      const inputEl = input.element() as HTMLInputElement;
+      inputEl.focus();
+      inputEl.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true }));
+      expect(onCheckRename).toHaveBeenCalled();
+    });
+
+    it('should show "Confirm name" text when editing', async () => {
+      const entry = makeEntry({ resolution: 'rename', renameState: 'editing' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByRole('button', { name: /Confirm name/ })).toBeInTheDocument();
+    });
+
+    it('should show check icon and success button when renameState is ok', async () => {
+      const entry = makeEntry({
+        resolution: 'rename',
+        renameState: 'ok',
+        customName: 'new-name.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      // Should show the static display with the custom name (not the input)
+      await expect.element(page.getByText('new-name.txt')).toBeInTheDocument();
+      // Button should have success styling and show "Rename" text (not "Confirm name")
+      const btn = page.getByRole('button', { name: /Rename/ });
+      await expect.element(btn).toBeInTheDocument();
+      await expect.element(btn).toHaveAttribute('aria-pressed', 'true');
+    });
+
+    it('should call onSetCustomName when input value changes', async () => {
+      const onSetCustomName = vi.fn();
+      const entry = makeEntry({
+        resolution: 'rename',
+        renameState: 'editing',
+        customName: 'old.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks, onSetCustomName });
+
+      const input = page.getByRole('textbox', { name: 'New file name' });
+      const inputEl = input.element() as HTMLInputElement;
+      inputEl.focus();
+      inputEl.value = 'new-value.txt';
+      inputEl.dispatchEvent(new Event('input', { bubbles: true }));
+      expect(onSetCustomName).toHaveBeenCalledWith('new-value.txt');
+    });
+
+    it('should show "Confirm name" text when renameState is conflict', async () => {
+      const file = new File(['x'], 'original.txt');
+      const entry = makeEntry({
+        file,
+        resolution: 'rename',
+        renameState: 'conflict',
+        customName: 'different.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByRole('button', { name: /Confirm name/ })).toBeInTheDocument();
+    });
+
+    it('should not call onCheckRename when a non-Enter key is pressed', async () => {
+      const onCheckRename = vi.fn();
+      const entry = makeEntry({
+        resolution: 'rename',
+        renameState: 'editing',
+        customName: 'new-name.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks, onCheckRename });
+
+      const input = page.getByRole('textbox', { name: 'New file name' });
+      const inputEl = input.element() as HTMLInputElement;
+      inputEl.focus();
+      inputEl.dispatchEvent(new KeyboardEvent('keydown', { key: 'a', bubbles: true }));
+      expect(onCheckRename).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('nameOnly derivation', () => {
+    it('should fall back to file.name when targetKey has no path separator', async () => {
+      const file = new File(['x'], 'fallback.txt');
+      const entry = makeEntry({ file, targetKey: 'fallback.txt' });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      await expect.element(page.getByText(/\u201Cfallback.txt\u201D/)).toBeInTheDocument();
+    });
+
+    it('should not show error when customName is valid and different', async () => {
+      const file = new File(['x'], 'original.txt');
+      const entry = makeEntry({
+        file,
+        resolution: 'rename',
+        renameState: 'editing',
+        customName: 'different.txt'
+      });
+      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+
+      // Input should be present and have no error styling
+      const input = page.getByRole('textbox', { name: 'New file name' });
+      await expect.element(input).toBeInTheDocument();
+      // The input should not have error class
+      const inputEl = input.element() as HTMLInputElement;
+      expect(inputEl.classList.contains('input-error')).toBe(false);
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts
new file mode 100644
index 00000000..2a98156c
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts
@@ -0,0 +1,389 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import UploadDropzone from './UploadDropzone.svelte';
+
+vi.mock('$lib/storage/file-collection.js', () => ({
+  collectDroppedFiles: vi.fn()
+}));
+
+async function getCollectDroppedFilesMock() {
+  const mod = await import('$lib/storage/file-collection.js');
+  return mod.collectDroppedFiles as ReturnType<typeof vi.fn>;
+}
+
+function createDropEvent(files: File[]): DragEvent {
+  const dt = new DataTransfer();
+  files.forEach((f) => dt.items.add(f));
+  return new DragEvent('drop', {
+    bubbles: true,
+    cancelable: true,
+    dataTransfer: dt
+  });
+}
+
+describe('UploadDropzone', () => {
+  describe('rendering', () => {
+    it('should have a drop zone with role button', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      await expect
+        .element(
+          page.getByRole('button', { name: 'Drop files or a folder here, or click to browse' })
+        )
+        .toBeInTheDocument();
+    });
+
+    it('should have Select files button', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      await expect.element(page.getByRole('button', { name: 'Select files' })).toBeInTheDocument();
+    });
+
+    it('should have Select folder button', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      await expect.element(page.getByRole('button', { name: 'Select folder' })).toBeInTheDocument();
+    });
+
+    it('should have hidden file inputs', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const fileInput = page.getByLabelText('Select files');
+      const dirInput = page.getByLabelText('Select folder');
+      await expect.element(fileInput).toBeInTheDocument();
+      await expect.element(dirInput).toBeInTheDocument();
+    });
+  });
+
+  describe('keyboard accessibility', () => {
+    it('should have tabindex on drop zone', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      await expect.element(dropzone).toHaveAttribute('tabindex', '0');
+    });
+
+    it('should trigger file input on Enter key', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      const fileInput = page.getByLabelText('Select files').element() as HTMLInputElement;
+      const clickSpy = vi.spyOn(fileInput, 'click');
+
+      dropzoneEl.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true }));
+
+      expect(clickSpy).toHaveBeenCalled();
+    });
+
+    it('should trigger file input on Space key', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      const fileInput = page.getByLabelText('Select files').element() as HTMLInputElement;
+      const clickSpy = vi.spyOn(fileInput, 'click');
+
+      dropzoneEl.dispatchEvent(new KeyboardEvent('keydown', { key: ' ', bubbles: true }));
+
+      expect(clickSpy).toHaveBeenCalled();
+    });
+
+    it('should not trigger file input on other keys', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      const fileInput = page.getByLabelText('Select files').element() as HTMLInputElement;
+      const clickSpy = vi.spyOn(fileInput, 'click');
+
+      dropzoneEl.dispatchEvent(new KeyboardEvent('keydown', { key: 'a', bubbles: true }));
+
+      expect(clickSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('file selection', () => {
+    it('should call onFilesSelected when files are chosen via file input', async () => {
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const fileName = faker.system.fileName();
+      const file = new File(['data'], fileName);
+      const fileInput = page.getByLabelText('Select files');
+
+      const inputEl = fileInput.element() as HTMLInputElement;
+      const dt = new DataTransfer();
+      dt.items.add(file);
+      inputEl.files = dt.files;
+      inputEl.dispatchEvent(new Event('change', { bubbles: true }));
+
+      expect(onFilesSelected).toHaveBeenCalledWith([
+        { file: expect.any(File), relativePath: fileName }
+      ]);
+    });
+
+    it('should not call onFilesSelected for empty file list', async () => {
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const fileInput = page.getByLabelText('Select files');
+      const inputEl = fileInput.element() as HTMLInputElement;
+      inputEl.dispatchEvent(new Event('change', { bubbles: true }));
+
+      expect(onFilesSelected).not.toHaveBeenCalled();
+    });
+
+    it('should handle multiple files', async () => {
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const files = Array.from({ length: 5 }, () => new File(['x'], faker.system.fileName()));
+      const fileInput = page.getByLabelText('Select files');
+      const inputEl = fileInput.element() as HTMLInputElement;
+      const dt = new DataTransfer();
+      files.forEach((f) => dt.items.add(f));
+      inputEl.files = dt.files;
+      inputEl.dispatchEvent(new Event('change', { bubbles: true }));
+
+      expect(onFilesSelected).toHaveBeenCalledOnce();
+      expect(onFilesSelected.mock.calls[0][0]).toHaveLength(5);
+    });
+
+    it('should reset input value after file selection', async () => {
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const file = new File(['data'], 'test.txt');
+      const fileInput = page.getByLabelText('Select files');
+      const inputEl = fileInput.element() as HTMLInputElement;
+      const dt = new DataTransfer();
+      dt.items.add(file);
+      inputEl.files = dt.files;
+      inputEl.dispatchEvent(new Event('change', { bubbles: true }));
+
+      expect(inputEl.value).toBe('');
+    });
+
+    it('should call onFilesSelected when files are chosen via directory input', async () => {
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const file = new File(['data'], 'file.txt');
+      const dirInput = page.getByLabelText('Select folder');
+      const inputEl = dirInput.element() as HTMLInputElement;
+      const dt = new DataTransfer();
+      dt.items.add(file);
+      inputEl.files = dt.files;
+      inputEl.dispatchEvent(new Event('change', { bubbles: true }));
+
+      expect(onFilesSelected).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe('drag and drop', () => {
+    it('should add visual feedback on dragover', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      dropzoneEl.dispatchEvent(new DragEvent('dragover', { bubbles: true, cancelable: true }));
+
+      // After dragover, the element should have the active drag classes
+      await expect.element(dropzone).toHaveClass(/border-primary/);
+    });
+
+    it('should remove visual feedback on dragleave', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      // First dragover to set dragOver = true
+      dropzoneEl.dispatchEvent(new DragEvent('dragover', { bubbles: true, cancelable: true }));
+      // Then dragleave to set dragOver = false
+      dropzoneEl.dispatchEvent(new DragEvent('dragleave', { bubbles: true }));
+
+      // The border-primary class from the conditional should be gone
+      // The element still has hover:border-primary/60 but not the conditional border-primary
+      const classes = dropzoneEl.className;
+      // The conditional adds 'border-primary bg-primary/5' when dragOver is true
+      // When false, those classes are not present (the empty string branch)
+      expect(classes).not.toContain(' border-primary ');
+    });
+
+    it('should call onFilesSelected on drop with collected files', async () => {
+      const collectMock = await getCollectDroppedFilesMock();
+      const fileName = faker.system.fileName();
+      const file = new File(['data'], fileName);
+      collectMock.mockResolvedValueOnce([{ file, relativePath: fileName }]);
+
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      const dropEvent = createDropEvent([file]);
+      dropzoneEl.dispatchEvent(dropEvent);
+
+      // Wait for async handleDrop
+      await vi.waitFor(() => {
+        expect(onFilesSelected).toHaveBeenCalledWith([{ file, relativePath: fileName }]);
+      });
+    });
+
+    it('should fall back to dt.files when collectDroppedFiles throws', async () => {
+      const collectMock = await getCollectDroppedFilesMock();
+      collectMock.mockRejectedValueOnce(new Error('unsupported'));
+
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      const file = new File(['data'], 'fallback.txt');
+      const dropEvent = createDropEvent([file]);
+      dropzoneEl.dispatchEvent(dropEvent);
+
+      await vi.waitFor(() => {
+        expect(onFilesSelected).toHaveBeenCalledWith([
+          { file: expect.any(File), relativePath: 'fallback.txt' }
+        ]);
+      });
+    });
+
+    it('should not call onFilesSelected when drop has no files', async () => {
+      const collectMock = await getCollectDroppedFilesMock();
+      collectMock.mockResolvedValueOnce([]);
+
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      const dropEvent = createDropEvent([]);
+      dropzoneEl.dispatchEvent(dropEvent);
+
+      // Wait a tick to ensure the async handler completes
+      await new Promise((r) => setTimeout(r, 50));
+      expect(onFilesSelected).not.toHaveBeenCalled();
+    });
+
+    it('should handle drop with no dataTransfer', async () => {
+      const onFilesSelected = vi.fn();
+      render(UploadDropzone, { onFilesSelected });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      // DragEvent without dataTransfer
+      const dropEvent = new DragEvent('drop', { bubbles: true, cancelable: true });
+      dropzoneEl.dispatchEvent(dropEvent);
+
+      await new Promise((r) => setTimeout(r, 50));
+      expect(onFilesSelected).not.toHaveBeenCalled();
+    });
+
+    it('should reset dragOver on drop', async () => {
+      const collectMock = await getCollectDroppedFilesMock();
+      collectMock.mockResolvedValueOnce([]);
+
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+
+      // Set dragOver = true first
+      dropzoneEl.dispatchEvent(new DragEvent('dragover', { bubbles: true, cancelable: true }));
+      // Then drop
+      const dropEvent = createDropEvent([]);
+      dropzoneEl.dispatchEvent(dropEvent);
+
+      await vi.waitFor(() => {
+        // dragOver should be false, so no conditional border-primary class
+        expect(dropzoneEl.className).not.toMatch(/\bborder-primary\b(?!\/)/);
+      });
+    });
+  });
+
+  describe('click interactions', () => {
+    it('should open file picker on dropzone click', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const fileInput = page.getByLabelText('Select files').element() as HTMLInputElement;
+      const clickSpy = vi.spyOn(fileInput, 'click');
+
+      const dropzone = page.getByRole('button', {
+        name: 'Drop files or a folder here, or click to browse'
+      });
+      const dropzoneEl = dropzone.element() as HTMLElement;
+      dropzoneEl.click();
+
+      expect(clickSpy).toHaveBeenCalled();
+    });
+
+    it('should open file picker on Select files button click', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const fileInput = page.getByLabelText('Select files').element() as HTMLInputElement;
+      const clickSpy = vi.spyOn(fileInput, 'click');
+
+      const btn = page.getByRole('button', { name: 'Select files' });
+      (btn.element() as HTMLElement).click();
+
+      expect(clickSpy).toHaveBeenCalled();
+    });
+
+    it('should open directory picker on Select folder button click', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dirInput = page.getByLabelText('Select folder').element() as HTMLInputElement;
+      const clickSpy = vi.spyOn(dirInput, 'click');
+
+      const btn = page.getByRole('button', { name: 'Select folder' });
+      (btn.element() as HTMLElement).click();
+
+      expect(clickSpy).toHaveBeenCalled();
+    });
+  });
+
+  describe('directory input', () => {
+    it('should set webkitdirectory attribute on directory input', async () => {
+      render(UploadDropzone, { onFilesSelected: vi.fn() });
+
+      const dirInput = page.getByLabelText('Select folder');
+      await expect.element(dirInput).toHaveAttribute('webkitdirectory');
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/upload/UploadEntryStatus.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadEntryStatus.svelte.spec.ts
new file mode 100644
index 00000000..789254fd
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/UploadEntryStatus.svelte.spec.ts
@@ -0,0 +1,148 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import UploadEntryStatus from './UploadEntryStatus.svelte';
+import type { FileEntry } from './types.js';
+
+function makeEntry(overrides: Partial<FileEntry> = {}): FileEntry {
+  const name = overrides.file?.name ?? faker.system.fileName();
+  return {
+    id: faker.string.uuid(),
+    file: new File(['content'], name),
+    displayPath: name,
+    targetKey: `bucket/${name}`,
+    conflict: false,
+    resolution: null,
+    customName: '',
+    renameState: 'idle',
+    status: 'pending',
+    progress: 0,
+    ...overrides
+  };
+}
+
+describe('UploadEntryStatus', () => {
+  describe('status labels', () => {
+    it('should show "done" for done status', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'done' }) });
+      await expect.element(page.getByText('done')).toBeInTheDocument();
+    });
+
+    it('should show "failed" for error status', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'error' }) });
+      await expect.element(page.getByText('failed')).toBeInTheDocument();
+    });
+
+    it('should show "skipped" for skipped status', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'skipped' }) });
+      await expect.element(page.getByText('skipped')).toBeInTheDocument();
+    });
+
+    it('should show "queued" for pending status', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'pending' }) });
+      await expect.element(page.getByText('queued')).toBeInTheDocument();
+    });
+
+    it('should show progress percentage when uploading', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'uploading', progress: 50 }) });
+      await expect.element(page.getByText('50%')).toBeInTheDocument();
+    });
+  });
+
+  describe('progress bar', () => {
+    it('should show progress bar when uploading', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'uploading', progress: 75 }) });
+
+      const progressBar = page.getByRole('progressbar');
+      await expect.element(progressBar).toBeInTheDocument();
+      await expect.element(progressBar).toHaveAttribute('aria-valuenow', '75');
+      await expect.element(progressBar).toHaveAttribute('aria-valuemin', '0');
+      await expect.element(progressBar).toHaveAttribute('aria-valuemax', '100');
+    });
+
+    it('should handle 0% progress', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'uploading', progress: 0 }) });
+
+      await expect.element(page.getByText('0%')).toBeInTheDocument();
+      await expect.element(page.getByRole('progressbar')).toHaveAttribute('aria-valuenow', '0');
+    });
+
+    it('should handle 100% progress', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'uploading', progress: 100 }) });
+
+      await expect.element(page.getByText('100%')).toBeInTheDocument();
+      await expect.element(page.getByRole('progressbar')).toHaveAttribute('aria-valuenow', '100');
+    });
+
+    it('should not show progress bar for non-uploading statuses', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'done' }) });
+
+      await expect.element(page.getByRole('progressbar')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('error display', () => {
+    it('should show error message when status is error', async () => {
+      const errorMessage = faker.lorem.sentence();
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'error', errorMessage }) });
+
+      await expect.element(page.getByText(errorMessage)).toBeInTheDocument();
+    });
+
+    it('should not show error paragraph when status is error but errorMessage is absent', async () => {
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'error' }) });
+
+      await expect.element(page.getByText('failed')).toBeInTheDocument();
+      // Only the "failed" label should exist, no error paragraph
+      const errorParagraphs = page.getByRole('listitem').element().querySelectorAll('p.text-error');
+      expect(errorParagraphs.length).toBe(0);
+    });
+
+    it('should handle long error messages', async () => {
+      const errorMessage = faker.lorem.paragraphs(3);
+      render(UploadEntryStatus, { entry: makeEntry({ status: 'error', errorMessage }) });
+
+      await expect.element(page.getByText(errorMessage)).toBeInTheDocument();
+    });
+  });
+
+  describe('file name display', () => {
+    it('should show filename from targetKey', async () => {
+      const entry = makeEntry({ targetKey: 'deep/nested/path/report.csv' });
+      render(UploadEntryStatus, { entry });
+
+      await expect.element(page.getByText('report.csv')).toBeInTheDocument();
+    });
+
+    it('should show customName when resolution is rename', async () => {
+      const entry = makeEntry({
+        resolution: 'rename',
+        customName: 'renamed-file.txt',
+        targetKey: 'folder/original.txt'
+      });
+      render(UploadEntryStatus, { entry });
+
+      await expect.element(page.getByText('renamed-file.txt')).toBeInTheDocument();
+    });
+
+    it('should fall back to targetKey filename when resolution is rename but customName is empty', async () => {
+      const entry = makeEntry({
+        resolution: 'rename',
+        customName: '   ',
+        targetKey: 'folder/fallback.txt'
+      });
+      render(UploadEntryStatus, { entry });
+
+      await expect.element(page.getByText('fallback.txt')).toBeInTheDocument();
+    });
+
+    it('should handle special characters in names', async () => {
+      const specialName = 'file (1) [copy] & data.txt';
+      const entry = makeEntry({ targetKey: `folder/${specialName}` });
+      render(UploadEntryStatus, { entry });
+
+      await expect.element(page.getByText(specialName)).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
new file mode 100644
index 00000000..5aace25a
--- /dev/null
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -0,0 +1,590 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import UploadModal from './UploadModal.svelte';
+
+const { mockCheckObjectExists, mockUploadFile, MockUploadError } = vi.hoisted(() => {
+  const mockCheckObjectExists = vi.fn().mockResolvedValue(false);
+  const mockUploadFile = vi.fn().mockResolvedValue(undefined);
+
+  class MockUploadError extends Error {
+    code: string;
+    constructor(code: string, message: string) {
+      super(message);
+      this.code = code;
+      this.name = 'UploadError';
+    }
+  }
+
+  return { mockCheckObjectExists, mockUploadFile, MockUploadError };
+});
+
+vi.mock('$lib/storage/upload.js', () => ({
+  checkObjectExists: mockCheckObjectExists,
+  uploadFile: mockUploadFile,
+  UploadError: MockUploadError
+}));
+
+const defaultProps = {
+  open: true,
+  bucket: faker.word.noun(),
+  prefix: '',
+  onSuccess: vi.fn()
+};
+
+/** Helper: select files via the hidden file input inside the dropzone */
+function selectFiles(files: File[]) {
+  const fileInput = document.querySelector('input[type="file"][multiple]') as HTMLInputElement;
+  const dt = new DataTransfer();
+  files.forEach((f) => dt.items.add(f));
+  fileInput.files = dt.files;
+  fileInput.dispatchEvent(new Event('change', { bubbles: true }));
+}
+
+function createFile(name: string, size = 100): File {
+  const content = new Uint8Array(size);
+  return new File([content], name);
+}
+
+/** Wait for async operations to settle */
+async function tick(ms = 50) {
+  await new Promise((r) => setTimeout(r, ms));
+}
+
+/**
+ * Returns a manually-controlled promise so tests can check intermediate state
+ * and then cleanly resolve the operation before teardown — avoiding state
+ * updates on already-destroyed Svelte components.
+ */
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  const promise = new Promise<T>((res) => {
+    resolve = res;
+  });
+  return { promise, resolve };
+}
+
+/** Select files and click Upload, wait for the flow to complete */
+async function selectAndUpload(files: File[]) {
+  selectFiles(files);
+  await tick();
+  await page.getByRole('button', { name: /upload/i }).click();
+  await tick(300);
+}
+
+describe('UploadModal', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockCheckObjectExists.mockResolvedValue(false);
+    mockUploadFile.mockResolvedValue(undefined);
+  });
+
+  describe('initial render (idle phase)', () => {
+    it('should render a dialog when open', async () => {
+      render(UploadModal, defaultProps);
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+
+    it('should show the upload title heading', async () => {
+      render(UploadModal, defaultProps);
+      await expect.element(page.getByRole('heading', { level: 2 })).toBeInTheDocument();
+    });
+
+    it('should show a close button', async () => {
+      render(UploadModal, defaultProps);
+      const closeBtn = page.getByRole('button', { name: /close/i });
+      await expect.element(closeBtn).toBeInTheDocument();
+    });
+
+    it('should not show prefix info when prefix is empty', async () => {
+      render(UploadModal, { ...defaultProps, prefix: '' });
+      const dialog = page.getByRole('dialog');
+      await expect.element(dialog).toBeInTheDocument();
+    });
+
+    it('should show prefix info when prefix is provided', async () => {
+      const prefix = 'data/reports/';
+      render(UploadModal, { ...defaultProps, prefix });
+      await expect.element(page.getByText(prefix)).toBeInTheDocument();
+    });
+  });
+
+  describe('when open is false', () => {
+    it('should not render dialog content', async () => {
+      render(UploadModal, { ...defaultProps, open: false });
+      const heading = page.getByRole('heading', { level: 2 });
+      await expect.element(heading).not.toBeInTheDocument();
+    });
+  });
+
+  describe('selected phase (file list preview)', () => {
+    it('should show selected files after file selection', async () => {
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('report.csv')]);
+      await tick();
+
+      await expect.element(page.getByText('report.csv')).toBeInTheDocument();
+    });
+
+    it('should show file count for single file', async () => {
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt')]);
+      await tick();
+
+      await expect.element(page.getByText(/1 file/i)).toBeInTheDocument();
+    });
+
+    it('should show file count for multiple files', async () => {
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt'), createFile('b.txt'), createFile('c.txt')]);
+      await tick();
+
+      await expect.element(page.getByText(/3 files/i)).toBeInTheDocument();
+    });
+
+    it('should show file list and total size info', async () => {
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt', 1024)]);
+      await tick();
+
+      const list = page.getByRole('list');
+      await expect.element(list).toBeInTheDocument();
+    });
+
+    it('should show cancel and upload buttons', async () => {
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt')]);
+      await tick();
+
+      await expect.element(page.getByRole('button', { name: /cancel/i })).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: /upload/i })).toBeInTheDocument();
+    });
+  });
+
+  describe('buildTargetKey with prefix', () => {
+    it('should prepend prefix to file path when checking conflicts', async () => {
+      const prefix = 'data/';
+      render(UploadModal, { ...defaultProps, prefix });
+      await selectAndUpload([createFile('report.csv')]);
+
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'data/report.csv');
+    });
+
+    it('should use filename directly when prefix is empty', async () => {
+      render(UploadModal, { ...defaultProps, prefix: '' });
+      await selectAndUpload([createFile('report.csv')]);
+
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'report.csv');
+    });
+  });
+
+  describe('upload flow - no conflicts', () => {
+    it('should check for existing objects', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt'), createFile('b.txt')]);
+
+      expect(mockCheckObjectExists).toHaveBeenCalledTimes(2);
+    });
+
+    it('should upload all files when no conflicts exist', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      expect(mockUploadFile).toHaveBeenCalledTimes(1);
+      expect(mockUploadFile).toHaveBeenCalledWith(
+        defaultProps.bucket,
+        'a.txt',
+        expect.any(File),
+        expect.any(Function)
+      );
+    });
+
+    it('should show complete phase after successful upload', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+    });
+
+    it('should show done button after completion', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      await expect.element(page.getByRole('button', { name: /done/i })).toBeInTheDocument();
+    });
+
+    it('should call onSuccess when done is clicked after uploads', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      await page.getByRole('button', { name: /done/i }).click();
+      await tick();
+
+      expect(defaultProps.onSuccess).toHaveBeenCalled();
+    });
+  });
+
+  describe('upload flow - with conflicts', () => {
+    it('should show review phase when conflicts are detected', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('existing.txt')]);
+
+      await expect.element(page.getByText(/conflict/i)).toBeInTheDocument();
+    });
+
+    it('should disable upload button when conflicts are unresolved', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('existing.txt')]);
+
+      const uploadBtn = page.getByRole('button', { name: /upload/i });
+      await expect.element(uploadBtn).toBeDisabled();
+    });
+
+    it('should show conflict entries list', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('existing.txt')]);
+
+      // The conflict list should be present in review phase
+      const list = page.getByRole('list');
+      await expect.element(list).toBeInTheDocument();
+    });
+  });
+
+  describe('upload flow - error handling', () => {
+    it('should handle checkObjectExists failures gracefully', async () => {
+      mockCheckObjectExists.mockRejectedValue(new Error('Network error'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      // Should proceed to upload (conflict defaults to false on error)
+      expect(mockUploadFile).toHaveBeenCalled();
+    });
+
+    it('should show error state when upload fails with UploadError (access_denied)', async () => {
+      mockUploadFile.mockRejectedValue(new MockUploadError('access_denied', 'Access denied'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+      // Error list should be visible
+      const errorList = page.getByRole('list', { name: /failed/i });
+      await expect.element(errorList).toBeInTheDocument();
+    });
+
+    it('should show error state when upload fails with unknown error', async () => {
+      mockUploadFile.mockRejectedValue(new Error('Something went wrong'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+    });
+
+    it('should handle not_connected error', async () => {
+      mockUploadFile.mockRejectedValue(new MockUploadError('not_connected', 'Not connected'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      const errorList = page.getByRole('list', { name: /failed/i });
+      await expect.element(errorList).toBeInTheDocument();
+    });
+
+    it('should handle no_such_bucket error', async () => {
+      mockUploadFile.mockRejectedValue(new MockUploadError('no_such_bucket', 'No such bucket'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      const errorList = page.getByRole('list', { name: /failed/i });
+      await expect.element(errorList).toBeInTheDocument();
+    });
+
+    it('should handle invalid_part error', async () => {
+      mockUploadFile.mockRejectedValue(new MockUploadError('invalid_part', 'Invalid part'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      const errorList = page.getByRole('list', { name: /failed/i });
+      await expect.element(errorList).toBeInTheDocument();
+    });
+
+    it('should handle server_error', async () => {
+      mockUploadFile.mockRejectedValue(new MockUploadError('server_error', 'Server error'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      const errorList = page.getByRole('list', { name: /failed/i });
+      await expect.element(errorList).toBeInTheDocument();
+    });
+
+    it('should show error filename in error list', async () => {
+      mockUploadFile.mockRejectedValue(new MockUploadError('access_denied', 'Denied'));
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('secret.txt')]);
+
+      await expect.element(page.getByText(/secret\.txt/)).toBeInTheDocument();
+    });
+  });
+
+  describe('upload progress', () => {
+    it('should call uploadFile with progress callback', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      expect(mockUploadFile).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.any(String),
+        expect.any(File),
+        expect.any(Function)
+      );
+    });
+
+    it('should update progress via callback and reach complete', async () => {
+      mockUploadFile.mockImplementation(
+        async (_bucket: string, _key: string, _file: File, onProgress: (pct: number) => void) => {
+          onProgress(50);
+          onProgress(100);
+        }
+      );
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+    });
+  });
+
+  describe('cancel behaviour', () => {
+    it('should close modal when cancel is clicked in selected phase', async () => {
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt')]);
+      await tick();
+
+      await page.getByRole('button', { name: /cancel/i }).click();
+      await tick();
+
+      const heading = page.getByRole('heading', { level: 2 });
+      await expect.element(heading).not.toBeInTheDocument();
+    });
+
+    it('should close modal when close button is clicked in idle phase', async () => {
+      render(UploadModal, defaultProps);
+
+      await page.getByRole('button', { name: /close/i }).click();
+      await tick();
+
+      const heading = page.getByRole('heading', { level: 2 });
+      await expect.element(heading).not.toBeInTheDocument();
+    });
+
+    it('should show cancel button in review phase', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('existing.txt')]);
+
+      await expect.element(page.getByRole('button', { name: /cancel/i })).toBeInTheDocument();
+    });
+  });
+
+  describe('done handler', () => {
+    it('should call onSuccess when there are uploaded files', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt')]);
+
+      await page.getByRole('button', { name: /done/i }).click();
+      await tick();
+
+      expect(defaultProps.onSuccess).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe('multiple file upload with concurrency', () => {
+    it('should upload multiple files', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([
+        createFile('a.txt'),
+        createFile('b.txt'),
+        createFile('c.txt'),
+        createFile('d.txt'),
+        createFile('e.txt')
+      ]);
+
+      expect(mockUploadFile).toHaveBeenCalledTimes(5);
+    });
+  });
+
+  describe('mixed conflict and non-conflict files', () => {
+    it('should show review phase when at least one file conflicts', async () => {
+      let callCount = 0;
+      mockCheckObjectExists.mockImplementation(async () => {
+        callCount++;
+        return callCount === 1; // Only first file conflicts
+      });
+
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('existing.txt'), createFile('new.txt')]);
+
+      await expect.element(page.getByText(/conflict/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('resolvedKey with prefix', () => {
+    it('should use prefix in target key for uploaded files', async () => {
+      const prefix = 'folder/sub/';
+      render(UploadModal, { ...defaultProps, prefix });
+      await selectAndUpload([createFile('data.csv')]);
+
+      expect(mockUploadFile).toHaveBeenCalledWith(
+        expect.any(String),
+        'folder/sub/data.csv',
+        expect.any(File),
+        expect.any(Function)
+      );
+    });
+  });
+
+  describe('checking phase', () => {
+    it('should show checking state during conflict check', async () => {
+      const check = deferred<boolean>();
+      mockCheckObjectExists.mockReturnValue(check.promise);
+
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt')]);
+      await tick();
+
+      await page.getByRole('button', { name: /upload/i }).click();
+
+      // Phase transitions to 'checking' before the check resolves; poll until
+      // the DOM reflects that state.
+      await expect.element(page.getByText(/checking/i)).toBeInTheDocument();
+
+      // Resolve the check and wait for the full upload flow to complete so no
+      // state updates land on an already-destroyed component after teardown.
+      check.resolve(false);
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+    });
+  });
+
+  describe('accessibility', () => {
+    it('should have a dialog role', async () => {
+      render(UploadModal, defaultProps);
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+
+    it('should have a heading', async () => {
+      render(UploadModal, defaultProps);
+      await expect.element(page.getByRole('heading')).toBeInTheDocument();
+    });
+
+    it('should have aria-label on close button', async () => {
+      render(UploadModal, defaultProps);
+      const closeBtn = page.getByRole('button', { name: /close/i });
+      await expect.element(closeBtn).toBeInTheDocument();
+    });
+
+    it('should have aria-disabled on upload button when conflicts unresolved', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('existing.txt')]);
+
+      const uploadBtn = page.getByRole('button', { name: /upload/i });
+      await expect.element(uploadBtn).toHaveAttribute('aria-disabled', 'true');
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle long prefix display', async () => {
+      const longPrefix = 'a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/';
+      render(UploadModal, { ...defaultProps, prefix: longPrefix });
+      await expect.element(page.getByText(longPrefix)).toBeInTheDocument();
+    });
+
+    it('should handle bucket with special characters', async () => {
+      render(UploadModal, { ...defaultProps, bucket: 'my-bucket-123' });
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+    });
+
+    it('should pass bucket name to upload functions', async () => {
+      const bucket = 'test-bucket-xyz';
+      render(UploadModal, { ...defaultProps, bucket });
+      await selectAndUpload([createFile('a.txt')]);
+
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(bucket, expect.any(String));
+      expect(mockUploadFile).toHaveBeenCalledWith(
+        bucket,
+        expect.any(String),
+        expect.any(File),
+        expect.any(Function)
+      );
+    });
+
+    it('should show uploading phase list during upload', async () => {
+      const upload = deferred<void>();
+      mockUploadFile.mockReturnValue(upload.promise);
+
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt')]);
+      await tick();
+
+      await page.getByRole('button', { name: /upload/i }).click();
+
+      // During uploading the file list is visible; poll until the uploading
+      // phase is reached (after the conflict-check microtasks settle).
+      const list = page.getByRole('list');
+      await expect.element(list).toBeInTheDocument();
+
+      // Resolve the upload so the component reaches 'complete' cleanly before
+      // teardown, avoiding a state update on a destroyed component.
+      upload.resolve();
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+    });
+
+    it('should close button be disabled during upload', async () => {
+      const upload = deferred<void>();
+      mockUploadFile.mockReturnValue(upload.promise);
+
+      render(UploadModal, defaultProps);
+      selectFiles([createFile('a.txt')]);
+      await tick();
+
+      await page.getByRole('button', { name: /upload/i }).click();
+
+      // The close button is disabled while an upload is in progress.
+      const closeBtn = page.getByRole('button', { name: /close/i });
+      await expect.element(closeBtn).toBeDisabled();
+
+      // Resolve the upload so the component reaches 'complete' cleanly before
+      // teardown, avoiding a state update on a destroyed component.
+      upload.resolve();
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+    });
+  });
+
+  describe('complete phase summary', () => {
+    it('should show uploaded count in summary', async () => {
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt'), createFile('b.txt')]);
+
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+      // Done button available
+      await expect.element(page.getByRole('button', { name: /done/i })).toBeInTheDocument();
+    });
+
+    it('should show mixed success/error summary', async () => {
+      let callIdx = 0;
+      mockUploadFile.mockImplementation(async () => {
+        callIdx++;
+        if (callIdx === 2) throw new MockUploadError('access_denied', 'Denied');
+      });
+
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('ok.txt'), createFile('fail.txt')]);
+
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+      // Error list should show
+      const errorList = page.getByRole('list', { name: /failed/i });
+      await expect.element(errorList).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/shared/TimestampDisplay.svelte.spec.ts b/src/lib/components/storage/shared/TimestampDisplay.svelte.spec.ts
new file mode 100644
index 00000000..84317a10
--- /dev/null
+++ b/src/lib/components/storage/shared/TimestampDisplay.svelte.spec.ts
@@ -0,0 +1,141 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi, afterEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import TimestampDisplay from './TimestampDisplay.svelte';
+
+describe('TimestampDisplay', () => {
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  describe('absolute mode (relative=false)', () => {
+    it('should render a formatted date', async () => {
+      const date = new Date(2026, 4, 13); // 13 May 2026
+      render(TimestampDisplay, { date });
+
+      await expect.element(page.getByText(/May.*13.*2026|13.*May.*2026/)).toBeInTheDocument();
+    });
+
+    it('should accept an ISO string', async () => {
+      const date = '2025-01-15T10:30:00Z';
+      render(TimestampDisplay, { date });
+
+      await expect.element(page.getByText(/Jan.*15.*2025|15.*Jan.*2025/)).toBeInTheDocument();
+    });
+
+    it('should have a tooltip with full timestamp', async () => {
+      const date = new Date(2026, 4, 13, 14, 30);
+      render(TimestampDisplay, { date });
+
+      const el = page.getByText(/May.*13.*2026|13.*May.*2026/);
+      await expect.element(el).toHaveAttribute('data-tip');
+    });
+  });
+
+  describe('relative mode (relative=true)', () => {
+    it('should show "just now" for less than 1 minute ago', async () => {
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(2026, 0, 1, 12, 0, 30));
+
+      const date = new Date(2026, 0, 1, 12, 0, 0);
+      render(TimestampDisplay, { date, relative: true });
+
+      await expect.element(page.getByText('just now')).toBeInTheDocument();
+    });
+
+    it('should show minutes ago', async () => {
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(2026, 0, 1, 12, 5, 0));
+
+      const date = new Date(2026, 0, 1, 12, 0, 0);
+      render(TimestampDisplay, { date, relative: true });
+
+      await expect.element(page.getByText('5m ago')).toBeInTheDocument();
+    });
+
+    it('should show hours ago', async () => {
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(2026, 0, 1, 15, 0, 0));
+
+      const date = new Date(2026, 0, 1, 12, 0, 0);
+      render(TimestampDisplay, { date, relative: true });
+
+      await expect.element(page.getByText('3h ago')).toBeInTheDocument();
+    });
+
+    it('should show days ago', async () => {
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(2026, 0, 8, 12, 0, 0));
+
+      const date = new Date(2026, 0, 1, 12, 0, 0);
+      render(TimestampDisplay, { date, relative: true });
+
+      await expect.element(page.getByText('7d ago')).toBeInTheDocument();
+    });
+
+    it('should show months ago', async () => {
+      // 91 days ago guarantees Math.floor(91/30) = 3
+      const date = new Date(Date.now() - 91 * 24 * 60 * 60 * 1000);
+      render(TimestampDisplay, { date, relative: true });
+
+      await expect.element(page.getByText('3mo ago')).toBeInTheDocument();
+    });
+
+    it('should show years ago', async () => {
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(2028, 0, 1, 12, 0, 0));
+
+      const date = new Date(2026, 0, 1, 12, 0, 0);
+      render(TimestampDisplay, { date, relative: true });
+
+      await expect.element(page.getByText('2y ago')).toBeInTheDocument();
+    });
+
+    it('should handle boundary at exactly 60 minutes', async () => {
+      vi.useFakeTimers();
+      vi.setSystemTime(new Date(2026, 0, 1, 13, 0, 0));
+
+      const date = new Date(2026, 0, 1, 12, 0, 0);
+      render(TimestampDisplay, { date, relative: true });
+
+      await expect.element(page.getByText('1h ago')).toBeInTheDocument();
+    });
+  });
+
+  describe('tooltip position', () => {
+    it('should default to tooltip-top', async () => {
+      const date = new Date();
+      render(TimestampDisplay, { date });
+
+      const el = page.getByText(/.+/).element();
+      expect(el?.classList.contains('tooltip-top')).toBe(true);
+    });
+
+    it('should accept custom tooltip position', async () => {
+      const date = new Date();
+      render(TimestampDisplay, { date, tooltip: 'tooltip-bottom' });
+
+      const el = page.getByText(/.+/).element();
+      expect(el?.classList.contains('tooltip-bottom')).toBe(true);
+    });
+  });
+
+  describe('edge cases with faker', () => {
+    it('should handle random past dates', async () => {
+      const date = faker.date.past({ years: 5 });
+      render(TimestampDisplay, { date });
+
+      const el = page.getByText(/.+/);
+      await expect.element(el).toBeInTheDocument();
+    });
+
+    it('should handle ISO string input from faker', async () => {
+      const date = faker.date.recent().toISOString();
+      render(TimestampDisplay, { date, relative: true });
+
+      const el = page.getByText(/.+/);
+      await expect.element(el).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
new file mode 100644
index 00000000..fa2528ce
--- /dev/null
+++ b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
@@ -0,0 +1,344 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, afterEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import { userEvent } from 'vitest/browser';
+import BucketListWrapper from './__tests__/BucketListWrapper.svelte';
+import { setPageState, resetPageState } from './__tests__/page-helper.svelte.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+import type { PinnedLocation } from '$lib/storage/types.js';
+
+function createState(
+  opts: {
+    buckets?: string[];
+    pinned?: PinnedLocation[];
+  } = {}
+): StorageState {
+  const buckets = opts.buckets ?? [];
+  const state = new StorageState({ connected: true, buckets });
+  state.bucket = buckets[0] ?? '';
+  state.prefix = '';
+  if (opts.pinned) {
+    for (const p of opts.pinned) {
+      state.bookmarks.pin(p.bucket, p.prefix);
+    }
+  }
+  return state;
+}
+
+describe('BucketList', () => {
+  afterEach(() => {
+    resetPageState();
+  });
+
+  describe('basic rendering', () => {
+    it('should render navigation with aria-label', async () => {
+      const state = createState({ buckets: ['b1'] });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByRole('navigation')).toBeInTheDocument();
+    });
+
+    it('should show bucket names', async () => {
+      const state = createState({ buckets: ['alpha-bucket', 'beta-bucket'] });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText('alpha-bucket')).toBeInTheDocument();
+      await expect.element(page.getByText('beta-bucket')).toBeInTheDocument();
+    });
+
+    it('should render bucket links', async () => {
+      const state = createState({ buckets: ['my-bucket'] });
+      render(BucketListWrapper, { state });
+
+      const links = page.getByRole('link', { name: /my-bucket/ });
+      await expect.element(links.first()).toBeInTheDocument();
+    });
+  });
+
+  describe('empty state', () => {
+    it('should show empty message when no buckets', async () => {
+      const state = createState({ buckets: [] });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText(/no bucket/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('active bucket highlighting', () => {
+    it('should highlight the active bucket based on URL', async () => {
+      setPageState({
+        url: new URL('http://localhost/storage/active-bucket'),
+        params: { bucket: 'active-bucket', prefix: '' }
+      });
+      const state = createState({ buckets: ['active-bucket', 'other-bucket'] });
+      render(BucketListWrapper, { state });
+
+      const activeLink = page.getByRole('link', { name: /active-bucket/ });
+      await expect.element(activeLink.first()).toHaveAttribute('aria-current', 'page');
+    });
+
+    it('should not set aria-current on bucket when navigated into a prefix', async () => {
+      setPageState({
+        url: new URL('http://localhost/storage/my-bucket/some/prefix'),
+        params: { bucket: 'my-bucket', prefix: 'some/prefix' }
+      });
+      const state = createState({ buckets: ['my-bucket'] });
+      render(BucketListWrapper, { state });
+
+      const link = page.getByRole('link', { name: /my-bucket/ });
+      await expect.element(link.first()).not.toHaveAttribute('aria-current');
+    });
+
+    it('should not highlight any bucket when URL does not match storage', async () => {
+      setPageState({ url: new URL('http://localhost/other-page') });
+      const state = createState({ buckets: ['bucket-a', 'bucket-b'] });
+      render(BucketListWrapper, { state });
+
+      const linkA = page.getByRole('link', { name: /bucket-a/ });
+      const linkB = page.getByRole('link', { name: /bucket-b/ });
+      await expect.element(linkA.first()).not.toHaveAttribute('aria-current');
+      await expect.element(linkB.first()).not.toHaveAttribute('aria-current');
+    });
+
+    it('should apply active styling to the matching bucket', async () => {
+      setPageState({
+        url: new URL('http://localhost/storage/styled-bucket'),
+        params: { bucket: 'styled-bucket', prefix: '' }
+      });
+      const state = createState({ buckets: ['styled-bucket'] });
+      render(BucketListWrapper, { state });
+
+      const link = page.getByRole('link', { name: /styled-bucket/ });
+      await expect.element(link.first()).toHaveClass('text-primary');
+    });
+  });
+
+  describe('pinned locations', () => {
+    it('should show pinned locations section when pins exist', async () => {
+      const state = createState({
+        buckets: ['test-bucket'],
+        pinned: [{ bucket: 'test-bucket', prefix: 'data/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText(/pinned/i)).toBeInTheDocument();
+    });
+
+    it('should not show pinned section when no pins', async () => {
+      const state = createState({ buckets: ['b1'] });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText(/bucket/i)).toBeInTheDocument();
+    });
+
+    it('should show pinned location label', async () => {
+      const state = createState({
+        buckets: ['data-lake'],
+        pinned: [{ bucket: 'data-lake', prefix: 'reports/2024/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText('2024')).toBeInTheDocument();
+    });
+
+    it('should show bucket name as label for root pin', async () => {
+      const state = createState({
+        buckets: ['my-bucket'],
+        pinned: [{ bucket: 'my-bucket', prefix: '' }]
+      });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText(/pinned/i)).toBeInTheDocument();
+      const links = page.getByRole('link', { name: /my-bucket/ });
+      await expect.element(links.first()).toBeInTheDocument();
+    });
+
+    it('should highlight active pinned location', async () => {
+      setPageState({
+        url: new URL('http://localhost/storage/test-bucket/data/'),
+        params: { bucket: 'test-bucket', prefix: 'data' }
+      });
+      const state = createState({
+        buckets: ['test-bucket'],
+        pinned: [{ bucket: 'test-bucket', prefix: 'data/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const pinnedLinks = page.getByRole('link', { name: /^data$/i });
+      await expect.element(pinnedLinks.first()).toHaveAttribute('aria-current', 'page');
+    });
+
+    it('should not highlight pinned location when prefix does not match', async () => {
+      setPageState({
+        url: new URL('http://localhost/storage/test-bucket/other/'),
+        params: { bucket: 'test-bucket', prefix: 'other' }
+      });
+      const state = createState({
+        buckets: ['test-bucket'],
+        pinned: [{ bucket: 'test-bucket', prefix: 'data/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const pinnedLinks = page.getByRole('link', { name: /^data$/i });
+      await expect.element(pinnedLinks.first()).not.toHaveAttribute('aria-current');
+    });
+
+    it('should not highlight pinned location when bucket does not match', async () => {
+      setPageState({
+        url: new URL('http://localhost/storage/other-bucket/'),
+        params: { bucket: 'other-bucket', prefix: '' }
+      });
+      const state = createState({
+        buckets: ['test-bucket', 'other-bucket'],
+        pinned: [{ bucket: 'test-bucket', prefix: '' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const pinnedLinks = page.getByRole('link', { name: /test-bucket/ });
+      await expect.element(pinnedLinks.first()).not.toHaveAttribute('aria-current');
+    });
+
+    it('should render multiple pinned locations', async () => {
+      const state = createState({
+        buckets: ['bucket-a', 'bucket-b'],
+        pinned: [
+          { bucket: 'bucket-a', prefix: '' },
+          { bucket: 'bucket-b', prefix: 'logs/' }
+        ]
+      });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText(/pinned/i)).toBeInTheDocument();
+      await expect.element(page.getByText('logs')).toBeInTheDocument();
+    });
+  });
+
+  describe('unpin context menu', () => {
+    it('should open context menu when more options button is clicked', async () => {
+      const state = createState({
+        buckets: ['ctx-bucket'],
+        pinned: [{ bucket: 'ctx-bucket', prefix: 'only-pin/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const moreButton = page.getByRole('button', { name: /more options/i }).first();
+      await moreButton.click();
+
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).toBeInTheDocument();
+    });
+
+    it('should close context menu when close button is clicked', async () => {
+      const state = createState({
+        buckets: ['ctx-bucket2'],
+        pinned: [{ bucket: 'ctx-bucket2', prefix: 'pin2/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const moreButton = page.getByRole('button', { name: /more options/i }).first();
+      await moreButton.click();
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).toBeInTheDocument();
+
+      const closeButton = page.getByRole('menuitem', { name: /close/i });
+      await closeButton.click();
+
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).not.toBeInTheDocument();
+    });
+
+    it('should close context menu when Escape key is pressed', async () => {
+      const state = createState({
+        buckets: ['ctx-bucket3'],
+        pinned: [{ bucket: 'ctx-bucket3', prefix: 'pin3/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const moreButton = page.getByRole('button', { name: /more options/i }).first();
+      await moreButton.click();
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).toBeInTheDocument();
+
+      await userEvent.keyboard('{Escape}');
+
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).not.toBeInTheDocument();
+    });
+
+    it('should close context menu when clicking outside', async () => {
+      const state = createState({
+        buckets: ['ctx-bucket4'],
+        pinned: [{ bucket: 'ctx-bucket4', prefix: 'pin4/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const moreButton = page.getByRole('button', { name: /more options/i }).first();
+      await moreButton.click();
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).toBeInTheDocument();
+
+      const nav = page.getByRole('navigation');
+      await nav.first().click();
+
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).not.toBeInTheDocument();
+    });
+
+    it('should unpin location when unpin button is clicked', async () => {
+      const state = createState({
+        buckets: ['ctx-bucket5'],
+        pinned: [{ bucket: 'ctx-bucket5', prefix: 'pin5/' }]
+      });
+      render(BucketListWrapper, { state });
+
+      const moreButton = page.getByRole('button', { name: /more options/i }).first();
+      await moreButton.click();
+
+      const unpinButton = page.getByRole('menuitem', { name: /unpin/i });
+      await unpinButton.click();
+
+      await expect.element(page.getByRole('menuitem', { name: /unpin/i })).not.toBeInTheDocument();
+    });
+
+    it('should not throw when pressing Escape without menu open', async () => {
+      const state = createState({ buckets: ['b1'] });
+      render(BucketListWrapper, { state });
+
+      await userEvent.keyboard('{Escape}');
+
+      await expect.element(page.getByRole('navigation')).toBeInTheDocument();
+    });
+  });
+
+  describe('disconnect button', () => {
+    it('should render disconnect button', async () => {
+      const state = createState({ buckets: ['b1'] });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByRole('button', { name: /disconnect/i })).toBeInTheDocument();
+    });
+
+    it('should be a submit button inside a form', async () => {
+      const state = createState({ buckets: ['b1'] });
+      render(BucketListWrapper, { state });
+
+      const button = page.getByRole('button', { name: /disconnect/i });
+      await expect.element(button).toHaveAttribute('type', 'submit');
+    });
+  });
+
+  describe('long bucket names', () => {
+    it('should render long bucket names without error', async () => {
+      const longName = faker.string.alpha(64);
+      const state = createState({ buckets: [longName] });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText(longName)).toBeInTheDocument();
+    });
+  });
+
+  describe('many buckets', () => {
+    it('should render many buckets', async () => {
+      const buckets = Array.from({ length: 20 }, (_, i) => `bucket-${i}`);
+      const state = createState({ buckets });
+      render(BucketListWrapper, { state });
+
+      await expect.element(page.getByText('bucket-0')).toBeInTheDocument();
+      await expect.element(page.getByText('bucket-19')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte b/src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte
new file mode 100644
index 00000000..622b879f
--- /dev/null
+++ b/src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte
@@ -0,0 +1,15 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import BucketList from '../BucketList.svelte';
+
+  interface Props {
+    state: StorageState;
+  }
+
+  let { state }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<BucketList />
diff --git a/src/lib/components/storage/sidebar/__tests__/page-helper.svelte.ts b/src/lib/components/storage/sidebar/__tests__/page-helper.svelte.ts
new file mode 100644
index 00000000..91720381
--- /dev/null
+++ b/src/lib/components/storage/sidebar/__tests__/page-helper.svelte.ts
@@ -0,0 +1,34 @@
+/**
+ * Test helper to set SvelteKit page state in vitest browser-mode tests.
+ *
+ * The `page` object from `$app/state` is read-only (getter-only proxy),
+ * but the underlying `_page` from SvelteKit's internal state module has
+ * writable `$state.raw` fields and an `update()` function that applies
+ * partial updates via `Object.assign`.
+ *
+ * We import the internal module here because `.svelte.ts` files are
+ * processed by the SvelteKit vite plugin which resolves the path.
+ */
+
+// @ts-expect-error — internal SvelteKit module, not part of public API
+
+import { update } from '../../../../../../node_modules/@sveltejs/kit/src/runtime/client/state.svelte.js';
+import type { Page } from '@sveltejs/kit';
+
+export function setPageState(overrides: Partial<Omit<Page, 'url'>> & { url?: URL }): void {
+  update(overrides);
+}
+
+export function resetPageState(): void {
+  update({
+    // eslint-disable-next-line svelte/prefer-svelte-reactivity
+    url: new URL('https://example.com'),
+    params: {},
+    route: { id: null },
+    data: {},
+    form: null,
+    error: null,
+    state: {},
+    status: -1
+  });
+}
diff --git a/src/lib/server/storage/factory.test.ts b/src/lib/server/storage/factory.test.ts
new file mode 100644
index 00000000..bee9877b
--- /dev/null
+++ b/src/lib/server/storage/factory.test.ts
@@ -0,0 +1,36 @@
+import { describe, it, expect, vi } from 'vitest';
+import { faker } from '@faker-js/faker';
+
+vi.mock('./s3-provider.js', () => ({
+  S3StorageProvider: class S3StorageProvider {
+    constructor(public config: unknown) {}
+  }
+}));
+
+vi.mock('./hdfs-provider.js', () => ({
+  HDFSStorageProvider: class HDFSStorageProvider {
+    constructor(public config: unknown) {}
+  }
+}));
+
+import { StorageProviderFactory } from './factory.js';
+import type { S3Config, HDFSConfig } from './types.js';
+
+describe('StorageProviderFactory', () => {
+  it('creates S3StorageProvider for type s3', () => {
+    const config: S3Config = { type: 's3', region: 'us-east-1', bucket: 'test' };
+    const provider = StorageProviderFactory.create(config);
+    expect((provider as unknown as { config: S3Config }).config).toEqual(config);
+  });
+
+  it('creates HDFSStorageProvider for type hdfs', () => {
+    const config: HDFSConfig = {
+      type: 'hdfs',
+      nameNode: faker.internet.url(),
+      port: 9870,
+      user: faker.internet.username()
+    };
+    const provider = StorageProviderFactory.create(config);
+    expect((provider as unknown as { config: HDFSConfig }).config).toEqual(config);
+  });
+});
diff --git a/src/lib/server/storage/hdfs-provider.test.ts b/src/lib/server/storage/hdfs-provider.test.ts
new file mode 100644
index 00000000..09682798
--- /dev/null
+++ b/src/lib/server/storage/hdfs-provider.test.ts
@@ -0,0 +1,99 @@
+import { describe, it, expect } from 'vitest';
+import { HDFSStorageProvider } from './hdfs-provider.js';
+import type { HDFSConfig } from './types.js';
+
+const config: HDFSConfig = {
+  type: 'hdfs',
+  nameNode: 'hdfs://namenode.example.com',
+  port: 9870,
+  user: 'testuser'
+};
+
+/** All methods throw synchronously (stub implementation). */
+function expectThrows(fn: () => unknown) {
+  expect(fn).toThrow('HDFS not implemented');
+}
+
+describe('HDFSStorageProvider', () => {
+  it('constructs without throwing', () => {
+    expect(() => new HDFSStorageProvider(config)).not.toThrow();
+  });
+
+  describe('listObjects', () => {
+    it('throws "HDFS not implemented"', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.listObjects('prefix/', 100));
+    });
+
+    it('throws with continuation token', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.listObjects('prefix/', 10, 'token'));
+    });
+
+    it('throws with null continuation token', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.listObjects('', 50, null));
+    });
+  });
+
+  describe('getObject', () => {
+    it('throws "HDFS not implemented"', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.getObject('some/key.txt'));
+    });
+  });
+
+  describe('getObjectRange', () => {
+    it('throws "HDFS not implemented"', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.getObjectRange('some/key.txt', 0, 1023));
+    });
+  });
+
+  describe('getMetadata', () => {
+    it('throws "HDFS not implemented"', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.getMetadata('some/key.txt'));
+    });
+  });
+
+  describe('exists', () => {
+    it('throws "HDFS not implemented"', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.exists('some/key.txt'));
+    });
+  });
+
+  describe('putObject', () => {
+    it('throws "HDFS not implemented" with Buffer body', () => {
+      const provider = new HDFSStorageProvider(config);
+      const body = Buffer.from('hello');
+      expectThrows(() => provider.putObject('some/key.txt', body, 'text/plain', 5));
+    });
+
+    it('throws "HDFS not implemented" without contentLength', () => {
+      const provider = new HDFSStorageProvider(config);
+      const body = Buffer.from('hello');
+      expectThrows(() => provider.putObject('some/key.txt', body, 'text/plain'));
+    });
+  });
+
+  describe('deleteObjects', () => {
+    it('throws "HDFS not implemented"', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.deleteObjects(['key1', 'key2']));
+    });
+
+    it('throws with empty array', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.deleteObjects([]));
+    });
+  });
+
+  describe('listAllKeys', () => {
+    it('throws "HDFS not implemented"', () => {
+      const provider = new HDFSStorageProvider(config);
+      expectThrows(() => provider.listAllKeys('prefix/'));
+    });
+  });
+});
diff --git a/src/lib/server/storage/preview/binary.test.ts b/src/lib/server/storage/preview/binary.test.ts
new file mode 100644
index 00000000..63b5a31d
--- /dev/null
+++ b/src/lib/server/storage/preview/binary.test.ts
@@ -0,0 +1,33 @@
+import { describe, it, expect } from 'vitest';
+import { KNOWN_BINARY_TYPES, binaryPreview } from './binary.js';
+
+describe('KNOWN_BINARY_TYPES', () => {
+  it('contains gzip', () => {
+    expect(KNOWN_BINARY_TYPES.has('application/gzip')).toBe(true);
+  });
+
+  it('contains zip', () => {
+    expect(KNOWN_BINARY_TYPES.has('application/zip')).toBe(true);
+  });
+
+  it('does not contain text/plain', () => {
+    expect(KNOWN_BINARY_TYPES.has('text/plain')).toBe(false);
+  });
+});
+
+describe('binaryPreview', () => {
+  it('returns response with correct headers', () => {
+    const res = binaryPreview('application/gzip', 12345);
+    expect(res.headers.get('Content-Type')).toBe('application/gzip');
+    expect(res.headers.get('X-Preview-Renderable')).toBe('false');
+    expect(res.headers.get('X-Preview-Total-Size')).toBe('12345');
+    expect(res.headers.get('X-Preview-Bytes')).toBe('0');
+    expect(res.headers.get('X-Preview-Truncated')).toBe('false');
+    expect(res.headers.get('Cache-Control')).toBe('no-store');
+  });
+
+  it('returns null body', async () => {
+    const res = binaryPreview('application/zip', 0);
+    expect(res.body).toBeNull();
+  });
+});
diff --git a/src/lib/server/storage/preview/stream.test.ts b/src/lib/server/storage/preview/stream.test.ts
new file mode 100644
index 00000000..382f19c7
--- /dev/null
+++ b/src/lib/server/storage/preview/stream.test.ts
@@ -0,0 +1,69 @@
+import { describe, it, expect, vi } from 'vitest';
+import type pino from 'pino';
+import { streamPreview } from './stream.js';
+import type { StorageProvider } from '$lib/server/storage/provider.js';
+
+const mockLog = { info: vi.fn(), debug: vi.fn(), warn: vi.fn() } as unknown as pino.Logger;
+
+function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider {
+  return {
+    listObjects: vi.fn(),
+    getObject: vi
+      .fn()
+      .mockResolvedValue({ stream: new ReadableStream(), contentType: 'text/plain' }),
+    getObjectRange: vi.fn().mockResolvedValue(new ReadableStream()),
+    getMetadata: vi.fn(),
+    exists: vi.fn(),
+    putObject: vi.fn(),
+    deleteObjects: vi.fn(),
+    listAllKeys: vi.fn(),
+    ...overrides
+  };
+}
+
+describe('streamPreview', () => {
+  it('uses full getObject when totalSize <= text limit (256KB)', async () => {
+    const provider = makeProvider();
+    const res = await streamPreview(provider, 'file.txt', 'text/plain', 1000, 'user1', mockLog);
+    expect(provider.getObject).toHaveBeenCalledWith('file.txt');
+    expect(provider.getObjectRange).not.toHaveBeenCalled();
+    expect(res.headers.get('X-Preview-Truncated')).toBe('false');
+    expect(res.headers.get('X-Preview-Bytes')).toBe('1000');
+  });
+
+  it('uses getObjectRange when totalSize > text limit', async () => {
+    const provider = makeProvider();
+    const totalSize = 300 * 1024;
+    const res = await streamPreview(provider, 'big.txt', 'text/plain', totalSize, 'user1', mockLog);
+    expect(provider.getObjectRange).toHaveBeenCalledWith('big.txt', 0, 256 * 1024 - 1);
+    expect(res.headers.get('X-Preview-Truncated')).toBe('true');
+    expect(res.headers.get('X-Preview-Bytes')).toBe(String(256 * 1024));
+    expect(res.headers.get('X-Preview-Total-Size')).toBe(String(totalSize));
+  });
+
+  it('uses 5MB limit for images', async () => {
+    const provider = makeProvider();
+    const totalSize = 6 * 1024 * 1024;
+    await streamPreview(provider, 'img.png', 'image/png', totalSize, 'user1', mockLog);
+    expect(provider.getObjectRange).toHaveBeenCalledWith('img.png', 0, 5 * 1024 * 1024 - 1);
+  });
+
+  it('uses 25MB limit for PDFs', async () => {
+    const provider = makeProvider();
+    const totalSize = 30 * 1024 * 1024;
+    await streamPreview(provider, 'doc.pdf', 'application/pdf', totalSize, 'user1', mockLog);
+    expect(provider.getObjectRange).toHaveBeenCalledWith('doc.pdf', 0, 25 * 1024 * 1024 - 1);
+  });
+
+  it('fetches full PDF when under limit', async () => {
+    const provider = makeProvider();
+    await streamPreview(provider, 'small.pdf', 'application/pdf', 1000, 'user1', mockLog);
+    expect(provider.getObject).toHaveBeenCalledWith('small.pdf');
+  });
+
+  it('sets X-Preview-Renderable to true', async () => {
+    const provider = makeProvider();
+    const res = await streamPreview(provider, 'f.txt', 'text/plain', 10, 'user1', mockLog);
+    expect(res.headers.get('X-Preview-Renderable')).toBe('true');
+  });
+});
diff --git a/src/lib/server/storage/s3-client.test.ts b/src/lib/server/storage/s3-client.test.ts
new file mode 100644
index 00000000..d554c86f
--- /dev/null
+++ b/src/lib/server/storage/s3-client.test.ts
@@ -0,0 +1,64 @@
+import { describe, it, expect, vi } from 'vitest';
+import { faker } from '@faker-js/faker';
+import type { S3ConnectionConfig } from './types.js';
+
+vi.mock('@aws-sdk/client-s3', () => ({
+  S3Client: vi.fn()
+}));
+
+import { createS3Client } from './s3-client.js';
+import { S3Client } from '@aws-sdk/client-s3';
+const mockS3Client = vi.mocked(S3Client);
+
+describe('createS3Client', () => {
+  it('creates client with region only (no endpoint, no credentials)', () => {
+    const config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
+    createS3Client(config);
+    expect(mockS3Client).toHaveBeenCalledWith({ region: 'us-east-1' });
+  });
+
+  it('sets endpoint and forcePathStyle when endpoint provided', () => {
+    const endpoint = faker.internet.url();
+    const config: S3ConnectionConfig = { type: 's3', region: 'eu-west-1', endpoint };
+    createS3Client(config);
+    expect(mockS3Client).toHaveBeenCalledWith(
+      expect.objectContaining({ endpoint, forcePathStyle: true })
+    );
+  });
+
+  it('respects pathStyle=false', () => {
+    const endpoint = faker.internet.url();
+    const config: S3ConnectionConfig = {
+      type: 's3',
+      region: 'eu-west-1',
+      endpoint,
+      pathStyle: false
+    };
+    createS3Client(config);
+    expect(mockS3Client).toHaveBeenCalledWith(
+      expect.objectContaining({ endpoint, forcePathStyle: false })
+    );
+  });
+
+  it('sets credentials when accessKeyId and secretAccessKey provided', () => {
+    const config: S3ConnectionConfig = {
+      type: 's3',
+      region: 'us-west-2',
+      accessKeyId: 'AKID',
+      secretAccessKey: 'SECRET'
+    };
+    createS3Client(config);
+    expect(mockS3Client).toHaveBeenCalledWith(
+      expect.objectContaining({
+        credentials: { accessKeyId: 'AKID', secretAccessKey: 'SECRET' }
+      })
+    );
+  });
+
+  it('does not set credentials when only accessKeyId provided', () => {
+    const config: S3ConnectionConfig = { type: 's3', region: 'us-west-2', accessKeyId: 'AKID' };
+    createS3Client(config);
+    const call = mockS3Client.mock.calls.at(-1)![0] as { credentials?: unknown };
+    expect(call.credentials).toBeUndefined();
+  });
+});
diff --git a/src/lib/server/storage/s3-errors.test.ts b/src/lib/server/storage/s3-errors.test.ts
new file mode 100644
index 00000000..2abace02
--- /dev/null
+++ b/src/lib/server/storage/s3-errors.test.ts
@@ -0,0 +1,65 @@
+import { describe, it, expect, vi } from 'vitest';
+import { S3ServiceException } from '@aws-sdk/client-s3';
+import { mapS3ErrorToHttp } from './s3-errors.js';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ warn: vi.fn(), info: vi.fn(), debug: vi.fn() }) }
+}));
+
+function makeS3Error(name: string, httpStatusCode?: number): S3ServiceException {
+  const err = new S3ServiceException({
+    name,
+    message: `${name} happened`,
+    $fault: 'client',
+    $metadata: { httpStatusCode }
+  });
+  err.name = name;
+  return err;
+}
+
+describe('mapS3ErrorToHttp', () => {
+  it('re-throws non-S3 errors as-is', () => {
+    const raw = new Error('network failure');
+    expect(() => mapS3ErrorToHttp(raw, {})).toThrow(raw);
+  });
+
+  it('maps AccessDenied to 403', () => {
+    const err = makeS3Error('AccessDenied', 403);
+    expect(() => mapS3ErrorToHttp(err, { key: 'file.txt' })).toThrow(
+      expect.objectContaining({ status: 403, body: { message: 'Access denied to "file.txt"' } })
+    );
+  });
+
+  it('maps 403 status without AccessDenied name to 403', () => {
+    const err = makeS3Error('SomeOtherCode', 403);
+    expect(() => mapS3ErrorToHttp(err, {})).toThrow(
+      expect.objectContaining({ status: 403, body: { message: 'Access denied' } })
+    );
+  });
+
+  it('maps NoSuchKey to 404 with key message', () => {
+    const err = makeS3Error('NoSuchKey', 404);
+    expect(() => mapS3ErrorToHttp(err, { key: 'missing.csv' })).toThrow(
+      expect.objectContaining({ status: 404, body: { message: 'Object "missing.csv" not found' } })
+    );
+  });
+
+  it('maps NoSuchBucket to 404 with bucket message', () => {
+    const err = makeS3Error('NoSuchBucket', 404);
+    expect(() => mapS3ErrorToHttp(err, { bucket: 'my-bucket' })).toThrow(
+      expect.objectContaining({ status: 404, body: { message: 'Bucket "my-bucket" not found' } })
+    );
+  });
+
+  it('maps 404 status to not found with generic message', () => {
+    const err = makeS3Error('NotFound', 404);
+    expect(() => mapS3ErrorToHttp(err, {})).toThrow(
+      expect.objectContaining({ status: 404, body: { message: 'Not found' } })
+    );
+  });
+
+  it('maps other S3 errors to 502', () => {
+    const err = makeS3Error('InternalError', 500);
+    expect(() => mapS3ErrorToHttp(err, {})).toThrow(expect.objectContaining({ status: 502 }));
+  });
+});
diff --git a/src/lib/server/storage/s3-provider.test.ts b/src/lib/server/storage/s3-provider.test.ts
new file mode 100644
index 00000000..d67d613a
--- /dev/null
+++ b/src/lib/server/storage/s3-provider.test.ts
@@ -0,0 +1,511 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { S3ServiceException } from '@aws-sdk/client-s3';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ trace: vi.fn(), warn: vi.fn(), info: vi.fn(), debug: vi.fn() }) }
+}));
+
+// Hoist so the factory closure can reference them
+const { mockUploadDone, MockUpload } = vi.hoisted(() => {
+  const mockUploadDone = vi.fn();
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  const MockUpload = vi.fn(function (this: { done: typeof mockUploadDone }, _: unknown) {
+    this.done = mockUploadDone;
+  });
+  return { mockUploadDone, MockUpload };
+});
+
+vi.mock('@aws-sdk/lib-storage', () => ({
+  Upload: MockUpload
+}));
+
+// Mock createS3Client — we inject a fake client directly so this is rarely called
+vi.mock('./s3-client.js', () => ({
+  createS3Client: vi.fn().mockReturnValue({ send: vi.fn() })
+}));
+
+import { S3StorageProvider } from './s3-provider.js';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeS3Error(name: string, httpStatusCode?: number): S3ServiceException {
+  const err = new S3ServiceException({
+    name,
+    message: `${name} error`,
+    $fault: 'client',
+    $metadata: { httpStatusCode }
+  });
+  err.name = name;
+  return err;
+}
+
+function makeProvider() {
+  const send = vi.fn();
+  const client = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
+  const config = { type: 's3' as const, region: 'us-east-1', bucket: 'test-bucket' };
+  const provider = new S3StorageProvider(config, client);
+  return { provider, send };
+}
+
+// ---------------------------------------------------------------------------
+// listObjects
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.listObjects', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns objects and directories from S3 output', async () => {
+    send.mockResolvedValue({
+      CommonPrefixes: [{ Prefix: 'folder/' }],
+      Contents: [{ Key: 'file.txt', Size: 100, LastModified: new Date('2024-01-01') }],
+      IsTruncated: false,
+      NextContinuationToken: undefined
+    });
+
+    const result = await provider.listObjects('', 50);
+
+    expect(result.objects).toHaveLength(2);
+    expect(result.objects[0]).toMatchObject({ key: 'folder/', isDirectory: true, size: 0 });
+    expect(result.objects[1]).toMatchObject({ key: 'file.txt', isDirectory: false, size: 100 });
+    expect(result.hasNextPage).toBe(false);
+    expect(result.nextContinuationToken).toBeNull();
+  });
+
+  it('filters out the prefix itself from Contents', async () => {
+    send.mockResolvedValue({
+      CommonPrefixes: [],
+      Contents: [
+        { Key: 'myprefix/', Size: 0, LastModified: new Date() },
+        { Key: 'myprefix/file.txt', Size: 42, LastModified: new Date() }
+      ],
+      IsTruncated: false
+    });
+
+    const result = await provider.listObjects('myprefix/', 50);
+    expect(result.objects).toHaveLength(1);
+    expect(result.objects[0].key).toBe('myprefix/file.txt');
+  });
+
+  it('handles missing CommonPrefixes and Contents gracefully', async () => {
+    send.mockResolvedValue({ IsTruncated: false });
+
+    const result = await provider.listObjects('', 20);
+    expect(result.objects).toHaveLength(0);
+    expect(result.hasNextPage).toBe(false);
+  });
+
+  it('propagates pagination token', async () => {
+    send.mockResolvedValue({
+      Contents: [{ Key: 'a.txt', Size: 1, LastModified: new Date() }],
+      IsTruncated: true,
+      NextContinuationToken: 'token-abc'
+    });
+
+    const result = await provider.listObjects('', 10, 'prev-token');
+    expect(result.hasNextPage).toBe(true);
+    expect(result.nextContinuationToken).toBe('token-abc');
+    expect(result.continuationToken).toBe('prev-token');
+  });
+
+  it('passes null continuationToken through as null', async () => {
+    send.mockResolvedValue({ IsTruncated: false });
+
+    const result = await provider.listObjects('', 10, null);
+    expect(result.continuationToken).toBeNull();
+  });
+
+  it('converts empty prefix string to undefined in S3 command', async () => {
+    send.mockResolvedValue({ IsTruncated: false });
+    await provider.listObjects('', 10);
+    const sentCommand = send.mock.calls[0][0];
+    expect(sentCommand.input.Prefix).toBeUndefined();
+  });
+
+  it('passes non-empty prefix to S3', async () => {
+    send.mockResolvedValue({ IsTruncated: false });
+    await provider.listObjects('some/prefix/', 10);
+    const sentCommand = send.mock.calls[0][0];
+    expect(sentCommand.input.Prefix).toBe('some/prefix/');
+  });
+
+  it('uses fallbacks when object fields are missing', async () => {
+    send.mockResolvedValue({
+      CommonPrefixes: [{}],
+      Contents: [{ Key: 'x.txt' }],
+      IsTruncated: false
+    });
+
+    const result = await provider.listObjects('', 10);
+    expect(result.objects[0].key).toBe(''); // Prefix fallback
+    expect(result.objects[1].key).toBe('x.txt');
+    expect(result.objects[1].size).toBe(0);
+    expect(result.objects[1].lastModified).toEqual(new Date(0));
+  });
+});
+
+// ---------------------------------------------------------------------------
+// getObject
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.getObject', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns stream and metadata', async () => {
+    const fakeStream = new ReadableStream();
+    send.mockResolvedValue({
+      Body: { transformToWebStream: () => fakeStream },
+      ContentType: 'text/plain',
+      ContentLength: 42,
+      ETag: '"abc123"'
+    });
+
+    const result = await provider.getObject('file.txt');
+    expect(result.stream).toBe(fakeStream);
+    expect(result.contentType).toBe('text/plain');
+    expect(result.contentLength).toBe(42);
+    expect(result.etag).toBe('"abc123"');
+  });
+
+  it('throws when Body is missing', async () => {
+    send.mockResolvedValue({ Body: null });
+    await expect(provider.getObject('missing.txt')).rejects.toThrow(
+      'Object missing.txt has no body'
+    );
+  });
+
+  it('throws when Body is undefined', async () => {
+    send.mockResolvedValue({});
+    await expect(provider.getObject('missing.txt')).rejects.toThrow(
+      'Object missing.txt has no body'
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// getObjectRange
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.getObjectRange', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns stream for byte range', async () => {
+    const fakeStream = new ReadableStream();
+    send.mockResolvedValue({
+      Body: { transformToWebStream: () => fakeStream }
+    });
+
+    const result = await provider.getObjectRange('video.mp4', 0, 999);
+    expect(result).toBe(fakeStream);
+
+    const sentCommand = send.mock.calls[0][0];
+    expect(sentCommand.input.Range).toBe('bytes=0-999');
+  });
+
+  it('throws when Body is missing', async () => {
+    send.mockResolvedValue({});
+    await expect(provider.getObjectRange('video.mp4', 0, 100)).rejects.toThrow(
+      'Object video.mp4 has no body'
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// getMetadata
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.getMetadata', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns metadata from HeadObject', async () => {
+    send.mockResolvedValue({
+      ContentLength: 1024,
+      LastModified: new Date('2024-06-01'),
+      ContentType: 'application/json',
+      ETag: '"etag1"',
+      Metadata: { 'x-custom': 'val' }
+    });
+
+    const result = await provider.getMetadata('data.json');
+    expect(result.size).toBe(1024);
+    expect(result.contentType).toBe('application/json');
+    expect(result.etag).toBe('"etag1"');
+    expect(result.customMetadata).toEqual({ 'x-custom': 'val' });
+  });
+
+  it('falls back to defaults when fields missing', async () => {
+    send.mockResolvedValue({});
+
+    const result = await provider.getMetadata('x');
+    expect(result.size).toBe(0);
+    expect(result.lastModified).toEqual(new Date(0));
+    expect(result.contentType).toBeUndefined();
+    expect(result.etag).toBeUndefined();
+    expect(result.customMetadata).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// exists
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.exists', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns true when HeadObject succeeds', async () => {
+    send.mockResolvedValue({});
+    expect(await provider.exists('file.txt')).toBe(true);
+  });
+
+  it('returns false for NoSuchKey S3 error', async () => {
+    send.mockRejectedValue(makeS3Error('NoSuchKey', 404));
+    expect(await provider.exists('missing.txt')).toBe(false);
+  });
+
+  it('returns false for NotFound S3 error', async () => {
+    send.mockRejectedValue(makeS3Error('NotFound', 404));
+    expect(await provider.exists('missing.txt')).toBe(false);
+  });
+
+  it('returns false for 404 http status even with different error name', async () => {
+    send.mockRejectedValue(makeS3Error('SomethingElse', 404));
+    expect(await provider.exists('missing.txt')).toBe(false);
+  });
+
+  it('re-throws non-404 S3 errors', async () => {
+    const err = makeS3Error('AccessDenied', 403);
+    send.mockRejectedValue(err);
+    await expect(provider.exists('protected.txt')).rejects.toThrow(err);
+  });
+
+  it('re-throws non-S3 errors', async () => {
+    const err = new Error('network failure');
+    send.mockRejectedValue(err);
+    await expect(provider.exists('file.txt')).rejects.toThrow(err);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// putObject
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.putObject', () => {
+  let provider: S3StorageProvider;
+
+  beforeEach(() => {
+    ({ provider } = makeProvider());
+    mockUploadDone.mockResolvedValue(undefined);
+    MockUpload.mockClear();
+  });
+
+  it('creates Upload with correct params and calls done()', async () => {
+    const body = Buffer.from('hello');
+    await provider.putObject('file.txt', body, 'text/plain', 5);
+
+    expect(MockUpload).toHaveBeenCalledWith(
+      expect.objectContaining({
+        params: expect.objectContaining({
+          Bucket: 'test-bucket',
+          Key: 'file.txt',
+          Body: body,
+          ContentType: 'text/plain',
+          ContentLength: 5
+        })
+      })
+    );
+    expect(mockUploadDone).toHaveBeenCalled();
+  });
+
+  it('omits ContentLength when not provided', async () => {
+    await provider.putObject('file.txt', Buffer.from('x'), 'text/plain');
+
+    const uploadParams = MockUpload.mock.calls[0][0] as { params: Record<string, unknown> };
+    expect(uploadParams.params.ContentLength).toBeUndefined();
+  });
+
+  it('accepts a ReadableStream as body', async () => {
+    const stream = new ReadableStream();
+    await provider.putObject('stream.txt', stream, 'application/octet-stream');
+
+    const uploadParams = MockUpload.mock.calls[0][0] as { params: Record<string, unknown> };
+    expect(uploadParams.params.Body).toBe(stream);
+  });
+
+  it('sets queue and part size', async () => {
+    await provider.putObject('f', Buffer.from('x'), 'text/plain');
+    const opts = MockUpload.mock.calls[0][0] as { queueSize: number; partSize: number };
+    expect(opts.queueSize).toBe(4);
+    expect(opts.partSize).toBe(5 * 1024 * 1024);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// deleteObjects
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.deleteObjects', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns empty failed list on full success', async () => {
+    send.mockResolvedValue({ Errors: [] });
+    const result = await provider.deleteObjects(['a.txt', 'b.txt']);
+    expect(result.failed).toHaveLength(0);
+  });
+
+  it('returns failed entries when S3 reports errors', async () => {
+    send.mockResolvedValue({
+      Errors: [{ Key: 'b.txt', Code: 'AccessDenied', Message: 'No permission' }]
+    });
+    const result = await provider.deleteObjects(['a.txt', 'b.txt']);
+    expect(result.failed).toEqual([
+      { key: 'b.txt', code: 'AccessDenied', message: 'No permission' }
+    ]);
+  });
+
+  it('uses fallback empty string for missing Key in errors', async () => {
+    send.mockResolvedValue({
+      Errors: [{ Code: 'InternalError', Message: 'oops' }]
+    });
+    const result = await provider.deleteObjects(['x.txt']);
+    expect(result.failed[0].key).toBe('');
+  });
+
+  it('handles undefined Errors from S3', async () => {
+    send.mockResolvedValue({});
+    const result = await provider.deleteObjects(['a.txt']);
+    expect(result.failed).toHaveLength(0);
+  });
+
+  it('sends correct Delete structure to S3', async () => {
+    send.mockResolvedValue({ Errors: [] });
+    await provider.deleteObjects(['x.txt', 'y.txt']);
+    const sentCommand = send.mock.calls[0][0];
+    expect(sentCommand.input.Delete.Objects).toEqual([{ Key: 'x.txt' }, { Key: 'y.txt' }]);
+    expect(sentCommand.input.Delete.Quiet).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// listAllKeys
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.listAllKeys', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns all keys in a single page', async () => {
+    send.mockResolvedValue({
+      Contents: [{ Key: 'a.txt' }, { Key: 'b.txt' }],
+      IsTruncated: false
+    });
+
+    const keys = await provider.listAllKeys('');
+    expect(keys).toEqual(['a.txt', 'b.txt']);
+    expect(send).toHaveBeenCalledTimes(1);
+  });
+
+  it('paginates across multiple pages', async () => {
+    send
+      .mockResolvedValueOnce({
+        Contents: [{ Key: 'a.txt' }, { Key: 'b.txt' }],
+        IsTruncated: true,
+        NextContinuationToken: 'token-1'
+      })
+      .mockResolvedValueOnce({
+        Contents: [{ Key: 'c.txt' }],
+        IsTruncated: false
+      });
+
+    const keys = await provider.listAllKeys('prefix/');
+    expect(keys).toEqual(['a.txt', 'b.txt', 'c.txt']);
+    expect(send).toHaveBeenCalledTimes(2);
+
+    // Second call must pass the continuation token
+    const secondCall = send.mock.calls[1][0];
+    expect(secondCall.input.ContinuationToken).toBe('token-1');
+  });
+
+  it('returns empty array when no contents', async () => {
+    send.mockResolvedValue({ IsTruncated: false });
+    const keys = await provider.listAllKeys('empty/');
+    expect(keys).toEqual([]);
+  });
+
+  it('skips Contents entries with no Key', async () => {
+    send.mockResolvedValue({
+      Contents: [{ Key: 'valid.txt' }, {}],
+      IsTruncated: false
+    });
+    const keys = await provider.listAllKeys('');
+    expect(keys).toEqual(['valid.txt']);
+  });
+
+  it('does not send delimiter (recursive listing)', async () => {
+    send.mockResolvedValue({ IsTruncated: false });
+    await provider.listAllKeys('p/');
+    const sentCommand = send.mock.calls[0][0];
+    expect(sentCommand.input.Delimiter).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Constructor — uses createS3Client when no client injected
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider constructor', () => {
+  it('uses injected client when provided', () => {
+    const send = vi.fn();
+    const fakeClient = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
+    const provider = new S3StorageProvider(
+      { type: 's3', region: 'us-east-1', bucket: 'b' },
+      fakeClient
+    );
+    expect(provider).toBeDefined();
+  });
+
+  it('creates client via createS3Client when none provided', async () => {
+    const { createS3Client } = await import('./s3-client.js');
+    const mockCreate = vi.mocked(createS3Client);
+    mockCreate.mockClear();
+
+    new S3StorageProvider({ type: 's3', region: 'us-east-1', bucket: 'b' });
+    expect(mockCreate).toHaveBeenCalledWith(
+      expect.objectContaining({ region: 'us-east-1', bucket: 'b' })
+    );
+  });
+});
diff --git a/src/lib/server/storage/service.test.ts b/src/lib/server/storage/service.test.ts
new file mode 100644
index 00000000..60f59388
--- /dev/null
+++ b/src/lib/server/storage/service.test.ts
@@ -0,0 +1,261 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { faker } from '@faker-js/faker';
+import { S3ServiceException } from '@aws-sdk/client-s3';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ info: vi.fn(), debug: vi.fn(), warn: vi.fn() }) }
+}));
+
+const mockGetUserConnection = vi.fn();
+const mockSetUserConnection = vi.fn();
+const mockClearUserConnection = vi.fn();
+vi.mock('./user-connections.js', () => ({
+  getUserConnection: (...args: unknown[]) => mockGetUserConnection(...args),
+  setUserConnection: (...args: unknown[]) => mockSetUserConnection(...args),
+  clearUserConnection: (...args: unknown[]) => mockClearUserConnection(...args)
+}));
+
+const mockSend = vi.fn();
+vi.mock('./s3-client.js', () => ({
+  createS3Client: () => ({ send: (...args: unknown[]) => mockSend(...args) })
+}));
+
+const mockProvider = {
+  listObjects: vi.fn(),
+  getObject: vi.fn(),
+  getObjectRange: vi.fn(),
+  getMetadata: vi.fn(),
+  exists: vi.fn(),
+  putObject: vi.fn(),
+  deleteObjects: vi.fn(),
+  listAllKeys: vi.fn()
+};
+vi.mock('./utils.js', () => ({
+  getProviderForUser: () => mockProvider
+}));
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+const mockMapS3ErrorToHttp = vi.fn((err: unknown, _context?: unknown) => {
+  throw err;
+});
+vi.mock('./s3-errors.js', () => ({
+  mapS3ErrorToHttp: (err: unknown, context: unknown) => mockMapS3ErrorToHttp(err, context)
+}));
+
+function makeS3Error(name = 'NoSuchKey'): S3ServiceException {
+  return new S3ServiceException({ name, message: name, $fault: 'client', $metadata: {} });
+}
+
+import {
+  listBuckets,
+  listObjects,
+  downloadObject,
+  getObjectMetadata,
+  uploadObject,
+  deleteObjects
+} from './service.js';
+
+describe('storage service', () => {
+  const userId = faker.string.uuid();
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  describe('listBuckets', () => {
+    it('returns empty array when no connection', async () => {
+      mockGetUserConnection.mockReturnValue(null);
+      expect(await listBuckets(userId)).toEqual([]);
+    });
+
+    it('returns bucket names', async () => {
+      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
+      mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: 'b' }] });
+      expect(await listBuckets(userId)).toEqual(['a', 'b']);
+    });
+
+    it('filters out buckets with no name', async () => {
+      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
+      mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: undefined }, { Name: '' }] });
+      expect(await listBuckets(userId)).toEqual(['a']);
+    });
+
+    it('handles null Buckets in response', async () => {
+      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
+      mockSend.mockResolvedValue({ Buckets: null });
+      expect(await listBuckets(userId)).toEqual([]);
+    });
+  });
+
+  describe('listObjects', () => {
+    it('proxies to provider', async () => {
+      const page = { objects: [], prefixes: [], nextToken: null };
+      mockProvider.listObjects.mockResolvedValue(page);
+      const result = await listObjects(userId, 'bucket', 'prefix/', 100);
+      expect(mockProvider.listObjects).toHaveBeenCalledWith('prefix/', 100, undefined);
+      expect(result).toEqual(page);
+    });
+
+    it('passes continuation token when provided', async () => {
+      const page = { objects: [], prefixes: [], nextToken: null };
+      mockProvider.listObjects.mockResolvedValue(page);
+      await listObjects(userId, 'bucket', '', 10, 'tok');
+      expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, 'tok');
+    });
+
+    it('passes undefined when continuation token is null', async () => {
+      const page = { objects: [], prefixes: [], nextToken: null };
+      mockProvider.listObjects.mockResolvedValue(page);
+      await listObjects(userId, 'bucket', '', 10, null);
+      expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, undefined);
+    });
+
+    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
+      const err = makeS3Error('AccessDenied');
+      mockProvider.listObjects.mockRejectedValue(err);
+      await expect(listObjects(userId, 'bucket', '', 10)).rejects.toThrow(err);
+      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
+        bucket: 'bucket',
+        operation: 'listObjects'
+      });
+    });
+
+    it('rethrows non-S3 errors', async () => {
+      const err = new Error('network');
+      mockProvider.listObjects.mockRejectedValue(err);
+      await expect(listObjects(userId, 'bucket', '', 10)).rejects.toThrow('network');
+      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('downloadObject', () => {
+    it('returns download from provider', async () => {
+      const download = { stream: new ReadableStream(), contentType: 'text/plain' };
+      mockProvider.getObject.mockResolvedValue(download);
+      const result = await downloadObject(userId, 'bucket', 'key.txt');
+      expect(result).toEqual(download);
+    });
+
+    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
+      const err = makeS3Error('NoSuchKey');
+      mockProvider.getObject.mockRejectedValue(err);
+      await expect(downloadObject(userId, 'bucket', 'key.txt')).rejects.toThrow(err);
+      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
+        bucket: 'bucket',
+        key: 'key.txt',
+        operation: 'getObject'
+      });
+    });
+
+    it('rethrows non-S3 errors', async () => {
+      const err = new Error('timeout');
+      mockProvider.getObject.mockRejectedValue(err);
+      await expect(downloadObject(userId, 'bucket', 'k')).rejects.toThrow('timeout');
+      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('getObjectMetadata', () => {
+    it('proxies to provider', async () => {
+      const meta = { contentType: 'text/plain', contentLength: 42 };
+      mockProvider.getMetadata.mockResolvedValue(meta);
+      expect(await getObjectMetadata(userId, 'bucket', 'k')).toEqual(meta);
+    });
+
+    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
+      const err = makeS3Error('NoSuchKey');
+      mockProvider.getMetadata.mockRejectedValue(err);
+      await expect(getObjectMetadata(userId, 'bucket', 'k')).rejects.toThrow(err);
+      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
+        bucket: 'bucket',
+        key: 'k',
+        operation: 'getMetadata'
+      });
+    });
+
+    it('rethrows non-S3 errors', async () => {
+      const err = new Error('gone');
+      mockProvider.getMetadata.mockRejectedValue(err);
+      await expect(getObjectMetadata(userId, 'bucket', 'k')).rejects.toThrow('gone');
+      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('uploadObject', () => {
+    it('proxies to provider', async () => {
+      mockProvider.putObject.mockResolvedValue(undefined);
+      await uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain', 1);
+      expect(mockProvider.putObject).toHaveBeenCalledWith('k', expect.any(Buffer), 'text/plain', 1);
+    });
+
+    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
+      const err = makeS3Error('AccessDenied');
+      mockProvider.putObject.mockRejectedValue(err);
+      await expect(
+        uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain')
+      ).rejects.toThrow(err);
+      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
+        bucket: 'bucket',
+        key: 'k',
+        operation: 'putObject'
+      });
+    });
+
+    it('rethrows non-S3 errors', async () => {
+      const err = new Error('disk full');
+      mockProvider.putObject.mockRejectedValue(err);
+      await expect(
+        uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain')
+      ).rejects.toThrow('disk full');
+      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('deleteObjects', () => {
+    it('expands directory prefixes and deletes all', async () => {
+      mockProvider.listAllKeys.mockResolvedValue(['dir/a.txt', 'dir/b.txt']);
+      mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
+      const result = await deleteObjects(userId, 'bucket', ['file.txt', 'dir/']);
+      expect(mockProvider.listAllKeys).toHaveBeenCalledWith('dir/');
+      expect(mockProvider.deleteObjects).toHaveBeenCalledWith([
+        'file.txt',
+        'dir/a.txt',
+        'dir/b.txt'
+      ]);
+      expect(result).toEqual({ failed: [] });
+    });
+
+    it('uses directory key itself when no children found', async () => {
+      mockProvider.listAllKeys.mockResolvedValue([]);
+      mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
+      await deleteObjects(userId, 'bucket', ['empty/']);
+      expect(mockProvider.deleteObjects).toHaveBeenCalledWith(['empty/']);
+    });
+
+    it('returns empty result for no keys', async () => {
+      // No file keys, no dir prefixes after expansion
+      mockProvider.listAllKeys.mockResolvedValue([]);
+      mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
+      const result = await deleteObjects(userId, 'bucket', []);
+      expect(result).toEqual({ failed: [] });
+    });
+
+    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
+      const err = makeS3Error('AccessDenied');
+      mockProvider.listAllKeys.mockResolvedValue([]);
+      mockProvider.deleteObjects.mockRejectedValue(err);
+      await expect(deleteObjects(userId, 'bucket', ['file.txt'])).rejects.toThrow(err);
+      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
+        bucket: 'bucket',
+        operation: 'deleteObjects'
+      });
+    });
+
+    it('rethrows non-S3 errors', async () => {
+      const err = new Error('network');
+      mockProvider.deleteObjects.mockRejectedValue(err);
+      await expect(deleteObjects(userId, 'bucket', ['file.txt'])).rejects.toThrow('network');
+      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/src/lib/server/storage/user-connections.test.ts b/src/lib/server/storage/user-connections.test.ts
new file mode 100644
index 00000000..68e9ac66
--- /dev/null
+++ b/src/lib/server/storage/user-connections.test.ts
@@ -0,0 +1,67 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { faker } from '@faker-js/faker';
+import { setUserConnection, getUserConnection, clearUserConnection } from './user-connections.js';
+import type { S3ConnectionConfig } from './types.js';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ info: vi.fn(), debug: vi.fn() }) }
+}));
+
+function makeConfig(): S3ConnectionConfig {
+  return {
+    type: 's3',
+    region: faker.location.countryCode(),
+    endpoint: faker.internet.url(),
+    accessKeyId: faker.string.alphanumeric(20),
+    secretAccessKey: faker.string.alphanumeric(40)
+  };
+}
+
+describe('user-connections', () => {
+  const userId = faker.string.uuid();
+
+  beforeEach(() => {
+    clearUserConnection(userId);
+  });
+
+  it('returns null for unknown user', () => {
+    expect(getUserConnection(faker.string.uuid())).toBeNull();
+  });
+
+  it('stores and retrieves a connection', () => {
+    const config = makeConfig();
+    setUserConnection(userId, config);
+    expect(getUserConnection(userId)).toEqual(config);
+  });
+
+  it('overwrites existing connection', () => {
+    setUserConnection(userId, makeConfig());
+    const newConfig = makeConfig();
+    setUserConnection(userId, newConfig);
+    expect(getUserConnection(userId)).toEqual(newConfig);
+  });
+
+  it('clears a connection', () => {
+    setUserConnection(userId, makeConfig());
+    clearUserConnection(userId);
+    expect(getUserConnection(userId)).toBeNull();
+  });
+
+  it('clearing non-existent user does not throw', () => {
+    expect(() => clearUserConnection(faker.string.uuid())).not.toThrow();
+  });
+
+  it('supports multiple users independently', () => {
+    const user1 = faker.string.uuid();
+    const user2 = faker.string.uuid();
+    const config1 = makeConfig();
+    const config2 = makeConfig();
+    setUserConnection(user1, config1);
+    setUserConnection(user2, config2);
+    expect(getUserConnection(user1)).toEqual(config1);
+    expect(getUserConnection(user2)).toEqual(config2);
+    clearUserConnection(user1);
+    expect(getUserConnection(user1)).toBeNull();
+    expect(getUserConnection(user2)).toEqual(config2);
+  });
+});
diff --git a/src/lib/server/storage/utils.test.ts b/src/lib/server/storage/utils.test.ts
new file mode 100644
index 00000000..55a3a061
--- /dev/null
+++ b/src/lib/server/storage/utils.test.ts
@@ -0,0 +1,42 @@
+import { describe, it, expect, vi } from 'vitest';
+import { faker } from '@faker-js/faker';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ info: vi.fn(), debug: vi.fn() }) }
+}));
+
+const mockGetUserConnection = vi.fn();
+vi.mock('./user-connections.js', () => ({
+  getUserConnection: (...args: unknown[]) => mockGetUserConnection(...args)
+}));
+
+const mockCreate = vi.fn().mockReturnValue({ listObjects: vi.fn() });
+vi.mock('./factory.js', () => ({
+  StorageProviderFactory: { create: (...args: unknown[]) => mockCreate(...args) }
+}));
+
+import { getProviderForUser } from './utils.js';
+
+describe('getProviderForUser', () => {
+  it('throws 401 when no connection exists', () => {
+    mockGetUserConnection.mockReturnValue(null);
+    expect(() => getProviderForUser(faker.string.uuid(), 'bucket')).toThrow(
+      expect.objectContaining({ status: 401 })
+    );
+  });
+
+  it('throws 400 for non-s3 connection type', () => {
+    mockGetUserConnection.mockReturnValue({ type: 'hdfs', nameNode: 'nn', port: 9870, user: 'u' });
+    expect(() => getProviderForUser(faker.string.uuid(), 'bucket')).toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns provider for valid s3 connection', () => {
+    const config = { type: 's3', region: 'us-east-1' };
+    mockGetUserConnection.mockReturnValue(config);
+    const provider = getProviderForUser('user1', 'my-bucket');
+    expect(mockCreate).toHaveBeenCalledWith({ ...config, bucket: 'my-bucket' });
+    expect(provider).toBeDefined();
+  });
+});
diff --git a/src/routes/(app)/page.svelte.spec.ts b/src/routes/(app)/page.svelte.spec.ts
index 380860f2..f1e6e6b7 100644
--- a/src/routes/(app)/page.svelte.spec.ts
+++ b/src/routes/(app)/page.svelte.spec.ts
@@ -26,6 +26,30 @@ describe('/(app)/+page.svelte', () => {
     await expect.element(page.getByText('Health', { exact: true })).toBeInTheDocument();
   });
 
+  it('should display the service count from props', async () => {
+    render(Page, {
+      params: {},
+      data: { user: null, storageBrowserEnabled: true, serviceCount: 5, healthy: true },
+      form: null
+    });
+
+    await expect.element(page.getByText('5')).toBeInTheDocument();
+  });
+
+  it('should display the health OK status', async () => {
+    renderPage();
+
+    await expect.element(page.getByText('OK')).toBeInTheDocument();
+  });
+
+  it('should render the dashboard subtitle', async () => {
+    renderPage();
+
+    await expect
+      .element(page.getByText(/stackable unified data platform overview/i))
+      .toBeInTheDocument();
+  });
+
   it('should render the getting started section', async () => {
     renderPage();
 
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 603be1f7..375f8d76 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -1,14 +1,18 @@
 <script lang="ts">
+  import { untrack } from 'svelte';
   import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
   import { StorageState } from '$lib/storage/state.svelte.js';
   import { setStorageState } from '$lib/storage/context.js';
 
   let { children, data } = $props();
 
-  const storage = new StorageState({
-    connected: data.connected,
-    buckets: data.buckets
-  });
+  const storage = untrack(
+    () =>
+      new StorageState({
+        connected: data.connected,
+        buckets: data.buckets
+      })
+  );
   setStorageState(storage);
 
   // Keep layout-level data in sync when SvelteKit re-runs the load function
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
new file mode 100644
index 00000000..e525528c
--- /dev/null
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
@@ -0,0 +1,62 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('$lib/server/storage/service.js', () => ({
+  listObjects: vi.fn()
+}));
+
+vi.mock('$lib/server/auth-utils.js', () => ({
+  getUserId: vi.fn(() => 'test-user')
+}));
+
+import { load } from './+page.server.js';
+import { listObjects } from '$lib/server/storage/service.js';
+
+function mockEvent(
+  opts: { bucket?: string; prefix?: string; searchParams?: Record<string, string> } = {}
+) {
+  const url = new URL('http://localhost/storage/b1/some/prefix');
+  for (const [k, v] of Object.entries(opts.searchParams ?? {})) {
+    url.searchParams.set(k, v);
+  }
+  return {
+    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } },
+    params: { bucket: opts.bucket ?? 'my-bucket', prefix: opts.prefix ?? '' },
+    url
+  } as unknown as Parameters<typeof load>[0];
+}
+
+describe('bucket page load', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('lists objects with default page size', async () => {
+    vi.mocked(listObjects).mockResolvedValue({ items: [], prefixes: [] } as unknown as Awaited<
+      ReturnType<typeof listObjects>
+    >);
+
+    const result = (await load(mockEvent())) as { bucket: string; prefix: string };
+
+    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', '', 25, undefined);
+    expect(result.bucket).toBe('my-bucket');
+    expect(result.prefix).toBe('');
+  });
+
+  it('adds trailing slash to prefix', async () => {
+    vi.mocked(listObjects).mockResolvedValue({ items: [] } as unknown as Awaited<
+      ReturnType<typeof listObjects>
+    >);
+
+    await load(mockEvent({ prefix: 'data/2024' }));
+
+    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', 'data/2024/', 25, undefined);
+  });
+
+  it('passes continuationToken and pageSize', async () => {
+    vi.mocked(listObjects).mockResolvedValue({ items: [] } as unknown as Awaited<
+      ReturnType<typeof listObjects>
+    >);
+
+    await load(mockEvent({ searchParams: { continuationToken: 'abc', pageSize: '50' } }));
+
+    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', '', 50, 'abc');
+  });
+});
diff --git a/src/routes/(app)/storage/api/delete/server.test.ts b/src/routes/(app)/storage/api/delete/server.test.ts
new file mode 100644
index 00000000..acda7403
--- /dev/null
+++ b/src/routes/(app)/storage/api/delete/server.test.ts
@@ -0,0 +1,56 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { faker } from '@faker-js/faker';
+
+vi.mock('$lib/server/storage/service.js', () => ({
+  deleteObjects: vi.fn()
+}));
+
+vi.mock('$lib/server/auth-utils.js', () => ({
+  getUserId: vi.fn(() => 'test-user')
+}));
+
+import { DELETE } from './+server.js';
+import { deleteObjects } from '$lib/server/storage/service.js';
+
+function mockEvent(searchParams: Record<string, string | string[]>) {
+  const url = new URL('http://localhost/storage/api/delete');
+  for (const [k, v] of Object.entries(searchParams)) {
+    if (Array.isArray(v)) {
+      v.forEach((val) => url.searchParams.append(k, val));
+    } else {
+      url.searchParams.set(k, v);
+    }
+  }
+  return {
+    url,
+    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+  } as unknown as Parameters<typeof DELETE>[0];
+}
+
+describe('DELETE /storage/api/delete', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('throws 400 when bucket is missing', async () => {
+    await expect(DELETE(mockEvent({ keys: 'a.txt' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('throws 400 when keys are missing', async () => {
+    await expect(DELETE(mockEvent({ bucket: 'b1' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('deletes objects and returns JSON result', async () => {
+    const keys = [faker.system.fileName(), faker.system.fileName()];
+    const result = { deleted: keys, failed: [] };
+    vi.mocked(deleteObjects).mockResolvedValue(
+      result as unknown as Awaited<ReturnType<typeof deleteObjects>>
+    );
+
+    const response = await DELETE(mockEvent({ bucket: 'b1', keys }));
+    expect(deleteObjects).toHaveBeenCalledWith('test-user', 'b1', keys);
+    expect(await response.json()).toEqual(result);
+  });
+});
diff --git a/src/routes/(app)/storage/api/download/server.test.ts b/src/routes/(app)/storage/api/download/server.test.ts
new file mode 100644
index 00000000..0ed933f8
--- /dev/null
+++ b/src/routes/(app)/storage/api/download/server.test.ts
@@ -0,0 +1,73 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('$lib/server/storage/service.js', () => ({
+  downloadObject: vi.fn(),
+  getObjectMetadata: vi.fn()
+}));
+
+vi.mock('$lib/server/auth-utils.js', () => ({
+  getUserId: vi.fn(() => 'test-user')
+}));
+
+import { GET, HEAD } from './+server.js';
+import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
+
+function mockEvent(params: string) {
+  const url = new URL(`http://localhost/storage/api/download?${params}`);
+  return {
+    url,
+    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /storage/api/download', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('streams download with correct headers', async () => {
+    const stream = new ReadableStream();
+    vi.mocked(downloadObject).mockResolvedValue({
+      stream,
+      contentType: 'text/csv',
+      contentLength: 1234,
+      etag: '"abc"'
+    } as unknown as Awaited<ReturnType<typeof downloadObject>>);
+
+    const res = await GET(mockEvent('bucket=b1&key=path/data.csv'));
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('Content-Disposition')).toContain('data.csv');
+    expect(res.headers.get('Content-Type')).toBe('text/csv');
+    expect(res.headers.get('Content-Length')).toBe('1234');
+    expect(res.headers.get('ETag')).toBe('"abc"');
+  });
+
+  it('uses application/octet-stream when no content type', async () => {
+    vi.mocked(downloadObject).mockResolvedValue({
+      stream: new ReadableStream(),
+      contentType: undefined,
+      contentLength: undefined,
+      etag: undefined
+    } as unknown as Awaited<ReturnType<typeof downloadObject>>);
+
+    const res = await GET(mockEvent('bucket=b1&key=file.bin'));
+    expect(res.headers.get('Content-Type')).toBe('application/octet-stream');
+    expect(res.headers.has('Content-Length')).toBe(false);
+  });
+});
+
+describe('HEAD /storage/api/download', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('returns 200 with metadata headers', async () => {
+    vi.mocked(getObjectMetadata).mockResolvedValue({
+      contentType: 'application/json',
+      size: 999
+    } as unknown as Awaited<ReturnType<typeof getObjectMetadata>>);
+
+    const res = await HEAD(mockEvent('bucket=b1&key=data.json'));
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('Content-Type')).toBe('application/json');
+    expect(res.headers.get('Content-Length')).toBe('999');
+  });
+});
diff --git a/src/routes/(app)/storage/api/params.test.ts b/src/routes/(app)/storage/api/params.test.ts
new file mode 100644
index 00000000..f8625d32
--- /dev/null
+++ b/src/routes/(app)/storage/api/params.test.ts
@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest';
+import { requireBucket, requireBucketKey } from './params.js';
+
+describe('requireBucket', () => {
+  it('throws 400 when bucket param is missing', () => {
+    const url = new URL('http://localhost/storage/api/test');
+    expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('throws 400 when bucket param is empty', () => {
+    const url = new URL('http://localhost/storage/api/test?bucket=');
+    expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('throws 400 when bucket param is whitespace only', () => {
+    const url = new URL('http://localhost/storage/api/test?bucket=%20%20');
+    expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('returns trimmed bucket name', () => {
+    const url = new URL('http://localhost/storage/api/test?bucket=%20my-bucket%20');
+    expect(requireBucket(url)).toBe('my-bucket');
+  });
+});
+
+describe('requireBucketKey', () => {
+  it('throws 400 when bucket is missing', () => {
+    const url = new URL('http://localhost/storage/api/test?key=file.txt');
+    expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('throws 400 when key is missing', () => {
+    const url = new URL('http://localhost/storage/api/test?bucket=my-bucket');
+    expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('throws 400 when key is empty', () => {
+    const url = new URL('http://localhost/storage/api/test?bucket=my-bucket&key=');
+    expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('returns both bucket and key trimmed', () => {
+    const url = new URL(
+      'http://localhost/storage/api/test?bucket=%20b1%20&key=%20path/file.txt%20'
+    );
+    expect(requireBucketKey(url)).toEqual({ bucket: 'b1', key: 'path/file.txt' });
+  });
+});
diff --git a/src/routes/(app)/storage/api/preview/server.test.ts b/src/routes/(app)/storage/api/preview/server.test.ts
new file mode 100644
index 00000000..d0867554
--- /dev/null
+++ b/src/routes/(app)/storage/api/preview/server.test.ts
@@ -0,0 +1,98 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { S3ServiceException } from '@aws-sdk/client-s3';
+
+const mockGetMetadata = vi.fn();
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProviderForUser: vi.fn(() => ({ getMetadata: mockGetMetadata }))
+}));
+
+vi.mock('$lib/server/auth-utils.js', () => ({
+  getUserId: vi.fn(() => 'test-user')
+}));
+
+vi.mock('$lib/server/storage/preview/binary.js', () => ({
+  KNOWN_BINARY_TYPES: new Set(['application/zip']),
+  binaryPreview: vi.fn(() => new Response(null, { headers: { 'X-Preview-Renderable': 'false' } }))
+}));
+
+vi.mock('$lib/server/storage/preview/stream.js', () => ({
+  streamPreview: vi.fn(async () => new Response('preview content'))
+}));
+
+vi.mock('$lib/server/storage/s3-errors.js', () => ({
+  mapS3ErrorToHttp: vi.fn((err) => {
+    throw err;
+  })
+}));
+
+import { GET } from './+server.js';
+import { binaryPreview } from '$lib/server/storage/preview/binary.js';
+import { streamPreview } from '$lib/server/storage/preview/stream.js';
+import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
+
+function mockEvent(params: string) {
+  const url = new URL(`http://localhost/storage/api/preview?${params}`);
+  return {
+    url,
+    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /storage/api/preview', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('returns binary preview for known binary types', async () => {
+    mockGetMetadata.mockResolvedValue({ contentType: 'application/zip', size: 5000 });
+
+    await GET(mockEvent('bucket=b1&key=archive.zip'));
+
+    expect(binaryPreview).toHaveBeenCalledWith('application/zip', 5000);
+  });
+
+  it('normalises Excel CSV content type', async () => {
+    mockGetMetadata.mockResolvedValue({ contentType: 'application/vnd.ms-excel', size: 100 });
+
+    await GET(mockEvent('bucket=b1&key=data.csv'));
+
+    expect(streamPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'data.csv',
+      'text/csv',
+      100,
+      'test-user',
+      expect.anything()
+    );
+  });
+
+  it('calls streamPreview for text types', async () => {
+    mockGetMetadata.mockResolvedValue({ contentType: 'text/plain', size: 50 });
+
+    await GET(mockEvent('bucket=b1&key=readme.txt'));
+
+    expect(streamPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'readme.txt',
+      'text/plain',
+      50,
+      'test-user',
+      expect.anything()
+    );
+  });
+
+  it('maps S3 errors to HTTP errors', async () => {
+    const s3Err = new S3ServiceException({
+      name: 'NoSuchKey',
+      message: 'not found',
+      $fault: 'client',
+      $metadata: { httpStatusCode: 404 }
+    });
+    mockGetMetadata.mockRejectedValue(s3Err);
+
+    await expect(GET(mockEvent('bucket=b1&key=missing.txt'))).rejects.toThrow();
+    expect(mapS3ErrorToHttp).toHaveBeenCalledWith(s3Err, {
+      bucket: 'b1',
+      key: 'missing.txt',
+      operation: 'preview'
+    });
+  });
+});
diff --git a/src/routes/(app)/storage/api/upload/server.test.ts b/src/routes/(app)/storage/api/upload/server.test.ts
new file mode 100644
index 00000000..0f3bb6ed
--- /dev/null
+++ b/src/routes/(app)/storage/api/upload/server.test.ts
@@ -0,0 +1,78 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('$lib/server/storage/service.js', () => ({
+  uploadObject: vi.fn()
+}));
+
+vi.mock('$lib/server/auth-utils.js', () => ({
+  getUserId: vi.fn(() => 'test-user')
+}));
+
+import { POST } from './+server.js';
+import { uploadObject } from '$lib/server/storage/service.js';
+
+function mockEvent(opts: {
+  params?: string;
+  body?: ReadableStream | null;
+  headers?: Record<string, string>;
+}) {
+  const url = new URL(
+    `http://localhost/storage/api/upload?${opts.params ?? 'bucket=b1&key=file.txt'}`
+  );
+  const headers = new Headers(
+    opts.headers ?? { 'Content-Type': 'text/plain', 'Content-Length': '42' }
+  );
+  const body = 'body' in opts ? opts.body : new ReadableStream();
+  return {
+    url,
+    request: { body, headers },
+    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+  } as unknown as Parameters<typeof POST>[0];
+}
+
+describe('POST /storage/api/upload', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('throws 400 when bucket/key missing', async () => {
+    await expect(POST(mockEvent({ params: '' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('throws 400 when request body is missing', async () => {
+    await expect(POST(mockEvent({ body: null }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('uploads and returns 201', async () => {
+    vi.mocked(uploadObject).mockResolvedValue(undefined);
+    const body = new ReadableStream();
+
+    const res = await POST(
+      mockEvent({
+        body,
+        headers: { 'Content-Type': 'image/png; charset=utf-8', 'Content-Length': '100' }
+      })
+    );
+
+    expect(res.status).toBe(201);
+    expect(uploadObject).toHaveBeenCalledWith(
+      'test-user',
+      'b1',
+      'file.txt',
+      body,
+      'image/png',
+      100
+    );
+  });
+
+  it('defaults content type to application/octet-stream', async () => {
+    vi.mocked(uploadObject).mockResolvedValue(undefined);
+
+    const res = await POST(mockEvent({ headers: {} }));
+
+    expect(res.status).toBe(201);
+    expect(vi.mocked(uploadObject).mock.calls[0][4]).toBe('application/octet-stream');
+  });
+});
diff --git a/src/routes/(app)/storage/layout.server.test.ts b/src/routes/(app)/storage/layout.server.test.ts
new file mode 100644
index 00000000..25d1e89e
--- /dev/null
+++ b/src/routes/(app)/storage/layout.server.test.ts
@@ -0,0 +1,69 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockStorageBrowserEnabled = vi.fn(() => true);
+vi.mock('$lib/server/feature-flags.js', () => ({
+  get storageBrowserEnabled() {
+    return mockStorageBrowserEnabled();
+  }
+}));
+
+vi.mock('$lib/server/storage/service.js', () => ({
+  getConnection: vi.fn(),
+  listBuckets: vi.fn()
+}));
+
+vi.mock('$lib/server/auth-utils.js', () => ({
+  getUserId: vi.fn(() => 'test-user')
+}));
+
+import { load } from './+layout.server.js';
+import { getConnection, listBuckets } from '$lib/server/storage/service.js';
+
+function mockEvent() {
+  return {
+    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+  } as unknown as Parameters<typeof load>[0];
+}
+
+describe('storage layout load', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('throws 404 when storage browser is disabled', async () => {
+    mockStorageBrowserEnabled.mockReturnValue(false);
+    await expect(load(mockEvent())).rejects.toThrow(expect.objectContaining({ status: 404 }));
+  });
+
+  it('returns connected:false when no connection', async () => {
+    mockStorageBrowserEnabled.mockReturnValue(true);
+    vi.mocked(getConnection).mockReturnValue(null);
+
+    const result = await load(mockEvent());
+    expect(result).toEqual({ connected: false, buckets: [], connectionType: null });
+  });
+
+  it('returns buckets when connected', async () => {
+    mockStorageBrowserEnabled.mockReturnValue(true);
+    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
+      typeof getConnection
+    >);
+    vi.mocked(listBuckets).mockResolvedValue(['bucket-a', 'bucket-b']);
+
+    const result = await load(mockEvent());
+    expect(result).toEqual({
+      connected: true,
+      buckets: ['bucket-a', 'bucket-b'],
+      connectionType: 's3'
+    });
+  });
+
+  it('returns empty buckets when listBuckets fails', async () => {
+    mockStorageBrowserEnabled.mockReturnValue(true);
+    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
+      typeof getConnection
+    >);
+    vi.mocked(listBuckets).mockRejectedValue(new Error('network'));
+
+    const result = await load(mockEvent());
+    expect(result).toEqual({ connected: true, buckets: [], connectionType: 's3' });
+  });
+});
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
new file mode 100644
index 00000000..d1766205
--- /dev/null
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -0,0 +1,146 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+vi.mock('$lib/server/storage/service.js', () => ({
+  getConnection: vi.fn(),
+  saveConnection: vi.fn(),
+  clearConnection: vi.fn(),
+  listBuckets: vi.fn()
+}));
+
+vi.mock('$lib/server/auth-utils.js', () => ({
+  getUserId: vi.fn(() => 'test-user')
+}));
+
+vi.mock('$lib/storage/schemas.js', () => ({
+  StorageConnectionSchema: {} // superValidate is also mocked
+}));
+
+vi.mock('sveltekit-superforms', () => ({
+  superValidate: vi.fn(),
+  message: vi.fn((form, msg, opts) => ({ form, message: msg, status: opts?.status }))
+}));
+
+vi.mock('sveltekit-superforms/adapters', () => ({
+  zod4: vi.fn((schema) => schema)
+}));
+
+import { load, actions } from './+page.server.js';
+import { getConnection, clearConnection, listBuckets } from '$lib/server/storage/service.js';
+import { superValidate } from 'sveltekit-superforms';
+
+function mockLocals() {
+  return { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } };
+}
+
+describe('storage page load', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('returns connectionForm and connected status', async () => {
+    vi.mocked(superValidate).mockResolvedValue({ data: {} } as unknown as Awaited<
+      ReturnType<typeof superValidate>
+    >);
+    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
+      typeof getConnection
+    >);
+
+    const result = (await load({
+      locals: mockLocals()
+    } as unknown as Parameters<typeof load>[0])) as { connected: boolean; connectionForm: unknown };
+    expect(result.connected).toBe(true);
+    expect(result.connectionForm).toBeDefined();
+  });
+});
+
+describe('storage page actions', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('connect: returns fail(400) on invalid form', async () => {
+    vi.mocked(superValidate).mockResolvedValue({ valid: false, errors: {} } as unknown as Awaited<
+      ReturnType<typeof superValidate>
+    >);
+
+    const result = await actions.connect({
+      request: new Request('http://localhost', { method: 'POST' }),
+      locals: mockLocals()
+    } as unknown as Parameters<typeof actions.connect>[0]);
+    expect(result?.status).toBe(400);
+  });
+
+  it('connect: returns message for non-s3 type', async () => {
+    vi.mocked(superValidate).mockResolvedValue({
+      valid: true,
+      data: {
+        type: 'hdfs',
+        endpoint: '',
+        pathStyle: false,
+        region: '',
+        accessKeyId: '',
+        secretAccessKey: ''
+      }
+    } as unknown as Awaited<ReturnType<typeof superValidate>>);
+
+    const result = await actions.connect({
+      request: new Request('http://localhost', { method: 'POST' }),
+      locals: mockLocals()
+    } as unknown as Parameters<typeof actions.connect>[0]);
+    expect(result).toHaveProperty('message', 'HDFS connections are not yet supported');
+  });
+
+  it('connect: clears connection and returns error on test failure', async () => {
+    vi.mocked(superValidate).mockResolvedValue({
+      valid: true,
+      data: {
+        type: 's3',
+        endpoint: 'http://s3',
+        pathStyle: true,
+        region: 'us-east-1',
+        accessKeyId: 'ak',
+        secretAccessKey: 'sk'
+      }
+    } as unknown as Awaited<ReturnType<typeof superValidate>>);
+    vi.mocked(listBuckets).mockRejectedValue(new Error('connection refused'));
+
+    const result = await actions.connect({
+      request: new Request('http://localhost', { method: 'POST' }),
+      locals: mockLocals()
+    } as unknown as Parameters<typeof actions.connect>[0]);
+    expect(clearConnection).toHaveBeenCalledWith('test-user');
+    expect(result).toHaveProperty(
+      'message',
+      'Could not connect — check the endpoint and credentials.'
+    );
+  });
+
+  it('connect: redirects on success', async () => {
+    vi.mocked(superValidate).mockResolvedValue({
+      valid: true,
+      data: {
+        type: 's3',
+        endpoint: 'http://s3',
+        pathStyle: true,
+        region: 'us-east-1',
+        accessKeyId: 'ak',
+        secretAccessKey: 'sk'
+      }
+    } as unknown as Awaited<ReturnType<typeof superValidate>>);
+    vi.mocked(listBuckets).mockResolvedValue(['b1']);
+
+    await expect(
+      actions.connect({
+        request: new Request('http://localhost', { method: 'POST' }),
+        locals: mockLocals()
+      } as unknown as Parameters<typeof actions.connect>[0])
+    ).rejects.toThrow(expect.objectContaining({ status: 303, location: '/storage' }));
+  });
+
+  it('disconnect: clears connection and redirects', async () => {
+    await expect(
+      actions.disconnect({ locals: mockLocals() } as unknown as Parameters<
+        typeof actions.disconnect
+      >[0])
+    ).rejects.toThrow(
+      expect.objectContaining({ status: 303, location: '/storage?disconnected=1' })
+    );
+    expect(clearConnection).toHaveBeenCalledWith('test-user');
+  });
+});
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 1c439f9d..bb67c769 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -136,38 +136,41 @@
     enhance: connectionEnhance,
     errors: connectionErrors,
     message: connectionMessage
-  } = superForm(data.connectionForm, {
-    onSubmit({ cancel }) {
-      const result = ConnectionSchema.safeParse({
-        connectionUrl,
-        authType,
-        authUsername,
-        authPassword
-      });
-      if (!result.success) {
-        const errors: Record<string, string[]> = {};
-        for (const issue of result.error.issues) {
-          const key = String(issue.path[0]);
-          (errors[key] ??= []).push(issue.message);
+  } = superForm(
+    untrack(() => data.connectionForm),
+    {
+      onSubmit({ cancel }) {
+        const result = ConnectionSchema.safeParse({
+          connectionUrl,
+          authType,
+          authUsername,
+          authPassword
+        });
+        if (!result.success) {
+          const errors: Record<string, string[]> = {};
+          for (const issue of result.error.issues) {
+            const key = String(issue.path[0]);
+            (errors[key] ??= []).push(issue.message);
+          }
+          $connectionErrors = {
+            connectionUrl: errors.connectionUrl,
+            authType: errors.authType,
+            authUsername: errors.authUsername,
+            authPassword: errors.authPassword
+          };
+          cancel();
+        }
+      },
+      onUpdated({ form }) {
+        const msg = form.message as ConnectionMessage | undefined;
+        if (msg?.type === 'success') {
+          catalogVersion++;
+        } else if (msg?.type === 'error') {
+          connectionOpen = true;
         }
-        $connectionErrors = {
-          connectionUrl: errors.connectionUrl,
-          authType: errors.authType,
-          authUsername: errors.authUsername,
-          authPassword: errors.authPassword
-        };
-        cancel();
-      }
-    },
-    onUpdated({ form }) {
-      const msg = form.message as ConnectionMessage | undefined;
-      if (msg?.type === 'success') {
-        catalogVersion++;
-      } else if (msg?.type === 'error') {
-        connectionOpen = true;
       }
     }
-  });
+  );
 
   const isActive = $derived(runner.state !== 'IDLE' && !isTerminal(runner.state));
   const skippedStatements = $derived.by(() => {
diff --git a/vite.config.ts b/vite.config.ts
index 4d7346d3..58711b13 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -18,6 +18,11 @@ export default defineConfig({
   ],
   server: { allowedHosts: true },
   test: {
+    coverage: {
+      provider: 'v8',
+      reporter: ['json', 'json-summary'],
+      reportsDirectory: './coverage'
+    },
     expect: { requireAssertions: true },
     projects: [
       {

From 6ac766ec539087b76e906bb03a91ecb02824cce1 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 2 Jun 2026 09:32:32 +0200
Subject: [PATCH 045/136] #94 #118 bugfix deleting a path removes it from
 recent access (#174)

---
 e2e/storage/recent-items.spec.ts    | 89 ++++++++++++++++++++++++++++-
 src/lib/storage/bookmarks.svelte.ts | 13 ++++-
 src/lib/storage/state.svelte.ts     |  6 +-
 3 files changed, 105 insertions(+), 3 deletions(-)

diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index a71f059a..6f76587f 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -1,4 +1,4 @@
-import { test, expect } from '@playwright/test';
+import { test, expect, type Page } from '@playwright/test';
 import {
   createS3Client,
   hasGarageCredentials,
@@ -15,6 +15,12 @@ import {
   uniquePrefix
 } from './helpers.js';
 
+async function previewFile(page: Page, name: string) {
+  await rowByName(page, name).dblclick();
+  await expect(page.getByRole('heading', { name })).toBeVisible();
+  await page.getByRole('button', { name: 'Close' }).last().click();
+}
+
 test.describe('Storage S3 — Recent Items', () => {
   test.use({ locale: 'en-US' });
 
@@ -66,4 +72,85 @@ test.describe('Storage S3 — Recent Items', () => {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
   });
+
+  test('removes a deleted file from Recent Files', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'recent-delete-file');
+    const key = `${prefix}to-delete.txt`;
+
+    try {
+      await putTextObject(client, credentials.bucket, key, 'ephemeral');
+
+      // Visit the file so it appears in Recent Files
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await previewFile(page, 'to-delete.txt');
+
+      // Confirm it appears in Recent Files
+      await page.goto('/storage');
+      await waitForHydration(page);
+      await expect(page.locator('tbody').getByText('to-delete.txt')).toBeVisible();
+
+      // Delete the file via the UI
+      await page.goto(bucketRoute(credentials.bucket, prefix));
+      await waitForHydration(page);
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      await page.getByLabel('Select to-delete.txt').check();
+      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete permanently' }).click();
+      await expect(page.getByText('This bucket is empty')).toBeVisible();
+
+      // File should no longer appear in Recent Files
+      await page.goto('/storage');
+      await waitForHydration(page);
+      await expect(page.locator('tbody').getByText('to-delete.txt')).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, [key]);
+    }
+  });
+
+  test('removes files and location from recent lists when a directory is deleted', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'recent-delete-dir');
+    const nestedKey = `${prefix}sub/nested.txt`;
+
+    try {
+      await putTextObject(client, credentials.bucket, nestedKey, 'nested content');
+
+      // Navigate into the sub-directory so it appears in Recent Locations
+      await connectAndOpenPrefix(page, credentials, `${prefix}sub/`);
+      await waitForHydration(page);
+
+      // Preview the nested file so it appears in Recent Files
+      await previewFile(page, 'nested.txt');
+
+      // Confirm both lists contain the entries
+      await page.goto('/storage');
+      await waitForHydration(page);
+      await expect(page.locator('tbody').getByText('nested.txt')).toBeVisible();
+      await page.getByRole('tab', { name: 'Recent Locations' }).click();
+      await expect(page.locator('tbody').getByText('sub')).toBeVisible();
+
+      // Delete the parent directory via the UI
+      await page.goto(bucketRoute(credentials.bucket, prefix));
+      await waitForHydration(page);
+      await page.getByRole('button', { name: 'Toggle selection mode' }).click();
+      await page.getByLabel('Select sub').check();
+      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete permanently' }).click();
+      await expect(page.getByText('This bucket is empty')).toBeVisible();
+
+      // Neither the file nor the location should appear in the recent lists
+      await page.goto('/storage');
+      await waitForHydration(page);
+      await expect(page.locator('tbody').getByText('nested.txt')).not.toBeVisible();
+      await page.getByRole('tab', { name: 'Recent Locations' }).click();
+      await expect(page.locator('tbody').getByText('sub')).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, [nestedKey]);
+    }
+  });
 });
diff --git a/src/lib/storage/bookmarks.svelte.ts b/src/lib/storage/bookmarks.svelte.ts
index 0e7be970..5116e2d3 100644
--- a/src/lib/storage/bookmarks.svelte.ts
+++ b/src/lib/storage/bookmarks.svelte.ts
@@ -7,7 +7,7 @@ import {
   loadFromStorage,
   persistToStorage
 } from './persistence.js';
-import { SvelteDate } from 'svelte/reactivity';
+import { SvelteDate, SvelteSet } from 'svelte/reactivity';
 
 export class BookmarksState {
   pinnedLocations = $state<PinnedLocation[]>(loadFromStorage<PinnedLocation>(LS_PINS));
@@ -71,6 +71,17 @@ export class BookmarksState {
     persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
   }
 
+  removeFiles(bucket: string, fileKeys: string[]): void {
+    if (fileKeys.length === 0) return;
+    const keySet = new SvelteSet(fileKeys);
+    const before = this.recentFiles.length;
+    const keep = this.recentFiles.filter((f) => !(f.bucket === bucket && keySet.has(f.key)));
+    if (keep.length !== before) {
+      this.recentFiles.splice(0, this.recentFiles.length, ...keep);
+      persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+    }
+  }
+
   removeItemsUnderDirectories(bucket: string, dirPrefixes: string[]): void {
     if (dirPrefixes.length === 0) return;
     const underAny = (path: string) => dirPrefixes.some((p) => path === p || path.startsWith(p));
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 89597e33..dc17aeef 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -365,12 +365,16 @@ export class StorageState {
       failed: Array<{ key: string; code?: string; message?: string }>;
     };
 
-    // Clean up pinned locations and recent items for deleted directories
+    // Clean up pinned locations and recent items for deleted paths
     const dirPrefixes = keys.filter((k) => k.endsWith('/'));
+    const fileKeys = keys.filter((k) => !k.endsWith('/'));
     if (dirPrefixes.length > 0) {
       this.bookmarks.unpinUnderDirectories(bucket, dirPrefixes);
       this.bookmarks.removeItemsUnderDirectories(bucket, dirPrefixes);
     }
+    if (fileKeys.length > 0) {
+      this.bookmarks.removeFiles(bucket, fileKeys);
+    }
 
     return result;
   }

From 4daae3ad29385e7774ca4cbd925b70449779c08c Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 2 Jun 2026 11:33:24 +0200
Subject: [PATCH 046/136] #154 Add Refresh Button (#169)

* #154 add refresh button

* #154 make the refresh button white

* Feat: add refresh button test  to reload file listing in S3 browser

* Fix: update visibility checks for recent items to use exact match

* Feat: update delete button selector to use exact match in tests

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
---
 e2e/storage/browsing.spec.ts                  | 32 +++++++++++++++++++
 e2e/storage/delete.spec.ts                    |  4 +--
 e2e/storage/permissions.spec.ts               |  2 +-
 e2e/storage/recent-items.spec.ts              |  8 ++---
 messages/de.json                              |  1 +
 messages/en.json                              |  1 +
 .../storage/explorer/SelectionToolbar.svelte  | 13 ++++++++
 src/lib/storage/state.svelte.ts               |  5 +++
 8 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/e2e/storage/browsing.spec.ts b/e2e/storage/browsing.spec.ts
index 701632d3..d0870d96 100644
--- a/e2e/storage/browsing.spec.ts
+++ b/e2e/storage/browsing.spec.ts
@@ -114,6 +114,38 @@ test.describe('Storage S3 — Browsing', () => {
     }
   });
 
+  test('refresh button reloads the file listing', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'refresh');
+    const initialKey = `${prefix}initial.txt`;
+    const addedKey = `${prefix}added-later.txt`;
+
+    try {
+      await putTextObject(client, credentials.bucket, initialKey, 'initial content');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Only the initial file should be visible.
+      await expect(rowByName(page, 'initial.txt')).toBeVisible();
+      await expect(rowByName(page, 'added-later.txt')).not.toBeVisible();
+
+      // Upload a second file directly via S3, bypassing the UI.
+      await putTextObject(client, credentials.bucket, addedKey, 'added later');
+
+      // The newly added file should not appear yet — the listing is stale.
+      await expect(rowByName(page, 'added-later.txt')).not.toBeVisible();
+
+      // Click the refresh button in the toolbar.
+      await page.getByRole('button', { name: 'Refresh' }).click();
+
+      // After refresh the newly added file should now be visible.
+      await expect(rowByName(page, 'added-later.txt')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, [initialKey, addedKey]);
+    }
+  });
+
   test('changes the page size and shows more items per page', async ({ page }, testInfo) => {
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
diff --git a/e2e/storage/delete.spec.ts b/e2e/storage/delete.spec.ts
index 2df45115..d647838f 100644
--- a/e2e/storage/delete.spec.ts
+++ b/e2e/storage/delete.spec.ts
@@ -40,7 +40,7 @@ test.describe('Storage S3 — Delete & Selection', () => {
       await page.getByLabel('Select remove-me.txt').check();
       await page.getByLabel('Select archive').check();
 
-      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete', exact: true }).click();
       await expect(page.getByText('All contents will be permanently deleted')).toBeVisible();
       await page.getByRole('button', { name: 'Delete permanently' }).click();
 
@@ -70,7 +70,7 @@ test.describe('Storage S3 — Delete & Selection', () => {
 
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select keep-me.txt').check();
-      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete', exact: true }).click();
 
       await expect(page.getByText('This action cannot be undone.')).toBeVisible();
 
diff --git a/e2e/storage/permissions.spec.ts b/e2e/storage/permissions.spec.ts
index 11cbec95..50de8f06 100644
--- a/e2e/storage/permissions.spec.ts
+++ b/e2e/storage/permissions.spec.ts
@@ -70,7 +70,7 @@ test.describe('Storage S3 — Permissions', () => {
 
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel(`Select ${existingKey}`).check();
-      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete', exact: true }).click();
       await page.getByRole('button', { name: 'Delete permanently' }).click();
 
       const errorToast = page
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index 6f76587f..7b30156e 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -96,7 +96,7 @@ test.describe('Storage S3 — Recent Items', () => {
       await waitForHydration(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select to-delete.txt').check();
-      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete', exact: true }).click();
       await page.getByRole('button', { name: 'Delete permanently' }).click();
       await expect(page.getByText('This bucket is empty')).toBeVisible();
 
@@ -132,14 +132,14 @@ test.describe('Storage S3 — Recent Items', () => {
       await waitForHydration(page);
       await expect(page.locator('tbody').getByText('nested.txt')).toBeVisible();
       await page.getByRole('tab', { name: 'Recent Locations' }).click();
-      await expect(page.locator('tbody').getByText('sub')).toBeVisible();
+      await expect(page.locator('tbody').getByText('sub', { exact: true })).toBeVisible();
 
       // Delete the parent directory via the UI
       await page.goto(bucketRoute(credentials.bucket, prefix));
       await waitForHydration(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select sub').check();
-      await page.getByRole('button', { name: 'Delete' }).click();
+      await page.getByRole('button', { name: 'Delete', exact: true }).click();
       await page.getByRole('button', { name: 'Delete permanently' }).click();
       await expect(page.getByText('This bucket is empty')).toBeVisible();
 
@@ -148,7 +148,7 @@ test.describe('Storage S3 — Recent Items', () => {
       await waitForHydration(page);
       await expect(page.locator('tbody').getByText('nested.txt')).not.toBeVisible();
       await page.getByRole('tab', { name: 'Recent Locations' }).click();
-      await expect(page.locator('tbody').getByText('sub')).not.toBeVisible();
+      await expect(page.locator('tbody').getByText('sub', { exact: true })).not.toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, [nestedKey]);
     }
diff --git a/messages/de.json b/messages/de.json
index e6e2d1a8..8fb7028f 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -178,6 +178,7 @@
   "storage_paste_plural": "{count} Elemente einfügen",
   "storage_selected": "{count} ausgewählt",
   "storage_action_preview": "Vorschau",
+  "storage_action_refresh": "Aktualisieren",
   "storage_action_preview_no_selection": "Keine Datei für die Vorschau ausgewählt.",
   "storage_action_download_no_selection": "Keine Datei für den Download ausgewählt.",
   "storage_action_rename": "Umbenennen",
diff --git a/messages/en.json b/messages/en.json
index d088c75a..fb91092b 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -178,6 +178,7 @@
   "storage_paste_plural": "Paste {count} items",
   "storage_selected": "{count} selected",
   "storage_action_preview": "Preview",
+  "storage_action_refresh": "Refresh",
   "storage_action_preview_no_selection": "No file selected for preview.",
   "storage_action_download_no_selection": "No file selected for download.",
   "storage_action_rename": "Rename",
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
index 8ce2a545..b5c7f4be 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -2,6 +2,7 @@
   import IconVisibility from 'virtual:icons/material-symbols/visibility';
   import IconDownload from 'virtual:icons/material-symbols/download';
   import IconDelete from 'virtual:icons/material-symbols/delete';
+  import IconRefresh from 'virtual:icons/material-symbols/refresh';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
 
@@ -55,6 +56,18 @@
         <IconDelete class="size-3.5" aria-hidden="true" />
         {m.storage_action_delete()}
       </button>
+
+      <div class="ml-auto">
+        <button
+          class="btn btn-ghost btn-xs gap-1 text-white"
+          title={m.storage_action_refresh()}
+          onclick={() => storage.refresh()}
+          disabled={storage.loading}
+        >
+          <IconRefresh class="size-3.5" aria-hidden="true" />
+          {m.storage_action_refresh()}
+        </button>
+      </div>
     </div>
   </th>
 </tr>
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index dc17aeef..af72b3b2 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -177,6 +177,11 @@ export class StorageState {
     this._onNavigate(this.prefix, null, this.pageSize);
   };
 
+  refresh = (): void => {
+    this.loading = true;
+    void invalidateAll();
+  };
+
   onPageSizeChange = (): void => {
     this.prevTokens = [];
     this.navigateFirst();

From de1aa62c61c7a08aa408a89e6d5309925f4aedf0 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 2 Jun 2026 11:46:35 +0200
Subject: [PATCH 047/136] #127 Env Variables for Preview Limits, Recent Items,
 Page Size (#177)

* #127 add env variables for preview sizes, page sizes, row limits

* #127 add env variables for max recent files

* #127 refactor deprecated flags

* feat: add environment variable configuration for feature flags and storage preview limits

* fix(unit tests): add mock setup for public env variables

* fix: fix import path

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
---
 .env.test                                 |  7 ++++
 README.md                                 | 20 ++++++++++
 dev/setup.sh                              | 15 +++++++
 e2e/storage-s3.spec.ts                    |  2 +-
 src/lib/client/feature-flags.ts           | 48 +++++++++++++++++++++++
 src/lib/components/Pagination.svelte      |  5 ++-
 src/lib/server/feature-flags.ts           | 30 ++++++++++++++
 src/lib/server/storage/preview/parquet.ts |  6 +--
 src/lib/server/storage/preview/stream.ts  | 14 ++-----
 src/lib/storage/bookmarks.svelte.ts       |  6 +--
 src/lib/storage/persistence.ts            |  2 -
 src/lib/storage/state.svelte.ts           |  3 +-
 src/lib/types/pagination.ts               | 10 ++---
 src/routes/(app)/trino/validation.ts      |  2 +-
 src/test/setup-client.ts                  | 22 +++++++++++
 vite.config.ts                            |  3 +-
 16 files changed, 165 insertions(+), 30 deletions(-)
 create mode 100644 src/test/setup-client.ts

diff --git a/.env.test b/.env.test
index 97f83472..8939082a 100644
--- a/.env.test
+++ b/.env.test
@@ -6,6 +6,13 @@ STACKABLE_UI_BASE_URL=http://localhost:4173
 STACKABLE_UI_TRINO_URL=http://localhost:8080
 STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
 ORIGIN=http://localhost:4173
+STACKABLE_UI_TEXT_PREVIEW_BYTES=262144
+STACKABLE_UI_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_UI_PDF_PREVIEW_BYTES=26214400
+STACKABLE_UI_FILE_PREVIEW_ROWS=250
 PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_UI_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_UI_MAX_RECENT_FILES=15
 GARAGE_ADMIN_URL=http://localhost:30902
 GARAGE_ADMIN_TOKEN=stackable-ui-e2e-admin-token
diff --git a/README.md b/README.md
index 01097c3b..7afc1c62 100644
--- a/README.md
+++ b/README.md
@@ -105,6 +105,26 @@ docker build . -f docker/Dockerfile --build-arg TARGETARCH=x86 --build-arg VERSI
 docker run -p 3000:3000 stackable-ui:0.0.0-dev
 ```
 
+## Configuration
+
+The application is configured via environment variables. Create a `.env` file at the project root (or set these in your deployment environment).
+
+### Feature Flags
+
+| Variable                               | Type                             | Default | Description                                                                                                                                                             | Example                                     |
+| -------------------------------------- | -------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
+| `STACKABLE_UI_COMPLETION_ENABLED`      | `boolean` (`"false"` to disable) | `true`  | Enables the SQL editor code-completion provider and the metadata endpoint. Set to `"false"` to fall back to plain syntax highlighting.                                  | `STACKABLE_UI_COMPLETION_ENABLED=false`     |
+| `STACKABLE_UI_STORAGE_BROWSER_ENABLED` | `boolean` (`"true"` to enable)   | `false` | Shows the S3/HDFS file browser in the sidebar and activates routes under `/storage`. Must be explicitly opted in to expose storage credentials and the file-browser UI. | `STACKABLE_UI_STORAGE_BROWSER_ENABLED=true` |
+
+### Storage Preview Limits
+
+| Variable                           | Type              | Default             | Description                                                                                | Example                                     |
+| ---------------------------------- | ----------------- | ------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------- |
+| `STACKABLE_UI_TEXT_PREVIEW_BYTES`  | `integer` (bytes) | `262144` (256 KiB)  | Maximum bytes fetched when previewing text, CSV, or JSON files.                            | `STACKABLE_UI_TEXT_PREVIEW_BYTES=524288`    |
+| `STACKABLE_UI_IMAGE_PREVIEW_BYTES` | `integer` (bytes) | `5242880` (5 MiB)   | Maximum bytes fetched when previewing image files.                                         | `STACKABLE_UI_IMAGE_PREVIEW_BYTES=10485760` |
+| `STACKABLE_UI_PDF_PREVIEW_BYTES`   | `integer` (bytes) | `26214400` (25 MiB) | Maximum bytes fetched when previewing PDF files.                                           | `STACKABLE_UI_PDF_PREVIEW_BYTES=52428800`   |
+| `STACKABLE_UI_FILE_PREVIEW_ROWS`   | `integer` (rows)  | `250`               | Maximum number of rows included in a tabular file preview (e.g. Parquet converted to CSV). | `STACKABLE_UI_FILE_PREVIEW_ROWS=500`        |
+
 ## Contributing
 
 1. Make your changes
diff --git a/dev/setup.sh b/dev/setup.sh
index cc3ac9ba..2e2d2268 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -272,7 +272,14 @@ STACKABLE_UI_TRINO_AUTH_USERNAME=stackable-ui
 STACKABLE_UI_TRINO_AUTH_PASSWORD=stackable-ui-dev
 STACKABLE_UI_TRINO_TLS_INSECURE=true
 STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
+STACKABLE_UI_TEXT_PREVIEW_BYTES=262144
+STACKABLE_UI_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_UI_PDF_PREVIEW_BYTES=26214400
+STACKABLE_UI_FILE_PREVIEW_ROWS=250
 PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_UI_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_UI_MAX_RECENT_FILES=15
 EOF
 else
   cat > "$ENV_FILE" <<EOF
@@ -282,7 +289,15 @@ STACKABLE_UI_OIDC_CLIENT_SECRET=${SECRET}
 STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
 STACKABLE_UI_BASE_URL=http://localhost:5173
 STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
+STACKABLE_UI_TEXT_PREVIEW_BYTES=262144
+STACKABLE_UI_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_UI_PDF_PREVIEW_BYTES=26214400
+STACKABLE_UI_FILE_PREVIEW_ROWS=250
 PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_UI_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_UI_MAX_RECENT_FILES=15
+
 EOF
 fi
 
diff --git a/e2e/storage-s3.spec.ts b/e2e/storage-s3.spec.ts
index f7e7710d..f1d37dad 100644
--- a/e2e/storage-s3.spec.ts
+++ b/e2e/storage-s3.spec.ts
@@ -1,5 +1,5 @@
 import { test, expect } from '@playwright/test';
-import { waitForHydration } from './helpers.js';
+import { waitForHydration } from './support/helpers';
 
 declare const process: {
   env: Record<string, string | undefined>;
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index 5e77dbb1..e239b67d 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -10,3 +10,51 @@ import { env } from '$env/dynamic/public';
  *  a connection manually. */
 export const storageAutoConnectEnabled =
   (env.PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT ?? 'false') === 'true';
+
+// ── Pagination ───────────────────────────────────────────────────────────────
+
+/** Parse a comma-separated page-sizes string into a deduplicated, sorted list
+ *  of positive integers. Falls back to [25, 50, 100] when the value is absent
+ *  or produces no valid entries. */
+function parsePageSizes(raw: string | undefined): readonly number[] {
+  if (raw) {
+    const parsed = raw
+      .split(',')
+      .map((s) => parseInt(s.trim(), 10))
+      .filter((n) => Number.isFinite(n) && n > 0);
+    if (parsed.length > 0) {
+      return [...new Set(parsed)].sort((a, b) => a - b);
+    }
+  }
+  return [25, 50, 100];
+}
+
+/** The set of page sizes available in paginated list views.
+ *  Controlled by `PUBLIC_STACKABLE_UI_PAGE_SIZES` (comma-separated positive
+ *  integers, e.g. `"10,25,50,100"`). Default: `25,50,100`.
+ *  Values are deduplicated and sorted ascending. */
+export const allowedPageSizes: readonly number[] = parsePageSizes(
+  env.PUBLIC_STACKABLE_UI_PAGE_SIZES
+);
+
+/** The page size selected by default when no user preference is stored.
+ *  Controlled by `PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE`.
+ *  Must be one of the values in `allowedPageSizes`; if the configured value
+ *  is not in the allowed set it falls back to the first allowed size. */
+export const defaultPageSize: number = (() => {
+  const raw = env.PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE;
+  const parsed = parseInt(raw ?? '', 10);
+  return allowedPageSizes.includes(parsed) ? parsed : (allowedPageSizes[0] ?? 25);
+})();
+
+// ── Storage browser ──────────────────────────────────────────────────────────
+
+/** Maximum number of recently visited files and locations kept in localStorage
+ *  for the storage browser history.
+ *  Controlled by `PUBLIC_STACKABLE_UI_MAX_RECENT_FILES`. Default: 15.
+ *  Raise to retain a longer history; lower to reduce localStorage pressure on
+ *  deployments that handle many distinct objects. Must be a positive integer. */
+export const maxRecentFiles: number = (() => {
+  const parsed = parseInt(env.PUBLIC_STACKABLE_UI_MAX_RECENT_FILES ?? '', 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 15;
+})();
diff --git a/src/lib/components/Pagination.svelte b/src/lib/components/Pagination.svelte
index 5f44a114..6aad8534 100644
--- a/src/lib/components/Pagination.svelte
+++ b/src/lib/components/Pagination.svelte
@@ -5,7 +5,8 @@
   import IconLastPage from 'virtual:icons/material-symbols/last-page';
   import * as m from '$lib/paraglide/messages.js';
   import { browser } from '$app/environment';
-  import { ALLOWED_PAGE_SIZES, isPageSize, type PageSize } from '$lib/types/pagination.js';
+  import { isPageSize, type PageSize } from '$lib/types/pagination.js';
+  import { allowedPageSizes } from '$lib/client/feature-flags.js';
 
   interface Props {
     /** Bound page size — parent initialises this from `initPageSize()`. */
@@ -92,7 +93,7 @@
       value={pageSize}
       onchange={handlePageSizeChange}
     >
-      {#each ALLOWED_PAGE_SIZES as size (size)}
+      {#each allowedPageSizes as size (size)}
         <option value={size}>{size}</option>
       {/each}
     </select>
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index c10257e0..adbe05df 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -14,3 +14,33 @@ export const completionEnabled = env.STACKABLE_UI_COMPLETION_ENABLED !== 'false'
  *  active. Disabled by default — opt in explicitly to expose storage
  *  credentials and the file-browser UI. */
 export const storageBrowserEnabled = env.STACKABLE_UI_STORAGE_BROWSER_ENABLED === 'true';
+
+// ── Storage preview limits ───────────────────────────────────────────────────
+
+/** Maximum bytes fetched when streaming a text, CSV, or JSON file preview.
+ *  Controlled by `STACKABLE_UI_TEXT_PREVIEW_BYTES`. Default: 262144 (256 KiB).
+ *  Larger values allow more of a file to be visible in-browser but increase
+ *  memory pressure and response latency. */
+export const textPreviewBytes =
+  parseInt(env.STACKABLE_UI_TEXT_PREVIEW_BYTES ?? '', 10) || 256 * 1024;
+
+/** Maximum bytes fetched when streaming an image file preview.
+ *  Controlled by `STACKABLE_UI_IMAGE_PREVIEW_BYTES`. Default: 5242880 (5 MiB).
+ *  Raise for large high-resolution images; lower to reduce bandwidth on
+ *  deployments where storage egress is expensive. */
+export const imagePreviewBytes =
+  parseInt(env.STACKABLE_UI_IMAGE_PREVIEW_BYTES ?? '', 10) || 5 * 1024 * 1024;
+
+/** Maximum bytes fetched when streaming a PDF file preview.
+ *  Controlled by `STACKABLE_UI_PDF_PREVIEW_BYTES`. Default: 26214400 (25 MiB).
+ *  PDFs typically need several megabytes for the initial pages to render
+ *  correctly in the browser PDF viewer. */
+export const pdfPreviewBytes =
+  parseInt(env.STACKABLE_UI_PDF_PREVIEW_BYTES ?? '', 10) || 25 * 1024 * 1024;
+
+/** Maximum number of rows included in a file preview that is rendered as a
+ *  table (currently: Parquet files converted to CSV).
+ *  Controlled by `STACKABLE_UI_FILE_PREVIEW_ROWS`. Default: 250.
+ *  Higher values give more data context but increase server-side S3 reads
+ *  and the size of the payload sent to the browser. */
+export const filePreviewRows = parseInt(env.STACKABLE_UI_FILE_PREVIEW_ROWS ?? '', 10) || 250;
diff --git a/src/lib/server/storage/preview/parquet.ts b/src/lib/server/storage/preview/parquet.ts
index 443d06df..993b32dc 100644
--- a/src/lib/server/storage/preview/parquet.ts
+++ b/src/lib/server/storage/preview/parquet.ts
@@ -3,9 +3,7 @@ import { parquetMetadataAsync, parquetReadObjects, parquetSchema } from 'hyparqu
 import { compressors } from 'hyparquet-compressors';
 import type pino from 'pino';
 import type { StorageProvider } from '$lib/server/storage/provider.js';
-
-/** Maximum rows to include in a parquet preview. */
-const PARQUET_PREVIEW_ROWS = 250;
+import { filePreviewRows } from '$lib/server/feature-flags.js';
 
 /**
  * Override the pure-JS GZIP decompressor from hyparquet-compressors with
@@ -82,7 +80,7 @@ export async function parquetPreview(
 
   const parquetMeta = await parquetMetadataAsync(footerBuffer);
   const totalRows = Number(parquetMeta.num_rows);
-  const previewRows = Math.min(totalRows, PARQUET_PREVIEW_ROWS);
+  const previewRows = Math.min(totalRows, filePreviewRows);
   const truncated = previewRows < totalRows;
   const schema = parquetSchema(parquetMeta);
   const columnNames = schema.children.map((e) => e.element.name);
diff --git a/src/lib/server/storage/preview/stream.ts b/src/lib/server/storage/preview/stream.ts
index 6617f2ee..1da502fc 100644
--- a/src/lib/server/storage/preview/stream.ts
+++ b/src/lib/server/storage/preview/stream.ts
@@ -1,12 +1,6 @@
 import type pino from 'pino';
 import type { StorageProvider } from '$lib/server/storage/provider.js';
-
-/** Maximum bytes fetched for text-based previews (256 KiB). */
-const TEXT_PREVIEW_BYTES = 256 * 1024;
-/** Maximum bytes fetched for image previews (5 MiB). */
-const IMAGE_PREVIEW_BYTES = 5 * 1024 * 1024;
-/** Maximum bytes fetched for PDF previews (25 MiB). */
-const PDF_PREVIEW_BYTES = 25 * 1024 * 1024;
+import { textPreviewBytes, imagePreviewBytes, pdfPreviewBytes } from '$lib/server/feature-flags.js';
 
 export async function streamPreview(
   provider: StorageProvider,
@@ -18,11 +12,11 @@ export async function streamPreview(
 ): Promise<Response> {
   let limitBytes: number;
   if (contentType.startsWith('image/')) {
-    limitBytes = IMAGE_PREVIEW_BYTES;
+    limitBytes = imagePreviewBytes;
   } else if (contentType === 'application/pdf') {
-    limitBytes = PDF_PREVIEW_BYTES;
+    limitBytes = pdfPreviewBytes;
   } else {
-    limitBytes = TEXT_PREVIEW_BYTES;
+    limitBytes = textPreviewBytes;
   }
 
   const previewBytes = Math.min(totalSize, limitBytes);
diff --git a/src/lib/storage/bookmarks.svelte.ts b/src/lib/storage/bookmarks.svelte.ts
index 5116e2d3..85f574b9 100644
--- a/src/lib/storage/bookmarks.svelte.ts
+++ b/src/lib/storage/bookmarks.svelte.ts
@@ -3,10 +3,10 @@ import {
   LS_PINS,
   LS_RECENT_FILES,
   LS_RECENT_LOCATIONS,
-  MAX_RECENT,
   loadFromStorage,
   persistToStorage
 } from './persistence.js';
+import { maxRecentFiles } from '$lib/client/feature-flags.js';
 import { SvelteDate, SvelteSet } from 'svelte/reactivity';
 
 export class BookmarksState {
@@ -57,7 +57,7 @@ export class BookmarksState {
     const entry: RecentFile = { key, bucket, size, visitedAt: new SvelteDate().toISOString() };
     if (idx !== -1) this.recentFiles.splice(idx, 1);
     this.recentFiles.unshift(entry);
-    if (this.recentFiles.length > MAX_RECENT) this.recentFiles.splice(MAX_RECENT);
+    if (this.recentFiles.length > maxRecentFiles) this.recentFiles.splice(maxRecentFiles);
     persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
   }
 
@@ -67,7 +67,7 @@ export class BookmarksState {
     const entry: RecentLocation = { bucket, prefix, visitedAt: new SvelteDate().toISOString() };
     if (idx !== -1) this.recentLocations.splice(idx, 1);
     this.recentLocations.unshift(entry);
-    if (this.recentLocations.length > MAX_RECENT) this.recentLocations.splice(MAX_RECENT);
+    if (this.recentLocations.length > maxRecentFiles) this.recentLocations.splice(maxRecentFiles);
     persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
   }
 
diff --git a/src/lib/storage/persistence.ts b/src/lib/storage/persistence.ts
index 0c17b21d..d295fd7b 100644
--- a/src/lib/storage/persistence.ts
+++ b/src/lib/storage/persistence.ts
@@ -6,8 +6,6 @@ export const LS_PINS = 'pinned_storage_locations';
 export const LS_RECENT_FILES = 'recent_storage_files';
 export const LS_RECENT_LOCATIONS = 'recent_storage_locations';
 
-export const MAX_RECENT = 15;
-
 // ── Utilities ────────────────────────────────────────────────────────────────
 
 export function loadFromStorage<T>(key: string): T[] {
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index af72b3b2..c15ccc6c 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -11,6 +11,7 @@ import type {
   ActionName
 } from '$lib/storage/types.js';
 import { initPageSize, type PageSize } from '$lib/types/pagination.js';
+import { defaultPageSize } from '$lib/client/feature-flags.js';
 import { downloadObject, DownloadError } from '$lib/storage/download.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { ActionError, getActionErrorMessage } from './errors.js';
@@ -24,7 +25,7 @@ export class StorageState {
     objects: [],
     hasNextPage: false,
     currentPage: 1,
-    pageSize: 25
+    pageSize: defaultPageSize
   });
   buckets = $state<string[]>([]);
   connected = $state(false);
diff --git a/src/lib/types/pagination.ts b/src/lib/types/pagination.ts
index 618c42dc..f739217c 100644
--- a/src/lib/types/pagination.ts
+++ b/src/lib/types/pagination.ts
@@ -1,14 +1,14 @@
 import { browser } from '$app/environment';
+import { allowedPageSizes, defaultPageSize } from '$lib/client/feature-flags.js';
 
-export const ALLOWED_PAGE_SIZES = [25, 50, 100] as const;
-export type PageSize = (typeof ALLOWED_PAGE_SIZES)[number];
+export type PageSize = number;
 
 export function isPageSize(n: number): n is PageSize {
-  return (ALLOWED_PAGE_SIZES as readonly number[]).includes(n);
+  return allowedPageSizes.includes(n);
 }
 
 export function initPageSize(storageKey: string): PageSize {
-  if (!browser) return 25;
+  if (!browser) return defaultPageSize;
   const stored = parseInt(localStorage.getItem(storageKey) ?? '', 10);
-  return isPageSize(stored) ? stored : 25;
+  return isPageSize(stored) ? stored : defaultPageSize;
 }
diff --git a/src/routes/(app)/trino/validation.ts b/src/routes/(app)/trino/validation.ts
index 14480646..eda60cbe 100644
--- a/src/routes/(app)/trino/validation.ts
+++ b/src/routes/(app)/trino/validation.ts
@@ -1,6 +1,6 @@
 import { z } from 'zod';
 
-export { ALLOWED_PAGE_SIZES, isPageSize, type PageSize } from '$lib/types/pagination.js';
+export { isPageSize, type PageSize } from '$lib/types/pagination.js';
 
 export const TabIdSchema = z.uuid();
 
diff --git a/src/test/setup-client.ts b/src/test/setup-client.ts
new file mode 100644
index 00000000..4cc8f7ff
--- /dev/null
+++ b/src/test/setup-client.ts
@@ -0,0 +1,22 @@
+import { vi, beforeEach } from 'vitest';
+
+// Mock client feature flags so tests don't try to resolve the SvelteKit
+// $env/dynamic/public virtual module, which is undefined in the Vitest
+// browser environment. Values match the defaults used in production when no
+// env vars are set.
+vi.mock('$lib/client/feature-flags.js', () => ({
+  storageAutoConnectEnabled: false,
+  allowedPageSizes: [25, 50, 100],
+  defaultPageSize: 25,
+  maxRecentFiles: 15
+}));
+
+// Prevent components from auto-submitting forms in browser tests.
+// Some components call formRef.requestSubmit() after filling fields (e.g.
+// StorageConnectForm's selectConnection). Without a server to handle the
+// resulting fetch, superforms produces an unhandled rejection that the
+// Chromium test runner reports as an "Internal Error". Replace requestSubmit
+// with a no-op for the duration of each test.
+beforeEach(() => {
+  vi.spyOn(HTMLFormElement.prototype, 'requestSubmit').mockImplementation(() => {});
+});
diff --git a/vite.config.ts b/vite.config.ts
index 58711b13..3249345f 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -35,7 +35,8 @@ export default defineConfig({
             instances: [{ browser: 'chromium', headless: true }]
           },
           include: ['src/**/*.svelte.{test,spec}.{js,ts}'],
-          exclude: ['src/lib/server/**']
+          exclude: ['src/lib/server/**'],
+          setupFiles: ['src/test/setup-client.ts']
         }
       },
 

From bf13b71fce157e5aa6ba4daff7c83d5c47800233 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 2 Jun 2026 15:36:07 +0200
Subject: [PATCH 048/136] #185 move saved s3 connection from backend to
 frontend

---
 TECH_DEBT.md                                  | 14 +---
 .../storage/modals/PreviewModal.svelte        | 52 ++++++++------
 .../modals/preview/FallbackPreview.svelte     |  9 ++-
 .../preview/FallbackPreview.svelte.spec.ts    | 39 +++++-----
 .../storage/modals/upload/UploadModal.svelte  | 24 +++++--
 src/lib/server/storage/connection.ts          | 62 ++++++++++++++++
 src/lib/server/storage/service.test.ts        | 72 ++++++++-----------
 src/lib/server/storage/service.ts             | 56 +++++++--------
 .../server/storage/user-connections.test.ts   | 67 -----------------
 src/lib/server/storage/user-connections.ts    | 20 ------
 src/lib/server/storage/utils.test.ts          | 31 +++-----
 src/lib/server/storage/utils.ts               | 17 +++--
 src/lib/storage/connection-storage.ts         | 17 ++++-
 src/lib/storage/download.ts                   | 53 +++++++++-----
 src/lib/storage/state.svelte.ts               | 13 +++-
 src/lib/storage/upload.ts                     | 19 ++++-
 src/routes/(app)/storage/+layout.server.ts    | 19 ++---
 src/routes/(app)/storage/+layout.ts           | 35 +++++++++
 src/routes/(app)/storage/+page.server.ts      | 25 ++-----
 .../[bucket]/[...prefix]/+page.server.ts      | 23 +-----
 .../storage/[bucket]/[...prefix]/+page.ts     | 46 ++++++++++++
 .../[bucket]/[...prefix]/page.server.test.ts  | 59 ++++-----------
 .../(app)/storage/api/buckets/+server.ts      | 16 +++++
 .../(app)/storage/api/delete/+server.ts       | 12 ++--
 .../(app)/storage/api/delete/server.test.ts   | 12 +++-
 .../(app)/storage/api/download/+server.ts     | 22 +++---
 .../(app)/storage/api/download/server.test.ts | 10 ++-
 .../(app)/storage/api/objects/+server.ts      | 30 ++++++++
 .../(app)/storage/api/preview/+server.ts      | 23 +++---
 .../(app)/storage/api/preview/server.test.ts  | 16 +++--
 .../(app)/storage/api/upload/+server.ts       | 14 ++--
 .../(app)/storage/api/upload/server.test.ts   | 21 ++++--
 .../(app)/storage/layout.server.test.ts       | 42 +----------
 src/routes/(app)/storage/page.server.test.ts  | 23 ++----
 34 files changed, 526 insertions(+), 487 deletions(-)
 create mode 100644 src/lib/server/storage/connection.ts
 delete mode 100644 src/lib/server/storage/user-connections.test.ts
 delete mode 100644 src/lib/server/storage/user-connections.ts
 create mode 100644 src/routes/(app)/storage/+layout.ts
 create mode 100644 src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
 create mode 100644 src/routes/(app)/storage/api/buckets/+server.ts
 create mode 100644 src/routes/(app)/storage/api/objects/+server.ts

diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 1f8fb6d4..63333d51 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -30,11 +30,11 @@ S3 connection credentials (access key ID and secret access key) are persisted in
 
 ---
 
-### In-memory storage connection state
+### Download endpoint buffers entire object in browser memory
 
-**File:** `src/lib/server/storage/user-connections.ts`
+**File:** `src/lib/storage/download.ts`
 
-Per-user S3 connection configs (endpoint, region, credentials) are stored in a server-side `Map`. All connections are lost on server restart and cannot be shared across multiple replicas. Acceptable for the initial phase; mirrors the same pattern used by the Trino user-clients module. Long-term fix: persist encrypted connection configs server-side, tied to the authenticated session.
+`downloadObject` fetches the full S3 object body via the `/storage/api/download` endpoint, buffers it as a `Blob` in browser memory, then triggers a programmatic anchor click. This is simpler than streaming directly to disk but means the entire object must fit in browser memory before the save dialog appears. Acceptable for the current object sizes; for very large files (multiple GiB) this will cause memory pressure. Long-term fix: use the [File System Access API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API) `createWritable()` to stream bytes directly to disk without buffering, with a fallback to the current Blob approach for Firefox (which does not support `showSaveFilePicker`).
 
 ---
 
@@ -128,14 +128,6 @@ The dev server accepts requests from any host. This enables DNS rebinding attack
 
 ---
 
-### Upload endpoint uses in-memory S3 credentials
-
-**File:** `src/routes/(app)/storage/api/upload/+server.ts`, `src/lib/server/storage/user-connections.ts`
-
-The upload endpoint reads S3 credentials from the same per-user in-memory connection map used by download and preview. This introduces no additional security risk beyond what is already documented in the "In-memory storage connection state" entry above. Long-term fix: same as that entry — persist encrypted credentials server-side.
-
----
-
 ### No server-side file size limit on uploads (v0)
 
 **File:** `src/routes/(app)/storage/api/upload/+server.ts`
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 1b1fea02..89bdd4ac 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -13,7 +13,10 @@
   import PdfPreview from './preview/PdfPreview.svelte';
   import FallbackPreview from './preview/FallbackPreview.svelte';
   import { keyToName, formatFileSize } from '$lib/storage/utils.js';
-  import { resolve } from '$app/paths';
+  import { downloadObject, DownloadError } from '$lib/storage/download.js';
+  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+  import { addToast } from '$lib/stores/toast.svelte.js';
+  import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
 
   interface Props {
     open: boolean;
@@ -87,9 +90,14 @@
     preview = { kind: 'loading' };
     revokeBlobUrls();
 
+    const conn = loadConnectionLocally();
+    const headers: HeadersInit = conn
+      ? { [STORAGE_CONNECTION_HEADER]: getConnectionHeader(conn) }
+      : {};
+
     try {
       const params = new URLSearchParams({ bucket: bkt, key });
-      const res = await fetch(`/storage/api/preview?${params}`);
+      const res = await fetch(`/storage/api/preview?${params}`, { headers });
 
       if (!res.ok) {
         const errBody = await res.json().catch(() => ({}));
@@ -211,9 +219,22 @@
 
   const filename = $derived(objectKey ? keyToName(objectKey) : '');
 
-  function buildDownloadUrl(key: string, bkt: string): string {
-    const params = new URLSearchParams({ bucket: bkt, key });
-    return `${resolve('/storage/api/download')}?${params}`;
+  async function triggerDownload() {
+    if (!objectKey) return;
+    const conn = loadConnectionLocally();
+    if (!conn) {
+      addToast('error', m.storage_download_error_unknown());
+      return;
+    }
+    try {
+      await downloadObject(bucket, objectKey, getConnectionHeader(conn));
+    } catch (err) {
+      if (err instanceof DownloadError) {
+        addToast('error', err.message);
+      } else {
+        addToast('error', m.storage_download_error_unknown());
+      }
+    }
   }
 
   function close() {
@@ -340,8 +361,7 @@
       {:else if preview.kind === 'fallback'}
         <FallbackPreview
           contentType={preview.contentType}
-          downloadUrl={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
-          name={filename}
+          onDownload={triggerDownload}
           isBinary={preview.isBinary}
         />
       {/if}
@@ -351,25 +371,15 @@
     {#if preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'parquet' || preview.kind === 'image' || preview.kind === 'pdf'}
       <div class="border-base-300 flex shrink-0 items-center justify-end gap-2 border-t px-5 py-2">
         {#if (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
-          <a
-            href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
-            download={filename}
-            rel="external"
-            class="btn btn-ghost btn-sm gap-1.5"
-          >
+          <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
-          </a>
+          </button>
         {:else if preview.kind === 'image' || preview.kind === 'pdf'}
-          <a
-            href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
-            download={filename}
-            rel="external"
-            class="btn btn-ghost btn-sm gap-1.5"
-          >
+          <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
-          </a>
+          </button>
         {/if}
         <button class="btn btn-primary btn-sm" onclick={close}>
           {m.storage_preview_close()}
diff --git a/src/lib/components/storage/modals/preview/FallbackPreview.svelte b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
index 78751213..e37cce89 100644
--- a/src/lib/components/storage/modals/preview/FallbackPreview.svelte
+++ b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
@@ -5,13 +5,12 @@
 
   interface Props {
     contentType: string;
-    downloadUrl: string;
-    name: string;
+    onDownload: () => void;
     /** When true, the content was determined to be binary (non-displayable UTF-8). */
     isBinary?: boolean;
   }
 
-  let { contentType, downloadUrl, name, isBinary = false }: Props = $props();
+  let { contentType, onDownload, isBinary = false }: Props = $props();
 </script>
 
 <div class="flex min-h-full flex-col items-center justify-center gap-4 p-8 text-center">
@@ -27,8 +26,8 @@
       <p class="text-base-content/40 mt-1 font-mono text-xs">{contentType}</p>
     {/if}
   </div>
-  <a href={downloadUrl} download={name} rel="external" class="btn btn-primary btn-sm gap-2">
+  <button type="button" onclick={onDownload} class="btn btn-primary btn-sm gap-2">
     <IconDownload class="size-4" aria-hidden="true" />
     {m.storage_preview_download_full()}
-  </a>
+  </button>
 </div>
diff --git a/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
index 726db3b1..2002f867 100644
--- a/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
@@ -1,5 +1,5 @@
 import { page } from 'vitest/browser';
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import FallbackPreview from './FallbackPreview.svelte';
@@ -7,32 +7,28 @@ import FallbackPreview from './FallbackPreview.svelte';
 describe('FallbackPreview', () => {
   const baseProps = {
     contentType: 'application/octet-stream',
-    downloadUrl: '/download/file.bin',
-    name: 'file.bin'
+    onDownload: vi.fn()
   };
 
   it('should show unsupported title when isBinary is false', async () => {
     render(FallbackPreview, { ...baseProps, isBinary: false });
 
-    // Find the download link as a reliable anchor
-    const link = page.getByRole('link');
-    await expect.element(link).toBeInTheDocument();
-    await expect.element(link).toHaveAttribute('download', 'file.bin');
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 
   it('should show binary title when isBinary is true', async () => {
     render(FallbackPreview, { ...baseProps, isBinary: true });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toBeInTheDocument();
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 
-  it('should render download link with correct attributes', async () => {
+  it('should render a download button', async () => {
     render(FallbackPreview, { ...baseProps });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toHaveAttribute('href', '/download/file.bin');
-    await expect.element(link).toHaveAttribute('download', 'file.bin');
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 
   it('should show contentType in mono text', async () => {
@@ -49,19 +45,18 @@ describe('FallbackPreview', () => {
     await expect.element(page.getByText(mimeType)).toBeInTheDocument();
   });
 
-  it('should handle long filenames', async () => {
-    const name = `${faker.string.alphanumeric(100)}.dat`;
-    render(FallbackPreview, { ...baseProps, name });
+  it('should call onDownload when button is clicked', async () => {
+    const onDownload = vi.fn();
+    render(FallbackPreview, { ...baseProps, onDownload });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toHaveAttribute('download', name);
+    await page.getByRole('button').click();
+    expect(onDownload).toHaveBeenCalledOnce();
   });
 
   it('should handle special characters in names', async () => {
-    const name = 'file (copy) [2].bin';
-    render(FallbackPreview, { ...baseProps, name });
+    render(FallbackPreview, { ...baseProps });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toHaveAttribute('download', name);
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 });
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index 57f1ac18..0fc49279 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -8,6 +8,7 @@
   import Modal from '$lib/components/Modal.svelte';
   import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
   import { formatFileSize } from '$lib/storage/utils.js';
+  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
   import UploadDropzone from './UploadDropzone.svelte';
   import UploadConflictEntry from './UploadConflictEntry.svelte';
   import UploadEntryStatus from './UploadEntryStatus.svelte';
@@ -98,10 +99,13 @@
     if (phase !== 'selected') return;
     phase = 'checking';
 
+    const conn = loadConnectionLocally();
+    const connHeader = conn ? getConnectionHeader(conn) : '';
+
     const results = await Promise.all(
       entries.map(async (e) => {
         try {
-          return { id: e.id, conflict: await checkObjectExists(bucket, e.targetKey) };
+          return { id: e.id, conflict: await checkObjectExists(bucket, e.targetKey, connHeader) };
         } catch {
           return { id: e.id, conflict: false };
         }
@@ -150,10 +154,18 @@
     entries = entries.map((e) =>
       e.id === entry.id ? { ...e, status: 'uploading' as const, progress: 0 } : e
     );
+    const conn = loadConnectionLocally();
+    const connHeader = conn ? getConnectionHeader(conn) : '';
     try {
-      await uploadFile(bucket, key, entry.file, (pct) => {
-        entries = entries.map((e) => (e.id === entry.id ? { ...e, progress: pct } : e));
-      });
+      await uploadFile(
+        bucket,
+        key,
+        entry.file,
+        (pct) => {
+          entries = entries.map((e) => (e.id === entry.id ? { ...e, progress: pct } : e));
+        },
+        connHeader
+      );
       entries = entries.map((e) =>
         e.id === entry.id ? { ...e, status: 'done' as const, progress: 100 } : e
       );
@@ -215,8 +227,10 @@
 
     entries = entries.map((e) => (e.id === id ? { ...e, renameState: 'checking' as const } : e));
     const newKey = resolvedKey(entry);
+    const conn = loadConnectionLocally();
+    const connHeader = conn ? getConnectionHeader(conn) : '';
     try {
-      const exists = await checkObjectExists(bucket, newKey);
+      const exists = await checkObjectExists(bucket, newKey, connHeader);
       const nextState: RenameState = exists ? 'conflict' : 'ok';
       entries = entries.map((e) => (e.id === id ? { ...e, renameState: nextState } : e));
     } catch {
diff --git a/src/lib/server/storage/connection.ts b/src/lib/server/storage/connection.ts
new file mode 100644
index 00000000..21e17b4c
--- /dev/null
+++ b/src/lib/server/storage/connection.ts
@@ -0,0 +1,62 @@
+import { error } from '@sveltejs/kit';
+import { StorageConnectionSchema } from '$lib/storage/schemas.js';
+import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+import type { S3ConnectionConfig } from './types.js';
+import { logger } from '$lib/server/logging';
+
+export { STORAGE_CONNECTION_HEADER };
+
+const log = logger.child({ module: 'storage-connection' });
+
+/**
+ * Parse and validate a base64-encoded JSON connection payload from a request header value.
+ * Throws a 400 HTTP error if the payload is malformed or fails schema validation.
+ * Throws a 400 HTTP error if the connection type is not 's3'.
+ */
+function parseConnectionPayload(raw: string): S3ConnectionConfig {
+  let data: unknown;
+  try {
+    data = JSON.parse(atob(raw));
+  } catch {
+    throw error(400, 'Invalid storage connection header');
+  }
+
+  const parsed = StorageConnectionSchema.safeParse(data);
+  if (!parsed.success) {
+    log.debug({ issues: parsed.error.issues }, 'storage connection header validation failed');
+    throw error(400, 'Invalid storage connection configuration');
+  }
+
+  if (parsed.data.type !== 's3') {
+    throw error(400, 'Storage backend not supported');
+  }
+
+  return {
+    type: 's3',
+    endpoint: parsed.data.endpoint || undefined,
+    pathStyle: parsed.data.pathStyle,
+    region: parsed.data.region,
+    accessKeyId: parsed.data.accessKeyId || undefined,
+    secretAccessKey: parsed.data.secretAccessKey || undefined
+  };
+}
+
+/**
+ * Extract the storage connection config from the `X-Storage-Connection` request header.
+ * Returns `null` if the header is absent. Throws on malformed or invalid payloads.
+ */
+export function getConnectionFromHeader(request: Request): S3ConnectionConfig | null {
+  const header = request.headers.get(STORAGE_CONNECTION_HEADER);
+  if (!header) return null;
+  return parseConnectionPayload(header);
+}
+
+/**
+ * Extract the storage connection config from the `X-Storage-Connection` request header.
+ * Throws a 401 HTTP error if the header is absent.
+ */
+export function requireConnection(request: Request): S3ConnectionConfig {
+  const conn = getConnectionFromHeader(request);
+  if (!conn) throw error(401, 'No storage connection configured');
+  return conn;
+}
diff --git a/src/lib/server/storage/service.test.ts b/src/lib/server/storage/service.test.ts
index 60f59388..fa4be91f 100644
--- a/src/lib/server/storage/service.test.ts
+++ b/src/lib/server/storage/service.test.ts
@@ -6,15 +6,6 @@ vi.mock('$lib/server/logging', () => ({
   logger: { child: () => ({ info: vi.fn(), debug: vi.fn(), warn: vi.fn() }) }
 }));
 
-const mockGetUserConnection = vi.fn();
-const mockSetUserConnection = vi.fn();
-const mockClearUserConnection = vi.fn();
-vi.mock('./user-connections.js', () => ({
-  getUserConnection: (...args: unknown[]) => mockGetUserConnection(...args),
-  setUserConnection: (...args: unknown[]) => mockSetUserConnection(...args),
-  clearUserConnection: (...args: unknown[]) => mockClearUserConnection(...args)
-}));
-
 const mockSend = vi.fn();
 vi.mock('./s3-client.js', () => ({
   createS3Client: () => ({ send: (...args: unknown[]) => mockSend(...args) })
@@ -31,7 +22,7 @@ const mockProvider = {
   listAllKeys: vi.fn()
 };
 vi.mock('./utils.js', () => ({
-  getProviderForUser: () => mockProvider
+  getProvider: () => mockProvider
 }));
 
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -54,36 +45,32 @@ import {
   uploadObject,
   deleteObjects
 } from './service.js';
+import type { S3ConnectionConfig } from './types.js';
 
-describe('storage service', () => {
-  const userId = faker.string.uuid();
+const config: S3ConnectionConfig = {
+  type: 's3',
+  region: faker.location.countryCode()
+};
 
+describe('storage service', () => {
   beforeEach(() => {
     vi.clearAllMocks();
   });
 
   describe('listBuckets', () => {
-    it('returns empty array when no connection', async () => {
-      mockGetUserConnection.mockReturnValue(null);
-      expect(await listBuckets(userId)).toEqual([]);
-    });
-
     it('returns bucket names', async () => {
-      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
       mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: 'b' }] });
-      expect(await listBuckets(userId)).toEqual(['a', 'b']);
+      expect(await listBuckets(config)).toEqual(['a', 'b']);
     });
 
     it('filters out buckets with no name', async () => {
-      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
       mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: undefined }, { Name: '' }] });
-      expect(await listBuckets(userId)).toEqual(['a']);
+      expect(await listBuckets(config)).toEqual(['a']);
     });
 
     it('handles null Buckets in response', async () => {
-      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
       mockSend.mockResolvedValue({ Buckets: null });
-      expect(await listBuckets(userId)).toEqual([]);
+      expect(await listBuckets(config)).toEqual([]);
     });
   });
 
@@ -91,7 +78,7 @@ describe('storage service', () => {
     it('proxies to provider', async () => {
       const page = { objects: [], prefixes: [], nextToken: null };
       mockProvider.listObjects.mockResolvedValue(page);
-      const result = await listObjects(userId, 'bucket', 'prefix/', 100);
+      const result = await listObjects(config, 'bucket', 'prefix/', 100);
       expect(mockProvider.listObjects).toHaveBeenCalledWith('prefix/', 100, undefined);
       expect(result).toEqual(page);
     });
@@ -99,21 +86,21 @@ describe('storage service', () => {
     it('passes continuation token when provided', async () => {
       const page = { objects: [], prefixes: [], nextToken: null };
       mockProvider.listObjects.mockResolvedValue(page);
-      await listObjects(userId, 'bucket', '', 10, 'tok');
+      await listObjects(config, 'bucket', '', 10, 'tok');
       expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, 'tok');
     });
 
     it('passes undefined when continuation token is null', async () => {
       const page = { objects: [], prefixes: [], nextToken: null };
       mockProvider.listObjects.mockResolvedValue(page);
-      await listObjects(userId, 'bucket', '', 10, null);
+      await listObjects(config, 'bucket', '', 10, null);
       expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, undefined);
     });
 
     it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
       const err = makeS3Error('AccessDenied');
       mockProvider.listObjects.mockRejectedValue(err);
-      await expect(listObjects(userId, 'bucket', '', 10)).rejects.toThrow(err);
+      await expect(listObjects(config, 'bucket', '', 10)).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         operation: 'listObjects'
@@ -123,7 +110,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('network');
       mockProvider.listObjects.mockRejectedValue(err);
-      await expect(listObjects(userId, 'bucket', '', 10)).rejects.toThrow('network');
+      await expect(listObjects(config, 'bucket', '', 10)).rejects.toThrow('network');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
@@ -132,14 +119,14 @@ describe('storage service', () => {
     it('returns download from provider', async () => {
       const download = { stream: new ReadableStream(), contentType: 'text/plain' };
       mockProvider.getObject.mockResolvedValue(download);
-      const result = await downloadObject(userId, 'bucket', 'key.txt');
+      const result = await downloadObject(config, 'bucket', 'key.txt');
       expect(result).toEqual(download);
     });
 
     it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
       const err = makeS3Error('NoSuchKey');
       mockProvider.getObject.mockRejectedValue(err);
-      await expect(downloadObject(userId, 'bucket', 'key.txt')).rejects.toThrow(err);
+      await expect(downloadObject(config, 'bucket', 'key.txt')).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         key: 'key.txt',
@@ -150,7 +137,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('timeout');
       mockProvider.getObject.mockRejectedValue(err);
-      await expect(downloadObject(userId, 'bucket', 'k')).rejects.toThrow('timeout');
+      await expect(downloadObject(config, 'bucket', 'k')).rejects.toThrow('timeout');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
@@ -159,13 +146,13 @@ describe('storage service', () => {
     it('proxies to provider', async () => {
       const meta = { contentType: 'text/plain', contentLength: 42 };
       mockProvider.getMetadata.mockResolvedValue(meta);
-      expect(await getObjectMetadata(userId, 'bucket', 'k')).toEqual(meta);
+      expect(await getObjectMetadata(config, 'bucket', 'k')).toEqual(meta);
     });
 
     it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
       const err = makeS3Error('NoSuchKey');
       mockProvider.getMetadata.mockRejectedValue(err);
-      await expect(getObjectMetadata(userId, 'bucket', 'k')).rejects.toThrow(err);
+      await expect(getObjectMetadata(config, 'bucket', 'k')).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         key: 'k',
@@ -176,7 +163,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('gone');
       mockProvider.getMetadata.mockRejectedValue(err);
-      await expect(getObjectMetadata(userId, 'bucket', 'k')).rejects.toThrow('gone');
+      await expect(getObjectMetadata(config, 'bucket', 'k')).rejects.toThrow('gone');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
@@ -184,7 +171,7 @@ describe('storage service', () => {
   describe('uploadObject', () => {
     it('proxies to provider', async () => {
       mockProvider.putObject.mockResolvedValue(undefined);
-      await uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain', 1);
+      await uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain', 1);
       expect(mockProvider.putObject).toHaveBeenCalledWith('k', expect.any(Buffer), 'text/plain', 1);
     });
 
@@ -192,7 +179,7 @@ describe('storage service', () => {
       const err = makeS3Error('AccessDenied');
       mockProvider.putObject.mockRejectedValue(err);
       await expect(
-        uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain')
+        uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain')
       ).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
@@ -205,7 +192,7 @@ describe('storage service', () => {
       const err = new Error('disk full');
       mockProvider.putObject.mockRejectedValue(err);
       await expect(
-        uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain')
+        uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain')
       ).rejects.toThrow('disk full');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
@@ -215,7 +202,7 @@ describe('storage service', () => {
     it('expands directory prefixes and deletes all', async () => {
       mockProvider.listAllKeys.mockResolvedValue(['dir/a.txt', 'dir/b.txt']);
       mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      const result = await deleteObjects(userId, 'bucket', ['file.txt', 'dir/']);
+      const result = await deleteObjects(config, 'bucket', ['file.txt', 'dir/']);
       expect(mockProvider.listAllKeys).toHaveBeenCalledWith('dir/');
       expect(mockProvider.deleteObjects).toHaveBeenCalledWith([
         'file.txt',
@@ -228,15 +215,14 @@ describe('storage service', () => {
     it('uses directory key itself when no children found', async () => {
       mockProvider.listAllKeys.mockResolvedValue([]);
       mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      await deleteObjects(userId, 'bucket', ['empty/']);
+      await deleteObjects(config, 'bucket', ['empty/']);
       expect(mockProvider.deleteObjects).toHaveBeenCalledWith(['empty/']);
     });
 
     it('returns empty result for no keys', async () => {
-      // No file keys, no dir prefixes after expansion
       mockProvider.listAllKeys.mockResolvedValue([]);
       mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      const result = await deleteObjects(userId, 'bucket', []);
+      const result = await deleteObjects(config, 'bucket', []);
       expect(result).toEqual({ failed: [] });
     });
 
@@ -244,7 +230,7 @@ describe('storage service', () => {
       const err = makeS3Error('AccessDenied');
       mockProvider.listAllKeys.mockResolvedValue([]);
       mockProvider.deleteObjects.mockRejectedValue(err);
-      await expect(deleteObjects(userId, 'bucket', ['file.txt'])).rejects.toThrow(err);
+      await expect(deleteObjects(config, 'bucket', ['file.txt'])).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         operation: 'deleteObjects'
@@ -254,7 +240,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('network');
       mockProvider.deleteObjects.mockRejectedValue(err);
-      await expect(deleteObjects(userId, 'bucket', ['file.txt'])).rejects.toThrow('network');
+      await expect(deleteObjects(config, 'bucket', ['file.txt'])).rejects.toThrow('network');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index c4550e94..c27b6532 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -1,40 +1,33 @@
 import { S3ServiceException, ListBucketsCommand } from '@aws-sdk/client-s3';
-import { getUserConnection, setUserConnection, clearUserConnection } from './user-connections.js';
 import { createS3Client } from './s3-client.js';
 import { mapS3ErrorToHttp } from './s3-errors.js';
-import { getProviderForUser } from './utils.js';
+import { getProvider } from './utils.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 import type { ObjectDownload, DeleteObjectsResult } from './provider.js';
+import type { S3ConnectionConfig } from './types.js';
 import { logger } from '$lib/server/logging';
 
 const log = logger.child({ module: 'storage-service' });
 
-export { getUserConnection as getConnection };
-export { setUserConnection as saveConnection };
-export { clearUserConnection as clearConnection };
-
-/** List all buckets accessible with the user's current connection. Returns [] when not connected. */
-export async function listBuckets(userId: string): Promise<string[]> {
-  const config = getUserConnection(userId);
-  if (!config) return [];
-
+/** List all buckets accessible with the given connection config. */
+export async function listBuckets(config: S3ConnectionConfig): Promise<string[]> {
   const client = createS3Client(config);
 
   const output = await client.send(new ListBucketsCommand({}));
   const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
-  log.debug({ user_id: userId, bucket_count: buckets.length }, 'listed buckets');
+  log.debug({ storage_type: config.type, bucket_count: buckets.length }, 'listed buckets');
   return buckets;
 }
 
-/** List objects at the given bucket/prefix for the user's current connection. Throws on S3 errors. */
+/** List objects at the given bucket/prefix. Throws on S3 errors. */
 export async function listObjects(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   prefix: string,
   pageSize: number,
   continuationToken?: string | null
 ): Promise<StoragePage> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
     return await provider.listObjects(prefix, pageSize, continuationToken ?? undefined);
@@ -45,18 +38,19 @@ export async function listObjects(
     throw err;
   }
 }
+
 /** Download a single object from the bucket, returning a stream and metadata for the HTTP response. */
 export async function downloadObject(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   key: string
 ): Promise<ObjectDownload> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
-    log.debug({ user_id: userId, bucket, key }, 'downloading object');
+    log.debug({ bucket, key }, 'downloading object');
     const download = await provider.getObject(key);
-    log.info({ user_id: userId, bucket, key }, 'object download started');
+    log.info({ bucket, key }, 'object download started');
     return download;
   } catch (err) {
     if (err instanceof S3ServiceException) {
@@ -68,14 +62,14 @@ export async function downloadObject(
 
 /** Fetch metadata for a single object — used for lightweight pre-flight checks. */
 export async function getObjectMetadata(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   key: string
 ): Promise<StorageMetadata> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
-    log.debug({ user_id: userId, bucket, key }, 'getting object metadata');
+    log.debug({ bucket, key }, 'getting object metadata');
     return await provider.getMetadata(key);
   } catch (err) {
     if (err instanceof S3ServiceException) {
@@ -87,20 +81,20 @@ export async function getObjectMetadata(
 
 /** Upload an object to the bucket, using multipart upload for large files. */
 export async function uploadObject(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   key: string,
   body: ReadableStream | Buffer,
   contentType: string,
   contentLength?: number
 ): Promise<void> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
-    log.debug({ user_id: userId, bucket, key, content_type: contentType }, 'uploading object');
+    log.debug({ bucket, key, content_type: contentType }, 'uploading object');
     await provider.putObject(key, body, contentType, contentLength);
     log.info(
-      { user_id: userId, bucket, key, content_type: contentType, content_length: contentLength },
+      { bucket, key, content_type: contentType, content_length: contentLength },
       'object uploaded'
     );
   } catch (err) {
@@ -114,11 +108,11 @@ export async function uploadObject(
 /** Delete one or more objects from the bucket. Returns a result listing any keys that failed.
  *  Directory keys (ending with '/') are expanded to all contained objects before deletion. */
 export async function deleteObjects(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   keys: string[]
 ): Promise<DeleteObjectsResult> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
     // Expand any directory prefixes (keys ending with '/') to their contents.
@@ -127,7 +121,7 @@ export async function deleteObjects(
 
     let allKeys = [...fileKeys];
     for (const prefix of dirPrefixes) {
-      log.debug({ user_id: userId, bucket, prefix }, 'expanding directory prefix for deletion');
+      log.debug({ bucket, prefix }, 'expanding directory prefix for deletion');
       const children = await provider.listAllKeys(prefix);
       allKeys = allKeys.concat(children.length > 0 ? children : [prefix]);
     }
@@ -136,10 +130,10 @@ export async function deleteObjects(
       return { failed: [] };
     }
 
-    log.debug({ user_id: userId, bucket, key_count: allKeys.length }, 'deleting objects');
+    log.debug({ bucket, key_count: allKeys.length }, 'deleting objects');
     const result = await provider.deleteObjects(allKeys);
     log.info(
-      { user_id: userId, bucket, key_count: allKeys.length, failed_count: result.failed.length },
+      { bucket, key_count: allKeys.length, failed_count: result.failed.length },
       'objects delete completed'
     );
     return result;
diff --git a/src/lib/server/storage/user-connections.test.ts b/src/lib/server/storage/user-connections.test.ts
deleted file mode 100644
index 68e9ac66..00000000
--- a/src/lib/server/storage/user-connections.test.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { faker } from '@faker-js/faker';
-import { setUserConnection, getUserConnection, clearUserConnection } from './user-connections.js';
-import type { S3ConnectionConfig } from './types.js';
-
-vi.mock('$lib/server/logging', () => ({
-  logger: { child: () => ({ info: vi.fn(), debug: vi.fn() }) }
-}));
-
-function makeConfig(): S3ConnectionConfig {
-  return {
-    type: 's3',
-    region: faker.location.countryCode(),
-    endpoint: faker.internet.url(),
-    accessKeyId: faker.string.alphanumeric(20),
-    secretAccessKey: faker.string.alphanumeric(40)
-  };
-}
-
-describe('user-connections', () => {
-  const userId = faker.string.uuid();
-
-  beforeEach(() => {
-    clearUserConnection(userId);
-  });
-
-  it('returns null for unknown user', () => {
-    expect(getUserConnection(faker.string.uuid())).toBeNull();
-  });
-
-  it('stores and retrieves a connection', () => {
-    const config = makeConfig();
-    setUserConnection(userId, config);
-    expect(getUserConnection(userId)).toEqual(config);
-  });
-
-  it('overwrites existing connection', () => {
-    setUserConnection(userId, makeConfig());
-    const newConfig = makeConfig();
-    setUserConnection(userId, newConfig);
-    expect(getUserConnection(userId)).toEqual(newConfig);
-  });
-
-  it('clears a connection', () => {
-    setUserConnection(userId, makeConfig());
-    clearUserConnection(userId);
-    expect(getUserConnection(userId)).toBeNull();
-  });
-
-  it('clearing non-existent user does not throw', () => {
-    expect(() => clearUserConnection(faker.string.uuid())).not.toThrow();
-  });
-
-  it('supports multiple users independently', () => {
-    const user1 = faker.string.uuid();
-    const user2 = faker.string.uuid();
-    const config1 = makeConfig();
-    const config2 = makeConfig();
-    setUserConnection(user1, config1);
-    setUserConnection(user2, config2);
-    expect(getUserConnection(user1)).toEqual(config1);
-    expect(getUserConnection(user2)).toEqual(config2);
-    clearUserConnection(user1);
-    expect(getUserConnection(user1)).toBeNull();
-    expect(getUserConnection(user2)).toEqual(config2);
-  });
-});
diff --git a/src/lib/server/storage/user-connections.ts b/src/lib/server/storage/user-connections.ts
deleted file mode 100644
index bcfa9835..00000000
--- a/src/lib/server/storage/user-connections.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import type { S3ConnectionConfig } from './types.js';
-import { logger } from '$lib/server/logging';
-
-const log = logger.child({ module: 'storage-user-connections' });
-
-const userConnections = new Map<string, S3ConnectionConfig>();
-
-export function setUserConnection(userId: string, config: S3ConnectionConfig): void {
-  userConnections.set(userId, config);
-  log.info({ user_id: userId, storage_type: config.type }, 'user storage connection saved');
-}
-
-export function getUserConnection(userId: string): S3ConnectionConfig | null {
-  return userConnections.get(userId) ?? null;
-}
-
-export function clearUserConnection(userId: string): void {
-  userConnections.delete(userId);
-  log.info({ user_id: userId }, 'user storage connection cleared');
-}
diff --git a/src/lib/server/storage/utils.test.ts b/src/lib/server/storage/utils.test.ts
index 55a3a061..b83bfb17 100644
--- a/src/lib/server/storage/utils.test.ts
+++ b/src/lib/server/storage/utils.test.ts
@@ -1,42 +1,29 @@
 import { describe, it, expect, vi } from 'vitest';
-import { faker } from '@faker-js/faker';
 
 vi.mock('$lib/server/logging', () => ({
   logger: { child: () => ({ info: vi.fn(), debug: vi.fn() }) }
 }));
 
-const mockGetUserConnection = vi.fn();
-vi.mock('./user-connections.js', () => ({
-  getUserConnection: (...args: unknown[]) => mockGetUserConnection(...args)
-}));
-
 const mockCreate = vi.fn().mockReturnValue({ listObjects: vi.fn() });
 vi.mock('./factory.js', () => ({
   StorageProviderFactory: { create: (...args: unknown[]) => mockCreate(...args) }
 }));
 
-import { getProviderForUser } from './utils.js';
+import { getProvider } from './utils.js';
+import type { S3ConnectionConfig } from './types.js';
 
-describe('getProviderForUser', () => {
-  it('throws 401 when no connection exists', () => {
-    mockGetUserConnection.mockReturnValue(null);
-    expect(() => getProviderForUser(faker.string.uuid(), 'bucket')).toThrow(
-      expect.objectContaining({ status: 401 })
-    );
-  });
+const s3Config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
 
+describe('getProvider', () => {
   it('throws 400 for non-s3 connection type', () => {
-    mockGetUserConnection.mockReturnValue({ type: 'hdfs', nameNode: 'nn', port: 9870, user: 'u' });
-    expect(() => getProviderForUser(faker.string.uuid(), 'bucket')).toThrow(
-      expect.objectContaining({ status: 400 })
-    );
+    expect(() =>
+      getProvider({ type: 'hdfs', nameNode: 'nn', port: 9870, user: 'u' } as never, 'bucket')
+    ).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('returns provider for valid s3 connection', () => {
-    const config = { type: 's3', region: 'us-east-1' };
-    mockGetUserConnection.mockReturnValue(config);
-    const provider = getProviderForUser('user1', 'my-bucket');
-    expect(mockCreate).toHaveBeenCalledWith({ ...config, bucket: 'my-bucket' });
+    const provider = getProvider(s3Config, 'my-bucket');
+    expect(mockCreate).toHaveBeenCalledWith({ ...s3Config, bucket: 'my-bucket' });
     expect(provider).toBeDefined();
   });
 });
diff --git a/src/lib/server/storage/utils.ts b/src/lib/server/storage/utils.ts
index c98a0d2c..a0ab2223 100644
--- a/src/lib/server/storage/utils.ts
+++ b/src/lib/server/storage/utils.ts
@@ -1,17 +1,16 @@
 import { error } from '@sveltejs/kit';
-import { getUserConnection } from './user-connections.js';
 import { StorageProviderFactory } from './factory.js';
 import type { StorageProvider } from './provider.js';
+import type { S3ConnectionConfig } from './types.js';
 
-export function getProviderForUser(userId: string, bucket: string): StorageProvider {
-  const connection = getUserConnection(userId);
-  if (!connection) {
-    throw error(401, 'No storage connection configured');
-  }
-
-  if (connection.type !== 's3') {
+/**
+ * Construct a bucket-scoped storage provider from the given connection config.
+ * Throws a 400 HTTP error if the connection type is not supported.
+ */
+export function getProvider(config: S3ConnectionConfig, bucket: string): StorageProvider {
+  if (config.type !== 's3') {
     throw error(400, 'Storage backend not supported');
   }
 
-  return StorageProviderFactory.create({ ...connection, bucket });
+  return StorageProviderFactory.create({ ...config, bucket });
 }
diff --git a/src/lib/storage/connection-storage.ts b/src/lib/storage/connection-storage.ts
index 9bf1f3ea..bf868931 100644
--- a/src/lib/storage/connection-storage.ts
+++ b/src/lib/storage/connection-storage.ts
@@ -1,7 +1,14 @@
 import type { z } from 'zod';
 import type { StorageConnectionSchema } from './schemas.js';
 
-type StoredConnection = z.infer<typeof StorageConnectionSchema>;
+export type StoredConnection = z.infer<typeof StorageConnectionSchema>;
+
+/**
+ * HTTP header name used to pass the S3 connection config from the browser to
+ * the backend API endpoints. Defined here (client-safe module) so both client
+ * and server code can import it without leaking server-only code to the browser.
+ */
+export const STORAGE_CONNECTION_HEADER = 'x-storage-connection';
 
 const STORAGE_KEY = 'stackable_storage_connections';
 
@@ -62,3 +69,11 @@ export function removeConnectionLocally(data: StoredConnection): void {
     // localStorage may be unavailable
   }
 }
+
+/**
+ * Encode a connection config as a base64 JSON string suitable for the
+ * `X-Storage-Connection` request header sent to the backend.
+ */
+export function getConnectionHeader(connection: StoredConnection): string {
+  return btoa(JSON.stringify(connection));
+}
diff --git a/src/lib/storage/download.ts b/src/lib/storage/download.ts
index 7f7ad963..ef447a63 100644
--- a/src/lib/storage/download.ts
+++ b/src/lib/storage/download.ts
@@ -2,15 +2,21 @@
  * Client-side utility for downloading a single S3 object via the server proxy.
  *
  * Strategy:
- *  1. Send a HEAD request to validate credentials and access rights without
- *     transferring the object body (server uses HeadObject internally).
+ *  1. Fetch the object with the `X-Storage-Connection` header carrying the
+ *     connection config from localStorage.
  *  2. On error: throw a `DownloadError` with a typed `code` so the caller can
  *     display a localised message.
- *  3. On success: trigger a native browser download via a programmatic anchor
- *     click. The browser streams the object directly to disk — no client-side
- *     buffering occurs regardless of file size.
+ *  3. On success: create a Blob URL and trigger a native browser download via a
+ *     programmatic anchor click.
+ *
+ * Note: The response body is buffered as a Blob before the download link is
+ * constructed. This avoids exposing credentials in the URL (query-param approach)
+ * while keeping the implementation simple. For very large files this will use
+ * proportional browser memory — see TECH_DEBT.md for the long-term fix.
  */
 
+import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+
 export type DownloadErrorCode =
   | 'not_connected'
   | 'access_denied'
@@ -43,33 +49,42 @@ function mapStatusToCode(status: number): DownloadErrorCode {
 /**
  * Download a single S3 object.
  *
- * Performs a HEAD pre-flight to surface auth and access errors as typed
- * `DownloadError` exceptions, then triggers a native browser download for
- * the actual transfer so the file streams straight to disk.
+ * Fetches the object with the connection config header, buffers it as a Blob,
+ * then triggers a native browser download via a programmatic anchor click.
  *
- * @throws {DownloadError} when the server returns a non-2xx response on the
- *   pre-flight check.
+ * @throws {DownloadError} when the server returns a non-2xx response.
  */
-export async function downloadObject(bucket: string, key: string): Promise<void> {
+export async function downloadObject(
+  bucket: string,
+  key: string,
+  connectionHeader: string
+): Promise<void> {
   const url = buildDownloadUrl(bucket, key);
 
-  // Pre-flight: validate credentials and access without fetching the body.
-  const check = await fetch(url, { method: 'HEAD' });
-  if (!check.ok) {
-    const code = mapStatusToCode(check.status);
-    throw new DownloadError(code, `Download pre-flight failed with status ${check.status}`);
+  const response = await fetch(url, {
+    headers: { [STORAGE_CONNECTION_HEADER]: connectionHeader }
+  });
+
+  if (!response.ok) {
+    const code = mapStatusToCode(response.status);
+    throw new DownloadError(code, `Download failed with status ${response.status}`);
   }
 
+  const blob = await response.blob();
+  const blobUrl = URL.createObjectURL(blob);
+
   // Derive filename from the key (last path segment).
   const filename = key.split('/').filter(Boolean).pop() ?? key;
 
-  // Trigger a native browser download. The browser sends the session cookie
-  // automatically and streams the response body directly to disk.
   const anchor = document.createElement('a');
-  anchor.href = url;
+  anchor.href = blobUrl;
   anchor.download = filename;
   anchor.style.display = 'none';
   document.body.appendChild(anchor);
   anchor.click();
   document.body.removeChild(anchor);
+
+  // Release the object URL after a short delay to allow the browser to initiate
+  // the download before the URL is revoked.
+  setTimeout(() => URL.revokeObjectURL(blobUrl), 10_000);
 }
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index c15ccc6c..e3f8eb49 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -16,6 +16,7 @@ import { downloadObject, DownloadError } from '$lib/storage/download.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { ActionError, getActionErrorMessage } from './errors.js';
 import { BookmarksState } from './bookmarks.svelte.js';
+import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 
 export class StorageState {
   // ── Core data (synced from server load) ──
@@ -269,7 +270,12 @@ export class StorageState {
           this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
         }
         try {
-          await downloadObject(this.bucket, key);
+          const conn = loadConnectionLocally();
+          if (!conn) {
+            addToast('error', m.storage_download_error_unknown());
+            return;
+          }
+          await downloadObject(this.bucket, key, getConnectionHeader(conn));
         } catch (err: unknown) {
           if (err instanceof DownloadError) {
             addToast('error', getActionErrorMessage(new ActionError(err.code, err.message)));
@@ -357,7 +363,10 @@ export class StorageState {
     const params = new SvelteURLSearchParams({ bucket });
     for (const key of keys) params.append('keys', key);
 
-    const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE' });
+    const conn = loadConnectionLocally();
+    const headers: HeadersInit = conn ? { 'x-storage-connection': getConnectionHeader(conn) } : {};
+
+    const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE', headers });
     if (!res.ok) {
       let code: string;
       if (res.status === 401) code = 'not_connected';
diff --git a/src/lib/storage/upload.ts b/src/lib/storage/upload.ts
index 8865b144..0f366405 100644
--- a/src/lib/storage/upload.ts
+++ b/src/lib/storage/upload.ts
@@ -9,8 +9,12 @@
  *   supported in Firefox.
  * - The file is sent as the raw request body — no base64 or multipart encoding.
  *   The server streams it directly to S3, preserving binary integrity.
+ * - The connection config is passed via the `X-Storage-Connection` header
+ *   (base64-encoded JSON), read by the server from the client's localStorage.
  */
 
+import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+
 export type UploadErrorCode =
   | 'not_connected'
   | 'access_denied'
@@ -53,9 +57,16 @@ function mapStatusToUploadCode(status: number): UploadErrorCode {
  * so no object body is transferred. Returns `true` if the object exists, `false`
  * if it does not. Throws `UploadError` for auth or server errors.
  */
-export async function checkObjectExists(bucket: string, key: string): Promise<boolean> {
+export async function checkObjectExists(
+  bucket: string,
+  key: string,
+  connectionHeader: string
+): Promise<boolean> {
   const url = buildDownloadUrl(bucket, key);
-  const res = await fetch(url, { method: 'HEAD' });
+  const res = await fetch(url, {
+    method: 'HEAD',
+    headers: { [STORAGE_CONNECTION_HEADER]: connectionHeader }
+  });
   if (res.status === 200) return true;
   if (res.status === 404) return false;
   if (res.status === 401) throw new UploadError('not_connected', 'Not connected');
@@ -77,7 +88,8 @@ export function uploadFile(
   bucket: string,
   key: string,
   file: File,
-  onProgress: (pct: number) => void
+  onProgress: (pct: number) => void,
+  connectionHeader: string
 ): Promise<void> {
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest();
@@ -109,6 +121,7 @@ export function uploadFile(
 
     xhr.open('POST', url);
     xhr.setRequestHeader('Content-Type', file.type || 'application/octet-stream');
+    xhr.setRequestHeader(STORAGE_CONNECTION_HEADER, connectionHeader);
     xhr.send(file);
   });
 }
diff --git a/src/routes/(app)/storage/+layout.server.ts b/src/routes/(app)/storage/+layout.server.ts
index ce04ed41..17175c59 100644
--- a/src/routes/(app)/storage/+layout.server.ts
+++ b/src/routes/(app)/storage/+layout.server.ts
@@ -1,7 +1,5 @@
 import type { LayoutServerLoad } from './$types';
 import { error } from '@sveltejs/kit';
-import { getConnection, listBuckets } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
 import { storageBrowserEnabled } from '$lib/server/feature-flags.js';
 
 export const load: LayoutServerLoad = async ({ locals }) => {
@@ -9,18 +7,9 @@ export const load: LayoutServerLoad = async ({ locals }) => {
     throw error(404, 'Not found');
   }
 
-  const userId = getUserId(locals);
-  const connection = getConnection(userId);
+  locals.logger.debug('loading storage layout');
 
-  if (!connection) {
-    return { connected: false, buckets: [] as string[], connectionType: null };
-  }
-
-  try {
-    const buckets = await listBuckets(userId);
-    return { connected: true, buckets, connectionType: connection.type };
-  } catch (err) {
-    locals.logger.warn({ err }, 'failed to list buckets for storage layout');
-    return { connected: true, buckets: [] as string[], connectionType: connection.type };
-  }
+  // Connected state and bucket list are determined client-side from localStorage
+  // and populated by the universal +layout.ts load after hydration.
+  return { connected: false, buckets: [] as string[], connectionType: null };
 };
diff --git a/src/routes/(app)/storage/+layout.ts b/src/routes/(app)/storage/+layout.ts
new file mode 100644
index 00000000..4b4c5e10
--- /dev/null
+++ b/src/routes/(app)/storage/+layout.ts
@@ -0,0 +1,35 @@
+import { browser } from '$app/environment';
+import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import type { LayoutLoad } from './$types';
+
+const DISCONNECTED = { connected: false, buckets: [] as string[], connectionType: null };
+
+/**
+ * Client-side load: reads the connection from localStorage and fetches the bucket
+ * list from the server. During SSR this returns the disconnected default — the
+ * layout re-runs on the client after hydration to populate the real state.
+ */
+export const load: LayoutLoad = async ({ fetch, url }) => {
+  if (!browser) return DISCONNECTED;
+
+  // When the user has just explicitly disconnected, skip the auto-reconnect.
+  if (url.searchParams.has('disconnected')) return DISCONNECTED;
+
+  const connection = loadConnectionLocally();
+  if (!connection) return DISCONNECTED;
+
+  const header = getConnectionHeader(connection);
+
+  try {
+    const res = await fetch('/storage/api/buckets', {
+      headers: { 'x-storage-connection': header }
+    });
+
+    if (!res.ok) return DISCONNECTED;
+
+    const buckets = (await res.json()) as string[];
+    return { connected: true, buckets, connectionType: connection.type };
+  } catch {
+    return DISCONNECTED;
+  }
+};
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 48fdd74d..b383aec3 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -3,21 +3,13 @@ import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
 import { StorageConnectionSchema } from '$lib/storage/schemas.js';
-import { getUserId } from '$lib/server/auth-utils.js';
-import {
-  getConnection,
-  saveConnection,
-  clearConnection,
-  listBuckets
-} from '$lib/server/storage/service.js';
+import { listBuckets } from '$lib/server/storage/service.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
   const connectionForm = await superValidate(zod(StorageConnectionSchema));
-  const userId = getUserId(locals);
-  const connected = getConnection(userId) !== null;
-  locals.logger.debug({ connected }, 'loading storage page');
-  return { connectionForm, connected };
+  locals.logger.debug('loading storage page');
+  return { connectionForm };
 };
 
 export const actions: Actions = {
@@ -30,7 +22,6 @@ export const actions: Actions = {
       return fail(400, { form });
     }
 
-    const userId = getUserId(locals);
     const { type, endpoint, pathStyle, region, accessKeyId, secretAccessKey } = form.data;
 
     if (type !== 's3') {
@@ -47,11 +38,9 @@ export const actions: Actions = {
     };
 
     try {
-      saveConnection(userId, config);
-      await listBuckets(userId);
-      log.info({ storage_type: type }, 'user storage connection verified and saved');
+      await listBuckets(config);
+      log.info({ storage_type: type }, 'user storage connection verified');
     } catch (err) {
-      clearConnection(userId);
       log.warn({ err }, 'storage connection test failed');
       return message(form, 'Could not connect — check the endpoint and credentials.', {
         status: 400
@@ -62,9 +51,7 @@ export const actions: Actions = {
   },
 
   disconnect: async ({ locals }) => {
-    const userId = getUserId(locals);
-    clearConnection(userId);
-    locals.logger.info({ user_id: userId }, 'user storage connection cleared');
+    locals.logger.info('user storage connection cleared');
     throw redirect(303, '/storage?disconnected=1');
   }
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
index df190b1b..32a557c6 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -1,26 +1,7 @@
 import type { PageServerLoad } from './$types';
-import { listObjects } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
 
-export const load: PageServerLoad = async ({ locals, params, url }) => {
-  const userId = getUserId(locals);
+export const load: PageServerLoad = async ({ params }) => {
   const prefix = params.prefix ? params.prefix + '/' : '';
   const bucket = params.bucket;
-  const continuationToken = url.searchParams.get('continuationToken');
-  const pageSizeParam = url.searchParams.get('pageSize');
-  const pageSize = pageSizeParam ? parseInt(pageSizeParam, 10) : undefined;
-
-  locals.logger.debug(
-    { bucket, prefix, continuation_token: continuationToken, page_size: pageSize },
-    'loading storage bucket objects'
-  );
-
-  const objects = await listObjects(
-    userId,
-    bucket,
-    prefix,
-    pageSize ?? 25,
-    continuationToken ?? undefined
-  );
-  return { objects, prefix, bucket };
+  return { bucket, prefix };
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
new file mode 100644
index 00000000..6a53ef13
--- /dev/null
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -0,0 +1,46 @@
+import { browser } from '$app/environment';
+import { redirect } from '@sveltejs/kit';
+import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import type { PageLoad } from './$types';
+import type { StoragePage } from '$lib/storage/types.js';
+
+const EMPTY_PAGE: StoragePage = {
+  objects: [],
+  hasNextPage: false,
+  currentPage: 1,
+  pageSize: 25
+};
+
+/**
+ * Client-side load: fetches the object list from the server using the connection
+ * config from localStorage. Redirects to /storage if no connection is available.
+ * During SSR this returns an empty page — the load re-runs on the client.
+ */
+export const load: PageLoad = async ({ fetch, url, data }) => {
+  // Always pass server data through so PageData includes bucket/prefix.
+  const { bucket, prefix } = data;
+
+  if (!browser) return { bucket, prefix, objects: EMPTY_PAGE };
+
+  const connection = loadConnectionLocally();
+  if (!connection) throw redirect(303, '/storage');
+
+  const continuationToken = url.searchParams.get('continuationToken');
+  const pageSizeParam = url.searchParams.get('pageSize');
+
+  const query = new URLSearchParams({ bucket, prefix: prefix ?? '' });
+  if (continuationToken) query.set('continuationToken', continuationToken);
+  if (pageSizeParam) query.set('pageSize', pageSizeParam);
+
+  const res = await fetch(`/storage/api/objects?${query}`, {
+    headers: { 'x-storage-connection': getConnectionHeader(connection) }
+  });
+
+  if (!res.ok) {
+    if (res.status === 401) throw redirect(303, '/storage');
+    return { bucket, prefix, objects: EMPTY_PAGE };
+  }
+
+  const objects = (await res.json()) as StoragePage;
+  return { bucket, prefix, objects };
+};
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
index e525528c..1ef2b010 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
@@ -1,62 +1,29 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-vi.mock('$lib/server/storage/service.js', () => ({
-  listObjects: vi.fn()
-}));
-
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
+import { describe, it, expect } from 'vitest';
 
 import { load } from './+page.server.js';
-import { listObjects } from '$lib/server/storage/service.js';
 
-function mockEvent(
-  opts: { bucket?: string; prefix?: string; searchParams?: Record<string, string> } = {}
-) {
-  const url = new URL('http://localhost/storage/b1/some/prefix');
-  for (const [k, v] of Object.entries(opts.searchParams ?? {})) {
-    url.searchParams.set(k, v);
-  }
+function mockEvent(opts: { bucket?: string; prefix?: string } = {}) {
   return {
     locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } },
-    params: { bucket: opts.bucket ?? 'my-bucket', prefix: opts.prefix ?? '' },
-    url
+    params: { bucket: opts.bucket ?? 'my-bucket', prefix: opts.prefix ?? '' }
   } as unknown as Parameters<typeof load>[0];
 }
 
-describe('bucket page load', () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it('lists objects with default page size', async () => {
-    vi.mocked(listObjects).mockResolvedValue({ items: [], prefixes: [] } as unknown as Awaited<
-      ReturnType<typeof listObjects>
-    >);
-
-    const result = (await load(mockEvent())) as { bucket: string; prefix: string };
+import { vi } from 'vitest';
 
-    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', '', 25, undefined);
-    expect(result.bucket).toBe('my-bucket');
-    expect(result.prefix).toBe('');
+describe('bucket page server load', () => {
+  it('returns bucket and prefix', async () => {
+    const result = await load(mockEvent());
+    expect(result).toEqual({ bucket: 'my-bucket', prefix: '' });
   });
 
   it('adds trailing slash to prefix', async () => {
-    vi.mocked(listObjects).mockResolvedValue({ items: [] } as unknown as Awaited<
-      ReturnType<typeof listObjects>
-    >);
-
-    await load(mockEvent({ prefix: 'data/2024' }));
-
-    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', 'data/2024/', 25, undefined);
+    const result = await load(mockEvent({ prefix: 'data/2024' }));
+    expect(result).toEqual({ bucket: 'my-bucket', prefix: 'data/2024/' });
   });
 
-  it('passes continuationToken and pageSize', async () => {
-    vi.mocked(listObjects).mockResolvedValue({ items: [] } as unknown as Awaited<
-      ReturnType<typeof listObjects>
-    >);
-
-    await load(mockEvent({ searchParams: { continuationToken: 'abc', pageSize: '50' } }));
-
-    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', '', 50, 'abc');
+  it('handles empty prefix', async () => {
+    const result = await load(mockEvent({ bucket: 'test-bucket', prefix: '' }));
+    expect(result).toEqual({ bucket: 'test-bucket', prefix: '' });
   });
 });
diff --git a/src/routes/(app)/storage/api/buckets/+server.ts b/src/routes/(app)/storage/api/buckets/+server.ts
new file mode 100644
index 00000000..620f983a
--- /dev/null
+++ b/src/routes/(app)/storage/api/buckets/+server.ts
@@ -0,0 +1,16 @@
+import { listBuckets } from '$lib/server/storage/service.js';
+import { requireConnection } from '$lib/server/storage/connection.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /storage/api/buckets
+ *
+ * Returns the list of buckets accessible with the connection config supplied in
+ * the `X-Storage-Connection` request header (base64-encoded JSON).
+ */
+export const GET: RequestHandler = async ({ request, locals }) => {
+  const config = requireConnection(request);
+  const buckets = await listBuckets(config);
+  locals.logger.debug({ bucket_count: buckets.length }, 'bucket list returned');
+  return Response.json(buckets);
+};
diff --git a/src/routes/(app)/storage/api/delete/+server.ts b/src/routes/(app)/storage/api/delete/+server.ts
index 174e84b4..4892bb35 100644
--- a/src/routes/(app)/storage/api/delete/+server.ts
+++ b/src/routes/(app)/storage/api/delete/+server.ts
@@ -1,7 +1,7 @@
 import type { RequestHandler } from './$types';
 import { error } from '@sveltejs/kit';
 import { deleteObjects } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
+import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucket } from '../params.js';
 
 /**
@@ -9,20 +9,22 @@ import { requireBucket } from '../params.js';
  *
  * Deletes one or more S3 objects from the given bucket.
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
+ *
+ * The connection config is read from the `X-Storage-Connection` request header
+ * (base64-encoded JSON), set by the client from its localStorage entry.
  */
-export const DELETE: RequestHandler = async ({ locals, url }) => {
+export const DELETE: RequestHandler = async ({ locals, url, request }) => {
   const bucket = requireBucket(url);
+  const config = requireConnection(request);
 
   const keys = url.searchParams.getAll('keys');
   if (!keys.length) {
     throw error(400, 'Missing required query parameter: keys');
   }
 
-  const userId = getUserId(locals);
-
   locals.logger.debug({ bucket, key_count: keys.length }, 'delete request received');
 
-  const result = await deleteObjects(userId, bucket, keys);
+  const result = await deleteObjects(config, bucket, keys);
 
   locals.logger.info(
     { bucket, key_count: keys.length, failed_count: result.failed.length },
diff --git a/src/routes/(app)/storage/api/delete/server.test.ts b/src/routes/(app)/storage/api/delete/server.test.ts
index acda7403..35783ccb 100644
--- a/src/routes/(app)/storage/api/delete/server.test.ts
+++ b/src/routes/(app)/storage/api/delete/server.test.ts
@@ -5,13 +5,18 @@ vi.mock('$lib/server/storage/service.js', () => ({
   deleteObjects: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
+vi.mock('$lib/server/storage/connection.js', () => ({
+  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
+  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
 }));
 
 import { DELETE } from './+server.js';
 import { deleteObjects } from '$lib/server/storage/service.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(searchParams: Record<string, string | string[]>) {
   const url = new URL('http://localhost/storage/api/delete');
   for (const [k, v] of Object.entries(searchParams)) {
@@ -23,6 +28,7 @@ function mockEvent(searchParams: Record<string, string | string[]>) {
   }
   return {
     url,
+    request: { headers: new Headers(CONNECTION_HEADER) },
     locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
   } as unknown as Parameters<typeof DELETE>[0];
 }
@@ -50,7 +56,7 @@ describe('DELETE /storage/api/delete', () => {
     );
 
     const response = await DELETE(mockEvent({ bucket: 'b1', keys }));
-    expect(deleteObjects).toHaveBeenCalledWith('test-user', 'b1', keys);
+    expect(deleteObjects).toHaveBeenCalledWith(expect.objectContaining({ type: 's3' }), 'b1', keys);
     expect(await response.json()).toEqual(result);
   });
 });
diff --git a/src/routes/(app)/storage/api/download/+server.ts b/src/routes/(app)/storage/api/download/+server.ts
index 0a2c984a..e43df827 100644
--- a/src/routes/(app)/storage/api/download/+server.ts
+++ b/src/routes/(app)/storage/api/download/+server.ts
@@ -1,6 +1,6 @@
 import type { RequestHandler } from './$types';
 import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
+import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucketKey } from '../params.js';
 
 /** Derive the bare filename from a (possibly path-prefixed) object key. */
@@ -15,14 +15,17 @@ function filenameFromKey(key: string): string {
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
  * The S3 body stream is piped straight to the HTTP response — no server-side
  * buffering occurs.
+ *
+ * The connection config is read from the `X-Storage-Connection` request header
+ * (base64-encoded JSON), set by the client from its localStorage entry.
  */
-export const GET: RequestHandler = async ({ locals, url }) => {
+export const GET: RequestHandler = async ({ locals, url, request }) => {
   const { bucket, key } = requireBucketKey(url);
-  const userId = getUserId(locals);
+  const config = requireConnection(request);
 
   locals.logger.debug({ bucket, key }, 'download request received');
 
-  const download = await downloadObject(userId, bucket, key);
+  const download = await downloadObject(config, bucket, key);
 
   const filename = filenameFromKey(key);
   // RFC 5987 encoding for non-ASCII filenames in Content-Disposition
@@ -53,16 +56,17 @@ export const GET: RequestHandler = async ({ locals, url }) => {
  *
  * Lightweight pre-flight that validates credentials and access rights using
  * a HeadObject call (no object body transferred). The client uses this before
- * initiating a native browser download to surface auth/not-found errors as
- * inline UI messages rather than browser download failures.
+ * initiating a download to surface auth/not-found errors as inline UI messages.
+ *
+ * The connection config is read from the `X-Storage-Connection` request header.
  */
-export const HEAD: RequestHandler = async ({ locals, url }) => {
+export const HEAD: RequestHandler = async ({ locals, url, request }) => {
   const { bucket, key } = requireBucketKey(url);
-  const userId = getUserId(locals);
+  const config = requireConnection(request);
 
   locals.logger.debug({ bucket, key }, 'download pre-flight check');
 
-  const meta = await getObjectMetadata(userId, bucket, key);
+  const meta = await getObjectMetadata(config, bucket, key);
 
   return new Response(null, {
     status: 200,
diff --git a/src/routes/(app)/storage/api/download/server.test.ts b/src/routes/(app)/storage/api/download/server.test.ts
index 0ed933f8..d0304e87 100644
--- a/src/routes/(app)/storage/api/download/server.test.ts
+++ b/src/routes/(app)/storage/api/download/server.test.ts
@@ -5,17 +5,23 @@ vi.mock('$lib/server/storage/service.js', () => ({
   getObjectMetadata: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
+vi.mock('$lib/server/storage/connection.js', () => ({
+  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
+  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
 }));
 
 import { GET, HEAD } from './+server.js';
 import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(params: string) {
   const url = new URL(`http://localhost/storage/api/download?${params}`);
   return {
     url,
+    request: { headers: new Headers(CONNECTION_HEADER) },
     locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
   } as unknown as Parameters<typeof GET>[0];
 }
diff --git a/src/routes/(app)/storage/api/objects/+server.ts b/src/routes/(app)/storage/api/objects/+server.ts
new file mode 100644
index 00000000..d1fb56f9
--- /dev/null
+++ b/src/routes/(app)/storage/api/objects/+server.ts
@@ -0,0 +1,30 @@
+import { error } from '@sveltejs/kit';
+import { listObjects } from '$lib/server/storage/service.js';
+import { requireConnection } from '$lib/server/storage/connection.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /storage/api/objects?bucket=<bucket>&prefix=<prefix>&pageSize=<n>&continuationToken=<token>
+ *
+ * Returns a page of objects in the given bucket/prefix using the connection
+ * config supplied in the `X-Storage-Connection` request header.
+ */
+export const GET: RequestHandler = async ({ request, url, locals }) => {
+  const config = requireConnection(request);
+
+  const bucket = url.searchParams.get('bucket')?.trim();
+  if (!bucket) throw error(400, 'Missing required query parameter: bucket');
+
+  const prefix = url.searchParams.get('prefix') ?? '';
+  const continuationToken = url.searchParams.get('continuationToken');
+  const pageSizeParam = url.searchParams.get('pageSize');
+  const pageSize = pageSizeParam ? parseInt(pageSizeParam, 10) : 25;
+
+  locals.logger.debug(
+    { bucket, prefix, continuation_token: continuationToken, page_size: pageSize },
+    'listing objects'
+  );
+
+  const page = await listObjects(config, bucket, prefix, pageSize, continuationToken);
+  return Response.json(page);
+};
diff --git a/src/routes/(app)/storage/api/preview/+server.ts b/src/routes/(app)/storage/api/preview/+server.ts
index 193ad363..f6c6e7f7 100644
--- a/src/routes/(app)/storage/api/preview/+server.ts
+++ b/src/routes/(app)/storage/api/preview/+server.ts
@@ -1,19 +1,25 @@
 import { S3ServiceException } from '@aws-sdk/client-s3';
-import { getUserId } from '$lib/server/auth-utils.js';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
-import { getProviderForUser } from '$lib/server/storage/utils.js';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireConnection } from '$lib/server/storage/connection.js';
 // import { parquetPreview } from '$lib/server/storage/preview/parquet.js';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
 
-export const GET: RequestHandler = async ({ url, locals }) => {
+/**
+ * GET /storage/api/preview?bucket=<bucket>&key=<object-key>
+ *
+ * The connection config is read from the `X-Storage-Connection` request header
+ * (base64-encoded JSON), set by the client from its localStorage entry.
+ */
+export const GET: RequestHandler = async ({ url, locals, request }) => {
   const log = locals.logger;
-  const userId = getUserId(locals);
+  const config = requireConnection(request);
   const { bucket, key } = requireBucketKey(url);
 
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
     const metadata = await provider.getMetadata(key);
@@ -29,7 +35,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
 
     if (isParquet) {
       log.info(
-        { user_id: userId, bucket, key, content_type: rawContentType, total_size: totalSize },
+        { bucket, key, content_type: rawContentType, total_size: totalSize },
         'parquet preview disabled'
       );
       // TODO: re-enable once we have a more robust parquet preview solution in place
@@ -39,7 +45,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
     // Skip body fetch for known-binary formats — client will show fallback immediately.
     if (KNOWN_BINARY_TYPES.has(rawContentType)) {
       log.info(
-        { user_id: userId, bucket, key, content_type: rawContentType },
+        { bucket, key, content_type: rawContentType },
         'skipping preview fetch for known-binary type'
       );
       return binaryPreview(rawContentType, totalSize);
@@ -52,7 +58,8 @@ export const GET: RequestHandler = async ({ url, locals }) => {
         ? 'text/csv'
         : rawContentType;
 
-    return await streamPreview(provider, key, contentType, totalSize, userId, log);
+    // Pass a placeholder user identifier for logging purposes (no longer user-specific)
+    return await streamPreview(provider, key, contentType, totalSize, 'client', log);
   } catch (err) {
     if (err instanceof S3ServiceException) {
       mapS3ErrorToHttp(err, { bucket, key, operation: 'preview' });
diff --git a/src/routes/(app)/storage/api/preview/server.test.ts b/src/routes/(app)/storage/api/preview/server.test.ts
index d0867554..79f72594 100644
--- a/src/routes/(app)/storage/api/preview/server.test.ts
+++ b/src/routes/(app)/storage/api/preview/server.test.ts
@@ -3,11 +3,12 @@ import { S3ServiceException } from '@aws-sdk/client-s3';
 
 const mockGetMetadata = vi.fn();
 vi.mock('$lib/server/storage/utils.js', () => ({
-  getProviderForUser: vi.fn(() => ({ getMetadata: mockGetMetadata }))
+  getProvider: vi.fn(() => ({ getMetadata: mockGetMetadata }))
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
+vi.mock('$lib/server/storage/connection.js', () => ({
+  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
+  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
 }));
 
 vi.mock('$lib/server/storage/preview/binary.js', () => ({
@@ -30,10 +31,15 @@ import { binaryPreview } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(params: string) {
   const url = new URL(`http://localhost/storage/api/preview?${params}`);
   return {
     url,
+    request: { headers: new Headers(CONNECTION_HEADER) },
     locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
   } as unknown as Parameters<typeof GET>[0];
 }
@@ -59,7 +65,7 @@ describe('GET /storage/api/preview', () => {
       'data.csv',
       'text/csv',
       100,
-      'test-user',
+      'client',
       expect.anything()
     );
   });
@@ -74,7 +80,7 @@ describe('GET /storage/api/preview', () => {
       'readme.txt',
       'text/plain',
       50,
-      'test-user',
+      'client',
       expect.anything()
     );
   });
diff --git a/src/routes/(app)/storage/api/upload/+server.ts b/src/routes/(app)/storage/api/upload/+server.ts
index 696e97c2..dc58c546 100644
--- a/src/routes/(app)/storage/api/upload/+server.ts
+++ b/src/routes/(app)/storage/api/upload/+server.ts
@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import { uploadObject } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
+import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
 
@@ -11,16 +11,12 @@ import type { RequestHandler } from './$types';
  * @aws-sdk/lib-storage). The request body is piped to the S3 SDK without
  * buffering in server memory, regardless of file size.
  *
- * Assumptions (v0):
- * - Credentials come from the in-memory per-user S3 connection config
- *   (same as download/preview). No production credential vaulting.
- * - No server-side file size limit is enforced; S3's 5 TB object limit applies.
- * - A single Content-Type header value is trusted from the client and forwarded
- *   to S3 as-is.
+ * The connection config is read from the `X-Storage-Connection` request header
+ * (base64-encoded JSON), set by the client from its localStorage entry.
  */
 export const POST: RequestHandler = async ({ locals, url, request }) => {
   const log = locals.logger;
-  const userId = getUserId(locals);
+  const config = requireConnection(request);
   const { bucket, key } = requireBucketKey(url);
 
   if (!request.body) {
@@ -39,7 +35,7 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     'upload request received'
   );
 
-  await uploadObject(userId, bucket, key, request.body, contentType, contentLength);
+  await uploadObject(config, bucket, key, request.body, contentType, contentLength);
 
   log.info(
     { bucket, key, content_type: contentType, content_length: contentLength },
diff --git a/src/routes/(app)/storage/api/upload/server.test.ts b/src/routes/(app)/storage/api/upload/server.test.ts
index 0f3bb6ed..b8adfdb9 100644
--- a/src/routes/(app)/storage/api/upload/server.test.ts
+++ b/src/routes/(app)/storage/api/upload/server.test.ts
@@ -4,13 +4,18 @@ vi.mock('$lib/server/storage/service.js', () => ({
   uploadObject: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
+vi.mock('$lib/server/storage/connection.js', () => ({
+  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
+  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
 }));
 
 import { POST } from './+server.js';
 import { uploadObject } from '$lib/server/storage/service.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(opts: {
   params?: string;
   body?: ReadableStream | null;
@@ -20,7 +25,7 @@ function mockEvent(opts: {
     `http://localhost/storage/api/upload?${opts.params ?? 'bucket=b1&key=file.txt'}`
   );
   const headers = new Headers(
-    opts.headers ?? { 'Content-Type': 'text/plain', 'Content-Length': '42' }
+    opts.headers ?? { 'Content-Type': 'text/plain', 'Content-Length': '42', ...CONNECTION_HEADER }
   );
   const body = 'body' in opts ? opts.body : new ReadableStream();
   return {
@@ -52,13 +57,17 @@ describe('POST /storage/api/upload', () => {
     const res = await POST(
       mockEvent({
         body,
-        headers: { 'Content-Type': 'image/png; charset=utf-8', 'Content-Length': '100' }
+        headers: {
+          'Content-Type': 'image/png; charset=utf-8',
+          'Content-Length': '100',
+          ...CONNECTION_HEADER
+        }
       })
     );
 
     expect(res.status).toBe(201);
     expect(uploadObject).toHaveBeenCalledWith(
-      'test-user',
+      expect.objectContaining({ type: 's3' }),
       'b1',
       'file.txt',
       body,
@@ -70,7 +79,7 @@ describe('POST /storage/api/upload', () => {
   it('defaults content type to application/octet-stream', async () => {
     vi.mocked(uploadObject).mockResolvedValue(undefined);
 
-    const res = await POST(mockEvent({ headers: {} }));
+    const res = await POST(mockEvent({ headers: { ...CONNECTION_HEADER } }));
 
     expect(res.status).toBe(201);
     expect(vi.mocked(uploadObject).mock.calls[0][4]).toBe('application/octet-stream');
diff --git a/src/routes/(app)/storage/layout.server.test.ts b/src/routes/(app)/storage/layout.server.test.ts
index 25d1e89e..7edce12a 100644
--- a/src/routes/(app)/storage/layout.server.test.ts
+++ b/src/routes/(app)/storage/layout.server.test.ts
@@ -7,17 +7,7 @@ vi.mock('$lib/server/feature-flags.js', () => ({
   }
 }));
 
-vi.mock('$lib/server/storage/service.js', () => ({
-  getConnection: vi.fn(),
-  listBuckets: vi.fn()
-}));
-
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
-
 import { load } from './+layout.server.js';
-import { getConnection, listBuckets } from '$lib/server/storage/service.js';
 
 function mockEvent() {
   return {
@@ -25,7 +15,7 @@ function mockEvent() {
   } as unknown as Parameters<typeof load>[0];
 }
 
-describe('storage layout load', () => {
+describe('storage layout server load', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('throws 404 when storage browser is disabled', async () => {
@@ -33,37 +23,9 @@ describe('storage layout load', () => {
     await expect(load(mockEvent())).rejects.toThrow(expect.objectContaining({ status: 404 }));
   });
 
-  it('returns connected:false when no connection', async () => {
+  it('returns disconnected default state', async () => {
     mockStorageBrowserEnabled.mockReturnValue(true);
-    vi.mocked(getConnection).mockReturnValue(null);
-
     const result = await load(mockEvent());
     expect(result).toEqual({ connected: false, buckets: [], connectionType: null });
   });
-
-  it('returns buckets when connected', async () => {
-    mockStorageBrowserEnabled.mockReturnValue(true);
-    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
-      typeof getConnection
-    >);
-    vi.mocked(listBuckets).mockResolvedValue(['bucket-a', 'bucket-b']);
-
-    const result = await load(mockEvent());
-    expect(result).toEqual({
-      connected: true,
-      buckets: ['bucket-a', 'bucket-b'],
-      connectionType: 's3'
-    });
-  });
-
-  it('returns empty buckets when listBuckets fails', async () => {
-    mockStorageBrowserEnabled.mockReturnValue(true);
-    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
-      typeof getConnection
-    >);
-    vi.mocked(listBuckets).mockRejectedValue(new Error('network'));
-
-    const result = await load(mockEvent());
-    expect(result).toEqual({ connected: true, buckets: [], connectionType: 's3' });
-  });
 });
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
index d1766205..207b214c 100644
--- a/src/routes/(app)/storage/page.server.test.ts
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -1,16 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 vi.mock('$lib/server/storage/service.js', () => ({
-  getConnection: vi.fn(),
-  saveConnection: vi.fn(),
-  clearConnection: vi.fn(),
   listBuckets: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
-
 vi.mock('$lib/storage/schemas.js', () => ({
   StorageConnectionSchema: {} // superValidate is also mocked
 }));
@@ -25,7 +18,7 @@ vi.mock('sveltekit-superforms/adapters', () => ({
 }));
 
 import { load, actions } from './+page.server.js';
-import { getConnection, clearConnection, listBuckets } from '$lib/server/storage/service.js';
+import { listBuckets } from '$lib/server/storage/service.js';
 import { superValidate } from 'sveltekit-superforms';
 
 function mockLocals() {
@@ -35,18 +28,14 @@ function mockLocals() {
 describe('storage page load', () => {
   beforeEach(() => vi.clearAllMocks());
 
-  it('returns connectionForm and connected status', async () => {
+  it('returns connectionForm', async () => {
     vi.mocked(superValidate).mockResolvedValue({ data: {} } as unknown as Awaited<
       ReturnType<typeof superValidate>
     >);
-    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
-      typeof getConnection
-    >);
 
     const result = (await load({
       locals: mockLocals()
-    } as unknown as Parameters<typeof load>[0])) as { connected: boolean; connectionForm: unknown };
-    expect(result.connected).toBe(true);
+    } as unknown as Parameters<typeof load>[0])) as { connectionForm: unknown };
     expect(result.connectionForm).toBeDefined();
   });
 });
@@ -86,7 +75,7 @@ describe('storage page actions', () => {
     expect(result).toHaveProperty('message', 'HDFS connections are not yet supported');
   });
 
-  it('connect: clears connection and returns error on test failure', async () => {
+  it('connect: returns error message on connection test failure', async () => {
     vi.mocked(superValidate).mockResolvedValue({
       valid: true,
       data: {
@@ -104,7 +93,6 @@ describe('storage page actions', () => {
       request: new Request('http://localhost', { method: 'POST' }),
       locals: mockLocals()
     } as unknown as Parameters<typeof actions.connect>[0]);
-    expect(clearConnection).toHaveBeenCalledWith('test-user');
     expect(result).toHaveProperty(
       'message',
       'Could not connect — check the endpoint and credentials.'
@@ -133,7 +121,7 @@ describe('storage page actions', () => {
     ).rejects.toThrow(expect.objectContaining({ status: 303, location: '/storage' }));
   });
 
-  it('disconnect: clears connection and redirects', async () => {
+  it('disconnect: redirects', async () => {
     await expect(
       actions.disconnect({ locals: mockLocals() } as unknown as Parameters<
         typeof actions.disconnect
@@ -141,6 +129,5 @@ describe('storage page actions', () => {
     ).rejects.toThrow(
       expect.objectContaining({ status: 303, location: '/storage?disconnected=1' })
     );
-    expect(clearConnection).toHaveBeenCalledWith('test-user');
   });
 });

From 6ea6b163758ae656e0813d1ab3f8097ecabee663 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 3 Jun 2026 08:17:41 +0200
Subject: [PATCH 049/136] #185 update e2e tests for browser connections

---
 e2e/storage/helpers.ts                        | 28 ++++++++++
 e2e/storage/permissions.spec.ts               |  1 +
 e2e/storage/preview.spec.ts                   |  8 +--
 e2e/storage/recent-items.spec.ts              | 27 +++++-----
 .../storage/sidebar/BucketList.svelte         |  8 +--
 src/routes/(app)/storage/+error.svelte        |  9 +++-
 .../storage/[bucket]/[...prefix]/+page.svelte | 51 ++++++++++++++++++-
 .../storage/[bucket]/[...prefix]/+page.ts     | 13 ++++-
 8 files changed, 120 insertions(+), 25 deletions(-)

diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 744a9246..95e26ae0 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -82,7 +82,35 @@ export async function connectAndOpenPrefix(
   await connectToStorage(page, credentials);
   await expect(page).toHaveURL('/storage');
   await page.goto(bucketRoute(credentials.bucket, prefix));
+  await waitForObjectsLoaded(page);
+}
+
+/**
+ * Wait for the bucket object listing to be ready after a client-side load.
+ * With the new architecture, `waitForHydration` alone is insufficient because
+ * the object list is fetched client-side after hydration. This waits for either
+ * a table row or the empty-state message to appear, confirming the fetch has
+ * completed and the UI has updated.
+ */
+export async function waitForObjectsLoaded(page: Page) {
+  await waitForHydration(page);
+  await page
+    .locator('tbody tr')
+    .or(page.getByText('This bucket is empty'))
+    .first()
+    .waitFor({ timeout: 15_000 });
+}
+
+/**
+ * Wait for the storage landing page to display the connected state.
+ * With the new client-side layout load, navigating to `/storage` initially
+ * renders the SSR default (disconnected) state. This waits until the
+ * client-side bucket fetch has completed and the connected UI (recent items
+ * tabs) is visible.
+ */
+export async function waitForStorageConnected(page: Page) {
   await waitForHydration(page);
+  await expect(page.getByRole('tab', { name: 'Recent Files' })).toBeVisible({ timeout: 15_000 });
 }
 
 export async function putTextObject(
diff --git a/e2e/storage/permissions.spec.ts b/e2e/storage/permissions.spec.ts
index 50de8f06..b9b2f467 100644
--- a/e2e/storage/permissions.spec.ts
+++ b/e2e/storage/permissions.spec.ts
@@ -127,6 +127,7 @@ test.describe('Storage S3 — Permissions', () => {
     });
 
     await connectToStorage(page, noAccessCredentials);
+    await expect(page).toHaveURL('/storage');
     await page.goto(bucketRoute(noAccessBucket));
 
     await expect(page.getByText('403')).toBeVisible();
diff --git a/e2e/storage/preview.spec.ts b/e2e/storage/preview.spec.ts
index e07fc162..84bd1b52 100644
--- a/e2e/storage/preview.spec.ts
+++ b/e2e/storage/preview.spec.ts
@@ -73,7 +73,7 @@ test.describe('Storage S3 — Preview', () => {
 
       await expect(page.getByRole('heading', { name: 'archive.zip' })).toBeVisible();
       await expect(page.getByText('Preview unavailable')).toBeVisible();
-      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Download full file' })).toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
@@ -103,7 +103,7 @@ test.describe('Storage S3 — Preview', () => {
 
       await expect(page.getByRole('heading', { name: 'data.bin' })).toBeVisible();
       await expect(page.getByText('Binary content')).toBeVisible();
-      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Download full file' })).toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
@@ -172,8 +172,8 @@ test.describe('Storage S3 — Preview', () => {
       // File size badge is displayed
       await expect(page.locator('.badge', { hasText: /B$/ })).toBeVisible();
 
-      // Download link is available
-      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+      // Download button is available
+      await expect(page.getByRole('button', { name: 'Download full file' })).toBeVisible();
 
       // Close button works
       await page.getByRole('button', { name: 'Close' }).last().click();
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index 7b30156e..9a53f2b7 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -4,7 +4,6 @@ import {
   hasGarageCredentials,
   requireGarageCredentials
 } from '../support/garage.js';
-import { waitForHydration } from '../support/helpers.js';
 import {
   bucketRoute,
   connectAndOpenPrefix,
@@ -12,7 +11,9 @@ import {
   deleteKnownKeys,
   putTextObject,
   rowByName,
-  uniquePrefix
+  uniquePrefix,
+  waitForObjectsLoaded,
+  waitForStorageConnected
 } from './helpers.js';
 
 async function previewFile(page: Page, name: string) {
@@ -35,11 +36,12 @@ test.describe('Storage S3 — Recent Items', () => {
     const credentials = requireGarageCredentials();
 
     await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
     await page.goto(bucketRoute(credentials.bucket));
-    await waitForHydration(page);
+    await waitForObjectsLoaded(page);
 
     await page.goto('/storage');
-    await waitForHydration(page);
+    await waitForStorageConnected(page);
 
     await page.getByRole('tab', { name: 'Recent Locations' }).click();
 
@@ -63,10 +65,8 @@ test.describe('Storage S3 — Recent Items', () => {
       await page.getByRole('button', { name: 'Close' }).last().click();
 
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
 
-      const filesTab = page.getByRole('tab', { name: 'Recent Files' });
-      await expect(filesTab).toBeVisible();
       await expect(page.locator('tbody').getByText('recent.txt')).toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
@@ -88,12 +88,12 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // Confirm it appears in Recent Files
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('to-delete.txt')).toBeVisible();
 
       // Delete the file via the UI
       await page.goto(bucketRoute(credentials.bucket, prefix));
-      await waitForHydration(page);
+      await waitForObjectsLoaded(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select to-delete.txt').check();
       await page.getByRole('button', { name: 'Delete', exact: true }).click();
@@ -102,7 +102,7 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // File should no longer appear in Recent Files
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('to-delete.txt')).not.toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, [key]);
@@ -122,21 +122,20 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // Navigate into the sub-directory so it appears in Recent Locations
       await connectAndOpenPrefix(page, credentials, `${prefix}sub/`);
-      await waitForHydration(page);
 
       // Preview the nested file so it appears in Recent Files
       await previewFile(page, 'nested.txt');
 
       // Confirm both lists contain the entries
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('nested.txt')).toBeVisible();
       await page.getByRole('tab', { name: 'Recent Locations' }).click();
       await expect(page.locator('tbody').getByText('sub', { exact: true })).toBeVisible();
 
       // Delete the parent directory via the UI
       await page.goto(bucketRoute(credentials.bucket, prefix));
-      await waitForHydration(page);
+      await waitForObjectsLoaded(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select sub').check();
       await page.getByRole('button', { name: 'Delete', exact: true }).click();
@@ -145,7 +144,7 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // Neither the file nor the location should appear in the recent lists
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('nested.txt')).not.toBeVisible();
       await page.getByRole('tab', { name: 'Recent Locations' }).click();
       await expect(page.locator('tbody').getByText('sub', { exact: true })).not.toBeVisible();
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 30e2742a..ac5f9f4c 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -15,10 +15,12 @@
 
   const storage = getStorageState();
 
-  // Detect the active bucket from the URL so the highlight stays on when
-  // navigating into any sub-prefix within the bucket.
+  // page.url may be undefined in the error boundary state (when a client-side
+  // universal load throws and SvelteKit transitions to the error state). Guard
+  // with optional chaining to avoid crashing the layout and escalating the
+  // error to the root fallback handler.
   const activeBucket = $derived.by(() => {
-    const match = page.url.pathname.match(/^\/storage\/([^/]+)/);
+    const match = page.url?.pathname?.match(/^\/storage\/([^/]+)/);
     return match ? decodeURIComponent(match[1]) : null;
   });
   const activePrefix = $derived(page.params.prefix ? page.params.prefix + '/' : '');
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
index e91a40b5..bcc2ce6a 100644
--- a/src/routes/(app)/storage/+error.svelte
+++ b/src/routes/(app)/storage/+error.svelte
@@ -4,7 +4,14 @@
   import IconWarning from 'virtual:icons/material-symbols/warning';
   import * as m from '$lib/paraglide/messages.js';
 
-  const bucket = $derived(page.params.bucket ?? '');
+  // page.params.bucket may be absent when a client-side universal load throws an
+  // error (the error boundary sits at the parent /storage level, and SvelteKit
+  // may not populate child-route params on the page store in that case).
+  // Fall back to parsing the bucket segment directly from the URL path.
+  const bucket = $derived(
+    page.params.bucket ||
+      decodeURIComponent(page.url?.pathname?.split('/').filter(Boolean)[1] ?? '')
+  );
 
   function bucketErrorMessage(status: number, name: string): string | null {
     if (!name) return null;
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index ef43e0db..49c8f26b 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -3,6 +3,8 @@
   import { resolve } from '$app/paths';
   import { getStorageState } from '$lib/storage/context.js';
   import FileExplorer from '$lib/components/storage/explorer/FileExplorer.svelte';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
+  import * as m from '$lib/paraglide/messages.js';
 
   let { data } = $props();
   const storage = getStorageState();
@@ -32,4 +34,51 @@
   });
 </script>
 
-<FileExplorer />
+{#if data.accessDenied}
+  <!--
+    403 is rendered inline rather than via +error.svelte because throwing from a
+    universal load during initial hydration (when data.connected=true causes
+    BucketList to mount) can escape the storage error boundary and fall through
+    to the root fallback. Rendering inline keeps the sidebar visible.
+  -->
+  <div
+    class="
+      flex flex-1 flex-col items-center justify-center gap-6 p-8 text-center
+    "
+  >
+    <div
+      class="
+        bg-error/10 text-error flex size-20 items-center justify-center
+        rounded-full
+      "
+      aria-hidden="true"
+    >
+      <IconWarning class="size-10" aria-hidden="true" />
+    </div>
+
+    <div>
+      <p
+        class="
+          text-base-content/50 mb-1 text-sm font-medium tracking-widest uppercase
+        "
+      >
+        {m.storage_error_title()}
+      </p>
+      <h1 class="text-base-content text-3xl font-bold">403</h1>
+      <p class="text-base-content/70 mt-2 max-w-sm text-sm">
+        {m.storage_error_access_denied({ bucket: data.bucket })}
+      </p>
+    </div>
+
+    <div class="flex flex-wrap items-center justify-center gap-3">
+      <a href={resolve('/storage')} class="btn btn-sm btn-primary">
+        {m.storage_error_back_to_storage()}
+      </a>
+      <button type="button" class="btn btn-ghost btn-sm" onclick={() => history.back()}>
+        {m.storage_error_go_back()}
+      </button>
+    </div>
+  </div>
+{:else}
+  <FileExplorer />
+{/if}
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
index 6a53ef13..e38da795 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -1,5 +1,5 @@
 import { browser } from '$app/environment';
-import { redirect } from '@sveltejs/kit';
+import { error, redirect } from '@sveltejs/kit';
 import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 import type { PageLoad } from './$types';
 import type { StoragePage } from '$lib/storage/types.js';
@@ -38,7 +38,16 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
 
   if (!res.ok) {
     if (res.status === 401) throw redirect(303, '/storage');
-    return { bucket, prefix, objects: EMPTY_PAGE };
+    // For 403 we return an accessDenied flag rather than throwing error().
+    // Throwing from a universal load during initial hydration (e.g. after
+    // page.goto) can bypass the +error.svelte boundary and fall through to the
+    // root fallback when data.connected=true causes BucketList to mount — a
+    // hydration-state mismatch that SvelteKit cannot safely recover from.
+    // Handling 403 inline in +page.svelte avoids the boundary entirely and
+    // keeps the sidebar visible so the user can navigate away.
+    if (res.status === 403) return { bucket, prefix, objects: EMPTY_PAGE, accessDenied: true as const };
+    const body = (await res.json().catch(() => ({}))) as { message?: string };
+    throw error(res.status, body.message ?? 'Failed to load objects');
   }
 
   const objects = (await res.json()) as StoragePage;

From c07a3bc46ab4a349bfc617fa2e24a18a11b7fcaa Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 3 Jun 2026 10:03:00 +0200
Subject: [PATCH 050/136] #185 fix unit test

---
 .../modals/upload/UploadModal.svelte.spec.ts   | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index 5aace25a..40eac1ad 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -168,14 +168,14 @@ describe('UploadModal', () => {
       render(UploadModal, { ...defaultProps, prefix });
       await selectAndUpload([createFile('report.csv')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'data/report.csv');
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'data/report.csv', expect.any(String));
     });
 
     it('should use filename directly when prefix is empty', async () => {
       render(UploadModal, { ...defaultProps, prefix: '' });
       await selectAndUpload([createFile('report.csv')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'report.csv');
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'report.csv', expect.any(String));
     });
   });
 
@@ -196,7 +196,8 @@ describe('UploadModal', () => {
         defaultProps.bucket,
         'a.txt',
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
 
@@ -337,7 +338,8 @@ describe('UploadModal', () => {
         expect.any(String),
         expect.any(String),
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
 
@@ -439,7 +441,8 @@ describe('UploadModal', () => {
         expect.any(String),
         'folder/sub/data.csv',
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
   });
@@ -510,12 +513,13 @@ describe('UploadModal', () => {
       render(UploadModal, { ...defaultProps, bucket });
       await selectAndUpload([createFile('a.txt')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(bucket, expect.any(String));
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(bucket, expect.any(String), expect.any(String));
       expect(mockUploadFile).toHaveBeenCalledWith(
         bucket,
         expect.any(String),
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
 

From 3dbcd2bdddbac3ecd5f579208473743c05e0d58a Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 3 Jun 2026 10:14:08 +0200
Subject: [PATCH 051/136] #185 fix lint

---
 .../modals/upload/UploadModal.svelte.spec.ts   | 18 +++++++++++++++---
 .../storage/[bucket]/[...prefix]/+page.ts      |  3 ++-
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index 40eac1ad..c2b31675 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -168,14 +168,22 @@ describe('UploadModal', () => {
       render(UploadModal, { ...defaultProps, prefix });
       await selectAndUpload([createFile('report.csv')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'data/report.csv', expect.any(String));
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(
+        expect.any(String),
+        'data/report.csv',
+        expect.any(String)
+      );
     });
 
     it('should use filename directly when prefix is empty', async () => {
       render(UploadModal, { ...defaultProps, prefix: '' });
       await selectAndUpload([createFile('report.csv')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'report.csv', expect.any(String));
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(
+        expect.any(String),
+        'report.csv',
+        expect.any(String)
+      );
     });
   });
 
@@ -513,7 +521,11 @@ describe('UploadModal', () => {
       render(UploadModal, { ...defaultProps, bucket });
       await selectAndUpload([createFile('a.txt')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(bucket, expect.any(String), expect.any(String));
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(
+        bucket,
+        expect.any(String),
+        expect.any(String)
+      );
       expect(mockUploadFile).toHaveBeenCalledWith(
         bucket,
         expect.any(String),
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
index e38da795..47568c1d 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -45,7 +45,8 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
     // hydration-state mismatch that SvelteKit cannot safely recover from.
     // Handling 403 inline in +page.svelte avoids the boundary entirely and
     // keeps the sidebar visible so the user can navigate away.
-    if (res.status === 403) return { bucket, prefix, objects: EMPTY_PAGE, accessDenied: true as const };
+    if (res.status === 403)
+      return { bucket, prefix, objects: EMPTY_PAGE, accessDenied: true as const };
     const body = (await res.json().catch(() => ({}))) as { message?: string };
     throw error(res.status, body.message ?? 'Failed to load objects');
   }

From 028b4162bf9dcc61f88d97ffb9c1c86b51c8f3ab Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 3 Jun 2026 11:43:09 +0200
Subject: [PATCH 052/136] Filebrowser: Rename Stackable UI to Stackable Cockpit
 (#191)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* chore: Rename and cleanup (#188)

* rename container image and chart from stackable-ui to cockpit

* clean up files

* use env.IMAGE_NAME in chart-directory

* Rename: stackable-ui → stackable-cockpit (#190)

* rename: stackable-ui → stackable-cockpit

Rename all occurrences of the old repository name across source files:
- Package name: @stackable/stackable-ui → @stackable/stackable-cockpit
- Env var prefix: STACKABLE_UI_ → STACKABLE_COCKPIT_ (and PUBLIC_ variant)
- Service/client identifiers, Kubernetes secret names, and Trino usernames
- Log service label and X-Trino-Source header value
- Dev setup scripts and Helm/Kubernetes config

* rename: stackable-ui → stackable-cockpit

* rename: stackable-ui → stackable-cockpit

* rename: stackable-ui → stackable-cockpit in feature-branch additions

Complete the rename for files introduced in feat/s3-file-browser:
- dev/garage/garage.toml: tmp paths and e2e admin token
- dev/garage/templates/deployment.yaml: container mount path
- dev/setup.sh: Garage admin token in probe and setup commands; storage
  env vars (STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED and preview/pagination
  vars) added to both heredocs
- .github/workflows/pr_checks.yaml: Garage admin token
- .env.test: all STACKABLE_UI_ → STACKABLE_COCKPIT_ plus new storage/
  pagination vars renamed; Garage token value updated
- src/lib/server/feature-flags.ts: STACKABLE_UI_ → STACKABLE_COCKPIT_
  for all storage browser and preview-limit flags
- TECH_DEBT.md: update Helm chart path reference

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
---
 .claude/settings.json                         |   5 -
 .claude/skills/code-reviewer/SKILL.md         | 231 ------------------
 .env.example                                  |  30 +--
 .env.test                                     |  32 +--
 .github/workflows/build.yaml                  |   6 +-
 .github/workflows/pr_checks.yaml              |   2 +-
 .pre-commit-config.yaml                       |   4 +-
 README.md                                     |  10 +-
 TECH_DEBT.md                                  |   2 +-
 .../helm/{stackable-ui => cockpit}/Chart.yaml |   4 +-
 .../helm/{stackable-ui => cockpit}/README.md  |  18 +-
 .../templates/_helpers.tpl                    |  26 +-
 .../templates/configmap.yaml                  |   4 +-
 .../templates/deployment.yaml                 |  56 ++---
 .../templates/ingress.yaml                    |   6 +-
 deploy/helm/cockpit/templates/secret.yaml     |  11 +
 .../templates/service.yaml                    |   6 +-
 .../templates/serviceaccount.yaml             |   4 +-
 .../{stackable-ui => cockpit}/values.yaml     |  10 +-
 .../helm/stackable-ui/templates/secret.yaml   |  11 -
 dev/garage/garage.toml                        |   6 +-
 dev/garage/templates/deployment.yaml          |   2 +-
 dev/helm/values.yaml                          |   8 +-
 dev/setup.sh                                  |  91 ++++---
 dev/trino.yaml                                |   6 +-
 docker/Dockerfile                             |  10 +-
 e2e/trino/connection-form.spec.ts             |   2 +-
 package-lock.json                             |   4 +-
 package.json                                  |   2 +-
 src/lib/server/auth.ts                        |  18 +-
 src/lib/server/feature-flags.ts               |  24 +-
 src/lib/server/logging/logger.ts              |   2 +-
 src/lib/server/trino/client.ts                |  16 +-
 src/lib/server/trino/queries.ts               |   2 +-
 34 files changed, 217 insertions(+), 454 deletions(-)
 delete mode 100644 .claude/settings.json
 delete mode 100644 .claude/skills/code-reviewer/SKILL.md
 rename deploy/helm/{stackable-ui => cockpit}/Chart.yaml (83%)
 rename deploy/helm/{stackable-ui => cockpit}/README.md (90%)
 rename deploy/helm/{stackable-ui => cockpit}/templates/_helpers.tpl (77%)
 rename deploy/helm/{stackable-ui => cockpit}/templates/configmap.yaml (87%)
 rename deploy/helm/{stackable-ui => cockpit}/templates/deployment.yaml (79%)
 rename deploy/helm/{stackable-ui => cockpit}/templates/ingress.yaml (84%)
 create mode 100644 deploy/helm/cockpit/templates/secret.yaml
 rename deploy/helm/{stackable-ui => cockpit}/templates/service.yaml (65%)
 rename deploy/helm/{stackable-ui => cockpit}/templates/serviceaccount.yaml (71%)
 rename deploy/helm/{stackable-ui => cockpit}/values.yaml (96%)
 delete mode 100644 deploy/helm/stackable-ui/templates/secret.yaml

diff --git a/.claude/settings.json b/.claude/settings.json
deleted file mode 100644
index 90308884..00000000
--- a/.claude/settings.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "enabledPlugins": {
-    "frontend-design@claude-plugins-official": true
-  }
-}
diff --git a/.claude/skills/code-reviewer/SKILL.md b/.claude/skills/code-reviewer/SKILL.md
deleted file mode 100644
index 3a442372..00000000
--- a/.claude/skills/code-reviewer/SKILL.md
+++ /dev/null
@@ -1,231 +0,0 @@
----
-name: code-review
-description: Review TypeScript/SvelteKit code for bugs, security, maintainability, and duplication. Use when reviewing code changes, PRs, or checking code quality. Identifies duplicate utilities/components and suggests refactoring only when clearly beneficial.
-allowed-tools: Read, Grep, Glob
----
-
-# Code Review Skill
-
-Conduct thorough, constructive code reviews that identify issues and provide actionable recommendations. Read AGENTS.md for project conventions.
-
-## Stack
-
-- TypeScript
-- Svelte 5
-- SvelteKit
-- TailwindCSS 4
-- DaisyUI
-- Zod + Superforms for forms
-
-## Analysis Framework
-
-1. **Correctness**: Logic errors, type issues, edge cases, things that will break at runtime
-2. **Security**: Input validation, auth/authorisation flaws, data exposure risks, injection vulnerabilities
-3. **Accessibility (BITV 2.0)**: Semantic HTML, keyboard navigation, ARIA attributes, colour contrast, form labels, screen reader support
-4. **Browser compatibility**: Must work in Firefox and Chromium. Flag browser-specific APIs or CSS without fallbacks
-5. **Mobile friendliness**: Responsive layouts, touch targets, viewport behaviour
-6. **Duplication**: Code that duplicates existing utilities, components, or patterns in the codebase
-7. **Readability**: Naming, code organisation, adherence to established patterns
-8. **Maintainability**: Complexity, coupling, unnecessary abstractions, long-term sustainability
-
-## Review Process
-
-### 1. Understand Context
-
-- Read the changed files and understand their purpose
-- Check AGENTS.md for project conventions
-- If reviewing uncommitted changes, run `git diff` mentally to understand scope
-
-### 2. Check for Duplication
-
-Search the codebase before flagging duplicates using Grep and Glob tools.
-
-Common duplication areas:
-
-- Date formatting functions
-- API call wrappers
-- Form validation helpers
-- Data transformations
-- Error handling patterns
-
-### 3. Component Extraction Guidelines
-
-**Create components ONLY when:**
-
-- Code is reused in 2+ places
-- Complex logic benefits from isolation for readability
-- NOT for simple markup that appears once
-
-### 4. Code Quality Checks
-
-**Correctness:**
-
-- Edge cases: null, undefined, empty arrays handled?
-- Error handling present and reasonable?
-- Logic errors that will break at runtime?
-
-**Security:**
-
-- User input validated and sanitised?
-- Auth checks in place where needed?
-- Sensitive data not exposed to client?
-- No injection vectors (SQL, XSS, command)?
-
-**Readability:**
-
-- Clear variable/function names?
-- Logic understandable in 6 months?
-- Types actually useful or just `any` with extra steps?
-
-**Svelte/SvelteKit specific:**
-
-- Proper use of `$state`, `$derived`, `$effect`?
-- Server vs client code separation makes sense?
-- Superforms used correctly with Zod schemas?
-- Zod schemas defined once, not duplicated?
-
-**Logging (server-side code only):**
-
-- Server-side load functions, API endpoints, and hooks should include logging at appropriate levels
-- Uses `event.locals.logger` (request-scoped) in request handlers, not the root `logger` import
-- Module-level singletons/services use `logger.child({ module: '...' })`, not bare `console.log`
-- Context object first, message string second: `log.info({ user_id }, 'User logged in')`
-- Field names use snake_case consistently (`request_id`, `user_id`, `duration_ms`, `status_code`) — not camelCase variants
-- Tokens, credentials, passwords, or full request/session objects are never logged directly
-- If new sensitive fields are logged, redaction paths should be added to `src/lib/server/logging/redaction.ts`
-- No leftover `console.log`/`console.error` in server code (use pino logger instead)
-
-**Accessibility (BITV 2.0 / WCAG 2.1 AA):**
-
-- Semantic HTML elements used (`<nav>`, `<main>`, `<button>`, `<a>`, correct heading levels)?
-- `<div>`/`<span>` used as interactive elements without `role` and keyboard handling?
-- Every form control has an associated `<label>` with `for`/`id`?
-- Images have meaningful `alt` text (or `alt=""` for decorative)?
-- Keyboard-only navigation works (focus order, visible focus indicators)?
-- ARIA attributes correct and not redundant with semantic HTML?
-- Colour contrast sufficient (4.5:1 normal text, 3:1 large text)?
-- Information not conveyed through colour alone?
-
-**Internationalisation:**
-
-- User-visible strings not wrapped in `m.*()` calls (text content, aria-labels, title attributes, placeholder text)?
-- Missing translations — new `m.*()` keys used but not present in both `messages/en.json` and `messages/de.json`?
-- Reactive data structures containing translated strings not using `$derived`?
-
-**Browser compatibility & mobile:**
-
-- Any Firefox-incompatible APIs or CSS (e.g., `isMobile` in Playwright, webkit-only features)?
-- Responsive layout works at mobile widths (393px+)?
-- Touch targets large enough (minimum 44x44px for WCAG)?
-
-### 5. Anti-patterns to Flag
-
-- Nested ternaries (more than 2 levels)
-- Functions longer than ~50 lines without clear sections
-- Prop drilling more than 2 levels deep
-- Magic numbers/strings without constants
-- Commented-out code (remove it)
-- `console.log`/`console.error` in server-side code (use pino logger)
-- Root `logger` import used inside request handlers instead of `event.locals.logger`
-- Logging sensitive data (tokens, passwords, full session objects) without redaction
-- Inconsistent field naming in log context (camelCase vs snake_case)
-- Hard-coded colours instead of DaisyUI semantic classes
-- Hardcoded user-facing strings in `.svelte` files instead of using `m.*()` from Paraglide
-
-## What NOT to Flag
-
-- Formatting/linting (handled by tools)
-- Micro-optimizations
-- Personal style preferences (unless it hurts readability)
-- Missing comments (code should be self-documenting)
-
-## Output Format
-
-Prioritise issues by severity: critical > important > minor. Only include sections that have findings — skip empty sections.
-
-```markdown
-# Code Review Report
-
-## Critical Issues
-
-[Bugs, security vulnerabilities, things that will break]
-
-- **File**: path/to/file.ts:42
-- **Issue**: Describe the problem
-- **Impact**: What happens if this ships
-
-## Security Notes
-
-[Auth flaws, input validation gaps, data exposure risks]
-
-- **File**: path/to/file.ts:15
-- **Risk**: Describe the vulnerability
-- **Recommendation**: How to fix it
-
-## Accessibility Issues
-
-[BITV 2.0 / WCAG 2.1 AA violations]
-
-- **File**: path/to/file.svelte:20
-- **Violation**: Missing label, wrong element, keyboard trap, contrast, etc.
-- **Fix**: How to resolve it
-
-## Browser / Mobile Issues
-
-[Cross-browser problems, responsive layout failures, touch target issues]
-
-- **File**: path/to/file.svelte:30
-- **Problem**: What breaks and where
-- **Fix**: How to resolve it
-
-## Logging Issues
-
-[Missing logging, wrong logger used, sensitive data exposure, inconsistent field names]
-
-- **File**: path/to/file.ts:20
-- **Issue**: Describe the logging problem
-- **Fix**: How to resolve it
-
-## Duplication Found
-
-[Existing code that could be reused, with exact file paths]
-
-- **Duplicate in**: path/to/new-code.ts:15-30
-- **Existing**: path/to/existing-util.ts:42-50
-- **Action**: Use existing function instead
-
-## Maintainability Concerns
-
-[Hard to read, confusing logic, unclear intent, unnecessary complexity]
-
-- **File**: path/to/file.ts:100
-- **Problem**: Describe what's confusing
-- **Suggestion**: How to improve it
-
-## Positive Observations
-
-[Well-implemented aspects worth noting — good patterns, clean logic, smart decisions]
-
-## Verdict
-
-[One paragraph: overall assessment, main action items, ready to merge or needs work]
-```
-
-## Guidelines
-
-- Be direct and honest — flag real problems, not nitpicks
-- If something is broken, say it's broken
-- If code is fine, say it's fine (don't invent issues)
-- Focus on "why" not just "what" — provide reasoning
-- Include specific file paths and line numbers
-- Highlight good practices too, not just problems
-- Don't modify code — report only
-
-## Workflow
-
-1. Read the changed files using Read tool
-2. Search for similar patterns using Grep and Glob
-3. Check for existing utilities/components
-4. Assess security considerations
-5. Identify actual problems (not theoretical ones)
-6. Write report with actionable findings
diff --git a/.env.example b/.env.example
index ad4aa269..1181a570 100644
--- a/.env.example
+++ b/.env.example
@@ -1,35 +1,35 @@
 # A long random secret used to sign sessions and tokens (min 32 characters)
-STACKABLE_UI_SESSION_SECRET=change-me-to-a-long-random-secret-min-32-chars
+STACKABLE_COCKPIT_SESSION_SECRET=change-me-to-a-long-random-secret-min-32-chars
 
 # The publicly accessible base URL of this application
-STACKABLE_UI_BASE_URL=http://localhost:5173
+STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
 
 # OIDC discovery URL (Keycloak, Entra ID, or any compliant OIDC provider)
-STACKABLE_UI_OIDC_DISCOVERY_URL=https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
+STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=https://your-idp.example.com/realms/your-realm/.well-known/openid-configuration
 
 # The client ID and secret registered in your OIDC provider
-STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
-STACKABLE_UI_OIDC_CLIENT_SECRET=your-client-secret
+STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
+STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 
 # OIDC claim used as the username for Trino impersonation (default: preferred_username)
-# STACKABLE_UI_OIDC_USERNAME_CLAIM=preferred_username
+# STACKABLE_COCKPIT_OIDC_USERNAME_CLAIM=preferred_username
 
 
 # Logging
 # LOG_LEVEL=debug    # Minimum log level (debug, info, warn, error). Default: debug in dev, info in prod.
 # LOG_PRETTY=true    # Human-readable log output. Default: true in dev, false in prod.
-# LOG_JSON_FILE=/var/log/stackable-ui/app.log  # Optional: also write JSON logs to this file (for Vector aggregation).
+# LOG_JSON_FILE=/var/log/stackable-cockpit/app.log  # Optional: also write JSON logs to this file (for Vector aggregation).
 
 # Optional: Pre-configure the Trino connection for all users.
-# When STACKABLE_UI_TRINO_URL is set, the connection form is hidden and
+# When STACKABLE_COCKPIT_TRINO_URL is set, the connection form is hidden and
 # the specified Trino endpoint is used automatically. Per-user X-Trino-User
 # impersonation is still applied via the OIDC username.
-# STACKABLE_UI_TRINO_URL=https://trino.example.com:8443
-# STACKABLE_UI_TRINO_AUTH_TYPE=basic       # "none" (default) or "basic"
-# STACKABLE_UI_TRINO_AUTH_USERNAME=service-account
-# STACKABLE_UI_TRINO_AUTH_PASSWORD=secret
-# STACKABLE_UI_TRINO_TLS_INSECURE=false    # Set to "true" to skip TLS certificate verification
-# STACKABLE_UI_TRINO_TLS_CA_CERT=/path/to/ca.pem  # Custom CA certificate file
+# STACKABLE_COCKPIT_TRINO_URL=https://trino.example.com:8443
+# STACKABLE_COCKPIT_TRINO_AUTH_TYPE=basic       # "none" (default) or "basic"
+# STACKABLE_COCKPIT_TRINO_AUTH_USERNAME=service-account
+# STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD=secret
+# STACKABLE_COCKPIT_TRINO_TLS_INSECURE=false    # Set to "true" to skip TLS certificate verification
+# STACKABLE_COCKPIT_TRINO_TLS_CA_CERT=/path/to/ca.pem  # Custom CA certificate file
 
 # Feature flags
-# STACKABLE_UI_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
+# STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
diff --git a/.env.test b/.env.test
index 8939082a..7e822f9c 100644
--- a/.env.test
+++ b/.env.test
@@ -1,18 +1,18 @@
-STACKABLE_UI_OIDC_CLIENT_ID=mock-client
-STACKABLE_UI_OIDC_CLIENT_SECRET=mock-secret
-STACKABLE_UI_OIDC_DISCOVERY_URL=http://localhost:9090/.well-known/openid-configuration
-STACKABLE_UI_SESSION_SECRET=e2e-test-session-secret-that-is-long-enough
-STACKABLE_UI_BASE_URL=http://localhost:4173
-STACKABLE_UI_TRINO_URL=http://localhost:8080
-STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
+STACKABLE_COCKPIT_OIDC_CLIENT_ID=mock-client
+STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=mock-secret
+STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=http://localhost:9090/.well-known/openid-configuration
+STACKABLE_COCKPIT_SESSION_SECRET=e2e-test-session-secret-that-is-long-enough
+STACKABLE_COCKPIT_BASE_URL=http://localhost:4173
+STACKABLE_COCKPIT_TRINO_URL=http://localhost:8080
+STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
 ORIGIN=http://localhost:4173
-STACKABLE_UI_TEXT_PREVIEW_BYTES=262144
-STACKABLE_UI_IMAGE_PREVIEW_BYTES=5242880
-STACKABLE_UI_PDF_PREVIEW_BYTES=26214400
-STACKABLE_UI_FILE_PREVIEW_ROWS=250
-PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
-PUBLIC_STACKABLE_UI_PAGE_SIZES=25,50,100
-PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE=25
-PUBLIC_STACKABLE_UI_MAX_RECENT_FILES=15
+STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
+STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
+STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 GARAGE_ADMIN_URL=http://localhost:30902
-GARAGE_ADMIN_TOKEN=stackable-ui-e2e-admin-token
+GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6bca3d83..31ebe7d1 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,5 +1,5 @@
 ---
-name: Build Stackable UI Container Image
+name: Build Cockpit Container Image
 
 permissions:
   contents: read
@@ -19,7 +19,7 @@ on:
   merge_group:
 
 env:
-  IMAGE_NAME: 'stackable-ui'
+  IMAGE_NAME: 'cockpit'
 
 jobs:
   detect-changes:
@@ -180,7 +180,7 @@ jobs:
           chart-registry-username: robot$sdp-charts+github-action-build
           chart-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
           chart-repository: sdp-charts
-          chart-directory: deploy/helm/stackable-ui
+          chart-directory: deploy/helm/${{ env.IMAGE_NAME }}
           chart-version: ${{ needs.build-container-image.outputs.image-version }}
           app-version: ${{ needs.build-container-image.outputs.image-version }}
 
diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index 14a448ab..e675cd69 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -137,7 +137,7 @@ jobs:
             sleep 1
           done
 
-          GARAGE_ADMIN_TOKEN='stackable-ui-e2e-admin-token' \
+          GARAGE_ADMIN_TOKEN='stackable-cockpit-e2e-admin-token' \
             S3_ENDPOINT='http://localhost:3900' \
             S3_CONFIG_PATH="$PWD/s3-config.json" \
             ./e2e/init-garage-s3.sh
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c2dd1aab..8d68075c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -64,7 +64,7 @@ repos:
       - id: helm-lint
         name: helm lint
         language: system
-        entry: helm lint deploy/helm/stackable-ui
+        entry: helm lint deploy/helm/cockpit
         stages: [pre-commit, pre-merge-commit]
         pass_filenames: false
         files: ^deploy/helm/
@@ -74,7 +74,7 @@ repos:
         language: system
         entry: >-
           bash -c '
-          helm template test deploy/helm/stackable-ui
+          helm template test deploy/helm/cockpit
           --set auth.oidc.discoveryUrl=https://stub
           --set auth.oidc.clientId=stub
           --set auth.oidc.clientSecret.secretKeyRef.name=stub > /dev/null'
diff --git a/README.md b/README.md
index 7afc1c62..5ce65fb3 100644
--- a/README.md
+++ b/README.md
@@ -82,16 +82,16 @@ The application includes a Helm chart for deploying to Kubernetes.
 
 ```bash
 # Install with default values
-helm install stackable-ui ./deploy/helm/stackable-ui
+helm install cockpit ./deploy/helm/cockpit
 
 # Install with custom configuration
-helm install stackable-ui ./deploy/helm/stackable-ui \
+helm install cockpit ./deploy/helm/cockpit \
   -f your-values.yaml
 ```
 
 #### Documentation
 
-For detailed Helm chart documentation, see [deploy/helm/stackable-ui/README.md](./deploy/helm/stackable-ui/README.md).
+For detailed Helm chart documentation, see [deploy/helm/cockpit/README.md](./deploy/helm/cockpit/README.md).
 
 ### Docker Deployment
 
@@ -99,10 +99,10 @@ Build and run the Docker image:
 
 ```bash
 # Build the image
-docker build . -f docker/Dockerfile --build-arg TARGETARCH=x86 --build-arg VERSION=0.0.0-dev -t stackable-ui:0.0.0-dev
+docker build . -f docker/Dockerfile --build-arg TARGETARCH=x86 --build-arg VERSION=0.0.0-dev -t cockpit:0.0.0-dev
 
 # Run the container
-docker run -p 3000:3000 stackable-ui:0.0.0-dev
+docker run -p 3000:3000 cockpit:0.0.0-dev
 ```
 
 ## Configuration
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 1f8fb6d4..d21111ed 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -146,6 +146,6 @@ The upload endpoint imposes no maximum file size. S3's 5 TB single-object limit
 
 ### No `/readyz` endpoint — readiness uses the trivial liveness probe
 
-**File:** `src/routes/healthz/+server.ts`, `deploy/helm/stackable-ui/values.yaml`
+**File:** `src/routes/healthz/+server.ts`, `deploy/helm/cockpit/values.yaml`
 
 Both `livenessProbe` and `readinessProbe` point at `/healthz`, which always returns 200. There is currently nothing meaningful to gate readiness on (better-auth uses an in-memory session store, OIDC discovery is fetched lazily on first auth call), so a separate `/readyz` would just be a placeholder. Once one of these lands — a real session store / DB, eager OIDC discovery, or a startup-time cache warm — split into `/healthz` (liveness, trivial) and `/readyz` (readiness, checking the new dependency), and update the helm probes accordingly.
diff --git a/deploy/helm/stackable-ui/Chart.yaml b/deploy/helm/cockpit/Chart.yaml
similarity index 83%
rename from deploy/helm/stackable-ui/Chart.yaml
rename to deploy/helm/cockpit/Chart.yaml
index 6bb7cdd6..8c0a42db 100644
--- a/deploy/helm/stackable-ui/Chart.yaml
+++ b/deploy/helm/cockpit/Chart.yaml
@@ -1,13 +1,13 @@
 ---
 apiVersion: v2
-name: stackable-ui
+name: cockpit
 description: Unified data platform UI for Stackable's data infrastructure
 type: application
 version: 0.0.0-dev
 appVersion: "0.0.0-dev"
 home: https://stackable.tech
 sources:
-  - https://github.com/stackabletech/stackable-ui
+  - https://github.com/stackabletech/cockpit
 maintainers:
   - name: Stackable GmbH
     email: info@stackable.tech
diff --git a/deploy/helm/stackable-ui/README.md b/deploy/helm/cockpit/README.md
similarity index 90%
rename from deploy/helm/stackable-ui/README.md
rename to deploy/helm/cockpit/README.md
index 156e3761..d692e04c 100644
--- a/deploy/helm/stackable-ui/README.md
+++ b/deploy/helm/cockpit/README.md
@@ -1,6 +1,6 @@
-# Stackable UI Helm Chart
+# Cockpit Helm Chart
 
-This Helm chart deploys the Stackable Unified Data Platform UI on Kubernetes.
+This Helm chart deploys the Stackable Data Platform (SDP) Cockpit UI on Kubernetes.
 
 ## Requirements
 
@@ -12,32 +12,32 @@ This Helm chart deploys the Stackable Unified Data Platform UI on Kubernetes.
 ### Basic Installation
 
 ```bash
-helm install stackable-ui ./deploy/helm/stackable-ui
+helm install cockpit ./deploy/helm/cockpit
 ```
 
 ### Installation with Custom Values
 
 ```bash
-helm install stackable-ui ./deploy/helm/stackable-ui \
+helm install cockpit ./deploy/helm/cockpit \
   --set image.tag=0.0.0-dev
 ```
 
 ### Installation with Values File
 
 ```bash
-helm install stackable-ui ./deploy/helm/stackable-ui \
+helm install cockpit ./deploy/helm/cockpit \
   -f my-values.yaml
 ```
 
 ## Uninstalling the Chart
 
 ```bash
-helm uninstall stackable-ui
+helm uninstall cockpit
 ```
 
 ## Configuration
 
-The following table lists the configurable parameters of the Stackable UI chart and their default values.
+The following table lists the configurable parameters of the Cockpit chart and their default values.
 
 ### Global Parameters
 
@@ -45,7 +45,7 @@ The following table lists the configurable parameters of the Stackable UI chart
 | --- | --- | --- |
 | `replicaCount` | Number of replicas | `1` |
 | `image.registry` | Container image registry | `oci.stackable.tech` |
-| `image.repository` | Container image repository | `sdp/stackable-ui` |
+| `image.repository` | Container image repository | `sdp/cockpit` |
 | `image.pullPolicy` | Image pull policy | `IfNotPresent` |
 | `image.tag` | Image tag (overrides appVersion) | `""` |
 | `nameOverride` | String to partially override fullname | `""` |
@@ -144,6 +144,6 @@ Optional pre-configured Trino endpoint. When `trino.url` is set, the in-app conn
 
 For issues and questions:
 
-- GitHub: <https://github.com/stackabletech/stackable-ui/issues>
+- GitHub: <https://github.com/stackabletech/cockpit/issues>
 - Documentation: <https://docs.stackable.tech/>
 - Email: <info@stackable.tech>
diff --git a/deploy/helm/stackable-ui/templates/_helpers.tpl b/deploy/helm/cockpit/templates/_helpers.tpl
similarity index 77%
rename from deploy/helm/stackable-ui/templates/_helpers.tpl
rename to deploy/helm/cockpit/templates/_helpers.tpl
index dacc03f1..ea08d32d 100644
--- a/deploy/helm/stackable-ui/templates/_helpers.tpl
+++ b/deploy/helm/cockpit/templates/_helpers.tpl
@@ -1,7 +1,7 @@
 {{/*
 Expand the name of the chart.
 */}}
-{{- define "stackable-ui.name" -}}
+{{- define "cockpit.name" -}}
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
@@ -10,7 +10,7 @@ Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 If release name contains chart name it will be used as a full name.
 */}}
-{{- define "stackable-ui.fullname" -}}
+{{- define "cockpit.fullname" -}}
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
@@ -26,16 +26,16 @@ If release name contains chart name it will be used as a full name.
 {{/*
 Create chart name and version as used by the chart label.
 */}}
-{{- define "stackable-ui.chart" -}}
+{{- define "cockpit.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Common labels
 */}}
-{{- define "stackable-ui.labels" -}}
-helm.sh/chart: {{ include "stackable-ui.chart" . }}
-{{ include "stackable-ui.selectorLabels" . }}
+{{- define "cockpit.labels" -}}
+helm.sh/chart: {{ include "cockpit.chart" . }}
+{{ include "cockpit.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
@@ -46,8 +46,8 @@ stackable.tech/vendor: stackable
 {{/*
 Selector labels
 */}}
-{{- define "stackable-ui.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "stackable-ui.name" . }}
+{{- define "cockpit.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "cockpit.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 app.kubernetes.io/component: ui
 {{- end }}
@@ -55,16 +55,16 @@ app.kubernetes.io/component: ui
 {{/*
 Create the name of the service account to use
 */}}
-{{- define "stackable-ui.serviceAccountName" -}}
+{{- define "cockpit.serviceAccountName" -}}
 {{- if .Values.serviceAccount.create }}
-{{- default (include "stackable-ui.fullname" .) .Values.serviceAccount.name }}
+{{- default (include "cockpit.fullname" .) .Values.serviceAccount.name }}
 {{- else }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
 
-{{- define "stackable-ui.sessionSecret" -}}
-{{- $existing := lookup "v1" "Secret" .Release.Namespace (include "stackable-ui.fullname" .) }}
+{{- define "cockpit.sessionSecret" -}}
+{{- $existing := lookup "v1" "Secret" .Release.Namespace (include "cockpit.fullname" .) }}
 {{- if and $existing $existing.data (index $existing.data "session-secret") }}
 {{- index $existing.data "session-secret" | b64dec }}
 {{- else }}
@@ -75,7 +75,7 @@ Create the name of the service account to use
 {{/*
 Image name
 */}}
-{{- define "stackable-ui.image" -}}
+{{- define "cockpit.image" -}}
 {{- if .Values.image.registry }}
 {{- printf "%s/%s:%s" .Values.image.registry .Values.image.repository (.Values.image.tag | default .Chart.AppVersion) }}
 {{- else }}
diff --git a/deploy/helm/stackable-ui/templates/configmap.yaml b/deploy/helm/cockpit/templates/configmap.yaml
similarity index 87%
rename from deploy/helm/stackable-ui/templates/configmap.yaml
rename to deploy/helm/cockpit/templates/configmap.yaml
index 678733a2..7df6c989 100644
--- a/deploy/helm/stackable-ui/templates/configmap.yaml
+++ b/deploy/helm/cockpit/templates/configmap.yaml
@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "stackable-ui.fullname" . }}
+  name: {{ include "cockpit.fullname" . }}
   labels:
-    {{- include "stackable-ui.labels" . | nindent 4 }}
+    {{- include "cockpit.labels" . | nindent 4 }}
 data:
   base-url: {{ .Values.auth.baseUrl | quote }}
   {{- with .Values.origin }}
diff --git a/deploy/helm/stackable-ui/templates/deployment.yaml b/deploy/helm/cockpit/templates/deployment.yaml
similarity index 79%
rename from deploy/helm/stackable-ui/templates/deployment.yaml
rename to deploy/helm/cockpit/templates/deployment.yaml
index f0c62ef8..df826e9f 100644
--- a/deploy/helm/stackable-ui/templates/deployment.yaml
+++ b/deploy/helm/cockpit/templates/deployment.yaml
@@ -1,14 +1,14 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "stackable-ui.fullname" . }}
+  name: {{ include "cockpit.fullname" . }}
   labels:
-    {{- include "stackable-ui.labels" . | nindent 4 }}
+    {{- include "cockpit.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
   selector:
     matchLabels:
-      {{- include "stackable-ui.selectorLabels" . | nindent 6 }}
+      {{- include "cockpit.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       annotations:
@@ -18,7 +18,7 @@ spec:
         {{- toYaml . | nindent 8 }}
         {{- end }}
       labels:
-        {{- include "stackable-ui.labels" . | nindent 8 }}
+        {{- include "cockpit.labels" . | nindent 8 }}
         {{- with .Values.podLabels }}
         {{- toYaml . | nindent 8 }}
         {{- end }}
@@ -27,7 +27,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "stackable-ui.serviceAccountName" . }}
+      serviceAccountName: {{ include "cockpit.serviceAccountName" . }}
       {{- with .Values.terminationGracePeriodSeconds }}
       terminationGracePeriodSeconds: {{ . }}
       {{- end }}
@@ -37,7 +37,7 @@ spec:
         - name: {{ .Chart.Name }}
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: {{ include "stackable-ui.image" . }}
+          image: {{ include "cockpit.image" . }}
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: http
@@ -58,39 +58,39 @@ spec:
               value: {{ .Values.config.nodeEnv | quote }}
             - name: PORT
               value: {{ .Values.service.targetPort | quote }}
-            - name: STACKABLE_UI_COMPLETION_ENABLED
+            - name: STACKABLE_COCKPIT_COMPLETION_ENABLED
               value: {{ .Values.features.trino.completion.enabled | quote }}
             {{- if .Values.logging.level }}
             - name: LOG_LEVEL
               value: {{ .Values.logging.level | quote }}
             {{- end }}
-            - name: STACKABLE_UI_SESSION_SECRET
+            - name: STACKABLE_COCKPIT_SESSION_SECRET
               valueFrom:
                 secretKeyRef:
                   {{- if .Values.sessionSecret.secretKeyRef.name }}
                   name: {{ .Values.sessionSecret.secretKeyRef.name | quote }}
                   key: {{ .Values.sessionSecret.secretKeyRef.key | quote }}
                   {{- else }}
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: session-secret
                   {{- end }}
             {{- if .Values.auth.oidc.enabled }}
-            - name: STACKABLE_UI_OIDC_CLIENT_SECRET
+            - name: STACKABLE_COCKPIT_OIDC_CLIENT_SECRET
               valueFrom:
                 secretKeyRef:
                   name: {{ required "auth.oidc.clientSecret.secretKeyRef.name is required when OIDC is enabled" .Values.auth.oidc.clientSecret.secretKeyRef.name | quote }}
                   key: {{ .Values.auth.oidc.clientSecret.secretKeyRef.key | quote }}
             {{- end }}
-            - name: STACKABLE_UI_BASE_URL
+            - name: STACKABLE_COCKPIT_BASE_URL
               valueFrom:
                 configMapKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: base-url
             {{- if .Values.origin }}
             - name: ORIGIN
               valueFrom:
                 configMapKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: origin
             {{- end }}
             {{- with .Values.proxy.protocolHeader }}
@@ -102,56 +102,56 @@ spec:
               value: {{ . | quote }}
             {{- end }}
             {{- if .Values.auth.oidc.enabled }}
-            - name: STACKABLE_UI_OIDC_DISCOVERY_URL
+            - name: STACKABLE_COCKPIT_OIDC_DISCOVERY_URL
               valueFrom:
                 configMapKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: oidc-discovery-url
-            - name: STACKABLE_UI_OIDC_CLIENT_ID
+            - name: STACKABLE_COCKPIT_OIDC_CLIENT_ID
               valueFrom:
                 configMapKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: oidc-client-id
-            - name: STACKABLE_UI_OIDC_USERNAME_CLAIM
+            - name: STACKABLE_COCKPIT_OIDC_USERNAME_CLAIM
               value: {{ .Values.auth.oidc.usernameClaim | quote }}
             {{- end }}
             {{- if .Values.trino.url }}
-            - name: STACKABLE_UI_TRINO_URL
+            - name: STACKABLE_COCKPIT_TRINO_URL
               valueFrom:
                 configMapKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: trino-url
             {{- end }}
             {{- if .Values.trino.auth.type }}
-            - name: STACKABLE_UI_TRINO_AUTH_TYPE
+            - name: STACKABLE_COCKPIT_TRINO_AUTH_TYPE
               valueFrom:
                 configMapKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: trino-auth-type
             {{- end }}
             {{- if .Values.trino.auth.username }}
-            - name: STACKABLE_UI_TRINO_AUTH_USERNAME
+            - name: STACKABLE_COCKPIT_TRINO_AUTH_USERNAME
               valueFrom:
                 configMapKeyRef:
-                  name: {{ include "stackable-ui.fullname" . }}
+                  name: {{ include "cockpit.fullname" . }}
                   key: trino-auth-username
             {{- end }}
             {{- if eq .Values.trino.auth.type "basic" }}
-            - name: STACKABLE_UI_TRINO_AUTH_PASSWORD
+            - name: STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: {{ required "trino.auth.password.secretKeyRef.name is required for basic auth" .Values.trino.auth.password.secretKeyRef.name | quote }}
                   key: {{ .Values.trino.auth.password.secretKeyRef.key | quote }}
             {{- end }}
             {{- if .Values.trino.tls.insecure }}
-            - name: STACKABLE_UI_TRINO_TLS_INSECURE
+            - name: STACKABLE_COCKPIT_TRINO_TLS_INSECURE
               value: "true"
             {{- end }}
             {{- if .Values.trino.tls.caCert }}
-            - name: STACKABLE_UI_TRINO_TLS_CA_CERT
+            - name: STACKABLE_COCKPIT_TRINO_TLS_CA_CERT
               value: {{ .Values.trino.tls.caCert | quote }}
             {{- else if .Values.trino.tls.secretClass }}
-            - name: STACKABLE_UI_TRINO_TLS_CA_CERT
+            - name: STACKABLE_COCKPIT_TRINO_TLS_CA_CERT
               value: /stackable/trino-tls/ca.crt
             {{- end }}
           volumeMounts:
diff --git a/deploy/helm/stackable-ui/templates/ingress.yaml b/deploy/helm/cockpit/templates/ingress.yaml
similarity index 84%
rename from deploy/helm/stackable-ui/templates/ingress.yaml
rename to deploy/helm/cockpit/templates/ingress.yaml
index c3129ae1..4ae71a49 100644
--- a/deploy/helm/stackable-ui/templates/ingress.yaml
+++ b/deploy/helm/cockpit/templates/ingress.yaml
@@ -2,9 +2,9 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: {{ include "stackable-ui.fullname" . }}
+  name: {{ include "cockpit.fullname" . }}
   labels:
-    {{- include "stackable-ui.labels" . | nindent 4 }}
+    {{- include "cockpit.labels" . | nindent 4 }}
   {{- with .Values.ingress.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -33,7 +33,7 @@ spec:
             pathType: {{ .pathType }}
             backend:
               service:
-                name: {{ include "stackable-ui.fullname" $ }}
+                name: {{ include "cockpit.fullname" $ }}
                 port:
                   number: {{ $.Values.service.port }}
           {{- end }}
diff --git a/deploy/helm/cockpit/templates/secret.yaml b/deploy/helm/cockpit/templates/secret.yaml
new file mode 100644
index 00000000..3dd7d341
--- /dev/null
+++ b/deploy/helm/cockpit/templates/secret.yaml
@@ -0,0 +1,11 @@
+{{- if not .Values.sessionSecret.secretKeyRef.name }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "cockpit.fullname" . }}
+  labels:
+    {{- include "cockpit.labels" . | nindent 4 }}
+type: Opaque
+stringData:
+  session-secret: {{ include "cockpit.sessionSecret" . | quote }}
+{{- end }}
diff --git a/deploy/helm/stackable-ui/templates/service.yaml b/deploy/helm/cockpit/templates/service.yaml
similarity index 65%
rename from deploy/helm/stackable-ui/templates/service.yaml
rename to deploy/helm/cockpit/templates/service.yaml
index ac427650..2344e170 100644
--- a/deploy/helm/stackable-ui/templates/service.yaml
+++ b/deploy/helm/cockpit/templates/service.yaml
@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "stackable-ui.fullname" . }}
+  name: {{ include "cockpit.fullname" . }}
   labels:
-    {{- include "stackable-ui.labels" . | nindent 4 }}
+    {{- include "cockpit.labels" . | nindent 4 }}
   {{- with .Values.service.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
@@ -16,4 +16,4 @@ spec:
       protocol: TCP
       name: http
   selector:
-    {{- include "stackable-ui.selectorLabels" . | nindent 4 }}
+    {{- include "cockpit.selectorLabels" . | nindent 4 }}
diff --git a/deploy/helm/stackable-ui/templates/serviceaccount.yaml b/deploy/helm/cockpit/templates/serviceaccount.yaml
similarity index 71%
rename from deploy/helm/stackable-ui/templates/serviceaccount.yaml
rename to deploy/helm/cockpit/templates/serviceaccount.yaml
index 34a1be2e..5db5cfee 100644
--- a/deploy/helm/stackable-ui/templates/serviceaccount.yaml
+++ b/deploy/helm/cockpit/templates/serviceaccount.yaml
@@ -2,9 +2,9 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ include "stackable-ui.serviceAccountName" . }}
+  name: {{ include "cockpit.serviceAccountName" . }}
   labels:
-    {{- include "stackable-ui.labels" . | nindent 4 }}
+    {{- include "cockpit.labels" . | nindent 4 }}
   {{- with .Values.serviceAccount.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
diff --git a/deploy/helm/stackable-ui/values.yaml b/deploy/helm/cockpit/values.yaml
similarity index 96%
rename from deploy/helm/stackable-ui/values.yaml
rename to deploy/helm/cockpit/values.yaml
index 2632791a..8f6058aa 100644
--- a/deploy/helm/stackable-ui/values.yaml
+++ b/deploy/helm/cockpit/values.yaml
@@ -1,11 +1,11 @@
 ---
-# Default values for stackable-ui
+# Default values for cockpit
 
 replicaCount: 1
 
 image:
   registry: oci.stackable.tech
-  repository: sdp/stackable-ui
+  repository: sdp/cockpit
   pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
   tag: ""
@@ -58,14 +58,14 @@ ingress:
     # cert-manager.io/cluster-issuer: letsencrypt-prod
     # kubernetes.io/tls-acme: "true"
   hosts:
-    - host: stackable-ui.local
+    - host: cockpit.local
       paths:
         - path: /
           pathType: Prefix
   tls: []
-  #  - secretName: stackable-ui-tls
+  #  - secretName: cockpit-tls
   #    hosts:
-  #      - stackable-ui.local
+  #      - cockpit.local
 
 resources:
   limits:
diff --git a/deploy/helm/stackable-ui/templates/secret.yaml b/deploy/helm/stackable-ui/templates/secret.yaml
deleted file mode 100644
index 73a7b4e6..00000000
--- a/deploy/helm/stackable-ui/templates/secret.yaml
+++ /dev/null
@@ -1,11 +0,0 @@
-{{- if not .Values.sessionSecret.secretKeyRef.name }}
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "stackable-ui.fullname" . }}
-  labels:
-    {{- include "stackable-ui.labels" . | nindent 4 }}
-type: Opaque
-stringData:
-  session-secret: {{ include "stackable-ui.sessionSecret" . | quote }}
-{{- end }}
diff --git a/dev/garage/garage.toml b/dev/garage/garage.toml
index 3b70aef8..f9451554 100644
--- a/dev/garage/garage.toml
+++ b/dev/garage/garage.toml
@@ -1,5 +1,5 @@
-metadata_dir = "/tmp/stackable-ui/meta"
-data_dir = "/tmp/stackable-ui/data"
+metadata_dir = "/tmp/stackable-cockpit/meta"
+data_dir = "/tmp/stackable-cockpit/data"
 db_engine = "sqlite"
 
 replication_factor = 1
@@ -10,7 +10,7 @@ rpc_secret = "2eef98a70ab343ba9dadf3809f38d63a2333a9f38909a3f3d3f3d3f3d3f3d3f3"
 
 [admin]
 api_bind_addr = "[::]:3902"
-admin_token = "stackable-ui-e2e-admin-token"
+admin_token = "stackable-cockpit-e2e-admin-token"
 
 [s3_api]
 s3_region = "garage"
diff --git a/dev/garage/templates/deployment.yaml b/dev/garage/templates/deployment.yaml
index 46ca06a7..f5314750 100644
--- a/dev/garage/templates/deployment.yaml
+++ b/dev/garage/templates/deployment.yaml
@@ -40,7 +40,7 @@ spec:
               subPath: garage.toml
               readOnly: true
             - name: data
-              mountPath: /tmp/stackable-ui
+              mountPath: /tmp/stackable-cockpit
           readinessProbe:
             tcpSocket:
               port: 3900
diff --git a/dev/helm/values.yaml b/dev/helm/values.yaml
index 7483ed8a..8f2ac47a 100644
--- a/dev/helm/values.yaml
+++ b/dev/helm/values.yaml
@@ -3,20 +3,20 @@ auth:
   baseUrl: 'http://localhost:3000'
   oidc:
     discoveryUrl: 'http://172.18.0.2:30080/realms/stackable/.well-known/openid-configuration'
-    clientId: 'stackable-ui'
+    clientId: 'stackable-cockpit'
     clientSecret:
       secretKeyRef:
-        name: stackable-ui-credentials
+        name: stackable-cockpit-credentials
         key: oidc-client-secret
 
 trino:
   url: 'https://trino-coordinator-default-headless:8443'
   auth:
     type: 'basic'
-    username: 'stackable-ui'
+    username: 'stackable-cockpit'
     password:
       secretKeyRef:
-        name: stackable-ui-credentials
+        name: stackable-cockpit-credentials
         key: trino-auth-password
   tls:
     insecure: true
diff --git a/dev/setup.sh b/dev/setup.sh
index 2e2d2268..b6165566 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -17,7 +17,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 ENV_FILE="$PROJECT_DIR/.env.development"
 
-echo "=== Stackable UI dev environment setup ==="
+echo "=== Stackable Cockpit dev environment setup ==="
 if [[ "$SKIP_TRINO" == true ]]; then
   echo "(Trino deployment skipped via --skip-trino)"
 fi
@@ -127,7 +127,7 @@ if kcadm get realms/stackable --fields realm 2>/dev/null | grep -q '"stackable"'
   echo "Realm 'stackable' already exists, skipping Keycloak configuration."
   # Still need to fetch the client secret
   CLIENT_UUID=$(kcadm get clients -r stackable --fields id,clientId \
-    | grep -B1 '"stackable-ui"' | grep '"id"' | sed 's/.*: *"\(.*\)".*/\1/')
+    | grep -B1 '"stackable-cockpit"' | grep '"id"' | sed 's/.*: *"\(.*\)".*/\1/')
   SECRET=$(kcadm get clients/"$CLIENT_UUID"/client-secret -r stackable --fields value \
     | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
 else
@@ -143,10 +143,10 @@ else
     -s realm=stackable \
     -s enabled=true
 
-  echo "Creating client 'stackable-ui'..."
+  echo "Creating client 'stackable-cockpit'..."
   CLIENT_UUID=$(kcadm create clients \
     -r stackable \
-    -s clientId=stackable-ui \
+    -s clientId=stackable-cockpit \
     -s enabled=true \
     -s protocol=openid-connect \
     -s publicClient=false \
@@ -206,7 +206,7 @@ if [[ "$SKIP_GARAGE" == false ]]; then
   deadline=$(( $(date +%s) + 60 ))
   while [ -z "$GARAGE_BASE_URL" ] && [ "$(date +%s)" -lt "$deadline" ]; do
     for base in "http://${NODE_IP}:${GARAGE_ADMIN_PORT}" "http://127.0.0.1:${GARAGE_ADMIN_PORT}" "http://localhost:${GARAGE_ADMIN_PORT}"; do
-      if curl -sf --max-time 2 -H "Authorization: Bearer stackable-ui-e2e-admin-token" "${base}/v2/ListBuckets" >/dev/null 2>&1; then
+      if curl -sf --max-time 2 -H "Authorization: Bearer stackable-cockpit-e2e-admin-token" "${base}/v2/ListBuckets" >/dev/null 2>&1; then
         GARAGE_BASE_URL="$base"
         break
       fi
@@ -224,7 +224,7 @@ if [[ "$SKIP_GARAGE" == false ]]; then
   GARAGE_HOST=$(echo "$GARAGE_BASE_URL" | sed 's|http://||; s|:[0-9]*$||')
   GARAGE_S3_URL="http://${GARAGE_HOST}:${GARAGE_S3_PORT}"
 
-  GARAGE_ADMIN_TOKEN=stackable-ui-e2e-admin-token \
+  GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token \
     S3_ENDPOINT="$GARAGE_S3_URL" \
     GARAGE_ADMIN_URL="$GARAGE_BASE_URL" \
     S3_CONFIG_PATH="$PROJECT_DIR/s3-config.json" \
@@ -261,43 +261,42 @@ fi
 
 if [[ "$SKIP_TRINO" == false ]]; then
   cat > "$ENV_FILE" <<EOF
-STACKABLE_UI_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
-STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
-STACKABLE_UI_OIDC_CLIENT_SECRET=${SECRET}
-STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
-STACKABLE_UI_BASE_URL=http://localhost:5173
-STACKABLE_UI_TRINO_URL=${TRINO_BASE_URL}
-STACKABLE_UI_TRINO_AUTH_TYPE=basic
-STACKABLE_UI_TRINO_AUTH_USERNAME=stackable-ui
-STACKABLE_UI_TRINO_AUTH_PASSWORD=stackable-ui-dev
-STACKABLE_UI_TRINO_TLS_INSECURE=true
-STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
-STACKABLE_UI_TEXT_PREVIEW_BYTES=262144
-STACKABLE_UI_IMAGE_PREVIEW_BYTES=5242880
-STACKABLE_UI_PDF_PREVIEW_BYTES=26214400
-STACKABLE_UI_FILE_PREVIEW_ROWS=250
-PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
-PUBLIC_STACKABLE_UI_PAGE_SIZES=25,50,100
-PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE=25
-PUBLIC_STACKABLE_UI_MAX_RECENT_FILES=15
+STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
+STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
+STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=${SECRET}
+STACKABLE_COCKPIT_SESSION_SECRET=${SESSION_SECRET}
+STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
+STACKABLE_COCKPIT_TRINO_URL=${TRINO_BASE_URL}
+STACKABLE_COCKPIT_TRINO_AUTH_TYPE=basic
+STACKABLE_COCKPIT_TRINO_AUTH_USERNAME=stackable-cockpit
+STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD=stackable-cockpit-dev
+STACKABLE_COCKPIT_TRINO_TLS_INSECURE=true
+STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
+STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
+STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
+STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 EOF
 else
   cat > "$ENV_FILE" <<EOF
-STACKABLE_UI_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
-STACKABLE_UI_OIDC_CLIENT_ID=stackable-ui
-STACKABLE_UI_OIDC_CLIENT_SECRET=${SECRET}
-STACKABLE_UI_SESSION_SECRET=${SESSION_SECRET}
-STACKABLE_UI_BASE_URL=http://localhost:5173
-STACKABLE_UI_STORAGE_BROWSER_ENABLED=true
-STACKABLE_UI_TEXT_PREVIEW_BYTES=262144
-STACKABLE_UI_IMAGE_PREVIEW_BYTES=5242880
-STACKABLE_UI_PDF_PREVIEW_BYTES=26214400
-STACKABLE_UI_FILE_PREVIEW_ROWS=250
-PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true
-PUBLIC_STACKABLE_UI_PAGE_SIZES=25,50,100
-PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE=25
-PUBLIC_STACKABLE_UI_MAX_RECENT_FILES=15
-
+STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
+STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
+STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=${SECRET}
+STACKABLE_COCKPIT_SESSION_SECRET=${SESSION_SECRET}
+STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
+STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
+STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
+STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
+STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 EOF
 fi
 
@@ -307,11 +306,11 @@ echo "Wrote $ENV_FILE"
 # 9. Create Kubernetes Secret for the Helm chart
 # ------------------------------------------------------------------
 echo ""
-echo "Creating stackable-ui-credentials Secret..."
-kubectl delete secret stackable-ui-credentials --ignore-not-found
-kubectl create secret generic stackable-ui-credentials \
+echo "Creating stackable-cockpit-credentials Secret..."
+kubectl delete secret stackable-cockpit-credentials --ignore-not-found
+kubectl create secret generic stackable-cockpit-credentials \
   --from-literal=oidc-client-secret="$SECRET" \
-  --from-literal=trino-auth-password=stackable-ui-dev
+  --from-literal=trino-auth-password=stackable-cockpit-dev
 
 # ------------------------------------------------------------------
 # 10. Wait for Trino to be ready
@@ -338,10 +337,10 @@ echo ""
 if [[ "$SKIP_TRINO" == false ]]; then
   echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
   echo ""
-  echo "Trino connection is pre-configured via STACKABLE_UI_TRINO_* env vars."
+  echo "Trino connection is pre-configured via STACKABLE_COCKPIT_TRINO_* env vars."
   echo ""
 else
-  echo "Trino was skipped. Add STACKABLE_UI_TRINO_* vars to $ENV_FILE manually when ready."
+  echo "Trino was skipped. Add STACKABLE_COCKPIT_TRINO_* vars to $ENV_FILE manually when ready."
   echo ""
 fi
 if [[ "$SKIP_GARAGE" == false ]]; then
diff --git a/dev/trino.yaml b/dev/trino.yaml
index 651ce20e..e04cfce7 100644
--- a/dev/trino.yaml
+++ b/dev/trino.yaml
@@ -5,8 +5,8 @@ metadata:
   name: trino-static-users
   namespace: default
 stringData:
-  # Service account used by Stackable UI to connect to Trino.
-  stackable-ui: stackable-ui-dev
+  # Service account used by Stackable Cockpit to connect to Trino.
+  stackable-cockpit: stackable-cockpit-dev
 ---
 apiVersion: authentication.stackable.tech/v1alpha1
 kind: AuthenticationClass
@@ -64,7 +64,7 @@ data:
     {
       "impersonation": [
         {
-          "original_user": "stackable-ui",
+          "original_user": "stackable-cockpit",
           "new_user": ".*",
           "allow": true
         }
diff --git a/docker/Dockerfile b/docker/Dockerfile
index bcd92b3b..52020e71 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -61,8 +61,8 @@ COPY svelte.config.js tsconfig.json vite.config.ts ./
 # Build the application. The dummy env vars let better-auth initialise during
 # SSR prerender; they are scoped to this single RUN and discarded with the
 # builder stage.
-RUN STACKABLE_UI_SESSION_SECRET="build-time-placeholder" \
-    STACKABLE_UI_BASE_URL="http://localhost:3000" \
+RUN STACKABLE_COCKPIT_SESSION_SECRET="build-time-placeholder" \
+    STACKABLE_COCKPIT_BASE_URL="http://localhost:3000" \
     npm run build
 
 #
@@ -84,7 +84,7 @@ RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev --ignore-scripts
 FROM prod-deps AS sbom
 
 RUN npm ls --omit=dev && \
-    npx @cyclonedx/cyclonedx-npm --omit dev --output-file /build/stackable-ui.cdx.json
+    npx @cyclonedx/cyclonedx-npm --omit dev --output-file /build/cockpit.cdx.json
 
 #
 # Production stage - minimal runtime image
@@ -118,7 +118,7 @@ WORKDIR /stackable/app
 COPY --from=builder   --chown=${STACKABLE_USER_UID}:0 /build/build ./build
 COPY --from=prod-deps --chown=${STACKABLE_USER_UID}:0 /build/node_modules ./node_modules
 COPY --from=prod-deps --chown=${STACKABLE_USER_UID}:0 /build/package.json ./
-COPY --from=sbom      --chown=${STACKABLE_USER_UID}:0 /build/stackable-ui.cdx.json ./stackable-ui.cdx.json
+COPY --from=sbom      --chown=${STACKABLE_USER_UID}:0 /build/cockpit.cdx.json ./cockpit.cdx.json
 COPY --chown=${STACKABLE_USER_UID}:0 LICENSE /licenses/LICENSE
 RUN chmod -R g=u /stackable/app
 
@@ -146,7 +146,7 @@ LABEL io.openshift.expose-services=""
 # https://github.com/opencontainers/image-spec/blob/036563a4a268d7c08b51a08f05a02a0fe74c7268/annotations.md#annotations
 LABEL org.opencontainers.image.authors="info@stackable.tech"
 LABEL org.opencontainers.image.url="https://stackable.tech"
-LABEL org.opencontainers.image.source="https://github.com/stackabletech/stackable-ui/"
+LABEL org.opencontainers.image.source="https://github.com/stackabletech/cockpit/"
 LABEL org.opencontainers.image.vendor="Stackable GmbH"
 LABEL org.opencontainers.image.licenses="Apache-2.0"
 
diff --git a/e2e/trino/connection-form.spec.ts b/e2e/trino/connection-form.spec.ts
index 3b66f2b7..4e1f2def 100644
--- a/e2e/trino/connection-form.spec.ts
+++ b/e2e/trino/connection-form.spec.ts
@@ -4,7 +4,7 @@ import { waitForHydration } from '../support/helpers';
 /**
  * Tests for the Trino connection form.
  *
- * The test environment has STACKABLE_UI_TRINO_URL set, so trinoConfigured=true
+ * The test environment has STACKABLE_COCKPIT_TRINO_URL set, so trinoConfigured=true
  * by default. The manual-mode tests use route interception to flip
  * trinoConfigured to false, patching both the SSR HTML (devalue.uneval format)
  * and the client-side __data.json (devalue.stringify format).
diff --git a/package-lock.json b/package-lock.json
index 3fc40c49..839d83af 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,11 +1,11 @@
 {
-  "name": "@stackable/stackable-ui",
+  "name": "@stackable/stackable-cockpit",
   "version": "0.0.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
-      "name": "@stackable/stackable-ui",
+      "name": "@stackable/stackable-cockpit",
       "version": "0.0.1",
       "license": "Apache-2.0",
       "dependencies": {
diff --git a/package.json b/package.json
index 2618a504..f2ff0156 100644
--- a/package.json
+++ b/package.json
@@ -1,5 +1,5 @@
 {
-  "name": "@stackable/stackable-ui",
+  "name": "@stackable/stackable-cockpit",
   "private": true,
   "version": "0.0.1",
   "license": "Apache-2.0",
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index bd64e1c8..ce918e7b 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -10,18 +10,18 @@ const appServer = await import('$app/server').catch(() => null);
 const env = envModule?.env ?? (process.env as Record<string, string | undefined>);
 const getRequestEvent = appServer?.getRequestEvent ?? (() => undefined as unknown as RequestEvent);
 
-const usernameClaim = env.STACKABLE_UI_OIDC_USERNAME_CLAIM ?? 'preferred_username';
+const usernameClaim = env.STACKABLE_COCKPIT_OIDC_USERNAME_CLAIM ?? 'preferred_username';
 
 // OIDC is enabled only when all required OIDC env vars are present.
 export const oidcEnabled = !!(
-  env.STACKABLE_UI_OIDC_DISCOVERY_URL &&
-  env.STACKABLE_UI_OIDC_CLIENT_ID &&
-  env.STACKABLE_UI_OIDC_CLIENT_SECRET
+  env.STACKABLE_COCKPIT_OIDC_DISCOVERY_URL &&
+  env.STACKABLE_COCKPIT_OIDC_CLIENT_ID &&
+  env.STACKABLE_COCKPIT_OIDC_CLIENT_SECRET
 );
 
 export const auth = betterAuth({
-  secret: env.STACKABLE_UI_SESSION_SECRET,
-  baseURL: env.STACKABLE_UI_BASE_URL,
+  secret: env.STACKABLE_COCKPIT_SESSION_SECRET,
+  baseURL: env.STACKABLE_COCKPIT_BASE_URL,
   session: {
     cookieCache: { enabled: true, maxAge: 5 * 60 }
   },
@@ -42,9 +42,9 @@ export const auth = betterAuth({
             config: [
               {
                 providerId: 'oidc',
-                discoveryUrl: env.STACKABLE_UI_OIDC_DISCOVERY_URL,
-                clientId: env.STACKABLE_UI_OIDC_CLIENT_ID!,
-                clientSecret: env.STACKABLE_UI_OIDC_CLIENT_SECRET!,
+                discoveryUrl: env.STACKABLE_COCKPIT_OIDC_DISCOVERY_URL,
+                clientId: env.STACKABLE_COCKPIT_OIDC_CLIENT_ID!,
+                clientSecret: env.STACKABLE_COCKPIT_OIDC_CLIENT_SECRET!,
                 scopes: ['openid', 'profile', 'email'],
                 pkce: true,
                 mapProfileToUser: async (profile) => {
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index adbe05df..8d2368cc 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -3,44 +3,44 @@
 
 import { env } from '$env/dynamic/private';
 
-/** When `STACKABLE_UI_COMPLETION_ENABLED=false`, the SQL editor's
+/** When `STACKABLE_COCKPIT_COMPLETION_ENABLED=false`, the SQL editor's
  *  code-completion provider is not registered and the metadata endpoint
  *  refuses requests. Useful to fall back to plain syntax highlighting if
  *  completion misbehaves or generates undesirable load on Trino. */
-export const completionEnabled = env.STACKABLE_UI_COMPLETION_ENABLED !== 'false';
+export const completionEnabled = env.STACKABLE_COCKPIT_COMPLETION_ENABLED !== 'false';
 
-/** When `STACKABLE_UI_STORAGE_BROWSER_ENABLED=true`, the S3/HDFS file
+/** When `STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true`, the S3/HDFS file
  *  browser is shown in the sidebar and routes under `/storage` become
  *  active. Disabled by default — opt in explicitly to expose storage
  *  credentials and the file-browser UI. */
-export const storageBrowserEnabled = env.STACKABLE_UI_STORAGE_BROWSER_ENABLED === 'true';
+export const storageBrowserEnabled = env.STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED === 'true';
 
 // ── Storage preview limits ───────────────────────────────────────────────────
 
 /** Maximum bytes fetched when streaming a text, CSV, or JSON file preview.
- *  Controlled by `STACKABLE_UI_TEXT_PREVIEW_BYTES`. Default: 262144 (256 KiB).
+ *  Controlled by `STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES`. Default: 262144 (256 KiB).
  *  Larger values allow more of a file to be visible in-browser but increase
  *  memory pressure and response latency. */
 export const textPreviewBytes =
-  parseInt(env.STACKABLE_UI_TEXT_PREVIEW_BYTES ?? '', 10) || 256 * 1024;
+  parseInt(env.STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES ?? '', 10) || 256 * 1024;
 
 /** Maximum bytes fetched when streaming an image file preview.
- *  Controlled by `STACKABLE_UI_IMAGE_PREVIEW_BYTES`. Default: 5242880 (5 MiB).
+ *  Controlled by `STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES`. Default: 5242880 (5 MiB).
  *  Raise for large high-resolution images; lower to reduce bandwidth on
  *  deployments where storage egress is expensive. */
 export const imagePreviewBytes =
-  parseInt(env.STACKABLE_UI_IMAGE_PREVIEW_BYTES ?? '', 10) || 5 * 1024 * 1024;
+  parseInt(env.STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES ?? '', 10) || 5 * 1024 * 1024;
 
 /** Maximum bytes fetched when streaming a PDF file preview.
- *  Controlled by `STACKABLE_UI_PDF_PREVIEW_BYTES`. Default: 26214400 (25 MiB).
+ *  Controlled by `STACKABLE_COCKPIT_PDF_PREVIEW_BYTES`. Default: 26214400 (25 MiB).
  *  PDFs typically need several megabytes for the initial pages to render
  *  correctly in the browser PDF viewer. */
 export const pdfPreviewBytes =
-  parseInt(env.STACKABLE_UI_PDF_PREVIEW_BYTES ?? '', 10) || 25 * 1024 * 1024;
+  parseInt(env.STACKABLE_COCKPIT_PDF_PREVIEW_BYTES ?? '', 10) || 25 * 1024 * 1024;
 
 /** Maximum number of rows included in a file preview that is rendered as a
  *  table (currently: Parquet files converted to CSV).
- *  Controlled by `STACKABLE_UI_FILE_PREVIEW_ROWS`. Default: 250.
+ *  Controlled by `STACKABLE_COCKPIT_FILE_PREVIEW_ROWS`. Default: 250.
  *  Higher values give more data context but increase server-side S3 reads
  *  and the size of the payload sent to the browser. */
-export const filePreviewRows = parseInt(env.STACKABLE_UI_FILE_PREVIEW_ROWS ?? '', 10) || 250;
+export const filePreviewRows = parseInt(env.STACKABLE_COCKPIT_FILE_PREVIEW_ROWS ?? '', 10) || 250;
diff --git a/src/lib/server/logging/logger.ts b/src/lib/server/logging/logger.ts
index a49b8ee0..28cbdada 100644
--- a/src/lib/server/logging/logger.ts
+++ b/src/lib/server/logging/logger.ts
@@ -22,7 +22,7 @@ function createLogger(): pino.Logger {
   const options: pino.LoggerOptions = {
     level: config.level,
     timestamp: pino.stdTimeFunctions.isoTime,
-    base: { service: 'stackable-ui' },
+    base: { service: 'stackable-cockpit' },
     redact: {
       paths: redactionPaths,
       censor: redactionCensor
diff --git a/src/lib/server/trino/client.ts b/src/lib/server/trino/client.ts
index 3cfd69e0..13efe456 100644
--- a/src/lib/server/trino/client.ts
+++ b/src/lib/server/trino/client.ts
@@ -55,7 +55,7 @@ export class TrinoClient {
     this.dispatcher = options.dispatcher;
 
     this.commonHeaders = {
-      'X-Trino-Source': options.source ?? 'stackable-ui'
+      'X-Trino-Source': options.source ?? 'stackable-cockpit'
     };
     if (options.authorization) {
       this.commonHeaders['Authorization'] = options.authorization;
@@ -134,12 +134,12 @@ export function buildBasicAuthHeader(username: string, password: string): string
 
 // --- Singleton & env config ---
 
-const trinoUrl = env.STACKABLE_UI_TRINO_URL;
-const authType = (env.STACKABLE_UI_TRINO_AUTH_TYPE ?? 'none') as 'none' | 'basic';
-const authUsername = env.STACKABLE_UI_TRINO_AUTH_USERNAME;
-const authPassword = env.STACKABLE_UI_TRINO_AUTH_PASSWORD;
-const tlsInsecure = env.STACKABLE_UI_TRINO_TLS_INSECURE === 'true';
-const tlsCaCertPath = env.STACKABLE_UI_TRINO_TLS_CA_CERT;
+const trinoUrl = env.STACKABLE_COCKPIT_TRINO_URL;
+const authType = (env.STACKABLE_COCKPIT_TRINO_AUTH_TYPE ?? 'none') as 'none' | 'basic';
+const authUsername = env.STACKABLE_COCKPIT_TRINO_AUTH_USERNAME;
+const authPassword = env.STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD;
+const tlsInsecure = env.STACKABLE_COCKPIT_TRINO_TLS_INSECURE === 'true';
+const tlsCaCertPath = env.STACKABLE_COCKPIT_TRINO_TLS_CA_CERT;
 
 /** True when the Trino connection is pre-configured via environment variables. */
 export const trinoConfigured = !!trinoUrl;
@@ -149,7 +149,7 @@ let singleton: TrinoClient | undefined;
 if (trinoConfigured) {
   if (authType === 'basic' && (!authUsername || !authPassword)) {
     throw new Error(
-      'STACKABLE_UI_TRINO_AUTH_TYPE is "basic" but STACKABLE_UI_TRINO_AUTH_USERNAME or STACKABLE_UI_TRINO_AUTH_PASSWORD is missing'
+      'STACKABLE_COCKPIT_TRINO_AUTH_TYPE is "basic" but STACKABLE_COCKPIT_TRINO_AUTH_USERNAME or STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD is missing'
     );
   }
 
diff --git a/src/lib/server/trino/queries.ts b/src/lib/server/trino/queries.ts
index 02e7c9e4..0a717406 100644
--- a/src/lib/server/trino/queries.ts
+++ b/src/lib/server/trino/queries.ts
@@ -17,7 +17,7 @@ const log = logger.child({ module: 'trino-queries' });
 // --- TTL & eviction configuration ---
 
 /** Time (seconds) before completed, unaccessed tab queries are evicted. */
-const QUERY_TTL = Number(env.STACKABLE_UI_QUERY_TTL) || 1800; // 30 min
+const QUERY_TTL = Number(env.STACKABLE_COCKPIT_QUERY_TTL) || 1800; // 30 min
 const SWEEP_INTERVAL_MS = 60_000;
 
 // --- TrinoQuery model ---

From 99e7d62045435cb5bc590e3c71918e6f64c5a00e Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 3 Jun 2026 12:38:49 +0200
Subject: [PATCH 053/136] #185 move request handling to middleware

---
 src/app.d.ts                                  |  8 +++++++
 src/hooks.server.ts                           | 22 +++++++++++++++++--
 src/lib/server/storage/connection.ts          | 17 ++++----------
 .../(app)/storage/api/buckets/+server.ts      |  8 +++----
 .../(app)/storage/api/delete/+server.ts       | 10 ++++-----
 .../(app)/storage/api/delete/server.test.ts   | 11 +++++-----
 .../(app)/storage/api/download/+server.ts     | 18 +++++++--------
 .../(app)/storage/api/download/server.test.ts | 11 +++++-----
 .../(app)/storage/api/objects/+server.ts      | 15 ++++++++-----
 .../(app)/storage/api/preview/+server.ts      | 10 ++++-----
 .../(app)/storage/api/preview/server.test.ts  | 11 +++++-----
 .../(app)/storage/api/upload/+server.ts       |  8 +++----
 .../(app)/storage/api/upload/server.test.ts   | 11 +++++-----
 13 files changed, 85 insertions(+), 75 deletions(-)

diff --git a/src/app.d.ts b/src/app.d.ts
index b5f6447a..222b0243 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -15,6 +15,14 @@ declare global {
       session: typeof auth.$Infer.Session.session | null;
       logger: import('pino').Logger;
       requestId: string;
+      /**
+       * Parsed S3 connection config extracted from the `x-storage-connection`
+       * request header by the `handleStorageConnection` middleware.
+       * Always non-null for requests to `/(app)/storage/api/*` routes
+       * (the middleware throws 401 before the handler runs if the header is absent).
+       * Null for all other routes.
+       */
+      storageConfig: import('$lib/server/storage/types.js').S3ConnectionConfig | null;
     }
     // interface PageData {}
     // interface PageState {}
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index e0066ed7..e48a50a4 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1,11 +1,12 @@
 import { paraglideMiddleware } from '$lib/paraglide/server';
 import { httpRequestDuration } from '$lib/server/metrics';
 import { building, dev } from '$app/environment';
-import { redirect, type Handle, type HandleServerError } from '@sveltejs/kit';
+import { error, redirect, type Handle, type HandleServerError } from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
 import { svelteKitHandler } from 'better-auth/svelte-kit';
 import { auth, oidcEnabled } from '$lib/server/auth';
 import { requestLogger, logger } from '$lib/server/logging';
+import { getConnectionFromHeader } from '$lib/server/storage/connection.js';
 
 // Allow self-signed TLS certificates in development (e.g. local Trino with self-signed certs).
 if (dev) {
@@ -58,11 +59,28 @@ const handleAuthGuard: Handle = async ({ event, resolve }) => {
   return resolve(event);
 };
 
+/**
+ * Parse the `x-storage-connection` header (base64 JSON) for every request and
+ * store the result in `event.locals.storageConfig`. For routes under
+ * `/(app)/storage/api/` the header is mandatory — the middleware throws 401
+ * before the handler runs if it is absent, so handlers can rely on
+ * `locals.storageConfig` being non-null. Throws 400 for a present but
+ * malformed / invalid header on any route.
+ */
+const handleStorageConnection: Handle = async ({ event, resolve }) => {
+  event.locals.storageConfig = getConnectionFromHeader(event.request);
+  if (event.locals.storageConfig === null && event.route.id?.startsWith('/(app)/storage/api/')) {
+    throw error(401, 'No storage connection configured');
+  }
+  return resolve(event);
+};
+
 export const handle = sequence(
   requestLogger,
   handleMetrics,
   handleParaglide,
-  ...(oidcEnabled ? [handleAuth, handleAuthGuard] : [])
+  ...(oidcEnabled ? [handleAuth, handleAuthGuard] : []),
+  handleStorageConnection
 );
 
 export const handleError: HandleServerError = ({ error, event, status, message }) => {
diff --git a/src/lib/server/storage/connection.ts b/src/lib/server/storage/connection.ts
index 21e17b4c..2f606ba5 100644
--- a/src/lib/server/storage/connection.ts
+++ b/src/lib/server/storage/connection.ts
@@ -4,8 +4,6 @@ import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
 import type { S3ConnectionConfig } from './types.js';
 import { logger } from '$lib/server/logging';
 
-export { STORAGE_CONNECTION_HEADER };
-
 const log = logger.child({ module: 'storage-connection' });
 
 /**
@@ -43,20 +41,13 @@ function parseConnectionPayload(raw: string): S3ConnectionConfig {
 
 /**
  * Extract the storage connection config from the `X-Storage-Connection` request header.
- * Returns `null` if the header is absent. Throws on malformed or invalid payloads.
+ * Returns `null` if the header is absent. Throws 400 on malformed or invalid payloads.
+ *
+ * Used by the `handleStorageConnection` middleware in `hooks.server.ts` to populate
+ * `event.locals.storageConfig` before any storage API handler runs.
  */
 export function getConnectionFromHeader(request: Request): S3ConnectionConfig | null {
   const header = request.headers.get(STORAGE_CONNECTION_HEADER);
   if (!header) return null;
   return parseConnectionPayload(header);
 }
-
-/**
- * Extract the storage connection config from the `X-Storage-Connection` request header.
- * Throws a 401 HTTP error if the header is absent.
- */
-export function requireConnection(request: Request): S3ConnectionConfig {
-  const conn = getConnectionFromHeader(request);
-  if (!conn) throw error(401, 'No storage connection configured');
-  return conn;
-}
diff --git a/src/routes/(app)/storage/api/buckets/+server.ts b/src/routes/(app)/storage/api/buckets/+server.ts
index 620f983a..54994560 100644
--- a/src/routes/(app)/storage/api/buckets/+server.ts
+++ b/src/routes/(app)/storage/api/buckets/+server.ts
@@ -1,5 +1,4 @@
 import { listBuckets } from '$lib/server/storage/service.js';
-import { requireConnection } from '$lib/server/storage/connection.js';
 import type { RequestHandler } from './$types';
 
 /**
@@ -7,10 +6,11 @@ import type { RequestHandler } from './$types';
  *
  * Returns the list of buckets accessible with the connection config supplied in
  * the `X-Storage-Connection` request header (base64-encoded JSON).
+ * The config is parsed and validated by the `handleStorageConnection` middleware
+ * in hooks.server.ts before this handler runs.
  */
-export const GET: RequestHandler = async ({ request, locals }) => {
-  const config = requireConnection(request);
-  const buckets = await listBuckets(config);
+export const GET: RequestHandler = async ({ locals }) => {
+  const buckets = await listBuckets(locals.storageConfig!);
   locals.logger.debug({ bucket_count: buckets.length }, 'bucket list returned');
   return Response.json(buckets);
 };
diff --git a/src/routes/(app)/storage/api/delete/+server.ts b/src/routes/(app)/storage/api/delete/+server.ts
index 4892bb35..43369e83 100644
--- a/src/routes/(app)/storage/api/delete/+server.ts
+++ b/src/routes/(app)/storage/api/delete/+server.ts
@@ -1,7 +1,6 @@
 import type { RequestHandler } from './$types';
 import { error } from '@sveltejs/kit';
 import { deleteObjects } from '$lib/server/storage/service.js';
-import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucket } from '../params.js';
 
 /**
@@ -10,12 +9,11 @@ import { requireBucket } from '../params.js';
  * Deletes one or more S3 objects from the given bucket.
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
  *
- * The connection config is read from the `X-Storage-Connection` request header
- * (base64-encoded JSON), set by the client from its localStorage entry.
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
-export const DELETE: RequestHandler = async ({ locals, url, request }) => {
+export const DELETE: RequestHandler = async ({ locals, url }) => {
   const bucket = requireBucket(url);
-  const config = requireConnection(request);
 
   const keys = url.searchParams.getAll('keys');
   if (!keys.length) {
@@ -24,7 +22,7 @@ export const DELETE: RequestHandler = async ({ locals, url, request }) => {
 
   locals.logger.debug({ bucket, key_count: keys.length }, 'delete request received');
 
-  const result = await deleteObjects(config, bucket, keys);
+  const result = await deleteObjects(locals.storageConfig!, bucket, keys);
 
   locals.logger.info(
     { bucket, key_count: keys.length, failed_count: result.failed.length },
diff --git a/src/routes/(app)/storage/api/delete/server.test.ts b/src/routes/(app)/storage/api/delete/server.test.ts
index 35783ccb..7d2dcd9e 100644
--- a/src/routes/(app)/storage/api/delete/server.test.ts
+++ b/src/routes/(app)/storage/api/delete/server.test.ts
@@ -5,11 +5,6 @@ vi.mock('$lib/server/storage/service.js', () => ({
   deleteObjects: vi.fn()
 }));
 
-vi.mock('$lib/server/storage/connection.js', () => ({
-  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
-  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
-}));
-
 import { DELETE } from './+server.js';
 import { deleteObjects } from '$lib/server/storage/service.js';
 
@@ -29,7 +24,11 @@ function mockEvent(searchParams: Record<string, string | string[]>) {
   return {
     url,
     request: { headers: new Headers(CONNECTION_HEADER) },
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof DELETE>[0];
 }
 
diff --git a/src/routes/(app)/storage/api/download/+server.ts b/src/routes/(app)/storage/api/download/+server.ts
index e43df827..d8e09bb8 100644
--- a/src/routes/(app)/storage/api/download/+server.ts
+++ b/src/routes/(app)/storage/api/download/+server.ts
@@ -1,6 +1,5 @@
 import type { RequestHandler } from './$types';
 import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
-import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucketKey } from '../params.js';
 
 /** Derive the bare filename from a (possibly path-prefixed) object key. */
@@ -16,16 +15,15 @@ function filenameFromKey(key: string): string {
  * The S3 body stream is piped straight to the HTTP response — no server-side
  * buffering occurs.
  *
- * The connection config is read from the `X-Storage-Connection` request header
- * (base64-encoded JSON), set by the client from its localStorage entry.
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
-export const GET: RequestHandler = async ({ locals, url, request }) => {
+export const GET: RequestHandler = async ({ locals, url }) => {
   const { bucket, key } = requireBucketKey(url);
-  const config = requireConnection(request);
 
   locals.logger.debug({ bucket, key }, 'download request received');
 
-  const download = await downloadObject(config, bucket, key);
+  const download = await downloadObject(locals.storageConfig!, bucket, key);
 
   const filename = filenameFromKey(key);
   // RFC 5987 encoding for non-ASCII filenames in Content-Disposition
@@ -58,15 +56,15 @@ export const GET: RequestHandler = async ({ locals, url, request }) => {
  * a HeadObject call (no object body transferred). The client uses this before
  * initiating a download to surface auth/not-found errors as inline UI messages.
  *
- * The connection config is read from the `X-Storage-Connection` request header.
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
-export const HEAD: RequestHandler = async ({ locals, url, request }) => {
+export const HEAD: RequestHandler = async ({ locals, url }) => {
   const { bucket, key } = requireBucketKey(url);
-  const config = requireConnection(request);
 
   locals.logger.debug({ bucket, key }, 'download pre-flight check');
 
-  const meta = await getObjectMetadata(config, bucket, key);
+  const meta = await getObjectMetadata(locals.storageConfig!, bucket, key);
 
   return new Response(null, {
     status: 200,
diff --git a/src/routes/(app)/storage/api/download/server.test.ts b/src/routes/(app)/storage/api/download/server.test.ts
index d0304e87..545b581b 100644
--- a/src/routes/(app)/storage/api/download/server.test.ts
+++ b/src/routes/(app)/storage/api/download/server.test.ts
@@ -5,11 +5,6 @@ vi.mock('$lib/server/storage/service.js', () => ({
   getObjectMetadata: vi.fn()
 }));
 
-vi.mock('$lib/server/storage/connection.js', () => ({
-  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
-  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
-}));
-
 import { GET, HEAD } from './+server.js';
 import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
 
@@ -22,7 +17,11 @@ function mockEvent(params: string) {
   return {
     url,
     request: { headers: new Headers(CONNECTION_HEADER) },
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof GET>[0];
 }
 
diff --git a/src/routes/(app)/storage/api/objects/+server.ts b/src/routes/(app)/storage/api/objects/+server.ts
index d1fb56f9..463a5b63 100644
--- a/src/routes/(app)/storage/api/objects/+server.ts
+++ b/src/routes/(app)/storage/api/objects/+server.ts
@@ -1,6 +1,5 @@
 import { error } from '@sveltejs/kit';
 import { listObjects } from '$lib/server/storage/service.js';
-import { requireConnection } from '$lib/server/storage/connection.js';
 import type { RequestHandler } from './$types';
 
 /**
@@ -8,10 +7,10 @@ import type { RequestHandler } from './$types';
  *
  * Returns a page of objects in the given bucket/prefix using the connection
  * config supplied in the `X-Storage-Connection` request header.
+ * The config is parsed and validated by the `handleStorageConnection` middleware
+ * in hooks.server.ts before this handler runs.
  */
-export const GET: RequestHandler = async ({ request, url, locals }) => {
-  const config = requireConnection(request);
-
+export const GET: RequestHandler = async ({ url, locals }) => {
   const bucket = url.searchParams.get('bucket')?.trim();
   if (!bucket) throw error(400, 'Missing required query parameter: bucket');
 
@@ -25,6 +24,12 @@ export const GET: RequestHandler = async ({ request, url, locals }) => {
     'listing objects'
   );
 
-  const page = await listObjects(config, bucket, prefix, pageSize, continuationToken);
+  const page = await listObjects(
+    locals.storageConfig!,
+    bucket,
+    prefix,
+    pageSize,
+    continuationToken
+  );
   return Response.json(page);
 };
diff --git a/src/routes/(app)/storage/api/preview/+server.ts b/src/routes/(app)/storage/api/preview/+server.ts
index f6c6e7f7..ffb51b24 100644
--- a/src/routes/(app)/storage/api/preview/+server.ts
+++ b/src/routes/(app)/storage/api/preview/+server.ts
@@ -1,7 +1,6 @@
 import { S3ServiceException } from '@aws-sdk/client-s3';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 import { getProvider } from '$lib/server/storage/utils.js';
-import { requireConnection } from '$lib/server/storage/connection.js';
 // import { parquetPreview } from '$lib/server/storage/preview/parquet.js';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
@@ -11,15 +10,14 @@ import type { RequestHandler } from './$types';
 /**
  * GET /storage/api/preview?bucket=<bucket>&key=<object-key>
  *
- * The connection config is read from the `X-Storage-Connection` request header
- * (base64-encoded JSON), set by the client from its localStorage entry.
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
-export const GET: RequestHandler = async ({ url, locals, request }) => {
+export const GET: RequestHandler = async ({ url, locals }) => {
   const log = locals.logger;
-  const config = requireConnection(request);
   const { bucket, key } = requireBucketKey(url);
 
-  const provider = getProvider(config, bucket);
+  const provider = getProvider(locals.storageConfig!, bucket);
 
   try {
     const metadata = await provider.getMetadata(key);
diff --git a/src/routes/(app)/storage/api/preview/server.test.ts b/src/routes/(app)/storage/api/preview/server.test.ts
index 79f72594..10c18fdd 100644
--- a/src/routes/(app)/storage/api/preview/server.test.ts
+++ b/src/routes/(app)/storage/api/preview/server.test.ts
@@ -6,11 +6,6 @@ vi.mock('$lib/server/storage/utils.js', () => ({
   getProvider: vi.fn(() => ({ getMetadata: mockGetMetadata }))
 }));
 
-vi.mock('$lib/server/storage/connection.js', () => ({
-  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
-  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
-}));
-
 vi.mock('$lib/server/storage/preview/binary.js', () => ({
   KNOWN_BINARY_TYPES: new Set(['application/zip']),
   binaryPreview: vi.fn(() => new Response(null, { headers: { 'X-Preview-Renderable': 'false' } }))
@@ -40,7 +35,11 @@ function mockEvent(params: string) {
   return {
     url,
     request: { headers: new Headers(CONNECTION_HEADER) },
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof GET>[0];
 }
 
diff --git a/src/routes/(app)/storage/api/upload/+server.ts b/src/routes/(app)/storage/api/upload/+server.ts
index dc58c546..b6202da4 100644
--- a/src/routes/(app)/storage/api/upload/+server.ts
+++ b/src/routes/(app)/storage/api/upload/+server.ts
@@ -1,6 +1,5 @@
 import { error } from '@sveltejs/kit';
 import { uploadObject } from '$lib/server/storage/service.js';
-import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
 
@@ -11,12 +10,11 @@ import type { RequestHandler } from './$types';
  * @aws-sdk/lib-storage). The request body is piped to the S3 SDK without
  * buffering in server memory, regardless of file size.
  *
- * The connection config is read from the `X-Storage-Connection` request header
- * (base64-encoded JSON), set by the client from its localStorage entry.
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
 export const POST: RequestHandler = async ({ locals, url, request }) => {
   const log = locals.logger;
-  const config = requireConnection(request);
   const { bucket, key } = requireBucketKey(url);
 
   if (!request.body) {
@@ -35,7 +33,7 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     'upload request received'
   );
 
-  await uploadObject(config, bucket, key, request.body, contentType, contentLength);
+  await uploadObject(locals.storageConfig!, bucket, key, request.body, contentType, contentLength);
 
   log.info(
     { bucket, key, content_type: contentType, content_length: contentLength },
diff --git a/src/routes/(app)/storage/api/upload/server.test.ts b/src/routes/(app)/storage/api/upload/server.test.ts
index b8adfdb9..17644c13 100644
--- a/src/routes/(app)/storage/api/upload/server.test.ts
+++ b/src/routes/(app)/storage/api/upload/server.test.ts
@@ -4,11 +4,6 @@ vi.mock('$lib/server/storage/service.js', () => ({
   uploadObject: vi.fn()
 }));
 
-vi.mock('$lib/server/storage/connection.js', () => ({
-  requireConnection: vi.fn(() => ({ type: 's3', region: 'us-east-1' })),
-  STORAGE_CONNECTION_HEADER: 'x-storage-connection'
-}));
-
 import { POST } from './+server.js';
 import { uploadObject } from '$lib/server/storage/service.js';
 
@@ -31,7 +26,11 @@ function mockEvent(opts: {
   return {
     url,
     request: { body, headers },
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof POST>[0];
 }
 

From e4b8b845277f62f420367e03ec94a59d89527fe0 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 3 Jun 2026 14:09:39 +0200
Subject: [PATCH 054/136] refactor: move service logic into StorageProvider
 interface and implementations

---
 src/lib/server/storage/hdfs-provider.ts       |   4 +
 src/lib/server/storage/preview/stream.test.ts |   1 +
 src/lib/server/storage/provider.ts            |   2 +
 src/lib/server/storage/s3-provider.test.ts    | 181 ++++++++++++
 src/lib/server/storage/s3-provider.ts         | 260 ++++++++++++------
 src/lib/server/storage/service.test.ts        | 247 -----------------
 src/lib/server/storage/service.ts             | 146 ----------
 src/lib/server/storage/utils.ts               |  13 +
 src/routes/(app)/storage/+page.server.ts      |   4 +-
 .../(app)/storage/api/buckets/+server.ts      |   4 +-
 .../(app)/storage/api/delete/+server.ts       |   4 +-
 .../(app)/storage/api/delete/server.test.ts   |  12 +-
 .../(app)/storage/api/download/+server.ts     |   6 +-
 .../(app)/storage/api/download/server.test.ts |  19 +-
 .../(app)/storage/api/objects/+server.ts      |   8 +-
 .../(app)/storage/api/upload/+server.ts       |   4 +-
 .../(app)/storage/api/upload/server.test.ts   |  21 +-
 src/routes/(app)/storage/page.server.test.ts  |  10 +-
 18 files changed, 413 insertions(+), 533 deletions(-)
 delete mode 100644 src/lib/server/storage/service.test.ts
 delete mode 100644 src/lib/server/storage/service.ts

diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 5861498a..1a8df630 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -10,6 +10,10 @@ import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 export class HDFSStorageProvider implements StorageProvider {
   constructor(_config: HDFSConfig) {}
 
+  listBuckets(): Promise<string[]> {
+    throw new Error('HDFS not implemented');
+  }
+
   listObjects(
     _prefix: string,
     _pageSize: number,
diff --git a/src/lib/server/storage/preview/stream.test.ts b/src/lib/server/storage/preview/stream.test.ts
index 382f19c7..6d11d0e7 100644
--- a/src/lib/server/storage/preview/stream.test.ts
+++ b/src/lib/server/storage/preview/stream.test.ts
@@ -7,6 +7,7 @@ const mockLog = { info: vi.fn(), debug: vi.fn(), warn: vi.fn() } as unknown as p
 
 function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider {
   return {
+    listBuckets: vi.fn(),
     listObjects: vi.fn(),
     getObject: vi
       .fn()
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index 6156762d..c666165b 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -12,6 +12,8 @@ export interface ObjectDownload {
 
 /** Backend-agnostic interface for a bucket-scoped storage provider. */
 export interface StorageProvider {
+  /** List all buckets accessible with the current connection credentials. */
+  listBuckets(): Promise<string[]>;
   /**
    * List objects using cursor-based pagination. `continuationToken` is the
    * provider-specific opaque token returned from a previous call. When
diff --git a/src/lib/server/storage/s3-provider.test.ts b/src/lib/server/storage/s3-provider.test.ts
index d67d613a..73ada8fe 100644
--- a/src/lib/server/storage/s3-provider.test.ts
+++ b/src/lib/server/storage/s3-provider.test.ts
@@ -509,3 +509,184 @@ describe('S3StorageProvider constructor', () => {
     );
   });
 });
+
+// ---------------------------------------------------------------------------
+// listBuckets
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.listBuckets', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('returns bucket names', async () => {
+    send.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: 'b' }] });
+    expect(await provider.listBuckets()).toEqual(['a', 'b']);
+  });
+
+  it('filters out buckets with no name', async () => {
+    send.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: undefined }, { Name: '' }] });
+    expect(await provider.listBuckets()).toEqual(['a']);
+  });
+
+  it('handles null Buckets in response', async () => {
+    send.mockResolvedValue({ Buckets: null });
+    expect(await provider.listBuckets()).toEqual([]);
+  });
+
+  it('maps AccessDenied S3 error to HTTP 403', async () => {
+    send.mockRejectedValue(makeS3Error('AccessDenied', 403));
+    await expect(provider.listBuckets()).rejects.toMatchObject({ status: 403 });
+  });
+
+  it('re-throws non-S3 errors', async () => {
+    const err = new Error('network');
+    send.mockRejectedValue(err);
+    await expect(provider.listBuckets()).rejects.toThrow('network');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Error handling — S3ServiceException → HTTP error mapping
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider error handling', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('listObjects: maps AccessDenied to HTTP 403', async () => {
+    send.mockRejectedValue(makeS3Error('AccessDenied', 403));
+    await expect(provider.listObjects('', 10)).rejects.toMatchObject({ status: 403 });
+  });
+
+  it('listObjects: maps NoSuchBucket to HTTP 404', async () => {
+    send.mockRejectedValue(makeS3Error('NoSuchBucket', 404));
+    await expect(provider.listObjects('', 10)).rejects.toMatchObject({ status: 404 });
+  });
+
+  it('listObjects: re-throws non-S3 errors', async () => {
+    send.mockRejectedValue(new Error('timeout'));
+    await expect(provider.listObjects('', 10)).rejects.toThrow('timeout');
+  });
+
+  it('getObject: maps NoSuchKey to HTTP 404', async () => {
+    send.mockRejectedValue(makeS3Error('NoSuchKey', 404));
+    await expect(provider.getObject('k')).rejects.toMatchObject({ status: 404 });
+  });
+
+  it('getObject: maps AccessDenied to HTTP 403', async () => {
+    send.mockRejectedValue(makeS3Error('AccessDenied', 403));
+    await expect(provider.getObject('k')).rejects.toMatchObject({ status: 403 });
+  });
+
+  it('getObject: re-throws non-S3 errors', async () => {
+    send.mockRejectedValue(new Error('gone'));
+    await expect(provider.getObject('k')).rejects.toThrow('gone');
+  });
+
+  it('getObjectRange: maps S3 error to HTTP error', async () => {
+    send.mockRejectedValue(makeS3Error('NoSuchKey', 404));
+    await expect(provider.getObjectRange('k', 0, 100)).rejects.toMatchObject({ status: 404 });
+  });
+
+  it('getObjectRange: re-throws non-S3 errors', async () => {
+    send.mockRejectedValue(new Error('network'));
+    await expect(provider.getObjectRange('k', 0, 100)).rejects.toThrow('network');
+  });
+
+  it('getMetadata: maps NoSuchKey to HTTP 404', async () => {
+    send.mockRejectedValue(makeS3Error('NoSuchKey', 404));
+    await expect(provider.getMetadata('k')).rejects.toMatchObject({ status: 404 });
+  });
+
+  it('getMetadata: re-throws non-S3 errors', async () => {
+    send.mockRejectedValue(new Error('gone'));
+    await expect(provider.getMetadata('k')).rejects.toThrow('gone');
+  });
+
+  it('putObject: maps AccessDenied to HTTP 403', async () => {
+    mockUploadDone.mockRejectedValue(makeS3Error('AccessDenied', 403));
+    MockUpload.mockImplementationOnce(function (this: { done: typeof mockUploadDone }) {
+      this.done = mockUploadDone;
+    });
+    await expect(provider.putObject('k', Buffer.from('x'), 'text/plain')).rejects.toMatchObject({
+      status: 403
+    });
+  });
+
+  it('putObject: re-throws non-S3 errors', async () => {
+    mockUploadDone.mockRejectedValue(new Error('disk full'));
+    MockUpload.mockImplementationOnce(function (this: { done: typeof mockUploadDone }) {
+      this.done = mockUploadDone;
+    });
+    await expect(provider.putObject('k', Buffer.from('x'), 'text/plain')).rejects.toThrow(
+      'disk full'
+    );
+  });
+
+  it('deleteObjects: maps AccessDenied to HTTP 403', async () => {
+    send.mockRejectedValue(makeS3Error('AccessDenied', 403));
+    await expect(provider.deleteObjects(['file.txt'])).rejects.toMatchObject({ status: 403 });
+  });
+
+  it('deleteObjects: re-throws non-S3 errors', async () => {
+    send.mockRejectedValue(new Error('network'));
+    await expect(provider.deleteObjects(['file.txt'])).rejects.toThrow('network');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// deleteObjects — directory expansion
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.deleteObjects directory expansion', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+  });
+
+  it('expands directory prefixes and deletes all contained keys', async () => {
+    // First call: ListObjectsV2 for dir/
+    send.mockResolvedValueOnce({
+      Contents: [{ Key: 'dir/a.txt' }, { Key: 'dir/b.txt' }],
+      IsTruncated: false
+    });
+    // Second call: DeleteObjects
+    send.mockResolvedValueOnce({ Errors: [] });
+
+    const result = await provider.deleteObjects(['file.txt', 'dir/']);
+
+    const deleteCall = send.mock.calls[1][0];
+    expect(deleteCall.input.Delete.Objects).toEqual([
+      { Key: 'file.txt' },
+      { Key: 'dir/a.txt' },
+      { Key: 'dir/b.txt' }
+    ]);
+    expect(result).toEqual({ failed: [] });
+  });
+
+  it('uses directory key itself when no children found', async () => {
+    send.mockResolvedValueOnce({ IsTruncated: false }); // listAllKeys returns []
+    send.mockResolvedValueOnce({ Errors: [] }); // deleteObjects
+
+    await provider.deleteObjects(['empty/']);
+
+    const deleteCall = send.mock.calls[1][0];
+    expect(deleteCall.input.Delete.Objects).toEqual([{ Key: 'empty/' }]);
+  });
+
+  it('returns empty result for no keys', async () => {
+    const result = await provider.deleteObjects([]);
+    expect(result).toEqual({ failed: [] });
+    expect(send).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index e6fac66f..60052508 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -1,6 +1,7 @@
 import {
   S3Client,
   S3ServiceException,
+  ListBucketsCommand,
   ListObjectsV2Command,
   GetObjectCommand,
   HeadObjectCommand,
@@ -13,6 +14,7 @@ import type { S3Config } from './types.js';
 import type { StoragePage, StorageObject, StorageMetadata } from '$lib/storage/types.js';
 import { logger } from '$lib/server/logging';
 import { createS3Client } from './s3-client.js';
+import { mapS3ErrorToHttp } from './s3-errors.js';
 
 const log = logger.child({ module: 's3-provider' });
 
@@ -25,6 +27,21 @@ export class S3StorageProvider implements StorageProvider {
     this.client = client ?? createS3Client(config);
   }
 
+  async listBuckets(): Promise<string[]> {
+    log.trace({ bucket: this.bucket }, 'S3 ListBuckets');
+    try {
+      const output = await this.client.send(new ListBucketsCommand({}));
+      const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
+      log.debug({ bucket_count: buckets.length }, 'listed buckets');
+      return buckets;
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        mapS3ErrorToHttp(err, { operation: 'listBuckets' });
+      }
+      throw err;
+    }
+  }
+
   async listObjects(
     prefix: string,
     pageSize: number,
@@ -32,81 +49,113 @@ export class S3StorageProvider implements StorageProvider {
   ): Promise<StoragePage> {
     log.trace({ bucket: this.bucket, prefix, page_size: pageSize }, 'S3 ListObjectsV2');
 
-    const output: ListObjectsV2CommandOutput = await this.client.send(
-      new ListObjectsV2Command({
-        Bucket: this.bucket,
-        Prefix: prefix || undefined,
-        Delimiter: '/',
-        MaxKeys: pageSize,
-        ContinuationToken: continuationToken ?? undefined
-      })
-    );
+    try {
+      const output: ListObjectsV2CommandOutput = await this.client.send(
+        new ListObjectsV2Command({
+          Bucket: this.bucket,
+          Prefix: prefix || undefined,
+          Delimiter: '/',
+          MaxKeys: pageSize,
+          ContinuationToken: continuationToken ?? undefined
+        })
+      );
 
-    const objects: StorageObject[] = [
-      ...(output.CommonPrefixes ?? []).map((cp) => ({
-        key: cp.Prefix ?? '',
-        size: 0,
-        lastModified: new Date(0),
-        isDirectory: true,
-        contentType: undefined
-      })),
-      ...(output.Contents ?? [])
-        // Filter out the prefix itself (S3 sometimes echoes it back)
-        .filter((obj) => obj.Key !== prefix)
-        .map((obj) => ({
-          key: obj.Key ?? '',
-          size: obj.Size ?? 0,
-          lastModified: obj.LastModified ?? new Date(0),
-          isDirectory: false,
+      const objects: StorageObject[] = [
+        ...(output.CommonPrefixes ?? []).map((cp) => ({
+          key: cp.Prefix ?? '',
+          size: 0,
+          lastModified: new Date(0),
+          isDirectory: true,
           contentType: undefined
-        }))
-    ];
-
-    return {
-      objects,
-      hasNextPage: output.IsTruncated ?? false,
-      currentPage: 1,
-      pageSize,
-      continuationToken: continuationToken ?? null,
-      nextContinuationToken: output.NextContinuationToken ?? null
-    };
+        })),
+        ...(output.Contents ?? [])
+          // Filter out the prefix itself (S3 sometimes echoes it back)
+          .filter((obj) => obj.Key !== prefix)
+          .map((obj) => ({
+            key: obj.Key ?? '',
+            size: obj.Size ?? 0,
+            lastModified: obj.LastModified ?? new Date(0),
+            isDirectory: false,
+            contentType: undefined
+          }))
+      ];
+
+      return {
+        objects,
+        hasNextPage: output.IsTruncated ?? false,
+        currentPage: 1,
+        pageSize,
+        continuationToken: continuationToken ?? null,
+        nextContinuationToken: output.NextContinuationToken ?? null
+      };
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        mapS3ErrorToHttp(err, { bucket: this.bucket, operation: 'listObjects' });
+      }
+      throw err;
+    }
   }
 
   async getObject(key: string): Promise<ObjectDownload> {
     log.trace({ bucket: this.bucket, key }, 'S3 GetObject');
-    const output = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
-    if (!output.Body) {
-      throw new Error(`Object ${key} has no body`);
+    try {
+      const output = await this.client.send(
+        new GetObjectCommand({ Bucket: this.bucket, Key: key })
+      );
+      if (!output.Body) {
+        throw new Error(`Object ${key} has no body`);
+      }
+      return {
+        stream: output.Body.transformToWebStream(),
+        contentType: output.ContentType,
+        contentLength: output.ContentLength,
+        etag: output.ETag
+      };
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'getObject' });
+      }
+      throw err;
     }
-    return {
-      stream: output.Body.transformToWebStream(),
-      contentType: output.ContentType,
-      contentLength: output.ContentLength,
-      etag: output.ETag
-    };
   }
 
   async getObjectRange(key: string, start: number, end: number): Promise<ReadableStream> {
     log.trace({ bucket: this.bucket, key, start, end }, 'S3 GetObject (range)');
-    const output = await this.client.send(
-      new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
-    );
-    if (!output.Body) {
-      throw new Error(`Object ${key} has no body`);
+    try {
+      const output = await this.client.send(
+        new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
+      );
+      if (!output.Body) {
+        throw new Error(`Object ${key} has no body`);
+      }
+      return output.Body.transformToWebStream();
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'getObjectRange' });
+      }
+      throw err;
     }
-    return output.Body.transformToWebStream();
   }
 
   async getMetadata(key: string): Promise<StorageMetadata> {
     log.trace({ bucket: this.bucket, key }, 'S3 HeadObject');
-    const output = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
-    return {
-      size: output.ContentLength ?? 0,
-      lastModified: output.LastModified ?? new Date(0),
-      contentType: output.ContentType,
-      etag: output.ETag,
-      customMetadata: output.Metadata
-    };
+    try {
+      const output = await this.client.send(
+        new HeadObjectCommand({ Bucket: this.bucket, Key: key })
+      );
+      return {
+        size: output.ContentLength ?? 0,
+        lastModified: output.LastModified ?? new Date(0),
+        contentType: output.ContentType,
+        etag: output.ETag,
+        customMetadata: output.Metadata
+      };
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'getMetadata' });
+      }
+      throw err;
+    }
   }
 
   async exists(key: string): Promise<boolean> {
@@ -134,44 +183,73 @@ export class S3StorageProvider implements StorageProvider {
       { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
       'S3 Upload'
     );
-    const upload = new Upload({
-      client: this.client,
-      queueSize: 4,
-      partSize: 5 * 1024 * 1024,
-      params: {
-        Bucket: this.bucket,
-        Key: key,
-        Body: body,
-        ContentType: contentType,
-        ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
+    try {
+      const upload = new Upload({
+        client: this.client,
+        queueSize: 4,
+        partSize: 5 * 1024 * 1024,
+        params: {
+          Bucket: this.bucket,
+          Key: key,
+          Body: body,
+          ContentType: contentType,
+          ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
+        }
+      });
+      await upload.done();
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'putObject' });
       }
-    });
-    await upload.done();
+      throw err;
+    }
   }
 
   async deleteObjects(keys: string[]): Promise<DeleteObjectsResult> {
-    log.trace({ bucket: this.bucket, key_count: keys.length }, 'S3 DeleteObjects');
-    const output = await this.client.send(
-      new DeleteObjectsCommand({
-        Bucket: this.bucket,
-        Delete: {
-          Objects: keys.map((key) => ({ Key: key })),
-          Quiet: true
-        }
-      })
-    );
-    const failed = (output.Errors ?? []).map((e) => ({
-      key: e.Key ?? '',
-      code: e.Code,
-      message: e.Message
-    }));
-    if (failed.length > 0) {
-      log.warn(
-        { bucket: this.bucket, failed_count: failed.length },
-        'some objects failed to delete'
+    // Expand any directory prefixes (keys ending with '/') to their contents.
+    const dirPrefixes = keys.filter((k) => k.endsWith('/'));
+    const fileKeys = keys.filter((k) => !k.endsWith('/'));
+
+    let allKeys = [...fileKeys];
+    for (const prefix of dirPrefixes) {
+      log.debug({ bucket: this.bucket, prefix }, 'expanding directory prefix for deletion');
+      const children = await this.listAllKeys(prefix);
+      allKeys = allKeys.concat(children.length > 0 ? children : [prefix]);
+    }
+
+    if (allKeys.length === 0) {
+      return { failed: [] };
+    }
+
+    log.trace({ bucket: this.bucket, key_count: allKeys.length }, 'S3 DeleteObjects');
+    try {
+      const output = await this.client.send(
+        new DeleteObjectsCommand({
+          Bucket: this.bucket,
+          Delete: {
+            Objects: allKeys.map((key) => ({ Key: key })),
+            Quiet: true
+          }
+        })
       );
+      const failed = (output.Errors ?? []).map((e) => ({
+        key: e.Key ?? '',
+        code: e.Code,
+        message: e.Message
+      }));
+      if (failed.length > 0) {
+        log.warn(
+          { bucket: this.bucket, failed_count: failed.length },
+          'some objects failed to delete'
+        );
+      }
+      return { failed };
+    } catch (err) {
+      if (err instanceof S3ServiceException) {
+        mapS3ErrorToHttp(err, { bucket: this.bucket, operation: 'deleteObjects' });
+      }
+      throw err;
     }
-    return { failed };
   }
 
   async listAllKeys(prefix: string): Promise<string[]> {
diff --git a/src/lib/server/storage/service.test.ts b/src/lib/server/storage/service.test.ts
deleted file mode 100644
index fa4be91f..00000000
--- a/src/lib/server/storage/service.test.ts
+++ /dev/null
@@ -1,247 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { faker } from '@faker-js/faker';
-import { S3ServiceException } from '@aws-sdk/client-s3';
-
-vi.mock('$lib/server/logging', () => ({
-  logger: { child: () => ({ info: vi.fn(), debug: vi.fn(), warn: vi.fn() }) }
-}));
-
-const mockSend = vi.fn();
-vi.mock('./s3-client.js', () => ({
-  createS3Client: () => ({ send: (...args: unknown[]) => mockSend(...args) })
-}));
-
-const mockProvider = {
-  listObjects: vi.fn(),
-  getObject: vi.fn(),
-  getObjectRange: vi.fn(),
-  getMetadata: vi.fn(),
-  exists: vi.fn(),
-  putObject: vi.fn(),
-  deleteObjects: vi.fn(),
-  listAllKeys: vi.fn()
-};
-vi.mock('./utils.js', () => ({
-  getProvider: () => mockProvider
-}));
-
-// eslint-disable-next-line @typescript-eslint/no-unused-vars
-const mockMapS3ErrorToHttp = vi.fn((err: unknown, _context?: unknown) => {
-  throw err;
-});
-vi.mock('./s3-errors.js', () => ({
-  mapS3ErrorToHttp: (err: unknown, context: unknown) => mockMapS3ErrorToHttp(err, context)
-}));
-
-function makeS3Error(name = 'NoSuchKey'): S3ServiceException {
-  return new S3ServiceException({ name, message: name, $fault: 'client', $metadata: {} });
-}
-
-import {
-  listBuckets,
-  listObjects,
-  downloadObject,
-  getObjectMetadata,
-  uploadObject,
-  deleteObjects
-} from './service.js';
-import type { S3ConnectionConfig } from './types.js';
-
-const config: S3ConnectionConfig = {
-  type: 's3',
-  region: faker.location.countryCode()
-};
-
-describe('storage service', () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  describe('listBuckets', () => {
-    it('returns bucket names', async () => {
-      mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: 'b' }] });
-      expect(await listBuckets(config)).toEqual(['a', 'b']);
-    });
-
-    it('filters out buckets with no name', async () => {
-      mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: undefined }, { Name: '' }] });
-      expect(await listBuckets(config)).toEqual(['a']);
-    });
-
-    it('handles null Buckets in response', async () => {
-      mockSend.mockResolvedValue({ Buckets: null });
-      expect(await listBuckets(config)).toEqual([]);
-    });
-  });
-
-  describe('listObjects', () => {
-    it('proxies to provider', async () => {
-      const page = { objects: [], prefixes: [], nextToken: null };
-      mockProvider.listObjects.mockResolvedValue(page);
-      const result = await listObjects(config, 'bucket', 'prefix/', 100);
-      expect(mockProvider.listObjects).toHaveBeenCalledWith('prefix/', 100, undefined);
-      expect(result).toEqual(page);
-    });
-
-    it('passes continuation token when provided', async () => {
-      const page = { objects: [], prefixes: [], nextToken: null };
-      mockProvider.listObjects.mockResolvedValue(page);
-      await listObjects(config, 'bucket', '', 10, 'tok');
-      expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, 'tok');
-    });
-
-    it('passes undefined when continuation token is null', async () => {
-      const page = { objects: [], prefixes: [], nextToken: null };
-      mockProvider.listObjects.mockResolvedValue(page);
-      await listObjects(config, 'bucket', '', 10, null);
-      expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, undefined);
-    });
-
-    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
-      const err = makeS3Error('AccessDenied');
-      mockProvider.listObjects.mockRejectedValue(err);
-      await expect(listObjects(config, 'bucket', '', 10)).rejects.toThrow(err);
-      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
-        bucket: 'bucket',
-        operation: 'listObjects'
-      });
-    });
-
-    it('rethrows non-S3 errors', async () => {
-      const err = new Error('network');
-      mockProvider.listObjects.mockRejectedValue(err);
-      await expect(listObjects(config, 'bucket', '', 10)).rejects.toThrow('network');
-      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('downloadObject', () => {
-    it('returns download from provider', async () => {
-      const download = { stream: new ReadableStream(), contentType: 'text/plain' };
-      mockProvider.getObject.mockResolvedValue(download);
-      const result = await downloadObject(config, 'bucket', 'key.txt');
-      expect(result).toEqual(download);
-    });
-
-    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
-      const err = makeS3Error('NoSuchKey');
-      mockProvider.getObject.mockRejectedValue(err);
-      await expect(downloadObject(config, 'bucket', 'key.txt')).rejects.toThrow(err);
-      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
-        bucket: 'bucket',
-        key: 'key.txt',
-        operation: 'getObject'
-      });
-    });
-
-    it('rethrows non-S3 errors', async () => {
-      const err = new Error('timeout');
-      mockProvider.getObject.mockRejectedValue(err);
-      await expect(downloadObject(config, 'bucket', 'k')).rejects.toThrow('timeout');
-      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('getObjectMetadata', () => {
-    it('proxies to provider', async () => {
-      const meta = { contentType: 'text/plain', contentLength: 42 };
-      mockProvider.getMetadata.mockResolvedValue(meta);
-      expect(await getObjectMetadata(config, 'bucket', 'k')).toEqual(meta);
-    });
-
-    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
-      const err = makeS3Error('NoSuchKey');
-      mockProvider.getMetadata.mockRejectedValue(err);
-      await expect(getObjectMetadata(config, 'bucket', 'k')).rejects.toThrow(err);
-      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
-        bucket: 'bucket',
-        key: 'k',
-        operation: 'getMetadata'
-      });
-    });
-
-    it('rethrows non-S3 errors', async () => {
-      const err = new Error('gone');
-      mockProvider.getMetadata.mockRejectedValue(err);
-      await expect(getObjectMetadata(config, 'bucket', 'k')).rejects.toThrow('gone');
-      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('uploadObject', () => {
-    it('proxies to provider', async () => {
-      mockProvider.putObject.mockResolvedValue(undefined);
-      await uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain', 1);
-      expect(mockProvider.putObject).toHaveBeenCalledWith('k', expect.any(Buffer), 'text/plain', 1);
-    });
-
-    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
-      const err = makeS3Error('AccessDenied');
-      mockProvider.putObject.mockRejectedValue(err);
-      await expect(
-        uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain')
-      ).rejects.toThrow(err);
-      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
-        bucket: 'bucket',
-        key: 'k',
-        operation: 'putObject'
-      });
-    });
-
-    it('rethrows non-S3 errors', async () => {
-      const err = new Error('disk full');
-      mockProvider.putObject.mockRejectedValue(err);
-      await expect(
-        uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain')
-      ).rejects.toThrow('disk full');
-      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('deleteObjects', () => {
-    it('expands directory prefixes and deletes all', async () => {
-      mockProvider.listAllKeys.mockResolvedValue(['dir/a.txt', 'dir/b.txt']);
-      mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      const result = await deleteObjects(config, 'bucket', ['file.txt', 'dir/']);
-      expect(mockProvider.listAllKeys).toHaveBeenCalledWith('dir/');
-      expect(mockProvider.deleteObjects).toHaveBeenCalledWith([
-        'file.txt',
-        'dir/a.txt',
-        'dir/b.txt'
-      ]);
-      expect(result).toEqual({ failed: [] });
-    });
-
-    it('uses directory key itself when no children found', async () => {
-      mockProvider.listAllKeys.mockResolvedValue([]);
-      mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      await deleteObjects(config, 'bucket', ['empty/']);
-      expect(mockProvider.deleteObjects).toHaveBeenCalledWith(['empty/']);
-    });
-
-    it('returns empty result for no keys', async () => {
-      mockProvider.listAllKeys.mockResolvedValue([]);
-      mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      const result = await deleteObjects(config, 'bucket', []);
-      expect(result).toEqual({ failed: [] });
-    });
-
-    it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
-      const err = makeS3Error('AccessDenied');
-      mockProvider.listAllKeys.mockResolvedValue([]);
-      mockProvider.deleteObjects.mockRejectedValue(err);
-      await expect(deleteObjects(config, 'bucket', ['file.txt'])).rejects.toThrow(err);
-      expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
-        bucket: 'bucket',
-        operation: 'deleteObjects'
-      });
-    });
-
-    it('rethrows non-S3 errors', async () => {
-      const err = new Error('network');
-      mockProvider.deleteObjects.mockRejectedValue(err);
-      await expect(deleteObjects(config, 'bucket', ['file.txt'])).rejects.toThrow('network');
-      expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
-    });
-  });
-});
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
deleted file mode 100644
index c27b6532..00000000
--- a/src/lib/server/storage/service.ts
+++ /dev/null
@@ -1,146 +0,0 @@
-import { S3ServiceException, ListBucketsCommand } from '@aws-sdk/client-s3';
-import { createS3Client } from './s3-client.js';
-import { mapS3ErrorToHttp } from './s3-errors.js';
-import { getProvider } from './utils.js';
-import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
-import type { ObjectDownload, DeleteObjectsResult } from './provider.js';
-import type { S3ConnectionConfig } from './types.js';
-import { logger } from '$lib/server/logging';
-
-const log = logger.child({ module: 'storage-service' });
-
-/** List all buckets accessible with the given connection config. */
-export async function listBuckets(config: S3ConnectionConfig): Promise<string[]> {
-  const client = createS3Client(config);
-
-  const output = await client.send(new ListBucketsCommand({}));
-  const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
-  log.debug({ storage_type: config.type, bucket_count: buckets.length }, 'listed buckets');
-  return buckets;
-}
-
-/** List objects at the given bucket/prefix. Throws on S3 errors. */
-export async function listObjects(
-  config: S3ConnectionConfig,
-  bucket: string,
-  prefix: string,
-  pageSize: number,
-  continuationToken?: string | null
-): Promise<StoragePage> {
-  const provider = getProvider(config, bucket);
-
-  try {
-    return await provider.listObjects(prefix, pageSize, continuationToken ?? undefined);
-  } catch (err) {
-    if (err instanceof S3ServiceException) {
-      mapS3ErrorToHttp(err, { bucket, operation: 'listObjects' });
-    }
-    throw err;
-  }
-}
-
-/** Download a single object from the bucket, returning a stream and metadata for the HTTP response. */
-export async function downloadObject(
-  config: S3ConnectionConfig,
-  bucket: string,
-  key: string
-): Promise<ObjectDownload> {
-  const provider = getProvider(config, bucket);
-
-  try {
-    log.debug({ bucket, key }, 'downloading object');
-    const download = await provider.getObject(key);
-    log.info({ bucket, key }, 'object download started');
-    return download;
-  } catch (err) {
-    if (err instanceof S3ServiceException) {
-      mapS3ErrorToHttp(err, { bucket, key, operation: 'getObject' });
-    }
-    throw err;
-  }
-}
-
-/** Fetch metadata for a single object — used for lightweight pre-flight checks. */
-export async function getObjectMetadata(
-  config: S3ConnectionConfig,
-  bucket: string,
-  key: string
-): Promise<StorageMetadata> {
-  const provider = getProvider(config, bucket);
-
-  try {
-    log.debug({ bucket, key }, 'getting object metadata');
-    return await provider.getMetadata(key);
-  } catch (err) {
-    if (err instanceof S3ServiceException) {
-      mapS3ErrorToHttp(err, { bucket, key, operation: 'getMetadata' });
-    }
-    throw err;
-  }
-}
-
-/** Upload an object to the bucket, using multipart upload for large files. */
-export async function uploadObject(
-  config: S3ConnectionConfig,
-  bucket: string,
-  key: string,
-  body: ReadableStream | Buffer,
-  contentType: string,
-  contentLength?: number
-): Promise<void> {
-  const provider = getProvider(config, bucket);
-
-  try {
-    log.debug({ bucket, key, content_type: contentType }, 'uploading object');
-    await provider.putObject(key, body, contentType, contentLength);
-    log.info(
-      { bucket, key, content_type: contentType, content_length: contentLength },
-      'object uploaded'
-    );
-  } catch (err) {
-    if (err instanceof S3ServiceException) {
-      mapS3ErrorToHttp(err, { bucket, key, operation: 'putObject' });
-    }
-    throw err;
-  }
-}
-
-/** Delete one or more objects from the bucket. Returns a result listing any keys that failed.
- *  Directory keys (ending with '/') are expanded to all contained objects before deletion. */
-export async function deleteObjects(
-  config: S3ConnectionConfig,
-  bucket: string,
-  keys: string[]
-): Promise<DeleteObjectsResult> {
-  const provider = getProvider(config, bucket);
-
-  try {
-    // Expand any directory prefixes (keys ending with '/') to their contents.
-    const dirPrefixes = keys.filter((k) => k.endsWith('/'));
-    const fileKeys = keys.filter((k) => !k.endsWith('/'));
-
-    let allKeys = [...fileKeys];
-    for (const prefix of dirPrefixes) {
-      log.debug({ bucket, prefix }, 'expanding directory prefix for deletion');
-      const children = await provider.listAllKeys(prefix);
-      allKeys = allKeys.concat(children.length > 0 ? children : [prefix]);
-    }
-
-    if (allKeys.length === 0) {
-      return { failed: [] };
-    }
-
-    log.debug({ bucket, key_count: allKeys.length }, 'deleting objects');
-    const result = await provider.deleteObjects(allKeys);
-    log.info(
-      { bucket, key_count: allKeys.length, failed_count: result.failed.length },
-      'objects delete completed'
-    );
-    return result;
-  } catch (err) {
-    if (err instanceof S3ServiceException) {
-      mapS3ErrorToHttp(err, { bucket, operation: 'deleteObjects' });
-    }
-    throw err;
-  }
-}
diff --git a/src/lib/server/storage/utils.ts b/src/lib/server/storage/utils.ts
index a0ab2223..7efb2d95 100644
--- a/src/lib/server/storage/utils.ts
+++ b/src/lib/server/storage/utils.ts
@@ -14,3 +14,16 @@ export function getProvider(config: S3ConnectionConfig, bucket: string): Storage
 
   return StorageProviderFactory.create({ ...config, bucket });
 }
+
+/**
+ * Construct a connection-scoped storage provider for operations that do not
+ * require a specific bucket (e.g. listing all buckets).
+ * Throws a 400 HTTP error if the connection type is not supported.
+ */
+export function getConnectionProvider(config: S3ConnectionConfig): StorageProvider {
+  if (config.type !== 's3') {
+    throw error(400, 'Storage backend not supported');
+  }
+
+  return StorageProviderFactory.create({ ...config, bucket: '' });
+}
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index b383aec3..a9a205f2 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -3,7 +3,7 @@ import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
 import { StorageConnectionSchema } from '$lib/storage/schemas.js';
-import { listBuckets } from '$lib/server/storage/service.js';
+import { getConnectionProvider } from '$lib/server/storage/utils.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
@@ -38,7 +38,7 @@ export const actions: Actions = {
     };
 
     try {
-      await listBuckets(config);
+      await getConnectionProvider(config).listBuckets();
       log.info({ storage_type: type }, 'user storage connection verified');
     } catch (err) {
       log.warn({ err }, 'storage connection test failed');
diff --git a/src/routes/(app)/storage/api/buckets/+server.ts b/src/routes/(app)/storage/api/buckets/+server.ts
index 620f983a..0afdce95 100644
--- a/src/routes/(app)/storage/api/buckets/+server.ts
+++ b/src/routes/(app)/storage/api/buckets/+server.ts
@@ -1,4 +1,4 @@
-import { listBuckets } from '$lib/server/storage/service.js';
+import { getConnectionProvider } from '$lib/server/storage/utils.js';
 import { requireConnection } from '$lib/server/storage/connection.js';
 import type { RequestHandler } from './$types';
 
@@ -10,7 +10,7 @@ import type { RequestHandler } from './$types';
  */
 export const GET: RequestHandler = async ({ request, locals }) => {
   const config = requireConnection(request);
-  const buckets = await listBuckets(config);
+  const buckets = await getConnectionProvider(config).listBuckets();
   locals.logger.debug({ bucket_count: buckets.length }, 'bucket list returned');
   return Response.json(buckets);
 };
diff --git a/src/routes/(app)/storage/api/delete/+server.ts b/src/routes/(app)/storage/api/delete/+server.ts
index 4892bb35..5ca7d213 100644
--- a/src/routes/(app)/storage/api/delete/+server.ts
+++ b/src/routes/(app)/storage/api/delete/+server.ts
@@ -1,6 +1,6 @@
 import type { RequestHandler } from './$types';
 import { error } from '@sveltejs/kit';
-import { deleteObjects } from '$lib/server/storage/service.js';
+import { getProvider } from '$lib/server/storage/utils.js';
 import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucket } from '../params.js';
 
@@ -24,7 +24,7 @@ export const DELETE: RequestHandler = async ({ locals, url, request }) => {
 
   locals.logger.debug({ bucket, key_count: keys.length }, 'delete request received');
 
-  const result = await deleteObjects(config, bucket, keys);
+  const result = await getProvider(config, bucket).deleteObjects(keys);
 
   locals.logger.info(
     { bucket, key_count: keys.length, failed_count: result.failed.length },
diff --git a/src/routes/(app)/storage/api/delete/server.test.ts b/src/routes/(app)/storage/api/delete/server.test.ts
index 35783ccb..1418a311 100644
--- a/src/routes/(app)/storage/api/delete/server.test.ts
+++ b/src/routes/(app)/storage/api/delete/server.test.ts
@@ -1,8 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { faker } from '@faker-js/faker';
 
-vi.mock('$lib/server/storage/service.js', () => ({
-  deleteObjects: vi.fn()
+const mockProvider = { deleteObjects: vi.fn() };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
 }));
 
 vi.mock('$lib/server/storage/connection.js', () => ({
@@ -11,7 +12,6 @@ vi.mock('$lib/server/storage/connection.js', () => ({
 }));
 
 import { DELETE } from './+server.js';
-import { deleteObjects } from '$lib/server/storage/service.js';
 
 const CONNECTION_HEADER = {
   'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
@@ -51,12 +51,10 @@ describe('DELETE /storage/api/delete', () => {
   it('deletes objects and returns JSON result', async () => {
     const keys = [faker.system.fileName(), faker.system.fileName()];
     const result = { deleted: keys, failed: [] };
-    vi.mocked(deleteObjects).mockResolvedValue(
-      result as unknown as Awaited<ReturnType<typeof deleteObjects>>
-    );
+    mockProvider.deleteObjects.mockResolvedValue(result);
 
     const response = await DELETE(mockEvent({ bucket: 'b1', keys }));
-    expect(deleteObjects).toHaveBeenCalledWith(expect.objectContaining({ type: 's3' }), 'b1', keys);
+    expect(mockProvider.deleteObjects).toHaveBeenCalledWith(keys);
     expect(await response.json()).toEqual(result);
   });
 });
diff --git a/src/routes/(app)/storage/api/download/+server.ts b/src/routes/(app)/storage/api/download/+server.ts
index e43df827..f74dff8a 100644
--- a/src/routes/(app)/storage/api/download/+server.ts
+++ b/src/routes/(app)/storage/api/download/+server.ts
@@ -1,5 +1,5 @@
 import type { RequestHandler } from './$types';
-import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
+import { getProvider } from '$lib/server/storage/utils.js';
 import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucketKey } from '../params.js';
 
@@ -25,7 +25,7 @@ export const GET: RequestHandler = async ({ locals, url, request }) => {
 
   locals.logger.debug({ bucket, key }, 'download request received');
 
-  const download = await downloadObject(config, bucket, key);
+  const download = await getProvider(config, bucket).getObject(key);
 
   const filename = filenameFromKey(key);
   // RFC 5987 encoding for non-ASCII filenames in Content-Disposition
@@ -66,7 +66,7 @@ export const HEAD: RequestHandler = async ({ locals, url, request }) => {
 
   locals.logger.debug({ bucket, key }, 'download pre-flight check');
 
-  const meta = await getObjectMetadata(config, bucket, key);
+  const meta = await getProvider(config, bucket).getMetadata(key);
 
   return new Response(null, {
     status: 200,
diff --git a/src/routes/(app)/storage/api/download/server.test.ts b/src/routes/(app)/storage/api/download/server.test.ts
index d0304e87..6f754b32 100644
--- a/src/routes/(app)/storage/api/download/server.test.ts
+++ b/src/routes/(app)/storage/api/download/server.test.ts
@@ -1,8 +1,8 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
-vi.mock('$lib/server/storage/service.js', () => ({
-  downloadObject: vi.fn(),
-  getObjectMetadata: vi.fn()
+const mockProvider = { getObject: vi.fn(), getMetadata: vi.fn() };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
 }));
 
 vi.mock('$lib/server/storage/connection.js', () => ({
@@ -11,7 +11,6 @@ vi.mock('$lib/server/storage/connection.js', () => ({
 }));
 
 import { GET, HEAD } from './+server.js';
-import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
 
 const CONNECTION_HEADER = {
   'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
@@ -31,12 +30,12 @@ describe('GET /storage/api/download', () => {
 
   it('streams download with correct headers', async () => {
     const stream = new ReadableStream();
-    vi.mocked(downloadObject).mockResolvedValue({
+    mockProvider.getObject.mockResolvedValue({
       stream,
       contentType: 'text/csv',
       contentLength: 1234,
       etag: '"abc"'
-    } as unknown as Awaited<ReturnType<typeof downloadObject>>);
+    });
 
     const res = await GET(mockEvent('bucket=b1&key=path/data.csv'));
 
@@ -48,12 +47,12 @@ describe('GET /storage/api/download', () => {
   });
 
   it('uses application/octet-stream when no content type', async () => {
-    vi.mocked(downloadObject).mockResolvedValue({
+    mockProvider.getObject.mockResolvedValue({
       stream: new ReadableStream(),
       contentType: undefined,
       contentLength: undefined,
       etag: undefined
-    } as unknown as Awaited<ReturnType<typeof downloadObject>>);
+    });
 
     const res = await GET(mockEvent('bucket=b1&key=file.bin'));
     expect(res.headers.get('Content-Type')).toBe('application/octet-stream');
@@ -65,10 +64,10 @@ describe('HEAD /storage/api/download', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('returns 200 with metadata headers', async () => {
-    vi.mocked(getObjectMetadata).mockResolvedValue({
+    mockProvider.getMetadata.mockResolvedValue({
       contentType: 'application/json',
       size: 999
-    } as unknown as Awaited<ReturnType<typeof getObjectMetadata>>);
+    });
 
     const res = await HEAD(mockEvent('bucket=b1&key=data.json'));
 
diff --git a/src/routes/(app)/storage/api/objects/+server.ts b/src/routes/(app)/storage/api/objects/+server.ts
index d1fb56f9..547be682 100644
--- a/src/routes/(app)/storage/api/objects/+server.ts
+++ b/src/routes/(app)/storage/api/objects/+server.ts
@@ -1,5 +1,5 @@
 import { error } from '@sveltejs/kit';
-import { listObjects } from '$lib/server/storage/service.js';
+import { getProvider } from '$lib/server/storage/utils.js';
 import { requireConnection } from '$lib/server/storage/connection.js';
 import type { RequestHandler } from './$types';
 
@@ -25,6 +25,10 @@ export const GET: RequestHandler = async ({ request, url, locals }) => {
     'listing objects'
   );
 
-  const page = await listObjects(config, bucket, prefix, pageSize, continuationToken);
+  const page = await getProvider(config, bucket).listObjects(
+    prefix,
+    pageSize,
+    continuationToken ?? undefined
+  );
   return Response.json(page);
 };
diff --git a/src/routes/(app)/storage/api/upload/+server.ts b/src/routes/(app)/storage/api/upload/+server.ts
index dc58c546..096b9488 100644
--- a/src/routes/(app)/storage/api/upload/+server.ts
+++ b/src/routes/(app)/storage/api/upload/+server.ts
@@ -1,5 +1,5 @@
 import { error } from '@sveltejs/kit';
-import { uploadObject } from '$lib/server/storage/service.js';
+import { getProvider } from '$lib/server/storage/utils.js';
 import { requireConnection } from '$lib/server/storage/connection.js';
 import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
@@ -35,7 +35,7 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     'upload request received'
   );
 
-  await uploadObject(config, bucket, key, request.body, contentType, contentLength);
+  await getProvider(config, bucket).putObject(key, request.body, contentType, contentLength);
 
   log.info(
     { bucket, key, content_type: contentType, content_length: contentLength },
diff --git a/src/routes/(app)/storage/api/upload/server.test.ts b/src/routes/(app)/storage/api/upload/server.test.ts
index b8adfdb9..f50a6cee 100644
--- a/src/routes/(app)/storage/api/upload/server.test.ts
+++ b/src/routes/(app)/storage/api/upload/server.test.ts
@@ -1,7 +1,8 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
-vi.mock('$lib/server/storage/service.js', () => ({
-  uploadObject: vi.fn()
+const mockProvider = { putObject: vi.fn() };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
 }));
 
 vi.mock('$lib/server/storage/connection.js', () => ({
@@ -10,7 +11,6 @@ vi.mock('$lib/server/storage/connection.js', () => ({
 }));
 
 import { POST } from './+server.js';
-import { uploadObject } from '$lib/server/storage/service.js';
 
 const CONNECTION_HEADER = {
   'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
@@ -51,7 +51,7 @@ describe('POST /storage/api/upload', () => {
   });
 
   it('uploads and returns 201', async () => {
-    vi.mocked(uploadObject).mockResolvedValue(undefined);
+    mockProvider.putObject.mockResolvedValue(undefined);
     const body = new ReadableStream();
 
     const res = await POST(
@@ -66,22 +66,15 @@ describe('POST /storage/api/upload', () => {
     );
 
     expect(res.status).toBe(201);
-    expect(uploadObject).toHaveBeenCalledWith(
-      expect.objectContaining({ type: 's3' }),
-      'b1',
-      'file.txt',
-      body,
-      'image/png',
-      100
-    );
+    expect(mockProvider.putObject).toHaveBeenCalledWith(body, 'image/png', 100);
   });
 
   it('defaults content type to application/octet-stream', async () => {
-    vi.mocked(uploadObject).mockResolvedValue(undefined);
+    mockProvider.putObject.mockResolvedValue(undefined);
 
     const res = await POST(mockEvent({ headers: { ...CONNECTION_HEADER } }));
 
     expect(res.status).toBe(201);
-    expect(vi.mocked(uploadObject).mock.calls[0][4]).toBe('application/octet-stream');
+    expect(mockProvider.putObject.mock.calls[0][1]).toBe('application/octet-stream');
   });
 });
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
index 207b214c..89efaa6b 100644
--- a/src/routes/(app)/storage/page.server.test.ts
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -1,7 +1,8 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
-vi.mock('$lib/server/storage/service.js', () => ({
-  listBuckets: vi.fn()
+const mockConnectionProvider = { listBuckets: vi.fn() };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getConnectionProvider: () => mockConnectionProvider
 }));
 
 vi.mock('$lib/storage/schemas.js', () => ({
@@ -18,7 +19,6 @@ vi.mock('sveltekit-superforms/adapters', () => ({
 }));
 
 import { load, actions } from './+page.server.js';
-import { listBuckets } from '$lib/server/storage/service.js';
 import { superValidate } from 'sveltekit-superforms';
 
 function mockLocals() {
@@ -87,7 +87,7 @@ describe('storage page actions', () => {
         secretAccessKey: 'sk'
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
-    vi.mocked(listBuckets).mockRejectedValue(new Error('connection refused'));
+    mockConnectionProvider.listBuckets.mockRejectedValue(new Error('connection refused'));
 
     const result = await actions.connect({
       request: new Request('http://localhost', { method: 'POST' }),
@@ -111,7 +111,7 @@ describe('storage page actions', () => {
         secretAccessKey: 'sk'
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
-    vi.mocked(listBuckets).mockResolvedValue(['b1']);
+    mockConnectionProvider.listBuckets.mockResolvedValue(['b1']);
 
     await expect(
       actions.connect({

From 739fbdbb0d33c990ca50e04b94955ba416c8f796 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 8 Jun 2026 09:13:57 +0200
Subject: [PATCH 055/136] refactor: rename listBuckets to listContainers across
 storage providers and tests

---
 src/lib/server/storage/hdfs-provider.ts       |   2 +-
 src/lib/server/storage/preview/stream.test.ts |   2 +-
 src/lib/server/storage/provider.ts            |   2 +-
 src/lib/server/storage/s3-provider.test.ts    |  14 +-
 src/lib/server/storage/s3-provider.ts         | 245 +++++++-----------
 src/routes/(app)/storage/+page.server.ts      |   2 +-
 .../(app)/storage/api/buckets/+server.ts      |   2 +-
 src/routes/(app)/storage/page.server.test.ts  |   6 +-
 8 files changed, 107 insertions(+), 168 deletions(-)

diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index 1a8df630..faa5c07c 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -10,7 +10,7 @@ import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 export class HDFSStorageProvider implements StorageProvider {
   constructor(_config: HDFSConfig) {}
 
-  listBuckets(): Promise<string[]> {
+  listContainers(): Promise<string[]> {
     throw new Error('HDFS not implemented');
   }
 
diff --git a/src/lib/server/storage/preview/stream.test.ts b/src/lib/server/storage/preview/stream.test.ts
index 6d11d0e7..458c16c8 100644
--- a/src/lib/server/storage/preview/stream.test.ts
+++ b/src/lib/server/storage/preview/stream.test.ts
@@ -7,7 +7,7 @@ const mockLog = { info: vi.fn(), debug: vi.fn(), warn: vi.fn() } as unknown as p
 
 function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider {
   return {
-    listBuckets: vi.fn(),
+    listContainers: vi.fn(),
     listObjects: vi.fn(),
     getObject: vi
       .fn()
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index c666165b..2977e238 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -13,7 +13,7 @@ export interface ObjectDownload {
 /** Backend-agnostic interface for a bucket-scoped storage provider. */
 export interface StorageProvider {
   /** List all buckets accessible with the current connection credentials. */
-  listBuckets(): Promise<string[]>;
+  listContainers(): Promise<string[]>;
   /**
    * List objects using cursor-based pagination. `continuationToken` is the
    * provider-specific opaque token returned from a previous call. When
diff --git a/src/lib/server/storage/s3-provider.test.ts b/src/lib/server/storage/s3-provider.test.ts
index 73ada8fe..7856b1f6 100644
--- a/src/lib/server/storage/s3-provider.test.ts
+++ b/src/lib/server/storage/s3-provider.test.ts
@@ -511,10 +511,10 @@ describe('S3StorageProvider constructor', () => {
 });
 
 // ---------------------------------------------------------------------------
-// listBuckets
+// listContainers
 // ---------------------------------------------------------------------------
 
-describe('S3StorageProvider.listBuckets', () => {
+describe('S3StorageProvider.listContainers', () => {
   let provider: S3StorageProvider;
   let send: ReturnType<typeof vi.fn>;
 
@@ -524,28 +524,28 @@ describe('S3StorageProvider.listBuckets', () => {
 
   it('returns bucket names', async () => {
     send.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: 'b' }] });
-    expect(await provider.listBuckets()).toEqual(['a', 'b']);
+    expect(await provider.listContainers()).toEqual(['a', 'b']);
   });
 
   it('filters out buckets with no name', async () => {
     send.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: undefined }, { Name: '' }] });
-    expect(await provider.listBuckets()).toEqual(['a']);
+    expect(await provider.listContainers()).toEqual(['a']);
   });
 
   it('handles null Buckets in response', async () => {
     send.mockResolvedValue({ Buckets: null });
-    expect(await provider.listBuckets()).toEqual([]);
+    expect(await provider.listContainers()).toEqual([]);
   });
 
   it('maps AccessDenied S3 error to HTTP 403', async () => {
     send.mockRejectedValue(makeS3Error('AccessDenied', 403));
-    await expect(provider.listBuckets()).rejects.toMatchObject({ status: 403 });
+    await expect(provider.listContainers()).rejects.toMatchObject({ status: 403 });
   });
 
   it('re-throws non-S3 errors', async () => {
     const err = new Error('network');
     send.mockRejectedValue(err);
-    await expect(provider.listBuckets()).rejects.toThrow('network');
+    await expect(provider.listContainers()).rejects.toThrow('network');
   });
 });
 
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 60052508..7f2594fb 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -27,7 +27,7 @@ export class S3StorageProvider implements StorageProvider {
     this.client = client ?? createS3Client(config);
   }
 
-  async listBuckets(): Promise<string[]> {
+  async listContainers(): Promise<string[]> {
     log.trace({ bucket: this.bucket }, 'S3 ListBuckets');
     try {
       const output = await this.client.send(new ListBucketsCommand({}));
@@ -49,113 +49,81 @@ export class S3StorageProvider implements StorageProvider {
   ): Promise<StoragePage> {
     log.trace({ bucket: this.bucket, prefix, page_size: pageSize }, 'S3 ListObjectsV2');
 
-    try {
-      const output: ListObjectsV2CommandOutput = await this.client.send(
-        new ListObjectsV2Command({
-          Bucket: this.bucket,
-          Prefix: prefix || undefined,
-          Delimiter: '/',
-          MaxKeys: pageSize,
-          ContinuationToken: continuationToken ?? undefined
-        })
-      );
+    const output: ListObjectsV2CommandOutput = await this.client.send(
+      new ListObjectsV2Command({
+        Bucket: this.bucket,
+        Prefix: prefix || undefined,
+        Delimiter: '/',
+        MaxKeys: pageSize,
+        ContinuationToken: continuationToken ?? undefined
+      })
+    );
 
-      const objects: StorageObject[] = [
-        ...(output.CommonPrefixes ?? []).map((cp) => ({
-          key: cp.Prefix ?? '',
-          size: 0,
-          lastModified: new Date(0),
-          isDirectory: true,
+    const objects: StorageObject[] = [
+      ...(output.CommonPrefixes ?? []).map((cp) => ({
+        key: cp.Prefix ?? '',
+        size: 0,
+        lastModified: new Date(0),
+        isDirectory: true,
+        contentType: undefined
+      })),
+      ...(output.Contents ?? [])
+        // Filter out the prefix itself (S3 sometimes echoes it back)
+        .filter((obj) => obj.Key !== prefix)
+        .map((obj) => ({
+          key: obj.Key ?? '',
+          size: obj.Size ?? 0,
+          lastModified: obj.LastModified ?? new Date(0),
+          isDirectory: false,
           contentType: undefined
-        })),
-        ...(output.Contents ?? [])
-          // Filter out the prefix itself (S3 sometimes echoes it back)
-          .filter((obj) => obj.Key !== prefix)
-          .map((obj) => ({
-            key: obj.Key ?? '',
-            size: obj.Size ?? 0,
-            lastModified: obj.LastModified ?? new Date(0),
-            isDirectory: false,
-            contentType: undefined
-          }))
-      ];
-
-      return {
-        objects,
-        hasNextPage: output.IsTruncated ?? false,
-        currentPage: 1,
-        pageSize,
-        continuationToken: continuationToken ?? null,
-        nextContinuationToken: output.NextContinuationToken ?? null
-      };
-    } catch (err) {
-      if (err instanceof S3ServiceException) {
-        mapS3ErrorToHttp(err, { bucket: this.bucket, operation: 'listObjects' });
-      }
-      throw err;
-    }
+        }))
+    ];
+
+    return {
+      objects,
+      hasNextPage: output.IsTruncated ?? false,
+      currentPage: 1,
+      pageSize,
+      continuationToken: continuationToken ?? null,
+      nextContinuationToken: output.NextContinuationToken ?? null
+    };
   }
 
   async getObject(key: string): Promise<ObjectDownload> {
     log.trace({ bucket: this.bucket, key }, 'S3 GetObject');
-    try {
-      const output = await this.client.send(
-        new GetObjectCommand({ Bucket: this.bucket, Key: key })
-      );
-      if (!output.Body) {
-        throw new Error(`Object ${key} has no body`);
-      }
-      return {
-        stream: output.Body.transformToWebStream(),
-        contentType: output.ContentType,
-        contentLength: output.ContentLength,
-        etag: output.ETag
-      };
-    } catch (err) {
-      if (err instanceof S3ServiceException) {
-        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'getObject' });
-      }
-      throw err;
+    const output = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
+    if (!output.Body) {
+      throw new Error(`Object ${key} has no body`);
     }
+    return {
+      stream: output.Body.transformToWebStream(),
+      contentType: output.ContentType,
+      contentLength: output.ContentLength,
+      etag: output.ETag
+    };
   }
 
   async getObjectRange(key: string, start: number, end: number): Promise<ReadableStream> {
     log.trace({ bucket: this.bucket, key, start, end }, 'S3 GetObject (range)');
-    try {
-      const output = await this.client.send(
-        new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
-      );
-      if (!output.Body) {
-        throw new Error(`Object ${key} has no body`);
-      }
-      return output.Body.transformToWebStream();
-    } catch (err) {
-      if (err instanceof S3ServiceException) {
-        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'getObjectRange' });
-      }
-      throw err;
+    const output = await this.client.send(
+      new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
+    );
+    if (!output.Body) {
+      throw new Error(`Object ${key} has no body`);
     }
+    return output.Body.transformToWebStream();
   }
 
   async getMetadata(key: string): Promise<StorageMetadata> {
     log.trace({ bucket: this.bucket, key }, 'S3 HeadObject');
-    try {
-      const output = await this.client.send(
-        new HeadObjectCommand({ Bucket: this.bucket, Key: key })
-      );
-      return {
-        size: output.ContentLength ?? 0,
-        lastModified: output.LastModified ?? new Date(0),
-        contentType: output.ContentType,
-        etag: output.ETag,
-        customMetadata: output.Metadata
-      };
-    } catch (err) {
-      if (err instanceof S3ServiceException) {
-        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'getMetadata' });
-      }
-      throw err;
-    }
+    const output = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
+    return {
+      size: output.ContentLength ?? 0,
+      lastModified: output.LastModified ?? new Date(0),
+      contentType: output.ContentType,
+      etag: output.ETag,
+      customMetadata: output.Metadata
+    };
   }
 
   async exists(key: string): Promise<boolean> {
@@ -183,73 +151,44 @@ export class S3StorageProvider implements StorageProvider {
       { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
       'S3 Upload'
     );
-    try {
-      const upload = new Upload({
-        client: this.client,
-        queueSize: 4,
-        partSize: 5 * 1024 * 1024,
-        params: {
-          Bucket: this.bucket,
-          Key: key,
-          Body: body,
-          ContentType: contentType,
-          ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
-        }
-      });
-      await upload.done();
-    } catch (err) {
-      if (err instanceof S3ServiceException) {
-        mapS3ErrorToHttp(err, { bucket: this.bucket, key, operation: 'putObject' });
+    const upload = new Upload({
+      client: this.client,
+      queueSize: 4,
+      partSize: 5 * 1024 * 1024,
+      params: {
+        Bucket: this.bucket,
+        Key: key,
+        Body: body,
+        ContentType: contentType,
+        ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
       }
-      throw err;
-    }
+    });
+    await upload.done();
   }
 
   async deleteObjects(keys: string[]): Promise<DeleteObjectsResult> {
-    // Expand any directory prefixes (keys ending with '/') to their contents.
-    const dirPrefixes = keys.filter((k) => k.endsWith('/'));
-    const fileKeys = keys.filter((k) => !k.endsWith('/'));
-
-    let allKeys = [...fileKeys];
-    for (const prefix of dirPrefixes) {
-      log.debug({ bucket: this.bucket, prefix }, 'expanding directory prefix for deletion');
-      const children = await this.listAllKeys(prefix);
-      allKeys = allKeys.concat(children.length > 0 ? children : [prefix]);
-    }
-
-    if (allKeys.length === 0) {
-      return { failed: [] };
-    }
-
-    log.trace({ bucket: this.bucket, key_count: allKeys.length }, 'S3 DeleteObjects');
-    try {
-      const output = await this.client.send(
-        new DeleteObjectsCommand({
-          Bucket: this.bucket,
-          Delete: {
-            Objects: allKeys.map((key) => ({ Key: key })),
-            Quiet: true
-          }
-        })
+    log.trace({ bucket: this.bucket, key_count: keys.length }, 'S3 DeleteObjects');
+    const output = await this.client.send(
+      new DeleteObjectsCommand({
+        Bucket: this.bucket,
+        Delete: {
+          Objects: keys.map((key) => ({ Key: key })),
+          Quiet: true
+        }
+      })
+    );
+    const failed = (output.Errors ?? []).map((e) => ({
+      key: e.Key ?? '',
+      code: e.Code,
+      message: e.Message
+    }));
+    if (failed.length > 0) {
+      log.warn(
+        { bucket: this.bucket, failed_count: failed.length },
+        'some objects failed to delete'
       );
-      const failed = (output.Errors ?? []).map((e) => ({
-        key: e.Key ?? '',
-        code: e.Code,
-        message: e.Message
-      }));
-      if (failed.length > 0) {
-        log.warn(
-          { bucket: this.bucket, failed_count: failed.length },
-          'some objects failed to delete'
-        );
-      }
-      return { failed };
-    } catch (err) {
-      if (err instanceof S3ServiceException) {
-        mapS3ErrorToHttp(err, { bucket: this.bucket, operation: 'deleteObjects' });
-      }
-      throw err;
     }
+    return { failed };
   }
 
   async listAllKeys(prefix: string): Promise<string[]> {
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index a9a205f2..55cab9d9 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -38,7 +38,7 @@ export const actions: Actions = {
     };
 
     try {
-      await getConnectionProvider(config).listBuckets();
+      await getConnectionProvider(config).listContainers();
       log.info({ storage_type: type }, 'user storage connection verified');
     } catch (err) {
       log.warn({ err }, 'storage connection test failed');
diff --git a/src/routes/(app)/storage/api/buckets/+server.ts b/src/routes/(app)/storage/api/buckets/+server.ts
index 0408290d..dadfa8e1 100644
--- a/src/routes/(app)/storage/api/buckets/+server.ts
+++ b/src/routes/(app)/storage/api/buckets/+server.ts
@@ -10,7 +10,7 @@ import type { RequestHandler } from './$types';
  * in hooks.server.ts before this handler runs.
  */
 export const GET: RequestHandler = async ({ locals }) => {
-  const buckets = await getConnectionProvider(locals.storageConfig!).listBuckets();
+  const buckets = await getConnectionProvider(locals.storageConfig!).listContainers();
   locals.logger.debug({ bucket_count: buckets.length }, 'bucket list returned');
   return Response.json(buckets);
 };
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
index 89efaa6b..d3e4926e 100644
--- a/src/routes/(app)/storage/page.server.test.ts
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -1,6 +1,6 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
-const mockConnectionProvider = { listBuckets: vi.fn() };
+const mockConnectionProvider = { listContainers: vi.fn() };
 vi.mock('$lib/server/storage/utils.js', () => ({
   getConnectionProvider: () => mockConnectionProvider
 }));
@@ -87,7 +87,7 @@ describe('storage page actions', () => {
         secretAccessKey: 'sk'
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
-    mockConnectionProvider.listBuckets.mockRejectedValue(new Error('connection refused'));
+    mockConnectionProvider.listContainers.mockRejectedValue(new Error('connection refused'));
 
     const result = await actions.connect({
       request: new Request('http://localhost', { method: 'POST' }),
@@ -111,7 +111,7 @@ describe('storage page actions', () => {
         secretAccessKey: 'sk'
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
-    mockConnectionProvider.listBuckets.mockResolvedValue(['b1']);
+    mockConnectionProvider.listContainers.mockResolvedValue(['b1']);
 
     await expect(
       actions.connect({

From 265654aeca85e1f8358cd3942735971e0c9f1e49 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 8 Jun 2026 10:11:27 +0200
Subject: [PATCH 056/136] refactor: centralize S3 error handling with
 withS3Errors function

---
 src/lib/server/storage/s3-provider.ts | 185 +++++++++++++++++---------
 1 file changed, 121 insertions(+), 64 deletions(-)

diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 7f2594fb..594030bf 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -18,6 +18,18 @@ import { mapS3ErrorToHttp } from './s3-errors.js';
 
 const log = logger.child({ module: 's3-provider' });
 
+/** Runs `fn` and maps any S3ServiceException to an HTTP error via `mapS3ErrorToHttp`. */
+async function withS3Errors<T>(
+  fn: () => Promise<T>,
+  context: Parameters<typeof mapS3ErrorToHttp>[1]
+): Promise<T> {
+  try {
+    return await fn();
+  } catch (err) {
+    mapS3ErrorToHttp(err, context);
+  }
+}
+
 export class S3StorageProvider implements StorageProvider {
   private readonly client: S3Client;
   private readonly bucket: string;
@@ -29,17 +41,15 @@ export class S3StorageProvider implements StorageProvider {
 
   async listContainers(): Promise<string[]> {
     log.trace({ bucket: this.bucket }, 'S3 ListBuckets');
-    try {
-      const output = await this.client.send(new ListBucketsCommand({}));
-      const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
-      log.debug({ bucket_count: buckets.length }, 'listed buckets');
-      return buckets;
-    } catch (err) {
-      if (err instanceof S3ServiceException) {
-        mapS3ErrorToHttp(err, { operation: 'listBuckets' });
-      }
-      throw err;
-    }
+    return withS3Errors(
+      async () => {
+        const output = await this.client.send(new ListBucketsCommand({}));
+        const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
+        log.debug({ bucket_count: buckets.length }, 'listed buckets');
+        return buckets;
+      },
+      { operation: 'listBuckets' }
+    );
   }
 
   async listObjects(
@@ -48,15 +58,18 @@ export class S3StorageProvider implements StorageProvider {
     continuationToken?: string | null
   ): Promise<StoragePage> {
     log.trace({ bucket: this.bucket, prefix, page_size: pageSize }, 'S3 ListObjectsV2');
-
-    const output: ListObjectsV2CommandOutput = await this.client.send(
-      new ListObjectsV2Command({
-        Bucket: this.bucket,
-        Prefix: prefix || undefined,
-        Delimiter: '/',
-        MaxKeys: pageSize,
-        ContinuationToken: continuationToken ?? undefined
-      })
+    const output = await withS3Errors(
+      () =>
+        this.client.send(
+          new ListObjectsV2Command({
+            Bucket: this.bucket,
+            Prefix: prefix || undefined,
+            Delimiter: '/',
+            MaxKeys: pageSize,
+            ContinuationToken: continuationToken ?? undefined
+          })
+        ),
+      { bucket: this.bucket, operation: 'listObjects' }
     );
 
     const objects: StorageObject[] = [
@@ -91,39 +104,58 @@ export class S3StorageProvider implements StorageProvider {
 
   async getObject(key: string): Promise<ObjectDownload> {
     log.trace({ bucket: this.bucket, key }, 'S3 GetObject');
-    const output = await this.client.send(new GetObjectCommand({ Bucket: this.bucket, Key: key }));
-    if (!output.Body) {
-      throw new Error(`Object ${key} has no body`);
-    }
-    return {
-      stream: output.Body.transformToWebStream(),
-      contentType: output.ContentType,
-      contentLength: output.ContentLength,
-      etag: output.ETag
-    };
+    return withS3Errors(
+      async () => {
+        const output = await this.client.send(
+          new GetObjectCommand({ Bucket: this.bucket, Key: key })
+        );
+        if (!output.Body) {
+          throw new Error(`Object ${key} has no body`);
+        }
+        return {
+          stream: output.Body.transformToWebStream(),
+          contentType: output.ContentType,
+          contentLength: output.ContentLength,
+          etag: output.ETag
+        };
+      },
+      { bucket: this.bucket, key, operation: 'getObject' }
+    );
   }
 
   async getObjectRange(key: string, start: number, end: number): Promise<ReadableStream> {
     log.trace({ bucket: this.bucket, key, start, end }, 'S3 GetObject (range)');
-    const output = await this.client.send(
-      new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
+    return withS3Errors(
+      async () => {
+        const output = await this.client.send(
+          new GetObjectCommand({ Bucket: this.bucket, Key: key, Range: `bytes=${start}-${end}` })
+        );
+        if (!output.Body) {
+          throw new Error(`Object ${key} has no body`);
+        }
+        return output.Body.transformToWebStream();
+      },
+      { bucket: this.bucket, key, operation: 'getObjectRange' }
     );
-    if (!output.Body) {
-      throw new Error(`Object ${key} has no body`);
-    }
-    return output.Body.transformToWebStream();
   }
 
   async getMetadata(key: string): Promise<StorageMetadata> {
     log.trace({ bucket: this.bucket, key }, 'S3 HeadObject');
-    const output = await this.client.send(new HeadObjectCommand({ Bucket: this.bucket, Key: key }));
-    return {
-      size: output.ContentLength ?? 0,
-      lastModified: output.LastModified ?? new Date(0),
-      contentType: output.ContentType,
-      etag: output.ETag,
-      customMetadata: output.Metadata
-    };
+    return withS3Errors(
+      async () => {
+        const output = await this.client.send(
+          new HeadObjectCommand({ Bucket: this.bucket, Key: key })
+        );
+        return {
+          size: output.ContentLength ?? 0,
+          lastModified: output.LastModified ?? new Date(0),
+          contentType: output.ContentType,
+          etag: output.ETag,
+          customMetadata: output.Metadata
+        };
+      },
+      { bucket: this.bucket, key, operation: 'getMetadata' }
+    );
   }
 
   async exists(key: string): Promise<boolean> {
@@ -163,32 +195,57 @@ export class S3StorageProvider implements StorageProvider {
         ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
       }
     });
-    await upload.done();
+    await withS3Errors(() => upload.done(), { bucket: this.bucket, key, operation: 'putObject' });
   }
 
   async deleteObjects(keys: string[]): Promise<DeleteObjectsResult> {
     log.trace({ bucket: this.bucket, key_count: keys.length }, 'S3 DeleteObjects');
-    const output = await this.client.send(
-      new DeleteObjectsCommand({
-        Bucket: this.bucket,
-        Delete: {
-          Objects: keys.map((key) => ({ Key: key })),
-          Quiet: true
+
+    if (keys.length === 0) {
+      return { failed: [] };
+    }
+
+    // Expand directory prefixes to their contained keys
+    const resolvedKeys: string[] = [];
+    for (const key of keys) {
+      if (key.endsWith('/')) {
+        const children = await this.listAllKeys(key);
+        if (children.length > 0) {
+          resolvedKeys.push(...children);
+        } else {
+          resolvedKeys.push(key);
         }
-      })
-    );
-    const failed = (output.Errors ?? []).map((e) => ({
-      key: e.Key ?? '',
-      code: e.Code,
-      message: e.Message
-    }));
-    if (failed.length > 0) {
-      log.warn(
-        { bucket: this.bucket, failed_count: failed.length },
-        'some objects failed to delete'
-      );
+      } else {
+        resolvedKeys.push(key);
+      }
     }
-    return { failed };
+
+    return withS3Errors(
+      async () => {
+        const output = await this.client.send(
+          new DeleteObjectsCommand({
+            Bucket: this.bucket,
+            Delete: {
+              Objects: resolvedKeys.map((key) => ({ Key: key })),
+              Quiet: true
+            }
+          })
+        );
+        const failed = (output.Errors ?? []).map((e) => ({
+          key: e.Key ?? '',
+          code: e.Code,
+          message: e.Message
+        }));
+        if (failed.length > 0) {
+          log.warn(
+            { bucket: this.bucket, failed_count: failed.length },
+            'some objects failed to delete'
+          );
+        }
+        return { failed };
+      },
+      { bucket: this.bucket, operation: 'deleteObjects' }
+    );
   }
 
   async listAllKeys(prefix: string): Promise<string[]> {

From f8e7f2d4c8ffe325e225fa790c759af82cf289e0 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 9 Jun 2026 10:35:20 +0200
Subject: [PATCH 057/136] #185 Save Connection in Browser (#189)

* #185 move saved s3 connection from backend to frontend

* #185 update e2e tests for browser connections

* #185 fix unit test

* #185 fix lint

* #185 move request handling to middleware
---
 TECH_DEBT.md                                  | 14 +---
 e2e/storage/helpers.ts                        | 28 ++++++++
 e2e/storage/permissions.spec.ts               |  1 +
 e2e/storage/preview.spec.ts                   |  8 +--
 e2e/storage/recent-items.spec.ts              | 27 ++++---
 src/app.d.ts                                  |  8 +++
 src/hooks.server.ts                           | 22 +++++-
 .../storage/modals/PreviewModal.svelte        | 52 ++++++++------
 .../modals/preview/FallbackPreview.svelte     |  9 ++-
 .../preview/FallbackPreview.svelte.spec.ts    | 39 +++++-----
 .../storage/modals/upload/UploadModal.svelte  | 24 +++++--
 .../modals/upload/UploadModal.svelte.spec.ts  | 30 ++++++--
 .../storage/sidebar/BucketList.svelte         |  8 ++-
 src/lib/server/storage/connection.ts          | 53 ++++++++++++++
 src/lib/server/storage/service.test.ts        | 72 ++++++++-----------
 src/lib/server/storage/service.ts             | 56 +++++++--------
 .../server/storage/user-connections.test.ts   | 67 -----------------
 src/lib/server/storage/user-connections.ts    | 20 ------
 src/lib/server/storage/utils.test.ts          | 31 +++-----
 src/lib/server/storage/utils.ts               | 17 +++--
 src/lib/storage/connection-storage.ts         | 17 ++++-
 src/lib/storage/download.ts                   | 53 +++++++++-----
 src/lib/storage/state.svelte.ts               | 13 +++-
 src/lib/storage/upload.ts                     | 19 ++++-
 src/routes/(app)/storage/+error.svelte        |  9 ++-
 src/routes/(app)/storage/+layout.server.ts    | 19 ++---
 src/routes/(app)/storage/+layout.ts           | 35 +++++++++
 src/routes/(app)/storage/+page.server.ts      | 25 ++-----
 .../[bucket]/[...prefix]/+page.server.ts      | 23 +-----
 .../storage/[bucket]/[...prefix]/+page.svelte | 51 ++++++++++++-
 .../storage/[bucket]/[...prefix]/+page.ts     | 56 +++++++++++++++
 .../[bucket]/[...prefix]/page.server.test.ts  | 59 ++++-----------
 .../(app)/storage/api/buckets/+server.ts      | 16 +++++
 .../(app)/storage/api/delete/+server.ts       |  8 +--
 .../(app)/storage/api/delete/server.test.ts   | 17 +++--
 .../(app)/storage/api/download/+server.ts     | 16 +++--
 .../(app)/storage/api/download/server.test.ts | 15 ++--
 .../(app)/storage/api/objects/+server.ts      | 35 +++++++++
 .../(app)/storage/api/preview/+server.ts      | 19 +++--
 .../(app)/storage/api/preview/server.test.ts  | 21 +++---
 .../(app)/storage/api/upload/+server.ts       | 12 +---
 .../(app)/storage/api/upload/server.test.ts   | 26 ++++---
 .../(app)/storage/layout.server.test.ts       | 42 +----------
 src/routes/(app)/storage/page.server.test.ts  | 23 ++----
 44 files changed, 688 insertions(+), 527 deletions(-)
 create mode 100644 src/lib/server/storage/connection.ts
 delete mode 100644 src/lib/server/storage/user-connections.test.ts
 delete mode 100644 src/lib/server/storage/user-connections.ts
 create mode 100644 src/routes/(app)/storage/+layout.ts
 create mode 100644 src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
 create mode 100644 src/routes/(app)/storage/api/buckets/+server.ts
 create mode 100644 src/routes/(app)/storage/api/objects/+server.ts

diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index d21111ed..b3e21208 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -30,11 +30,11 @@ S3 connection credentials (access key ID and secret access key) are persisted in
 
 ---
 
-### In-memory storage connection state
+### Download endpoint buffers entire object in browser memory
 
-**File:** `src/lib/server/storage/user-connections.ts`
+**File:** `src/lib/storage/download.ts`
 
-Per-user S3 connection configs (endpoint, region, credentials) are stored in a server-side `Map`. All connections are lost on server restart and cannot be shared across multiple replicas. Acceptable for the initial phase; mirrors the same pattern used by the Trino user-clients module. Long-term fix: persist encrypted connection configs server-side, tied to the authenticated session.
+`downloadObject` fetches the full S3 object body via the `/storage/api/download` endpoint, buffers it as a `Blob` in browser memory, then triggers a programmatic anchor click. This is simpler than streaming directly to disk but means the entire object must fit in browser memory before the save dialog appears. Acceptable for the current object sizes; for very large files (multiple GiB) this will cause memory pressure. Long-term fix: use the [File System Access API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API) `createWritable()` to stream bytes directly to disk without buffering, with a fallback to the current Blob approach for Firefox (which does not support `showSaveFilePicker`).
 
 ---
 
@@ -128,14 +128,6 @@ The dev server accepts requests from any host. This enables DNS rebinding attack
 
 ---
 
-### Upload endpoint uses in-memory S3 credentials
-
-**File:** `src/routes/(app)/storage/api/upload/+server.ts`, `src/lib/server/storage/user-connections.ts`
-
-The upload endpoint reads S3 credentials from the same per-user in-memory connection map used by download and preview. This introduces no additional security risk beyond what is already documented in the "In-memory storage connection state" entry above. Long-term fix: same as that entry — persist encrypted credentials server-side.
-
----
-
 ### No server-side file size limit on uploads (v0)
 
 **File:** `src/routes/(app)/storage/api/upload/+server.ts`
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 744a9246..95e26ae0 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -82,7 +82,35 @@ export async function connectAndOpenPrefix(
   await connectToStorage(page, credentials);
   await expect(page).toHaveURL('/storage');
   await page.goto(bucketRoute(credentials.bucket, prefix));
+  await waitForObjectsLoaded(page);
+}
+
+/**
+ * Wait for the bucket object listing to be ready after a client-side load.
+ * With the new architecture, `waitForHydration` alone is insufficient because
+ * the object list is fetched client-side after hydration. This waits for either
+ * a table row or the empty-state message to appear, confirming the fetch has
+ * completed and the UI has updated.
+ */
+export async function waitForObjectsLoaded(page: Page) {
+  await waitForHydration(page);
+  await page
+    .locator('tbody tr')
+    .or(page.getByText('This bucket is empty'))
+    .first()
+    .waitFor({ timeout: 15_000 });
+}
+
+/**
+ * Wait for the storage landing page to display the connected state.
+ * With the new client-side layout load, navigating to `/storage` initially
+ * renders the SSR default (disconnected) state. This waits until the
+ * client-side bucket fetch has completed and the connected UI (recent items
+ * tabs) is visible.
+ */
+export async function waitForStorageConnected(page: Page) {
   await waitForHydration(page);
+  await expect(page.getByRole('tab', { name: 'Recent Files' })).toBeVisible({ timeout: 15_000 });
 }
 
 export async function putTextObject(
diff --git a/e2e/storage/permissions.spec.ts b/e2e/storage/permissions.spec.ts
index 50de8f06..b9b2f467 100644
--- a/e2e/storage/permissions.spec.ts
+++ b/e2e/storage/permissions.spec.ts
@@ -127,6 +127,7 @@ test.describe('Storage S3 — Permissions', () => {
     });
 
     await connectToStorage(page, noAccessCredentials);
+    await expect(page).toHaveURL('/storage');
     await page.goto(bucketRoute(noAccessBucket));
 
     await expect(page.getByText('403')).toBeVisible();
diff --git a/e2e/storage/preview.spec.ts b/e2e/storage/preview.spec.ts
index e07fc162..84bd1b52 100644
--- a/e2e/storage/preview.spec.ts
+++ b/e2e/storage/preview.spec.ts
@@ -73,7 +73,7 @@ test.describe('Storage S3 — Preview', () => {
 
       await expect(page.getByRole('heading', { name: 'archive.zip' })).toBeVisible();
       await expect(page.getByText('Preview unavailable')).toBeVisible();
-      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Download full file' })).toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
@@ -103,7 +103,7 @@ test.describe('Storage S3 — Preview', () => {
 
       await expect(page.getByRole('heading', { name: 'data.bin' })).toBeVisible();
       await expect(page.getByText('Binary content')).toBeVisible();
-      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+      await expect(page.getByRole('button', { name: 'Download full file' })).toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
@@ -172,8 +172,8 @@ test.describe('Storage S3 — Preview', () => {
       // File size badge is displayed
       await expect(page.locator('.badge', { hasText: /B$/ })).toBeVisible();
 
-      // Download link is available
-      await expect(page.getByRole('link', { name: 'Download full file' })).toBeVisible();
+      // Download button is available
+      await expect(page.getByRole('button', { name: 'Download full file' })).toBeVisible();
 
       // Close button works
       await page.getByRole('button', { name: 'Close' }).last().click();
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index 7b30156e..9a53f2b7 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -4,7 +4,6 @@ import {
   hasGarageCredentials,
   requireGarageCredentials
 } from '../support/garage.js';
-import { waitForHydration } from '../support/helpers.js';
 import {
   bucketRoute,
   connectAndOpenPrefix,
@@ -12,7 +11,9 @@ import {
   deleteKnownKeys,
   putTextObject,
   rowByName,
-  uniquePrefix
+  uniquePrefix,
+  waitForObjectsLoaded,
+  waitForStorageConnected
 } from './helpers.js';
 
 async function previewFile(page: Page, name: string) {
@@ -35,11 +36,12 @@ test.describe('Storage S3 — Recent Items', () => {
     const credentials = requireGarageCredentials();
 
     await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
     await page.goto(bucketRoute(credentials.bucket));
-    await waitForHydration(page);
+    await waitForObjectsLoaded(page);
 
     await page.goto('/storage');
-    await waitForHydration(page);
+    await waitForStorageConnected(page);
 
     await page.getByRole('tab', { name: 'Recent Locations' }).click();
 
@@ -63,10 +65,8 @@ test.describe('Storage S3 — Recent Items', () => {
       await page.getByRole('button', { name: 'Close' }).last().click();
 
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
 
-      const filesTab = page.getByRole('tab', { name: 'Recent Files' });
-      await expect(filesTab).toBeVisible();
       await expect(page.locator('tbody').getByText('recent.txt')).toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
@@ -88,12 +88,12 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // Confirm it appears in Recent Files
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('to-delete.txt')).toBeVisible();
 
       // Delete the file via the UI
       await page.goto(bucketRoute(credentials.bucket, prefix));
-      await waitForHydration(page);
+      await waitForObjectsLoaded(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select to-delete.txt').check();
       await page.getByRole('button', { name: 'Delete', exact: true }).click();
@@ -102,7 +102,7 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // File should no longer appear in Recent Files
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('to-delete.txt')).not.toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, [key]);
@@ -122,21 +122,20 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // Navigate into the sub-directory so it appears in Recent Locations
       await connectAndOpenPrefix(page, credentials, `${prefix}sub/`);
-      await waitForHydration(page);
 
       // Preview the nested file so it appears in Recent Files
       await previewFile(page, 'nested.txt');
 
       // Confirm both lists contain the entries
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('nested.txt')).toBeVisible();
       await page.getByRole('tab', { name: 'Recent Locations' }).click();
       await expect(page.locator('tbody').getByText('sub', { exact: true })).toBeVisible();
 
       // Delete the parent directory via the UI
       await page.goto(bucketRoute(credentials.bucket, prefix));
-      await waitForHydration(page);
+      await waitForObjectsLoaded(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select sub').check();
       await page.getByRole('button', { name: 'Delete', exact: true }).click();
@@ -145,7 +144,7 @@ test.describe('Storage S3 — Recent Items', () => {
 
       // Neither the file nor the location should appear in the recent lists
       await page.goto('/storage');
-      await waitForHydration(page);
+      await waitForStorageConnected(page);
       await expect(page.locator('tbody').getByText('nested.txt')).not.toBeVisible();
       await page.getByRole('tab', { name: 'Recent Locations' }).click();
       await expect(page.locator('tbody').getByText('sub', { exact: true })).not.toBeVisible();
diff --git a/src/app.d.ts b/src/app.d.ts
index b5f6447a..222b0243 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -15,6 +15,14 @@ declare global {
       session: typeof auth.$Infer.Session.session | null;
       logger: import('pino').Logger;
       requestId: string;
+      /**
+       * Parsed S3 connection config extracted from the `x-storage-connection`
+       * request header by the `handleStorageConnection` middleware.
+       * Always non-null for requests to `/(app)/storage/api/*` routes
+       * (the middleware throws 401 before the handler runs if the header is absent).
+       * Null for all other routes.
+       */
+      storageConfig: import('$lib/server/storage/types.js').S3ConnectionConfig | null;
     }
     // interface PageData {}
     // interface PageState {}
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index e0066ed7..e48a50a4 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1,11 +1,12 @@
 import { paraglideMiddleware } from '$lib/paraglide/server';
 import { httpRequestDuration } from '$lib/server/metrics';
 import { building, dev } from '$app/environment';
-import { redirect, type Handle, type HandleServerError } from '@sveltejs/kit';
+import { error, redirect, type Handle, type HandleServerError } from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
 import { svelteKitHandler } from 'better-auth/svelte-kit';
 import { auth, oidcEnabled } from '$lib/server/auth';
 import { requestLogger, logger } from '$lib/server/logging';
+import { getConnectionFromHeader } from '$lib/server/storage/connection.js';
 
 // Allow self-signed TLS certificates in development (e.g. local Trino with self-signed certs).
 if (dev) {
@@ -58,11 +59,28 @@ const handleAuthGuard: Handle = async ({ event, resolve }) => {
   return resolve(event);
 };
 
+/**
+ * Parse the `x-storage-connection` header (base64 JSON) for every request and
+ * store the result in `event.locals.storageConfig`. For routes under
+ * `/(app)/storage/api/` the header is mandatory — the middleware throws 401
+ * before the handler runs if it is absent, so handlers can rely on
+ * `locals.storageConfig` being non-null. Throws 400 for a present but
+ * malformed / invalid header on any route.
+ */
+const handleStorageConnection: Handle = async ({ event, resolve }) => {
+  event.locals.storageConfig = getConnectionFromHeader(event.request);
+  if (event.locals.storageConfig === null && event.route.id?.startsWith('/(app)/storage/api/')) {
+    throw error(401, 'No storage connection configured');
+  }
+  return resolve(event);
+};
+
 export const handle = sequence(
   requestLogger,
   handleMetrics,
   handleParaglide,
-  ...(oidcEnabled ? [handleAuth, handleAuthGuard] : [])
+  ...(oidcEnabled ? [handleAuth, handleAuthGuard] : []),
+  handleStorageConnection
 );
 
 export const handleError: HandleServerError = ({ error, event, status, message }) => {
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 1b1fea02..89bdd4ac 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -13,7 +13,10 @@
   import PdfPreview from './preview/PdfPreview.svelte';
   import FallbackPreview from './preview/FallbackPreview.svelte';
   import { keyToName, formatFileSize } from '$lib/storage/utils.js';
-  import { resolve } from '$app/paths';
+  import { downloadObject, DownloadError } from '$lib/storage/download.js';
+  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+  import { addToast } from '$lib/stores/toast.svelte.js';
+  import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
 
   interface Props {
     open: boolean;
@@ -87,9 +90,14 @@
     preview = { kind: 'loading' };
     revokeBlobUrls();
 
+    const conn = loadConnectionLocally();
+    const headers: HeadersInit = conn
+      ? { [STORAGE_CONNECTION_HEADER]: getConnectionHeader(conn) }
+      : {};
+
     try {
       const params = new URLSearchParams({ bucket: bkt, key });
-      const res = await fetch(`/storage/api/preview?${params}`);
+      const res = await fetch(`/storage/api/preview?${params}`, { headers });
 
       if (!res.ok) {
         const errBody = await res.json().catch(() => ({}));
@@ -211,9 +219,22 @@
 
   const filename = $derived(objectKey ? keyToName(objectKey) : '');
 
-  function buildDownloadUrl(key: string, bkt: string): string {
-    const params = new URLSearchParams({ bucket: bkt, key });
-    return `${resolve('/storage/api/download')}?${params}`;
+  async function triggerDownload() {
+    if (!objectKey) return;
+    const conn = loadConnectionLocally();
+    if (!conn) {
+      addToast('error', m.storage_download_error_unknown());
+      return;
+    }
+    try {
+      await downloadObject(bucket, objectKey, getConnectionHeader(conn));
+    } catch (err) {
+      if (err instanceof DownloadError) {
+        addToast('error', err.message);
+      } else {
+        addToast('error', m.storage_download_error_unknown());
+      }
+    }
   }
 
   function close() {
@@ -340,8 +361,7 @@
       {:else if preview.kind === 'fallback'}
         <FallbackPreview
           contentType={preview.contentType}
-          downloadUrl={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
-          name={filename}
+          onDownload={triggerDownload}
           isBinary={preview.isBinary}
         />
       {/if}
@@ -351,25 +371,15 @@
     {#if preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'parquet' || preview.kind === 'image' || preview.kind === 'pdf'}
       <div class="border-base-300 flex shrink-0 items-center justify-end gap-2 border-t px-5 py-2">
         {#if (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
-          <a
-            href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
-            download={filename}
-            rel="external"
-            class="btn btn-ghost btn-sm gap-1.5"
-          >
+          <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
-          </a>
+          </button>
         {:else if preview.kind === 'image' || preview.kind === 'pdf'}
-          <a
-            href={objectKey ? buildDownloadUrl(objectKey, bucket) : '#'}
-            download={filename}
-            rel="external"
-            class="btn btn-ghost btn-sm gap-1.5"
-          >
+          <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
-          </a>
+          </button>
         {/if}
         <button class="btn btn-primary btn-sm" onclick={close}>
           {m.storage_preview_close()}
diff --git a/src/lib/components/storage/modals/preview/FallbackPreview.svelte b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
index 78751213..e37cce89 100644
--- a/src/lib/components/storage/modals/preview/FallbackPreview.svelte
+++ b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
@@ -5,13 +5,12 @@
 
   interface Props {
     contentType: string;
-    downloadUrl: string;
-    name: string;
+    onDownload: () => void;
     /** When true, the content was determined to be binary (non-displayable UTF-8). */
     isBinary?: boolean;
   }
 
-  let { contentType, downloadUrl, name, isBinary = false }: Props = $props();
+  let { contentType, onDownload, isBinary = false }: Props = $props();
 </script>
 
 <div class="flex min-h-full flex-col items-center justify-center gap-4 p-8 text-center">
@@ -27,8 +26,8 @@
       <p class="text-base-content/40 mt-1 font-mono text-xs">{contentType}</p>
     {/if}
   </div>
-  <a href={downloadUrl} download={name} rel="external" class="btn btn-primary btn-sm gap-2">
+  <button type="button" onclick={onDownload} class="btn btn-primary btn-sm gap-2">
     <IconDownload class="size-4" aria-hidden="true" />
     {m.storage_preview_download_full()}
-  </a>
+  </button>
 </div>
diff --git a/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
index 726db3b1..2002f867 100644
--- a/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/FallbackPreview.svelte.spec.ts
@@ -1,5 +1,5 @@
 import { page } from 'vitest/browser';
-import { describe, expect, it } from 'vitest';
+import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import FallbackPreview from './FallbackPreview.svelte';
@@ -7,32 +7,28 @@ import FallbackPreview from './FallbackPreview.svelte';
 describe('FallbackPreview', () => {
   const baseProps = {
     contentType: 'application/octet-stream',
-    downloadUrl: '/download/file.bin',
-    name: 'file.bin'
+    onDownload: vi.fn()
   };
 
   it('should show unsupported title when isBinary is false', async () => {
     render(FallbackPreview, { ...baseProps, isBinary: false });
 
-    // Find the download link as a reliable anchor
-    const link = page.getByRole('link');
-    await expect.element(link).toBeInTheDocument();
-    await expect.element(link).toHaveAttribute('download', 'file.bin');
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 
   it('should show binary title when isBinary is true', async () => {
     render(FallbackPreview, { ...baseProps, isBinary: true });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toBeInTheDocument();
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 
-  it('should render download link with correct attributes', async () => {
+  it('should render a download button', async () => {
     render(FallbackPreview, { ...baseProps });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toHaveAttribute('href', '/download/file.bin');
-    await expect.element(link).toHaveAttribute('download', 'file.bin');
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 
   it('should show contentType in mono text', async () => {
@@ -49,19 +45,18 @@ describe('FallbackPreview', () => {
     await expect.element(page.getByText(mimeType)).toBeInTheDocument();
   });
 
-  it('should handle long filenames', async () => {
-    const name = `${faker.string.alphanumeric(100)}.dat`;
-    render(FallbackPreview, { ...baseProps, name });
+  it('should call onDownload when button is clicked', async () => {
+    const onDownload = vi.fn();
+    render(FallbackPreview, { ...baseProps, onDownload });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toHaveAttribute('download', name);
+    await page.getByRole('button').click();
+    expect(onDownload).toHaveBeenCalledOnce();
   });
 
   it('should handle special characters in names', async () => {
-    const name = 'file (copy) [2].bin';
-    render(FallbackPreview, { ...baseProps, name });
+    render(FallbackPreview, { ...baseProps });
 
-    const link = page.getByRole('link');
-    await expect.element(link).toHaveAttribute('download', name);
+    const btn = page.getByRole('button');
+    await expect.element(btn).toBeInTheDocument();
   });
 });
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index 57f1ac18..0fc49279 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -8,6 +8,7 @@
   import Modal from '$lib/components/Modal.svelte';
   import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
   import { formatFileSize } from '$lib/storage/utils.js';
+  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
   import UploadDropzone from './UploadDropzone.svelte';
   import UploadConflictEntry from './UploadConflictEntry.svelte';
   import UploadEntryStatus from './UploadEntryStatus.svelte';
@@ -98,10 +99,13 @@
     if (phase !== 'selected') return;
     phase = 'checking';
 
+    const conn = loadConnectionLocally();
+    const connHeader = conn ? getConnectionHeader(conn) : '';
+
     const results = await Promise.all(
       entries.map(async (e) => {
         try {
-          return { id: e.id, conflict: await checkObjectExists(bucket, e.targetKey) };
+          return { id: e.id, conflict: await checkObjectExists(bucket, e.targetKey, connHeader) };
         } catch {
           return { id: e.id, conflict: false };
         }
@@ -150,10 +154,18 @@
     entries = entries.map((e) =>
       e.id === entry.id ? { ...e, status: 'uploading' as const, progress: 0 } : e
     );
+    const conn = loadConnectionLocally();
+    const connHeader = conn ? getConnectionHeader(conn) : '';
     try {
-      await uploadFile(bucket, key, entry.file, (pct) => {
-        entries = entries.map((e) => (e.id === entry.id ? { ...e, progress: pct } : e));
-      });
+      await uploadFile(
+        bucket,
+        key,
+        entry.file,
+        (pct) => {
+          entries = entries.map((e) => (e.id === entry.id ? { ...e, progress: pct } : e));
+        },
+        connHeader
+      );
       entries = entries.map((e) =>
         e.id === entry.id ? { ...e, status: 'done' as const, progress: 100 } : e
       );
@@ -215,8 +227,10 @@
 
     entries = entries.map((e) => (e.id === id ? { ...e, renameState: 'checking' as const } : e));
     const newKey = resolvedKey(entry);
+    const conn = loadConnectionLocally();
+    const connHeader = conn ? getConnectionHeader(conn) : '';
     try {
-      const exists = await checkObjectExists(bucket, newKey);
+      const exists = await checkObjectExists(bucket, newKey, connHeader);
       const nextState: RenameState = exists ? 'conflict' : 'ok';
       entries = entries.map((e) => (e.id === id ? { ...e, renameState: nextState } : e));
     } catch {
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index 5aace25a..c2b31675 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -168,14 +168,22 @@ describe('UploadModal', () => {
       render(UploadModal, { ...defaultProps, prefix });
       await selectAndUpload([createFile('report.csv')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'data/report.csv');
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(
+        expect.any(String),
+        'data/report.csv',
+        expect.any(String)
+      );
     });
 
     it('should use filename directly when prefix is empty', async () => {
       render(UploadModal, { ...defaultProps, prefix: '' });
       await selectAndUpload([createFile('report.csv')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(expect.any(String), 'report.csv');
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(
+        expect.any(String),
+        'report.csv',
+        expect.any(String)
+      );
     });
   });
 
@@ -196,7 +204,8 @@ describe('UploadModal', () => {
         defaultProps.bucket,
         'a.txt',
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
 
@@ -337,7 +346,8 @@ describe('UploadModal', () => {
         expect.any(String),
         expect.any(String),
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
 
@@ -439,7 +449,8 @@ describe('UploadModal', () => {
         expect.any(String),
         'folder/sub/data.csv',
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
   });
@@ -510,12 +521,17 @@ describe('UploadModal', () => {
       render(UploadModal, { ...defaultProps, bucket });
       await selectAndUpload([createFile('a.txt')]);
 
-      expect(mockCheckObjectExists).toHaveBeenCalledWith(bucket, expect.any(String));
+      expect(mockCheckObjectExists).toHaveBeenCalledWith(
+        bucket,
+        expect.any(String),
+        expect.any(String)
+      );
       expect(mockUploadFile).toHaveBeenCalledWith(
         bucket,
         expect.any(String),
         expect.any(File),
-        expect.any(Function)
+        expect.any(Function),
+        expect.any(String)
       );
     });
 
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 30e2742a..ac5f9f4c 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -15,10 +15,12 @@
 
   const storage = getStorageState();
 
-  // Detect the active bucket from the URL so the highlight stays on when
-  // navigating into any sub-prefix within the bucket.
+  // page.url may be undefined in the error boundary state (when a client-side
+  // universal load throws and SvelteKit transitions to the error state). Guard
+  // with optional chaining to avoid crashing the layout and escalating the
+  // error to the root fallback handler.
   const activeBucket = $derived.by(() => {
-    const match = page.url.pathname.match(/^\/storage\/([^/]+)/);
+    const match = page.url?.pathname?.match(/^\/storage\/([^/]+)/);
     return match ? decodeURIComponent(match[1]) : null;
   });
   const activePrefix = $derived(page.params.prefix ? page.params.prefix + '/' : '');
diff --git a/src/lib/server/storage/connection.ts b/src/lib/server/storage/connection.ts
new file mode 100644
index 00000000..2f606ba5
--- /dev/null
+++ b/src/lib/server/storage/connection.ts
@@ -0,0 +1,53 @@
+import { error } from '@sveltejs/kit';
+import { StorageConnectionSchema } from '$lib/storage/schemas.js';
+import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+import type { S3ConnectionConfig } from './types.js';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'storage-connection' });
+
+/**
+ * Parse and validate a base64-encoded JSON connection payload from a request header value.
+ * Throws a 400 HTTP error if the payload is malformed or fails schema validation.
+ * Throws a 400 HTTP error if the connection type is not 's3'.
+ */
+function parseConnectionPayload(raw: string): S3ConnectionConfig {
+  let data: unknown;
+  try {
+    data = JSON.parse(atob(raw));
+  } catch {
+    throw error(400, 'Invalid storage connection header');
+  }
+
+  const parsed = StorageConnectionSchema.safeParse(data);
+  if (!parsed.success) {
+    log.debug({ issues: parsed.error.issues }, 'storage connection header validation failed');
+    throw error(400, 'Invalid storage connection configuration');
+  }
+
+  if (parsed.data.type !== 's3') {
+    throw error(400, 'Storage backend not supported');
+  }
+
+  return {
+    type: 's3',
+    endpoint: parsed.data.endpoint || undefined,
+    pathStyle: parsed.data.pathStyle,
+    region: parsed.data.region,
+    accessKeyId: parsed.data.accessKeyId || undefined,
+    secretAccessKey: parsed.data.secretAccessKey || undefined
+  };
+}
+
+/**
+ * Extract the storage connection config from the `X-Storage-Connection` request header.
+ * Returns `null` if the header is absent. Throws 400 on malformed or invalid payloads.
+ *
+ * Used by the `handleStorageConnection` middleware in `hooks.server.ts` to populate
+ * `event.locals.storageConfig` before any storage API handler runs.
+ */
+export function getConnectionFromHeader(request: Request): S3ConnectionConfig | null {
+  const header = request.headers.get(STORAGE_CONNECTION_HEADER);
+  if (!header) return null;
+  return parseConnectionPayload(header);
+}
diff --git a/src/lib/server/storage/service.test.ts b/src/lib/server/storage/service.test.ts
index 60f59388..fa4be91f 100644
--- a/src/lib/server/storage/service.test.ts
+++ b/src/lib/server/storage/service.test.ts
@@ -6,15 +6,6 @@ vi.mock('$lib/server/logging', () => ({
   logger: { child: () => ({ info: vi.fn(), debug: vi.fn(), warn: vi.fn() }) }
 }));
 
-const mockGetUserConnection = vi.fn();
-const mockSetUserConnection = vi.fn();
-const mockClearUserConnection = vi.fn();
-vi.mock('./user-connections.js', () => ({
-  getUserConnection: (...args: unknown[]) => mockGetUserConnection(...args),
-  setUserConnection: (...args: unknown[]) => mockSetUserConnection(...args),
-  clearUserConnection: (...args: unknown[]) => mockClearUserConnection(...args)
-}));
-
 const mockSend = vi.fn();
 vi.mock('./s3-client.js', () => ({
   createS3Client: () => ({ send: (...args: unknown[]) => mockSend(...args) })
@@ -31,7 +22,7 @@ const mockProvider = {
   listAllKeys: vi.fn()
 };
 vi.mock('./utils.js', () => ({
-  getProviderForUser: () => mockProvider
+  getProvider: () => mockProvider
 }));
 
 // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -54,36 +45,32 @@ import {
   uploadObject,
   deleteObjects
 } from './service.js';
+import type { S3ConnectionConfig } from './types.js';
 
-describe('storage service', () => {
-  const userId = faker.string.uuid();
+const config: S3ConnectionConfig = {
+  type: 's3',
+  region: faker.location.countryCode()
+};
 
+describe('storage service', () => {
   beforeEach(() => {
     vi.clearAllMocks();
   });
 
   describe('listBuckets', () => {
-    it('returns empty array when no connection', async () => {
-      mockGetUserConnection.mockReturnValue(null);
-      expect(await listBuckets(userId)).toEqual([]);
-    });
-
     it('returns bucket names', async () => {
-      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
       mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: 'b' }] });
-      expect(await listBuckets(userId)).toEqual(['a', 'b']);
+      expect(await listBuckets(config)).toEqual(['a', 'b']);
     });
 
     it('filters out buckets with no name', async () => {
-      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
       mockSend.mockResolvedValue({ Buckets: [{ Name: 'a' }, { Name: undefined }, { Name: '' }] });
-      expect(await listBuckets(userId)).toEqual(['a']);
+      expect(await listBuckets(config)).toEqual(['a']);
     });
 
     it('handles null Buckets in response', async () => {
-      mockGetUserConnection.mockReturnValue({ type: 's3', region: 'us-east-1' });
       mockSend.mockResolvedValue({ Buckets: null });
-      expect(await listBuckets(userId)).toEqual([]);
+      expect(await listBuckets(config)).toEqual([]);
     });
   });
 
@@ -91,7 +78,7 @@ describe('storage service', () => {
     it('proxies to provider', async () => {
       const page = { objects: [], prefixes: [], nextToken: null };
       mockProvider.listObjects.mockResolvedValue(page);
-      const result = await listObjects(userId, 'bucket', 'prefix/', 100);
+      const result = await listObjects(config, 'bucket', 'prefix/', 100);
       expect(mockProvider.listObjects).toHaveBeenCalledWith('prefix/', 100, undefined);
       expect(result).toEqual(page);
     });
@@ -99,21 +86,21 @@ describe('storage service', () => {
     it('passes continuation token when provided', async () => {
       const page = { objects: [], prefixes: [], nextToken: null };
       mockProvider.listObjects.mockResolvedValue(page);
-      await listObjects(userId, 'bucket', '', 10, 'tok');
+      await listObjects(config, 'bucket', '', 10, 'tok');
       expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, 'tok');
     });
 
     it('passes undefined when continuation token is null', async () => {
       const page = { objects: [], prefixes: [], nextToken: null };
       mockProvider.listObjects.mockResolvedValue(page);
-      await listObjects(userId, 'bucket', '', 10, null);
+      await listObjects(config, 'bucket', '', 10, null);
       expect(mockProvider.listObjects).toHaveBeenCalledWith('', 10, undefined);
     });
 
     it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
       const err = makeS3Error('AccessDenied');
       mockProvider.listObjects.mockRejectedValue(err);
-      await expect(listObjects(userId, 'bucket', '', 10)).rejects.toThrow(err);
+      await expect(listObjects(config, 'bucket', '', 10)).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         operation: 'listObjects'
@@ -123,7 +110,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('network');
       mockProvider.listObjects.mockRejectedValue(err);
-      await expect(listObjects(userId, 'bucket', '', 10)).rejects.toThrow('network');
+      await expect(listObjects(config, 'bucket', '', 10)).rejects.toThrow('network');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
@@ -132,14 +119,14 @@ describe('storage service', () => {
     it('returns download from provider', async () => {
       const download = { stream: new ReadableStream(), contentType: 'text/plain' };
       mockProvider.getObject.mockResolvedValue(download);
-      const result = await downloadObject(userId, 'bucket', 'key.txt');
+      const result = await downloadObject(config, 'bucket', 'key.txt');
       expect(result).toEqual(download);
     });
 
     it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
       const err = makeS3Error('NoSuchKey');
       mockProvider.getObject.mockRejectedValue(err);
-      await expect(downloadObject(userId, 'bucket', 'key.txt')).rejects.toThrow(err);
+      await expect(downloadObject(config, 'bucket', 'key.txt')).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         key: 'key.txt',
@@ -150,7 +137,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('timeout');
       mockProvider.getObject.mockRejectedValue(err);
-      await expect(downloadObject(userId, 'bucket', 'k')).rejects.toThrow('timeout');
+      await expect(downloadObject(config, 'bucket', 'k')).rejects.toThrow('timeout');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
@@ -159,13 +146,13 @@ describe('storage service', () => {
     it('proxies to provider', async () => {
       const meta = { contentType: 'text/plain', contentLength: 42 };
       mockProvider.getMetadata.mockResolvedValue(meta);
-      expect(await getObjectMetadata(userId, 'bucket', 'k')).toEqual(meta);
+      expect(await getObjectMetadata(config, 'bucket', 'k')).toEqual(meta);
     });
 
     it('throws S3ServiceException via mapS3ErrorToHttp', async () => {
       const err = makeS3Error('NoSuchKey');
       mockProvider.getMetadata.mockRejectedValue(err);
-      await expect(getObjectMetadata(userId, 'bucket', 'k')).rejects.toThrow(err);
+      await expect(getObjectMetadata(config, 'bucket', 'k')).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         key: 'k',
@@ -176,7 +163,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('gone');
       mockProvider.getMetadata.mockRejectedValue(err);
-      await expect(getObjectMetadata(userId, 'bucket', 'k')).rejects.toThrow('gone');
+      await expect(getObjectMetadata(config, 'bucket', 'k')).rejects.toThrow('gone');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
@@ -184,7 +171,7 @@ describe('storage service', () => {
   describe('uploadObject', () => {
     it('proxies to provider', async () => {
       mockProvider.putObject.mockResolvedValue(undefined);
-      await uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain', 1);
+      await uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain', 1);
       expect(mockProvider.putObject).toHaveBeenCalledWith('k', expect.any(Buffer), 'text/plain', 1);
     });
 
@@ -192,7 +179,7 @@ describe('storage service', () => {
       const err = makeS3Error('AccessDenied');
       mockProvider.putObject.mockRejectedValue(err);
       await expect(
-        uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain')
+        uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain')
       ).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
@@ -205,7 +192,7 @@ describe('storage service', () => {
       const err = new Error('disk full');
       mockProvider.putObject.mockRejectedValue(err);
       await expect(
-        uploadObject(userId, 'bucket', 'k', Buffer.from('x'), 'text/plain')
+        uploadObject(config, 'bucket', 'k', Buffer.from('x'), 'text/plain')
       ).rejects.toThrow('disk full');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
@@ -215,7 +202,7 @@ describe('storage service', () => {
     it('expands directory prefixes and deletes all', async () => {
       mockProvider.listAllKeys.mockResolvedValue(['dir/a.txt', 'dir/b.txt']);
       mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      const result = await deleteObjects(userId, 'bucket', ['file.txt', 'dir/']);
+      const result = await deleteObjects(config, 'bucket', ['file.txt', 'dir/']);
       expect(mockProvider.listAllKeys).toHaveBeenCalledWith('dir/');
       expect(mockProvider.deleteObjects).toHaveBeenCalledWith([
         'file.txt',
@@ -228,15 +215,14 @@ describe('storage service', () => {
     it('uses directory key itself when no children found', async () => {
       mockProvider.listAllKeys.mockResolvedValue([]);
       mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      await deleteObjects(userId, 'bucket', ['empty/']);
+      await deleteObjects(config, 'bucket', ['empty/']);
       expect(mockProvider.deleteObjects).toHaveBeenCalledWith(['empty/']);
     });
 
     it('returns empty result for no keys', async () => {
-      // No file keys, no dir prefixes after expansion
       mockProvider.listAllKeys.mockResolvedValue([]);
       mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
-      const result = await deleteObjects(userId, 'bucket', []);
+      const result = await deleteObjects(config, 'bucket', []);
       expect(result).toEqual({ failed: [] });
     });
 
@@ -244,7 +230,7 @@ describe('storage service', () => {
       const err = makeS3Error('AccessDenied');
       mockProvider.listAllKeys.mockResolvedValue([]);
       mockProvider.deleteObjects.mockRejectedValue(err);
-      await expect(deleteObjects(userId, 'bucket', ['file.txt'])).rejects.toThrow(err);
+      await expect(deleteObjects(config, 'bucket', ['file.txt'])).rejects.toThrow(err);
       expect(mockMapS3ErrorToHttp).toHaveBeenCalledWith(err, {
         bucket: 'bucket',
         operation: 'deleteObjects'
@@ -254,7 +240,7 @@ describe('storage service', () => {
     it('rethrows non-S3 errors', async () => {
       const err = new Error('network');
       mockProvider.deleteObjects.mockRejectedValue(err);
-      await expect(deleteObjects(userId, 'bucket', ['file.txt'])).rejects.toThrow('network');
+      await expect(deleteObjects(config, 'bucket', ['file.txt'])).rejects.toThrow('network');
       expect(mockMapS3ErrorToHttp).not.toHaveBeenCalled();
     });
   });
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index c4550e94..c27b6532 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -1,40 +1,33 @@
 import { S3ServiceException, ListBucketsCommand } from '@aws-sdk/client-s3';
-import { getUserConnection, setUserConnection, clearUserConnection } from './user-connections.js';
 import { createS3Client } from './s3-client.js';
 import { mapS3ErrorToHttp } from './s3-errors.js';
-import { getProviderForUser } from './utils.js';
+import { getProvider } from './utils.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
 import type { ObjectDownload, DeleteObjectsResult } from './provider.js';
+import type { S3ConnectionConfig } from './types.js';
 import { logger } from '$lib/server/logging';
 
 const log = logger.child({ module: 'storage-service' });
 
-export { getUserConnection as getConnection };
-export { setUserConnection as saveConnection };
-export { clearUserConnection as clearConnection };
-
-/** List all buckets accessible with the user's current connection. Returns [] when not connected. */
-export async function listBuckets(userId: string): Promise<string[]> {
-  const config = getUserConnection(userId);
-  if (!config) return [];
-
+/** List all buckets accessible with the given connection config. */
+export async function listBuckets(config: S3ConnectionConfig): Promise<string[]> {
   const client = createS3Client(config);
 
   const output = await client.send(new ListBucketsCommand({}));
   const buckets = (output.Buckets ?? []).map((b) => b.Name ?? '').filter(Boolean);
-  log.debug({ user_id: userId, bucket_count: buckets.length }, 'listed buckets');
+  log.debug({ storage_type: config.type, bucket_count: buckets.length }, 'listed buckets');
   return buckets;
 }
 
-/** List objects at the given bucket/prefix for the user's current connection. Throws on S3 errors. */
+/** List objects at the given bucket/prefix. Throws on S3 errors. */
 export async function listObjects(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   prefix: string,
   pageSize: number,
   continuationToken?: string | null
 ): Promise<StoragePage> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
     return await provider.listObjects(prefix, pageSize, continuationToken ?? undefined);
@@ -45,18 +38,19 @@ export async function listObjects(
     throw err;
   }
 }
+
 /** Download a single object from the bucket, returning a stream and metadata for the HTTP response. */
 export async function downloadObject(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   key: string
 ): Promise<ObjectDownload> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
-    log.debug({ user_id: userId, bucket, key }, 'downloading object');
+    log.debug({ bucket, key }, 'downloading object');
     const download = await provider.getObject(key);
-    log.info({ user_id: userId, bucket, key }, 'object download started');
+    log.info({ bucket, key }, 'object download started');
     return download;
   } catch (err) {
     if (err instanceof S3ServiceException) {
@@ -68,14 +62,14 @@ export async function downloadObject(
 
 /** Fetch metadata for a single object — used for lightweight pre-flight checks. */
 export async function getObjectMetadata(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   key: string
 ): Promise<StorageMetadata> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
-    log.debug({ user_id: userId, bucket, key }, 'getting object metadata');
+    log.debug({ bucket, key }, 'getting object metadata');
     return await provider.getMetadata(key);
   } catch (err) {
     if (err instanceof S3ServiceException) {
@@ -87,20 +81,20 @@ export async function getObjectMetadata(
 
 /** Upload an object to the bucket, using multipart upload for large files. */
 export async function uploadObject(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   key: string,
   body: ReadableStream | Buffer,
   contentType: string,
   contentLength?: number
 ): Promise<void> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
-    log.debug({ user_id: userId, bucket, key, content_type: contentType }, 'uploading object');
+    log.debug({ bucket, key, content_type: contentType }, 'uploading object');
     await provider.putObject(key, body, contentType, contentLength);
     log.info(
-      { user_id: userId, bucket, key, content_type: contentType, content_length: contentLength },
+      { bucket, key, content_type: contentType, content_length: contentLength },
       'object uploaded'
     );
   } catch (err) {
@@ -114,11 +108,11 @@ export async function uploadObject(
 /** Delete one or more objects from the bucket. Returns a result listing any keys that failed.
  *  Directory keys (ending with '/') are expanded to all contained objects before deletion. */
 export async function deleteObjects(
-  userId: string,
+  config: S3ConnectionConfig,
   bucket: string,
   keys: string[]
 ): Promise<DeleteObjectsResult> {
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(config, bucket);
 
   try {
     // Expand any directory prefixes (keys ending with '/') to their contents.
@@ -127,7 +121,7 @@ export async function deleteObjects(
 
     let allKeys = [...fileKeys];
     for (const prefix of dirPrefixes) {
-      log.debug({ user_id: userId, bucket, prefix }, 'expanding directory prefix for deletion');
+      log.debug({ bucket, prefix }, 'expanding directory prefix for deletion');
       const children = await provider.listAllKeys(prefix);
       allKeys = allKeys.concat(children.length > 0 ? children : [prefix]);
     }
@@ -136,10 +130,10 @@ export async function deleteObjects(
       return { failed: [] };
     }
 
-    log.debug({ user_id: userId, bucket, key_count: allKeys.length }, 'deleting objects');
+    log.debug({ bucket, key_count: allKeys.length }, 'deleting objects');
     const result = await provider.deleteObjects(allKeys);
     log.info(
-      { user_id: userId, bucket, key_count: allKeys.length, failed_count: result.failed.length },
+      { bucket, key_count: allKeys.length, failed_count: result.failed.length },
       'objects delete completed'
     );
     return result;
diff --git a/src/lib/server/storage/user-connections.test.ts b/src/lib/server/storage/user-connections.test.ts
deleted file mode 100644
index 68e9ac66..00000000
--- a/src/lib/server/storage/user-connections.test.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { faker } from '@faker-js/faker';
-import { setUserConnection, getUserConnection, clearUserConnection } from './user-connections.js';
-import type { S3ConnectionConfig } from './types.js';
-
-vi.mock('$lib/server/logging', () => ({
-  logger: { child: () => ({ info: vi.fn(), debug: vi.fn() }) }
-}));
-
-function makeConfig(): S3ConnectionConfig {
-  return {
-    type: 's3',
-    region: faker.location.countryCode(),
-    endpoint: faker.internet.url(),
-    accessKeyId: faker.string.alphanumeric(20),
-    secretAccessKey: faker.string.alphanumeric(40)
-  };
-}
-
-describe('user-connections', () => {
-  const userId = faker.string.uuid();
-
-  beforeEach(() => {
-    clearUserConnection(userId);
-  });
-
-  it('returns null for unknown user', () => {
-    expect(getUserConnection(faker.string.uuid())).toBeNull();
-  });
-
-  it('stores and retrieves a connection', () => {
-    const config = makeConfig();
-    setUserConnection(userId, config);
-    expect(getUserConnection(userId)).toEqual(config);
-  });
-
-  it('overwrites existing connection', () => {
-    setUserConnection(userId, makeConfig());
-    const newConfig = makeConfig();
-    setUserConnection(userId, newConfig);
-    expect(getUserConnection(userId)).toEqual(newConfig);
-  });
-
-  it('clears a connection', () => {
-    setUserConnection(userId, makeConfig());
-    clearUserConnection(userId);
-    expect(getUserConnection(userId)).toBeNull();
-  });
-
-  it('clearing non-existent user does not throw', () => {
-    expect(() => clearUserConnection(faker.string.uuid())).not.toThrow();
-  });
-
-  it('supports multiple users independently', () => {
-    const user1 = faker.string.uuid();
-    const user2 = faker.string.uuid();
-    const config1 = makeConfig();
-    const config2 = makeConfig();
-    setUserConnection(user1, config1);
-    setUserConnection(user2, config2);
-    expect(getUserConnection(user1)).toEqual(config1);
-    expect(getUserConnection(user2)).toEqual(config2);
-    clearUserConnection(user1);
-    expect(getUserConnection(user1)).toBeNull();
-    expect(getUserConnection(user2)).toEqual(config2);
-  });
-});
diff --git a/src/lib/server/storage/user-connections.ts b/src/lib/server/storage/user-connections.ts
deleted file mode 100644
index bcfa9835..00000000
--- a/src/lib/server/storage/user-connections.ts
+++ /dev/null
@@ -1,20 +0,0 @@
-import type { S3ConnectionConfig } from './types.js';
-import { logger } from '$lib/server/logging';
-
-const log = logger.child({ module: 'storage-user-connections' });
-
-const userConnections = new Map<string, S3ConnectionConfig>();
-
-export function setUserConnection(userId: string, config: S3ConnectionConfig): void {
-  userConnections.set(userId, config);
-  log.info({ user_id: userId, storage_type: config.type }, 'user storage connection saved');
-}
-
-export function getUserConnection(userId: string): S3ConnectionConfig | null {
-  return userConnections.get(userId) ?? null;
-}
-
-export function clearUserConnection(userId: string): void {
-  userConnections.delete(userId);
-  log.info({ user_id: userId }, 'user storage connection cleared');
-}
diff --git a/src/lib/server/storage/utils.test.ts b/src/lib/server/storage/utils.test.ts
index 55a3a061..b83bfb17 100644
--- a/src/lib/server/storage/utils.test.ts
+++ b/src/lib/server/storage/utils.test.ts
@@ -1,42 +1,29 @@
 import { describe, it, expect, vi } from 'vitest';
-import { faker } from '@faker-js/faker';
 
 vi.mock('$lib/server/logging', () => ({
   logger: { child: () => ({ info: vi.fn(), debug: vi.fn() }) }
 }));
 
-const mockGetUserConnection = vi.fn();
-vi.mock('./user-connections.js', () => ({
-  getUserConnection: (...args: unknown[]) => mockGetUserConnection(...args)
-}));
-
 const mockCreate = vi.fn().mockReturnValue({ listObjects: vi.fn() });
 vi.mock('./factory.js', () => ({
   StorageProviderFactory: { create: (...args: unknown[]) => mockCreate(...args) }
 }));
 
-import { getProviderForUser } from './utils.js';
+import { getProvider } from './utils.js';
+import type { S3ConnectionConfig } from './types.js';
 
-describe('getProviderForUser', () => {
-  it('throws 401 when no connection exists', () => {
-    mockGetUserConnection.mockReturnValue(null);
-    expect(() => getProviderForUser(faker.string.uuid(), 'bucket')).toThrow(
-      expect.objectContaining({ status: 401 })
-    );
-  });
+const s3Config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
 
+describe('getProvider', () => {
   it('throws 400 for non-s3 connection type', () => {
-    mockGetUserConnection.mockReturnValue({ type: 'hdfs', nameNode: 'nn', port: 9870, user: 'u' });
-    expect(() => getProviderForUser(faker.string.uuid(), 'bucket')).toThrow(
-      expect.objectContaining({ status: 400 })
-    );
+    expect(() =>
+      getProvider({ type: 'hdfs', nameNode: 'nn', port: 9870, user: 'u' } as never, 'bucket')
+    ).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('returns provider for valid s3 connection', () => {
-    const config = { type: 's3', region: 'us-east-1' };
-    mockGetUserConnection.mockReturnValue(config);
-    const provider = getProviderForUser('user1', 'my-bucket');
-    expect(mockCreate).toHaveBeenCalledWith({ ...config, bucket: 'my-bucket' });
+    const provider = getProvider(s3Config, 'my-bucket');
+    expect(mockCreate).toHaveBeenCalledWith({ ...s3Config, bucket: 'my-bucket' });
     expect(provider).toBeDefined();
   });
 });
diff --git a/src/lib/server/storage/utils.ts b/src/lib/server/storage/utils.ts
index c98a0d2c..a0ab2223 100644
--- a/src/lib/server/storage/utils.ts
+++ b/src/lib/server/storage/utils.ts
@@ -1,17 +1,16 @@
 import { error } from '@sveltejs/kit';
-import { getUserConnection } from './user-connections.js';
 import { StorageProviderFactory } from './factory.js';
 import type { StorageProvider } from './provider.js';
+import type { S3ConnectionConfig } from './types.js';
 
-export function getProviderForUser(userId: string, bucket: string): StorageProvider {
-  const connection = getUserConnection(userId);
-  if (!connection) {
-    throw error(401, 'No storage connection configured');
-  }
-
-  if (connection.type !== 's3') {
+/**
+ * Construct a bucket-scoped storage provider from the given connection config.
+ * Throws a 400 HTTP error if the connection type is not supported.
+ */
+export function getProvider(config: S3ConnectionConfig, bucket: string): StorageProvider {
+  if (config.type !== 's3') {
     throw error(400, 'Storage backend not supported');
   }
 
-  return StorageProviderFactory.create({ ...connection, bucket });
+  return StorageProviderFactory.create({ ...config, bucket });
 }
diff --git a/src/lib/storage/connection-storage.ts b/src/lib/storage/connection-storage.ts
index 9bf1f3ea..bf868931 100644
--- a/src/lib/storage/connection-storage.ts
+++ b/src/lib/storage/connection-storage.ts
@@ -1,7 +1,14 @@
 import type { z } from 'zod';
 import type { StorageConnectionSchema } from './schemas.js';
 
-type StoredConnection = z.infer<typeof StorageConnectionSchema>;
+export type StoredConnection = z.infer<typeof StorageConnectionSchema>;
+
+/**
+ * HTTP header name used to pass the S3 connection config from the browser to
+ * the backend API endpoints. Defined here (client-safe module) so both client
+ * and server code can import it without leaking server-only code to the browser.
+ */
+export const STORAGE_CONNECTION_HEADER = 'x-storage-connection';
 
 const STORAGE_KEY = 'stackable_storage_connections';
 
@@ -62,3 +69,11 @@ export function removeConnectionLocally(data: StoredConnection): void {
     // localStorage may be unavailable
   }
 }
+
+/**
+ * Encode a connection config as a base64 JSON string suitable for the
+ * `X-Storage-Connection` request header sent to the backend.
+ */
+export function getConnectionHeader(connection: StoredConnection): string {
+  return btoa(JSON.stringify(connection));
+}
diff --git a/src/lib/storage/download.ts b/src/lib/storage/download.ts
index 7f7ad963..ef447a63 100644
--- a/src/lib/storage/download.ts
+++ b/src/lib/storage/download.ts
@@ -2,15 +2,21 @@
  * Client-side utility for downloading a single S3 object via the server proxy.
  *
  * Strategy:
- *  1. Send a HEAD request to validate credentials and access rights without
- *     transferring the object body (server uses HeadObject internally).
+ *  1. Fetch the object with the `X-Storage-Connection` header carrying the
+ *     connection config from localStorage.
  *  2. On error: throw a `DownloadError` with a typed `code` so the caller can
  *     display a localised message.
- *  3. On success: trigger a native browser download via a programmatic anchor
- *     click. The browser streams the object directly to disk — no client-side
- *     buffering occurs regardless of file size.
+ *  3. On success: create a Blob URL and trigger a native browser download via a
+ *     programmatic anchor click.
+ *
+ * Note: The response body is buffered as a Blob before the download link is
+ * constructed. This avoids exposing credentials in the URL (query-param approach)
+ * while keeping the implementation simple. For very large files this will use
+ * proportional browser memory — see TECH_DEBT.md for the long-term fix.
  */
 
+import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+
 export type DownloadErrorCode =
   | 'not_connected'
   | 'access_denied'
@@ -43,33 +49,42 @@ function mapStatusToCode(status: number): DownloadErrorCode {
 /**
  * Download a single S3 object.
  *
- * Performs a HEAD pre-flight to surface auth and access errors as typed
- * `DownloadError` exceptions, then triggers a native browser download for
- * the actual transfer so the file streams straight to disk.
+ * Fetches the object with the connection config header, buffers it as a Blob,
+ * then triggers a native browser download via a programmatic anchor click.
  *
- * @throws {DownloadError} when the server returns a non-2xx response on the
- *   pre-flight check.
+ * @throws {DownloadError} when the server returns a non-2xx response.
  */
-export async function downloadObject(bucket: string, key: string): Promise<void> {
+export async function downloadObject(
+  bucket: string,
+  key: string,
+  connectionHeader: string
+): Promise<void> {
   const url = buildDownloadUrl(bucket, key);
 
-  // Pre-flight: validate credentials and access without fetching the body.
-  const check = await fetch(url, { method: 'HEAD' });
-  if (!check.ok) {
-    const code = mapStatusToCode(check.status);
-    throw new DownloadError(code, `Download pre-flight failed with status ${check.status}`);
+  const response = await fetch(url, {
+    headers: { [STORAGE_CONNECTION_HEADER]: connectionHeader }
+  });
+
+  if (!response.ok) {
+    const code = mapStatusToCode(response.status);
+    throw new DownloadError(code, `Download failed with status ${response.status}`);
   }
 
+  const blob = await response.blob();
+  const blobUrl = URL.createObjectURL(blob);
+
   // Derive filename from the key (last path segment).
   const filename = key.split('/').filter(Boolean).pop() ?? key;
 
-  // Trigger a native browser download. The browser sends the session cookie
-  // automatically and streams the response body directly to disk.
   const anchor = document.createElement('a');
-  anchor.href = url;
+  anchor.href = blobUrl;
   anchor.download = filename;
   anchor.style.display = 'none';
   document.body.appendChild(anchor);
   anchor.click();
   document.body.removeChild(anchor);
+
+  // Release the object URL after a short delay to allow the browser to initiate
+  // the download before the URL is revoked.
+  setTimeout(() => URL.revokeObjectURL(blobUrl), 10_000);
 }
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index c15ccc6c..e3f8eb49 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -16,6 +16,7 @@ import { downloadObject, DownloadError } from '$lib/storage/download.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { ActionError, getActionErrorMessage } from './errors.js';
 import { BookmarksState } from './bookmarks.svelte.js';
+import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 
 export class StorageState {
   // ── Core data (synced from server load) ──
@@ -269,7 +270,12 @@ export class StorageState {
           this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
         }
         try {
-          await downloadObject(this.bucket, key);
+          const conn = loadConnectionLocally();
+          if (!conn) {
+            addToast('error', m.storage_download_error_unknown());
+            return;
+          }
+          await downloadObject(this.bucket, key, getConnectionHeader(conn));
         } catch (err: unknown) {
           if (err instanceof DownloadError) {
             addToast('error', getActionErrorMessage(new ActionError(err.code, err.message)));
@@ -357,7 +363,10 @@ export class StorageState {
     const params = new SvelteURLSearchParams({ bucket });
     for (const key of keys) params.append('keys', key);
 
-    const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE' });
+    const conn = loadConnectionLocally();
+    const headers: HeadersInit = conn ? { 'x-storage-connection': getConnectionHeader(conn) } : {};
+
+    const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE', headers });
     if (!res.ok) {
       let code: string;
       if (res.status === 401) code = 'not_connected';
diff --git a/src/lib/storage/upload.ts b/src/lib/storage/upload.ts
index 8865b144..0f366405 100644
--- a/src/lib/storage/upload.ts
+++ b/src/lib/storage/upload.ts
@@ -9,8 +9,12 @@
  *   supported in Firefox.
  * - The file is sent as the raw request body — no base64 or multipart encoding.
  *   The server streams it directly to S3, preserving binary integrity.
+ * - The connection config is passed via the `X-Storage-Connection` header
+ *   (base64-encoded JSON), read by the server from the client's localStorage.
  */
 
+import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+
 export type UploadErrorCode =
   | 'not_connected'
   | 'access_denied'
@@ -53,9 +57,16 @@ function mapStatusToUploadCode(status: number): UploadErrorCode {
  * so no object body is transferred. Returns `true` if the object exists, `false`
  * if it does not. Throws `UploadError` for auth or server errors.
  */
-export async function checkObjectExists(bucket: string, key: string): Promise<boolean> {
+export async function checkObjectExists(
+  bucket: string,
+  key: string,
+  connectionHeader: string
+): Promise<boolean> {
   const url = buildDownloadUrl(bucket, key);
-  const res = await fetch(url, { method: 'HEAD' });
+  const res = await fetch(url, {
+    method: 'HEAD',
+    headers: { [STORAGE_CONNECTION_HEADER]: connectionHeader }
+  });
   if (res.status === 200) return true;
   if (res.status === 404) return false;
   if (res.status === 401) throw new UploadError('not_connected', 'Not connected');
@@ -77,7 +88,8 @@ export function uploadFile(
   bucket: string,
   key: string,
   file: File,
-  onProgress: (pct: number) => void
+  onProgress: (pct: number) => void,
+  connectionHeader: string
 ): Promise<void> {
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest();
@@ -109,6 +121,7 @@ export function uploadFile(
 
     xhr.open('POST', url);
     xhr.setRequestHeader('Content-Type', file.type || 'application/octet-stream');
+    xhr.setRequestHeader(STORAGE_CONNECTION_HEADER, connectionHeader);
     xhr.send(file);
   });
 }
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
index e91a40b5..bcc2ce6a 100644
--- a/src/routes/(app)/storage/+error.svelte
+++ b/src/routes/(app)/storage/+error.svelte
@@ -4,7 +4,14 @@
   import IconWarning from 'virtual:icons/material-symbols/warning';
   import * as m from '$lib/paraglide/messages.js';
 
-  const bucket = $derived(page.params.bucket ?? '');
+  // page.params.bucket may be absent when a client-side universal load throws an
+  // error (the error boundary sits at the parent /storage level, and SvelteKit
+  // may not populate child-route params on the page store in that case).
+  // Fall back to parsing the bucket segment directly from the URL path.
+  const bucket = $derived(
+    page.params.bucket ||
+      decodeURIComponent(page.url?.pathname?.split('/').filter(Boolean)[1] ?? '')
+  );
 
   function bucketErrorMessage(status: number, name: string): string | null {
     if (!name) return null;
diff --git a/src/routes/(app)/storage/+layout.server.ts b/src/routes/(app)/storage/+layout.server.ts
index ce04ed41..17175c59 100644
--- a/src/routes/(app)/storage/+layout.server.ts
+++ b/src/routes/(app)/storage/+layout.server.ts
@@ -1,7 +1,5 @@
 import type { LayoutServerLoad } from './$types';
 import { error } from '@sveltejs/kit';
-import { getConnection, listBuckets } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
 import { storageBrowserEnabled } from '$lib/server/feature-flags.js';
 
 export const load: LayoutServerLoad = async ({ locals }) => {
@@ -9,18 +7,9 @@ export const load: LayoutServerLoad = async ({ locals }) => {
     throw error(404, 'Not found');
   }
 
-  const userId = getUserId(locals);
-  const connection = getConnection(userId);
+  locals.logger.debug('loading storage layout');
 
-  if (!connection) {
-    return { connected: false, buckets: [] as string[], connectionType: null };
-  }
-
-  try {
-    const buckets = await listBuckets(userId);
-    return { connected: true, buckets, connectionType: connection.type };
-  } catch (err) {
-    locals.logger.warn({ err }, 'failed to list buckets for storage layout');
-    return { connected: true, buckets: [] as string[], connectionType: connection.type };
-  }
+  // Connected state and bucket list are determined client-side from localStorage
+  // and populated by the universal +layout.ts load after hydration.
+  return { connected: false, buckets: [] as string[], connectionType: null };
 };
diff --git a/src/routes/(app)/storage/+layout.ts b/src/routes/(app)/storage/+layout.ts
new file mode 100644
index 00000000..4b4c5e10
--- /dev/null
+++ b/src/routes/(app)/storage/+layout.ts
@@ -0,0 +1,35 @@
+import { browser } from '$app/environment';
+import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import type { LayoutLoad } from './$types';
+
+const DISCONNECTED = { connected: false, buckets: [] as string[], connectionType: null };
+
+/**
+ * Client-side load: reads the connection from localStorage and fetches the bucket
+ * list from the server. During SSR this returns the disconnected default — the
+ * layout re-runs on the client after hydration to populate the real state.
+ */
+export const load: LayoutLoad = async ({ fetch, url }) => {
+  if (!browser) return DISCONNECTED;
+
+  // When the user has just explicitly disconnected, skip the auto-reconnect.
+  if (url.searchParams.has('disconnected')) return DISCONNECTED;
+
+  const connection = loadConnectionLocally();
+  if (!connection) return DISCONNECTED;
+
+  const header = getConnectionHeader(connection);
+
+  try {
+    const res = await fetch('/storage/api/buckets', {
+      headers: { 'x-storage-connection': header }
+    });
+
+    if (!res.ok) return DISCONNECTED;
+
+    const buckets = (await res.json()) as string[];
+    return { connected: true, buckets, connectionType: connection.type };
+  } catch {
+    return DISCONNECTED;
+  }
+};
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 48fdd74d..b383aec3 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -3,21 +3,13 @@ import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
 import { StorageConnectionSchema } from '$lib/storage/schemas.js';
-import { getUserId } from '$lib/server/auth-utils.js';
-import {
-  getConnection,
-  saveConnection,
-  clearConnection,
-  listBuckets
-} from '$lib/server/storage/service.js';
+import { listBuckets } from '$lib/server/storage/service.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
   const connectionForm = await superValidate(zod(StorageConnectionSchema));
-  const userId = getUserId(locals);
-  const connected = getConnection(userId) !== null;
-  locals.logger.debug({ connected }, 'loading storage page');
-  return { connectionForm, connected };
+  locals.logger.debug('loading storage page');
+  return { connectionForm };
 };
 
 export const actions: Actions = {
@@ -30,7 +22,6 @@ export const actions: Actions = {
       return fail(400, { form });
     }
 
-    const userId = getUserId(locals);
     const { type, endpoint, pathStyle, region, accessKeyId, secretAccessKey } = form.data;
 
     if (type !== 's3') {
@@ -47,11 +38,9 @@ export const actions: Actions = {
     };
 
     try {
-      saveConnection(userId, config);
-      await listBuckets(userId);
-      log.info({ storage_type: type }, 'user storage connection verified and saved');
+      await listBuckets(config);
+      log.info({ storage_type: type }, 'user storage connection verified');
     } catch (err) {
-      clearConnection(userId);
       log.warn({ err }, 'storage connection test failed');
       return message(form, 'Could not connect — check the endpoint and credentials.', {
         status: 400
@@ -62,9 +51,7 @@ export const actions: Actions = {
   },
 
   disconnect: async ({ locals }) => {
-    const userId = getUserId(locals);
-    clearConnection(userId);
-    locals.logger.info({ user_id: userId }, 'user storage connection cleared');
+    locals.logger.info('user storage connection cleared');
     throw redirect(303, '/storage?disconnected=1');
   }
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
index df190b1b..32a557c6 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -1,26 +1,7 @@
 import type { PageServerLoad } from './$types';
-import { listObjects } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
 
-export const load: PageServerLoad = async ({ locals, params, url }) => {
-  const userId = getUserId(locals);
+export const load: PageServerLoad = async ({ params }) => {
   const prefix = params.prefix ? params.prefix + '/' : '';
   const bucket = params.bucket;
-  const continuationToken = url.searchParams.get('continuationToken');
-  const pageSizeParam = url.searchParams.get('pageSize');
-  const pageSize = pageSizeParam ? parseInt(pageSizeParam, 10) : undefined;
-
-  locals.logger.debug(
-    { bucket, prefix, continuation_token: continuationToken, page_size: pageSize },
-    'loading storage bucket objects'
-  );
-
-  const objects = await listObjects(
-    userId,
-    bucket,
-    prefix,
-    pageSize ?? 25,
-    continuationToken ?? undefined
-  );
-  return { objects, prefix, bucket };
+  return { bucket, prefix };
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index ef43e0db..49c8f26b 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -3,6 +3,8 @@
   import { resolve } from '$app/paths';
   import { getStorageState } from '$lib/storage/context.js';
   import FileExplorer from '$lib/components/storage/explorer/FileExplorer.svelte';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
+  import * as m from '$lib/paraglide/messages.js';
 
   let { data } = $props();
   const storage = getStorageState();
@@ -32,4 +34,51 @@
   });
 </script>
 
-<FileExplorer />
+{#if data.accessDenied}
+  <!--
+    403 is rendered inline rather than via +error.svelte because throwing from a
+    universal load during initial hydration (when data.connected=true causes
+    BucketList to mount) can escape the storage error boundary and fall through
+    to the root fallback. Rendering inline keeps the sidebar visible.
+  -->
+  <div
+    class="
+      flex flex-1 flex-col items-center justify-center gap-6 p-8 text-center
+    "
+  >
+    <div
+      class="
+        bg-error/10 text-error flex size-20 items-center justify-center
+        rounded-full
+      "
+      aria-hidden="true"
+    >
+      <IconWarning class="size-10" aria-hidden="true" />
+    </div>
+
+    <div>
+      <p
+        class="
+          text-base-content/50 mb-1 text-sm font-medium tracking-widest uppercase
+        "
+      >
+        {m.storage_error_title()}
+      </p>
+      <h1 class="text-base-content text-3xl font-bold">403</h1>
+      <p class="text-base-content/70 mt-2 max-w-sm text-sm">
+        {m.storage_error_access_denied({ bucket: data.bucket })}
+      </p>
+    </div>
+
+    <div class="flex flex-wrap items-center justify-center gap-3">
+      <a href={resolve('/storage')} class="btn btn-sm btn-primary">
+        {m.storage_error_back_to_storage()}
+      </a>
+      <button type="button" class="btn btn-ghost btn-sm" onclick={() => history.back()}>
+        {m.storage_error_go_back()}
+      </button>
+    </div>
+  </div>
+{:else}
+  <FileExplorer />
+{/if}
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
new file mode 100644
index 00000000..47568c1d
--- /dev/null
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -0,0 +1,56 @@
+import { browser } from '$app/environment';
+import { error, redirect } from '@sveltejs/kit';
+import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import type { PageLoad } from './$types';
+import type { StoragePage } from '$lib/storage/types.js';
+
+const EMPTY_PAGE: StoragePage = {
+  objects: [],
+  hasNextPage: false,
+  currentPage: 1,
+  pageSize: 25
+};
+
+/**
+ * Client-side load: fetches the object list from the server using the connection
+ * config from localStorage. Redirects to /storage if no connection is available.
+ * During SSR this returns an empty page — the load re-runs on the client.
+ */
+export const load: PageLoad = async ({ fetch, url, data }) => {
+  // Always pass server data through so PageData includes bucket/prefix.
+  const { bucket, prefix } = data;
+
+  if (!browser) return { bucket, prefix, objects: EMPTY_PAGE };
+
+  const connection = loadConnectionLocally();
+  if (!connection) throw redirect(303, '/storage');
+
+  const continuationToken = url.searchParams.get('continuationToken');
+  const pageSizeParam = url.searchParams.get('pageSize');
+
+  const query = new URLSearchParams({ bucket, prefix: prefix ?? '' });
+  if (continuationToken) query.set('continuationToken', continuationToken);
+  if (pageSizeParam) query.set('pageSize', pageSizeParam);
+
+  const res = await fetch(`/storage/api/objects?${query}`, {
+    headers: { 'x-storage-connection': getConnectionHeader(connection) }
+  });
+
+  if (!res.ok) {
+    if (res.status === 401) throw redirect(303, '/storage');
+    // For 403 we return an accessDenied flag rather than throwing error().
+    // Throwing from a universal load during initial hydration (e.g. after
+    // page.goto) can bypass the +error.svelte boundary and fall through to the
+    // root fallback when data.connected=true causes BucketList to mount — a
+    // hydration-state mismatch that SvelteKit cannot safely recover from.
+    // Handling 403 inline in +page.svelte avoids the boundary entirely and
+    // keeps the sidebar visible so the user can navigate away.
+    if (res.status === 403)
+      return { bucket, prefix, objects: EMPTY_PAGE, accessDenied: true as const };
+    const body = (await res.json().catch(() => ({}))) as { message?: string };
+    throw error(res.status, body.message ?? 'Failed to load objects');
+  }
+
+  const objects = (await res.json()) as StoragePage;
+  return { bucket, prefix, objects };
+};
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
index e525528c..1ef2b010 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
@@ -1,62 +1,29 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-vi.mock('$lib/server/storage/service.js', () => ({
-  listObjects: vi.fn()
-}));
-
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
+import { describe, it, expect } from 'vitest';
 
 import { load } from './+page.server.js';
-import { listObjects } from '$lib/server/storage/service.js';
 
-function mockEvent(
-  opts: { bucket?: string; prefix?: string; searchParams?: Record<string, string> } = {}
-) {
-  const url = new URL('http://localhost/storage/b1/some/prefix');
-  for (const [k, v] of Object.entries(opts.searchParams ?? {})) {
-    url.searchParams.set(k, v);
-  }
+function mockEvent(opts: { bucket?: string; prefix?: string } = {}) {
   return {
     locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } },
-    params: { bucket: opts.bucket ?? 'my-bucket', prefix: opts.prefix ?? '' },
-    url
+    params: { bucket: opts.bucket ?? 'my-bucket', prefix: opts.prefix ?? '' }
   } as unknown as Parameters<typeof load>[0];
 }
 
-describe('bucket page load', () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it('lists objects with default page size', async () => {
-    vi.mocked(listObjects).mockResolvedValue({ items: [], prefixes: [] } as unknown as Awaited<
-      ReturnType<typeof listObjects>
-    >);
-
-    const result = (await load(mockEvent())) as { bucket: string; prefix: string };
+import { vi } from 'vitest';
 
-    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', '', 25, undefined);
-    expect(result.bucket).toBe('my-bucket');
-    expect(result.prefix).toBe('');
+describe('bucket page server load', () => {
+  it('returns bucket and prefix', async () => {
+    const result = await load(mockEvent());
+    expect(result).toEqual({ bucket: 'my-bucket', prefix: '' });
   });
 
   it('adds trailing slash to prefix', async () => {
-    vi.mocked(listObjects).mockResolvedValue({ items: [] } as unknown as Awaited<
-      ReturnType<typeof listObjects>
-    >);
-
-    await load(mockEvent({ prefix: 'data/2024' }));
-
-    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', 'data/2024/', 25, undefined);
+    const result = await load(mockEvent({ prefix: 'data/2024' }));
+    expect(result).toEqual({ bucket: 'my-bucket', prefix: 'data/2024/' });
   });
 
-  it('passes continuationToken and pageSize', async () => {
-    vi.mocked(listObjects).mockResolvedValue({ items: [] } as unknown as Awaited<
-      ReturnType<typeof listObjects>
-    >);
-
-    await load(mockEvent({ searchParams: { continuationToken: 'abc', pageSize: '50' } }));
-
-    expect(listObjects).toHaveBeenCalledWith('test-user', 'my-bucket', '', 50, 'abc');
+  it('handles empty prefix', async () => {
+    const result = await load(mockEvent({ bucket: 'test-bucket', prefix: '' }));
+    expect(result).toEqual({ bucket: 'test-bucket', prefix: '' });
   });
 });
diff --git a/src/routes/(app)/storage/api/buckets/+server.ts b/src/routes/(app)/storage/api/buckets/+server.ts
new file mode 100644
index 00000000..54994560
--- /dev/null
+++ b/src/routes/(app)/storage/api/buckets/+server.ts
@@ -0,0 +1,16 @@
+import { listBuckets } from '$lib/server/storage/service.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /storage/api/buckets
+ *
+ * Returns the list of buckets accessible with the connection config supplied in
+ * the `X-Storage-Connection` request header (base64-encoded JSON).
+ * The config is parsed and validated by the `handleStorageConnection` middleware
+ * in hooks.server.ts before this handler runs.
+ */
+export const GET: RequestHandler = async ({ locals }) => {
+  const buckets = await listBuckets(locals.storageConfig!);
+  locals.logger.debug({ bucket_count: buckets.length }, 'bucket list returned');
+  return Response.json(buckets);
+};
diff --git a/src/routes/(app)/storage/api/delete/+server.ts b/src/routes/(app)/storage/api/delete/+server.ts
index 174e84b4..43369e83 100644
--- a/src/routes/(app)/storage/api/delete/+server.ts
+++ b/src/routes/(app)/storage/api/delete/+server.ts
@@ -1,7 +1,6 @@
 import type { RequestHandler } from './$types';
 import { error } from '@sveltejs/kit';
 import { deleteObjects } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
 import { requireBucket } from '../params.js';
 
 /**
@@ -9,6 +8,9 @@ import { requireBucket } from '../params.js';
  *
  * Deletes one or more S3 objects from the given bucket.
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
 export const DELETE: RequestHandler = async ({ locals, url }) => {
   const bucket = requireBucket(url);
@@ -18,11 +20,9 @@ export const DELETE: RequestHandler = async ({ locals, url }) => {
     throw error(400, 'Missing required query parameter: keys');
   }
 
-  const userId = getUserId(locals);
-
   locals.logger.debug({ bucket, key_count: keys.length }, 'delete request received');
 
-  const result = await deleteObjects(userId, bucket, keys);
+  const result = await deleteObjects(locals.storageConfig!, bucket, keys);
 
   locals.logger.info(
     { bucket, key_count: keys.length, failed_count: result.failed.length },
diff --git a/src/routes/(app)/storage/api/delete/server.test.ts b/src/routes/(app)/storage/api/delete/server.test.ts
index acda7403..7d2dcd9e 100644
--- a/src/routes/(app)/storage/api/delete/server.test.ts
+++ b/src/routes/(app)/storage/api/delete/server.test.ts
@@ -5,13 +5,13 @@ vi.mock('$lib/server/storage/service.js', () => ({
   deleteObjects: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
-
 import { DELETE } from './+server.js';
 import { deleteObjects } from '$lib/server/storage/service.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(searchParams: Record<string, string | string[]>) {
   const url = new URL('http://localhost/storage/api/delete');
   for (const [k, v] of Object.entries(searchParams)) {
@@ -23,7 +23,12 @@ function mockEvent(searchParams: Record<string, string | string[]>) {
   }
   return {
     url,
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    request: { headers: new Headers(CONNECTION_HEADER) },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof DELETE>[0];
 }
 
@@ -50,7 +55,7 @@ describe('DELETE /storage/api/delete', () => {
     );
 
     const response = await DELETE(mockEvent({ bucket: 'b1', keys }));
-    expect(deleteObjects).toHaveBeenCalledWith('test-user', 'b1', keys);
+    expect(deleteObjects).toHaveBeenCalledWith(expect.objectContaining({ type: 's3' }), 'b1', keys);
     expect(await response.json()).toEqual(result);
   });
 });
diff --git a/src/routes/(app)/storage/api/download/+server.ts b/src/routes/(app)/storage/api/download/+server.ts
index 0a2c984a..d8e09bb8 100644
--- a/src/routes/(app)/storage/api/download/+server.ts
+++ b/src/routes/(app)/storage/api/download/+server.ts
@@ -1,6 +1,5 @@
 import type { RequestHandler } from './$types';
 import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
 import { requireBucketKey } from '../params.js';
 
 /** Derive the bare filename from a (possibly path-prefixed) object key. */
@@ -15,14 +14,16 @@ function filenameFromKey(key: string): string {
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
  * The S3 body stream is piped straight to the HTTP response — no server-side
  * buffering occurs.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
 export const GET: RequestHandler = async ({ locals, url }) => {
   const { bucket, key } = requireBucketKey(url);
-  const userId = getUserId(locals);
 
   locals.logger.debug({ bucket, key }, 'download request received');
 
-  const download = await downloadObject(userId, bucket, key);
+  const download = await downloadObject(locals.storageConfig!, bucket, key);
 
   const filename = filenameFromKey(key);
   // RFC 5987 encoding for non-ASCII filenames in Content-Disposition
@@ -53,16 +54,17 @@ export const GET: RequestHandler = async ({ locals, url }) => {
  *
  * Lightweight pre-flight that validates credentials and access rights using
  * a HeadObject call (no object body transferred). The client uses this before
- * initiating a native browser download to surface auth/not-found errors as
- * inline UI messages rather than browser download failures.
+ * initiating a download to surface auth/not-found errors as inline UI messages.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
 export const HEAD: RequestHandler = async ({ locals, url }) => {
   const { bucket, key } = requireBucketKey(url);
-  const userId = getUserId(locals);
 
   locals.logger.debug({ bucket, key }, 'download pre-flight check');
 
-  const meta = await getObjectMetadata(userId, bucket, key);
+  const meta = await getObjectMetadata(locals.storageConfig!, bucket, key);
 
   return new Response(null, {
     status: 200,
diff --git a/src/routes/(app)/storage/api/download/server.test.ts b/src/routes/(app)/storage/api/download/server.test.ts
index 0ed933f8..545b581b 100644
--- a/src/routes/(app)/storage/api/download/server.test.ts
+++ b/src/routes/(app)/storage/api/download/server.test.ts
@@ -5,18 +5,23 @@ vi.mock('$lib/server/storage/service.js', () => ({
   getObjectMetadata: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
-
 import { GET, HEAD } from './+server.js';
 import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(params: string) {
   const url = new URL(`http://localhost/storage/api/download?${params}`);
   return {
     url,
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    request: { headers: new Headers(CONNECTION_HEADER) },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof GET>[0];
 }
 
diff --git a/src/routes/(app)/storage/api/objects/+server.ts b/src/routes/(app)/storage/api/objects/+server.ts
new file mode 100644
index 00000000..463a5b63
--- /dev/null
+++ b/src/routes/(app)/storage/api/objects/+server.ts
@@ -0,0 +1,35 @@
+import { error } from '@sveltejs/kit';
+import { listObjects } from '$lib/server/storage/service.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /storage/api/objects?bucket=<bucket>&prefix=<prefix>&pageSize=<n>&continuationToken=<token>
+ *
+ * Returns a page of objects in the given bucket/prefix using the connection
+ * config supplied in the `X-Storage-Connection` request header.
+ * The config is parsed and validated by the `handleStorageConnection` middleware
+ * in hooks.server.ts before this handler runs.
+ */
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const bucket = url.searchParams.get('bucket')?.trim();
+  if (!bucket) throw error(400, 'Missing required query parameter: bucket');
+
+  const prefix = url.searchParams.get('prefix') ?? '';
+  const continuationToken = url.searchParams.get('continuationToken');
+  const pageSizeParam = url.searchParams.get('pageSize');
+  const pageSize = pageSizeParam ? parseInt(pageSizeParam, 10) : 25;
+
+  locals.logger.debug(
+    { bucket, prefix, continuation_token: continuationToken, page_size: pageSize },
+    'listing objects'
+  );
+
+  const page = await listObjects(
+    locals.storageConfig!,
+    bucket,
+    prefix,
+    pageSize,
+    continuationToken
+  );
+  return Response.json(page);
+};
diff --git a/src/routes/(app)/storage/api/preview/+server.ts b/src/routes/(app)/storage/api/preview/+server.ts
index 193ad363..ffb51b24 100644
--- a/src/routes/(app)/storage/api/preview/+server.ts
+++ b/src/routes/(app)/storage/api/preview/+server.ts
@@ -1,19 +1,23 @@
 import { S3ServiceException } from '@aws-sdk/client-s3';
-import { getUserId } from '$lib/server/auth-utils.js';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
-import { getProviderForUser } from '$lib/server/storage/utils.js';
+import { getProvider } from '$lib/server/storage/utils.js';
 // import { parquetPreview } from '$lib/server/storage/preview/parquet.js';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
 
+/**
+ * GET /storage/api/preview?bucket=<bucket>&key=<object-key>
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
+ */
 export const GET: RequestHandler = async ({ url, locals }) => {
   const log = locals.logger;
-  const userId = getUserId(locals);
   const { bucket, key } = requireBucketKey(url);
 
-  const provider = getProviderForUser(userId, bucket);
+  const provider = getProvider(locals.storageConfig!, bucket);
 
   try {
     const metadata = await provider.getMetadata(key);
@@ -29,7 +33,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
 
     if (isParquet) {
       log.info(
-        { user_id: userId, bucket, key, content_type: rawContentType, total_size: totalSize },
+        { bucket, key, content_type: rawContentType, total_size: totalSize },
         'parquet preview disabled'
       );
       // TODO: re-enable once we have a more robust parquet preview solution in place
@@ -39,7 +43,7 @@ export const GET: RequestHandler = async ({ url, locals }) => {
     // Skip body fetch for known-binary formats — client will show fallback immediately.
     if (KNOWN_BINARY_TYPES.has(rawContentType)) {
       log.info(
-        { user_id: userId, bucket, key, content_type: rawContentType },
+        { bucket, key, content_type: rawContentType },
         'skipping preview fetch for known-binary type'
       );
       return binaryPreview(rawContentType, totalSize);
@@ -52,7 +56,8 @@ export const GET: RequestHandler = async ({ url, locals }) => {
         ? 'text/csv'
         : rawContentType;
 
-    return await streamPreview(provider, key, contentType, totalSize, userId, log);
+    // Pass a placeholder user identifier for logging purposes (no longer user-specific)
+    return await streamPreview(provider, key, contentType, totalSize, 'client', log);
   } catch (err) {
     if (err instanceof S3ServiceException) {
       mapS3ErrorToHttp(err, { bucket, key, operation: 'preview' });
diff --git a/src/routes/(app)/storage/api/preview/server.test.ts b/src/routes/(app)/storage/api/preview/server.test.ts
index d0867554..10c18fdd 100644
--- a/src/routes/(app)/storage/api/preview/server.test.ts
+++ b/src/routes/(app)/storage/api/preview/server.test.ts
@@ -3,11 +3,7 @@ import { S3ServiceException } from '@aws-sdk/client-s3';
 
 const mockGetMetadata = vi.fn();
 vi.mock('$lib/server/storage/utils.js', () => ({
-  getProviderForUser: vi.fn(() => ({ getMetadata: mockGetMetadata }))
-}));
-
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
+  getProvider: vi.fn(() => ({ getMetadata: mockGetMetadata }))
 }));
 
 vi.mock('$lib/server/storage/preview/binary.js', () => ({
@@ -30,11 +26,20 @@ import { binaryPreview } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(params: string) {
   const url = new URL(`http://localhost/storage/api/preview?${params}`);
   return {
     url,
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    request: { headers: new Headers(CONNECTION_HEADER) },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof GET>[0];
 }
 
@@ -59,7 +64,7 @@ describe('GET /storage/api/preview', () => {
       'data.csv',
       'text/csv',
       100,
-      'test-user',
+      'client',
       expect.anything()
     );
   });
@@ -74,7 +79,7 @@ describe('GET /storage/api/preview', () => {
       'readme.txt',
       'text/plain',
       50,
-      'test-user',
+      'client',
       expect.anything()
     );
   });
diff --git a/src/routes/(app)/storage/api/upload/+server.ts b/src/routes/(app)/storage/api/upload/+server.ts
index 696e97c2..b6202da4 100644
--- a/src/routes/(app)/storage/api/upload/+server.ts
+++ b/src/routes/(app)/storage/api/upload/+server.ts
@@ -1,6 +1,5 @@
 import { error } from '@sveltejs/kit';
 import { uploadObject } from '$lib/server/storage/service.js';
-import { getUserId } from '$lib/server/auth-utils.js';
 import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
 
@@ -11,16 +10,11 @@ import type { RequestHandler } from './$types';
  * @aws-sdk/lib-storage). The request body is piped to the S3 SDK without
  * buffering in server memory, regardless of file size.
  *
- * Assumptions (v0):
- * - Credentials come from the in-memory per-user S3 connection config
- *   (same as download/preview). No production credential vaulting.
- * - No server-side file size limit is enforced; S3's 5 TB object limit applies.
- * - A single Content-Type header value is trusted from the client and forwarded
- *   to S3 as-is.
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
  */
 export const POST: RequestHandler = async ({ locals, url, request }) => {
   const log = locals.logger;
-  const userId = getUserId(locals);
   const { bucket, key } = requireBucketKey(url);
 
   if (!request.body) {
@@ -39,7 +33,7 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     'upload request received'
   );
 
-  await uploadObject(userId, bucket, key, request.body, contentType, contentLength);
+  await uploadObject(locals.storageConfig!, bucket, key, request.body, contentType, contentLength);
 
   log.info(
     { bucket, key, content_type: contentType, content_length: contentLength },
diff --git a/src/routes/(app)/storage/api/upload/server.test.ts b/src/routes/(app)/storage/api/upload/server.test.ts
index 0f3bb6ed..17644c13 100644
--- a/src/routes/(app)/storage/api/upload/server.test.ts
+++ b/src/routes/(app)/storage/api/upload/server.test.ts
@@ -4,13 +4,13 @@ vi.mock('$lib/server/storage/service.js', () => ({
   uploadObject: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
-
 import { POST } from './+server.js';
 import { uploadObject } from '$lib/server/storage/service.js';
 
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
 function mockEvent(opts: {
   params?: string;
   body?: ReadableStream | null;
@@ -20,13 +20,17 @@ function mockEvent(opts: {
     `http://localhost/storage/api/upload?${opts.params ?? 'bucket=b1&key=file.txt'}`
   );
   const headers = new Headers(
-    opts.headers ?? { 'Content-Type': 'text/plain', 'Content-Length': '42' }
+    opts.headers ?? { 'Content-Type': 'text/plain', 'Content-Length': '42', ...CONNECTION_HEADER }
   );
   const body = 'body' in opts ? opts.body : new ReadableStream();
   return {
     url,
     request: { body, headers },
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } }
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
   } as unknown as Parameters<typeof POST>[0];
 }
 
@@ -52,13 +56,17 @@ describe('POST /storage/api/upload', () => {
     const res = await POST(
       mockEvent({
         body,
-        headers: { 'Content-Type': 'image/png; charset=utf-8', 'Content-Length': '100' }
+        headers: {
+          'Content-Type': 'image/png; charset=utf-8',
+          'Content-Length': '100',
+          ...CONNECTION_HEADER
+        }
       })
     );
 
     expect(res.status).toBe(201);
     expect(uploadObject).toHaveBeenCalledWith(
-      'test-user',
+      expect.objectContaining({ type: 's3' }),
       'b1',
       'file.txt',
       body,
@@ -70,7 +78,7 @@ describe('POST /storage/api/upload', () => {
   it('defaults content type to application/octet-stream', async () => {
     vi.mocked(uploadObject).mockResolvedValue(undefined);
 
-    const res = await POST(mockEvent({ headers: {} }));
+    const res = await POST(mockEvent({ headers: { ...CONNECTION_HEADER } }));
 
     expect(res.status).toBe(201);
     expect(vi.mocked(uploadObject).mock.calls[0][4]).toBe('application/octet-stream');
diff --git a/src/routes/(app)/storage/layout.server.test.ts b/src/routes/(app)/storage/layout.server.test.ts
index 25d1e89e..7edce12a 100644
--- a/src/routes/(app)/storage/layout.server.test.ts
+++ b/src/routes/(app)/storage/layout.server.test.ts
@@ -7,17 +7,7 @@ vi.mock('$lib/server/feature-flags.js', () => ({
   }
 }));
 
-vi.mock('$lib/server/storage/service.js', () => ({
-  getConnection: vi.fn(),
-  listBuckets: vi.fn()
-}));
-
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
-
 import { load } from './+layout.server.js';
-import { getConnection, listBuckets } from '$lib/server/storage/service.js';
 
 function mockEvent() {
   return {
@@ -25,7 +15,7 @@ function mockEvent() {
   } as unknown as Parameters<typeof load>[0];
 }
 
-describe('storage layout load', () => {
+describe('storage layout server load', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('throws 404 when storage browser is disabled', async () => {
@@ -33,37 +23,9 @@ describe('storage layout load', () => {
     await expect(load(mockEvent())).rejects.toThrow(expect.objectContaining({ status: 404 }));
   });
 
-  it('returns connected:false when no connection', async () => {
+  it('returns disconnected default state', async () => {
     mockStorageBrowserEnabled.mockReturnValue(true);
-    vi.mocked(getConnection).mockReturnValue(null);
-
     const result = await load(mockEvent());
     expect(result).toEqual({ connected: false, buckets: [], connectionType: null });
   });
-
-  it('returns buckets when connected', async () => {
-    mockStorageBrowserEnabled.mockReturnValue(true);
-    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
-      typeof getConnection
-    >);
-    vi.mocked(listBuckets).mockResolvedValue(['bucket-a', 'bucket-b']);
-
-    const result = await load(mockEvent());
-    expect(result).toEqual({
-      connected: true,
-      buckets: ['bucket-a', 'bucket-b'],
-      connectionType: 's3'
-    });
-  });
-
-  it('returns empty buckets when listBuckets fails', async () => {
-    mockStorageBrowserEnabled.mockReturnValue(true);
-    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
-      typeof getConnection
-    >);
-    vi.mocked(listBuckets).mockRejectedValue(new Error('network'));
-
-    const result = await load(mockEvent());
-    expect(result).toEqual({ connected: true, buckets: [], connectionType: 's3' });
-  });
 });
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
index d1766205..207b214c 100644
--- a/src/routes/(app)/storage/page.server.test.ts
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -1,16 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 
 vi.mock('$lib/server/storage/service.js', () => ({
-  getConnection: vi.fn(),
-  saveConnection: vi.fn(),
-  clearConnection: vi.fn(),
   listBuckets: vi.fn()
 }));
 
-vi.mock('$lib/server/auth-utils.js', () => ({
-  getUserId: vi.fn(() => 'test-user')
-}));
-
 vi.mock('$lib/storage/schemas.js', () => ({
   StorageConnectionSchema: {} // superValidate is also mocked
 }));
@@ -25,7 +18,7 @@ vi.mock('sveltekit-superforms/adapters', () => ({
 }));
 
 import { load, actions } from './+page.server.js';
-import { getConnection, clearConnection, listBuckets } from '$lib/server/storage/service.js';
+import { listBuckets } from '$lib/server/storage/service.js';
 import { superValidate } from 'sveltekit-superforms';
 
 function mockLocals() {
@@ -35,18 +28,14 @@ function mockLocals() {
 describe('storage page load', () => {
   beforeEach(() => vi.clearAllMocks());
 
-  it('returns connectionForm and connected status', async () => {
+  it('returns connectionForm', async () => {
     vi.mocked(superValidate).mockResolvedValue({ data: {} } as unknown as Awaited<
       ReturnType<typeof superValidate>
     >);
-    vi.mocked(getConnection).mockReturnValue({ type: 's3' } as unknown as ReturnType<
-      typeof getConnection
-    >);
 
     const result = (await load({
       locals: mockLocals()
-    } as unknown as Parameters<typeof load>[0])) as { connected: boolean; connectionForm: unknown };
-    expect(result.connected).toBe(true);
+    } as unknown as Parameters<typeof load>[0])) as { connectionForm: unknown };
     expect(result.connectionForm).toBeDefined();
   });
 });
@@ -86,7 +75,7 @@ describe('storage page actions', () => {
     expect(result).toHaveProperty('message', 'HDFS connections are not yet supported');
   });
 
-  it('connect: clears connection and returns error on test failure', async () => {
+  it('connect: returns error message on connection test failure', async () => {
     vi.mocked(superValidate).mockResolvedValue({
       valid: true,
       data: {
@@ -104,7 +93,6 @@ describe('storage page actions', () => {
       request: new Request('http://localhost', { method: 'POST' }),
       locals: mockLocals()
     } as unknown as Parameters<typeof actions.connect>[0]);
-    expect(clearConnection).toHaveBeenCalledWith('test-user');
     expect(result).toHaveProperty(
       'message',
       'Could not connect — check the endpoint and credentials.'
@@ -133,7 +121,7 @@ describe('storage page actions', () => {
     ).rejects.toThrow(expect.objectContaining({ status: 303, location: '/storage' }));
   });
 
-  it('disconnect: clears connection and redirects', async () => {
+  it('disconnect: redirects', async () => {
     await expect(
       actions.disconnect({ locals: mockLocals() } as unknown as Parameters<
         typeof actions.disconnect
@@ -141,6 +129,5 @@ describe('storage page actions', () => {
     ).rejects.toThrow(
       expect.objectContaining({ status: 303, location: '/storage?disconnected=1' })
     );
-    expect(clearConnection).toHaveBeenCalledWith('test-user');
   });
 });

From 80b75d55ce04d2fe149c18fbd0963486ec0e10c4 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 16 Jun 2026 08:48:03 +0200
Subject: [PATCH 058/136] #79 implement all requested changes

---
 .env.example                                  |  1 +
 .github/workflows/pr_checks.yaml              | 10 -----
 README.md                                     | 20 +++++-----
 TECH_DEBT.md                                  |  2 +-
 messages/de.json                              |  2 +
 messages/en.json                              |  2 +
 package.json                                  |  1 -
 src/hooks.server.ts                           |  4 ++
 src/lib/client/feature-flags.ts               | 16 ++++----
 .../storage/landing/BucketGrid.svelte         |  2 +-
 .../storage/modals/PreviewModal.svelte        |  4 +-
 .../storage/modals/preview/CsvPreview.svelte  |  2 +-
 .../storage/modals/upload/UploadModal.svelte  | 39 +++++++++++++++++--
 .../modals/upload/UploadModal.svelte.spec.ts  |  8 ++--
 .../storage/shared/BucketIcon.svelte          | 21 ++++++++++
 .../storage/sidebar/BucketList.svelte         |  2 +-
 16 files changed, 93 insertions(+), 43 deletions(-)
 create mode 100644 src/lib/components/storage/shared/BucketIcon.svelte

diff --git a/.env.example b/.env.example
index 1181a570..1c987817 100644
--- a/.env.example
+++ b/.env.example
@@ -33,3 +33,4 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 
 # Feature flags
 # STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
+# STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index e675cd69..b9c11866 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -82,12 +82,6 @@ jobs:
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium
 
-      - name: Compile Paraglide messages
-        run: npx @inlang/paraglide-js compile --project ./project.inlang --outdir ./src/lib/paraglide
-
-      - name: Sync SvelteKit
-        run: npx svelte-kit sync
-
       - name: Run unit tests
         run: npm run test:unit
 
@@ -144,7 +138,3 @@ jobs:
 
       - name: Run E2E tests with Garage
         run: npm run test:e2e:garage
-
-      - name: Debug - print config
-        run: cat s3-config.json
-        if: failure()
diff --git a/README.md b/README.md
index 5ce65fb3..3a8ef45d 100644
--- a/README.md
+++ b/README.md
@@ -111,19 +111,19 @@ The application is configured via environment variables. Create a `.env` file at
 
 ### Feature Flags
 
-| Variable                               | Type                             | Default | Description                                                                                                                                                             | Example                                     |
-| -------------------------------------- | -------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- |
-| `STACKABLE_UI_COMPLETION_ENABLED`      | `boolean` (`"false"` to disable) | `true`  | Enables the SQL editor code-completion provider and the metadata endpoint. Set to `"false"` to fall back to plain syntax highlighting.                                  | `STACKABLE_UI_COMPLETION_ENABLED=false`     |
-| `STACKABLE_UI_STORAGE_BROWSER_ENABLED` | `boolean` (`"true"` to enable)   | `false` | Shows the S3/HDFS file browser in the sidebar and activates routes under `/storage`. Must be explicitly opted in to expose storage credentials and the file-browser UI. | `STACKABLE_UI_STORAGE_BROWSER_ENABLED=true` |
+| Variable                                    | Type                             | Default | Description                                                                                                                                                             | Example                                          |
+| ------------------------------------------- | -------------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
+| `STACKABLE_COCKPIT_COMPLETION_ENABLED`      | `boolean` (`"false"` to disable) | `true`  | Enables the SQL editor code-completion provider and the metadata endpoint. Set to `"false"` to fall back to plain syntax highlighting.                                  | `STACKABLE_COCKPIT_COMPLETION_ENABLED=false`     |
+| `STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED` | `boolean` (`"true"` to enable)   | `false` | Shows the S3/HDFS file browser in the sidebar and activates routes under `/storage`. Must be explicitly opted in to expose storage credentials and the file-browser UI. | `STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true` |
 
 ### Storage Preview Limits
 
-| Variable                           | Type              | Default             | Description                                                                                | Example                                     |
-| ---------------------------------- | ----------------- | ------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------- |
-| `STACKABLE_UI_TEXT_PREVIEW_BYTES`  | `integer` (bytes) | `262144` (256 KiB)  | Maximum bytes fetched when previewing text, CSV, or JSON files.                            | `STACKABLE_UI_TEXT_PREVIEW_BYTES=524288`    |
-| `STACKABLE_UI_IMAGE_PREVIEW_BYTES` | `integer` (bytes) | `5242880` (5 MiB)   | Maximum bytes fetched when previewing image files.                                         | `STACKABLE_UI_IMAGE_PREVIEW_BYTES=10485760` |
-| `STACKABLE_UI_PDF_PREVIEW_BYTES`   | `integer` (bytes) | `26214400` (25 MiB) | Maximum bytes fetched when previewing PDF files.                                           | `STACKABLE_UI_PDF_PREVIEW_BYTES=52428800`   |
-| `STACKABLE_UI_FILE_PREVIEW_ROWS`   | `integer` (rows)  | `250`               | Maximum number of rows included in a tabular file preview (e.g. Parquet converted to CSV). | `STACKABLE_UI_FILE_PREVIEW_ROWS=500`        |
+| Variable                                | Type              | Default             | Description                                                                                | Example                                          |
+| --------------------------------------- | ----------------- | ------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------ |
+| `STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES`  | `integer` (bytes) | `262144` (256 KiB)  | Maximum bytes fetched when previewing text, CSV, or JSON files.                            | `STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=524288`    |
+| `STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES` | `integer` (bytes) | `5242880` (5 MiB)   | Maximum bytes fetched when previewing image files.                                         | `STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=10485760` |
+| `STACKABLE_COCKPIT_PDF_PREVIEW_BYTES`   | `integer` (bytes) | `26214400` (25 MiB) | Maximum bytes fetched when previewing PDF files.                                           | `STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=52428800`   |
+| `STACKABLE_COCKPIT_FILE_PREVIEW_ROWS`   | `integer` (rows)  | `250`               | Maximum number of rows included in a tabular file preview (e.g. Parquet converted to CSV). | `STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=500`        |
 
 ## Contributing
 
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index b3e21208..fac5094d 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -74,7 +74,7 @@ The Download action is intentionally restricted to a single file at a time. Mult
 
 **File:** `src/lib/server/trino/queries.ts:20`
 
-Completed query snapshots (including result rows) are cleaned up after `STACKABLE_UI_QUERY_TTL` seconds (default 1800). If a user leaves and returns later, the results will be gone. Consider persisting results to disk or a cache with configurable TTL.
+Completed query snapshots (including result rows) are cleaned up after `STACKABLE_COCKPIT_QUERY_TTL` seconds (default 1800). If a user leaves and returns later, the results will be gone. Consider persisting results to disk or a cache with configurable TTL.
 
 ---
 
diff --git a/messages/de.json b/messages/de.json
index 8fb7028f..1d5615af 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -270,6 +270,8 @@
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
+  "storage_preview_maximise": "Maximieren",
+  "storage_preview_restore": "Wiederherstellen",
   "storage_context_menu_actions": "Aktionen",
   "storage_action_upload": "Hochladen",
   "storage_upload_title": "Hochladen",
diff --git a/messages/en.json b/messages/en.json
index fb91092b..6f5a6875 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -270,6 +270,8 @@
   "storage_preview_csv_rows": "Showing first {count} rows",
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
+  "storage_preview_maximise": "Maximise",
+  "storage_preview_restore": "Restore",
   "storage_context_menu_actions": "Actions",
   "storage_action_upload": "Upload",
   "storage_upload_title": "Upload",
diff --git a/package.json b/package.json
index f2ff0156..7affb0d4 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,6 @@
     "@eslint/compat": "^2.0.2",
     "@eslint/js": "^9.39.2",
     "@faker-js/faker": "^10.4.0",
-    "@iconify-json/gravity-ui": "^1.2.12",
     "@iconify-json/material-symbols": "^1.2.74",
     "@inlang/paraglide-js": "^2.12.0",
     "@playwright/test": "^1.58.2",
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index e48a50a4..ddec24e7 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -7,6 +7,7 @@ import { svelteKitHandler } from 'better-auth/svelte-kit';
 import { auth, oidcEnabled } from '$lib/server/auth';
 import { requestLogger, logger } from '$lib/server/logging';
 import { getConnectionFromHeader } from '$lib/server/storage/connection.js';
+import { storageBrowserEnabled } from '$lib/server/feature-flags.js';
 
 // Allow self-signed TLS certificates in development (e.g. local Trino with self-signed certs).
 if (dev) {
@@ -68,6 +69,9 @@ const handleAuthGuard: Handle = async ({ event, resolve }) => {
  * malformed / invalid header on any route.
  */
 const handleStorageConnection: Handle = async ({ event, resolve }) => {
+  if (event.route.id?.startsWith('/(app)/storage/') && !storageBrowserEnabled) {
+    throw error(404, 'Storage browser is not enabled');
+  }
   event.locals.storageConfig = getConnectionFromHeader(event.request);
   if (event.locals.storageConfig === null && event.route.id?.startsWith('/(app)/storage/api/')) {
     throw error(401, 'No storage connection configured');
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index e239b67d..d15a661e 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -4,12 +4,12 @@
 
 import { env } from '$env/dynamic/public';
 
-/** When `PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT=true`, the storage page
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true`, the storage page
  *  automatically reconnects to the most recently used connection when the
  *  user navigates to `/storage`. Disabled by default — the user must choose
  *  a connection manually. */
 export const storageAutoConnectEnabled =
-  (env.PUBLIC_STACKABLE_UI_STORAGE_AUTO_CONNECT ?? 'false') === 'true';
+  (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT ?? 'false') === 'true';
 
 // ── Pagination ───────────────────────────────────────────────────────────────
 
@@ -30,19 +30,19 @@ function parsePageSizes(raw: string | undefined): readonly number[] {
 }
 
 /** The set of page sizes available in paginated list views.
- *  Controlled by `PUBLIC_STACKABLE_UI_PAGE_SIZES` (comma-separated positive
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES` (comma-separated positive
  *  integers, e.g. `"10,25,50,100"`). Default: `25,50,100`.
  *  Values are deduplicated and sorted ascending. */
 export const allowedPageSizes: readonly number[] = parsePageSizes(
-  env.PUBLIC_STACKABLE_UI_PAGE_SIZES
+  env.PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES
 );
 
 /** The page size selected by default when no user preference is stored.
- *  Controlled by `PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE`.
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE`.
  *  Must be one of the values in `allowedPageSizes`; if the configured value
  *  is not in the allowed set it falls back to the first allowed size. */
 export const defaultPageSize: number = (() => {
-  const raw = env.PUBLIC_STACKABLE_UI_DEFAULT_PAGE_SIZE;
+  const raw = env.PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE;
   const parsed = parseInt(raw ?? '', 10);
   return allowedPageSizes.includes(parsed) ? parsed : (allowedPageSizes[0] ?? 25);
 })();
@@ -51,10 +51,10 @@ export const defaultPageSize: number = (() => {
 
 /** Maximum number of recently visited files and locations kept in localStorage
  *  for the storage browser history.
- *  Controlled by `PUBLIC_STACKABLE_UI_MAX_RECENT_FILES`. Default: 15.
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES`. Default: 15.
  *  Raise to retain a longer history; lower to reduce localStorage pressure on
  *  deployments that handle many distinct objects. Must be a positive integer. */
 export const maxRecentFiles: number = (() => {
-  const parsed = parseInt(env.PUBLIC_STACKABLE_UI_MAX_RECENT_FILES ?? '', 10);
+  const parsed = parseInt(env.PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES ?? '', 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 15;
 })();
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte b/src/lib/components/storage/landing/BucketGrid.svelte
index d21ca364..41cad839 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte
+++ b/src/lib/components/storage/landing/BucketGrid.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import IconBucket from 'virtual:icons/gravity-ui/bucket';
+  import IconBucket from '../shared/BucketIcon.svelte';
   import * as m from '$lib/paraglide/messages.js';
   import { resolve } from '$app/paths';
 
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 89bdd4ac..cc01971d 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -303,7 +303,7 @@
         <button
           class="btn btn-ghost btn-sm btn-square"
           onclick={toggleMaximized}
-          aria-label="Restore"
+          aria-label={m.storage_preview_restore()}
         >
           <MaximizeIcon class="size-4" aria-hidden="true" />
         </button>
@@ -312,7 +312,7 @@
         <button
           class="btn btn-ghost btn-sm btn-square"
           onclick={toggleMaximized}
-          aria-label="Maximise"
+          aria-label={m.storage_preview_maximise()}
         >
           <MaximizeIcon class="size-4" aria-hidden="true" />
         </button>
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index 8c4f3c27..a40e3d23 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -58,7 +58,7 @@
     <table class="table-xs table min-w-max" aria-label="CSV preview">
       <thead>
         <tr class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs">
-          {#each headers as header (header)}
+          {#each headers as header, i (i)}
             <th class="font-semibold whitespace-nowrap">{header}</th>
           {/each}
         </tr>
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index 0fc49279..c1b2f839 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -28,6 +28,8 @@
   let phase = $state<Phase>('idle');
   let entries = $state<FileEntry[]>([]);
 
+  let cancelRequested = $state(false);
+
   // Reset when modal closes.
   $effect(() => {
     if (!open) {
@@ -97,6 +99,7 @@
 
   async function startUploadFlow() {
     if (phase !== 'selected') return;
+    cancelRequested = false;
     phase = 'checking';
 
     const conn = loadConnectionLocally();
@@ -112,6 +115,12 @@
       })
     );
 
+    if (cancelRequested) {
+      phase = 'idle';
+      entries = [];
+      return;
+    }
+
     const conflictMap = new Map(results.map((r) => [r.id, r.conflict]));
     entries = entries.map((e) => ({
       ...e,
@@ -129,6 +138,7 @@
 
   async function confirmAndUpload() {
     if (!canProceed) return;
+    cancelRequested = false;
     await doUploadAll();
   }
 
@@ -143,10 +153,19 @@
     const toUpload = entries.filter((e) => e.status !== 'skipped');
     const concurrency = 3;
     for (let i = 0; i < toUpload.length; i += concurrency) {
+      if (cancelRequested) {
+        const pending = new Set(toUpload.slice(i).map((e) => e.id));
+        entries = entries.map((e) =>
+          pending.has(e.id) ? { ...e, status: 'skipped' as const } : e
+        );
+        break;
+      }
       await Promise.all(toUpload.slice(i, i + concurrency).map(doUploadEntry));
     }
 
-    phase = 'complete';
+    if (!cancelRequested) {
+      phase = 'complete';
+    }
   }
 
   async function doUploadEntry(entry: FileEntry) {
@@ -248,7 +267,12 @@
   }
 
   function handleCancel() {
-    if (phase === 'uploading') return;
+    if (phase === 'uploading') {
+      cancelRequested = true;
+      open = false;
+      return;
+    }
+    cancelRequested = true;
     phase = 'idle';
     entries = [];
     open = false;
@@ -284,7 +308,6 @@
       <button
         class="btn btn-ghost btn-sm btn-square"
         onclick={handleCancel}
-        disabled={phase === 'uploading'}
         aria-label={m.storage_upload_close()}
       >
         <IconClose class="size-5" aria-hidden="true" />
@@ -338,9 +361,12 @@
 
       <!-- ── checking ─────────────────────────────────────────────────────── -->
     {:else if phase === 'checking'}
-      <div class="flex items-center justify-center gap-3 py-8" aria-live="polite">
+      <div class="flex flex-col items-center justify-center gap-3 py-8" aria-live="polite">
         <span class="loading loading-spinner loading-sm text-primary" aria-hidden="true"></span>
         <span class="text-base-content/60 text-sm">{m.storage_upload_checking()}</span>
+        <button class="btn btn-ghost btn-sm mt-2" onclick={handleCancel}>
+          {m.storage_upload_overwrite_cancel()}
+        </button>
       </div>
 
       <!-- ── review: conflict resolution ──────────────────────────────────── -->
@@ -394,6 +420,11 @@
           <UploadEntryStatus {entry} />
         {/each}
       </ul>
+      <div class="flex justify-end">
+        <button class="btn btn-ghost btn-sm" onclick={handleCancel}>
+          {m.storage_upload_overwrite_cancel()}
+        </button>
+      </div>
 
       <!-- ── complete ───────────────────────────────────────────────────────── -->
     {:else if phase === 'complete'}
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index c2b31675..e9aefc47 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -556,7 +556,7 @@ describe('UploadModal', () => {
       await expect.element(page.getByRole('status')).toBeInTheDocument();
     });
 
-    it('should close button be disabled during upload', async () => {
+    it('should show cancel button during upload', async () => {
       const upload = deferred<void>();
       mockUploadFile.mockReturnValue(upload.promise);
 
@@ -566,9 +566,9 @@ describe('UploadModal', () => {
 
       await page.getByRole('button', { name: /upload/i }).click();
 
-      // The close button is disabled while an upload is in progress.
-      const closeBtn = page.getByRole('button', { name: /close/i });
-      await expect.element(closeBtn).toBeDisabled();
+      // The cancel button is visible while an upload is in progress.
+      const cancelBtn = page.getByRole('button', { name: /cancel/i });
+      await expect.element(cancelBtn).toBeInTheDocument();
 
       // Resolve the upload so the component reaches 'complete' cleanly before
       // teardown, avoiding a state update on a destroyed component.
diff --git a/src/lib/components/storage/shared/BucketIcon.svelte b/src/lib/components/storage/shared/BucketIcon.svelte
new file mode 100644
index 00000000..5a0868ec
--- /dev/null
+++ b/src/lib/components/storage/shared/BucketIcon.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+  interface Props {
+    class?: string;
+    'aria-hidden'?: boolean | 'true' | 'false';
+  }
+  let { class: className = '', 'aria-hidden': ariaHidden }: Props = $props();
+</script>
+
+<svg
+  xmlns="http://www.w3.org/2000/svg"
+  viewBox="0 0 16 16"
+  class={className}
+  aria-hidden={ariaHidden}
+>
+  <path
+    fill="currentColor"
+    fill-rule="evenodd"
+    d="M11.615 4.888c.814-.375.885-.714.885-.888s-.071-.513-.885-.888S9.538 2.5 8 2.5s-2.799.237-3.615.612C3.57 3.487 3.5 3.826 3.5 4s.071.513.885.888S6.462 5.5 8 5.5s2.799-.237 3.615-.612M8 7c1.688 0 3.213-.26 4.304-.779a13 13 0 0 1-.085.431l-1.18 5.51a1 1 0 0 1-.039.094a1.5 1.5 0 0 1-.31.433c-.306.306-1.03.811-2.69.811s-2.384-.505-2.69-.81a1.5 1.5 0 0 1-.31-.434a1 1 0 0 1-.038-.095l-.022-.1q.163-.025.33-.063c1.518-.331 3.284-1.253 5.221-2.931a.75.75 0 1 0-.982-1.134c-1.813 1.572-3.36 2.338-4.56 2.6q-.166.036-.324.06l-.844-3.94q-.046-.215-.085-.432C4.786 6.741 6.312 7 8 7m-4.93 3.496l-.697-3.254c-.28.426-.434.846-.49 1.227c-.107.72.13 1.323.592 1.7c.158.13.356.244.596.327M2.062 5.314Q2.001 4.66 2 4c0-2 2.686-3 6-3s6 1 6 3c0 .997-.105 1.992-.314 2.967L12.5 12.5S12 15 8 15s-4.5-2.5-4.5-2.5l-.084-.394c-.736-.091-1.378-.356-1.89-.775C.611 10.583.223 9.435.398 8.25c.15-1.02.708-2.049 1.662-2.936"
+    clip-rule="evenodd"
+  />
+</svg>
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index ac5f9f4c..7ccda83e 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -5,7 +5,7 @@
   import IconClose from 'virtual:icons/material-symbols/close';
   import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
-  import IconBucket from 'virtual:icons/gravity-ui/bucket';
+  import IconBucket from '../shared/BucketIcon.svelte';
   import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
   import IconGridView from 'virtual:icons/material-symbols/grid-view';
   import * as m from '$lib/paraglide/messages.js';

From 9abd4910988ebb8a5c09c732f652495f5c158d30 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 16 Jun 2026 10:10:04 +0200
Subject: [PATCH 059/136] #79 revert remove mobile e2e tests, fix mobile tests

---
 playwright.config.ts                          | 32 ++++++++++++++++++-
 .../storage/explorer/ContextMenu.svelte       |  2 +-
 .../storage/explorer/StorageBreadcrumb.svelte |  2 +-
 3 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/playwright.config.ts b/playwright.config.ts
index e0b51c08..568b4946 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -55,6 +55,18 @@ export default defineConfig({
         viewport: { width: 1280, height: 720 }
       }
     },
+    ...(!process.env.CI
+      ? [
+          {
+            name: 'setup-mobile',
+            testMatch: /auth\.setup\.ts/,
+            use: {
+              browserName: 'chromium' as const,
+              viewport: { width: 393, height: 851 }
+            }
+          }
+        ]
+      : []),
     {
       name: 'firefox',
       use: {
@@ -73,6 +85,24 @@ export default defineConfig({
         ...(chromiumExecutablePath && { launchOptions: { executablePath: chromiumExecutablePath } })
       },
       dependencies: ['setup-chromium']
-    }
+    },
+    ...(!process.env.CI
+      ? [
+          {
+            name: 'mobile',
+            use: {
+              browserName: 'chromium' as const,
+              viewport: { width: 393, height: 851 },
+              isMobile: true,
+              hasTouch: true,
+              storageState: 'e2e/.auth/user-setup-mobile.json',
+              ...(chromiumExecutablePath && {
+                launchOptions: { executablePath: chromiumExecutablePath }
+              })
+            },
+            dependencies: ['setup-mobile']
+          }
+        ]
+      : [])
   ]
 });
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index 59976dbb..eb4dd9d4 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -101,7 +101,7 @@
 <ul
   bind:this={menuEl}
   class="
-    menu menu-sm border-base-300 bg-base-100 absolute z-50 w-48 rounded-lg
+    menu menu-sm border-base-300 bg-base-100 absolute z-70 w-48 rounded-lg
     border p-1 shadow-lg
   "
   role="menu"
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 36754dfb..433fc3e8 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -133,7 +133,7 @@
   </span>
 {/snippet}
 
-<div class="border-base-300 flex items-center gap-3 border-b px-6 py-3">
+<div class="border-base-300 flex flex-wrap items-center gap-3 border-b px-6 py-3">
   <!-- Breadcrumbs -->
   <nav
     aria-label="breadcrumb"

From dae8f8ec9f9f0ee35f1be891ada5e786a77c524a Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Thu, 18 Jun 2026 13:14:00 +0200
Subject: [PATCH 060/136] feat(database): integrate Drizzle ORM with PostgreSQL
 18 (#200)

* feat(database): integrate Drizzle ORM with PostgreSQL 18

- Added PostgreSQL Helm chart and related Kubernetes configurations for local development and E2E testing.
- Introduced new NPM scripts for database generation, migration, and management using Drizzle ORM.
- Created database connection and migration logic in `drizzle.config.ts`, `db.ts`, and `migrate.ts`.
- Defined user storage connections schema and initial migration files.
- Updated `DATABASE.md` with setup instructions and usage guidelines for the new database system.

* remove connection testing section from DATABASE.md

* move DATABASE.md into docs folder
---
 dev/postgresql/Chart.yaml                     |     7 +
 dev/postgresql/templates/configmap.yaml       |    20 +
 dev/postgresql/templates/deployment.yaml      |    64 +
 dev/postgresql/templates/secret.yaml          |     9 +
 dev/postgresql/templates/service.yaml         |    15 +
 dev/postgresql/values.yaml                    |    16 +
 dev/setup.sh                                  |    51 +-
 docs/DATABASE.md                              |   190 +
 drizzle.config.ts                             |    17 +
 package-lock.json                             | 10279 +++++++++-------
 package.json                                  |    10 +-
 src/lib/server/db.ts                          |    50 +
 src/lib/server/migrate.ts                     |    29 +
 .../server/migrations/0000_calm_jimmy_woo.sql |    12 +
 .../server/migrations/meta/0000_snapshot.json |   100 +
 src/lib/server/migrations/meta/_journal.json  |    13 +
 src/lib/server/schema.ts                      |    24 +
 17 files changed, 6548 insertions(+), 4358 deletions(-)
 create mode 100644 dev/postgresql/Chart.yaml
 create mode 100644 dev/postgresql/templates/configmap.yaml
 create mode 100644 dev/postgresql/templates/deployment.yaml
 create mode 100644 dev/postgresql/templates/secret.yaml
 create mode 100644 dev/postgresql/templates/service.yaml
 create mode 100644 dev/postgresql/values.yaml
 create mode 100644 docs/DATABASE.md
 create mode 100644 drizzle.config.ts
 create mode 100644 src/lib/server/db.ts
 create mode 100644 src/lib/server/migrate.ts
 create mode 100644 src/lib/server/migrations/0000_calm_jimmy_woo.sql
 create mode 100644 src/lib/server/migrations/meta/0000_snapshot.json
 create mode 100644 src/lib/server/migrations/meta/_journal.json
 create mode 100644 src/lib/server/schema.ts

diff --git a/dev/postgresql/Chart.yaml b/dev/postgresql/Chart.yaml
new file mode 100644
index 00000000..156e12f1
--- /dev/null
+++ b/dev/postgresql/Chart.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v2
+name: postgresql
+description: PostgreSQL 18 database for local dev and E2E testing
+type: application
+version: 0.1.0
+appVersion: '18'
diff --git a/dev/postgresql/templates/configmap.yaml b/dev/postgresql/templates/configmap.yaml
new file mode 100644
index 00000000..ef868f04
--- /dev/null
+++ b/dev/postgresql/templates/configmap.yaml
@@ -0,0 +1,20 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: postgresql-config
+  namespace: default
+data:
+  postgresql.conf: |-
+    # PostgreSQL configuration for development
+    listen_addresses = '*'
+    max_connections = 100
+    shared_buffers = 128MB
+    effective_cache_size = 256MB
+    work_mem = 4MB
+  pg_hba.conf: |-
+    # PostgreSQL Host-based Authentication
+    local   all             all                                     trust
+    host    all             all             127.0.0.1/32            md5
+    host    all             all             ::1/128                 md5
+    host    all             all             0.0.0.0/0               md5
diff --git a/dev/postgresql/templates/deployment.yaml b/dev/postgresql/templates/deployment.yaml
new file mode 100644
index 00000000..b06353dd
--- /dev/null
+++ b/dev/postgresql/templates/deployment.yaml
@@ -0,0 +1,64 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postgresql
+  namespace: default
+  labels:
+    app: postgresql
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgresql
+  template:
+    metadata:
+      labels:
+        app: postgresql
+    spec:
+      containers:
+        - name: postgresql
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: { { .Values.image.pullPolicy } }
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: POSTGRES_DB
+              value: { { .Values.database.name | quote } }
+            - name: POSTGRES_USER
+              value: { { .Values.database.user | quote } }
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgresql-secret
+                  key: password
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql
+            - name: config
+              mountPath: /etc/postgresql
+              readOnly: true
+          readinessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - pg_isready -U {{ .Values.database.user }}
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            failureThreshold: 10
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+      volumes:
+        - name: data
+          emptyDir: {}
+        - name: config
+          configMap:
+            name: postgresql-config
diff --git a/dev/postgresql/templates/secret.yaml b/dev/postgresql/templates/secret.yaml
new file mode 100644
index 00000000..a3aa0972
--- /dev/null
+++ b/dev/postgresql/templates/secret.yaml
@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: postgresql-secret
+  namespace: default
+type: Opaque
+data:
+  password: { { .Values.database.password | b64enc | quote } }
diff --git a/dev/postgresql/templates/service.yaml b/dev/postgresql/templates/service.yaml
new file mode 100644
index 00000000..243cc453
--- /dev/null
+++ b/dev/postgresql/templates/service.yaml
@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgresql
+  namespace: default
+spec:
+  type: NodePort
+  selector:
+    app: postgresql
+  ports:
+    - name: postgres
+      port: 5432
+      targetPort: 5432
+      nodePort: { { .Values.nodePorts.postgres } }
diff --git a/dev/postgresql/values.yaml b/dev/postgresql/values.yaml
new file mode 100644
index 00000000..e99bd668
--- /dev/null
+++ b/dev/postgresql/values.yaml
@@ -0,0 +1,16 @@
+---
+image:
+  repository: postgres
+  tag: '18.4-alpine3.23'
+  pullPolicy: IfNotPresent
+
+# Database configuration
+database:
+  name: cockpit
+  user: cockpit
+  password: cockpit-dev-password
+
+# NodePort value for host access.
+# PostgreSQL is exposed on nodePorts.postgres
+nodePorts:
+  postgres: 31432
diff --git a/dev/setup.sh b/dev/setup.sh
index b6165566..4c052501 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -5,11 +5,13 @@ set -euo pipefail
 
 SKIP_TRINO=false
 SKIP_GARAGE=false
+SKIP_POSTGRESQL=false
 for arg in "$@"; do
   case "$arg" in
     --skip-trino) SKIP_TRINO=true ;;
     --skip-garage) SKIP_GARAGE=true ;;
-    *) echo "Unknown argument: $arg"; echo "Usage: $0 [--skip-trino] [--skip-garage]"; exit 1 ;;
+    --skip-postgresql) SKIP_POSTGRESQL=true ;;
+    *) echo "Unknown argument: $arg"; echo "Usage: $0 [--skip-trino] [--skip-garage] [--skip-postgresql]"; exit 1 ;;
   esac
 done
 
@@ -24,6 +26,9 @@ fi
 if [[ "$SKIP_GARAGE" == true ]]; then
   echo "(Garage deployment skipped via --skip-garage)"
 fi
+if [[ "$SKIP_POSTGRESQL" == true ]]; then
+  echo "(PostgreSQL deployment skipped via --skip-postgresql)"
+fi
 echo ""
 
 # ------------------------------------------------------------------
@@ -91,6 +96,18 @@ if [[ "$SKIP_GARAGE" == false ]]; then
     --timeout 60s
 fi
 
+# ------------------------------------------------------------------
+# 5c. Deploy PostgreSQL 18 (via Helm)
+# ------------------------------------------------------------------
+if [[ "$SKIP_POSTGRESQL" == false ]]; then
+  echo ""
+  echo "Deploying PostgreSQL 18..."
+  helm upgrade --install postgresql "$SCRIPT_DIR/postgresql" \
+    --namespace default \
+    --wait \
+    --timeout 60s
+fi
+
 # On some local Kubernetes distributions (e.g. Rancher Desktop k3s), the node's
 # InternalIP is not reachable from the host network, but NodePorts are exposed
 # on localhost. Probe both and use the first reachable URL.
@@ -244,6 +261,20 @@ if [ -f "$ENV_FILE" ]; then
   cp "$ENV_FILE" "$ENV_FILE.bak"
 fi
 
+if [[ "$SKIP_POSTGRESQL" == false ]]; then
+  echo ""
+  echo "Waiting for PostgreSQL to be ready..."
+  kubectl wait --for=condition=ready pod -l app=postgresql --timeout=60s
+
+  echo "Running database migrations..."
+  DATABASE_HOST=localhost \
+    DATABASE_PORT=31432 \
+    DATABASE_NAME=cockpit \
+    DATABASE_USER=cockpit \
+    DATABASE_PASSWORD=cockpit-dev-password \
+    npx tsx src/lib/server/migrate.ts
+fi
+
 if [[ "$SKIP_TRINO" == false ]]; then
   TRINO_PORT=$(kubectl get svc trino-coordinator -o jsonpath='{.spec.ports[0].nodePort}')
 
@@ -280,6 +311,11 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+DATABASE_HOST=localhost
+DATABASE_PORT=31432
+DATABASE_NAME=cockpit
+DATABASE_USER=cockpit
+DATABASE_PASSWORD=cockpit-dev-password
 EOF
 else
   cat > "$ENV_FILE" <<EOF
@@ -297,6 +333,11 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+DATABASE_HOST=localhost
+DATABASE_PORT=31432
+DATABASE_NAME=cockpit
+DATABASE_USER=cockpit
+DATABASE_PASSWORD=cockpit-dev-password
 EOF
 fi
 
@@ -348,6 +389,14 @@ if [[ "$SKIP_GARAGE" == false ]]; then
   echo "  Credentials written to s3-config.json for E2E tests."
   echo ""
 fi
+if [[ "$SKIP_POSTGRESQL" == false ]]; then
+  echo "PostgreSQL:     localhost:31432"
+  echo "  Database:     cockpit"
+  echo "  User:         cockpit"
+  echo "  Password:     cockpit-dev-password"
+  echo "  Environment:  DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD"
+  echo ""
+fi
 echo "Test users (OIDC):"
 echo "  alice / alicealice"
 echo "  bob   / bobbob"
diff --git a/docs/DATABASE.md b/docs/DATABASE.md
new file mode 100644
index 00000000..09126f7a
--- /dev/null
+++ b/docs/DATABASE.md
@@ -0,0 +1,190 @@
+# Drizzle ORM Database Setup Guide
+
+This project uses **Drizzle ORM** with PostgreSQL 18 for database management.
+
+## Environment Variables
+
+The following environment variables are required for database connection:
+
+```env
+DATABASE_HOST=localhost          # PostgreSQL host
+DATABASE_PORT=31432              # PostgreSQL port (default: 5432)
+DATABASE_NAME=cockpit            # Database name
+DATABASE_USER=cockpit            # Database user
+DATABASE_PASSWORD=cockpit-dev-password  # Database password
+```
+
+These are automatically set in `.env.development` by `./dev/setup.sh`.
+
+## Database Setup
+
+### 1. Automatic Setup (Recommended)
+
+Run the setup script to deploy PostgreSQL and automatically run migrations:
+
+```bash
+./dev/setup.sh              # Deploy Keycloak, Trino, Garage, PostgreSQL + migrations
+./dev/setup.sh --skip-trino  # Skip Trino if not needed
+./dev/setup.sh --skip-postgresql  # Skip PostgreSQL if already running
+```
+
+The script will:
+
+1. Deploy PostgreSQL to the Kubernetes cluster
+2. Wait for it to be ready
+3. Automatically run all pending migrations
+
+### 2. Manual Setup
+
+If you have PostgreSQL running elsewhere, just set the environment variables in `.env.development`.
+
+## Schema Management
+
+### Define Tables
+
+Edit [src/lib/server/schema.ts](../src/lib/server/schema.ts) to define your database schema:
+
+```typescript
+import { pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+
+export const users = pgTable('users', {
+  id: uuid('id').primaryKey().defaultRandom(),
+  name: text('name').notNull(),
+  email: text('email').notNull().unique(),
+  createdAt: timestamp('created_at').defaultNow().notNull()
+});
+```
+
+### Generate & Run Migrations
+
+```bash
+# Generate migration files from schema
+npm run db:generate
+
+# Run migrations against the database (manual)
+npm run db:migrate
+
+# Or run via Node script (same as setup.sh uses)
+npm run db:migrate:run
+```
+
+**Automatic Migrations**: When you run `./dev/setup.sh`, migrations are automatically applied after PostgreSQL is deployed. You don't need to run them manually in that case.
+
+Migrations are stored in `src/lib/server/migrations/`.
+
+## NPM Scripts
+
+All Drizzle commands automatically load `.env.development` via `dotenv` in `drizzle.config.ts`.
+
+```bash
+npm run db:generate        # Generate new migrations from schema changes
+npm run db:migrate         # Run pending migrations (via drizzle-kit)
+npm run db:migrate:run     # Run pending migrations (via Node script, used by setup.sh)
+npm run db:studio          # Open Drizzle Studio (web-based DB preview/management)
+```
+
+**Override env file**: Use `DRIZZLE_ENV_FILE` to use a different environment file:
+
+```bash
+DRIZZLE_ENV_FILE=.env.production npm run db:generate
+```
+
+**Drizzle Studio**: Open a visual editor and preview of your database:
+
+```bash
+npm run db:studio
+# Opens http://local.drizzle.studio in your browser
+# Shows schema, tables, relationships, and allows data browsing
+```
+
+## Database Preview & Management
+
+Perfect for inspecting your database during development without leaving your editor.
+
+## Using the Database
+
+### In Server-Side Code
+
+```typescript
+// In +page.server.ts or +server.ts
+import { db } from '$lib/server/db';
+
+export const load: PageServerLoad = async ({ locals }) => {
+  const log = locals.logger;
+
+  try {
+    // Query example
+    const users = await db.query.users.findMany();
+    log.info({ count: users.length }, 'Loaded users');
+    return { users };
+  } catch (error) {
+    log.error({ error }, 'Database query failed');
+    throw error;
+  }
+};
+```
+
+### Connection Testing
+
+The database connection is tested automatically when the server starts. Check the logs for connection status:
+
+```bash
+npm run dev   # Check terminal output for "Database connection successful"
+```
+
+## Documentation
+
+- [Drizzle ORM Docs](https://orm.drizzle.team/docs/overview)
+- [PostgreSQL Driver](https://orm.drizzle.team/docs/get-started-postgresql)
+- [Query API](https://orm.drizzle.team/docs/select)
+
+## Troubleshooting
+
+### Connection Failed
+
+1. Ensure PostgreSQL is running: `kubectl get pod -l app=postgresql`
+2. Check environment variables: `env | grep DATABASE_`
+3. Verify the database exists: `psql -h localhost -U cockpit -d cockpit`
+4. Check logs: `kubectl logs -l app=postgresql`
+
+### Schema Sync Issues
+
+If schema changes aren't reflected:
+
+```bash
+npm run db:generate    # Regenerate migrations
+npm run db:migrate     # Apply migrations
+npm run dev            # Restart dev server
+```
+
+### View Database State
+
+To inspect the current database state:
+
+```bash
+npm run db:studio      # Opens Drizzle Studio for visual inspection
+```
+
+Or use psql directly:
+
+```bash
+psql -h localhost -U cockpit -d cockpit
+# Once connected:
+\dt                    # List all tables
+\d <table_name>        # Describe a table
+SELECT * FROM <table>; # View data
+```
+
+## Security
+
+### SSL/TLS Configuration
+
+- **Development** (`NODE_ENV != production`): SSL is **disabled** by default for local Kubernetes
+- **Production** (`NODE_ENV = production`): SSL is **always enabled** for security
+
+This is configured automatically in both:
+
+- `drizzle.config.ts` - for migrations and Drizzle Studio
+- `src/lib/server/db.ts` - for the application runtime
+
+**Never disable SSL in production.** Unencrypted database connections expose credentials and data to network attacks.
diff --git a/drizzle.config.ts b/drizzle.config.ts
new file mode 100644
index 00000000..da1adf3d
--- /dev/null
+++ b/drizzle.config.ts
@@ -0,0 +1,17 @@
+import { defineConfig } from 'drizzle-kit';
+
+const isDev = process.env.NODE_ENV !== 'production';
+
+export default defineConfig({
+  schema: './src/lib/server/schema.ts',
+  out: './src/lib/server/migrations',
+  dialect: 'postgresql',
+  dbCredentials: {
+    host: process.env.DATABASE_HOST ?? 'localhost',
+    port: Number(process.env.DATABASE_PORT ?? 31432),
+    database: process.env.DATABASE_NAME ?? 'cockpit',
+    user: process.env.DATABASE_USER ?? 'cockpit',
+    password: process.env.DATABASE_PASSWORD ?? 'cockpit-dev-password',
+    ssl: !isDev
+  }
+});
diff --git a/package-lock.json b/package-lock.json
index 839d83af..a0dc6991 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -15,9 +15,11 @@
         "antlr4-c3": "^3.4.4",
         "antlr4ng": "^3.0.16",
         "better-auth": "^1.5.4",
+        "drizzle-orm": "^0.45.2",
         "hyparquet": "^1.25.8",
         "hyparquet-compressors": "^1.1.1",
         "monaco-editor": "^0.55.1",
+        "pg": "^8.21.0",
         "pino": "^10.3.1",
         "pretty-bytes": "^7.1.0",
         "prom-client": "^15.1.3",
@@ -37,10 +39,12 @@
         "@sveltejs/vite-plugin-svelte": "^6.2.4",
         "@tailwindcss/vite": "^4.2.1",
         "@types/node": "^24",
+        "@types/pg": "^8.20.0",
         "@vitest/browser-playwright": "^4.0.18",
         "@vitest/coverage-v8": "^4.0.18",
         "antlr-ng": "^1.0.10",
         "daisyui": "^5.5.19",
+        "drizzle-kit": "^0.31.10",
         "eslint": "^9.39.2",
         "eslint-config-prettier": "^10.1.8",
         "eslint-plugin-better-tailwindcss": "^4.3.0",
@@ -415,16 +419,6 @@
         "@aws-sdk/client-s3": "^3.1053.0"
       }
     },
-    "node_modules/@aws-sdk/lib-storage/node_modules/buffer": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
-      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
-      "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.0.2",
-        "ieee754": "^1.1.4"
-      }
-    },
     "node_modules/@aws-sdk/middleware-bucket-endpoint": {
       "version": "3.972.15",
       "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.15.tgz",
@@ -862,6 +856,13 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/@drizzle-team/brocli": {
+      "version": "0.10.2",
+      "resolved": "https://registry.npmjs.org/@drizzle-team/brocli/-/brocli-0.10.2.tgz",
+      "integrity": "sha512-z33Il7l5dKjUgGULTqBsQBQwckHh5AbIuxhdsIxDDiZAzBOrZO6q9ogcWC65kU382AfynTfgNumVcNIjuIua6w==",
+      "devOptional": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/@electric-sql/pglite": {
       "version": "0.3.15",
       "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.3.15.tgz",
@@ -926,10 +927,88 @@
         "tslib": "^2.4.0"
       }
     },
+    "node_modules/@esbuild-kit/core-utils": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/@esbuild-kit/core-utils/-/core-utils-3.3.2.tgz",
+      "integrity": "sha512-sPRAnw9CdSsRmEtnsl2WXWdyquogVpB3yZ3dgwJfe8zrOzTsV7cJvmwrKVa+0ma5BoiGJ+BoqkMvawbayKUsqQ==",
+      "deprecated": "Merged into tsx: https://tsx.is",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "~0.18.20",
+        "source-map-support": "^0.5.21"
+      }
+    },
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-x64": {
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.18.20.tgz",
+      "integrity": "sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild-kit/core-utils/node_modules/esbuild": {
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.18.20.tgz",
+      "integrity": "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==",
+      "devOptional": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "optionalDependencies": {
+        "@esbuild/android-arm": "0.18.20",
+        "@esbuild/android-arm64": "0.18.20",
+        "@esbuild/android-x64": "0.18.20",
+        "@esbuild/darwin-arm64": "0.18.20",
+        "@esbuild/darwin-x64": "0.18.20",
+        "@esbuild/freebsd-arm64": "0.18.20",
+        "@esbuild/freebsd-x64": "0.18.20",
+        "@esbuild/linux-arm": "0.18.20",
+        "@esbuild/linux-arm64": "0.18.20",
+        "@esbuild/linux-ia32": "0.18.20",
+        "@esbuild/linux-loong64": "0.18.20",
+        "@esbuild/linux-mips64el": "0.18.20",
+        "@esbuild/linux-ppc64": "0.18.20",
+        "@esbuild/linux-riscv64": "0.18.20",
+        "@esbuild/linux-s390x": "0.18.20",
+        "@esbuild/linux-x64": "0.18.20",
+        "@esbuild/netbsd-x64": "0.18.20",
+        "@esbuild/openbsd-x64": "0.18.20",
+        "@esbuild/sunos-x64": "0.18.20",
+        "@esbuild/win32-arm64": "0.18.20",
+        "@esbuild/win32-ia32": "0.18.20",
+        "@esbuild/win32-x64": "0.18.20"
+      }
+    },
+    "node_modules/@esbuild-kit/esm-loader": {
+      "version": "2.6.5",
+      "resolved": "https://registry.npmjs.org/@esbuild-kit/esm-loader/-/esm-loader-2.6.5.tgz",
+      "integrity": "sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA==",
+      "deprecated": "Merged into tsx: https://tsx.is",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@esbuild-kit/core-utils": "^3.3.2",
+        "get-tsconfig": "^4.7.0"
+      }
+    },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.3.tgz",
-      "integrity": "sha512-9fJMTNFTWZMh5qwrBItuziu834eOCUcEqymSH7pY+zoMVEZg3gcPuBNxH1EvfVYe9h0x/Ptw8KBzv7qxb7l8dg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
+      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
       "cpu": [
         "ppc64"
       ],
@@ -943,9 +1022,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.3.tgz",
-      "integrity": "sha512-i5D1hPY7GIQmXlXhs2w8AWHhenb00+GxjxRncS2ZM7YNVGNfaMxgzSGuO8o8SJzRc/oZwU2bcScvVERk03QhzA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.18.20.tgz",
+      "integrity": "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw==",
       "cpu": [
         "arm"
       ],
@@ -955,13 +1034,13 @@
         "android"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.3.tgz",
-      "integrity": "sha512-YdghPYUmj/FX2SYKJ0OZxf+iaKgMsKHVPF1MAq/P8WirnSpCStzKJFjOjzsW0QQ7oIAiccHdcqjbHmJxRb/dmg==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.18.20.tgz",
+      "integrity": "sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ==",
       "cpu": [
         "arm64"
       ],
@@ -971,13 +1050,13 @@
         "android"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.3.tgz",
-      "integrity": "sha512-IN/0BNTkHtk8lkOM8JWAYFg4ORxBkZQf9zXiEOfERX/CzxW3Vg1ewAhU7QSWQpVIzTW+b8Xy+lGzdYXV6UZObQ==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.18.20.tgz",
+      "integrity": "sha512-8GDdlePJA8D6zlZYJV/jnrRAi6rOiNaCC/JclcXpB+KIuvfBN4owLtgzY2bsxnx666XjJx2kDPUmnTtR8qKQUg==",
       "cpu": [
         "x64"
       ],
@@ -987,13 +1066,13 @@
         "android"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.3.tgz",
-      "integrity": "sha512-Re491k7ByTVRy0t3EKWajdLIr0gz2kKKfzafkth4Q8A5n1xTHrkqZgLLjFEHVD+AXdUGgQMq+Godfq45mGpCKg==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.18.20.tgz",
+      "integrity": "sha512-bxRHW5kHU38zS2lPTPOyuyTm+S+eobPUnTNkdJEfAddYgEcll4xkT8DB9d2008DtTbl7uJag2HuE5NZAZgnNEA==",
       "cpu": [
         "arm64"
       ],
@@ -1003,13 +1082,13 @@
         "darwin"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.3.tgz",
-      "integrity": "sha512-vHk/hA7/1AckjGzRqi6wbo+jaShzRowYip6rt6q7VYEDX4LEy1pZfDpdxCBnGtl+A5zq8iXDcyuxwtv3hNtHFg==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.18.20.tgz",
+      "integrity": "sha512-pc5gxlMDxzm513qPGbCbDukOdsGtKhfxD1zJKXjCCcU7ju50O7MeAZ8c4krSJcOIJGFR+qx21yMMVYwiQvyTyQ==",
       "cpu": [
         "x64"
       ],
@@ -1019,13 +1098,13 @@
         "darwin"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-ipTYM2fjt3kQAYOvo6vcxJx3nBYAzPjgTCk7QEgZG8AUO3ydUhvelmhrbOheMnGOlaSFUoHXB6un+A7q4ygY9w==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.18.20.tgz",
+      "integrity": "sha512-yqDQHy4QHevpMAaxhhIwYPMv1NECwOvIpGCZkECn8w2WFHXjEwrBn3CeNIYsibZ/iZEUemj++M26W3cNR5h+Tw==",
       "cpu": [
         "arm64"
       ],
@@ -1035,13 +1114,13 @@
         "freebsd"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.3.tgz",
-      "integrity": "sha512-dDk0X87T7mI6U3K9VjWtHOXqwAMJBNN2r7bejDsc+j03SEjtD9HrOl8gVFByeM0aJksoUuUVU9TBaZa2rgj0oA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.18.20.tgz",
+      "integrity": "sha512-tgWRPPuQsd3RmBZwarGVHZQvtzfEBOreNuxEMKFcd5DaDn2PbBxfwLcj4+aenoh7ctXcbXmOQIn8HI6mCSw5MQ==",
       "cpu": [
         "x64"
       ],
@@ -1051,13 +1130,13 @@
         "freebsd"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.3.tgz",
-      "integrity": "sha512-s6nPv2QkSupJwLYyfS+gwdirm0ukyTFNl3KTgZEAiJDd+iHZcbTPPcWCcRYH+WlNbwChgH2QkE9NSlNrMT8Gfw==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.18.20.tgz",
+      "integrity": "sha512-/5bHkMWnq1EgKr1V+Ybz3s1hWXok7mDFUMQ4cG10AfW3wL02PSZi5kFpYKrptDsgb2WAJIvRcDm+qIvXf/apvg==",
       "cpu": [
         "arm"
       ],
@@ -1067,13 +1146,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.3.tgz",
-      "integrity": "sha512-sZOuFz/xWnZ4KH3YfFrKCf1WyPZHakVzTiqji3WDc0BCl2kBwiJLCXpzLzUBLgmp4veFZdvN5ChW4Eq/8Fc2Fg==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.18.20.tgz",
+      "integrity": "sha512-2YbscF+UL7SQAVIpnWvYwM+3LskyDmPhe31pE7/aoTMFKKzIc9lLbyGUpmmb8a8AixOL61sQ/mFh3jEjHYFvdA==",
       "cpu": [
         "arm64"
       ],
@@ -1083,13 +1162,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.3.tgz",
-      "integrity": "sha512-yGlQYjdxtLdh0a3jHjuwOrxQjOZYD/C9PfdbgJJF3TIZWnm/tMd/RcNiLngiu4iwcBAOezdnSLAwQDPqTmtTYg==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.18.20.tgz",
+      "integrity": "sha512-P4etWwq6IsReT0E1KHU40bOnzMHoH73aXp96Fs8TIT6z9Hu8G6+0SHSw9i2isWrD2nbx2qo5yUqACgdfVGx7TA==",
       "cpu": [
         "ia32"
       ],
@@ -1099,13 +1178,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.3.tgz",
-      "integrity": "sha512-WO60Sn8ly3gtzhyjATDgieJNet/KqsDlX5nRC5Y3oTFcS1l0KWba+SEa9Ja1GfDqSF1z6hif/SkpQJbL63cgOA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.18.20.tgz",
+      "integrity": "sha512-nXW8nqBTrOpDLPgPY9uV+/1DjxoQ7DoB2N8eocyq8I9XuqJ7BiAMDMf9n1xZM9TgW0J8zrquIb/A7s3BJv7rjg==",
       "cpu": [
         "loong64"
       ],
@@ -1115,13 +1194,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.3.tgz",
-      "integrity": "sha512-APsymYA6sGcZ4pD6k+UxbDjOFSvPWyZhjaiPyl/f79xKxwTnrn5QUnXR5prvetuaSMsb4jgeHewIDCIWljrSxw==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.18.20.tgz",
+      "integrity": "sha512-d5NeaXZcHp8PzYy5VnXV3VSd2D328Zb+9dEq5HE6bw6+N86JVPExrA6O68OPwobntbNJ0pzCpUFZTo3w0GyetQ==",
       "cpu": [
         "mips64el"
       ],
@@ -1131,13 +1210,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.3.tgz",
-      "integrity": "sha512-eizBnTeBefojtDb9nSh4vvVQ3V9Qf9Df01PfawPcRzJH4gFSgrObw+LveUyDoKU3kxi5+9RJTCWlj4FjYXVPEA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.18.20.tgz",
+      "integrity": "sha512-WHPyeScRNcmANnLQkq6AfyXRFr5D6N2sKgkFo2FqguP44Nw2eyDlbTdZwd9GYk98DZG9QItIiTlFLHJHjxP3FA==",
       "cpu": [
         "ppc64"
       ],
@@ -1147,13 +1226,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.3.tgz",
-      "integrity": "sha512-3Emwh0r5wmfm3ssTWRQSyVhbOHvqegUDRd0WhmXKX2mkHJe1SFCMJhagUleMq+Uci34wLSipf8Lagt4LlpRFWQ==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.18.20.tgz",
+      "integrity": "sha512-WSxo6h5ecI5XH34KC7w5veNnKkju3zBRLEQNY7mv5mtBmrP/MjNBCAlsM2u5hDBlS3NGcTQpoBvRzqBcRtpq1A==",
       "cpu": [
         "riscv64"
       ],
@@ -1163,13 +1242,13 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.3.tgz",
-      "integrity": "sha512-pBHUx9LzXWBc7MFIEEL0yD/ZVtNgLytvx60gES28GcWMqil8ElCYR4kvbV2BDqsHOvVDRrOxGySBM9Fcv744hw==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.18.20.tgz",
+      "integrity": "sha512-+8231GMs3mAEth6Ja1iK0a1sQ3ohfcpzpRLH8uuc5/KVDFneH6jtAJLFGafpzpMRO6DzJ6AvXKze9LfFMrIHVQ==",
       "cpu": [
         "s390x"
       ],
@@ -1178,14 +1257,30 @@
       "os": [
         "linux"
       ],
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
         "node": ">=18"
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-sDpk0RgmTCR/5HguIZa9n9u+HVKf40fbEUt+iTzSnCaGvY9kFP0YKBWZtJaraonFnqef5SlJ8/TiPAxzyS+UoA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
       "cpu": [
         "arm64"
       ],
@@ -1199,9 +1294,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-P14lFKJl/DdaE00LItAukUdZO5iqNH7+PjoBm+fLQjtxfcfFE20Xf5CrLsmZdq5LFFZzb5JMZ9grUwvtVYzjiA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.18.20.tgz",
+      "integrity": "sha512-iO1c++VP6xUBUmltHZoMtCUdPlnPGdBom6IrO4gyKPFFVBKioIImVooR5I83nTew5UOYrk3gIJhbZh8X44y06A==",
       "cpu": [
         "x64"
       ],
@@ -1211,13 +1306,13 @@
         "netbsd"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.3.tgz",
-      "integrity": "sha512-AIcMP77AvirGbRl/UZFTq5hjXK+2wC7qFRGoHSDrZ5v5b8DK/GYpXW3CPRL53NkvDqb9D+alBiC/dV0Fb7eJcw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
       "cpu": [
         "arm64"
       ],
@@ -1231,9 +1326,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.3.tgz",
-      "integrity": "sha512-DnW2sRrBzA+YnE70LKqnM3P+z8vehfJWHXECbwBmH/CU51z6FiqTQTHFenPlHmo3a8UgpLyH3PT+87OViOh1AQ==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.18.20.tgz",
+      "integrity": "sha512-e5e4YSsuQfX4cxcygw/UCPIEP6wbIL+se3sxPdCiMbFLBWu0eiZOJ7WoD+ptCLrmjZBK1Wk7I6D/I3NglUGOxg==",
       "cpu": [
         "x64"
       ],
@@ -1243,13 +1338,13 @@
         "openbsd"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.3.tgz",
-      "integrity": "sha512-NinAEgr/etERPTsZJ7aEZQvvg/A6IsZG/LgZy+81wON2huV7SrK3e63dU0XhyZP4RKGyTm7aOgmQk0bGp0fy2g==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
+      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
       "cpu": [
         "arm64"
       ],
@@ -1263,9 +1358,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.3.tgz",
-      "integrity": "sha512-PanZ+nEz+eWoBJ8/f8HKxTTD172SKwdXebZ0ndd953gt1HRBbhMsaNqjTyYLGLPdoWHy4zLU7bDVJztF5f3BHA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.18.20.tgz",
+      "integrity": "sha512-kDbFRFp0YpTQVVrqUd5FTYmWo45zGaXe0X8E1G/LKFC0v8x0vWrhOWSLITcCn63lmZIxfOMXtCfti/RxN/0wnQ==",
       "cpu": [
         "x64"
       ],
@@ -1275,13 +1370,13 @@
         "sunos"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.3.tgz",
-      "integrity": "sha512-B2t59lWWYrbRDw/tjiWOuzSsFh1Y/E95ofKz7rIVYSQkUYBjfSgf6oeYPNWHToFRr2zx52JKApIcAS/D5TUBnA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.18.20.tgz",
+      "integrity": "sha512-ddYFR6ItYgoaq4v4JmQQaAI5s7npztfV4Ag6NrhiaW0RrnOXqBkgwZLofVTlq1daVTQNhtI5oieTvkRPfZrePg==",
       "cpu": [
         "arm64"
       ],
@@ -1291,13 +1386,13 @@
         "win32"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.3.tgz",
-      "integrity": "sha512-QLKSFeXNS8+tHW7tZpMtjlNb7HKau0QDpwm49u0vUp9y1WOF+PEzkU84y9GqYaAVW8aH8f3GcBck26jh54cX4Q==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.18.20.tgz",
+      "integrity": "sha512-Wv7QBi3ID/rROT08SABTS7eV4hX26sVduqDOTe1MvGMjNd3EjOz4b7zeexIR62GTIEKrfJXKL9LFxTYgkyeu7g==",
       "cpu": [
         "ia32"
       ],
@@ -1307,13 +1402,13 @@
         "win32"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.3.tgz",
-      "integrity": "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA==",
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.18.20.tgz",
+      "integrity": "sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ==",
       "cpu": [
         "x64"
       ],
@@ -1323,7 +1418,7 @@
         "win32"
       ],
       "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
     "node_modules/@eslint-community/eslint-utils": {
@@ -3363,6 +3458,18 @@
         "undici-types": "~7.16.0"
       }
     },
+    "node_modules/@types/pg": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/@types/pg/-/pg-8.20.0.tgz",
+      "integrity": "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "pg-protocol": "*",
+        "pg-types": "^2.2.0"
+      }
+    },
     "node_modules/@types/react": {
       "version": "19.2.14",
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.14.tgz",
@@ -3646,9 +3753,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4619,9 +4726,9 @@
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.12",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
-      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4640,31 +4747,22 @@
       }
     },
     "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
+      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
+        "base64-js": "^1.0.2",
+        "ieee754": "^1.1.4"
       }
     },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "devOptional": true,
+      "license": "MIT"
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
       "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
@@ -5228,12 +5326,27 @@
         "@types/trusted-types": "^2.0.7"
       }
     },
+    "node_modules/drizzle-kit": {
+      "version": "0.31.10",
+      "resolved": "https://registry.npmjs.org/drizzle-kit/-/drizzle-kit-0.31.10.tgz",
+      "integrity": "sha512-7OZcmQUrdGI+DUNNsKBn1aW8qSoKuTH7d0mYgSP8bAzdFzKoovxEFnoGQp2dVs82EOJeYycqRtciopszwUf8bw==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@drizzle-team/brocli": "^0.10.2",
+        "@esbuild-kit/esm-loader": "^2.5.5",
+        "esbuild": "^0.25.4",
+        "tsx": "^4.21.0"
+      },
+      "bin": {
+        "drizzle-kit": "bin.cjs"
+      }
+    },
     "node_modules/drizzle-orm": {
-      "version": "0.41.0",
-      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.41.0.tgz",
-      "integrity": "sha512-7A4ZxhHk9gdlXmTdPj/lREtP+3u8KvZ4yEN6MYVxBzZGex5Wtdc+CWSbu7btgF6TB0N+MNPrvW7RKBbxJchs/Q==",
+      "version": "0.45.2",
+      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.2.tgz",
+      "integrity": "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==",
       "license": "Apache-2.0",
-      "peer": true,
       "peerDependencies": {
         "@aws-sdk/client-rds-data": ">=3",
         "@cloudflare/workers-types": ">=4",
@@ -5243,12 +5356,13 @@
         "@neondatabase/serverless": ">=0.10.0",
         "@op-engineering/op-sqlite": ">=2",
         "@opentelemetry/api": "^1.4.1",
-        "@planetscale/database": ">=1",
+        "@planetscale/database": ">=1.13",
         "@prisma/client": "*",
         "@tidbcloud/serverless": "*",
         "@types/better-sqlite3": "*",
         "@types/pg": "*",
         "@types/sql.js": "*",
+        "@upstash/redis": ">=1.34.7",
         "@vercel/postgres": ">=0.8.0",
         "@xata.io/client": "*",
         "better-sqlite3": ">=7",
@@ -5306,6 +5420,9 @@
         "@types/sql.js": {
           "optional": true
         },
+        "@upstash/redis": {
+          "optional": true
+        },
         "@vercel/postgres": {
           "optional": true
         },
@@ -5381,9 +5498,9 @@
       "license": "MIT"
     },
     "node_modules/effect": {
-      "version": "3.21.2",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.2.tgz",
-      "integrity": "sha512-rXd2FGDM8KdjSIrc+mqEELo7ScW7xTVxEf1iInmPSpIde9/nyGuFM710cjTo7/EreGXiUX2MOonPpprbz2XHCg==",
+      "version": "3.21.3",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.3.tgz",
+      "integrity": "sha512-RqwU7WnJ6CqYhyjpOVJA5vh1Sgkn6eVECO6mnD0EjlbWcC2M3LJaPglXXr13Rdo/Y+B+wTEPzGRYFNL2xKxNeQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5528,1264 +5645,1224 @@
         "node": ">= 0.4"
       }
     },
-    "node_modules/escape-html": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/escape-string-regexp": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
-      "dev": true,
+    "node_modules/esbuild": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "devOptional": true,
+      "hasInstallScript": true,
       "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
       "engines": {
-        "node": ">=10"
+        "node": ">=18"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
+      }
+    },
+    "node_modules/esbuild/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/eslint": {
-      "version": "9.39.2",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.2.tgz",
-      "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/android-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "cpu": [
+        "arm"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@eslint-community/eslint-utils": "^4.8.0",
-        "@eslint-community/regexpp": "^4.12.1",
-        "@eslint/config-array": "^0.21.1",
-        "@eslint/config-helpers": "^0.4.2",
-        "@eslint/core": "^0.17.0",
-        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "9.39.2",
-        "@eslint/plugin-kit": "^0.4.1",
-        "@humanfs/node": "^0.16.6",
-        "@humanwhocodes/module-importer": "^1.0.1",
-        "@humanwhocodes/retry": "^0.4.2",
-        "@types/estree": "^1.0.6",
-        "ajv": "^6.12.4",
-        "chalk": "^4.0.0",
-        "cross-spawn": "^7.0.6",
-        "debug": "^4.3.2",
-        "escape-string-regexp": "^4.0.0",
-        "eslint-scope": "^8.4.0",
-        "eslint-visitor-keys": "^4.2.1",
-        "espree": "^10.4.0",
-        "esquery": "^1.5.0",
-        "esutils": "^2.0.2",
-        "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^8.0.0",
-        "find-up": "^5.0.0",
-        "glob-parent": "^6.0.2",
-        "ignore": "^5.2.0",
-        "imurmurhash": "^0.1.4",
-        "is-glob": "^4.0.0",
-        "json-stable-stringify-without-jsonify": "^1.0.1",
-        "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.2",
-        "natural-compare": "^1.4.0",
-        "optionator": "^0.9.3"
-      },
-      "bin": {
-        "eslint": "bin/eslint.js"
-      },
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://eslint.org/donate"
-      },
-      "peerDependencies": {
-        "jiti": "*"
-      },
-      "peerDependenciesMeta": {
-        "jiti": {
-          "optional": true
-        }
+        "node": ">=18"
       }
     },
-    "node_modules/eslint-config-prettier": {
-      "version": "10.1.8",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.8.tgz",
-      "integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/android-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "bin": {
-        "eslint-config-prettier": "bin/cli.js"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint-config-prettier"
-      },
-      "peerDependencies": {
-        "eslint": ">=7.0.0"
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/eslint-plugin-better-tailwindcss": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-better-tailwindcss/-/eslint-plugin-better-tailwindcss-4.3.0.tgz",
-      "integrity": "sha512-AYNFAeqExOS/yt1qn7kg1il0VZvAxGwBuW/6xAQtmKDRZXkdkWzwWCYF6Ou2/0tza42K8xh4q420DBq+QvXzjA==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/android-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@eslint/css-tree": "^3.6.8",
-        "@valibot/to-json-schema": "^1.5.0",
-        "enhanced-resolve": "^5.19.0",
-        "jiti": "^2.6.1",
-        "synckit": "^0.11.12",
-        "tailwind-csstree": "^0.1.4",
-        "tsconfig-paths-webpack-plugin": "^4.2.0",
-        "valibot": "^1.2.0"
-      },
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^20.19.0 || ^22.12.0 || >=23.0.0"
-      },
-      "peerDependencies": {
-        "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0",
-        "oxlint": "^1.35.0",
-        "tailwindcss": "^3.3.0 || ^4.1.17"
-      },
-      "peerDependenciesMeta": {
-        "eslint": {
-          "optional": true
-        },
-        "oxlint": {
-          "optional": true
-        }
+        "node": ">=18"
       }
     },
-    "node_modules/eslint-plugin-security": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-security/-/eslint-plugin-security-4.0.0.tgz",
-      "integrity": "sha512-tfuQT8K/Li1ZxhFzyD8wPIKtlzZxqBcPr9q0jFMQ77wWAbKBVEhaMPVQRTMTvCMUDhwBe5vPVqQPwAGk/ASfxQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "safe-regex": "^2.1.1"
-      },
+    "node_modules/esbuild/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+        "node": ">=18"
       }
     },
-    "node_modules/eslint-plugin-svelte": {
-      "version": "3.15.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.15.0.tgz",
-      "integrity": "sha512-QKB7zqfuB8aChOfBTComgDptMf2yxiJx7FE04nneCmtQzgTHvY8UJkuh8J2Rz7KB9FFV9aTHX6r7rdYGvG8T9Q==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@eslint-community/eslint-utils": "^4.6.1",
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "esutils": "^2.0.3",
-        "globals": "^16.0.0",
-        "known-css-properties": "^0.37.0",
-        "postcss": "^8.4.49",
-        "postcss-load-config": "^3.1.4",
-        "postcss-safe-parser": "^7.0.0",
-        "semver": "^7.6.3",
-        "svelte-eslint-parser": "^1.4.0"
-      },
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ota-meshi"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.1 || ^9.0.0 || ^10.0.0",
-        "svelte": "^3.37.0 || ^4.0.0 || ^5.0.0"
-      },
-      "peerDependenciesMeta": {
-        "svelte": {
-          "optional": true
-        }
+        "node": ">=18"
       }
     },
-    "node_modules/eslint-scope": {
-      "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
-      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "esrecurse": "^4.3.0",
-        "estraverse": "^5.2.0"
-      },
+    "node_modules/esbuild/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+        "node": ">=18"
       }
     },
-    "node_modules/eslint-visitor-keys": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
-      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/esbuild/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+        "node": ">=18"
       }
     },
-    "node_modules/eslint/node_modules/@eslint/core": {
-      "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
+    "node_modules/esbuild/node_modules/@esbuild/linux-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18"
       }
     },
-    "node_modules/esm-env": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
-      "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
-      "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/espree": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
-      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "acorn": "^8.15.0",
-        "acorn-jsx": "^5.3.2",
-        "eslint-visitor-keys": "^4.2.1"
-      },
+    "node_modules/esbuild/node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+        "node": ">=18"
       }
     },
-    "node_modules/esprima": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "bin": {
-        "esparse": "bin/esparse.js",
-        "esvalidate": "bin/esvalidate.js"
-      },
+    "node_modules/esbuild/node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=4"
+        "node": ">=18"
       }
     },
-    "node_modules/esquery": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
-      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "estraverse": "^5.1.0"
-      },
+    "node_modules/esbuild/node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=0.10"
+        "node": ">=18"
       }
     },
-    "node_modules/esrap": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.3.tgz",
-      "integrity": "sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ==",
-      "devOptional": true,
+    "node_modules/esbuild/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "cpu": [
+        "mips64el"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.4.15"
-      }
-    },
-    "node_modules/esrecurse": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "estraverse": "^5.2.0"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=4.0"
+        "node": ">=18"
       }
     },
-    "node_modules/estraverse": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
-      "dev": true,
-      "license": "BSD-2-Clause",
+    "node_modules/esbuild/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=4.0"
+        "node": ">=18"
       }
     },
-    "node_modules/estree-walker": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
-      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/esutils": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
-      "dev": true,
-      "license": "BSD-2-Clause",
+    "node_modules/esbuild/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">=18"
       }
     },
-    "node_modules/etag": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "cpu": [
+        "s390x"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
       }
     },
-    "node_modules/events": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+    "node_modules/esbuild/node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
       "engines": {
-        "node": ">=0.8.x"
+        "node": ">=18"
       }
     },
-    "node_modules/expand-template": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
-      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
-      "dev": true,
-      "license": "(MIT OR WTFPL)",
+    "node_modules/esbuild/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
       "optional": true,
+      "os": [
+        "netbsd"
+      ],
       "engines": {
-        "node": ">=6"
+        "node": ">=18"
       }
     },
-    "node_modules/expect-type": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
-      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
-      "devOptional": true,
-      "license": "Apache-2.0",
+    "node_modules/esbuild/node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
       "engines": {
-        "node": ">=12.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/exponential-backoff": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
-      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "optional": true
+    "node_modules/esbuild/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/express": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
-      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "accepts": "^2.0.0",
-        "body-parser": "^2.2.1",
-        "content-disposition": "^1.0.0",
-        "content-type": "^1.0.5",
-        "cookie": "^0.7.1",
-        "cookie-signature": "^1.2.1",
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "finalhandler": "^2.1.0",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.0",
-        "merge-descriptors": "^2.0.0",
-        "mime-types": "^3.0.0",
-        "on-finished": "^2.4.1",
-        "once": "^1.4.0",
-        "parseurl": "^1.3.3",
-        "proxy-addr": "^2.0.7",
-        "qs": "^6.14.0",
-        "range-parser": "^1.2.1",
-        "router": "^2.2.0",
-        "send": "^1.1.0",
-        "serve-static": "^2.2.0",
-        "statuses": "^2.0.1",
-        "type-is": "^2.0.1",
-        "vary": "^1.1.2"
-      },
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
       "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "node": ">=18"
       }
     },
-    "node_modules/express/node_modules/cookie": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
       }
     },
-    "node_modules/exsolve": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
-      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
-      "license": "MIT"
+    "node_modules/esbuild/node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/extend": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
-      "dev": true,
+    "node_modules/esbuild/node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "cpu": [
+        "ia32"
+      ],
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/fast-check": {
-      "version": "3.23.2",
-      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
-      "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/dubzzz"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fast-check"
-        }
+    "node_modules/esbuild/node_modules/@esbuild/win32-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "cpu": [
+        "x64"
       ],
       "license": "MIT",
-      "dependencies": {
-        "pure-rand": "^6.1.0"
-      },
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/fast-copy": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.2.tgz",
-      "integrity": "sha512-ybA6PDXIXOXivLJK/z9e+Otk7ve13I4ckBvGO5I2RRmBU1gMHLVDJYEuJYhGwez7YNlYji2M2DvVU+a9mSFDlw==",
+    "node_modules/escape-html": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/fast-deep-equal": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+    "node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
     },
-    "node_modules/fast-json-stable-stringify": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fast-levenshtein": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fast-printf": {
-      "version": "1.6.10",
-      "resolved": "https://registry.npmjs.org/fast-printf/-/fast-printf-1.6.10.tgz",
-      "integrity": "sha512-GwTgG9O4FVIdShhbVF3JxOgSBY2+ePGsu2V/UONgoCPzF9VY6ZdBMKsHKCYQHZwNk3qNouUolRDsgVxcVA5G1w==",
+    "node_modules/eslint": {
+      "version": "9.39.2",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.2.tgz",
+      "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
       "dev": true,
-      "license": "BSD-3-Clause",
+      "license": "MIT",
+      "dependencies": {
+        "@eslint-community/eslint-utils": "^4.8.0",
+        "@eslint-community/regexpp": "^4.12.1",
+        "@eslint/config-array": "^0.21.1",
+        "@eslint/config-helpers": "^0.4.2",
+        "@eslint/core": "^0.17.0",
+        "@eslint/eslintrc": "^3.3.1",
+        "@eslint/js": "9.39.2",
+        "@eslint/plugin-kit": "^0.4.1",
+        "@humanfs/node": "^0.16.6",
+        "@humanwhocodes/module-importer": "^1.0.1",
+        "@humanwhocodes/retry": "^0.4.2",
+        "@types/estree": "^1.0.6",
+        "ajv": "^6.12.4",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.6",
+        "debug": "^4.3.2",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^8.4.0",
+        "eslint-visitor-keys": "^4.2.1",
+        "espree": "^10.4.0",
+        "esquery": "^1.5.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^8.0.0",
+        "find-up": "^5.0.0",
+        "glob-parent": "^6.0.2",
+        "ignore": "^5.2.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.2",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
       "engines": {
-        "node": ">=10.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://eslint.org/donate"
+      },
+      "peerDependencies": {
+        "jiti": "*"
+      },
+      "peerDependenciesMeta": {
+        "jiti": {
+          "optional": true
+        }
       }
     },
-    "node_modules/fast-safe-stringify": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz",
-      "integrity": "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/fast-uri": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
-      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+    "node_modules/eslint-config-prettier": {
+      "version": "10.1.8",
+      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.8.tgz",
+      "integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
       "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
-    "node_modules/fast-xml-builder": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
-      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
       "license": "MIT",
-      "dependencies": {
-        "path-expression-matcher": "^1.5.0",
-        "xml-naming": "^0.1.0"
+      "bin": {
+        "eslint-config-prettier": "bin/cli.js"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint-config-prettier"
+      },
+      "peerDependencies": {
+        "eslint": ">=7.0.0"
       }
     },
-    "node_modules/fast-xml-parser": {
-      "version": "5.7.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.3.tgz",
-      "integrity": "sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
+    "node_modules/eslint-plugin-better-tailwindcss": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-better-tailwindcss/-/eslint-plugin-better-tailwindcss-4.3.0.tgz",
+      "integrity": "sha512-AYNFAeqExOS/yt1qn7kg1il0VZvAxGwBuW/6xAQtmKDRZXkdkWzwWCYF6Ou2/0tza42K8xh4q420DBq+QvXzjA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@nodable/entities": "^2.1.0",
-        "fast-xml-builder": "^1.1.7",
-        "path-expression-matcher": "^1.5.0",
-        "strnum": "^2.2.3"
+        "@eslint/css-tree": "^3.6.8",
+        "@valibot/to-json-schema": "^1.5.0",
+        "enhanced-resolve": "^5.19.0",
+        "jiti": "^2.6.1",
+        "synckit": "^0.11.12",
+        "tailwind-csstree": "^0.1.4",
+        "tsconfig-paths-webpack-plugin": "^4.2.0",
+        "valibot": "^1.2.0"
       },
-      "bin": {
-        "fxparser": "src/cli/cli.js"
-      }
-    },
-    "node_modules/fdir": {
-      "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
-      "devOptional": true,
-      "license": "MIT",
       "engines": {
-        "node": ">=12.0.0"
+        "node": "^20.19.0 || ^22.12.0 || >=23.0.0"
       },
       "peerDependencies": {
-        "picomatch": "^3 || ^4"
+        "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0",
+        "oxlint": "^1.35.0",
+        "tailwindcss": "^3.3.0 || ^4.1.17"
       },
       "peerDependenciesMeta": {
-        "picomatch": {
+        "eslint": {
+          "optional": true
+        },
+        "oxlint": {
           "optional": true
         }
       }
     },
-    "node_modules/file-entry-cache": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+    "node_modules/eslint-plugin-security": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-security/-/eslint-plugin-security-4.0.0.tgz",
+      "integrity": "sha512-tfuQT8K/Li1ZxhFzyD8wPIKtlzZxqBcPr9q0jFMQ77wWAbKBVEhaMPVQRTMTvCMUDhwBe5vPVqQPwAGk/ASfxQ==",
       "dev": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
       "dependencies": {
-        "flat-cache": "^4.0.0"
+        "safe-regex": "^2.1.1"
       },
       "engines": {
-        "node": ">=16.0.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/file-uri-to-path": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
-      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/finalhandler": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
-      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
+    "node_modules/eslint-plugin-svelte": {
+      "version": "3.15.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.15.0.tgz",
+      "integrity": "sha512-QKB7zqfuB8aChOfBTComgDptMf2yxiJx7FE04nneCmtQzgTHvY8UJkuh8J2Rz7KB9FFV9aTHX6r7rdYGvG8T9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "debug": "^4.4.0",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "on-finished": "^2.4.1",
-        "parseurl": "^1.3.3",
-        "statuses": "^2.0.1"
+        "@eslint-community/eslint-utils": "^4.6.1",
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "esutils": "^2.0.3",
+        "globals": "^16.0.0",
+        "known-css-properties": "^0.37.0",
+        "postcss": "^8.4.49",
+        "postcss-load-config": "^3.1.4",
+        "postcss-safe-parser": "^7.0.0",
+        "semver": "^7.6.3",
+        "svelte-eslint-parser": "^1.4.0"
       },
       "engines": {
-        "node": ">= 18.0.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "url": "https://github.com/sponsors/ota-meshi"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.1 || ^9.0.0 || ^10.0.0",
+        "svelte": "^3.37.0 || ^4.0.0 || ^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "svelte": {
+          "optional": true
+        }
       }
     },
-    "node_modules/find-up": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+    "node_modules/eslint-scope": {
+      "version": "8.4.0",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
+      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-2-Clause",
       "dependencies": {
-        "locate-path": "^6.0.0",
-        "path-exists": "^4.0.0"
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
       },
       "engines": {
-        "node": ">=10"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/flat-cache": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+    "node_modules/eslint-visitor-keys": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
+      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
       "dev": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint/node_modules/@eslint/core": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
+      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
+      "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "flatted": "^3.2.9",
-        "keyv": "^4.5.4"
+        "@types/json-schema": "^7.0.15"
       },
       "engines": {
-        "node": ">=16"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
-      "dev": true,
-      "license": "ISC"
+    "node_modules/esm-env": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
+      "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
+      "devOptional": true,
+      "license": "MIT"
     },
-    "node_modules/foreground-child": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "license": "ISC",
+    "node_modules/espree": {
+      "version": "10.4.0",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
+      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
       "dependencies": {
-        "cross-spawn": "^7.0.6",
-        "signal-exit": "^4.0.1"
+        "acorn": "^8.15.0",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^4.2.1"
       },
       "engines": {
-        "node": ">=14"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/forwarded": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+    "node_modules/esprima": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
+      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-2-Clause",
+      "bin": {
+        "esparse": "bin/esparse.js",
+        "esvalidate": "bin/esvalidate.js"
+      },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=4"
       }
     },
-    "node_modules/fresh": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
-      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
+    "node_modules/esquery": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
+      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=0.10"
       }
     },
-    "node_modules/fs-constants": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
-      "dev": true,
+    "node_modules/esrap": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.3.tgz",
+      "integrity": "sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.4.15"
+      }
     },
-    "node_modules/fs-minipass": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
-      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
+      "license": "BSD-2-Clause",
       "dependencies": {
-        "minipass": "^7.0.3"
+        "estraverse": "^5.2.0"
       },
       "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+        "node": ">=4.0"
       }
     },
-    "node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
+    "node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "license": "BSD-2-Clause",
       "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+        "node": ">=4.0"
       }
     },
-    "node_modules/function-bind": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+    "node_modules/estree-walker": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
+      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
       "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
-    },
-    "node_modules/fzstd": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/fzstd/-/fzstd-0.1.1.tgz",
-      "integrity": "sha512-dkuVSOKKwh3eas5VkJy1AW1vFpet8TA/fGmVA5krThl8YcOVE/8ZIoEA1+U1vEn5ckxxhLirSdY837azmbaNHA==",
       "license": "MIT"
     },
-    "node_modules/generate-function": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
-      "integrity": "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "is-property": "^1.0.2"
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "engines": {
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/get-intrinsic": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+    "node_modules/etag": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "es-define-property": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "es-object-atoms": "^1.1.1",
-        "function-bind": "^1.1.2",
-        "get-proto": "^1.0.1",
-        "gopd": "^1.2.0",
-        "has-symbols": "^1.1.0",
-        "hasown": "^2.0.2",
-        "math-intrinsics": "^1.1.0"
-      },
       "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/get-port-please": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/get-port-please/-/get-port-please-3.2.0.tgz",
-      "integrity": "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==",
+    "node_modules/events": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
       "license": "MIT",
-      "peer": true
+      "engines": {
+        "node": ">=0.8.x"
+      }
     },
-    "node_modules/get-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+    "node_modules/expand-template": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
+      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "dunder-proto": "^1.0.1",
-        "es-object-atoms": "^1.0.0"
-      },
+      "license": "(MIT OR WTFPL)",
+      "optional": true,
       "engines": {
-        "node": ">= 0.4"
+        "node": ">=6"
       }
     },
-    "node_modules/giget": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/giget/-/giget-2.0.0.tgz",
-      "integrity": "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "citty": "^0.1.6",
-        "consola": "^3.4.0",
-        "defu": "^6.1.4",
-        "node-fetch-native": "^1.6.6",
-        "nypm": "^0.6.0",
-        "pathe": "^2.0.3"
-      },
-      "bin": {
-        "giget": "dist/cli.mjs"
+    "node_modules/expect-type": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
+      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
       }
     },
-    "node_modules/github-from-package": {
-      "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
-      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
+    "node_modules/exponential-backoff": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
+      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
       "dev": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
       "optional": true
     },
-    "node_modules/glob": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
-      "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "dependencies": {
-        "foreground-child": "^3.1.0",
-        "jackspeak": "^3.1.2",
-        "minimatch": "^9.0.4",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^1.11.1"
-      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/glob-parent": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "is-glob": "^4.0.3"
-      },
-      "engines": {
-        "node": ">=10.13.0"
-      }
-    },
-    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+    "node_modules/express": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
+      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/glob/node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true,
       "dependencies": {
-        "brace-expansion": "^2.0.2"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "accepts": "^2.0.0",
+        "body-parser": "^2.2.1",
+        "content-disposition": "^1.0.0",
+        "content-type": "^1.0.5",
+        "cookie": "^0.7.1",
+        "cookie-signature": "^1.2.1",
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "finalhandler": "^2.1.0",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.0",
+        "merge-descriptors": "^2.0.0",
+        "mime-types": "^3.0.0",
+        "on-finished": "^2.4.1",
+        "once": "^1.4.0",
+        "parseurl": "^1.3.3",
+        "proxy-addr": "^2.0.7",
+        "qs": "^6.14.0",
+        "range-parser": "^1.2.1",
+        "router": "^2.2.0",
+        "send": "^1.1.0",
+        "serve-static": "^2.2.0",
+        "statuses": "^2.0.1",
+        "type-is": "^2.0.1",
+        "vary": "^1.1.2"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/globals": {
-      "version": "16.5.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-16.5.0.tgz",
-      "integrity": "sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==",
-      "dev": true,
-      "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">= 18"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/gopd": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+    "node_modules/express/node_modules/cookie": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/graceful-fs": {
-      "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
-      "license": "ISC"
-    },
-    "node_modules/grammex": {
-      "version": "3.1.12",
-      "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.12.tgz",
-      "integrity": "sha512-6ufJOsSA7LcQehIJNCO7HIBykfM7DXQual0Ny780/DEcJIpBlHRvcqEBWGPYd7hrXL2GJ3oJI1MIhaXjWmLQOQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/graphmatch": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/graphmatch/-/graphmatch-1.1.1.tgz",
-      "integrity": "sha512-5ykVn/EXM1hF0XCaWh05VbYvEiOL2lY1kBxZtaYsyvjp7cmWOU1XsAdfQBwClraEofXDT197lFbXOEVMHpvQOg==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
+    "node_modules/exsolve": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
+      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
+      "license": "MIT"
     },
-    "node_modules/has-symbols": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+    "node_modules/extend": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
+      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
-      }
+      "optional": true
     },
-    "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
-      "dev": true,
+    "node_modules/fast-check": {
+      "version": "3.23.2",
+      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
+      "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
-        "function-bind": "^1.1.2"
+        "pure-rand": "^6.1.0"
       },
       "engines": {
-        "node": ">= 0.4"
+        "node": ">=8.0.0"
       }
     },
-    "node_modules/he": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
-      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
+    "node_modules/fast-copy": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.2.tgz",
+      "integrity": "sha512-ybA6PDXIXOXivLJK/z9e+Otk7ve13I4ckBvGO5I2RRmBU1gMHLVDJYEuJYhGwez7YNlYji2M2DvVU+a9mSFDlw==",
       "dev": true,
-      "license": "MIT",
-      "bin": {
-        "he": "bin/he"
-      }
+      "license": "MIT"
     },
-    "node_modules/help-me": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/help-me/-/help-me-5.0.0.tgz",
-      "integrity": "sha512-7xgomUX6ADmcYzFik0HzAxh/73YlKR9bmFzf51CZwR+b6YtzU2m0u49hQCqV6SvlqIqsaxovfwdvbnsw3b/zpg==",
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/hono": {
-      "version": "4.11.4",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.4.tgz",
-      "integrity": "sha512-U7tt8JsyrxSRKspfhtLET79pU8K+tInj5QZXs1jSugO1Vq5dFj3kmZsRldo29mTBfcjDRVRXrEZ6LS63Cog9ZA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=16.9.0"
-      }
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/hosted-git-info": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.2.tgz",
-      "integrity": "sha512-M422h7o/BR3rmCQ8UHi7cyyMqKltdP9Uo+J2fXK+RSAY+wTcKOIRyhTuKv4qn+DJf3g+PL890AzId5KZpX+CBg==",
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
       "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "lru-cache": "^11.1.0"
-      },
-      "engines": {
-        "node": "^20.17.0 || >=22.9.0"
-      }
+      "license": "MIT"
     },
-    "node_modules/hosted-git-info/node_modules/lru-cache": {
-      "version": "11.3.5",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.3.5.tgz",
-      "integrity": "sha512-NxVFwLAnrd9i7KUBxC4DrUhmgjzOs+1Qm50D3oF1/oL+r1NpZ4gA7xvG0/zJ8evR7zIKn4vLf7qTNduWFtCrRw==",
+    "node_modules/fast-printf": {
+      "version": "1.6.10",
+      "resolved": "https://registry.npmjs.org/fast-printf/-/fast-printf-1.6.10.tgz",
+      "integrity": "sha512-GwTgG9O4FVIdShhbVF3JxOgSBY2+ePGsu2V/UONgoCPzF9VY6ZdBMKsHKCYQHZwNk3qNouUolRDsgVxcVA5G1w==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
+      "license": "BSD-3-Clause",
       "engines": {
-        "node": "20 || >=22"
+        "node": ">=10.0"
       }
     },
-    "node_modules/html-escaper": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
+    "node_modules/fast-safe-stringify": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz",
+      "integrity": "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/http-cache-semantics": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+    "node_modules/fast-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
+      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
       "dev": true,
-      "license": "BSD-2-Clause",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause",
       "optional": true
     },
-    "node_modules/http-errors": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
-      "dev": true,
+    "node_modules/fast-xml-builder": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
+      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
-        "depd": "~2.0.0",
-        "inherits": "~2.0.4",
-        "setprototypeof": "~1.2.0",
-        "statuses": "~2.0.2",
-        "toidentifier": "~1.0.1"
-      },
-      "engines": {
-        "node": ">= 0.8"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "path-expression-matcher": "^1.5.0",
+        "xml-naming": "^0.1.0"
       }
     },
-    "node_modules/http-proxy-agent": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
-      "dev": true,
+    "node_modules/fast-xml-parser": {
+      "version": "5.7.3",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.3.tgz",
+      "integrity": "sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "agent-base": "^7.1.0",
-        "debug": "^4.3.4"
+        "@nodable/entities": "^2.1.0",
+        "fast-xml-builder": "^1.1.7",
+        "path-expression-matcher": "^1.5.0",
+        "strnum": "^2.2.3"
       },
-      "engines": {
-        "node": ">= 14"
+      "bin": {
+        "fxparser": "src/cli/cli.js"
       }
     },
-    "node_modules/http-status-codes": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/http-status-codes/-/http-status-codes-2.3.0.tgz",
-      "integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==",
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "devOptional": true,
       "license": "MIT",
-      "peer": true
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
     },
-    "node_modules/https-proxy-agent": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+    "node_modules/file-entry-cache": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
+      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "4"
+        "flat-cache": "^4.0.0"
       },
       "engines": {
-        "node": ">= 14"
+        "node": ">=16.0.0"
       }
     },
-    "node_modules/human-id": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/human-id/-/human-id-4.1.3.tgz",
-      "integrity": "sha512-tsYlhAYpjCKa//8rXZ9DqKEawhPoSytweBC2eNvcaDK+57RZLHGqNs3PZTQO6yekLFSuvA6AlnAfrw1uBvtb+Q==",
+    "node_modules/file-uri-to-path": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
+      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
       "dev": true,
       "license": "MIT",
-      "bin": {
-        "human-id": "dist/cli.js"
-      }
-    },
-    "node_modules/hyparquet": {
-      "version": "1.26.0",
-      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.26.0.tgz",
-      "integrity": "sha512-yxUiViPZ+z5h+xdX4rA1G+k30jXoEsG9I2xEpjaM84imGznbKjZzxuZFsdzqg6C4LxNnnAlDFvzpk4uxQWTbTQ==",
-      "license": "MIT"
+      "optional": true
     },
-    "node_modules/hyparquet-compressors": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/hyparquet-compressors/-/hyparquet-compressors-1.1.1.tgz",
-      "integrity": "sha512-yx7aA3Rhj0YycbdV71+XznQSLAefa4cT0urpgNXy4aM6eSeCknaVDNne8y45Uz74Fb15yyXUzOStlceOJBan7A==",
+    "node_modules/finalhandler": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
+      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "fzstd": "0.1.1",
-        "hysnappy": "1.0.0"
+        "debug": "^4.4.0",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "on-finished": "^2.4.1",
+        "parseurl": "^1.3.3",
+        "statuses": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/hysnappy": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/hysnappy/-/hysnappy-1.0.0.tgz",
-      "integrity": "sha512-MNrC4NfwDGPb889O6gIfEtbvEZCSWUsSEhsz4Oq2FRcpGtXHfeVz3KciSPp5Pnnz1NjFMgDQNfxdJozymJEDDA==",
-      "license": "MIT"
-    },
-    "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+    "node_modules/find-up": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
+        "locate-path": "^6.0.0",
+        "path-exists": "^4.0.0"
       },
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">=10"
       },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/ieee754": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/ignore": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+    "node_modules/flat-cache": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
+      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "flatted": "^3.2.9",
+        "keyv": "^4.5.4"
+      },
       "engines": {
-        "node": ">= 4"
+        "node": ">=16"
       }
     },
-    "node_modules/import-fresh": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
-      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
+    "node_modules/flatted": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
+      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
       "dev": true,
-      "license": "MIT",
+      "license": "ISC"
+    },
+    "node_modules/foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "license": "ISC",
       "dependencies": {
-        "parent-module": "^1.0.0",
-        "resolve-from": "^4.0.0"
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
       },
       "engines": {
-        "node": ">=6"
+        "node": ">=14"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/import-meta-resolve": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/import-meta-resolve/-/import-meta-resolve-4.2.0.tgz",
-      "integrity": "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==",
+    "node_modules/forwarded": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "dev": true,
       "license": "MIT",
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wooorm"
+      "engines": {
+        "node": ">= 0.6"
       }
     },
-    "node_modules/imurmurhash": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+    "node_modules/fresh": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
+      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=0.8.19"
+        "node": ">= 0.8"
       }
     },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
+    "node_modules/fs-constants": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
+      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
     },
-    "node_modules/ini": {
-      "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+    "node_modules/fs-minipass": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
+      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
       "dev": true,
       "license": "ISC",
-      "optional": true
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+      }
     },
-    "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">= 12"
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
-    "node_modules/ipaddr.js": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+    "node_modules/function-bind": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">= 0.10"
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/is-core-module": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
-      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
+    "node_modules/fzstd": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/fzstd/-/fzstd-0.1.1.tgz",
+      "integrity": "sha512-dkuVSOKKwh3eas5VkJy1AW1vFpet8TA/fGmVA5krThl8YcOVE/8ZIoEA1+U1vEn5ckxxhLirSdY837azmbaNHA==",
+      "license": "MIT"
+    },
+    "node_modules/generate-function": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
+      "integrity": "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "is-property": "^1.0.2"
+      }
+    },
+    "node_modules/get-intrinsic": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hasown": "^2.0.2"
+        "call-bind-apply-helpers": "^1.0.2",
+        "es-define-property": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "es-object-atoms": "^1.1.1",
+        "function-bind": "^1.1.2",
+        "get-proto": "^1.0.1",
+        "gopd": "^1.2.0",
+        "has-symbols": "^1.1.0",
+        "hasown": "^2.0.2",
+        "math-intrinsics": "^1.1.0"
       },
       "engines": {
         "node": ">= 0.4"
@@ -6794,1267 +6871,2620 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/is-extglob": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
-      "dev": true,
+    "node_modules/get-port-please": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/get-port-please/-/get-port-please-3.2.0.tgz",
+      "integrity": "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==",
       "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
+      "peer": true
     },
-    "node_modules/is-fullwidth-code-point": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+    "node_modules/get-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
+      "dependencies": {
+        "dunder-proto": "^1.0.1",
+        "es-object-atoms": "^1.0.0"
+      },
       "engines": {
-        "node": ">=8"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/is-glob": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
-      "dev": true,
+    "node_modules/get-tsconfig": {
+      "version": "4.14.0",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.0.tgz",
+      "integrity": "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "is-extglob": "^2.1.1"
+        "resolve-pkg-maps": "^1.0.0"
       },
-      "engines": {
-        "node": ">=0.10.0"
+      "funding": {
+        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
-    "node_modules/is-module": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
-      "integrity": "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/is-plain-obj": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
-      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
-      "dev": true,
+    "node_modules/giget": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/giget/-/giget-2.0.0.tgz",
+      "integrity": "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==",
       "license": "MIT",
-      "engines": {
-        "node": ">=12"
+      "peer": true,
+      "dependencies": {
+        "citty": "^0.1.6",
+        "consola": "^3.4.0",
+        "defu": "^6.1.4",
+        "node-fetch-native": "^1.6.6",
+        "nypm": "^0.6.0",
+        "pathe": "^2.0.3"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "bin": {
+        "giget": "dist/cli.mjs"
       }
     },
-    "node_modules/is-promise": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
-      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
+    "node_modules/github-from-package": {
+      "version": "0.0.0",
+      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
+      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/is-property": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
-      "integrity": "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==",
       "license": "MIT",
-      "peer": true
+      "optional": true
     },
-    "node_modules/is-reference": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-1.2.1.tgz",
-      "integrity": "sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ==",
+    "node_modules/glob": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
+      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
-      "license": "MIT",
+      "license": "ISC",
+      "optional": true,
       "dependencies": {
-        "@types/estree": "*"
-      }
-    },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
-    },
-    "node_modules/istanbul-lib-coverage": {
-      "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
-      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=8"
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^3.1.2",
+        "minimatch": "^9.0.4",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^1.11.1"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/istanbul-lib-report": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
-      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
       "dev": true,
-      "license": "BSD-3-Clause",
+      "license": "ISC",
       "dependencies": {
-        "istanbul-lib-coverage": "^3.0.0",
-        "make-dir": "^4.0.0",
-        "supports-color": "^7.1.0"
+        "is-glob": "^4.0.3"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=10.13.0"
       }
     },
-    "node_modules/istanbul-reports": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
-      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
+      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
       "dev": true,
-      "license": "BSD-3-Clause",
+      "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "html-escaper": "^2.0.0",
-        "istanbul-lib-report": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
+        "balanced-match": "^1.0.0"
       }
     },
-    "node_modules/jackspeak": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+    "node_modules/glob/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
+      "license": "ISC",
       "optional": true,
       "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
-      }
-    },
-    "node_modules/jiti": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
-      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
-      "license": "MIT",
-      "bin": {
-        "jiti": "lib/jiti-cli.mjs"
       }
     },
-    "node_modules/joi": {
-      "version": "17.13.3",
-      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz",
-      "integrity": "sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==",
+    "node_modules/globals": {
+      "version": "16.5.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-16.5.0.tgz",
+      "integrity": "sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==",
       "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true,
-      "dependencies": {
-        "@hapi/hoek": "^9.3.0",
-        "@hapi/topo": "^5.1.0",
-        "@sideway/address": "^4.1.5",
-        "@sideway/formula": "^3.0.1",
-        "@sideway/pinpoint": "^2.0.0"
-      }
-    },
-    "node_modules/jose": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.1.tgz",
-      "integrity": "sha512-jUaKr1yrbfaImV7R2TN/b3IcZzsw38/chqMpo2XJ7i2F8AfM/lA4G1goC3JVEwg0H7UldTmSt3P68nt31W7/mw==",
       "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
       "funding": {
-        "url": "https://github.com/sponsors/panva"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/joycon": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/joycon/-/joycon-3.1.1.tgz",
-      "integrity": "sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==",
+    "node_modules/gopd": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=10"
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/js-sha256": {
-      "version": "0.11.1",
-      "resolved": "https://registry.npmjs.org/js-sha256/-/js-sha256-0.11.1.tgz",
-      "integrity": "sha512-o6WSo/LUvY2uC4j7mO50a2ms7E/EAdbP0swigLV+nzHKTTaYnaLIWJ02VdXrsJX0vGedDESQnLsOekr94ryfjg==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "license": "ISC"
     },
-    "node_modules/js-tokens": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
-      "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/grammex": {
+      "version": "3.1.12",
+      "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.12.tgz",
+      "integrity": "sha512-6ufJOsSA7LcQehIJNCO7HIBykfM7DXQual0Ny780/DEcJIpBlHRvcqEBWGPYd7hrXL2GJ3oJI1MIhaXjWmLQOQ==",
+      "license": "MIT",
+      "peer": true
     },
-    "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+    "node_modules/graphmatch": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/graphmatch/-/graphmatch-1.1.1.tgz",
+      "integrity": "sha512-5ykVn/EXM1hF0XCaWh05VbYvEiOL2lY1kBxZtaYsyvjp7cmWOU1XsAdfQBwClraEofXDT197lFbXOEVMHpvQOg==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "argparse": "^2.0.1"
-      },
-      "bin": {
-        "js-yaml": "bin/js-yaml.js"
+      "engines": {
+        "node": ">=8"
       }
     },
-    "node_modules/json-buffer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
+    "node_modules/has-symbols": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
     },
-    "node_modules/json-schema-to-ts": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
-      "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
+    "node_modules/hasown": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "@babel/runtime": "^7.18.3",
-        "ts-algebra": "^2.0.0"
+        "function-bind": "^1.1.2"
       },
       "engines": {
-        "node": ">=16"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+    "node_modules/he": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
+      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "bin": {
+        "he": "bin/he"
+      }
     },
-    "node_modules/json-stable-stringify-without-jsonify": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+    "node_modules/help-me": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/help-me/-/help-me-5.0.0.tgz",
+      "integrity": "sha512-7xgomUX6ADmcYzFik0HzAxh/73YlKR9bmFzf51CZwR+b6YtzU2m0u49hQCqV6SvlqIqsaxovfwdvbnsw3b/zpg==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/json5": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
-      "dev": true,
+    "node_modules/hono": {
+      "version": "4.11.4",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.4.tgz",
+      "integrity": "sha512-U7tt8JsyrxSRKspfhtLET79pU8K+tInj5QZXs1jSugO1Vq5dFj3kmZsRldo29mTBfcjDRVRXrEZ6LS63Cog9ZA==",
       "license": "MIT",
-      "bin": {
-        "json5": "lib/cli.js"
-      },
+      "peer": true,
       "engines": {
-        "node": ">=6"
+        "node": ">=16.9.0"
       }
     },
-    "node_modules/keyv": {
-      "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+    "node_modules/hosted-git-info": {
+      "version": "9.0.2",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.2.tgz",
+      "integrity": "sha512-M422h7o/BR3rmCQ8UHi7cyyMqKltdP9Uo+J2fXK+RSAY+wTcKOIRyhTuKv4qn+DJf3g+PL890AzId5KZpX+CBg==",
       "dev": true,
-      "license": "MIT",
+      "license": "ISC",
       "dependencies": {
-        "json-buffer": "3.0.1"
+        "lru-cache": "^11.1.0"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "node_modules/kleur": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
-      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
-      "devOptional": true,
-      "license": "MIT",
+    "node_modules/hosted-git-info/node_modules/lru-cache": {
+      "version": "11.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
+      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
       "engines": {
-        "node": ">=6"
+        "node": "20 || >=22"
       }
     },
-    "node_modules/known-css-properties": {
-      "version": "0.37.0",
-      "resolved": "https://registry.npmjs.org/known-css-properties/-/known-css-properties-0.37.0.tgz",
-      "integrity": "sha512-JCDrsP4Z1Sb9JwG0aJ8Eo2r7k4Ou5MwmThS/6lcIe1ICyb7UBJKGRIUUdqc2ASdE/42lgz6zFUnzAIhtXnBVrQ==",
+    "node_modules/html-escaper": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
+      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/kysely": {
-      "version": "0.27.6",
-      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.27.6.tgz",
-      "integrity": "sha512-FIyV/64EkKhJmjgC0g2hygpBv5RNWVPyNCqSAD7eTCv6eFWNIi4PN1UvdSJGicN/o35bnevgis4Y0UDC0qi8jQ==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
-      }
+    "node_modules/http-cache-semantics": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
+      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "optional": true
     },
-    "node_modules/levn": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+    "node_modules/http-errors": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "prelude-ls": "^1.2.1",
-        "type-check": "~0.4.0"
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
       },
       "engines": {
-        "node": ">= 0.8.0"
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/libphonenumber-js": {
-      "version": "1.12.36",
-      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.12.36.tgz",
-      "integrity": "sha512-woWhKMAVx1fzzUnMCyOzglgSgf6/AFHLASdOBcchYCyvWSGWt12imw3iu2hdI5d4dGZRsNWAmWiz37sDKUPaRQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/libxmljs2": {
-      "version": "0.37.0",
-      "resolved": "https://registry.npmjs.org/libxmljs2/-/libxmljs2-0.37.0.tgz",
-      "integrity": "sha512-Xb78V8GZouoZFrq8cCwx7+G3WYOcJG0xb3YUbweSyE4z2EIrQCZMr3Ye/dHn4mESs6YxUMeQeUZm5IXg+iLHog==",
+    "node_modules/http-proxy-agent": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
-      "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "bindings": "~1.5.0",
-        "nan": "~2.22.2",
-        "node-gyp": "^11.2.0",
-        "prebuild-install": "^7.1.3"
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
       },
       "engines": {
-        "node": ">=22"
+        "node": ">= 14"
       }
     },
-    "node_modules/lightningcss": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
-      "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
-      "devOptional": true,
-      "license": "MPL-2.0",
+    "node_modules/http-status-codes": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/http-status-codes/-/http-status-codes-2.3.0.tgz",
+      "integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/https-proxy-agent": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "detect-libc": "^2.0.3"
+        "agent-base": "^7.1.2",
+        "debug": "4"
       },
       "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      },
-      "optionalDependencies": {
-        "lightningcss-android-arm64": "1.31.1",
-        "lightningcss-darwin-arm64": "1.31.1",
-        "lightningcss-darwin-x64": "1.31.1",
-        "lightningcss-freebsd-x64": "1.31.1",
-        "lightningcss-linux-arm-gnueabihf": "1.31.1",
-        "lightningcss-linux-arm64-gnu": "1.31.1",
-        "lightningcss-linux-arm64-musl": "1.31.1",
-        "lightningcss-linux-x64-gnu": "1.31.1",
-        "lightningcss-linux-x64-musl": "1.31.1",
-        "lightningcss-win32-arm64-msvc": "1.31.1",
-        "lightningcss-win32-x64-msvc": "1.31.1"
+        "node": ">= 14"
       }
     },
-    "node_modules/lightningcss-android-arm64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.31.1.tgz",
-      "integrity": "sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+    "node_modules/human-id": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/human-id/-/human-id-4.1.3.tgz",
+      "integrity": "sha512-tsYlhAYpjCKa//8rXZ9DqKEawhPoSytweBC2eNvcaDK+57RZLHGqNs3PZTQO6yekLFSuvA6AlnAfrw1uBvtb+Q==",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "human-id": "dist/cli.js"
       }
     },
-    "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.31.1.tgz",
-      "integrity": "sha512-02uTEqf3vIfNMq3h/z2cJfcOXnQ0GRwQrkmPafhueLb2h7mqEidiCzkE4gBMEH65abHRiQvhdcQ+aP0D0g67sg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+    "node_modules/hyparquet": {
+      "version": "1.26.0",
+      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.26.0.tgz",
+      "integrity": "sha512-yxUiViPZ+z5h+xdX4rA1G+k30jXoEsG9I2xEpjaM84imGznbKjZzxuZFsdzqg6C4LxNnnAlDFvzpk4uxQWTbTQ==",
+      "license": "MIT"
+    },
+    "node_modules/hyparquet-compressors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/hyparquet-compressors/-/hyparquet-compressors-1.1.1.tgz",
+      "integrity": "sha512-yx7aA3Rhj0YycbdV71+XznQSLAefa4cT0urpgNXy4aM6eSeCknaVDNne8y45Uz74Fb15yyXUzOStlceOJBan7A==",
+      "license": "MIT",
+      "dependencies": {
+        "fzstd": "0.1.1",
+        "hysnappy": "1.0.0"
       }
     },
-    "node_modules/lightningcss-darwin-x64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.31.1.tgz",
-      "integrity": "sha512-1ObhyoCY+tGxtsz1lSx5NXCj3nirk0Y0kB/g8B8DT+sSx4G9djitg9ejFnjb3gJNWo7qXH4DIy2SUHvpoFwfTA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
+    "node_modules/hysnappy": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/hysnappy/-/hysnappy-1.0.0.tgz",
+      "integrity": "sha512-MNrC4NfwDGPb889O6gIfEtbvEZCSWUsSEhsz4Oq2FRcpGtXHfeVz3KciSPp5Pnnz1NjFMgDQNfxdJozymJEDDA==",
+      "license": "MIT"
+    },
+    "node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
       "engines": {
-        "node": ">= 12.0.0"
+        "node": ">=0.10.0"
       },
       "funding": {
         "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.31.1.tgz",
-      "integrity": "sha512-1RINmQKAItO6ISxYgPwszQE1BrsVU5aB45ho6O42mu96UiZBxEXsuQ7cJW4zs4CEodPUioj/QrXW1r9pLUM74A==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "freebsd"
+    "node_modules/ieee754": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
       ],
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/ignore": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": ">= 4"
       }
     },
-    "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.31.1.tgz",
-      "integrity": "sha512-OOCm2//MZJ87CdDK62rZIu+aw9gBv4azMJuA8/KB74wmfS3lnC4yoPHm0uXZ/dvNNHmnZnB8XLAZzObeG0nS1g==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/import-fresh": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
+      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      },
       "engines": {
-        "node": ">= 12.0.0"
+        "node": ">=6"
       },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.31.1.tgz",
-      "integrity": "sha512-WKyLWztD71rTnou4xAD5kQT+982wvca7E6QoLpoawZ1gP9JM0GJj4Tp5jMUh9B3AitHbRZ2/H3W5xQmdEOUlLg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
+    "node_modules/import-meta-resolve": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/import-meta-resolve/-/import-meta-resolve-4.2.0.tgz",
+      "integrity": "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==",
+      "dev": true,
+      "license": "MIT",
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "type": "github",
+        "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.31.1.tgz",
-      "integrity": "sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": ">=0.8.19"
       }
     },
-    "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.31.1.tgz",
-      "integrity": "sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MPL-2.0",
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/ini": {
+      "version": "1.3.8",
+      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/ip-address": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
+      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "license": "MIT",
       "optional": true,
-      "os": [
-        "linux"
-      ],
       "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": ">= 12"
       }
     },
-    "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.31.1.tgz",
-      "integrity": "sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/ipaddr.js": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": ">= 0.10"
       }
     },
-    "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.31.1.tgz",
-      "integrity": "sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+    "node_modules/is-core-module": {
+      "version": "2.16.1",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
+      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hasown": "^2.0.2"
+      },
       "engines": {
-        "node": ">= 12.0.0"
+        "node": ">= 0.4"
       },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.31.1.tgz",
-      "integrity": "sha512-I9aiFrbd7oYHwlnQDqr1Roz+fTz61oDDJX7n9tYF9FJymH1cIN1DtKw3iYt6b8WZgEjoNwVSncwF4wx/ZedMhw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/lilconfig": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
-      "integrity": "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==",
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
-        "node": ">=10"
+        "node": ">=8"
       }
     },
-    "node_modules/local-pkg": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/local-pkg/-/local-pkg-1.2.1.tgz",
-      "integrity": "sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q==",
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "mlly": "^1.7.4",
-        "pkg-types": "^2.3.0",
-        "quansync": "^0.2.11"
+        "is-extglob": "^2.1.1"
       },
       "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/antfu"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/locate-character": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
-      "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
-      "devOptional": true,
+    "node_modules/is-module": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
+      "integrity": "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
+      "dev": true,
       "license": "MIT"
     },
-    "node_modules/locate-path": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+    "node_modules/is-plain-obj": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
+      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "p-locate": "^5.0.0"
-      },
       "engines": {
-        "node": ">=10"
+        "node": ">=12"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/lodash.merge": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+    "node_modules/is-promise": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
+      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0",
+    "node_modules/is-property": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
+      "integrity": "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==",
+      "license": "MIT",
       "peer": true
     },
-    "node_modules/lru-cache": {
-      "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+    "node_modules/is-reference": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-1.2.1.tgz",
+      "integrity": "sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ==",
       "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
-    "node_modules/lru.min": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz",
-      "integrity": "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==",
       "license": "MIT",
-      "peer": true,
-      "engines": {
-        "bun": ">=1.0.0",
-        "deno": ">=1.30.0",
-        "node": ">=8.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wellwelwel"
+      "dependencies": {
+        "@types/estree": "*"
       }
     },
-    "node_modules/luxon": {
-      "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.5.0.tgz",
-      "integrity": "sha512-rh+Zjr6DNfUYR3bPwJEnuwDdqMbxZW7LOQfUN4B54+Cl+0o5zaU9RJ6bcidfDtC1cWCZXQ+nvX8bf6bAji37QQ==",
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "license": "ISC"
+    },
+    "node_modules/istanbul-lib-coverage": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
+      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-3-Clause",
       "engines": {
-        "node": ">=12"
+        "node": ">=8"
       }
     },
-    "node_modules/magic-string": {
-      "version": "0.30.21",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
-      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
-      "devOptional": true,
-      "license": "MIT",
+    "node_modules/istanbul-lib-report": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
+      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
+      "dev": true,
+      "license": "BSD-3-Clause",
       "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.5"
+        "istanbul-lib-coverage": "^3.0.0",
+        "make-dir": "^4.0.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
       }
     },
-    "node_modules/magicast": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.3.tgz",
-      "integrity": "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw==",
+    "node_modules/istanbul-reports": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
+      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@babel/parser": "^7.29.3",
-        "@babel/types": "^7.29.0",
-        "source-map-js": "^1.2.1"
-      }
-    },
-    "node_modules/make-dir": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
-      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
-      "dev": true,
-      "license": "MIT",
+      "license": "BSD-3-Clause",
       "dependencies": {
-        "semver": "^7.5.3"
+        "html-escaper": "^2.0.0",
+        "istanbul-lib-report": "^3.0.0"
       },
       "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=8"
       }
     },
-    "node_modules/make-fetch-happen": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
-      "integrity": "sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==",
+    "node_modules/jackspeak": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "optional": true,
       "dependencies": {
-        "@npmcli/agent": "^3.0.0",
-        "cacache": "^19.0.1",
-        "http-cache-semantics": "^4.1.1",
-        "minipass": "^7.0.2",
-        "minipass-fetch": "^4.0.0",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "negotiator": "^1.0.0",
-        "proc-log": "^5.0.0",
-        "promise-retry": "^2.0.1",
-        "ssri": "^12.0.0"
+        "@isaacs/cliui": "^8.0.2"
       },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
       }
     },
-    "node_modules/marked": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
-      "integrity": "sha512-uIj4+faQ+MgHgwUW1l2PsPglZLOLOT1uErt06dAPtx2kjteLAkbsd/0FiYg/MGS+i7ZKLb7w2WClxHkzOOuryQ==",
+    "node_modules/jiti": {
+      "version": "2.6.1",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
+      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
       "license": "MIT",
       "bin": {
-        "marked": "bin/marked.js"
-      },
-      "engines": {
-        "node": ">= 18"
+        "jiti": "lib/jiti-cli.mjs"
       }
     },
-    "node_modules/math-intrinsics": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+    "node_modules/joi": {
+      "version": "17.13.3",
+      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz",
+      "integrity": "sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
+      "license": "BSD-3-Clause",
+      "optional": true,
+      "dependencies": {
+        "@hapi/hoek": "^9.3.0",
+        "@hapi/topo": "^5.1.0",
+        "@sideway/address": "^4.1.5",
+        "@sideway/formula": "^3.0.1",
+        "@sideway/pinpoint": "^2.0.0"
       }
     },
-    "node_modules/mdn-data": {
-      "version": "2.23.0",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.23.0.tgz",
-      "integrity": "sha512-786vq1+4079JSeu2XdcDjrhi/Ry7BWtjDl9WtGPWLiIHb2T66GvIVflZTBoSNZ5JqTtJGYEVMuFA/lbQlMOyDQ==",
-      "dev": true,
-      "license": "CC0-1.0"
+    "node_modules/jose": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.1.tgz",
+      "integrity": "sha512-jUaKr1yrbfaImV7R2TN/b3IcZzsw38/chqMpo2XJ7i2F8AfM/lA4G1goC3JVEwg0H7UldTmSt3P68nt31W7/mw==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/panva"
+      }
     },
-    "node_modules/media-typer": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
-      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
+    "node_modules/joycon": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/joycon/-/joycon-3.1.1.tgz",
+      "integrity": "sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=10"
       }
     },
-    "node_modules/memoize-weak": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/memoize-weak/-/memoize-weak-1.0.2.tgz",
-      "integrity": "sha512-gj39xkrjEw7nCn4nJ1M5ms6+MyMlyiGmttzsqAUsAKn6bYKwuTHh/AO3cKPF8IBrTIYTxb0wWXFs3E//Y8VoWQ==",
+    "node_modules/js-sha256": {
+      "version": "0.11.1",
+      "resolved": "https://registry.npmjs.org/js-sha256/-/js-sha256-0.11.1.tgz",
+      "integrity": "sha512-o6WSo/LUvY2uC4j7mO50a2ms7E/EAdbP0swigLV+nzHKTTaYnaLIWJ02VdXrsJX0vGedDESQnLsOekr94ryfjg==",
       "dev": true,
-      "license": "ISC"
+      "license": "MIT"
     },
-    "node_modules/memory-pager": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/memory-pager/-/memory-pager-1.5.0.tgz",
-      "integrity": "sha512-ZS4Bp4r/Zoeq6+NLJpP+0Zzm0pR8whtGPf1XExKLJBAczGMnSi3It14OiNCStjQjM6NU1okjQGSxgEZN8eBYKg==",
-      "license": "MIT",
-      "peer": true
+    "node_modules/js-tokens": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
+      "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/merge-descriptors": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
-      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
+    "node_modules/js-yaml": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "argparse": "^2.0.1"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
       }
     },
-    "node_modules/mime-db": {
-      "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+    "node_modules/json-buffer": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
+      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
+      "license": "MIT"
     },
-    "node_modules/mime-types": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+    "node_modules/json-schema-to-ts": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
+      "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "mime-db": "^1.54.0"
+        "@babel/runtime": "^7.18.3",
+        "ts-algebra": "^2.0.0"
       },
       "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "node": ">=16"
       }
     },
-    "node_modules/mimic-response": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
-      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+    "node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=10"
+      "bin": {
+        "json5": "lib/cli.js"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+      "engines": {
+        "node": ">=6"
       }
     },
-    "node_modules/minimatch": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+    "node_modules/keyv": {
+      "version": "4.5.4",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
+      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
       "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
+        "json-buffer": "3.0.1"
       }
     },
-    "node_modules/minimist": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
-      "dev": true,
+    "node_modules/kleur": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
+      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
+      "devOptional": true,
       "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+      "engines": {
+        "node": ">=6"
       }
     },
-    "node_modules/minipass": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+    "node_modules/known-css-properties": {
+      "version": "0.37.0",
+      "resolved": "https://registry.npmjs.org/known-css-properties/-/known-css-properties-0.37.0.tgz",
+      "integrity": "sha512-JCDrsP4Z1Sb9JwG0aJ8Eo2r7k4Ou5MwmThS/6lcIe1ICyb7UBJKGRIUUdqc2ASdE/42lgz6zFUnzAIhtXnBVrQ==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true,
+      "license": "MIT"
+    },
+    "node_modules/kysely": {
+      "version": "0.27.6",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.27.6.tgz",
+      "integrity": "sha512-FIyV/64EkKhJmjgC0g2hygpBv5RNWVPyNCqSAD7eTCv6eFWNIi4PN1UvdSJGicN/o35bnevgis4Y0UDC0qi8jQ==",
+      "devOptional": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/minipass-collect": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
-      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
+      "license": "MIT",
       "dependencies": {
-        "minipass": "^7.0.3"
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
+        "node": ">= 0.8.0"
       }
     },
-    "node_modules/minipass-fetch": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-4.0.1.tgz",
-      "integrity": "sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==",
+    "node_modules/libphonenumber-js": {
+      "version": "1.12.36",
+      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.12.36.tgz",
+      "integrity": "sha512-woWhKMAVx1fzzUnMCyOzglgSgf6/AFHLASdOBcchYCyvWSGWt12imw3iu2hdI5d4dGZRsNWAmWiz37sDKUPaRQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "minipass": "^7.0.3",
-        "minipass-sized": "^1.0.3",
-        "minizlib": "^3.0.1"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      },
-      "optionalDependencies": {
-        "encoding": "^0.1.13"
-      }
+      "optional": true
     },
-    "node_modules/minipass-flush": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
-      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
+    "node_modules/libxmljs2": {
+      "version": "0.37.0",
+      "resolved": "https://registry.npmjs.org/libxmljs2/-/libxmljs2-0.37.0.tgz",
+      "integrity": "sha512-Xb78V8GZouoZFrq8cCwx7+G3WYOcJG0xb3YUbweSyE4z2EIrQCZMr3Ye/dHn4mESs6YxUMeQeUZm5IXg+iLHog==",
       "dev": true,
-      "license": "ISC",
+      "hasInstallScript": true,
+      "license": "MIT",
       "optional": true,
       "dependencies": {
-        "minipass": "^3.0.0"
+        "bindings": "~1.5.0",
+        "nan": "~2.22.2",
+        "node-gyp": "^11.2.0",
+        "prebuild-install": "^7.1.3"
       },
       "engines": {
-        "node": ">= 8"
+        "node": ">=22"
       }
     },
-    "node_modules/minipass-flush/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true,
+    "node_modules/lightningcss": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
+      "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
+      "devOptional": true,
+      "license": "MPL-2.0",
       "dependencies": {
-        "yallist": "^4.0.0"
+        "detect-libc": "^2.0.3"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "lightningcss-android-arm64": "1.31.1",
+        "lightningcss-darwin-arm64": "1.31.1",
+        "lightningcss-darwin-x64": "1.31.1",
+        "lightningcss-freebsd-x64": "1.31.1",
+        "lightningcss-linux-arm-gnueabihf": "1.31.1",
+        "lightningcss-linux-arm64-gnu": "1.31.1",
+        "lightningcss-linux-arm64-musl": "1.31.1",
+        "lightningcss-linux-x64-gnu": "1.31.1",
+        "lightningcss-linux-x64-musl": "1.31.1",
+        "lightningcss-win32-arm64-msvc": "1.31.1",
+        "lightningcss-win32-x64-msvc": "1.31.1"
       }
     },
-    "node_modules/minipass-flush/node_modules/yallist": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
-    "node_modules/minipass-pipeline": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
-      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.31.1.tgz",
+      "integrity": "sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
       "optional": true,
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/minipass-pipeline/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/lightningcss-darwin-arm64": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.31.1.tgz",
+      "integrity": "sha512-02uTEqf3vIfNMq3h/z2cJfcOXnQ0GRwQrkmPafhueLb2h7mqEidiCzkE4gBMEH65abHRiQvhdcQ+aP0D0g67sg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
       "optional": true,
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/minipass-pipeline/node_modules/yallist": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
-    "node_modules/minipass-sized": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
-      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/lightningcss-darwin-x64": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.31.1.tgz",
+      "integrity": "sha512-1ObhyoCY+tGxtsz1lSx5NXCj3nirk0Y0kB/g8B8DT+sSx4G9djitg9ejFnjb3gJNWo7qXH4DIy2SUHvpoFwfTA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
       "optional": true,
-      "dependencies": {
-        "minipass": "^3.0.0"
-      },
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/minipass-sized/node_modules/minipass": {
-      "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/lightningcss-freebsd-x64": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.31.1.tgz",
+      "integrity": "sha512-1RINmQKAItO6ISxYgPwszQE1BrsVU5aB45ho6O42mu96UiZBxEXsuQ7cJW4zs4CEodPUioj/QrXW1r9pLUM74A==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
       "optional": true,
-      "dependencies": {
-        "yallist": "^4.0.0"
-      },
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/minipass-sized/node_modules/yallist": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
-    "node_modules/minizlib": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
-      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/lightningcss-linux-arm-gnueabihf": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.31.1.tgz",
+      "integrity": "sha512-OOCm2//MZJ87CdDK62rZIu+aw9gBv4azMJuA8/KB74wmfS3lnC4yoPHm0uXZ/dvNNHmnZnB8XLAZzObeG0nS1g==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MPL-2.0",
       "optional": true,
-      "dependencies": {
-        "minipass": "^7.1.2"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">= 18"
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
       }
     },
-    "node_modules/mkdirp-classic": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/mlly": {
-      "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.8.2.tgz",
-      "integrity": "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==",
-      "dev": true,
+    "node_modules/lightningcss-linux-arm64-gnu": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.31.1.tgz",
+      "integrity": "sha512-WKyLWztD71rTnou4xAD5kQT+982wvca7E6QoLpoawZ1gP9JM0GJj4Tp5jMUh9B3AitHbRZ2/H3W5xQmdEOUlLg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-arm64-musl": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.31.1.tgz",
+      "integrity": "sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-gnu": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.31.1.tgz",
+      "integrity": "sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-linux-x64-musl": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.31.1.tgz",
+      "integrity": "sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-arm64-msvc": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.31.1.tgz",
+      "integrity": "sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lightningcss-win32-x64-msvc": {
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.31.1.tgz",
+      "integrity": "sha512-I9aiFrbd7oYHwlnQDqr1Roz+fTz61oDDJX7n9tYF9FJymH1cIN1DtKw3iYt6b8WZgEjoNwVSncwF4wx/ZedMhw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/lilconfig": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
+      "integrity": "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/local-pkg": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/local-pkg/-/local-pkg-1.2.1.tgz",
+      "integrity": "sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mlly": "^1.7.4",
+        "pkg-types": "^2.3.0",
+        "quansync": "^0.2.11"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/locate-character": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
+      "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/locate-path": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-locate": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/lodash": {
+      "version": "4.17.21",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/long": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
+      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
+      "license": "Apache-2.0",
+      "peer": true
+    },
+    "node_modules/lru-cache": {
+      "version": "10.4.3",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/lru.min": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz",
+      "integrity": "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==",
+      "license": "MIT",
+      "peer": true,
+      "engines": {
+        "bun": ">=1.0.0",
+        "deno": ">=1.30.0",
+        "node": ">=8.0.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/wellwelwel"
+      }
+    },
+    "node_modules/luxon": {
+      "version": "3.5.0",
+      "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.5.0.tgz",
+      "integrity": "sha512-rh+Zjr6DNfUYR3bPwJEnuwDdqMbxZW7LOQfUN4B54+Cl+0o5zaU9RJ6bcidfDtC1cWCZXQ+nvX8bf6bAji37QQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/magicast": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.3.tgz",
+      "integrity": "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@babel/parser": "^7.29.3",
+        "@babel/types": "^7.29.0",
+        "source-map-js": "^1.2.1"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
+      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "semver": "^7.5.3"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/make-fetch-happen": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
+      "integrity": "sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "@npmcli/agent": "^3.0.0",
+        "cacache": "^19.0.1",
+        "http-cache-semantics": "^4.1.1",
+        "minipass": "^7.0.2",
+        "minipass-fetch": "^4.0.0",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "negotiator": "^1.0.0",
+        "proc-log": "^5.0.0",
+        "promise-retry": "^2.0.1",
+        "ssri": "^12.0.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/marked": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
+      "integrity": "sha512-uIj4+faQ+MgHgwUW1l2PsPglZLOLOT1uErt06dAPtx2kjteLAkbsd/0FiYg/MGS+i7ZKLb7w2WClxHkzOOuryQ==",
+      "license": "MIT",
+      "bin": {
+        "marked": "bin/marked.js"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/math-intrinsics": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      }
+    },
+    "node_modules/mdn-data": {
+      "version": "2.23.0",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.23.0.tgz",
+      "integrity": "sha512-786vq1+4079JSeu2XdcDjrhi/Ry7BWtjDl9WtGPWLiIHb2T66GvIVflZTBoSNZ5JqTtJGYEVMuFA/lbQlMOyDQ==",
+      "dev": true,
+      "license": "CC0-1.0"
+    },
+    "node_modules/media-typer": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
+      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/memoize-weak": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/memoize-weak/-/memoize-weak-1.0.2.tgz",
+      "integrity": "sha512-gj39xkrjEw7nCn4nJ1M5ms6+MyMlyiGmttzsqAUsAKn6bYKwuTHh/AO3cKPF8IBrTIYTxb0wWXFs3E//Y8VoWQ==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/memory-pager": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/memory-pager/-/memory-pager-1.5.0.tgz",
+      "integrity": "sha512-ZS4Bp4r/Zoeq6+NLJpP+0Zzm0pR8whtGPf1XExKLJBAczGMnSi3It14OiNCStjQjM6NU1okjQGSxgEZN8eBYKg==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/merge-descriptors": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
+      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mime-db": {
+      "version": "1.54.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
+      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
+      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "^1.54.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/mimic-response": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
+      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/minipass-collect": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
+      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.3"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/minipass-fetch": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-4.0.1.tgz",
+      "integrity": "sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.0.3",
+        "minipass-sized": "^1.0.3",
+        "minizlib": "^3.0.1"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      },
+      "optionalDependencies": {
+        "encoding": "^0.1.13"
+      }
+    },
+    "node_modules/minipass-flush": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
+      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/minipass-flush/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-flush/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/minipass-pipeline": {
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
+      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-pipeline/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-pipeline/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/minipass-sized": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
+      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-sized/node_modules/minipass": {
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/minipass-sized/node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/minizlib": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
+      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/mkdirp-classic": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
+      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/mlly": {
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.8.2.tgz",
+      "integrity": "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "acorn": "^8.16.0",
+        "pathe": "^2.0.3",
+        "pkg-types": "^1.3.1",
+        "ufo": "^1.6.3"
+      }
+    },
+    "node_modules/mlly/node_modules/confbox": {
+      "version": "0.1.8",
+      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.1.8.tgz",
+      "integrity": "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mlly/node_modules/pkg-types": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-1.3.1.tgz",
+      "integrity": "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "confbox": "^0.1.8",
+        "mlly": "^1.7.4",
+        "pathe": "^2.0.1"
+      }
+    },
+    "node_modules/monaco-editor": {
+      "version": "0.55.1",
+      "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz",
+      "integrity": "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==",
+      "license": "MIT",
+      "dependencies": {
+        "dompurify": "3.2.7",
+        "marked": "14.0.0"
+      }
+    },
+    "node_modules/mongodb": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-7.1.0.tgz",
+      "integrity": "sha512-kMfnKunbolQYwCIyrkxNJFB4Ypy91pYqua5NargS/f8ODNSJxT03ZU3n1JqL4mCzbSih8tvmMEMLpKTT7x5gCg==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "@mongodb-js/saslprep": "^1.3.0",
+        "bson": "^7.1.1",
+        "mongodb-connection-string-url": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      },
+      "peerDependencies": {
+        "@aws-sdk/credential-providers": "^3.806.0",
+        "@mongodb-js/zstd": "^7.0.0",
+        "gcp-metadata": "^7.0.1",
+        "kerberos": "^7.0.0",
+        "mongodb-client-encryption": ">=7.0.0 <7.1.0",
+        "snappy": "^7.3.2",
+        "socks": "^2.8.6"
+      },
+      "peerDependenciesMeta": {
+        "@aws-sdk/credential-providers": {
+          "optional": true
+        },
+        "@mongodb-js/zstd": {
+          "optional": true
+        },
+        "gcp-metadata": {
+          "optional": true
+        },
+        "kerberos": {
+          "optional": true
+        },
+        "mongodb-client-encryption": {
+          "optional": true
+        },
+        "snappy": {
+          "optional": true
+        },
+        "socks": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/mongodb-connection-string-url": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/mongodb-connection-string-url/-/mongodb-connection-string-url-7.0.1.tgz",
+      "integrity": "sha512-h0AZ9A7IDVwwHyMxmdMXKy+9oNlF0zFoahHiX3vQ8e3KFcSP3VmsmfvtRSuLPxmyv2vjIDxqty8smTgie/SNRQ==",
+      "license": "Apache-2.0",
+      "peer": true,
+      "dependencies": {
+        "@types/whatwg-url": "^13.0.0",
+        "whatwg-url": "^14.1.0"
+      },
+      "engines": {
+        "node": ">=20.19.0"
+      }
+    },
+    "node_modules/moo": {
+      "version": "0.5.3",
+      "resolved": "https://registry.npmjs.org/moo/-/moo-0.5.3.tgz",
+      "integrity": "sha512-m2fmM2dDm7GZQsY7KK2cme8agi+AAljILjQnof7p1ZMDe6dQ4bdnSMx0cPppudoeNv5hEFQirN6u+O4fDE0IWA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
+    "node_modules/mri": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
+      "integrity": "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/mrmime": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
+      "integrity": "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/mysql2": {
+      "version": "3.15.3",
+      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.15.3.tgz",
+      "integrity": "sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "aws-ssl-profiles": "^1.1.1",
+        "denque": "^2.1.0",
+        "generate-function": "^2.3.1",
+        "iconv-lite": "^0.7.0",
+        "long": "^5.2.1",
+        "lru.min": "^1.0.0",
+        "named-placeholders": "^1.1.3",
+        "seq-queue": "^0.0.5",
+        "sqlstring": "^2.3.2"
+      },
+      "engines": {
+        "node": ">= 8.0"
+      }
+    },
+    "node_modules/named-placeholders": {
+      "version": "1.1.6",
+      "resolved": "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.6.tgz",
+      "integrity": "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "lru.min": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/nan": {
+      "version": "2.22.2",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
+      "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "devOptional": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/nanostores": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.1.1.tgz",
+      "integrity": "sha512-EYJqS25r2iBeTtGQCHidXl1VfZ1jXM7Q04zXJOrMlxVVmD0ptxJaNux92n1mJ7c5lN3zTq12MhH/8x59nP+qmg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": "^20.0.0 || >=22.0.0"
+      }
+    },
+    "node_modules/napi-build-utils": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
+      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nearley": {
+      "version": "2.20.1",
+      "resolved": "https://registry.npmjs.org/nearley/-/nearley-2.20.1.tgz",
+      "integrity": "sha512-+Mc8UaAebFzgV+KpI5n7DasuuQCHA89dmwm7JXw3TV43ukfNQ9DnBH3Mdb2g/I4Fdxc26pwimBWvjIw0UAILSQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "commander": "^2.19.0",
+        "moo": "^0.5.0",
+        "railroad-diagrams": "^1.0.0",
+        "randexp": "0.4.6"
+      },
+      "bin": {
+        "nearley-railroad": "bin/nearley-railroad.js",
+        "nearley-test": "bin/nearley-test.js",
+        "nearley-unparse": "bin/nearley-unparse.js",
+        "nearleyc": "bin/nearleyc.js"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://nearley.js.org/#give-to-nearley"
+      }
+    },
+    "node_modules/nearley/node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/negotiator": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
+      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/node-abi": {
+      "version": "3.87.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.87.0.tgz",
+      "integrity": "sha512-+CGM1L1CgmtheLcBuleyYOn7NWPVu0s0EJH2C4puxgEZb9h8QpR9G2dBfZJOAUhi7VQxuBPMd0hiISWcTyiYyQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/node-fetch-native": {
+      "version": "1.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
+      "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/node-gyp": {
+      "version": "11.5.0",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
+      "integrity": "sha512-ra7Kvlhxn5V9Slyus0ygMa2h+UqExPqUIkfk7Pc8QTLT956JLSy51uWFwHtIYy0vI8cB4BDhc/S03+880My/LQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "env-paths": "^2.2.0",
+        "exponential-backoff": "^3.1.1",
+        "graceful-fs": "^4.2.6",
+        "make-fetch-happen": "^14.0.3",
+        "nopt": "^8.0.0",
+        "proc-log": "^5.0.0",
+        "semver": "^7.3.5",
+        "tar": "^7.4.3",
+        "tinyglobby": "^0.2.12",
+        "which": "^5.0.0"
+      },
+      "bin": {
+        "node-gyp": "bin/node-gyp.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/node-gyp/node_modules/isexe": {
+      "version": "3.1.5",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/node-gyp/node_modules/which": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
+      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "isexe": "^3.1.1"
+      },
+      "bin": {
+        "node-which": "bin/which.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/nopt": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/nopt/-/nopt-8.1.0.tgz",
+      "integrity": "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "dependencies": {
+        "abbrev": "^3.0.0"
+      },
+      "bin": {
+        "nopt": "bin/nopt.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "node_modules/normalize-package-data": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-8.0.0.tgz",
+      "integrity": "sha512-RWk+PI433eESQ7ounYxIp67CYuVsS1uYSonX3kA6ps/3LWfjVQa/ptEg6Y3T6uAMq1mWpX9PQ+qx+QaHpsc7gQ==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "hosted-git-info": "^9.0.0",
+        "semver": "^7.3.5",
+        "validate-npm-package-license": "^3.0.4"
+      },
+      "engines": {
+        "node": "^20.17.0 || >=22.9.0"
+      }
+    },
+    "node_modules/normalize-url": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.1.1.tgz",
+      "integrity": "sha512-JYc0DPlpGWB40kH5g07gGTrYuMqV653k3uBKY6uITPWds3M0ov3GaWGp9lbE3Bzngx8+XkfzgvASb9vk9JDFXQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=14.16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/nypm": {
+      "version": "0.6.5",
+      "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.5.tgz",
+      "integrity": "sha512-K6AJy1GMVyfyMXRVB88700BJqNUkByijGJM8kEHpLdcAt+vSQAVfkWWHYzuRXHSY6xA2sNc5RjTj0p9rE2izVQ==",
+      "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "citty": "^0.2.0",
+        "pathe": "^2.0.3",
+        "tinyexec": "^1.0.2"
+      },
+      "bin": {
+        "nypm": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/nypm/node_modules/citty": {
+      "version": "0.2.2",
+      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz",
+      "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/oauth2-mock-server": {
+      "version": "8.2.2",
+      "resolved": "https://registry.npmjs.org/oauth2-mock-server/-/oauth2-mock-server-8.2.2.tgz",
+      "integrity": "sha512-ZjMFtomGM4q1DflxEJpq2WVtSLbOjqlJYkkuGWdq9nL3oAbDExamFyhDN/bUqcooCHWeI0n99K/NU+gXEZLNiA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "basic-auth": "^2.0.1",
+        "cors": "^2.8.6",
+        "express": "^5.2.1",
+        "is-plain-obj": "^4.1.0",
+        "jose": "^6.1.3"
+      },
+      "bin": {
+        "oauth2-mock-server": "dist/oauth2-mock-server.js"
+      },
+      "engines": {
+        "node": "^20.19 || ^22.12 || ^24"
+      }
+    },
+    "node_modules/object-assign": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/object-inspect": {
+      "version": "1.13.4",
+      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/obug": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
+      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
+      "devOptional": true,
+      "funding": [
+        "https://github.com/sponsors/sxzz",
+        "https://opencollective.com/debug"
+      ],
+      "license": "MIT"
+    },
+    "node_modules/ohash": {
+      "version": "2.0.11",
+      "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.11.tgz",
+      "integrity": "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/on-exit-leak-free": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
+      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/on-finished": {
+      "version": "2.4.1",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ee-first": "1.1.1"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/optionator": {
+      "version": "0.9.4",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
+      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.5"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "p-limit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-map": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
+      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true
+    },
+    "node_modules/package-manager-detector": {
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
+      "integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/packageurl-js": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
+      "integrity": "sha512-N5ixXjzTy4QDQH0Q9YFjqIWd6zH6936Djpl2m9QNFmDv5Fum8q8BjkpAcHNMzOFE0IwQrFhJWex3AN6kS0OSwg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pako": {
+      "version": "0.2.9",
+      "resolved": "https://registry.npmjs.org/pako/-/pako-0.2.9.tgz",
+      "integrity": "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "callsites": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/parseurl": {
+      "version": "1.3.3",
+      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-expression-matcher": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
+      "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-parse": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.18"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/path-to-regexp": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
+      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "license": "MIT"
+    },
+    "node_modules/pg": {
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.21.0.tgz",
+      "integrity": "sha512-AUP1EYJuHraQGsVoCQVIcM7TEJVGtDzxWtGFZd8rds9d+CCXlU5Js1rYgfLNvxy9iJrpHjGrRjoi/3BT9fRyiA==",
+      "license": "MIT",
+      "dependencies": {
+        "pg-connection-string": "^2.13.0",
+        "pg-pool": "^3.14.0",
+        "pg-protocol": "^1.14.0",
+        "pg-types": "2.2.0",
+        "pgpass": "1.0.5"
+      },
+      "engines": {
+        "node": ">= 16.0.0"
+      },
+      "optionalDependencies": {
+        "pg-cloudflare": "^1.4.0"
+      },
+      "peerDependencies": {
+        "pg-native": ">=3.0.1"
+      },
+      "peerDependenciesMeta": {
+        "pg-native": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/pg-cloudflare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.4.0.tgz",
+      "integrity": "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==",
       "license": "MIT",
-      "dependencies": {
-        "acorn": "^8.16.0",
-        "pathe": "^2.0.3",
-        "pkg-types": "^1.3.1",
-        "ufo": "^1.6.3"
+      "optional": true
+    },
+    "node_modules/pg-connection-string": {
+      "version": "2.13.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.13.0.tgz",
+      "integrity": "sha512-EMnU9E2fSULdsbErBbMaXJvFeD9B4+nPcM3f+4lsiCR0BHLPrLVjv3DbyM2hgQQviKJaTWIRRTjKjWlHg3p2ig==",
+      "license": "MIT"
+    },
+    "node_modules/pg-int8": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
+      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
+      "license": "ISC",
+      "engines": {
+        "node": ">=4.0.0"
       }
     },
-    "node_modules/mlly/node_modules/confbox": {
-      "version": "0.1.8",
-      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.1.8.tgz",
-      "integrity": "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==",
-      "dev": true,
+    "node_modules/pg-pool": {
+      "version": "3.14.0",
+      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.14.0.tgz",
+      "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "pg": ">=8.0"
+      }
+    },
+    "node_modules/pg-protocol": {
+      "version": "1.14.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.14.0.tgz",
+      "integrity": "sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA==",
       "license": "MIT"
     },
-    "node_modules/mlly/node_modules/pkg-types": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-1.3.1.tgz",
-      "integrity": "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==",
-      "dev": true,
+    "node_modules/pg-types": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
+      "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
       "license": "MIT",
       "dependencies": {
-        "confbox": "^0.1.8",
-        "mlly": "^1.7.4",
-        "pathe": "^2.0.1"
+        "pg-int8": "1.0.1",
+        "postgres-array": "~2.0.0",
+        "postgres-bytea": "~1.0.0",
+        "postgres-date": "~1.0.4",
+        "postgres-interval": "^1.1.0"
+      },
+      "engines": {
+        "node": ">=4"
       }
     },
-    "node_modules/monaco-editor": {
-      "version": "0.55.1",
-      "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz",
-      "integrity": "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==",
+    "node_modules/pgpass": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.5.tgz",
+      "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
       "license": "MIT",
       "dependencies": {
-        "dompurify": "3.2.7",
-        "marked": "14.0.0"
+        "split2": "^4.1.0"
       }
     },
-    "node_modules/mongodb": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-7.1.0.tgz",
-      "integrity": "sha512-kMfnKunbolQYwCIyrkxNJFB4Ypy91pYqua5NargS/f8ODNSJxT03ZU3n1JqL4mCzbSih8tvmMEMLpKTT7x5gCg==",
-      "license": "Apache-2.0",
-      "peer": true,
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "devOptional": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "devOptional": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/pino": {
+      "version": "10.3.1",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-10.3.1.tgz",
+      "integrity": "sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==",
+      "license": "MIT",
       "dependencies": {
-        "@mongodb-js/saslprep": "^1.3.0",
-        "bson": "^7.1.1",
-        "mongodb-connection-string-url": "^7.0.0"
+        "@pinojs/redact": "^0.4.0",
+        "atomic-sleep": "^1.0.0",
+        "on-exit-leak-free": "^2.1.0",
+        "pino-abstract-transport": "^3.0.0",
+        "pino-std-serializers": "^7.0.0",
+        "process-warning": "^5.0.0",
+        "quick-format-unescaped": "^4.0.3",
+        "real-require": "^0.2.0",
+        "safe-stable-stringify": "^2.3.1",
+        "sonic-boom": "^4.0.1",
+        "thread-stream": "^4.0.0"
+      },
+      "bin": {
+        "pino": "bin.js"
+      }
+    },
+    "node_modules/pino-abstract-transport": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-3.0.0.tgz",
+      "integrity": "sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.0.0"
+      }
+    },
+    "node_modules/pino-pretty": {
+      "version": "13.1.3",
+      "resolved": "https://registry.npmjs.org/pino-pretty/-/pino-pretty-13.1.3.tgz",
+      "integrity": "sha512-ttXRkkOz6WWC95KeY9+xxWL6AtImwbyMHrL1mSwqwW9u+vLp/WIElvHvCSDg0xO/Dzrggz1zv3rN5ovTRVowKg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "colorette": "^2.0.7",
+        "dateformat": "^4.6.3",
+        "fast-copy": "^4.0.0",
+        "fast-safe-stringify": "^2.1.1",
+        "help-me": "^5.0.0",
+        "joycon": "^3.1.1",
+        "minimist": "^1.2.6",
+        "on-exit-leak-free": "^2.1.0",
+        "pino-abstract-transport": "^3.0.0",
+        "pump": "^3.0.0",
+        "secure-json-parse": "^4.0.0",
+        "sonic-boom": "^4.0.1",
+        "strip-json-comments": "^5.0.2"
       },
+      "bin": {
+        "pino-pretty": "bin.js"
+      }
+    },
+    "node_modules/pino-pretty/node_modules/strip-json-comments": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
+      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=20.19.0"
+        "node": ">=14.16"
       },
-      "peerDependencies": {
-        "@aws-sdk/credential-providers": "^3.806.0",
-        "@mongodb-js/zstd": "^7.0.0",
-        "gcp-metadata": "^7.0.1",
-        "kerberos": "^7.0.0",
-        "mongodb-client-encryption": ">=7.0.0 <7.1.0",
-        "snappy": "^7.3.2",
-        "socks": "^2.8.6"
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/pino-std-serializers": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
+      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
+      "license": "MIT"
+    },
+    "node_modules/pixelmatch": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
+      "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
+      "devOptional": true,
+      "license": "ISC",
+      "dependencies": {
+        "pngjs": "^7.0.0"
       },
-      "peerDependenciesMeta": {
-        "@aws-sdk/credential-providers": {
-          "optional": true
-        },
-        "@mongodb-js/zstd": {
-          "optional": true
-        },
-        "gcp-metadata": {
-          "optional": true
-        },
-        "kerberos": {
-          "optional": true
-        },
-        "mongodb-client-encryption": {
-          "optional": true
-        },
-        "snappy": {
-          "optional": true
-        },
-        "socks": {
-          "optional": true
-        }
+      "bin": {
+        "pixelmatch": "bin/pixelmatch"
       }
     },
-    "node_modules/mongodb-connection-string-url": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/mongodb-connection-string-url/-/mongodb-connection-string-url-7.0.1.tgz",
-      "integrity": "sha512-h0AZ9A7IDVwwHyMxmdMXKy+9oNlF0zFoahHiX3vQ8e3KFcSP3VmsmfvtRSuLPxmyv2vjIDxqty8smTgie/SNRQ==",
+    "node_modules/pkg-types": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.1.tgz",
+      "integrity": "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==",
+      "license": "MIT",
+      "dependencies": {
+        "confbox": "^0.2.4",
+        "exsolve": "^1.0.8",
+        "pathe": "^2.0.3"
+      }
+    },
+    "node_modules/playwright": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
+      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "devOptional": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@types/whatwg-url": "^13.0.0",
-        "whatwg-url": "^14.1.0"
+        "playwright-core": "1.58.2"
+      },
+      "bin": {
+        "playwright": "cli.js"
       },
       "engines": {
-        "node": ">=20.19.0"
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "fsevents": "2.3.2"
       }
     },
-    "node_modules/moo": {
-      "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/moo/-/moo-0.5.3.tgz",
-      "integrity": "sha512-m2fmM2dDm7GZQsY7KK2cme8agi+AAljILjQnof7p1ZMDe6dQ4bdnSMx0cPppudoeNv5hEFQirN6u+O4fDE0IWA==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
+    "node_modules/playwright-core": {
+      "version": "1.58.2",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
+      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "playwright-core": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/mri": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
-      "integrity": "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==",
-      "dev": true,
+    "node_modules/pngjs": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
+      "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
-        "node": ">=4"
+        "node": ">=14.19.0"
       }
     },
-    "node_modules/mrmime": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
-      "integrity": "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==",
+    "node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
       "devOptional": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
       "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
       "engines": {
-        "node": ">=10"
+        "node": "^10 || ^12 || >=14"
       }
     },
-    "node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+    "node_modules/postcss-load-config": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-3.1.4.tgz",
+      "integrity": "sha512-6DiM4E7v4coTE4uzA8U//WhtPwyhiim3eyjEMFCnUpzbrkK9wJHgKDT2mR+HbtSrd/NubVaYTOpSpjUl8NQeRg==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/mysql2": {
-      "version": "3.15.3",
-      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.15.3.tgz",
-      "integrity": "sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "aws-ssl-profiles": "^1.1.1",
-        "denque": "^2.1.0",
-        "generate-function": "^2.3.1",
-        "iconv-lite": "^0.7.0",
-        "long": "^5.2.1",
-        "lru.min": "^1.0.0",
-        "named-placeholders": "^1.1.3",
-        "seq-queue": "^0.0.5",
-        "sqlstring": "^2.3.2"
+        "lilconfig": "^2.0.5",
+        "yaml": "^1.10.2"
       },
       "engines": {
-        "node": ">= 8.0"
+        "node": ">= 10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/postcss/"
+      },
+      "peerDependencies": {
+        "postcss": ">=8.0.9",
+        "ts-node": ">=9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "postcss": {
+          "optional": true
+        },
+        "ts-node": {
+          "optional": true
+        }
       }
     },
-    "node_modules/named-placeholders": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.6.tgz",
-      "integrity": "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "lru.min": "^1.1.0"
-      },
+    "node_modules/postcss-load-config/node_modules/yaml": {
+      "version": "1.10.2",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
+      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "dev": true,
+      "license": "ISC",
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">= 6"
       }
     },
-    "node_modules/nan": {
-      "version": "2.22.2",
-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
-      "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==",
+    "node_modules/postcss-safe-parser": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/postcss-safe-parser/-/postcss-safe-parser-7.0.1.tgz",
+      "integrity": "sha512-0AioNCJZ2DPYz5ABT6bddIqlhgwhpHZ/l65YAYo0BCIn0xiDpsnTHz0gnoTGk0OXZW0JRs+cDwL8u/teRdz+8A==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
-      "devOptional": true,
       "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss-safe-parser"
+        },
         {
           "type": "github",
           "url": "https://github.com/sponsors/ai"
         }
       ],
       "license": "MIT",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
       "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+        "node": ">=18.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.4.31"
       }
     },
-    "node_modules/nanostores": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.1.1.tgz",
-      "integrity": "sha512-EYJqS25r2iBeTtGQCHidXl1VfZ1jXM7Q04zXJOrMlxVVmD0ptxJaNux92n1mJ7c5lN3zTq12MhH/8x59nP+qmg==",
+    "node_modules/postcss-scss": {
+      "version": "4.0.9",
+      "resolved": "https://registry.npmjs.org/postcss-scss/-/postcss-scss-4.0.9.tgz",
+      "integrity": "sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A==",
+      "dev": true,
       "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss-scss"
+        },
         {
           "type": "github",
           "url": "https://github.com/sponsors/ai"
@@ -8062,3152 +9492,3280 @@
       ],
       "license": "MIT",
       "engines": {
-        "node": "^20.0.0 || >=22.0.0"
+        "node": ">=12.0"
+      },
+      "peerDependencies": {
+        "postcss": "^8.4.29"
       }
     },
-    "node_modules/napi-build-utils": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
-      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/natural-compare": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/nearley": {
-      "version": "2.20.1",
-      "resolved": "https://registry.npmjs.org/nearley/-/nearley-2.20.1.tgz",
-      "integrity": "sha512-+Mc8UaAebFzgV+KpI5n7DasuuQCHA89dmwm7JXw3TV43ukfNQ9DnBH3Mdb2g/I4Fdxc26pwimBWvjIw0UAILSQ==",
+    "node_modules/postcss-selector-parser": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
+      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "commander": "^2.19.0",
-        "moo": "^0.5.0",
-        "railroad-diagrams": "^1.0.0",
-        "randexp": "0.4.6"
+        "cssesc": "^3.0.0",
+        "util-deprecate": "^1.0.2"
       },
-      "bin": {
-        "nearley-railroad": "bin/nearley-railroad.js",
-        "nearley-test": "bin/nearley-test.js",
-        "nearley-unparse": "bin/nearley-unparse.js",
-        "nearleyc": "bin/nearleyc.js"
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/postgres": {
+      "version": "3.4.7",
+      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
+      "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
+      "license": "Unlicense",
+      "peer": true,
+      "engines": {
+        "node": ">=12"
       },
       "funding": {
         "type": "individual",
-        "url": "https://nearley.js.org/#give-to-nearley"
+        "url": "https://github.com/sponsors/porsager"
       }
     },
-    "node_modules/nearley/node_modules/commander": {
-      "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
-      "dev": true,
+    "node_modules/postgres-array": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
+      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
       "license": "MIT",
-      "optional": true
+      "engines": {
+        "node": ">=4"
+      }
     },
-    "node_modules/negotiator": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
-      "dev": true,
+    "node_modules/postgres-bytea": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.1.tgz",
+      "integrity": "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/node-abi": {
-      "version": "3.87.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.87.0.tgz",
-      "integrity": "sha512-+CGM1L1CgmtheLcBuleyYOn7NWPVu0s0EJH2C4puxgEZb9h8QpR9G2dBfZJOAUhi7VQxuBPMd0hiISWcTyiYyQ==",
-      "dev": true,
+    "node_modules/postgres-date": {
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
+      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "semver": "^7.3.5"
-      },
       "engines": {
-        "node": ">=10"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/node-fetch-native": {
-      "version": "1.6.7",
-      "resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
-      "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
+    "node_modules/postgres-interval": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
+      "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
       "license": "MIT",
-      "peer": true
+      "dependencies": {
+        "xtend": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
     },
-    "node_modules/node-gyp": {
-      "version": "11.5.0",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
-      "integrity": "sha512-ra7Kvlhxn5V9Slyus0ygMa2h+UqExPqUIkfk7Pc8QTLT956JLSy51uWFwHtIYy0vI8cB4BDhc/S03+880My/LQ==",
+    "node_modules/prebuild-install": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
+      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
+      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "env-paths": "^2.2.0",
-        "exponential-backoff": "^3.1.1",
-        "graceful-fs": "^4.2.6",
-        "make-fetch-happen": "^14.0.3",
-        "nopt": "^8.0.0",
-        "proc-log": "^5.0.0",
-        "semver": "^7.3.5",
-        "tar": "^7.4.3",
-        "tinyglobby": "^0.2.12",
-        "which": "^5.0.0"
+        "detect-libc": "^2.0.0",
+        "expand-template": "^2.0.3",
+        "github-from-package": "0.0.0",
+        "minimist": "^1.2.3",
+        "mkdirp-classic": "^0.5.3",
+        "napi-build-utils": "^2.0.0",
+        "node-abi": "^3.3.0",
+        "pump": "^3.0.0",
+        "rc": "^1.2.7",
+        "simple-get": "^4.0.0",
+        "tar-fs": "^2.0.0",
+        "tunnel-agent": "^0.6.0"
       },
       "bin": {
-        "node-gyp": "bin/node-gyp.js"
+        "prebuild-install": "bin.js"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": ">=10"
       }
     },
-    "node_modules/node-gyp/node_modules/isexe": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
-      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.8.0"
       }
     },
-    "node_modules/node-gyp/node_modules/which": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
-      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
+    "node_modules/prettier": {
+      "version": "3.8.1",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
+      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "dependencies": {
-        "isexe": "^3.1.1"
-      },
+      "license": "MIT",
       "bin": {
-        "node-which": "bin/which.js"
+        "prettier": "bin/prettier.cjs"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/prettier/prettier?sponsor=1"
       }
     },
-    "node_modules/nopt": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-8.1.0.tgz",
-      "integrity": "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==",
+    "node_modules/prettier-plugin-svelte": {
+      "version": "3.5.0",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-3.5.0.tgz",
+      "integrity": "sha512-2lLO/7EupnjO/95t+XZesXs8Bf3nYLIDfCo270h5QWbj/vjLqmrQ1LiRk9LPggxSDsnVYfehamZNf+rgQYApZg==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "dependencies": {
-        "abbrev": "^3.0.0"
-      },
-      "bin": {
-        "nopt": "bin/nopt.js"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+      "license": "MIT",
+      "peerDependencies": {
+        "prettier": "^3.0.0",
+        "svelte": "^3.2.0 || ^4.0.0-next.0 || ^5.0.0-next.0"
       }
     },
-    "node_modules/normalize-package-data": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-8.0.0.tgz",
-      "integrity": "sha512-RWk+PI433eESQ7ounYxIp67CYuVsS1uYSonX3kA6ps/3LWfjVQa/ptEg6Y3T6uAMq1mWpX9PQ+qx+QaHpsc7gQ==",
+    "node_modules/prettier-plugin-tailwindcss": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.7.2.tgz",
+      "integrity": "sha512-LkphyK3Fw+q2HdMOoiEHWf93fNtYJwfamoKPl7UwtjFQdei/iIBoX11G6j706FzN3ymX9mPVi97qIY8328vdnA==",
       "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "hosted-git-info": "^9.0.0",
-        "semver": "^7.3.5",
-        "validate-npm-package-license": "^3.0.4"
-      },
+      "license": "MIT",
       "engines": {
-        "node": "^20.17.0 || >=22.9.0"
+        "node": ">=20.19"
+      },
+      "peerDependencies": {
+        "@ianvs/prettier-plugin-sort-imports": "*",
+        "@prettier/plugin-hermes": "*",
+        "@prettier/plugin-oxc": "*",
+        "@prettier/plugin-pug": "*",
+        "@shopify/prettier-plugin-liquid": "*",
+        "@trivago/prettier-plugin-sort-imports": "*",
+        "@zackad/prettier-plugin-twig": "*",
+        "prettier": "^3.0",
+        "prettier-plugin-astro": "*",
+        "prettier-plugin-css-order": "*",
+        "prettier-plugin-jsdoc": "*",
+        "prettier-plugin-marko": "*",
+        "prettier-plugin-multiline-arrays": "*",
+        "prettier-plugin-organize-attributes": "*",
+        "prettier-plugin-organize-imports": "*",
+        "prettier-plugin-sort-imports": "*",
+        "prettier-plugin-svelte": "*"
+      },
+      "peerDependenciesMeta": {
+        "@ianvs/prettier-plugin-sort-imports": {
+          "optional": true
+        },
+        "@prettier/plugin-hermes": {
+          "optional": true
+        },
+        "@prettier/plugin-oxc": {
+          "optional": true
+        },
+        "@prettier/plugin-pug": {
+          "optional": true
+        },
+        "@shopify/prettier-plugin-liquid": {
+          "optional": true
+        },
+        "@trivago/prettier-plugin-sort-imports": {
+          "optional": true
+        },
+        "@zackad/prettier-plugin-twig": {
+          "optional": true
+        },
+        "prettier-plugin-astro": {
+          "optional": true
+        },
+        "prettier-plugin-css-order": {
+          "optional": true
+        },
+        "prettier-plugin-jsdoc": {
+          "optional": true
+        },
+        "prettier-plugin-marko": {
+          "optional": true
+        },
+        "prettier-plugin-multiline-arrays": {
+          "optional": true
+        },
+        "prettier-plugin-organize-attributes": {
+          "optional": true
+        },
+        "prettier-plugin-organize-imports": {
+          "optional": true
+        },
+        "prettier-plugin-sort-imports": {
+          "optional": true
+        },
+        "prettier-plugin-svelte": {
+          "optional": true
+        }
       }
     },
-    "node_modules/normalize-url": {
-      "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.1.1.tgz",
-      "integrity": "sha512-JYc0DPlpGWB40kH5g07gGTrYuMqV653k3uBKY6uITPWds3M0ov3GaWGp9lbE3Bzngx8+XkfzgvASb9vk9JDFXQ==",
-      "dev": true,
+    "node_modules/pretty-bytes": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-7.1.0.tgz",
+      "integrity": "sha512-nODzvTiYVRGRqAOvE84Vk5JDPyyxsVk0/fbA/bq7RqlnhksGpset09XTxbpvLTIjoaF7K8Z8DG8yHtKGTPSYRw==",
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=14.16"
+        "node": ">=20"
       },
       "funding": {
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/nypm": {
-      "version": "0.6.5",
-      "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.5.tgz",
-      "integrity": "sha512-K6AJy1GMVyfyMXRVB88700BJqNUkByijGJM8kEHpLdcAt+vSQAVfkWWHYzuRXHSY6xA2sNc5RjTj0p9rE2izVQ==",
-      "license": "MIT",
+    "node_modules/prisma": {
+      "version": "7.4.2",
+      "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.4.2.tgz",
+      "integrity": "sha512-2bP8Ruww3Q95Z2eH4Yqh4KAENRsj/SxbdknIVBfd6DmjPwmpsC4OVFMLOeHt6tM3Amh8ebjvstrUz3V/hOe1dA==",
+      "hasInstallScript": true,
+      "license": "Apache-2.0",
       "peer": true,
       "dependencies": {
-        "citty": "^0.2.0",
-        "pathe": "^2.0.3",
-        "tinyexec": "^1.0.2"
+        "@prisma/config": "7.4.2",
+        "@prisma/dev": "0.20.0",
+        "@prisma/engines": "7.4.2",
+        "@prisma/studio-core": "0.13.1",
+        "mysql2": "3.15.3",
+        "postgres": "3.4.7"
       },
       "bin": {
-        "nypm": "dist/cli.mjs"
+        "prisma": "build/index.js"
       },
       "engines": {
-        "node": ">=18"
+        "node": "^20.19 || ^22.12 || >=24.0"
+      },
+      "peerDependencies": {
+        "better-sqlite3": ">=9.0.0",
+        "typescript": ">=5.4.0"
+      },
+      "peerDependenciesMeta": {
+        "better-sqlite3": {
+          "optional": true
+        },
+        "typescript": {
+          "optional": true
+        }
       }
     },
-    "node_modules/nypm/node_modules/citty": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz",
-      "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/oauth2-mock-server": {
-      "version": "8.2.2",
-      "resolved": "https://registry.npmjs.org/oauth2-mock-server/-/oauth2-mock-server-8.2.2.tgz",
-      "integrity": "sha512-ZjMFtomGM4q1DflxEJpq2WVtSLbOjqlJYkkuGWdq9nL3oAbDExamFyhDN/bUqcooCHWeI0n99K/NU+gXEZLNiA==",
+    "node_modules/proc-log": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
+      "integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
       "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "basic-auth": "^2.0.1",
-        "cors": "^2.8.6",
-        "express": "^5.2.1",
-        "is-plain-obj": "^4.1.0",
-        "jose": "^6.1.3"
-      },
-      "bin": {
-        "oauth2-mock-server": "dist/oauth2-mock-server.js"
-      },
+      "license": "ISC",
+      "optional": true,
       "engines": {
-        "node": "^20.19 || ^22.12 || ^24"
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/process-warning": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.0.0.tgz",
+      "integrity": "sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/prom-client": {
+      "version": "15.1.3",
+      "resolved": "https://registry.npmjs.org/prom-client/-/prom-client-15.1.3.tgz",
+      "integrity": "sha512-6ZiOBfCywsD4k1BN9IX0uZhF+tJkV8q8llP64G5Hajs4JOeVLPCwpPVcpXy3BwYiUGgyJzsJJQeOIv7+hDSq8g==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@opentelemetry/api": "^1.4.0",
+        "tdigest": "^0.1.1"
+      },
       "engines": {
-        "node": ">=0.10.0"
+        "node": "^16 || ^18 || >=20"
       }
     },
-    "node_modules/object-inspect": {
-      "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+    "node_modules/promise-retry": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
+      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">= 0.4"
+      "optional": true,
+      "dependencies": {
+        "err-code": "^2.0.2",
+        "retry": "^0.12.0"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+      "engines": {
+        "node": ">=10"
       }
     },
-    "node_modules/obug": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
-      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
-      "devOptional": true,
-      "funding": [
-        "https://github.com/sponsors/sxzz",
-        "https://opencollective.com/debug"
-      ],
-      "license": "MIT"
-    },
-    "node_modules/ohash": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.11.tgz",
-      "integrity": "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==",
+    "node_modules/proper-lockfile": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
+      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
       "license": "MIT",
+      "peer": true,
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "retry": "^0.12.0",
+        "signal-exit": "^3.0.2"
+      }
+    },
+    "node_modules/proper-lockfile/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
+      "license": "ISC",
       "peer": true
     },
-    "node_modules/on-exit-leak-free": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
-      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
+    "node_modules/property-expr": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/property-expr/-/property-expr-2.0.6.tgz",
+      "integrity": "sha512-SVtmxhRE/CGkn3eZY1T6pC8Nln6Fr/lu1mKSgRud0eC73whjGfoAogbn78LkD8aFL0zz3bAFerKSnOl7NlErBA==",
+      "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
-      }
+      "optional": true
     },
-    "node_modules/on-finished": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+    "node_modules/proxy-addr": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ee-first": "1.1.1"
+        "forwarded": "0.2.0",
+        "ipaddr.js": "1.9.1"
       },
       "engines": {
-        "node": ">= 0.8"
+        "node": ">= 0.10"
       }
     },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+    "node_modules/pump": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
+      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
       "dependencies": {
-        "wrappy": "1"
+        "end-of-stream": "^1.1.0",
+        "once": "^1.3.1"
       }
     },
-    "node_modules/optionator": {
-      "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
-      "dev": true,
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "license": "MIT",
-      "dependencies": {
-        "deep-is": "^0.1.3",
-        "fast-levenshtein": "^2.0.6",
-        "levn": "^0.4.1",
-        "prelude-ls": "^1.2.1",
-        "type-check": "^0.4.0",
-        "word-wrap": "^1.2.5"
-      },
       "engines": {
-        "node": ">= 0.8.0"
+        "node": ">=6"
       }
     },
-    "node_modules/p-limit": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+    "node_modules/pure-rand": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
+      "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/dubzzz"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fast-check"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/qs": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
+      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-3-Clause",
       "dependencies": {
-        "yocto-queue": "^0.1.0"
+        "side-channel": "^1.1.0"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=0.6"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/p-locate": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+    "node_modules/quansync": {
+      "version": "0.2.11",
+      "resolved": "https://registry.npmjs.org/quansync/-/quansync-0.2.11.tgz",
+      "integrity": "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/antfu"
+        },
+        {
+          "type": "individual",
+          "url": "https://github.com/sponsors/sxzz"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/quick-format-unescaped": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
+      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
+      "license": "MIT"
+    },
+    "node_modules/railroad-diagrams": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/railroad-diagrams/-/railroad-diagrams-1.0.0.tgz",
+      "integrity": "sha512-cz93DjNeLY0idrCNOH6PviZGRN9GJhsdm9hpn1YCS879fj4W+x5IFJhhkRZcwVgMmFF7R82UA/7Oh+R8lLZg6A==",
+      "dev": true,
+      "license": "CC0-1.0",
+      "optional": true
+    },
+    "node_modules/randexp": {
+      "version": "0.4.6",
+      "resolved": "https://registry.npmjs.org/randexp/-/randexp-0.4.6.tgz",
+      "integrity": "sha512-80WNmd9DA0tmZrw9qQa62GPPWfuXJknrmVmLcxvq4uZBdYqb1wYoKTmnlGUchvVWe0XiLupYkBoXVOxz3C8DYQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "p-limit": "^3.0.2"
+        "discontinuous-range": "1.0.0",
+        "ret": "~0.1.10"
       },
       "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=0.12"
       }
     },
-    "node_modules/p-map": {
-      "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
-      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
+    "node_modules/range-parser": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true
-    },
-    "node_modules/package-manager-detector": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
-      "integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/packageurl-js": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
-      "integrity": "sha512-N5ixXjzTy4QDQH0Q9YFjqIWd6zH6936Djpl2m9QNFmDv5Fum8q8BjkpAcHNMzOFE0IwQrFhJWex3AN6kS0OSwg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/pako": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-0.2.9.tgz",
-      "integrity": "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA==",
+    "node_modules/raw-body": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
+      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.7.0",
+        "unpipe": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.10"
+      }
     },
-    "node_modules/parent-module": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+    "node_modules/rc": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
       "dev": true,
-      "license": "MIT",
+      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "optional": true,
       "dependencies": {
-        "callsites": "^3.0.0"
+        "deep-extend": "^0.6.0",
+        "ini": "~1.3.0",
+        "minimist": "^1.2.0",
+        "strip-json-comments": "~2.0.1"
       },
-      "engines": {
-        "node": ">=6"
+      "bin": {
+        "rc": "cli.js"
       }
     },
-    "node_modules/parseurl": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+    "node_modules/rc/node_modules/strip-json-comments": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/path-exists": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
-      "dev": true,
+    "node_modules/rc9": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/rc9/-/rc9-2.1.2.tgz",
+      "integrity": "sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==",
       "license": "MIT",
-      "engines": {
-        "node": ">=8"
+      "peer": true,
+      "dependencies": {
+        "defu": "^6.1.4",
+        "destr": "^2.0.3"
       }
     },
-    "node_modules/path-expression-matcher": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
-      "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
+    "node_modules/react": {
+      "version": "19.2.4",
+      "resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
+      "integrity": "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+    "node_modules/react-dom": {
+      "version": "19.2.4",
+      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.4.tgz",
+      "integrity": "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==",
       "license": "MIT",
-      "engines": {
-        "node": ">=8"
+      "peer": true,
+      "dependencies": {
+        "scheduler": "^0.27.0"
+      },
+      "peerDependencies": {
+        "react": "^19.2.4"
       }
     },
-    "node_modules/path-parse": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/path-scurry": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true,
+    "node_modules/readable-stream": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "license": "MIT",
       "dependencies": {
-        "lru-cache": "^10.2.0",
-        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+        "inherits": "^2.0.3",
+        "string_decoder": "^1.1.1",
+        "util-deprecate": "^1.0.1"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "node": ">= 6"
       }
     },
-    "node_modules/path-to-regexp": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
-      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
-      "dev": true,
+    "node_modules/readdirp": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
+      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
       "license": "MIT",
+      "engines": {
+        "node": ">= 14.18.0"
+      },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "type": "individual",
+        "url": "https://paulmillr.com/funding/"
       }
     },
-    "node_modules/pathe": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
-      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
-      "license": "MIT"
-    },
-    "node_modules/picocolors": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
-      "devOptional": true,
-      "license": "ISC"
-    },
-    "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
-      "devOptional": true,
+    "node_modules/real-require": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
+      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
       "license": "MIT",
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/jonschlinkert"
+        "node": ">= 12.13.0"
       }
     },
-    "node_modules/pino": {
-      "version": "10.3.1",
-      "resolved": "https://registry.npmjs.org/pino/-/pino-10.3.1.tgz",
-      "integrity": "sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==",
+    "node_modules/regexp-to-ast": {
+      "version": "0.5.0",
+      "resolved": "https://registry.npmjs.org/regexp-to-ast/-/regexp-to-ast-0.5.0.tgz",
+      "integrity": "sha512-tlbJqcMHnPKI9zSrystikWKwHkBqu2a/Sgw01h3zFjvYrMxEDYHzzoMZnUrbIfpTFEsoRnnviOXNCzFiSc54Qw==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/regexp-tree": {
+      "version": "0.1.27",
+      "resolved": "https://registry.npmjs.org/regexp-tree/-/regexp-tree-0.1.27.tgz",
+      "integrity": "sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@pinojs/redact": "^0.4.0",
-        "atomic-sleep": "^1.0.0",
-        "on-exit-leak-free": "^2.1.0",
-        "pino-abstract-transport": "^3.0.0",
-        "pino-std-serializers": "^7.0.0",
-        "process-warning": "^5.0.0",
-        "quick-format-unescaped": "^4.0.3",
-        "real-require": "^0.2.0",
-        "safe-stable-stringify": "^2.3.1",
-        "sonic-boom": "^4.0.1",
-        "thread-stream": "^4.0.0"
-      },
       "bin": {
-        "pino": "bin.js"
+        "regexp-tree": "bin/regexp-tree"
       }
     },
-    "node_modules/pino-abstract-transport": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-3.0.0.tgz",
-      "integrity": "sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==",
+    "node_modules/remeda": {
+      "version": "2.33.4",
+      "resolved": "https://registry.npmjs.org/remeda/-/remeda-2.33.4.tgz",
+      "integrity": "sha512-ygHswjlc/opg2VrtiYvUOPLjxjtdKvjGz1/plDhkG66hjNjFr1xmfrs2ClNFo/E6TyUFiwYNh53bKV26oBoMGQ==",
       "license": "MIT",
-      "dependencies": {
-        "split2": "^4.0.0"
+      "peer": true,
+      "funding": {
+        "url": "https://github.com/sponsors/remeda"
       }
     },
-    "node_modules/pino-pretty": {
-      "version": "13.1.3",
-      "resolved": "https://registry.npmjs.org/pino-pretty/-/pino-pretty-13.1.3.tgz",
-      "integrity": "sha512-ttXRkkOz6WWC95KeY9+xxWL6AtImwbyMHrL1mSwqwW9u+vLp/WIElvHvCSDg0xO/Dzrggz1zv3rN5ovTRVowKg==",
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "colorette": "^2.0.7",
-        "dateformat": "^4.6.3",
-        "fast-copy": "^4.0.0",
-        "fast-safe-stringify": "^2.1.1",
-        "help-me": "^5.0.0",
-        "joycon": "^3.1.1",
-        "minimist": "^1.2.6",
-        "on-exit-leak-free": "^2.1.0",
-        "pino-abstract-transport": "^3.0.0",
-        "pump": "^3.0.0",
-        "secure-json-parse": "^4.0.0",
-        "sonic-boom": "^4.0.1",
-        "strip-json-comments": "^5.0.2"
-      },
-      "bin": {
-        "pino-pretty": "bin.js"
+      "optional": true,
+      "engines": {
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/pino-pretty/node_modules/strip-json-comments": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
-      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
+    "node_modules/resolve": {
+      "version": "1.22.11",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
+      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "is-core-module": "^2.16.1",
+        "path-parse": "^1.0.7",
+        "supports-preserve-symlinks-flag": "^1.0.0"
+      },
+      "bin": {
+        "resolve": "bin/resolve"
+      },
       "engines": {
-        "node": ">=14.16"
+        "node": ">= 0.4"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/pino-std-serializers": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
-      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
-      "license": "MIT"
+    "node_modules/resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
     },
-    "node_modules/pixelmatch": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
-      "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
+    "node_modules/resolve-pkg-maps": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
+      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
       "devOptional": true,
-      "license": "ISC",
-      "dependencies": {
-        "pngjs": "^7.0.0"
-      },
-      "bin": {
-        "pixelmatch": "bin/pixelmatch"
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
       }
     },
-    "node_modules/pkg-types": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.0.tgz",
-      "integrity": "sha512-SIqCzDRg0s9npO5XQ3tNZioRY1uK06lA41ynBC1YmFTmnY6FjUjVt6s4LoADmwoig1qqD0oK8h1p/8mlMx8Oig==",
+    "node_modules/ret": {
+      "version": "0.1.15",
+      "resolved": "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz",
+      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "confbox": "^0.2.2",
-        "exsolve": "^1.0.7",
-        "pathe": "^2.0.3"
+      "optional": true,
+      "engines": {
+        "node": ">=0.12"
       }
     },
-    "node_modules/playwright": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
-      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+    "node_modules/retry": {
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/rollup": {
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.57.1.tgz",
+      "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==",
       "devOptional": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "dependencies": {
-        "playwright-core": "1.58.2"
+        "@types/estree": "1.0.8"
       },
       "bin": {
-        "playwright": "cli.js"
+        "rollup": "dist/bin/rollup"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=18.0.0",
+        "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "fsevents": "2.3.2"
+        "@rollup/rollup-android-arm-eabi": "4.57.1",
+        "@rollup/rollup-android-arm64": "4.57.1",
+        "@rollup/rollup-darwin-arm64": "4.57.1",
+        "@rollup/rollup-darwin-x64": "4.57.1",
+        "@rollup/rollup-freebsd-arm64": "4.57.1",
+        "@rollup/rollup-freebsd-x64": "4.57.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.57.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.57.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.57.1",
+        "@rollup/rollup-linux-arm64-musl": "4.57.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.57.1",
+        "@rollup/rollup-linux-loong64-musl": "4.57.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.57.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.57.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.57.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.57.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.57.1",
+        "@rollup/rollup-linux-x64-gnu": "4.57.1",
+        "@rollup/rollup-linux-x64-musl": "4.57.1",
+        "@rollup/rollup-openbsd-x64": "4.57.1",
+        "@rollup/rollup-openharmony-arm64": "4.57.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.57.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.57.1",
+        "@rollup/rollup-win32-x64-gnu": "4.57.1",
+        "@rollup/rollup-win32-x64-msvc": "4.57.1",
+        "fsevents": "~2.3.2"
       }
     },
-    "node_modules/playwright-core": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
-      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
-      "devOptional": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "playwright-core": "cli.js"
-      },
-      "engines": {
-        "node": ">=18"
-      }
+    "node_modules/rou3": {
+      "version": "0.7.12",
+      "resolved": "https://registry.npmjs.org/rou3/-/rou3-0.7.12.tgz",
+      "integrity": "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==",
+      "license": "MIT"
     },
-    "node_modules/pngjs": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
-      "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
-      "devOptional": true,
+    "node_modules/router": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
+      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
+      "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "debug": "^4.4.0",
+        "depd": "^2.0.0",
+        "is-promise": "^4.0.0",
+        "parseurl": "^1.3.3",
+        "path-to-regexp": "^8.0.0"
+      },
       "engines": {
-        "node": ">=14.19.0"
+        "node": ">= 18"
       }
     },
-    "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
-      "devOptional": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
+    "node_modules/sade": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
+      "integrity": "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
-        "picocolors": "^1.1.1",
-        "source-map-js": "^1.2.1"
+        "mri": "^1.1.0"
       },
       "engines": {
-        "node": "^10 || ^12 || >=14"
+        "node": ">=6"
       }
     },
-    "node_modules/postcss-load-config": {
-      "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-3.1.4.tgz",
-      "integrity": "sha512-6DiM4E7v4coTE4uzA8U//WhtPwyhiim3eyjEMFCnUpzbrkK9wJHgKDT2mR+HbtSrd/NubVaYTOpSpjUl8NQeRg==",
+    "node_modules/safe-buffer": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/safe-regex": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-2.1.1.tgz",
+      "integrity": "sha512-rx+x8AMzKb5Q5lQ95Zoi6ZbJqwCLkqi3XuJXp5P3rT8OEc6sZCJG5AE5dU3lsgRr/F4Bs31jSlVN+j5KrsGu9A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "lilconfig": "^2.0.5",
-        "yaml": "^1.10.2"
-      },
-      "engines": {
-        "node": ">= 10"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/postcss/"
-      },
-      "peerDependencies": {
-        "postcss": ">=8.0.9",
-        "ts-node": ">=9.0.0"
-      },
-      "peerDependenciesMeta": {
-        "postcss": {
-          "optional": true
-        },
-        "ts-node": {
-          "optional": true
-        }
+        "regexp-tree": "~0.1.1"
       }
     },
-    "node_modules/postcss-load-config/node_modules/yaml": {
-      "version": "1.10.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
-      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
       "engines": {
-        "node": ">= 6"
+        "node": ">=10"
       }
     },
-    "node_modules/postcss-safe-parser": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/postcss-safe-parser/-/postcss-safe-parser-7.0.1.tgz",
-      "integrity": "sha512-0AioNCJZ2DPYz5ABT6bddIqlhgwhpHZ/l65YAYo0BCIn0xiDpsnTHz0gnoTGk0OXZW0JRs+cDwL8u/teRdz+8A==",
+    "node_modules/safer-buffer": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
+      "license": "MIT"
+    },
+    "node_modules/scheduler": {
+      "version": "0.27.0",
+      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
+      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
+      "license": "MIT",
+      "peer": true
+    },
+    "node_modules/schemes": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/schemes/-/schemes-1.4.0.tgz",
+      "integrity": "sha512-ImFy9FbCsQlVgnE3TCWmLPCFnVzx0lHL/l+umHplDqAKd0dzFpnS6lFZIpagBlYhKwzVmlV36ec0Y1XTu8JBAQ==",
       "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss-safe-parser"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
       "license": "MIT",
-      "engines": {
-        "node": ">=18.0"
-      },
-      "peerDependencies": {
-        "postcss": "^8.4.31"
+      "optional": true,
+      "dependencies": {
+        "extend": "^3.0.0"
       }
     },
-    "node_modules/postcss-scss": {
-      "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/postcss-scss/-/postcss-scss-4.0.9.tgz",
-      "integrity": "sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A==",
+    "node_modules/secure-json-parse": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-4.1.0.tgz",
+      "integrity": "sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==",
       "dev": true,
       "funding": [
         {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss-scss"
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
         },
         {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
         }
       ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.0"
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/semver": {
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
+      "dev": true,
+      "license": "ISC",
+      "bin": {
+        "semver": "bin/semver.js"
       },
-      "peerDependencies": {
-        "postcss": "^8.4.29"
+      "engines": {
+        "node": ">=10"
       }
     },
-    "node_modules/postcss-selector-parser": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
-      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
+    "node_modules/send": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
+      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "cssesc": "^3.0.0",
-        "util-deprecate": "^1.0.2"
+        "debug": "^4.4.3",
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "etag": "^1.8.1",
+        "fresh": "^2.0.0",
+        "http-errors": "^2.0.1",
+        "mime-types": "^3.0.2",
+        "ms": "^2.1.3",
+        "on-finished": "^2.4.1",
+        "range-parser": "^1.2.1",
+        "statuses": "^2.0.2"
       },
       "engines": {
-        "node": ">=4"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/postgres": {
-      "version": "3.4.7",
-      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
-      "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
-      "license": "Unlicense",
-      "peer": true,
+    "node_modules/seq-queue": {
+      "version": "0.0.5",
+      "resolved": "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz",
+      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q==",
+      "peer": true
+    },
+    "node_modules/serve-static": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
+      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "encodeurl": "^2.0.0",
+        "escape-html": "^1.0.3",
+        "parseurl": "^1.3.3",
+        "send": "^1.2.0"
+      },
       "engines": {
-        "node": ">=12"
+        "node": ">= 18"
       },
       "funding": {
-        "type": "individual",
-        "url": "https://github.com/sponsors/porsager"
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/prebuild-install": {
-      "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
-      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
-      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
+    "node_modules/set-cookie-parser": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.0.1.tgz",
+      "integrity": "sha512-n7Z7dXZhJbwuAHhNzkTti6Aw9QDDjZtm3JTpTGATIdNzdQz5GuFs22w90BcvF4INfnrL5xrX3oGsuqO5Dx3A1Q==",
+      "license": "MIT"
+    },
+    "node_modules/setprototypeof": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
       "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "detect-libc": "^2.0.0",
-        "expand-template": "^2.0.3",
-        "github-from-package": "0.0.0",
-        "minimist": "^1.2.3",
-        "mkdirp-classic": "^0.5.3",
-        "napi-build-utils": "^2.0.0",
-        "node-abi": "^3.3.0",
-        "pump": "^3.0.0",
-        "rc": "^1.2.7",
-        "simple-get": "^4.0.0",
-        "tar-fs": "^2.0.0",
-        "tunnel-agent": "^0.6.0"
-      },
-      "bin": {
-        "prebuild-install": "bin.js"
+        "shebang-regex": "^3.0.0"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=8"
       }
     },
-    "node_modules/prelude-ls": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
-      "dev": true,
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.8.0"
+        "node": ">=8"
       }
     },
-    "node_modules/prettier": {
-      "version": "3.8.1",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
-      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
+    "node_modules/side-channel": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
       "dev": true,
       "license": "MIT",
-      "bin": {
-        "prettier": "bin/prettier.cjs"
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
+        "side-channel-map": "^1.0.1",
+        "side-channel-weakmap": "^1.0.2"
       },
       "engines": {
-        "node": ">=14"
+        "node": ">= 0.4"
       },
       "funding": {
-        "url": "https://github.com/prettier/prettier?sponsor=1"
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/prettier-plugin-svelte": {
-      "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-3.5.0.tgz",
-      "integrity": "sha512-2lLO/7EupnjO/95t+XZesXs8Bf3nYLIDfCo270h5QWbj/vjLqmrQ1LiRk9LPggxSDsnVYfehamZNf+rgQYApZg==",
+    "node_modules/side-channel-list": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
       "dev": true,
       "license": "MIT",
-      "peerDependencies": {
-        "prettier": "^3.0.0",
-        "svelte": "^3.2.0 || ^4.0.0-next.0 || ^5.0.0-next.0"
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "object-inspect": "^1.13.3"
+      },
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/prettier-plugin-tailwindcss": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.7.2.tgz",
-      "integrity": "sha512-LkphyK3Fw+q2HdMOoiEHWf93fNtYJwfamoKPl7UwtjFQdei/iIBoX11G6j706FzN3ymX9mPVi97qIY8328vdnA==",
+    "node_modules/side-channel-map": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=20.19"
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3"
       },
-      "peerDependencies": {
-        "@ianvs/prettier-plugin-sort-imports": "*",
-        "@prettier/plugin-hermes": "*",
-        "@prettier/plugin-oxc": "*",
-        "@prettier/plugin-pug": "*",
-        "@shopify/prettier-plugin-liquid": "*",
-        "@trivago/prettier-plugin-sort-imports": "*",
-        "@zackad/prettier-plugin-twig": "*",
-        "prettier": "^3.0",
-        "prettier-plugin-astro": "*",
-        "prettier-plugin-css-order": "*",
-        "prettier-plugin-jsdoc": "*",
-        "prettier-plugin-marko": "*",
-        "prettier-plugin-multiline-arrays": "*",
-        "prettier-plugin-organize-attributes": "*",
-        "prettier-plugin-organize-imports": "*",
-        "prettier-plugin-sort-imports": "*",
-        "prettier-plugin-svelte": "*"
+      "engines": {
+        "node": ">= 0.4"
       },
-      "peerDependenciesMeta": {
-        "@ianvs/prettier-plugin-sort-imports": {
-          "optional": true
-        },
-        "@prettier/plugin-hermes": {
-          "optional": true
-        },
-        "@prettier/plugin-oxc": {
-          "optional": true
-        },
-        "@prettier/plugin-pug": {
-          "optional": true
-        },
-        "@shopify/prettier-plugin-liquid": {
-          "optional": true
-        },
-        "@trivago/prettier-plugin-sort-imports": {
-          "optional": true
-        },
-        "@zackad/prettier-plugin-twig": {
-          "optional": true
-        },
-        "prettier-plugin-astro": {
-          "optional": true
-        },
-        "prettier-plugin-css-order": {
-          "optional": true
-        },
-        "prettier-plugin-jsdoc": {
-          "optional": true
-        },
-        "prettier-plugin-marko": {
-          "optional": true
-        },
-        "prettier-plugin-multiline-arrays": {
-          "optional": true
-        },
-        "prettier-plugin-organize-attributes": {
-          "optional": true
-        },
-        "prettier-plugin-organize-imports": {
-          "optional": true
-        },
-        "prettier-plugin-sort-imports": {
-          "optional": true
-        },
-        "prettier-plugin-svelte": {
-          "optional": true
-        }
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/pretty-bytes": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-7.1.0.tgz",
-      "integrity": "sha512-nODzvTiYVRGRqAOvE84Vk5JDPyyxsVk0/fbA/bq7RqlnhksGpset09XTxbpvLTIjoaF7K8Z8DG8yHtKGTPSYRw==",
+    "node_modules/side-channel-weakmap": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+      "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "call-bound": "^1.0.2",
+        "es-errors": "^1.3.0",
+        "get-intrinsic": "^1.2.5",
+        "object-inspect": "^1.13.3",
+        "side-channel-map": "^1.0.1"
+      },
       "engines": {
-        "node": ">=20"
+        "node": ">= 0.4"
       },
       "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/prisma": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.4.2.tgz",
-      "integrity": "sha512-2bP8Ruww3Q95Z2eH4Yqh4KAENRsj/SxbdknIVBfd6DmjPwmpsC4OVFMLOeHt6tM3Amh8ebjvstrUz3V/hOe1dA==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@prisma/config": "7.4.2",
-        "@prisma/dev": "0.20.0",
-        "@prisma/engines": "7.4.2",
-        "@prisma/studio-core": "0.13.1",
-        "mysql2": "3.15.3",
-        "postgres": "3.4.7"
-      },
-      "bin": {
-        "prisma": "build/index.js"
-      },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "devOptional": true,
+      "license": "ISC"
+    },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "license": "ISC",
       "engines": {
-        "node": "^20.19 || ^22.12 || >=24.0"
-      },
-      "peerDependencies": {
-        "better-sqlite3": ">=9.0.0",
-        "typescript": ">=5.4.0"
+        "node": ">=14"
       },
-      "peerDependenciesMeta": {
-        "better-sqlite3": {
-          "optional": true
-        },
-        "typescript": {
-          "optional": true
-        }
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/proc-log": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
-      "integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
+    "node_modules/simple-concat": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
+      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "optional": true
     },
-    "node_modules/process-warning": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.0.0.tgz",
-      "integrity": "sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==",
+    "node_modules/simple-get": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
+      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
+      "dev": true,
       "funding": [
         {
           "type": "github",
-          "url": "https://github.com/sponsors/fastify"
+          "url": "https://github.com/sponsors/feross"
         },
         {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
         }
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "decompress-response": "^6.0.0",
+        "once": "^1.3.1",
+        "simple-concat": "^1.0.0"
+      }
     },
-    "node_modules/prom-client": {
-      "version": "15.1.3",
-      "resolved": "https://registry.npmjs.org/prom-client/-/prom-client-15.1.3.tgz",
-      "integrity": "sha512-6ZiOBfCywsD4k1BN9IX0uZhF+tJkV8q8llP64G5Hajs4JOeVLPCwpPVcpXy3BwYiUGgyJzsJJQeOIv7+hDSq8g==",
-      "license": "Apache-2.0",
+    "node_modules/sirv": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
+      "integrity": "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==",
+      "devOptional": true,
+      "license": "MIT",
       "dependencies": {
-        "@opentelemetry/api": "^1.4.0",
-        "tdigest": "^0.1.1"
+        "@polka/url": "^1.0.0-next.24",
+        "mrmime": "^2.0.0",
+        "totalist": "^3.0.0"
       },
       "engines": {
-        "node": "^16 || ^18 || >=20"
+        "node": ">=18"
       }
     },
-    "node_modules/promise-retry": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
-      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
+    "node_modules/smart-buffer": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 6.0.0",
+        "npm": ">= 3.0.0"
+      }
+    },
+    "node_modules/smtp-address-parser": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/smtp-address-parser/-/smtp-address-parser-1.1.0.tgz",
+      "integrity": "sha512-Gz11jbNU0plrReU9Sj7fmshSBxxJ9ShdD2q4ktHIHo/rpTH6lFyQoYHYKINPJtPe8aHFnsbtW46Ls0tCCBsIZg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "err-code": "^2.0.2",
-        "retry": "^0.12.0"
+        "nearley": "^2.20.1"
       },
       "engines": {
-        "node": ">=10"
+        "node": ">=0.10"
       }
     },
-    "node_modules/proper-lockfile": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
-      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
+    "node_modules/socks": {
+      "version": "2.8.7",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
+      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
       "license": "MIT",
-      "peer": true,
+      "optional": true,
       "dependencies": {
-        "graceful-fs": "^4.2.4",
-        "retry": "^0.12.0",
-        "signal-exit": "^3.0.2"
+        "ip-address": "^10.0.1",
+        "smart-buffer": "^4.2.0"
+      },
+      "engines": {
+        "node": ">= 10.0.0",
+        "npm": ">= 3.0.0"
       }
     },
-    "node_modules/proper-lockfile/node_modules/signal-exit": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
-      "license": "ISC",
-      "peer": true
-    },
-    "node_modules/property-expr": {
-      "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/property-expr/-/property-expr-2.0.6.tgz",
-      "integrity": "sha512-SVtmxhRE/CGkn3eZY1T6pC8Nln6Fr/lu1mKSgRud0eC73whjGfoAogbn78LkD8aFL0zz3bAFerKSnOl7NlErBA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+    "node_modules/socks-proxy-agent": {
+      "version": "8.0.5",
+      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
+      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "forwarded": "0.2.0",
-        "ipaddr.js": "1.9.1"
+        "agent-base": "^7.1.2",
+        "debug": "^4.3.4",
+        "socks": "^2.8.3"
       },
       "engines": {
-        "node": ">= 0.10"
+        "node": ">= 14"
       }
     },
-    "node_modules/pump": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
-      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
-      "dev": true,
+    "node_modules/sonic-boom": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
+      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
       "license": "MIT",
       "dependencies": {
-        "end-of-stream": "^1.1.0",
-        "once": "^1.3.1"
+        "atomic-sleep": "^1.0.0"
       }
     },
-    "node_modules/punycode": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
-      "license": "MIT",
+    "node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "devOptional": true,
+      "license": "BSD-3-Clause",
       "engines": {
-        "node": ">=6"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/pure-rand": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
-      "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/dubzzz"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fast-check"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/qs": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
-      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
-      "dev": true,
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "devOptional": true,
       "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "node_modules/sparse-bitfield": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/sparse-bitfield/-/sparse-bitfield-3.0.3.tgz",
+      "integrity": "sha512-kvzhi7vqKTfkh0PZU+2D2PIllw2ymqJKujUcyPMd9Y75Nv4nPbGJZXNhxsgdQab2BmlDct1YnfQCguEvHr7VsQ==",
+      "license": "MIT",
+      "peer": true,
       "dependencies": {
-        "side-channel": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=0.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "memory-pager": "^1.0.2"
       }
     },
-    "node_modules/quansync": {
-      "version": "0.2.11",
-      "resolved": "https://registry.npmjs.org/quansync/-/quansync-0.2.11.tgz",
-      "integrity": "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==",
+    "node_modules/spdx-correct": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
+      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
       "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/antfu"
-        },
-        {
-          "type": "individual",
-          "url": "https://github.com/sponsors/sxzz"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/quick-format-unescaped": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
-      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
-      "license": "MIT"
+      "license": "Apache-2.0",
+      "dependencies": {
+        "spdx-expression-parse": "^3.0.0",
+        "spdx-license-ids": "^3.0.0"
+      }
     },
-    "node_modules/railroad-diagrams": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/railroad-diagrams/-/railroad-diagrams-1.0.0.tgz",
-      "integrity": "sha512-cz93DjNeLY0idrCNOH6PviZGRN9GJhsdm9hpn1YCS879fj4W+x5IFJhhkRZcwVgMmFF7R82UA/7Oh+R8lLZg6A==",
+    "node_modules/spdx-exceptions": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
+      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
       "dev": true,
-      "license": "CC0-1.0",
-      "optional": true
+      "license": "CC-BY-3.0"
     },
-    "node_modules/randexp": {
-      "version": "0.4.6",
-      "resolved": "https://registry.npmjs.org/randexp/-/randexp-0.4.6.tgz",
-      "integrity": "sha512-80WNmd9DA0tmZrw9qQa62GPPWfuXJknrmVmLcxvq4uZBdYqb1wYoKTmnlGUchvVWe0XiLupYkBoXVOxz3C8DYQ==",
+    "node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "discontinuous-range": "1.0.0",
-        "ret": "~0.1.10"
-      },
-      "engines": {
-        "node": ">=0.12"
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
       }
     },
-    "node_modules/range-parser": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+    "node_modules/spdx-license-ids": {
+      "version": "3.0.23",
+      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
+      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
       "dev": true,
-      "license": "MIT",
+      "license": "CC0-1.0"
+    },
+    "node_modules/split2": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
+      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
+      "license": "ISC",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 10.x"
       }
     },
-    "node_modules/raw-body": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
-      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
+    "node_modules/sqlite-wasm-kysely": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/sqlite-wasm-kysely/-/sqlite-wasm-kysely-0.3.0.tgz",
+      "integrity": "sha512-TzjBNv7KwRw6E3pdKdlRyZiTmUIE0UttT/Sl56MVwVARl/u5gp978KepazCJZewFUnlWHz9i3NQd4kOtP/Afdg==",
       "dev": true,
-      "license": "MIT",
       "dependencies": {
-        "bytes": "~3.1.2",
-        "http-errors": "~2.0.1",
-        "iconv-lite": "~0.7.0",
-        "unpipe": "~1.0.0"
+        "@sqlite.org/sqlite-wasm": "^3.48.0-build2"
       },
+      "peerDependencies": {
+        "kysely": "*"
+      }
+    },
+    "node_modules/sqlstring": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/sqlstring/-/sqlstring-2.3.3.tgz",
+      "integrity": "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==",
+      "license": "MIT",
+      "peer": true,
       "engines": {
-        "node": ">= 0.10"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/rc": {
-      "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
-      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+    "node_modules/ssri": {
+      "version": "12.0.0",
+      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
+      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
       "dev": true,
-      "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
+      "license": "ISC",
       "optional": true,
       "dependencies": {
-        "deep-extend": "^0.6.0",
-        "ini": "~1.3.0",
-        "minimist": "^1.2.0",
-        "strip-json-comments": "~2.0.1"
+        "minipass": "^7.0.3"
       },
-      "bin": {
-        "rc": "cli.js"
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/rc/node_modules/strip-json-comments": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/statuses": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">= 0.8"
       }
     },
-    "node_modules/rc9": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/rc9/-/rc9-2.1.2.tgz",
-      "integrity": "sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "defu": "^6.1.4",
-        "destr": "^2.0.3"
-      }
+    "node_modules/std-env": {
+      "version": "3.10.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
+      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
+      "license": "MIT"
     },
-    "node_modules/react": {
-      "version": "19.2.4",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
-      "integrity": "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==",
+    "node_modules/stream-browserify": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/stream-browserify/-/stream-browserify-3.0.0.tgz",
+      "integrity": "sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==",
       "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
+      "dependencies": {
+        "inherits": "~2.0.4",
+        "readable-stream": "^3.5.0"
       }
     },
-    "node_modules/react-dom": {
-      "version": "19.2.4",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.4.tgz",
-      "integrity": "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==",
+    "node_modules/string_decoder": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "scheduler": "^0.27.0"
-      },
-      "peerDependencies": {
-        "react": "^19.2.4"
+        "safe-buffer": "~5.2.0"
       }
     },
-    "node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+    "node_modules/string_decoder/node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
+    "node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/readdirp": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
-      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">= 14.18.0"
-      },
-      "funding": {
-        "type": "individual",
-        "url": "https://paulmillr.com/funding/"
+      "optional": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
       }
     },
-    "node_modules/real-require": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
-      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
+    "node_modules/string-width-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
-        "node": ">= 12.13.0"
+        "node": ">=8"
       }
     },
-    "node_modules/regexp-to-ast": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/regexp-to-ast/-/regexp-to-ast-0.5.0.tgz",
-      "integrity": "sha512-tlbJqcMHnPKI9zSrystikWKwHkBqu2a/Sgw01h3zFjvYrMxEDYHzzoMZnUrbIfpTFEsoRnnviOXNCzFiSc54Qw==",
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
       "license": "MIT",
-      "peer": true
+      "optional": true
     },
-    "node_modules/regexp-tree": {
-      "version": "0.1.27",
-      "resolved": "https://registry.npmjs.org/regexp-tree/-/regexp-tree-0.1.27.tgz",
-      "integrity": "sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==",
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "dev": true,
       "license": "MIT",
-      "bin": {
-        "regexp-tree": "bin/regexp-tree"
+      "optional": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
       }
     },
-    "node_modules/remeda": {
-      "version": "2.33.4",
-      "resolved": "https://registry.npmjs.org/remeda/-/remeda-2.33.4.tgz",
-      "integrity": "sha512-ygHswjlc/opg2VrtiYvUOPLjxjtdKvjGz1/plDhkG66hjNjFr1xmfrs2ClNFo/E6TyUFiwYNh53bKV26oBoMGQ==",
+    "node_modules/stringtemplate4ts": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/stringtemplate4ts/-/stringtemplate4ts-1.0.9.tgz",
+      "integrity": "sha512-KYZm2bJlSjynG5Y+L46fkaKBQG6mhV6hb2RBA8dpx3/Vj6G4u7gwXNKYvaN9+QD5sj68/1srtSNDvqEso7MwsQ==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
-      "funding": {
-        "url": "https://github.com/sponsors/remeda"
+      "dependencies": {
+        "antlr4ng": "3.0.15",
+        "fast-printf": "1.6.10",
+        "he": "1.2.0",
+        "luxon": "3.5.0"
       }
     },
-    "node_modules/require-from-string": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+    "node_modules/stringtemplate4ts/node_modules/antlr4ng": {
+      "version": "3.0.15",
+      "resolved": "https://registry.npmjs.org/antlr4ng/-/antlr4ng-3.0.15.tgz",
+      "integrity": "sha512-VELFqTfcpGI2bj6ScMWuxM3FI6HOsojrgmnw3cCbUtsQ1DNOq32wJsjOt7vLvfIniyyuE1DIYegGcuFmn+jgyw==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
+      "license": "BSD-3-Clause"
     },
-    "node_modules/resolve": {
-      "version": "1.22.11",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
-      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
+    "node_modules/strip-ansi": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "is-core-module": "^2.16.1",
-        "path-parse": "^1.0.7",
-        "supports-preserve-symlinks-flag": "^1.0.0"
-      },
-      "bin": {
-        "resolve": "bin/resolve"
+        "ansi-regex": "^6.2.2"
       },
       "engines": {
-        "node": ">= 0.4"
+        "node": ">=12"
       },
       "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
       }
     },
-    "node_modules/resolve-from": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
-      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
       "engines": {
-        "node": ">=4"
+        "node": ">=8"
       }
     },
-    "node_modules/ret": {
-      "version": "0.1.15",
-      "resolved": "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz",
-      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
+    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "engines": {
-        "node": ">=0.12"
+        "node": ">=8"
       }
     },
-    "node_modules/retry": {
-      "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+    "node_modules/strip-bom": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
+      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
+      "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 4"
+        "node": ">=4"
       }
     },
-    "node_modules/rollup": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.57.1.tgz",
-      "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==",
-      "devOptional": true,
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@types/estree": "1.0.8"
-      },
-      "bin": {
-        "rollup": "dist/bin/rollup"
-      },
       "engines": {
-        "node": ">=18.0.0",
-        "npm": ">=8.0.0"
+        "node": ">=8"
       },
-      "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.57.1",
-        "@rollup/rollup-android-arm64": "4.57.1",
-        "@rollup/rollup-darwin-arm64": "4.57.1",
-        "@rollup/rollup-darwin-x64": "4.57.1",
-        "@rollup/rollup-freebsd-arm64": "4.57.1",
-        "@rollup/rollup-freebsd-x64": "4.57.1",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.57.1",
-        "@rollup/rollup-linux-arm-musleabihf": "4.57.1",
-        "@rollup/rollup-linux-arm64-gnu": "4.57.1",
-        "@rollup/rollup-linux-arm64-musl": "4.57.1",
-        "@rollup/rollup-linux-loong64-gnu": "4.57.1",
-        "@rollup/rollup-linux-loong64-musl": "4.57.1",
-        "@rollup/rollup-linux-ppc64-gnu": "4.57.1",
-        "@rollup/rollup-linux-ppc64-musl": "4.57.1",
-        "@rollup/rollup-linux-riscv64-gnu": "4.57.1",
-        "@rollup/rollup-linux-riscv64-musl": "4.57.1",
-        "@rollup/rollup-linux-s390x-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-musl": "4.57.1",
-        "@rollup/rollup-openbsd-x64": "4.57.1",
-        "@rollup/rollup-openharmony-arm64": "4.57.1",
-        "@rollup/rollup-win32-arm64-msvc": "4.57.1",
-        "@rollup/rollup-win32-ia32-msvc": "4.57.1",
-        "@rollup/rollup-win32-x64-gnu": "4.57.1",
-        "@rollup/rollup-win32-x64-msvc": "4.57.1",
-        "fsevents": "~2.3.2"
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/rou3": {
-      "version": "0.7.12",
-      "resolved": "https://registry.npmjs.org/rou3/-/rou3-0.7.12.tgz",
-      "integrity": "sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==",
+    "node_modules/strnum": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
+      "integrity": "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
       "license": "MIT"
     },
-    "node_modules/router": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
-      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
+    "node_modules/superstruct": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/superstruct/-/superstruct-2.0.2.tgz",
+      "integrity": "sha512-uV+TFRZdXsqXTL2pRvujROjdZQ4RAlBUS5BTh9IGm+jTqQntYThciG/qu57Gs69yjnVUSqdxF9YLmSnpupBW9A==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "debug": "^4.4.0",
-        "depd": "^2.0.0",
-        "is-promise": "^4.0.0",
-        "parseurl": "^1.3.3",
-        "path-to-regexp": "^8.0.0"
+        "has-flag": "^4.0.0"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">=8"
       }
     },
-    "node_modules/sade": {
-      "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
-      "integrity": "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==",
+    "node_modules/supports-preserve-symlinks-flag": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
       "dev": true,
       "license": "MIT",
+      "engines": {
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
+    "node_modules/svelte": {
+      "version": "5.53.5",
+      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.53.5.tgz",
+      "integrity": "sha512-YkqERnF05g8KLdDZwZrF8/i1eSbj6Eoat8Jjr2IfruZz9StLuBqo8sfCSzjosNKd+ZrQ8DkKZDjpO5y3ht1Pow==",
+      "devOptional": true,
+      "license": "MIT",
       "dependencies": {
-        "mri": "^1.1.0"
+        "@jridgewell/remapping": "^2.3.4",
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@sveltejs/acorn-typescript": "^1.0.5",
+        "@types/estree": "^1.0.5",
+        "@types/trusted-types": "^2.0.7",
+        "acorn": "^8.12.1",
+        "aria-query": "5.3.1",
+        "axobject-query": "^4.1.0",
+        "clsx": "^2.1.1",
+        "devalue": "^5.6.3",
+        "esm-env": "^1.2.1",
+        "esrap": "^2.2.2",
+        "is-reference": "^3.0.3",
+        "locate-character": "^3.0.0",
+        "magic-string": "^0.30.11",
+        "zimmerframe": "^1.1.2"
       },
       "engines": {
-        "node": ">=6"
+        "node": ">=18"
       }
     },
-    "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/safe-regex": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-2.1.1.tgz",
-      "integrity": "sha512-rx+x8AMzKb5Q5lQ95Zoi6ZbJqwCLkqi3XuJXp5P3rT8OEc6sZCJG5AE5dU3lsgRr/F4Bs31jSlVN+j5KrsGu9A==",
+    "node_modules/svelte-check": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/svelte-check/-/svelte-check-4.4.3.tgz",
+      "integrity": "sha512-4HtdEv2hOoLCEsSXI+RDELk9okP/4sImWa7X02OjMFFOWeSdFF3NFy3vqpw0z+eH9C88J9vxZfUXz/Uv2A1ANw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "regexp-tree": "~0.1.1"
+        "@jridgewell/trace-mapping": "^0.3.25",
+        "chokidar": "^4.0.1",
+        "fdir": "^6.2.0",
+        "picocolors": "^1.0.0",
+        "sade": "^1.7.4"
+      },
+      "bin": {
+        "svelte-check": "bin/svelte-check"
+      },
+      "engines": {
+        "node": ">= 18.0.0"
+      },
+      "peerDependencies": {
+        "svelte": "^4.0.0 || ^5.0.0-next.0",
+        "typescript": ">=5.0.0"
       }
     },
-    "node_modules/safe-stable-stringify": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
-      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+    "node_modules/svelte-eslint-parser": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-1.4.1.tgz",
+      "integrity": "sha512-1eqkfQ93goAhjAXxZiu1SaKI9+0/sxp4JIWQwUpsz7ybehRE5L8dNuz7Iry7K22R47p5/+s9EM+38nHV2OlgXA==",
+      "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "eslint-scope": "^8.2.0",
+        "eslint-visitor-keys": "^4.0.0",
+        "espree": "^10.0.0",
+        "postcss": "^8.4.49",
+        "postcss-scss": "^4.0.9",
+        "postcss-selector-parser": "^7.0.0"
+      },
       "engines": {
-        "node": ">=10"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0",
+        "pnpm": "10.24.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ota-meshi"
+      },
+      "peerDependencies": {
+        "svelte": "^3.37.0 || ^4.0.0 || ^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "svelte": {
+          "optional": true
+        }
       }
     },
-    "node_modules/safer-buffer": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
-    },
-    "node_modules/scheduler": {
-      "version": "0.27.0",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
-      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/schemes": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/schemes/-/schemes-1.4.0.tgz",
-      "integrity": "sha512-ImFy9FbCsQlVgnE3TCWmLPCFnVzx0lHL/l+umHplDqAKd0dzFpnS6lFZIpagBlYhKwzVmlV36ec0Y1XTu8JBAQ==",
-      "dev": true,
+    "node_modules/svelte/node_modules/is-reference": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
+      "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "extend": "^3.0.0"
+        "@types/estree": "^1.0.6"
       }
     },
-    "node_modules/secure-json-parse": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-4.1.0.tgz",
-      "integrity": "sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==",
+    "node_modules/sveltekit-superforms": {
+      "version": "2.30.0",
+      "resolved": "https://registry.npmjs.org/sveltekit-superforms/-/sveltekit-superforms-2.30.0.tgz",
+      "integrity": "sha512-EzXD7sHbi7yBU/eNtzVm6P6axcrVM8BArkbiT96Vdx48s5m4KXte/tbbp3UULtEW8Nk9wt2hYkGeq7nDBwVceg==",
       "dev": true,
       "funding": [
         {
           "type": "github",
-          "url": "https://github.com/sponsors/fastify"
+          "url": "https://github.com/sponsors/ciscoheat"
         },
         {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
+          "type": "ko-fi",
+          "url": "https://ko-fi.com/ciscoheat"
+        },
+        {
+          "type": "paypal",
+          "url": "https://www.paypal.com/donate/?hosted_button_id=NY7F5ALHHSVQS"
         }
       ],
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
-      "dev": true,
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/send": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
-      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "debug": "^4.4.3",
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "etag": "^1.8.1",
-        "fresh": "^2.0.0",
-        "http-errors": "^2.0.1",
-        "mime-types": "^3.0.2",
-        "ms": "^2.1.3",
-        "on-finished": "^2.4.1",
-        "range-parser": "^1.2.1",
-        "statuses": "^2.0.2"
-      },
-      "engines": {
-        "node": ">= 18"
+        "devalue": "^5.6.3",
+        "memoize-weak": "^1.0.2",
+        "ts-deepmerge": "^7.0.3"
       },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/seq-queue": {
-      "version": "0.0.5",
-      "resolved": "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz",
-      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q==",
-      "peer": true
-    },
-    "node_modules/serve-static": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
-      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "encodeurl": "^2.0.0",
-        "escape-html": "^1.0.3",
-        "parseurl": "^1.3.3",
-        "send": "^1.2.0"
+      "optionalDependencies": {
+        "@exodus/schemasafe": "^1.3.0",
+        "@standard-schema/spec": "^1.0.0",
+        "@typeschema/class-validator": "^0.3.0",
+        "@valibot/to-json-schema": "^1.5.0",
+        "@vinejs/vine": "^3.0.1",
+        "arktype": "^2.1.29",
+        "class-validator": "^0.14.3",
+        "effect": "^3.19.12",
+        "joi": "^17.13.3",
+        "json-schema-to-ts": "^3.1.1",
+        "superstruct": "^2.0.2",
+        "typebox": "^1.0.62",
+        "valibot": "^1.2.0",
+        "yup": "^1.7.1",
+        "zod": "^4.1.13",
+        "zod-v3-to-json-schema": "^4.0.0"
       },
-      "engines": {
-        "node": ">= 18"
+      "peerDependencies": {
+        "@exodus/schemasafe": "^1.3.0",
+        "@sveltejs/kit": "1.x || 2.x",
+        "@typeschema/class-validator": "^0.3.0",
+        "@vinejs/vine": "^1.8.0 || ^2.0.0 || ^3.0.0",
+        "arktype": ">=2.0.0-rc.23",
+        "class-validator": "^0.14.1",
+        "effect": "^3.13.7",
+        "joi": "^17.13.1",
+        "superstruct": "^2.0.2",
+        "svelte": "3.x || 4.x || >=5.0.0-next.51",
+        "typebox": "^1.0.36",
+        "valibot": "^1.2.0",
+        "yup": "^1.4.0",
+        "zod": "^3.25.0 || ^4.0.0"
       },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+      "peerDependenciesMeta": {
+        "@exodus/schemasafe": {
+          "optional": true
+        },
+        "@typeschema/class-validator": {
+          "optional": true
+        },
+        "@vinejs/vine": {
+          "optional": true
+        },
+        "arktype": {
+          "optional": true
+        },
+        "class-validator": {
+          "optional": true
+        },
+        "effect": {
+          "optional": true
+        },
+        "joi": {
+          "optional": true
+        },
+        "superstruct": {
+          "optional": true
+        },
+        "typebox": {
+          "optional": true
+        },
+        "valibot": {
+          "optional": true
+        },
+        "yup": {
+          "optional": true
+        },
+        "zod": {
+          "optional": true
+        }
       }
     },
-    "node_modules/set-cookie-parser": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.0.1.tgz",
-      "integrity": "sha512-n7Z7dXZhJbwuAHhNzkTti6Aw9QDDjZtm3JTpTGATIdNzdQz5GuFs22w90BcvF4INfnrL5xrX3oGsuqO5Dx3A1Q==",
-      "license": "MIT"
-    },
-    "node_modules/setprototypeof": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
+    "node_modules/synckit": {
+      "version": "0.11.12",
+      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
+      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
       "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "license": "MIT",
       "dependencies": {
-        "shebang-regex": "^3.0.0"
+        "@pkgr/core": "^0.2.9"
       },
       "engines": {
-        "node": ">=8"
+        "node": "^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/synckit"
       }
     },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
+    "node_modules/tailwind-csstree": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/tailwind-csstree/-/tailwind-csstree-0.1.4.tgz",
+      "integrity": "sha512-FzD187HuFIZEyeR7Xy6sJbJll2d4SybS90satC8SKIuaNRC05CxMvdzN7BUsfDQffcnabckRM5OIcfArjsZ0mg==",
+      "dev": true,
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">=8"
+        "node": ">=18.18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
       }
     },
-    "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+    "node_modules/tailwindcss": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.2.1.tgz",
+      "integrity": "sha512-/tBrSQ36vCleJkAOsy9kbNTgaxvGbyOamC30PRePTQe/o1MFwEKHQk4Cn7BNGaPtjp+PuUrByJehM1hgxfq4sw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tapable": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
+      "integrity": "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
-        "side-channel-map": "^1.0.1",
-        "side-channel-weakmap": "^1.0.2"
-      },
       "engines": {
-        "node": ">= 0.4"
+        "node": ">=6"
       },
       "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "type": "opencollective",
+        "url": "https://opencollective.com/webpack"
       }
     },
-    "node_modules/side-channel-list": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+    "node_modules/tar": {
+      "version": "7.5.11",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.11.tgz",
+      "integrity": "sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==",
       "dev": true,
-      "license": "MIT",
+      "license": "BlueOak-1.0.0",
+      "optional": true,
       "dependencies": {
-        "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3"
+        "@isaacs/fs-minipass": "^4.0.0",
+        "chownr": "^3.0.0",
+        "minipass": "^7.1.2",
+        "minizlib": "^3.1.0",
+        "yallist": "^5.0.0"
       },
       "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "node": ">=18"
       }
     },
-    "node_modules/side-channel-map": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+    "node_modules/tar-fs": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
+      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "chownr": "^1.1.1",
+        "mkdirp-classic": "^0.5.2",
+        "pump": "^3.0.0",
+        "tar-stream": "^2.1.4"
       }
     },
-    "node_modules/side-channel-weakmap": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+    "node_modules/tar-stream": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
+      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "call-bound": "^1.0.2",
-        "es-errors": "^1.3.0",
-        "get-intrinsic": "^1.2.5",
-        "object-inspect": "^1.13.3",
-        "side-channel-map": "^1.0.1"
+        "bl": "^4.0.3",
+        "end-of-stream": "^1.4.1",
+        "fs-constants": "^1.0.0",
+        "inherits": "^2.0.3",
+        "readable-stream": "^3.1.1"
       },
       "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "node": ">=6"
       }
     },
-    "node_modules/siginfo": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
-      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
-      "devOptional": true,
-      "license": "ISC"
-    },
-    "node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "license": "ISC",
+    "node_modules/tar/node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
       "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "node": ">=18"
       }
     },
-    "node_modules/simple-concat": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/simple-get": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
-      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
+    "node_modules/tdigest": {
+      "version": "0.1.2",
+      "resolved": "https://registry.npmjs.org/tdigest/-/tdigest-0.1.2.tgz",
+      "integrity": "sha512-+G0LLgjjo9BZX2MfdvPfH+MKLCrxlXSYec5DaPYP1fe6Iyhf0/fSmJ0bFiZ1F8BT6cGXl2LpltQptzjXKWEkKA==",
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "decompress-response": "^6.0.0",
-        "once": "^1.3.1",
-        "simple-concat": "^1.0.0"
+        "bintrees": "1.0.2"
       }
     },
-    "node_modules/sirv": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
-      "integrity": "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==",
-      "devOptional": true,
+    "node_modules/thread-stream": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.0.0.tgz",
+      "integrity": "sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==",
       "license": "MIT",
       "dependencies": {
-        "@polka/url": "^1.0.0-next.24",
-        "mrmime": "^2.0.0",
-        "totalist": "^3.0.0"
+        "real-require": "^0.2.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       }
     },
-    "node_modules/smart-buffer": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+    "node_modules/tiny-case": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/tiny-case/-/tiny-case-1.0.3.tgz",
+      "integrity": "sha512-Eet/eeMhkO6TX8mnUteS9zgPbUMQa4I6Kkp5ORiBD5476/m+PIRiumP5tmh5ioJpH7k51Kehawy2UDfsnxxY8Q==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "engines": {
-        "node": ">= 6.0.0",
-        "npm": ">= 3.0.0"
-      }
+      "optional": true
     },
-    "node_modules/smtp-address-parser": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/smtp-address-parser/-/smtp-address-parser-1.1.0.tgz",
-      "integrity": "sha512-Gz11jbNU0plrReU9Sj7fmshSBxxJ9ShdD2q4ktHIHo/rpTH6lFyQoYHYKINPJtPe8aHFnsbtW46Ls0tCCBsIZg==",
+    "node_modules/tiny-inflate": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/tiny-inflate/-/tiny-inflate-1.0.3.tgz",
+      "integrity": "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw==",
       "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
+      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.15",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
+      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "nearley": "^2.20.1"
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.3"
       },
       "engines": {
-        "node": ">=0.10"
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/socks": {
-      "version": "2.8.7",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
-      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
+    "node_modules/tinyrainbow": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
+      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "ip-address": "^10.0.1",
-        "smart-buffer": "^4.2.0"
-      },
       "engines": {
-        "node": ">= 10.0.0",
-        "npm": ">= 3.0.0"
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/socks-proxy-agent": {
-      "version": "8.0.5",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
-      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
+    "node_modules/toidentifier": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "agent-base": "^7.1.2",
-        "debug": "^4.3.4",
-        "socks": "^2.8.3"
-      },
       "engines": {
-        "node": ">= 14"
+        "node": ">=0.6"
       }
     },
-    "node_modules/sonic-boom": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
-      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
+    "node_modules/toposort": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/toposort/-/toposort-2.0.2.tgz",
+      "integrity": "sha512-0a5EOkAUp8D4moMi2W8ZF8jcga7BgZd91O/yabJCFY8az+XSzeGyTKs0Aoo897iV1Nj6guFq8orWDS96z91oGg==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "atomic-sleep": "^1.0.0"
-      }
+      "optional": true
     },
-    "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+    "node_modules/totalist": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
+      "integrity": "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==",
       "devOptional": true,
-      "license": "BSD-3-Clause",
+      "license": "MIT",
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">=6"
       }
     },
-    "node_modules/sparse-bitfield": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/sparse-bitfield/-/sparse-bitfield-3.0.3.tgz",
-      "integrity": "sha512-kvzhi7vqKTfkh0PZU+2D2PIllw2ymqJKujUcyPMd9Y75Nv4nPbGJZXNhxsgdQab2BmlDct1YnfQCguEvHr7VsQ==",
+    "node_modules/tr46": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
+      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
       "license": "MIT",
       "peer": true,
       "dependencies": {
-        "memory-pager": "^1.0.2"
-      }
-    },
-    "node_modules/spdx-correct": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
-      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "spdx-expression-parse": "^3.0.0",
-        "spdx-license-ids": "^3.0.0"
+        "punycode": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/spdx-exceptions": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
-      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
+    "node_modules/ts-algebra": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
+      "integrity": "sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==",
       "dev": true,
-      "license": "CC-BY-3.0"
+      "license": "MIT",
+      "optional": true
     },
-    "node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+    "node_modules/ts-api-utils": {
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.4.0.tgz",
+      "integrity": "sha512-3TaVTaAv2gTiMB35i3FiGJaRfwb3Pyn/j3m/bfAvGe8FB7CF6u+LMYqYlDh7reQf7UNvoTvdfAqHGmPGOSsPmA==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
+      "engines": {
+        "node": ">=18.12"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4"
       }
     },
-    "node_modules/spdx-license-ids": {
-      "version": "3.0.23",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
-      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
+    "node_modules/ts-deepmerge": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/ts-deepmerge/-/ts-deepmerge-7.0.3.tgz",
+      "integrity": "sha512-Du/ZW2RfwV/D4cmA5rXafYjBQVuvu4qGiEEla4EmEHVHgRdx68Gftx7i66jn2bzHPwSVZY36Ae6OuDn9el4ZKA==",
       "dev": true,
-      "license": "CC0-1.0"
-    },
-    "node_modules/split2": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
-      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
       "license": "ISC",
       "engines": {
-        "node": ">= 10.x"
+        "node": ">=14.13.1"
       }
     },
-    "node_modules/sqlite-wasm-kysely": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/sqlite-wasm-kysely/-/sqlite-wasm-kysely-0.3.0.tgz",
-      "integrity": "sha512-TzjBNv7KwRw6E3pdKdlRyZiTmUIE0UttT/Sl56MVwVARl/u5gp978KepazCJZewFUnlWHz9i3NQd4kOtP/Afdg==",
+    "node_modules/tsconfig-paths": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-4.2.0.tgz",
+      "integrity": "sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==",
       "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@sqlite.org/sqlite-wasm": "^3.48.0-build2"
+        "json5": "^2.2.2",
+        "minimist": "^1.2.6",
+        "strip-bom": "^3.0.0"
       },
-      "peerDependencies": {
-        "kysely": "*"
-      }
-    },
-    "node_modules/sqlstring": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/sqlstring/-/sqlstring-2.3.3.tgz",
-      "integrity": "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==",
-      "license": "MIT",
-      "peer": true,
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=6"
       }
     },
-    "node_modules/ssri": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
-      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
+    "node_modules/tsconfig-paths-webpack-plugin": {
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/tsconfig-paths-webpack-plugin/-/tsconfig-paths-webpack-plugin-4.2.0.tgz",
+      "integrity": "sha512-zbem3rfRS8BgeNK50Zz5SIQgXzLafiHjOwUAvk/38/o1jHn/V5QAgVUcz884or7WYcPaH3N2CIfUc2u0ul7UcA==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
+      "license": "MIT",
       "dependencies": {
-        "minipass": "^7.0.3"
+        "chalk": "^4.1.0",
+        "enhanced-resolve": "^5.7.0",
+        "tapable": "^2.2.1",
+        "tsconfig-paths": "^4.1.2"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": ">=10.13.0"
       }
     },
-    "node_modules/stackback": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
-      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+    "node_modules/tslib": {
+      "version": "2.8.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
+      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
+      "license": "0BSD"
+    },
+    "node_modules/tsx": {
+      "version": "4.22.4",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
+      "integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
       "devOptional": true,
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "~0.28.0"
+      },
+      "bin": {
+        "tsx": "dist/cli.mjs"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      }
     },
-    "node_modules/statuses": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/android-arm": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
+      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
+      "cpu": [
+        "arm"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=18"
       }
     },
-    "node_modules/std-env": {
-      "version": "3.10.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
-      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
-      "license": "MIT"
+    "node_modules/tsx/node_modules/@esbuild/android-arm64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
+      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/stream-browserify": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/stream-browserify/-/stream-browserify-3.0.0.tgz",
-      "integrity": "sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==",
+    "node_modules/tsx/node_modules/@esbuild/android-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
+      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "inherits": "~2.0.4",
-        "readable-stream": "^3.5.0"
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/tsx/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
+      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/string_decoder": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+    "node_modules/tsx/node_modules/@esbuild/darwin-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
+      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "~5.2.0"
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/string_decoder/node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
+    "node_modules/tsx/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
+      "cpu": [
+        "arm64"
       ],
-      "license": "MIT"
-    },
-    "node_modules/string-width": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
-      "dev": true,
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=18"
       }
     },
-    "node_modules/string-width-cjs": {
-      "name": "string-width",
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
+      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
-    "node_modules/string-width-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-arm": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
+      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
+      "cpu": [
+        "arm"
+      ],
       "license": "MIT",
       "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
-    "node_modules/string-width-cjs/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-arm64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
+      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/string-width-cjs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-ia32": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
+      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
+      "cpu": [
+        "ia32"
+      ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
-    "node_modules/stringtemplate4ts": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/stringtemplate4ts/-/stringtemplate4ts-1.0.9.tgz",
-      "integrity": "sha512-KYZm2bJlSjynG5Y+L46fkaKBQG6mhV6hb2RBA8dpx3/Vj6G4u7gwXNKYvaN9+QD5sj68/1srtSNDvqEso7MwsQ==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-loong64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
+      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
+      "cpu": [
+        "loong64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "antlr4ng": "3.0.15",
-        "fast-printf": "1.6.10",
-        "he": "1.2.0",
-        "luxon": "3.5.0"
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/stringtemplate4ts/node_modules/antlr4ng": {
-      "version": "3.0.15",
-      "resolved": "https://registry.npmjs.org/antlr4ng/-/antlr4ng-3.0.15.tgz",
-      "integrity": "sha512-VELFqTfcpGI2bj6ScMWuxM3FI6HOsojrgmnw3cCbUtsQ1DNOq32wJsjOt7vLvfIniyyuE1DIYegGcuFmn+jgyw==",
-      "dev": true,
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/strip-ansi": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
+      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
+      "cpu": [
+        "mips64el"
+      ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "ansi-regex": "^6.2.2"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+        "node": ">=18"
       }
     },
-    "node_modules/strip-ansi-cjs": {
-      "name": "strip-ansi",
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
+      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
+      "cpu": [
+        "ppc64"
+      ],
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
-    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
+      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
+      "cpu": [
+        "riscv64"
+      ],
       "license": "MIT",
       "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
-    "node_modules/strip-bom": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-s390x": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
+      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
+      "cpu": [
+        "s390x"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=4"
+        "node": ">=18"
       }
     },
-    "node_modules/strip-json-comments": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/linux-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
+      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=8"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=18"
       }
     },
-    "node_modules/strnum": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
-      "integrity": "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
+    "node_modules/tsx/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
+      "cpu": [
+        "x64"
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/superstruct": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/superstruct/-/superstruct-2.0.2.tgz",
-      "integrity": "sha512-uV+TFRZdXsqXTL2pRvujROjdZQ4RAlBUS5BTh9IGm+jTqQntYThciG/qu57Gs69yjnVUSqdxF9YLmSnpupBW9A==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
       "optional": true,
+      "os": [
+        "openbsd"
+      ],
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/sunos-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
+      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
-    "node_modules/supports-preserve-symlinks-flag": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/win32-arm64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
+      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "node": ">=18"
       }
     },
-    "node_modules/svelte": {
-      "version": "5.53.5",
-      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.53.5.tgz",
-      "integrity": "sha512-YkqERnF05g8KLdDZwZrF8/i1eSbj6Eoat8Jjr2IfruZz9StLuBqo8sfCSzjosNKd+ZrQ8DkKZDjpO5y3ht1Pow==",
-      "devOptional": true,
+    "node_modules/tsx/node_modules/@esbuild/win32-ia32": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
+      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
+      "cpu": [
+        "ia32"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/remapping": "^2.3.4",
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@sveltejs/acorn-typescript": "^1.0.5",
-        "@types/estree": "^1.0.5",
-        "@types/trusted-types": "^2.0.7",
-        "acorn": "^8.12.1",
-        "aria-query": "5.3.1",
-        "axobject-query": "^4.1.0",
-        "clsx": "^2.1.1",
-        "devalue": "^5.6.3",
-        "esm-env": "^1.2.1",
-        "esrap": "^2.2.2",
-        "is-reference": "^3.0.3",
-        "locate-character": "^3.0.0",
-        "magic-string": "^0.30.11",
-        "zimmerframe": "^1.1.2"
-      },
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
         "node": ">=18"
       }
     },
-    "node_modules/svelte-check": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/svelte-check/-/svelte-check-4.4.3.tgz",
-      "integrity": "sha512-4HtdEv2hOoLCEsSXI+RDELk9okP/4sImWa7X02OjMFFOWeSdFF3NFy3vqpw0z+eH9C88J9vxZfUXz/Uv2A1ANw==",
-      "dev": true,
+    "node_modules/tsx/node_modules/@esbuild/win32-x64": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
+      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.25",
-        "chokidar": "^4.0.1",
-        "fdir": "^6.2.0",
-        "picocolors": "^1.0.0",
-        "sade": "^1.7.4"
-      },
-      "bin": {
-        "svelte-check": "bin/svelte-check"
-      },
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">= 18.0.0"
-      },
-      "peerDependencies": {
-        "svelte": "^4.0.0 || ^5.0.0-next.0",
-        "typescript": ">=5.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/svelte-eslint-parser": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-1.4.1.tgz",
-      "integrity": "sha512-1eqkfQ93goAhjAXxZiu1SaKI9+0/sxp4JIWQwUpsz7ybehRE5L8dNuz7Iry7K22R47p5/+s9EM+38nHV2OlgXA==",
-      "dev": true,
+    "node_modules/tsx/node_modules/esbuild": {
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
+      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
+      "devOptional": true,
+      "hasInstallScript": true,
       "license": "MIT",
-      "dependencies": {
-        "eslint-scope": "^8.2.0",
-        "eslint-visitor-keys": "^4.0.0",
-        "espree": "^10.0.0",
-        "postcss": "^8.4.49",
-        "postcss-scss": "^4.0.9",
-        "postcss-selector-parser": "^7.0.0"
+      "bin": {
+        "esbuild": "bin/esbuild"
       },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0",
-        "pnpm": "10.24.0"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ota-meshi"
-      },
-      "peerDependencies": {
-        "svelte": "^3.37.0 || ^4.0.0 || ^5.0.0"
+        "node": ">=18"
       },
-      "peerDependenciesMeta": {
-        "svelte": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/svelte/node_modules/is-reference": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
-      "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
-      "devOptional": true,
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.28.0",
+        "@esbuild/android-arm": "0.28.0",
+        "@esbuild/android-arm64": "0.28.0",
+        "@esbuild/android-x64": "0.28.0",
+        "@esbuild/darwin-arm64": "0.28.0",
+        "@esbuild/darwin-x64": "0.28.0",
+        "@esbuild/freebsd-arm64": "0.28.0",
+        "@esbuild/freebsd-x64": "0.28.0",
+        "@esbuild/linux-arm": "0.28.0",
+        "@esbuild/linux-arm64": "0.28.0",
+        "@esbuild/linux-ia32": "0.28.0",
+        "@esbuild/linux-loong64": "0.28.0",
+        "@esbuild/linux-mips64el": "0.28.0",
+        "@esbuild/linux-ppc64": "0.28.0",
+        "@esbuild/linux-riscv64": "0.28.0",
+        "@esbuild/linux-s390x": "0.28.0",
+        "@esbuild/linux-x64": "0.28.0",
+        "@esbuild/netbsd-arm64": "0.28.0",
+        "@esbuild/netbsd-x64": "0.28.0",
+        "@esbuild/openbsd-arm64": "0.28.0",
+        "@esbuild/openbsd-x64": "0.28.0",
+        "@esbuild/openharmony-arm64": "0.28.0",
+        "@esbuild/sunos-x64": "0.28.0",
+        "@esbuild/win32-arm64": "0.28.0",
+        "@esbuild/win32-ia32": "0.28.0",
+        "@esbuild/win32-x64": "0.28.0"
+      }
+    },
+    "node_modules/tsx/node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "hasInstallScript": true,
       "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.6"
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
       }
     },
-    "node_modules/sveltekit-superforms": {
-      "version": "2.30.0",
-      "resolved": "https://registry.npmjs.org/sveltekit-superforms/-/sveltekit-superforms-2.30.0.tgz",
-      "integrity": "sha512-EzXD7sHbi7yBU/eNtzVm6P6axcrVM8BArkbiT96Vdx48s5m4KXte/tbbp3UULtEW8Nk9wt2hYkGeq7nDBwVceg==",
+    "node_modules/tunnel-agent": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
+      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
       "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ciscoheat"
-        },
-        {
-          "type": "ko-fi",
-          "url": "https://ko-fi.com/ciscoheat"
-        },
-        {
-          "type": "paypal",
-          "url": "https://www.paypal.com/donate/?hosted_button_id=NY7F5ALHHSVQS"
-        }
-      ],
-      "license": "MIT",
+      "license": "Apache-2.0",
+      "optional": true,
       "dependencies": {
-        "devalue": "^5.6.3",
-        "memoize-weak": "^1.0.2",
-        "ts-deepmerge": "^7.0.3"
-      },
-      "optionalDependencies": {
-        "@exodus/schemasafe": "^1.3.0",
-        "@standard-schema/spec": "^1.0.0",
-        "@typeschema/class-validator": "^0.3.0",
-        "@valibot/to-json-schema": "^1.5.0",
-        "@vinejs/vine": "^3.0.1",
-        "arktype": "^2.1.29",
-        "class-validator": "^0.14.3",
-        "effect": "^3.19.12",
-        "joi": "^17.13.3",
-        "json-schema-to-ts": "^3.1.1",
-        "superstruct": "^2.0.2",
-        "typebox": "^1.0.62",
-        "valibot": "^1.2.0",
-        "yup": "^1.7.1",
-        "zod": "^4.1.13",
-        "zod-v3-to-json-schema": "^4.0.0"
-      },
-      "peerDependencies": {
-        "@exodus/schemasafe": "^1.3.0",
-        "@sveltejs/kit": "1.x || 2.x",
-        "@typeschema/class-validator": "^0.3.0",
-        "@vinejs/vine": "^1.8.0 || ^2.0.0 || ^3.0.0",
-        "arktype": ">=2.0.0-rc.23",
-        "class-validator": "^0.14.1",
-        "effect": "^3.13.7",
-        "joi": "^17.13.1",
-        "superstruct": "^2.0.2",
-        "svelte": "3.x || 4.x || >=5.0.0-next.51",
-        "typebox": "^1.0.36",
-        "valibot": "^1.2.0",
-        "yup": "^1.4.0",
-        "zod": "^3.25.0 || ^4.0.0"
+        "safe-buffer": "^5.0.1"
       },
-      "peerDependenciesMeta": {
-        "@exodus/schemasafe": {
-          "optional": true
-        },
-        "@typeschema/class-validator": {
-          "optional": true
-        },
-        "@vinejs/vine": {
-          "optional": true
-        },
-        "arktype": {
-          "optional": true
-        },
-        "class-validator": {
-          "optional": true
-        },
-        "effect": {
-          "optional": true
-        },
-        "joi": {
-          "optional": true
-        },
-        "superstruct": {
-          "optional": true
-        },
-        "typebox": {
-          "optional": true
-        },
-        "valibot": {
-          "optional": true
-        },
-        "yup": {
-          "optional": true
-        },
-        "zod": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/synckit": {
-      "version": "0.11.12",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
-      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@pkgr/core": "^0.2.9"
+        "prelude-ls": "^1.2.1"
       },
       "engines": {
-        "node": "^14.18.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/synckit"
+        "node": ">= 0.8.0"
       }
     },
-    "node_modules/tailwind-csstree": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/tailwind-csstree/-/tailwind-csstree-0.1.4.tgz",
-      "integrity": "sha512-FzD187HuFIZEyeR7Xy6sJbJll2d4SybS90satC8SKIuaNRC05CxMvdzN7BUsfDQffcnabckRM5OIcfArjsZ0mg==",
+    "node_modules/type-fest": {
+      "version": "2.19.0",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-2.19.0.tgz",
+      "integrity": "sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==",
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "(MIT OR CC0-1.0)",
+      "optional": true,
       "engines": {
-        "node": ">=18.18"
+        "node": ">=12.20"
       },
       "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/tailwindcss": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.2.1.tgz",
-      "integrity": "sha512-/tBrSQ36vCleJkAOsy9kbNTgaxvGbyOamC30PRePTQe/o1MFwEKHQk4Cn7BNGaPtjp+PuUrByJehM1hgxfq4sw==",
+    "node_modules/type-is": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
+      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "dependencies": {
+        "content-type": "^1.0.5",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
     },
-    "node_modules/tapable": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
-      "integrity": "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==",
+    "node_modules/typebox": {
+      "version": "1.0.81",
+      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.0.81.tgz",
+      "integrity": "sha512-bCslZUmZESHhBn4kHDghzH2oo3qu8m2W89xDLxQHv/aPvY4i81Nd1jvijlBp9wSpsVytDSfSoosbiBAjgsNb2Q==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/typescript-eslint": {
+      "version": "8.56.1",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.56.1.tgz",
+      "integrity": "sha512-U4lM6pjmBX7J5wk4szltF7I1cGBHXZopnAXCMXb3+fZ3B/0Z3hq3wS/CCUB2NZBNAExK92mCU2tEohWuwVMsDQ==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "@typescript-eslint/eslint-plugin": "8.56.1",
+        "@typescript-eslint/parser": "8.56.1",
+        "@typescript-eslint/typescript-estree": "8.56.1",
+        "@typescript-eslint/utils": "8.56.1"
+      },
       "engines": {
-        "node": ">=6"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
         "type": "opencollective",
-        "url": "https://opencollective.com/webpack"
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
-    "node_modules/tar": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.11.tgz",
-      "integrity": "sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==",
+    "node_modules/ufo": {
+      "version": "1.6.4",
+      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.4.tgz",
+      "integrity": "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true,
-      "dependencies": {
-        "@isaacs/fs-minipass": "^4.0.0",
-        "chownr": "^3.0.0",
-        "minipass": "^7.1.2",
-        "minizlib": "^3.1.0",
-        "yallist": "^5.0.0"
-      },
+      "license": "MIT"
+    },
+    "node_modules/undici": {
+      "version": "7.24.4",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.4.tgz",
+      "integrity": "sha512-BM/JzwwaRXxrLdElV2Uo6cTLEjhSb3WXboncJamZ15NgUURmvlXvxa6xkwIOILIjPNo9i8ku136ZvWV0Uly8+w==",
+      "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": ">=20.18.1"
       }
     },
-    "node_modules/tar-fs": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
-      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
+    "node_modules/undici-types": {
+      "version": "7.16.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
+      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/unicode-properties": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/unicode-properties/-/unicode-properties-1.4.1.tgz",
+      "integrity": "sha512-CLjCCLQ6UuMxWnbIylkisbRj31qxHPAurvena/0iwSVbQ2G1VY5/HjV0IRabOEbDHlzZlRdCrD4NhB0JtU40Pg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "chownr": "^1.1.1",
-        "mkdirp-classic": "^0.5.2",
-        "pump": "^3.0.0",
-        "tar-stream": "^2.1.4"
+        "base64-js": "^1.3.0",
+        "unicode-trie": "^2.0.0"
       }
     },
-    "node_modules/tar-stream": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+    "node_modules/unicode-trie": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/unicode-trie/-/unicode-trie-2.0.0.tgz",
+      "integrity": "sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "pako": "^0.2.5",
+        "tiny-inflate": "^1.0.0"
+      }
+    },
+    "node_modules/unique-filename": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
+      "integrity": "sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==",
+      "dev": true,
+      "license": "ISC",
       "optional": true,
       "dependencies": {
-        "bl": "^4.0.3",
-        "end-of-stream": "^1.4.1",
-        "fs-constants": "^1.0.0",
-        "inherits": "^2.0.3",
-        "readable-stream": "^3.1.1"
+        "unique-slug": "^5.0.0"
       },
       "engines": {
-        "node": ">=6"
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/tar/node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+    "node_modules/unique-slug": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-5.0.0.tgz",
+      "integrity": "sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
+      "license": "ISC",
       "optional": true,
+      "dependencies": {
+        "imurmurhash": "^0.1.4"
+      },
       "engines": {
-        "node": ">=18"
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/tdigest": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/tdigest/-/tdigest-0.1.2.tgz",
-      "integrity": "sha512-+G0LLgjjo9BZX2MfdvPfH+MKLCrxlXSYec5DaPYP1fe6Iyhf0/fSmJ0bFiZ1F8BT6cGXl2LpltQptzjXKWEkKA==",
+    "node_modules/unpipe": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "bintrees": "1.0.2"
+      "engines": {
+        "node": ">= 0.8"
       }
     },
-    "node_modules/thread-stream": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.0.0.tgz",
-      "integrity": "sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==",
+    "node_modules/unplugin": {
+      "version": "2.3.11",
+      "resolved": "https://registry.npmjs.org/unplugin/-/unplugin-2.3.11.tgz",
+      "integrity": "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "real-require": "^0.2.0"
+        "@jridgewell/remapping": "^2.3.5",
+        "acorn": "^8.15.0",
+        "picomatch": "^4.0.3",
+        "webpack-virtual-modules": "^0.6.2"
       },
       "engines": {
-        "node": ">=20"
+        "node": ">=18.12.0"
       }
     },
-    "node_modules/tiny-case": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tiny-case/-/tiny-case-1.0.3.tgz",
-      "integrity": "sha512-Eet/eeMhkO6TX8mnUteS9zgPbUMQa4I6Kkp5ORiBD5476/m+PIRiumP5tmh5ioJpH7k51Kehawy2UDfsnxxY8Q==",
+    "node_modules/unplugin-icons": {
+      "version": "23.0.1",
+      "resolved": "https://registry.npmjs.org/unplugin-icons/-/unplugin-icons-23.0.1.tgz",
+      "integrity": "sha512-rv0XEJepajKzDLvRUWASM8K+8+/CCfZn2jtogXqg6RIp7kpatRc/aFrVJn8ANQA09e++lPEEv9yX8cC9enc+QQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@antfu/install-pkg": "^1.1.0",
+        "@iconify/utils": "^3.1.0",
+        "local-pkg": "^1.1.2",
+        "obug": "^2.1.1",
+        "unplugin": "^2.3.11"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      },
+      "peerDependencies": {
+        "@svgr/core": ">=7.0.0",
+        "@svgx/core": "^1.0.1",
+        "@vue/compiler-sfc": "^3.0.2",
+        "svelte": "^3.0.0 || ^4.0.0 || ^5.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@svgr/core": {
+          "optional": true
+        },
+        "@svgx/core": {
+          "optional": true
+        },
+        "@vue/compiler-sfc": {
+          "optional": true
+        },
+        "svelte": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
     },
-    "node_modules/tiny-inflate": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tiny-inflate/-/tiny-inflate-1.0.3.tgz",
-      "integrity": "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw==",
+    "node_modules/urlpattern-polyfill": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/urlpattern-polyfill/-/urlpattern-polyfill-10.1.0.tgz",
+      "integrity": "sha512-IGjKp/o0NL3Bso1PymYURCJxMPNAf/ILOpendP9f5B6e1rTJgdgiOvgfoT8VxCAdY+Wisb9uhGaJJf3yZ2V9nw==",
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/tinybench": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
-      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
-      "devOptional": true,
+    "node_modules/util-deprecate": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
-    "node_modules/tinyexec": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+    "node_modules/uuid": {
+      "version": "13.0.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.2.tgz",
+      "integrity": "sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
       "license": "MIT",
-      "engines": {
-        "node": ">=18"
+      "bin": {
+        "uuid": "dist-node/bin/uuid"
       }
     },
-    "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
-      "devOptional": true,
+    "node_modules/valibot": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
+      "integrity": "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==",
       "license": "MIT",
-      "dependencies": {
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
-      },
-      "engines": {
-        "node": ">=12.0.0"
+      "peerDependencies": {
+        "typescript": ">=5"
       },
-      "funding": {
-        "url": "https://github.com/sponsors/SuperchupuDev"
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
       }
     },
-    "node_modules/tinyrainbow": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
-      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
+    "node_modules/validate-npm-package-license": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
+      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "spdx-correct": "^3.0.0",
+        "spdx-expression-parse": "^3.0.0"
       }
     },
-    "node_modules/toidentifier": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+    "node_modules/validator": {
+      "version": "13.15.26",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
+      "integrity": "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
-        "node": ">=0.6"
+        "node": ">= 0.10"
       }
     },
-    "node_modules/toposort": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/toposort/-/toposort-2.0.2.tgz",
-      "integrity": "sha512-0a5EOkAUp8D4moMi2W8ZF8jcga7BgZd91O/yabJCFY8az+XSzeGyTKs0Aoo897iV1Nj6guFq8orWDS96z91oGg==",
+    "node_modules/vary": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "dev": true,
       "license": "MIT",
-      "optional": true
+      "engines": {
+        "node": ">= 0.8"
+      }
     },
-    "node_modules/totalist": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
-      "integrity": "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==",
+    "node_modules/vite": {
+      "version": "7.3.1",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
+      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
       "devOptional": true,
       "license": "MIT",
+      "dependencies": {
+        "esbuild": "^0.27.0",
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.3",
+        "postcss": "^8.5.6",
+        "rollup": "^4.43.0",
+        "tinyglobby": "^0.2.15"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
       "engines": {
-        "node": ">=6"
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "lightningcss": "^1.21.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "lightningcss": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
       }
     },
-    "node_modules/tr46": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
-      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
+    "node_modules/vite/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
+      "integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",
+      "cpu": [
+        "ppc64"
+      ],
       "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "punycode": "^2.3.1"
-      },
+      "optional": true,
+      "os": [
+        "aix"
+      ],
       "engines": {
         "node": ">=18"
       }
     },
-    "node_modules/ts-algebra": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
-      "integrity": "sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/android-arm": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",
+      "integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",
+      "cpu": [
+        "arm"
+      ],
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/ts-api-utils": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.4.0.tgz",
-      "integrity": "sha512-3TaVTaAv2gTiMB35i3FiGJaRfwb3Pyn/j3m/bfAvGe8FB7CF6u+LMYqYlDh7reQf7UNvoTvdfAqHGmPGOSsPmA==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/android-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",
+      "integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=18.12"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4"
+        "node": ">=18"
       }
     },
-    "node_modules/ts-deepmerge": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/ts-deepmerge/-/ts-deepmerge-7.0.3.tgz",
-      "integrity": "sha512-Du/ZW2RfwV/D4cmA5rXafYjBQVuvu4qGiEEla4EmEHVHgRdx68Gftx7i66jn2bzHPwSVZY36Ae6OuDn9el4ZKA==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/vite/node_modules/@esbuild/android-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",
+      "integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": ">=14.13.1"
+        "node": ">=18"
       }
     },
-    "node_modules/tsconfig-paths": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-4.2.0.tgz",
-      "integrity": "sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/darwin-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",
+      "integrity": "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "json5": "^2.2.2",
-        "minimist": "^1.2.6",
-        "strip-bom": "^3.0.0"
-      },
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=6"
+        "node": ">=18"
       }
     },
-    "node_modules/tsconfig-paths-webpack-plugin": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths-webpack-plugin/-/tsconfig-paths-webpack-plugin-4.2.0.tgz",
-      "integrity": "sha512-zbem3rfRS8BgeNK50Zz5SIQgXzLafiHjOwUAvk/38/o1jHn/V5QAgVUcz884or7WYcPaH3N2CIfUc2u0ul7UcA==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/darwin-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",
+      "integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "chalk": "^4.1.0",
-        "enhanced-resolve": "^5.7.0",
-        "tapable": "^2.2.1",
-        "tsconfig-paths": "^4.1.2"
-      },
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": ">=10.13.0"
+        "node": ">=18"
       }
     },
-    "node_modules/tslib": {
-      "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
-      "license": "0BSD"
-    },
-    "node_modules/tunnel-agent": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/vite/node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "safe-buffer": "^5.0.1"
-      },
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": "*"
+        "node": ">=18"
       }
     },
-    "node_modules/type-check": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/freebsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",
+      "integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "prelude-ls": "^1.2.1"
-      },
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": ">= 0.8.0"
+        "node": ">=18"
       }
     },
-    "node_modules/type-fest": {
-      "version": "2.19.0",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-2.19.0.tgz",
-      "integrity": "sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==",
-      "dev": true,
-      "license": "(MIT OR CC0-1.0)",
+    "node_modules/vite/node_modules/@esbuild/linux-arm": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",
+      "integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
       "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=12.20"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=18"
       }
     },
-    "node_modules/type-is": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
-      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/linux-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",
+      "integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "content-type": "^1.0.5",
-        "media-typer": "^1.1.0",
-        "mime-types": "^3.0.0"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
       }
     },
-    "node_modules/typebox": {
-      "version": "1.0.81",
-      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.0.81.tgz",
-      "integrity": "sha512-bCslZUmZESHhBn4kHDghzH2oo3qu8m2W89xDLxQHv/aPvY4i81Nd1jvijlBp9wSpsVytDSfSoosbiBAjgsNb2Q==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/linux-ia32": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",
+      "integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",
+      "cpu": [
+        "ia32"
+      ],
       "license": "MIT",
-      "optional": true
-    },
-    "node_modules/typescript": {
-      "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "devOptional": true,
-      "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=14.17"
+        "node": ">=18"
       }
     },
-    "node_modules/typescript-eslint": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.56.1.tgz",
-      "integrity": "sha512-U4lM6pjmBX7J5wk4szltF7I1cGBHXZopnAXCMXb3+fZ3B/0Z3hq3wS/CCUB2NZBNAExK92mCU2tEohWuwVMsDQ==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/linux-loong64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",
+      "integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",
+      "cpu": [
+        "loong64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.56.1",
-        "@typescript-eslint/parser": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/ufo": {
-      "version": "1.6.4",
-      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.4.tgz",
-      "integrity": "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/undici": {
-      "version": "7.24.4",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.4.tgz",
-      "integrity": "sha512-BM/JzwwaRXxrLdElV2Uo6cTLEjhSb3WXboncJamZ15NgUURmvlXvxa6xkwIOILIjPNo9i8ku136ZvWV0Uly8+w==",
+    "node_modules/vite/node_modules/@esbuild/linux-mips64el": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",
+      "integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",
+      "cpu": [
+        "mips64el"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=20.18.1"
+        "node": ">=18"
       }
     },
-    "node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
-      "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/unicode-properties": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/unicode-properties/-/unicode-properties-1.4.1.tgz",
-      "integrity": "sha512-CLjCCLQ6UuMxWnbIylkisbRj31qxHPAurvena/0iwSVbQ2G1VY5/HjV0IRabOEbDHlzZlRdCrD4NhB0JtU40Pg==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/linux-ppc64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",
+      "integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",
+      "cpu": [
+        "ppc64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "base64-js": "^1.3.0",
-        "unicode-trie": "^2.0.0"
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/unicode-trie": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/unicode-trie/-/unicode-trie-2.0.0.tgz",
-      "integrity": "sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/linux-riscv64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",
+      "integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",
+      "cpu": [
+        "riscv64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "pako": "^0.2.5",
-        "tiny-inflate": "^1.0.0"
-      }
-    },
-    "node_modules/unique-filename": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
-      "integrity": "sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==",
-      "dev": true,
-      "license": "ISC",
       "optional": true,
-      "dependencies": {
-        "unique-slug": "^5.0.0"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": ">=18"
       }
     },
-    "node_modules/unique-slug": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-5.0.0.tgz",
-      "integrity": "sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==",
-      "dev": true,
-      "license": "ISC",
+    "node_modules/vite/node_modules/@esbuild/linux-s390x": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",
+      "integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "imurmurhash": "^0.1.4"
-      },
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": ">=18"
       }
     },
-    "node_modules/unpipe": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/linux-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
+      "integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=18"
       }
     },
-    "node_modules/unplugin": {
-      "version": "2.3.11",
-      "resolved": "https://registry.npmjs.org/unplugin/-/unplugin-2.3.11.tgz",
-      "integrity": "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/remapping": "^2.3.5",
-        "acorn": "^8.15.0",
-        "picomatch": "^4.0.3",
-        "webpack-virtual-modules": "^0.6.2"
-      },
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
       "engines": {
-        "node": ">=18.12.0"
+        "node": ">=18"
       }
     },
-    "node_modules/unplugin-icons": {
-      "version": "23.0.1",
-      "resolved": "https://registry.npmjs.org/unplugin-icons/-/unplugin-icons-23.0.1.tgz",
-      "integrity": "sha512-rv0XEJepajKzDLvRUWASM8K+8+/CCfZn2jtogXqg6RIp7kpatRc/aFrVJn8ANQA09e++lPEEv9yX8cC9enc+QQ==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/netbsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@antfu/install-pkg": "^1.1.0",
-        "@iconify/utils": "^3.1.0",
-        "local-pkg": "^1.1.2",
-        "obug": "^2.1.1",
-        "unplugin": "^2.3.11"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/antfu"
-      },
-      "peerDependencies": {
-        "@svgr/core": ">=7.0.0",
-        "@svgx/core": "^1.0.1",
-        "@vue/compiler-sfc": "^3.0.2",
-        "svelte": "^3.0.0 || ^4.0.0 || ^5.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@svgr/core": {
-          "optional": true
-        },
-        "@svgx/core": {
-          "optional": true
-        },
-        "@vue/compiler-sfc": {
-          "optional": true
-        },
-        "svelte": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/uri-js": {
-      "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
-      "dev": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "punycode": "^2.1.0"
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/urlpattern-polyfill": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/urlpattern-polyfill/-/urlpattern-polyfill-10.1.0.tgz",
-      "integrity": "sha512-IGjKp/o0NL3Bso1PymYURCJxMPNAf/ILOpendP9f5B6e1rTJgdgiOvgfoT8VxCAdY+Wisb9uhGaJJf3yZ2V9nw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "license": "MIT"
-    },
-    "node_modules/uuid": {
-      "version": "13.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.1.tgz",
-      "integrity": "sha512-9ezox2roIft6ExBVTVqibSd5dc5/47Sw/uY6b4SjQUT2TzQ0tltNquWA46y4xPQmdZYqvnio22SgWd41M86+jw==",
-      "dev": true,
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
+    "node_modules/vite/node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",
+      "integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",
+      "cpu": [
+        "arm64"
       ],
       "license": "MIT",
-      "bin": {
-        "uuid": "dist-node/bin/uuid"
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/valibot": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
-      "integrity": "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==",
+    "node_modules/vite/node_modules/@esbuild/openbsd-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",
+      "integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "peerDependencies": {
-        "typescript": ">=5"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/validate-npm-package-license": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "spdx-correct": "^3.0.0",
-        "spdx-expression-parse": "^3.0.0"
+    "node_modules/vite/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",
+      "integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/validator": {
-      "version": "13.15.26",
-      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
-      "integrity": "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/sunos-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",
+      "integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
       "optional": true,
+      "os": [
+        "sunos"
+      ],
       "engines": {
-        "node": ">= 0.10"
+        "node": ">=18"
       }
     },
-    "node_modules/vary": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
-      "dev": true,
+    "node_modules/vite/node_modules/@esbuild/win32-arm64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",
+      "integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=18"
       }
     },
-    "node_modules/vite": {
-      "version": "7.3.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
-      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
-      "devOptional": true,
+    "node_modules/vite/node_modules/@esbuild/win32-ia32": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",
+      "integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",
+      "cpu": [
+        "ia32"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "esbuild": "^0.27.0",
-        "fdir": "^6.5.0",
-        "picomatch": "^4.0.3",
-        "postcss": "^8.5.6",
-        "rollup": "^4.43.0",
-        "tinyglobby": "^0.2.15"
-      },
-      "bin": {
-        "vite": "bin/vite.js"
-      },
+      "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": "^20.19.0 || >=22.12.0"
-      },
-      "funding": {
-        "url": "https://github.com/vitejs/vite?sponsor=1"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.3"
-      },
-      "peerDependencies": {
-        "@types/node": "^20.19.0 || >=22.12.0",
-        "jiti": ">=1.21.0",
-        "less": "^4.0.0",
-        "lightningcss": "^1.21.0",
-        "sass": "^1.70.0",
-        "sass-embedded": "^1.70.0",
-        "stylus": ">=0.54.8",
-        "sugarss": "^5.0.0",
-        "terser": "^5.16.0",
-        "tsx": "^4.8.1",
-        "yaml": "^2.4.2"
-      },
-      "peerDependenciesMeta": {
-        "@types/node": {
-          "optional": true
-        },
-        "jiti": {
-          "optional": true
-        },
-        "less": {
-          "optional": true
-        },
-        "lightningcss": {
-          "optional": true
-        },
-        "sass": {
-          "optional": true
-        },
-        "sass-embedded": {
-          "optional": true
-        },
-        "stylus": {
-          "optional": true
-        },
-        "sugarss": {
-          "optional": true
-        },
-        "terser": {
-          "optional": true
-        },
-        "tsx": {
-          "optional": true
-        },
-        "yaml": {
-          "optional": true
-        }
+        "node": ">=18"
       }
     },
-    "node_modules/vite/node_modules/@esbuild/linux-x64": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.3.tgz",
-      "integrity": "sha512-Czi8yzXUWIQYAtL/2y6vogER8pvcsOsk5cpwL4Gk5nJqH5UZiVByIY8Eorm5R13gq+DQKYg0+JyQoytLQas4dA==",
+    "node_modules/vite/node_modules/@esbuild/win32-x64": {
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",
+      "integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",
       "cpu": [
         "x64"
       ],
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
+        "win32"
       ],
       "engines": {
         "node": ">=18"
       }
     },
     "node_modules/vite/node_modules/esbuild": {
-      "version": "0.27.3",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.3.tgz",
-      "integrity": "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg==",
+      "version": "0.27.7",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
+      "integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -11218,32 +12776,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.3",
-        "@esbuild/android-arm": "0.27.3",
-        "@esbuild/android-arm64": "0.27.3",
-        "@esbuild/android-x64": "0.27.3",
-        "@esbuild/darwin-arm64": "0.27.3",
-        "@esbuild/darwin-x64": "0.27.3",
-        "@esbuild/freebsd-arm64": "0.27.3",
-        "@esbuild/freebsd-x64": "0.27.3",
-        "@esbuild/linux-arm": "0.27.3",
-        "@esbuild/linux-arm64": "0.27.3",
-        "@esbuild/linux-ia32": "0.27.3",
-        "@esbuild/linux-loong64": "0.27.3",
-        "@esbuild/linux-mips64el": "0.27.3",
-        "@esbuild/linux-ppc64": "0.27.3",
-        "@esbuild/linux-riscv64": "0.27.3",
-        "@esbuild/linux-s390x": "0.27.3",
-        "@esbuild/linux-x64": "0.27.3",
-        "@esbuild/netbsd-arm64": "0.27.3",
-        "@esbuild/netbsd-x64": "0.27.3",
-        "@esbuild/openbsd-arm64": "0.27.3",
-        "@esbuild/openbsd-x64": "0.27.3",
-        "@esbuild/openharmony-arm64": "0.27.3",
-        "@esbuild/sunos-x64": "0.27.3",
-        "@esbuild/win32-arm64": "0.27.3",
-        "@esbuild/win32-ia32": "0.27.3",
-        "@esbuild/win32-x64": "0.27.3"
+        "@esbuild/aix-ppc64": "0.27.7",
+        "@esbuild/android-arm": "0.27.7",
+        "@esbuild/android-arm64": "0.27.7",
+        "@esbuild/android-x64": "0.27.7",
+        "@esbuild/darwin-arm64": "0.27.7",
+        "@esbuild/darwin-x64": "0.27.7",
+        "@esbuild/freebsd-arm64": "0.27.7",
+        "@esbuild/freebsd-x64": "0.27.7",
+        "@esbuild/linux-arm": "0.27.7",
+        "@esbuild/linux-arm64": "0.27.7",
+        "@esbuild/linux-ia32": "0.27.7",
+        "@esbuild/linux-loong64": "0.27.7",
+        "@esbuild/linux-mips64el": "0.27.7",
+        "@esbuild/linux-ppc64": "0.27.7",
+        "@esbuild/linux-riscv64": "0.27.7",
+        "@esbuild/linux-s390x": "0.27.7",
+        "@esbuild/linux-x64": "0.27.7",
+        "@esbuild/netbsd-arm64": "0.27.7",
+        "@esbuild/netbsd-x64": "0.27.7",
+        "@esbuild/openbsd-arm64": "0.27.7",
+        "@esbuild/openbsd-x64": "0.27.7",
+        "@esbuild/openharmony-arm64": "0.27.7",
+        "@esbuild/sunos-x64": "0.27.7",
+        "@esbuild/win32-arm64": "0.27.7",
+        "@esbuild/win32-ia32": "0.27.7",
+        "@esbuild/win32-x64": "0.27.7"
       }
     },
     "node_modules/vite/node_modules/fsevents": {
@@ -11610,6 +13168,15 @@
         "node": ">=20.0"
       }
     },
+    "node_modules/xtend": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.4"
+      }
+    },
     "node_modules/yallist": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
diff --git a/package.json b/package.json
index f2ff0156..f5122cba 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,11 @@
     "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && playwright test",
     "test:e2e:garage": "./e2e/run-garage-tests.sh",
     "test:e2e:ui": "playwright test --ui",
-    "generate:antlr": "cd src/lib/editor/grammar && antlr-ng -v -l -Dlanguage=TypeScript -o ../generated SqlBase.g4 && node patch-generated.mjs"
+    "generate:antlr": "cd src/lib/editor/grammar && antlr-ng -v -l -Dlanguage=TypeScript -o ../generated SqlBase.g4 && node patch-generated.mjs",
+    "db:generate": "drizzle-kit generate",
+    "db:migrate": "drizzle-kit migrate",
+    "db:migrate:run": "tsx src/lib/server/migrate.ts",
+    "db:studio": "drizzle-kit studio"
   },
   "devDependencies": {
     "@cyclonedx/cyclonedx-npm": "^4.2.1",
@@ -34,10 +38,12 @@
     "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@tailwindcss/vite": "^4.2.1",
     "@types/node": "^24",
+    "@types/pg": "^8.20.0",
     "@vitest/browser-playwright": "^4.0.18",
     "@vitest/coverage-v8": "^4.0.18",
     "antlr-ng": "^1.0.10",
     "daisyui": "^5.5.19",
+    "drizzle-kit": "^0.31.10",
     "eslint": "^9.39.2",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-better-tailwindcss": "^4.3.0",
@@ -68,9 +74,11 @@
     "antlr4-c3": "^3.4.4",
     "antlr4ng": "^3.0.16",
     "better-auth": "^1.5.4",
+    "drizzle-orm": "^0.45.2",
     "hyparquet": "^1.25.8",
     "hyparquet-compressors": "^1.1.1",
     "monaco-editor": "^0.55.1",
+    "pg": "^8.21.0",
     "pino": "^10.3.1",
     "pretty-bytes": "^7.1.0",
     "prom-client": "^15.1.3",
diff --git a/src/lib/server/db.ts b/src/lib/server/db.ts
new file mode 100644
index 00000000..8c47d75b
--- /dev/null
+++ b/src/lib/server/db.ts
@@ -0,0 +1,50 @@
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { Pool } from 'pg';
+import { logger } from './logging';
+
+const log = logger.child({ module: 'database' });
+
+// Parse connection credentials from environment variables
+const dbHost = process.env.DATABASE_HOST || 'localhost';
+const dbPort = parseInt(process.env.DATABASE_PORT || '31432', 10);
+const dbName = process.env.DATABASE_NAME || 'cockpit';
+const dbUser = process.env.DATABASE_USER || 'cockpit';
+const dbPassword = process.env.DATABASE_PASSWORD || 'cockpit-dev-password';
+
+if (!dbPassword) {
+  log.warn('DATABASE_PASSWORD not set, connection may fail');
+}
+
+// SSL is disabled in development (local k8s), enabled in production
+const isDev = process.env.NODE_ENV !== 'production';
+const sslMode = isDev ? false : true;
+
+// Create a connection pool
+const pool = new Pool({
+  host: dbHost,
+  port: dbPort,
+  database: dbName,
+  user: dbUser,
+  password: dbPassword,
+  ssl: sslMode,
+  max: 20,
+  idleTimeoutMillis: 30000,
+  connectionTimeoutMillis: 2000
+});
+
+pool.on('error', (err) => {
+  log.error({ error: err }, 'Unexpected error on idle client');
+});
+
+// Create Drizzle instance
+export const db = drizzle({ client: pool });
+
+// Graceful shutdown
+export async function closeDb(): Promise<void> {
+  try {
+    await pool.end();
+    log.info('Database pool closed');
+  } catch (error) {
+    log.error({ error }, 'Error closing database pool');
+  }
+}
diff --git a/src/lib/server/migrate.ts b/src/lib/server/migrate.ts
new file mode 100644
index 00000000..fed65f1d
--- /dev/null
+++ b/src/lib/server/migrate.ts
@@ -0,0 +1,29 @@
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+import { db } from './db.js';
+import { logger } from './logging/index.js';
+
+const log = logger.child({ module: 'migrations' });
+
+export async function runMigrations() {
+  try {
+    log.info('Running database migrations...');
+    await migrate(db, { migrationsFolder: './src/lib/server/migrations' });
+    log.info('Database migrations completed successfully');
+    return true;
+  } catch (error) {
+    log.error({ error }, 'Database migrations failed');
+    return false;
+  }
+}
+
+// Run if called directly
+if (import.meta.url === `file://${process.argv[1]}`) {
+  runMigrations()
+    .then((success) => {
+      process.exit(success ? 0 : 1);
+    })
+    .catch((error) => {
+      console.error('Migration error:', error);
+      process.exit(1);
+    });
+}
diff --git a/src/lib/server/migrations/0000_calm_jimmy_woo.sql b/src/lib/server/migrations/0000_calm_jimmy_woo.sql
new file mode 100644
index 00000000..34720993
--- /dev/null
+++ b/src/lib/server/migrations/0000_calm_jimmy_woo.sql
@@ -0,0 +1,12 @@
+CREATE TABLE "user_storage_connections" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"user_id" text NOT NULL,
+	"name" text NOT NULL,
+	"encrypted_payload" text NOT NULL,
+	"hash" text NOT NULL,
+	"additional_buckets" jsonb DEFAULT '[]' NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX "user_id_idx" ON "user_storage_connections" USING btree ("user_id");
diff --git a/src/lib/server/migrations/meta/0000_snapshot.json b/src/lib/server/migrations/meta/0000_snapshot.json
new file mode 100644
index 00000000..9a9dcb6e
--- /dev/null
+++ b/src/lib/server/migrations/meta/0000_snapshot.json
@@ -0,0 +1,100 @@
+{
+  "id": "37569bc7-4e3e-4cc3-b3db-daa37dc0cd52",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.user_storage_connections": {
+      "name": "user_storage_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_payload": {
+          "name": "encrypted_payload",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "additional_buckets": {
+          "name": "additional_buckets",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_id_idx": {
+          "name": "user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/src/lib/server/migrations/meta/_journal.json b/src/lib/server/migrations/meta/_journal.json
new file mode 100644
index 00000000..735d0f90
--- /dev/null
+++ b/src/lib/server/migrations/meta/_journal.json
@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1781095861625,
+      "tag": "0000_calm_jimmy_woo",
+      "breakpoints": true
+    }
+  ]
+}
diff --git a/src/lib/server/schema.ts b/src/lib/server/schema.ts
new file mode 100644
index 00000000..324f3169
--- /dev/null
+++ b/src/lib/server/schema.ts
@@ -0,0 +1,24 @@
+import { pgTable, text, timestamp, uuid, jsonb, index } from 'drizzle-orm/pg-core';
+
+/**
+ * User storage connections table.
+ * Stores encrypted credentials and configuration for S3-compatible storage buckets.
+ * Multiple connections can be stored per user.
+ */
+export const userStorageConnections = pgTable(
+  'user_storage_connections',
+  {
+    id: uuid('id').primaryKey().defaultRandom(),
+    userId: text('user_id').notNull(),
+    // Display name for this connection (e.g., "Primary S3", "Backup Storage")
+    name: text('name').notNull(),
+    // Encrypted payload containing connection details and hash
+    encryptedPayload: text('encrypted_payload').notNull(),
+    hash: text('hash').notNull(),
+    // Array of additional bucket names accessible with these credentials
+    additionalBuckets: jsonb('additional_buckets').notNull().default('[]'),
+    createdAt: timestamp('created_at', { mode: 'date' }).defaultNow().notNull(),
+    updatedAt: timestamp('updated_at', { mode: 'date' }).defaultNow().notNull()
+  },
+  (table) => [index('user_id_idx').on(table.userId)]
+);

From 04758db6f1dab4ae35b0f9d93c3f01a79e576414 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Thu, 18 Jun 2026 14:09:33 +0200
Subject: [PATCH 061/136] Feat/more file icons (#197)

* feat: Add VSCode file icons and refactor FileRow component

* #142 use materials and lsicon icons for CSV, ZIP and YAML

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 package-lock.json                             |  33 +++
 package.json                                  |   3 +
 .../storage/explorer/FileRow.svelte           |  30 +--
 .../explorer/file-icon/FileIconAndName.svelte |  32 +++
 .../storage/explorer/file-icon/iconConfig.ts  | 235 ++++++++++++++++++
 5 files changed, 306 insertions(+), 27 deletions(-)
 create mode 100644 src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
 create mode 100644 src/lib/components/storage/explorer/file-icon/iconConfig.ts

diff --git a/package-lock.json b/package-lock.json
index a0dc6991..cd96b20d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -31,7 +31,10 @@
         "@eslint/js": "^9.39.2",
         "@faker-js/faker": "^10.4.0",
         "@iconify-json/gravity-ui": "^1.2.12",
+        "@iconify-json/lsicon": "^1.2.5",
+        "@iconify-json/material-icon-theme": "^1.2.67",
         "@iconify-json/material-symbols": "^1.2.74",
+        "@iconify-json/vscode-icons": "^1.2.55",
         "@inlang/paraglide-js": "^2.12.0",
         "@playwright/test": "^1.58.2",
         "@sveltejs/adapter-node": "^5.5.3",
@@ -1758,6 +1761,26 @@
         "@iconify/types": "*"
       }
     },
+    "node_modules/@iconify-json/lsicon": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@iconify-json/lsicon/-/lsicon-1.2.5.tgz",
+      "integrity": "sha512-dXmYFljtE+xYf/QKzs3WYjHjJuJIbagiUsIT5NL5z+qsWrCOHojfoL0inivGSSpGJjRQM18GPjspzzPaTfJVtw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@iconify/types": "*"
+      }
+    },
+    "node_modules/@iconify-json/material-icon-theme": {
+      "version": "1.2.67",
+      "resolved": "https://registry.npmjs.org/@iconify-json/material-icon-theme/-/material-icon-theme-1.2.67.tgz",
+      "integrity": "sha512-SouqLxahwVOuIVqED8Spl1wSy3DM7sYwNOPxFW7Eh4hVNqR4L4zTkEXFP4V6bQegkhl9kFWbNGlYKDFjXh92iQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@iconify/types": "*"
+      }
+    },
     "node_modules/@iconify-json/material-symbols": {
       "version": "1.2.74",
       "resolved": "https://registry.npmjs.org/@iconify-json/material-symbols/-/material-symbols-1.2.74.tgz",
@@ -1768,6 +1791,16 @@
         "@iconify/types": "*"
       }
     },
+    "node_modules/@iconify-json/vscode-icons": {
+      "version": "1.2.55",
+      "resolved": "https://registry.npmjs.org/@iconify-json/vscode-icons/-/vscode-icons-1.2.55.tgz",
+      "integrity": "sha512-7c6yep/OW7/xVWPedBeFbHv5wM4PnRcrZvlsaB+l5cBNWL/6thNE1yuN+PDPQZoEGdXRMUfwDAI3qF0ZVftwag==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@iconify/types": "*"
+      }
+    },
     "node_modules/@iconify/types": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
diff --git a/package.json b/package.json
index 17986f4e..5a9e4766 100644
--- a/package.json
+++ b/package.json
@@ -30,6 +30,9 @@
     "@eslint/js": "^9.39.2",
     "@faker-js/faker": "^10.4.0",
     "@iconify-json/material-symbols": "^1.2.74",
+    "@iconify-json/vscode-icons": "^1.2.55",
+    "@iconify-json/material-icon-theme": "^1.2.67",
+    "@iconify-json/lsicon": "^1.2.5",
     "@inlang/paraglide-js": "^2.12.0",
     "@playwright/test": "^1.58.2",
     "@sveltejs/adapter-node": "^5.5.3",
diff --git a/src/lib/components/storage/explorer/FileRow.svelte b/src/lib/components/storage/explorer/FileRow.svelte
index 777475af..dc3d3408 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte
+++ b/src/lib/components/storage/explorer/FileRow.svelte
@@ -1,13 +1,9 @@
 <script lang="ts">
-  import IconImage from 'virtual:icons/material-symbols/image';
-  import IconCode from 'virtual:icons/material-symbols/code';
-  import IconArchive from 'virtual:icons/material-symbols/archive';
-  import IconPictureAsPdf from 'virtual:icons/material-symbols/picture-as-pdf';
-  import IconDescription from 'virtual:icons/material-symbols/description';
   import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
-  import { fileIconKind, iconColors, keyToName, formatFileSize } from '$lib/storage/utils.js';
+  import { keyToName, formatFileSize } from '$lib/storage/utils.js';
   import type { StorageObject } from '$lib/storage/types.js';
   import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
+  import FileIconAndName from './file-icon/FileIconAndName.svelte';
   import { getStorageState } from '$lib/storage/context.js';
 
   interface Props {
@@ -20,8 +16,6 @@
 
   const selected = $derived(storage.selectedKeys.has(file.key));
   const isCtx = $derived(storage.contextMenu?.key === file.key);
-  const kind = $derived(fileIconKind(file.contentType));
-  const color = $derived(iconColors[kind]);
 </script>
 
 <tr
@@ -48,25 +42,7 @@
     />
   </td>
   <td>
-    <div class="flex items-center gap-2.5">
-      {#if kind === 'image'}
-        <IconImage class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {:else if kind === 'code'}
-        <IconCode class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {:else if kind === 'archive'}
-        <IconArchive class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {:else if kind === 'pdf'}
-        <IconPictureAsPdf class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {:else}
-        <IconDescription class="size-5 shrink-0 {color}" aria-hidden="true" />
-      {/if}
-      <span class="truncate">{keyToName(file.key)}</span>
-      {#if file.contentType}
-        <span class="badge badge-ghost badge-sm ml-1 shrink-0 text-[10px] opacity-50">
-          {file.contentType.split('/').at(-1) ?? ''}
-        </span>
-      {/if}
-    </div>
+    <FileIconAndName {file} />
   </td>
   <td class="text-right font-mono text-sm">{formatFileSize(file.size)}</td>
   <td class="text-base-content/60 text-sm"
diff --git a/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
new file mode 100644
index 00000000..c1a7e6cc
--- /dev/null
+++ b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
@@ -0,0 +1,32 @@
+<script lang="ts">
+  import { keyToName } from '$lib/storage/utils.js';
+  import type { StorageObject } from '$lib/storage/types.js';
+  import { FILE_ICON_CONFIG, fileIconKind } from './iconConfig.js';
+  import type { IconConfig } from './iconConfig.js';
+
+  interface Props {
+    file: StorageObject;
+  }
+
+  const { file }: Props = $props();
+
+  const kind = $derived(fileIconKind(file.contentType, file.key));
+  const config = $derived(FILE_ICON_CONFIG[kind]);
+
+  const ext = $derived(file.key.split('.').at(-1)?.toLowerCase() ?? '');
+  const badge = $derived(file.contentType ? (file.contentType.split('/').at(-1) ?? '') : ext);
+</script>
+
+<div class="flex items-center gap-2.5">
+  {@render renderIcon(config)}
+  <span class="truncate">{keyToName(file.key)}</span>
+  {#if badge}
+    <span class="badge badge-ghost badge-sm ml-1 shrink-0 text-[10px] opacity-50">
+      {badge}
+    </span>
+  {/if}
+</div>
+
+{#snippet renderIcon(cfg: IconConfig)}
+  <cfg.component class="size-5 shrink-0" aria-hidden="true" />
+{/snippet}
diff --git a/src/lib/components/storage/explorer/file-icon/iconConfig.ts b/src/lib/components/storage/explorer/file-icon/iconConfig.ts
new file mode 100644
index 00000000..804cb005
--- /dev/null
+++ b/src/lib/components/storage/explorer/file-icon/iconConfig.ts
@@ -0,0 +1,235 @@
+import IconPdf from 'virtual:icons/vscode-icons/file-type-pdf2';
+import IconMarkdown from 'virtual:icons/vscode-icons/file-type-markdown';
+import IconExcel from 'virtual:icons/vscode-icons/file-type-excel';
+import IconWord from 'virtual:icons/vscode-icons/file-type-word';
+import IconCss from 'virtual:icons/vscode-icons/file-type-css';
+import IconHtml from 'virtual:icons/vscode-icons/file-type-html';
+import IconJs from 'virtual:icons/vscode-icons/file-type-js';
+import IconTs from 'virtual:icons/vscode-icons/file-type-typescript';
+import IconJson from 'virtual:icons/vscode-icons/file-type-json';
+import IconImage from 'virtual:icons/vscode-icons/file-type-image';
+import IconSvg from 'virtual:icons/vscode-icons/file-type-svg';
+import IconZip from 'virtual:icons/material-icon-theme/zip';
+import IconText from 'virtual:icons/vscode-icons/file-type-text';
+import IconDocument from 'virtual:icons/vscode-icons/default-file';
+import IconYaml from 'virtual:icons/material-icon-theme/yaml';
+import IconCsv from 'virtual:icons/lsicon/file-csv-filled';
+import IconToml from 'virtual:icons/vscode-icons/file-type-toml';
+import IconXml from 'virtual:icons/vscode-icons/file-type-xml';
+import IconSql from 'virtual:icons/vscode-icons/file-type-sql';
+import IconAudio from 'virtual:icons/vscode-icons/file-type-audio';
+import IconVideo from 'virtual:icons/vscode-icons/file-type-video';
+import IconFont from 'virtual:icons/vscode-icons/file-type-font';
+import IconPython from 'virtual:icons/vscode-icons/file-type-python';
+import IconRuby from 'virtual:icons/vscode-icons/file-type-ruby';
+import IconRust from 'virtual:icons/vscode-icons/file-type-rust';
+import IconGo from 'virtual:icons/vscode-icons/file-type-go';
+import IconJava from 'virtual:icons/vscode-icons/file-type-java';
+import IconPhp from 'virtual:icons/vscode-icons/file-type-php';
+import IconShell from 'virtual:icons/vscode-icons/file-type-shell';
+import IconLog from 'virtual:icons/vscode-icons/file-type-log';
+import IconParquet from 'virtual:icons/vscode-icons/file-type-parquet';
+import IconDb from 'virtual:icons/vscode-icons/file-type-db';
+import type { Component } from 'svelte';
+
+export type FileIconKind =
+  | 'pdf'
+  | 'markdown'
+  | 'excel'
+  | 'word'
+  | 'css'
+  | 'html'
+  | 'javascript'
+  | 'typescript'
+  | 'json'
+  | 'image'
+  | 'svg'
+  | 'archive'
+  | 'text'
+  | 'yaml'
+  | 'csv'
+  | 'toml'
+  | 'xml'
+  | 'sql'
+  | 'audio'
+  | 'video'
+  | 'font'
+  | 'python'
+  | 'ruby'
+  | 'rust'
+  | 'go'
+  | 'java'
+  | 'php'
+  | 'shell'
+  | 'log'
+  | 'parquet'
+  | 'database'
+  | 'document';
+
+export interface IconConfig {
+  component: Component;
+}
+
+export const FILE_ICON_CONFIG: Record<FileIconKind, IconConfig> = {
+  pdf: { component: IconPdf },
+  markdown: { component: IconMarkdown },
+  excel: { component: IconExcel },
+  word: { component: IconWord },
+  css: { component: IconCss },
+  html: { component: IconHtml },
+  javascript: { component: IconJs },
+  typescript: { component: IconTs },
+  json: { component: IconJson },
+  image: { component: IconImage },
+  svg: { component: IconSvg },
+  archive: { component: IconZip },
+  text: { component: IconText },
+  yaml: { component: IconYaml },
+  csv: { component: IconCsv },
+  toml: { component: IconToml },
+  xml: { component: IconXml },
+  sql: { component: IconSql },
+  audio: { component: IconAudio },
+  video: { component: IconVideo },
+  font: { component: IconFont },
+  python: { component: IconPython },
+  ruby: { component: IconRuby },
+  rust: { component: IconRust },
+  go: { component: IconGo },
+  java: { component: IconJava },
+  php: { component: IconPhp },
+  shell: { component: IconShell },
+  log: { component: IconLog },
+  parquet: { component: IconParquet },
+  database: { component: IconDb },
+  document: { component: IconDocument }
+};
+
+// Content type patterns to icon kind mappings
+const MARKDOWN_TYPES = new Set(['text/markdown', 'text/x-markdown']);
+
+const EXCEL_TYPES = new Set([
+  'application/vnd.ms-excel',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+  'application/vnd.openxmlformats-officedocument.spreadsheetml.template'
+]);
+
+const WORD_TYPES = new Set([
+  'application/msword',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+  'application/vnd.openxmlformats-officedocument.wordprocessingml.template'
+]);
+
+const ARCHIVE_TYPES = new Set(['application/gzip', 'application/zip', 'application/x-tar']);
+
+const EXT_KIND = new Map<string, FileIconKind>([
+  ['pdf', 'pdf'],
+  ['md', 'markdown'],
+  ['markdown', 'markdown'],
+  ['xls', 'excel'],
+  ['xlsx', 'excel'],
+  ['doc', 'word'],
+  ['docx', 'word'],
+  ['css', 'css'],
+  ['html', 'html'],
+  ['htm', 'html'],
+  ['js', 'javascript'],
+  ['mjs', 'javascript'],
+  ['cjs', 'javascript'],
+  ['ts', 'typescript'],
+  ['mts', 'typescript'],
+  ['cts', 'typescript'],
+  ['json', 'json'],
+  ['jsonc', 'json'],
+  ['png', 'image'],
+  ['jpg', 'image'],
+  ['jpeg', 'image'],
+  ['gif', 'image'],
+  ['bmp', 'image'],
+  ['ico', 'image'],
+  ['tiff', 'image'],
+  ['avif', 'image'],
+  ['webp', 'image'],
+  ['svg', 'svg'],
+  ['zip', 'archive'],
+  ['tar', 'archive'],
+  ['gz', 'archive'],
+  ['tgz', 'archive'],
+  ['bz2', 'archive'],
+  ['xz', 'archive'],
+  ['zst', 'archive'],
+  ['txt', 'text'],
+  ['csv', 'csv'],
+  ['tsv', 'text'],
+  ['yaml', 'yaml'],
+  ['yml', 'yaml'],
+  ['toml', 'toml'],
+  ['xml', 'xml'],
+  ['sql', 'sql'],
+  ['log', 'log'],
+  ['py', 'python'],
+  ['pyw', 'python'],
+  ['rb', 'ruby'],
+  ['rs', 'rust'],
+  ['go', 'go'],
+  ['java', 'java'],
+  ['class', 'java'],
+  ['jar', 'java'],
+  ['php', 'php'],
+  ['sh', 'shell'],
+  ['bash', 'shell'],
+  ['zsh', 'shell'],
+  ['fish', 'shell'],
+  ['parquet', 'parquet'],
+  ['db', 'database'],
+  ['sqlite', 'database'],
+  ['sqlite3', 'database']
+]);
+
+export function fileIconKind(contentType: string | undefined, key?: string): FileIconKind {
+  if (!contentType) {
+    if (key) {
+      const ext = key.split('.').at(-1)?.toLowerCase();
+      const kind = ext ? EXT_KIND.get(ext) : undefined;
+      if (kind) return kind;
+    }
+    return 'document';
+  }
+  if (contentType === 'image/svg+xml') return 'svg';
+  if (contentType.startsWith('image/')) return 'image';
+  if (contentType.startsWith('audio/')) return 'audio';
+  if (contentType.startsWith('video/')) return 'video';
+  if (contentType.startsWith('font/')) return 'font';
+  if (contentType === 'application/pdf') return 'pdf';
+  if (MARKDOWN_TYPES.has(contentType)) return 'markdown';
+  if (EXCEL_TYPES.has(contentType)) return 'excel';
+  if (WORD_TYPES.has(contentType)) return 'word';
+  if (contentType === 'text/css') return 'css';
+  if (contentType === 'text/html') return 'html';
+  if (contentType === 'application/javascript' || contentType === 'text/javascript')
+    return 'javascript';
+  if (contentType === 'text/typescript' || contentType === 'application/typescript')
+    return 'typescript';
+  if (contentType === 'application/json') return 'json';
+  if (ARCHIVE_TYPES.has(contentType)) return 'archive';
+  if (contentType === 'application/xml' || contentType === 'text/xml') return 'xml';
+  if (contentType === 'text/csv' || contentType === 'application/csv') return 'csv';
+  if (contentType === 'text/yaml' || contentType === 'application/yaml') return 'yaml';
+  if (contentType === 'application/toml') return 'toml';
+  if (contentType === 'application/sql' || contentType === 'text/x-sql') return 'sql';
+  if (contentType === 'application/vnd.apache.parquet' || contentType === 'application/x-parquet')
+    return 'parquet';
+  if (contentType === 'text/x-python' || contentType === 'application/x-python-code')
+    return 'python';
+  if (contentType === 'text/x-ruby') return 'ruby';
+  if (contentType === 'text/x-go') return 'go';
+  if (contentType === 'text/x-java-source' || contentType === 'application/java-vm') return 'java';
+  if (
+    contentType === 'application/x-sh' ||
+    contentType === 'text/x-sh' ||
+    contentType === 'text/x-shellscript'
+  )
+    return 'shell';
+  if (contentType.startsWith('text/')) return 'text';
+  return 'document';
+}

From f390bb7239243f4ce485ead83b1bb83df92b8a37 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 22 Jun 2026 08:05:19 +0200
Subject: [PATCH 062/136] #98 simplified garage access key retrieval

---
 .github/workflows/pr_checks.yaml    |  3 +-
 dev/setup.sh                        |  3 +-
 e2e/init-garage-s3.sh               | 53 +++++------------------------
 src/lib/storage/bookmarks.svelte.ts | 23 +++++++++++--
 4 files changed, 32 insertions(+), 50 deletions(-)

diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index b9c11866..f1b7216b 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -131,7 +131,8 @@ jobs:
             sleep 1
           done
 
-          GARAGE_ADMIN_TOKEN='stackable-cockpit-e2e-admin-token' \
+          S3_SECRET_ACCESS_KEY="e2e-test-secret-key-for-ci" \
+            GARAGE_ADMIN_TOKEN='stackable-cockpit-e2e-admin-token' \
             S3_ENDPOINT='http://localhost:3900' \
             S3_CONFIG_PATH="$PWD/s3-config.json" \
             ./e2e/init-garage-s3.sh
diff --git a/dev/setup.sh b/dev/setup.sh
index b6165566..b428976e 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -224,7 +224,8 @@ if [[ "$SKIP_GARAGE" == false ]]; then
   GARAGE_HOST=$(echo "$GARAGE_BASE_URL" | sed 's|http://||; s|:[0-9]*$||')
   GARAGE_S3_URL="http://${GARAGE_HOST}:${GARAGE_S3_PORT}"
 
-  GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token \
+  S3_SECRET_ACCESS_KEY=$(openssl rand -hex 32) \
+    GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token \
     S3_ENDPOINT="$GARAGE_S3_URL" \
     GARAGE_ADMIN_URL="$GARAGE_BASE_URL" \
     S3_CONFIG_PATH="$PROJECT_DIR/s3-config.json" \
diff --git a/e2e/init-garage-s3.sh b/e2e/init-garage-s3.sh
index dc2b9bb0..fd5ac81a 100755
--- a/e2e/init-garage-s3.sh
+++ b/e2e/init-garage-s3.sh
@@ -8,6 +8,8 @@ set -euo pipefail
 : "${S3_REGION:=garage}"
 : "${S3_BUCKET:=test-bucket}"
 : "${S3_CONFIG_PATH:=s3-config.json}"
+: "${S3_ACCESS_KEY_ID:=E2E00000000000000001}"
+: "${S3_SECRET_ACCESS_KEY:?S3_SECRET_ACCESS_KEY must be set}"
 : "${S3_ACCESS_KEY_NAME:=e2e-test-app}"
 : "${S3_PERMISSION_OWNER:=true}"
 : "${S3_PERMISSION_READ:=true}"
@@ -41,20 +43,6 @@ json_find_bucket_id_by_alias() {
   ' "$bucket_name"
 }
 
-json_find_key_id_by_name() {
-  local key_name="$1"
-
-  node -e '
-    const fs = require("fs");
-    const keyName = process.argv[1];
-    const items = JSON.parse(fs.readFileSync(0, "utf8"));
-    const key = items.find((item) => item?.name === keyName && item?.expired === false);
-    if (key?.id) {
-      process.stdout.write(key.id);
-    }
-  ' "$key_name"
-}
-
 admin_post() {
   local path="$1"
   local payload="$2"
@@ -81,30 +69,12 @@ get_bucket_id() {
   admin_get '/v2/ListBuckets' | json_find_bucket_id_by_alias "$bucket_name"
 }
 
-get_key_id() {
-  local key_name="$1"
-
-  admin_get '/v2/ListKeys' | json_find_key_id_by_name "$key_name"
-}
-
-get_key_info() {
-  local access_key_id="$1"
-
-  admin_get "/v2/GetKeyInfo?id=$access_key_id&showSecretKey=true"
-}
-
 create_bucket() {
   local bucket_name="$1"
 
   admin_post '/v2/CreateBucket' "{\"globalAlias\":\"$bucket_name\"}"
 }
 
-create_access_key() {
-  local key_name="$1"
-
-  admin_post '/v2/CreateKey' "{\"name\":\"$key_name\",\"neverExpires\":true}"
-}
-
 allow_bucket_key() {
   local bucket_id="$1"
   local access_key_id="$2"
@@ -112,30 +82,23 @@ allow_bucket_key() {
   admin_post '/v2/AllowBucketKey' "{\"bucketId\":\"$bucket_id\",\"accessKeyId\":\"$access_key_id\",\"permissions\":{\"owner\":$S3_PERMISSION_OWNER,\"read\":$S3_PERMISSION_READ,\"write\":$S3_PERMISSION_WRITE}}"
 }
 
+# Import pre-defined access key (idempotent — Garage ignores re-import of existing keys)
+admin_post '/v2/ImportKey' "{\"accessKeyId\":\"$S3_ACCESS_KEY_ID\",\"secretAccessKey\":\"$S3_SECRET_ACCESS_KEY\",\"name\":\"$S3_ACCESS_KEY_NAME\",\"neverExpires\":true}" >/dev/null 2>&1 || true
+
 bucket_id=$(get_bucket_id "$S3_BUCKET")
 if [[ -z "$bucket_id" ]]; then
   bucket_response=$(create_bucket "$S3_BUCKET")
   bucket_id=$(printf '%s' "$bucket_response" | json_get 'id')
 fi
 
-access_key_id=$(get_key_id "$S3_ACCESS_KEY_NAME")
-if [[ -z "$access_key_id" ]]; then
-  key_response=$(create_access_key "$S3_ACCESS_KEY_NAME")
-  access_key_id=$(printf '%s' "$key_response" | json_get 'accessKeyId')
-  secret_access_key=$(printf '%s' "$key_response" | json_get 'secretAccessKey')
-else
-  key_response=$(get_key_info "$access_key_id")
-  secret_access_key=$(printf '%s' "$key_response" | json_get 'secretAccessKey')
-fi
-
-allow_bucket_key "$bucket_id" "$access_key_id" >/dev/null
+allow_bucket_key "$bucket_id" "$S3_ACCESS_KEY_ID" >/dev/null
 
 cat > "$S3_CONFIG_PATH" <<EOF
 {
   "awsEndpoint": "$S3_ENDPOINT",
   "awsRegion": "$S3_REGION",
-  "awsAccessKeyId": "$access_key_id",
-  "awsSecretAccessKey": "$secret_access_key",
+  "awsAccessKeyId": "$S3_ACCESS_KEY_ID",
+  "awsSecretAccessKey": "$S3_SECRET_ACCESS_KEY",
   "bucket": "$S3_BUCKET",
   "garageAdminUrl": "$GARAGE_ADMIN_URL",
   "garageAdminToken": "$GARAGE_ADMIN_TOKEN"
diff --git a/src/lib/storage/bookmarks.svelte.ts b/src/lib/storage/bookmarks.svelte.ts
index 85f574b9..c104a201 100644
--- a/src/lib/storage/bookmarks.svelte.ts
+++ b/src/lib/storage/bookmarks.svelte.ts
@@ -9,11 +9,28 @@ import {
 import { maxRecentFiles } from '$lib/client/feature-flags.js';
 import { SvelteDate, SvelteSet } from 'svelte/reactivity';
 
+function dedupByKey<T>(items: T[], keyFn: (item: T) => string): T[] {
+  const seen = new SvelteSet<string>();
+  return items.filter((item) => {
+    const key = keyFn(item);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+
 export class BookmarksState {
-  pinnedLocations = $state<PinnedLocation[]>(loadFromStorage<PinnedLocation>(LS_PINS));
-  recentFiles = $state<RecentFile[]>(loadFromStorage<RecentFile>(LS_RECENT_FILES));
+  pinnedLocations = $state<PinnedLocation[]>(
+    dedupByKey(loadFromStorage<PinnedLocation>(LS_PINS), (p) => p.bucket + '\0' + p.prefix)
+  );
+  recentFiles = $state<RecentFile[]>(
+    dedupByKey(loadFromStorage<RecentFile>(LS_RECENT_FILES), (f) => f.bucket + '\0' + f.key)
+  );
   recentLocations = $state<RecentLocation[]>(
-    loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter((l) => Boolean(l.bucket))
+    dedupByKey(
+      loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter((l) => Boolean(l.bucket)),
+      (l) => l.bucket + '\0' + l.prefix
+    )
   );
 
   pin(bucket: string, prefix: string): void {

From 79021563b024b6a4a25fdf571a4826e48337b46c Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 23 Jun 2026 06:17:15 +0200
Subject: [PATCH 063/136] fix format on templates

---
 .prettierignore                          | 1 +
 dev/postgresql/templates/deployment.yaml | 6 +++---
 dev/postgresql/templates/secret.yaml     | 2 +-
 dev/postgresql/templates/service.yaml    | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.prettierignore b/.prettierignore
index 6dbc7f7c..f2eaf48d 100644
--- a/.prettierignore
+++ b/.prettierignore
@@ -33,3 +33,4 @@ coverage/
 # Helm templates
 deploy/helm/
 dev/garage/
+dev/postgresql/
diff --git a/dev/postgresql/templates/deployment.yaml b/dev/postgresql/templates/deployment.yaml
index b06353dd..35f2729f 100644
--- a/dev/postgresql/templates/deployment.yaml
+++ b/dev/postgresql/templates/deployment.yaml
@@ -19,16 +19,16 @@ spec:
       containers:
         - name: postgresql
           image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
-          imagePullPolicy: { { .Values.image.pullPolicy } }
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
           ports:
             - name: postgres
               containerPort: 5432
               protocol: TCP
           env:
             - name: POSTGRES_DB
-              value: { { .Values.database.name | quote } }
+              value: {{ .Values.database.name | quote }}
             - name: POSTGRES_USER
-              value: { { .Values.database.user | quote } }
+              value: {{ .Values.database.user | quote }}
             - name: POSTGRES_PASSWORD
               valueFrom:
                 secretKeyRef:
diff --git a/dev/postgresql/templates/secret.yaml b/dev/postgresql/templates/secret.yaml
index a3aa0972..0e9bddc5 100644
--- a/dev/postgresql/templates/secret.yaml
+++ b/dev/postgresql/templates/secret.yaml
@@ -6,4 +6,4 @@ metadata:
   namespace: default
 type: Opaque
 data:
-  password: { { .Values.database.password | b64enc | quote } }
+  password: {{ .Values.database.password | b64enc | quote }}
diff --git a/dev/postgresql/templates/service.yaml b/dev/postgresql/templates/service.yaml
index 243cc453..a2f4a6ea 100644
--- a/dev/postgresql/templates/service.yaml
+++ b/dev/postgresql/templates/service.yaml
@@ -12,4 +12,4 @@ spec:
     - name: postgres
       port: 5432
       targetPort: 5432
-      nodePort: { { .Values.nodePorts.postgres } }
+      nodePort: {{ .Values.nodePorts.postgres }}

From 78b6446a4fd938f9062dde454f705de915e5e5af Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 23 Jun 2026 08:16:30 +0200
Subject: [PATCH 064/136] #98 fix limiting deleting keys, reset pagination on
 bucket switch

---
 package-lock.json                     | 11 ------
 src/lib/server/storage/s3-provider.ts | 49 +++++++++++++++++----------
 src/lib/storage/state.svelte.ts       |  1 +
 3 files changed, 33 insertions(+), 28 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 839d83af..8335cfef 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -28,7 +28,6 @@
         "@eslint/compat": "^2.0.2",
         "@eslint/js": "^9.39.2",
         "@faker-js/faker": "^10.4.0",
-        "@iconify-json/gravity-ui": "^1.2.12",
         "@iconify-json/material-symbols": "^1.2.74",
         "@inlang/paraglide-js": "^2.12.0",
         "@playwright/test": "^1.58.2",
@@ -1653,16 +1652,6 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
-    "node_modules/@iconify-json/gravity-ui": {
-      "version": "1.2.12",
-      "resolved": "https://registry.npmjs.org/@iconify-json/gravity-ui/-/gravity-ui-1.2.12.tgz",
-      "integrity": "sha512-/66CorNnUoFs66nb8FJ+ZPq6Zog9NwR13ml90qijI0Hj3bVqQIdiWZ9npSyNWRgJe452LFmWZrdWQONYBbJ7XA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@iconify/types": "*"
-      }
-    },
     "node_modules/@iconify-json/material-symbols": {
       "version": "1.2.74",
       "resolved": "https://registry.npmjs.org/@iconify-json/material-symbols/-/material-symbols-1.2.74.tgz",
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index e6fac66f..56dadd73 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -151,27 +151,42 @@ export class S3StorageProvider implements StorageProvider {
 
   async deleteObjects(keys: string[]): Promise<DeleteObjectsResult> {
     log.trace({ bucket: this.bucket, key_count: keys.length }, 'S3 DeleteObjects');
-    const output = await this.client.send(
-      new DeleteObjectsCommand({
-        Bucket: this.bucket,
-        Delete: {
-          Objects: keys.map((key) => ({ Key: key })),
-          Quiet: true
-        }
-      })
-    );
-    const failed = (output.Errors ?? []).map((e) => ({
-      key: e.Key ?? '',
-      code: e.Code,
-      message: e.Message
-    }));
-    if (failed.length > 0) {
+
+    // S3 DeleteObjects has a limit of 1000 keys per request.
+    // MinIO/Ionos return MalformedXML when exceeding this limit.
+    const MAX_KEYS = 1000;
+    const allFailed: Array<{ key: string; code?: string; message?: string }> = [];
+
+    for (let i = 0; i < keys.length; i += MAX_KEYS) {
+      const chunk = keys.slice(i, i + MAX_KEYS);
+      log.trace(
+        { bucket: this.bucket, chunk_offset: i, chunk_size: chunk.length },
+        'S3 DeleteObjects chunk'
+      );
+      const output = await this.client.send(
+        new DeleteObjectsCommand({
+          Bucket: this.bucket,
+          Delete: {
+            Objects: chunk.map((key) => ({ Key: key })),
+            Quiet: true
+          }
+        })
+      );
+      const failed = (output.Errors ?? []).map((e) => ({
+        key: e.Key ?? '',
+        code: e.Code,
+        message: e.Message
+      }));
+      allFailed.push(...failed);
+    }
+
+    if (allFailed.length > 0) {
       log.warn(
-        { bucket: this.bucket, failed_count: failed.length },
+        { bucket: this.bucket, failed_count: allFailed.length },
         'some objects failed to delete'
       );
     }
-    return { failed };
+    return { failed: allFailed };
   }
 
   async listAllKeys(prefix: string): Promise<string[]> {
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index e3f8eb49..eee1b9b2 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -103,6 +103,7 @@ export class StorageState {
     this.bucket = bucket;
     this.prefix = prefix;
     this.objects = objects;
+    this.prevTokens = [];
     this.loading = false;
     // Clear selection on navigation
     this.selectedKeys = new SvelteSet<string>();

From bf20c7c5d5acf6719d83b2537cc5eb60bfffc32b Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 23 Jun 2026 09:24:30 +0200
Subject: [PATCH 065/136] #98 fix pagination inside the same bucket

---
 src/lib/storage/state.svelte.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index eee1b9b2..a52740f4 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -100,10 +100,11 @@ export class StorageState {
   // ────────────────────────────────────────────────────────────────────────────
 
   syncFromServer(bucket: string, prefix: string, objects: StoragePage): void {
+    const bucketChanged = bucket !== this.bucket;
     this.bucket = bucket;
     this.prefix = prefix;
     this.objects = objects;
-    this.prevTokens = [];
+    if (bucketChanged) this.prevTokens = [];
     this.loading = false;
     // Clear selection on navigation
     this.selectedKeys = new SvelteSet<string>();

From 87f9a1cfe6c1ad390e8b16bcbd1109116ca0c8e7 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 23 Jun 2026 09:43:08 +0200
Subject: [PATCH 066/136] add svelte check to lint command

---
 package.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package.json b/package.json
index 5a9e4766..1e0d153c 100644
--- a/package.json
+++ b/package.json
@@ -12,8 +12,8 @@
     "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
     "check:watch": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json --watch",
     "format": "prettier --write --ignore-path .prettierignore .",
-    "lint": "prettier --check --ignore-path .prettierignore . && eslint .",
-    "lint:fix": "prettier --write --ignore-path .prettierignore . && eslint . --fix",
+    "lint": "prettier --check --ignore-path .prettierignore . && eslint . && npm run check",
+    "lint:fix": "prettier --write --ignore-path .prettierignore . && eslint . --fix && npm run check",
     "test:unit": "vitest run",
     "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && playwright test",
     "test:e2e:garage": "./e2e/run-garage-tests.sh",

From 44791d0a1fa6ef99e1742accb724f4caf5a78358 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 23 Jun 2026 10:54:50 +0200
Subject: [PATCH 067/136] #153 Allow Upload of Empty Files (#171)

* #153 allow upload of empty files

* test: add test for uploading empty files in S3 storage provider tests

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
---
 src/lib/server/storage/s3-provider.test.ts | 26 +++++++++++++++++++++-
 src/lib/server/storage/s3-provider.ts      | 17 ++++++++++++++
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/src/lib/server/storage/s3-provider.test.ts b/src/lib/server/storage/s3-provider.test.ts
index 7856b1f6..84f19bed 100644
--- a/src/lib/server/storage/s3-provider.test.ts
+++ b/src/lib/server/storage/s3-provider.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { S3ServiceException } from '@aws-sdk/client-s3';
+import { S3ServiceException, PutObjectCommand } from '@aws-sdk/client-s3';
 
 vi.mock('$lib/server/logging', () => ({
   logger: { child: () => ({ trace: vi.fn(), warn: vi.fn(), info: vi.fn(), debug: vi.fn() }) }
@@ -363,6 +363,30 @@ describe('S3StorageProvider.putObject', () => {
     expect(opts.queueSize).toBe(4);
     expect(opts.partSize).toBe(5 * 1024 * 1024);
   });
+
+  it('uses PutObjectCommand for empty files instead of multipart Upload', async () => {
+    const { send } = makeProvider();
+    // Re-create provider with the send mock we can inspect
+    const client = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
+    const config = { type: 's3' as const, region: 'us-east-1', bucket: 'test-bucket' };
+    const emptyProvider = new S3StorageProvider(config, client);
+    send.mockResolvedValue({});
+
+    await emptyProvider.putObject('empty.txt', new ReadableStream(), 'text/plain', 0);
+
+    expect(MockUpload).not.toHaveBeenCalled();
+    expect(send).toHaveBeenCalledOnce();
+    const cmd = send.mock.calls[0][0];
+    expect(cmd).toBeInstanceOf(PutObjectCommand);
+    expect(cmd.input).toMatchObject({
+      Bucket: 'test-bucket',
+      Key: 'empty.txt',
+      ContentType: 'text/plain',
+      ContentLength: 0
+    });
+    expect(Buffer.isBuffer(cmd.input.Body)).toBe(true);
+    expect((cmd.input.Body as Buffer).length).toBe(0);
+  });
 });
 
 // ---------------------------------------------------------------------------
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 594030bf..8f18d333 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -6,6 +6,7 @@ import {
   GetObjectCommand,
   HeadObjectCommand,
   DeleteObjectsCommand,
+  PutObjectCommand,
   type ListObjectsV2CommandOutput
 } from '@aws-sdk/client-s3';
 import { Upload } from '@aws-sdk/lib-storage';
@@ -183,6 +184,22 @@ export class S3StorageProvider implements StorageProvider {
       { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
       'S3 Upload'
     );
+
+    // Empty files cannot use multipart upload (S3 rejects empty parts).
+    // Use a simple PutObject request instead.
+    if (contentLength === 0) {
+      await this.client.send(
+        new PutObjectCommand({
+          Bucket: this.bucket,
+          Key: key,
+          Body: Buffer.alloc(0),
+          ContentType: contentType,
+          ContentLength: 0
+        })
+      );
+      return;
+    }
+
     const upload = new Upload({
       client: this.client,
       queueSize: 4,

From 9a96d47d7fcb324ecde270343110dbe02fef565f Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 24 Jun 2026 09:08:16 +0200
Subject: [PATCH 068/136] update lock

---
 package-lock.json | 170 +++-------------------------------------------
 1 file changed, 9 insertions(+), 161 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a20cc0de..3b0b96cd 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -948,7 +948,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1015,7 +1014,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1032,7 +1030,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1049,7 +1046,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1066,7 +1062,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1083,7 +1078,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1100,7 +1094,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1117,7 +1110,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1134,7 +1126,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1151,7 +1142,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1168,7 +1158,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1185,7 +1174,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1202,7 +1190,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1219,7 +1206,6 @@
       "cpu": [
         "mips64el"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1236,7 +1222,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1253,7 +1238,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1270,7 +1254,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1287,7 +1270,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1304,7 +1286,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1321,7 +1302,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1338,7 +1318,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1355,7 +1334,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1372,7 +1350,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1389,7 +1366,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1406,7 +1382,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1423,7 +1398,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1440,7 +1414,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2326,19 +2299,6 @@
         "fast-check": "^3.23.1"
       }
     },
-    "node_modules/@prisma/config/node_modules/magicast": {
-      "version": "0.3.5",
-      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.3.5.tgz",
-      "integrity": "sha512-L0WhttDl+2BOsybvEOLK7fW3UA0OQ0IQ2d6Zl2x/a6vVRs3bAY0ECOSHHeL5jD+SbOpOCUEi0y1DgHEn9Qn1AQ==",
-      "license": "MIT",
-      "optional": true,
-      "peer": true,
-      "dependencies": {
-        "@babel/parser": "^7.25.4",
-        "@babel/types": "^7.25.4",
-        "source-map-js": "^1.2.0"
-      }
-    },
     "node_modules/@prisma/config/node_modules/perfect-debounce": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
@@ -2571,7 +2531,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2585,7 +2544,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2599,7 +2557,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2613,7 +2570,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2627,7 +2583,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2641,7 +2596,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2655,7 +2609,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2669,7 +2622,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2683,7 +2635,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2697,7 +2648,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2711,7 +2661,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2725,7 +2674,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2739,7 +2687,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2753,7 +2700,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2767,7 +2713,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2781,7 +2726,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2795,7 +2739,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2809,7 +2752,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2823,7 +2765,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2837,7 +2778,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2851,7 +2791,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2865,7 +2804,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2879,7 +2817,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2893,7 +2830,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2907,7 +2843,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -3969,7 +3904,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.0.18.tgz",
       "integrity": "sha512-gVQqh7paBz3gC+ZdcCmNSWJMk70IUjDeVqi+5m5vYpEHsIwRgw3Y545jljtajhkekIpIp5Gg8oK7bctgY0E2Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/mocker": "4.0.18",
@@ -3992,7 +3927,7 @@
       "version": "4.0.18",
       "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.0.18.tgz",
       "integrity": "sha512-gfajTHVCiwpxRj1qh0Sh/5bbGLG4F/ZH/V9xvFVoFddpITfMta9YGow0W6ZpTTORv2vdJuz9TnrNSmjKvpOf4g==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@vitest/browser": "4.0.18",
@@ -5375,7 +5310,7 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
       "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
         "node": ">=8"
@@ -5781,7 +5716,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5798,7 +5732,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5815,7 +5748,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5832,7 +5764,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5849,7 +5780,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5866,7 +5796,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5883,7 +5812,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5900,7 +5828,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5917,7 +5844,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5934,7 +5860,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5951,7 +5876,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5968,7 +5892,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -5985,7 +5908,6 @@
       "cpu": [
         "mips64el"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6002,7 +5924,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6019,7 +5940,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6036,7 +5956,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6053,7 +5972,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6070,7 +5988,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6087,7 +6004,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6104,7 +6020,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6121,7 +6036,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6138,7 +6052,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6155,7 +6068,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6172,7 +6084,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6189,7 +6100,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -6922,7 +6832,6 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
       "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -7819,7 +7728,7 @@
       "version": "1.31.1",
       "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
       "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MPL-2.0",
       "dependencies": {
         "detect-libc": "^2.0.3"
@@ -7852,7 +7761,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7873,7 +7781,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7894,7 +7801,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7915,7 +7821,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7936,7 +7841,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7957,7 +7861,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7978,7 +7881,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -7999,7 +7901,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8020,7 +7921,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8041,7 +7941,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -8062,7 +7961,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MPL-2.0",
       "optional": true,
       "os": [
@@ -9437,7 +9335,7 @@
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
       "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
-      "dev": true,
+      "devOptional": true,
       "license": "ISC",
       "dependencies": {
         "pngjs": "^7.0.0"
@@ -9461,7 +9359,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
       "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
         "playwright-core": "1.58.2"
@@ -9480,7 +9378,7 @@
       "version": "1.58.2",
       "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
       "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
-      "dev": true,
+      "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
         "playwright-core": "cli.js"
@@ -9493,7 +9391,7 @@
       "version": "7.0.0",
       "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
       "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14.19.0"
@@ -11673,7 +11571,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11690,7 +11587,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11707,7 +11603,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11724,7 +11619,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11741,7 +11635,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11758,7 +11651,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11775,7 +11667,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11792,7 +11683,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11809,7 +11699,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11826,7 +11715,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11843,7 +11731,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11860,7 +11747,6 @@
       "cpu": [
         "mips64el"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11877,7 +11763,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11894,7 +11779,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11911,7 +11795,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11928,7 +11811,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11945,7 +11827,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11962,7 +11843,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11979,7 +11859,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -11996,7 +11875,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12013,7 +11891,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12030,7 +11907,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12086,7 +11962,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -12500,7 +12375,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12517,7 +12391,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12534,7 +12407,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12551,7 +12423,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12568,7 +12439,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12585,7 +12455,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12602,7 +12471,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12619,7 +12487,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12636,7 +12503,6 @@
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12653,7 +12519,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12670,7 +12535,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12687,7 +12551,6 @@
       "cpu": [
         "loong64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12704,7 +12567,6 @@
       "cpu": [
         "mips64el"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12721,7 +12583,6 @@
       "cpu": [
         "ppc64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12738,7 +12599,6 @@
       "cpu": [
         "riscv64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12755,7 +12615,6 @@
       "cpu": [
         "s390x"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12772,7 +12631,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12789,7 +12647,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12806,7 +12663,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12823,7 +12679,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12840,7 +12695,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12857,7 +12711,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12874,7 +12727,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12891,7 +12743,6 @@
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12908,7 +12759,6 @@
       "cpu": [
         "ia32"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12925,7 +12775,6 @@
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
@@ -12981,7 +12830,6 @@
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
       "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "optional": true,
@@ -13293,7 +13141,7 @@
       "version": "8.19.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
       "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

From b7aad814379da7959dacb7c13dda925c33764063 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 06:50:01 +0200
Subject: [PATCH 069/136] #98 swap order of action and selection bar

---
 src/lib/components/storage/explorer/ObjectTable.svelte | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 6ad99bef..66f185b6 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -25,6 +25,9 @@
 <div class="preview-scroll h-full overflow-x-auto overflow-y-auto">
   <table class="table-sm table">
     <thead class="bg-base-100 sticky top-0 z-10">
+      <!-- Selection action toolbar -->
+      <SelectionToolbar />
+
       <!-- Column headers -->
       <tr
         class="
@@ -50,9 +53,6 @@
         <th class="w-3/12 font-semibold">{m.storage_header_last_modified()}</th>
         <th class="w-10"></th>
       </tr>
-
-      <!-- Selection action toolbar -->
-      <SelectionToolbar />
     </thead>
 
     <tbody>

From 17ed09c06be4757fea6f02a4de491d4d1ef45e0a Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 07:15:41 +0200
Subject: [PATCH 070/136] #98 allow for resizing sidebar

---
 messages/de.json                              |   1 +
 messages/en.json                              |   1 +
 .../storage/sidebar/BucketList.svelte         | 114 +++++++++++++++++-
 3 files changed, 115 insertions(+), 1 deletion(-)

diff --git a/messages/de.json b/messages/de.json
index 1d5615af..51aa72a2 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -144,6 +144,7 @@
   "storage_connect_forget_cancel": "Abbrechen",
   "storage_connect_forget_label": "Verbindung zu {endpoint} vergessen",
   "storage_disconnect": "Verbindung Trennen",
+  "storage_sidebar_resize_handle": "Seitenleiste in der Größe ändern",
   "storage_buckets_label": "Buckets",
   "storage_buckets_subtitle": "Durchsuchen und verwalten Sie Ihre gespeicherten Objekte.",
   "storage_view_all_buckets": "Alle Buckets anzeigen",
diff --git a/messages/en.json b/messages/en.json
index 6f5a6875..487239e6 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -144,6 +144,7 @@
   "storage_connect_forget_cancel": "Cancel",
   "storage_connect_forget_label": "Forget connection to {endpoint}",
   "storage_disconnect": "Disconnect",
+  "storage_sidebar_resize_handle": "Resize sidebar",
   "storage_buckets_label": "Buckets",
   "storage_buckets_subtitle": "Browse and manage your stored objects.",
   "storage_view_all_buckets": "View all buckets",
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 7ccda83e..67597df0 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { browser } from '$app/environment';
   import { page } from '$app/state';
   import { resolve } from '$app/paths';
   import { beforeNavigate } from '$app/navigation';
@@ -15,6 +16,85 @@
 
   const storage = getStorageState();
 
+  // ── Resizable sidebar ─────────────────────────────────────────────────────
+  const SIDEBAR_WIDTH_KEY = 'storage_sidebar_width';
+  const DEFAULT_WIDTH = 192; // matches previous w-48
+  const MIN_WIDTH = 120;
+  const MAX_WIDTH = 480;
+
+  function getInitialWidth(): number {
+    if (!browser) return DEFAULT_WIDTH;
+    try {
+      const stored = localStorage.getItem(SIDEBAR_WIDTH_KEY);
+      if (stored) {
+        const parsed = parseInt(stored, 10);
+        if (!isNaN(parsed) && parsed >= MIN_WIDTH && parsed <= MAX_WIDTH) return parsed;
+      }
+    } catch {
+      /* ignore storage errors */
+    }
+    return DEFAULT_WIDTH;
+  }
+
+  function saveWidth(width: number) {
+    try {
+      localStorage.setItem(SIDEBAR_WIDTH_KEY, String(width));
+    } catch {
+      /* ignore storage errors */
+    }
+  }
+
+  let sidebarWidth = $state(getInitialWidth());
+  let isDragging = $state(false);
+  let dragStartX = 0;
+  let dragStartWidth = 0;
+
+  function onResizeStart(e: PointerEvent) {
+    isDragging = true;
+    dragStartX = e.clientX;
+    dragStartWidth = sidebarWidth;
+    (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId);
+    e.preventDefault();
+  }
+
+  function onResizeMove(e: PointerEvent) {
+    if (!isDragging) return;
+    const delta = e.clientX - dragStartX;
+    sidebarWidth = Math.min(MAX_WIDTH, Math.max(MIN_WIDTH, dragStartWidth + delta));
+  }
+
+  function onResizeEnd() {
+    if (!isDragging) return;
+    isDragging = false;
+    saveWidth(sidebarWidth);
+  }
+
+  function onResizeKeydown(e: KeyboardEvent) {
+    const step = e.shiftKey ? 20 : 4;
+    if (e.key === 'ArrowRight') {
+      sidebarWidth = Math.min(MAX_WIDTH, sidebarWidth + step);
+      saveWidth(sidebarWidth);
+      e.preventDefault();
+    } else if (e.key === 'ArrowLeft') {
+      sidebarWidth = Math.max(MIN_WIDTH, sidebarWidth - step);
+      saveWidth(sidebarWidth);
+      e.preventDefault();
+    }
+  }
+
+  // Keep the col-resize cursor active across the whole page while dragging so
+  // it doesn't flicker when the pointer moves faster than the DOM updates.
+  $effect(() => {
+    if (!browser) return;
+    if (isDragging) {
+      document.body.style.cursor = 'col-resize';
+      document.body.style.userSelect = 'none';
+    } else {
+      document.body.style.cursor = '';
+      document.body.style.userSelect = '';
+    }
+  });
+
   // page.url may be undefined in the error boundary state (when a client-side
   // universal load throws and SvelteKit transitions to the error state). Guard
   // with optional chaining to avoid crashing the layout and escalating the
@@ -113,9 +193,10 @@
 
 <nav
   class="
-    border-base-300 bg-base-100 flex w-48 shrink-0 flex-col
+    border-base-300 bg-base-100 relative flex shrink-0 flex-col
     rounded-lg border
   "
+  style="width: {sidebarWidth}px"
   aria-label={m.storage_buckets_label()}
 >
   <!-- Pinned Access section -->
@@ -239,4 +320,35 @@
       </button>
     </form>
   </div>
+
+  <!-- Drag-to-resize handle -->
+  <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
+  <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+  <div
+    role="separator"
+    aria-orientation="vertical"
+    aria-label={m.storage_sidebar_resize_handle()}
+    aria-valuenow={sidebarWidth}
+    aria-valuemin={MIN_WIDTH}
+    aria-valuemax={MAX_WIDTH}
+    tabindex="0"
+    class="
+      focus-visible:outline-primary/50 absolute inset-y-0 -right-2 z-10 w-4 cursor-col-resize
+      touch-none rounded-r-lg
+      select-none focus-visible:outline-2 focus-visible:outline-offset-0
+    "
+    onpointerdown={onResizeStart}
+    onpointermove={onResizeMove}
+    onpointerup={onResizeEnd}
+    onpointercancel={onResizeEnd}
+    onkeydown={onResizeKeydown}
+  >
+    <div
+      class="
+        absolute inset-y-2 left-1/2 w-0.5 -translate-x-1/2 rounded-full
+        transition-colors duration-100
+        {isDragging ? 'bg-primary' : 'bg-base-300 hover:bg-primary/50'}
+      "
+    ></div>
+  </div>
 </nav>

From e0c6aa0c6104f935d30c8e3c687dbb2f2dc68311 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 07:49:39 +0200
Subject: [PATCH 071/136] #98 add copy path and full path actions

---
 e2e/storage/context-menu.spec.ts              | 64 +++++++++++++++++++
 messages/de.json                              |  4 ++
 messages/en.json                              |  4 ++
 .../storage/explorer/ContextMenu.svelte       | 16 +++++
 src/lib/storage/state.svelte.ts               | 19 ++++++
 src/lib/storage/types.ts                      | 10 ++-
 6 files changed, 116 insertions(+), 1 deletion(-)

diff --git a/e2e/storage/context-menu.spec.ts b/e2e/storage/context-menu.spec.ts
index 3d01da59..d68bf144 100644
--- a/e2e/storage/context-menu.spec.ts
+++ b/e2e/storage/context-menu.spec.ts
@@ -93,4 +93,68 @@ test.describe('Storage S3 — Context Menu', () => {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
   });
+
+  test('Copy filename copies the bare file name to the clipboard', async ({
+    page,
+    context
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'ctx-copy-name');
+    const cleanupKeys = [`${prefix}copy-name-test.txt`];
+
+    try {
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}copy-name-test.txt`,
+        'copy name test'
+      );
+
+      await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'copy-name-test.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Copy filename' }).click();
+
+      await expect(page.getByText('Filename copied to clipboard')).toBeVisible();
+
+      const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+      expect(clipboardText).toBe('copy-name-test.txt');
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('Copy path copies the full s3:// URI to the clipboard', async ({
+    page,
+    context
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'ctx-copy-path');
+    const cleanupKeys = [`${prefix}copy-path-test.txt`];
+
+    try {
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}copy-path-test.txt`,
+        'copy path test'
+      );
+
+      await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'copy-path-test.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Copy path' }).click();
+
+      await expect(page.getByText('Path copied to clipboard')).toBeVisible();
+
+      const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+      expect(clipboardText).toBe(`s3://${credentials.bucket}/${prefix}copy-path-test.txt`);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
 });
diff --git a/messages/de.json b/messages/de.json
index 51aa72a2..3e355a8a 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -191,6 +191,10 @@
   "storage_action_paste": "Einfügen",
   "storage_action_pin": "Ort anheften",
   "storage_action_unpin": "Loslösen",
+  "storage_action_copy_filename": "Dateiname kopieren",
+  "storage_action_copy_filename_success": "Dateiname in die Zwischenablage kopiert.",
+  "storage_action_copy_path": "Pfad kopieren",
+  "storage_action_copy_path_success": "Pfad in die Zwischenablage kopiert.",
   "storage_pinned_label": "Angeheftete Orte",
   "storage_more_options": "Weitere Optionen",
   "storage_recent_files": "Zuletzt geöffnete Dateien",
diff --git a/messages/en.json b/messages/en.json
index 487239e6..b272b10f 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -191,6 +191,10 @@
   "storage_action_paste": "Paste",
   "storage_action_pin": "Pin this location",
   "storage_action_unpin": "Unpin",
+  "storage_action_copy_filename": "Copy filename",
+  "storage_action_copy_filename_success": "Filename copied to clipboard.",
+  "storage_action_copy_path": "Copy path",
+  "storage_action_copy_path_success": "Path copied to clipboard.",
   "storage_pinned_label": "Pinned Access",
   "storage_more_options": "More options",
   "storage_recent_files": "Recent Files",
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index eb4dd9d4..981e88da 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -7,6 +7,8 @@
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
   import IconPushPin from 'virtual:icons/material-symbols/push-pin';
   import IconDelete from 'virtual:icons/material-symbols/delete';
+  import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconFileCopy from 'virtual:icons/material-symbols/file-copy-outline';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import type { ActionName } from '$lib/storage/types.js';
@@ -69,6 +71,20 @@
       disabled: !canDownload,
       hidden: false
     },
+    {
+      key: 'copy-filename' as ActionName,
+      icon: IconFileCopy as Component,
+      label: m.storage_action_copy_filename(),
+      disabled: storage.contextMenu === null,
+      hidden: false
+    },
+    {
+      key: 'copy-path' as ActionName,
+      icon: IconContentCopy as Component,
+      label: m.storage_action_copy_path(),
+      disabled: storage.contextMenu === null,
+      hidden: false
+    },
     {
       key: 'pin' as ActionName,
       icon: IconPushPinOutline as Component,
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index a52740f4..3c2880fa 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -17,6 +17,7 @@ import { addToast } from '$lib/stores/toast.svelte.js';
 import { ActionError, getActionErrorMessage } from './errors.js';
 import { BookmarksState } from './bookmarks.svelte.js';
 import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import { keyToName } from '$lib/storage/utils.js';
 
 export class StorageState {
   // ── Core data (synced from server load) ──
@@ -294,6 +295,24 @@ export class StorageState {
       case 'unpin':
         this.bookmarks.unpin(this.bucket, ctxKey ?? this.prefix);
         return;
+
+      case 'copy-filename': {
+        const nameKey = ctxKey ?? this.selectedFiles[0]?.key;
+        if (!nameKey) return;
+        await navigator.clipboard.writeText(keyToName(nameKey));
+        addToast('success', m.storage_action_copy_filename_success());
+        return;
+      }
+
+      case 'copy-path': {
+        const pathKey = ctxKey ?? this.selectedFiles[0]?.key;
+        if (!pathKey) return;
+        // Strip trailing slash for folders so the URI is canonical.
+        const cleanKey = pathKey.endsWith('/') ? pathKey.slice(0, -1) : pathKey;
+        await navigator.clipboard.writeText(`s3://${this.bucket}/${cleanKey}`);
+        addToast('success', m.storage_action_copy_path_success());
+        return;
+      }
     }
   };
 
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index c8975115..dd43f495 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -30,7 +30,15 @@ export type NavigateFn = (
 
 // ── Action names ─────────────────────────────────────────────────────────────
 
-export type ActionName = 'download' | 'upload' | 'preview' | 'delete' | 'pin' | 'unpin';
+export type ActionName =
+  | 'download'
+  | 'upload'
+  | 'preview'
+  | 'delete'
+  | 'pin'
+  | 'unpin'
+  | 'copy-filename'
+  | 'copy-path';
 
 // ── Storage locations ────────────────────────────────────────────────────────
 

From 079638e4188b7db09baaeb967458cb2d87eb64e4 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 07:56:32 +0200
Subject: [PATCH 072/136] #98 close modals by clicking outside of them

---
 src/lib/components/Modal.svelte | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/lib/components/Modal.svelte b/src/lib/components/Modal.svelte
index b8fdfdb5..99558c69 100644
--- a/src/lib/components/Modal.svelte
+++ b/src/lib/components/Modal.svelte
@@ -24,9 +24,17 @@
   function handleClose() {
     open = false;
   }
+
+  function handleBackdropClick(e: MouseEvent) {
+    // The click target is the <dialog> element itself only when the backdrop is
+    // clicked; clicks inside the content bubble up to child elements instead.
+    if (e.target === dialogEl) {
+      open = false;
+    }
+  }
 </script>
 
-<dialog bind:this={dialogEl} class={className} onclose={handleClose}>
+<dialog bind:this={dialogEl} class={className} onclose={handleClose} onclick={handleBackdropClick}>
   {#if open}
     {@render children()}
   {/if}

From 0a4f46590b4cf2c0d4f00a4fca18c6e0e0607d3d Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 08:03:08 +0200
Subject: [PATCH 073/136] #98 add disconnect confirmation box

---
 messages/de.json                              |  4 ++
 messages/en.json                              |  4 ++
 .../storage/sidebar/BucketList.svelte         | 43 ++++++++++++++++---
 3 files changed, 45 insertions(+), 6 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 3e355a8a..c1384db7 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -144,6 +144,10 @@
   "storage_connect_forget_cancel": "Abbrechen",
   "storage_connect_forget_label": "Verbindung zu {endpoint} vergessen",
   "storage_disconnect": "Verbindung Trennen",
+  "storage_disconnect_confirm_title": "Speicherverbindung trennen?",
+  "storage_disconnect_confirm_message": "Sie werden zum Verbindungsbildschirm zurückgeleitet.",
+  "storage_disconnect_cancel": "Abbrechen",
+  "storage_disconnect_confirm_button": "Verbindung trennen",
   "storage_sidebar_resize_handle": "Seitenleiste in der Größe ändern",
   "storage_buckets_label": "Buckets",
   "storage_buckets_subtitle": "Durchsuchen und verwalten Sie Ihre gespeicherten Objekte.",
diff --git a/messages/en.json b/messages/en.json
index b272b10f..1f671aa5 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -144,6 +144,10 @@
   "storage_connect_forget_cancel": "Cancel",
   "storage_connect_forget_label": "Forget connection to {endpoint}",
   "storage_disconnect": "Disconnect",
+  "storage_disconnect_confirm_title": "Disconnect from storage?",
+  "storage_disconnect_confirm_message": "You will be returned to the connection screen.",
+  "storage_disconnect_cancel": "Cancel",
+  "storage_disconnect_confirm_button": "Disconnect",
   "storage_sidebar_resize_handle": "Resize sidebar",
   "storage_buckets_label": "Buckets",
   "storage_buckets_subtitle": "Browse and manage your stored objects.",
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 67597df0..dcdbe2fd 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -9,6 +9,8 @@
   import IconBucket from '../shared/BucketIcon.svelte';
   import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
   import IconGridView from 'virtual:icons/material-symbols/grid-view';
+  import IconPowerOff from 'virtual:icons/material-symbols/power-settings-new';
+  import Modal from '$lib/components/Modal.svelte';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import type { PinnedLocation, StorageLocation } from '$lib/storage/types.js';
@@ -95,6 +97,15 @@
     }
   });
 
+  // ── Disconnect confirmation ───────────────────────────────────────────────
+  let disconnectConfirmOpen = $state(false);
+  let disconnectForm = $state<HTMLFormElement | null>(null);
+
+  function confirmDisconnect() {
+    disconnectConfirmOpen = false;
+    disconnectForm?.requestSubmit();
+  }
+
   // page.url may be undefined in the error boundary state (when a client-side
   // universal load throws and SvelteKit transitions to the error state). Guard
   // with optional chaining to avoid crashing the layout and escalating the
@@ -306,21 +317,41 @@
     {/if}
   </ul>
 
-  <!-- TODO: This needs to be a two step process to avoid unintentional disconnects from misclicks -->
   <!-- Disconnect button -->
   <div class="border-base-300 border-t p-2">
-    <form method="POST" action="/storage?/disconnect">
+    <form bind:this={disconnectForm} method="POST" action="/storage?/disconnect">
       <button
-        type="submit"
-        class="
-        btn text-base-content/60 btn-ghost btn-xs hover:text-error w-full
-      "
+        type="button"
+        class="btn text-base-content/60 btn-ghost btn-xs hover:text-error w-full"
+        onclick={() => (disconnectConfirmOpen = true)}
       >
         {m.storage_disconnect()}
       </button>
     </form>
   </div>
 
+  <!-- Disconnect confirmation modal -->
+  <Modal bind:open={disconnectConfirmOpen} class="modal">
+    <div class="modal-box max-w-sm">
+      <h3 class="mb-3 flex items-center gap-2 text-lg font-bold">
+        <IconPowerOff class="text-error size-5 shrink-0" aria-hidden="true" />
+        {m.storage_disconnect_confirm_title()}
+      </h3>
+      <p class="text-base-content/80 text-sm">
+        {m.storage_disconnect_confirm_message()}
+      </p>
+      <div class="modal-action mt-6">
+        <button class="btn btn-ghost" onclick={() => (disconnectConfirmOpen = false)}>
+          {m.storage_disconnect_cancel()}
+        </button>
+        <button class="btn btn-outline btn-error" onclick={confirmDisconnect}>
+          <IconPowerOff class="size-4" aria-hidden="true" />
+          {m.storage_disconnect_confirm_button()}
+        </button>
+      </div>
+    </div>
+  </Modal>
+
   <!-- Drag-to-resize handle -->
   <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
   <!-- svelte-ignore a11y_no_noninteractive_tabindex -->

From 433a41f098212b36c775fb508649602a76183fe8 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 08:54:52 +0200
Subject: [PATCH 074/136] #98 move api paths to /<app>/api

---
 src/app.d.ts                                  |  2 +-
 src/hooks.server.ts                           | 10 ++++--
 .../components/catalog/CatalogBrowser.svelte  |  2 +-
 .../storage/modals/PreviewModal.svelte        |  2 +-
 .../storage/sidebar/BucketList.svelte.spec.ts | 31 +++++++++++++++++--
 .../editor/completion/completion-metadata.ts  |  4 +--
 src/lib/storage/download.ts                   |  2 +-
 src/lib/storage/state.svelte.ts               |  2 +-
 src/lib/storage/upload.ts                     |  4 +--
 .../api => api/storage}/buckets/+server.ts    |  0
 .../api => api/storage}/delete/+server.ts     |  0
 .../api => api/storage}/delete/server.test.ts |  0
 .../api => api/storage}/download/+server.ts   |  0
 .../storage}/download/server.test.ts          |  0
 .../api => api/storage}/objects/+server.ts    |  0
 .../api => api/storage}/params.test.ts        |  0
 .../{storage/api => api/storage}/params.ts    |  0
 .../api => api/storage}/preview/+server.ts    |  0
 .../storage}/preview/server.test.ts           |  0
 .../api => api/storage}/upload/+server.ts     |  0
 .../api => api/storage}/upload/server.test.ts |  0
 .../(app)/{ => api}/trino/catalog/+server.ts  |  0
 .../trino/completion/metadata/+server.ts      |  0
 .../(app)/{ => api}/trino/query/+server.ts    |  2 +-
 src/routes/(app)/storage/+layout.ts           |  2 +-
 .../storage/[bucket]/[...prefix]/+page.ts     |  2 +-
 src/routes/(app)/trino/+page.svelte           |  2 +-
 src/routes/(app)/trino/query-runner.svelte.ts | 12 ++++---
 28 files changed, 55 insertions(+), 24 deletions(-)
 rename src/routes/(app)/{storage/api => api/storage}/buckets/+server.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/delete/+server.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/delete/server.test.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/download/+server.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/download/server.test.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/objects/+server.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/params.test.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/params.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/preview/+server.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/preview/server.test.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/upload/+server.ts (100%)
 rename src/routes/(app)/{storage/api => api/storage}/upload/server.test.ts (100%)
 rename src/routes/(app)/{ => api}/trino/catalog/+server.ts (100%)
 rename src/routes/(app)/{ => api}/trino/completion/metadata/+server.ts (100%)
 rename src/routes/(app)/{ => api}/trino/query/+server.ts (97%)

diff --git a/src/app.d.ts b/src/app.d.ts
index 222b0243..f31b166a 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -18,7 +18,7 @@ declare global {
       /**
        * Parsed S3 connection config extracted from the `x-storage-connection`
        * request header by the `handleStorageConnection` middleware.
-       * Always non-null for requests to `/(app)/storage/api/*` routes
+       * Always non-null for requests to `/(app)/api/storage/*` routes
        * (the middleware throws 401 before the handler runs if the header is absent).
        * Null for all other routes.
        */
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index ddec24e7..0cd63943 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -63,17 +63,21 @@ const handleAuthGuard: Handle = async ({ event, resolve }) => {
 /**
  * Parse the `x-storage-connection` header (base64 JSON) for every request and
  * store the result in `event.locals.storageConfig`. For routes under
- * `/(app)/storage/api/` the header is mandatory — the middleware throws 401
+ * `/(app)/api/storage/` the header is mandatory — the middleware throws 401
  * before the handler runs if it is absent, so handlers can rely on
  * `locals.storageConfig` being non-null. Throws 400 for a present but
  * malformed / invalid header on any route.
  */
 const handleStorageConnection: Handle = async ({ event, resolve }) => {
-  if (event.route.id?.startsWith('/(app)/storage/') && !storageBrowserEnabled) {
+  if (
+    (event.route.id?.startsWith('/(app)/storage/') ||
+      event.route.id?.startsWith('/(app)/api/storage/')) &&
+    !storageBrowserEnabled
+  ) {
     throw error(404, 'Storage browser is not enabled');
   }
   event.locals.storageConfig = getConnectionFromHeader(event.request);
-  if (event.locals.storageConfig === null && event.route.id?.startsWith('/(app)/storage/api/')) {
+  if (event.locals.storageConfig === null && event.route.id?.startsWith('/(app)/api/storage/')) {
     throw error(401, 'No storage connection configured');
   }
   return resolve(event);
diff --git a/src/lib/components/catalog/CatalogBrowser.svelte b/src/lib/components/catalog/CatalogBrowser.svelte
index 1cff6aec..f73931d8 100644
--- a/src/lib/components/catalog/CatalogBrowser.svelte
+++ b/src/lib/components/catalog/CatalogBrowser.svelte
@@ -29,7 +29,7 @@
 
   async function fetchLevel(params: Record<string, string>): Promise<unknown[][]> {
     const qs = new URLSearchParams(params).toString();
-    const res = await fetch(`/trino/catalog?${qs}`);
+    const res = await fetch(`/api/trino/catalog?${qs}`);
     if (!res.ok) {
       const text = await res.text();
       throw new Error(text);
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index cc01971d..c15b24ae 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -97,7 +97,7 @@
 
     try {
       const params = new URLSearchParams({ bucket: bkt, key });
-      const res = await fetch(`/storage/api/preview?${params}`, { headers });
+      const res = await fetch(`/api/storage/preview?${params}`, { headers });
 
       if (!res.ok) {
         const errBody = await res.json().catch(() => ({}));
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
index fa2528ce..f880a727 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
+++ b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
@@ -312,12 +312,37 @@ describe('BucketList', () => {
       await expect.element(page.getByRole('button', { name: /disconnect/i })).toBeInTheDocument();
     });
 
-    it('should be a submit button inside a form', async () => {
+    it('should be a type=button (not submit) that opens a confirmation modal', async () => {
       const state = createState({ buckets: ['b1'] });
       render(BucketListWrapper, { state });
 
-      const button = page.getByRole('button', { name: /disconnect/i });
-      await expect.element(button).toHaveAttribute('type', 'submit');
+      const button = page.getByRole('button', { name: /disconnect/i }).first();
+      await expect.element(button).toHaveAttribute('type', 'button');
+    });
+
+    it('should open confirmation modal when disconnect button is clicked', async () => {
+      const state = createState({ buckets: ['b1'] });
+      render(BucketListWrapper, { state });
+
+      const button = page.getByRole('button', { name: /disconnect/i }).first();
+      await button.click();
+
+      await expect.element(page.getByText(/disconnect from storage/i)).toBeInTheDocument();
+    });
+
+    it('should close confirmation modal when cancel button is clicked', async () => {
+      const state = createState({ buckets: ['b1'] });
+      render(BucketListWrapper, { state });
+
+      await page
+        .getByRole('button', { name: /disconnect/i })
+        .first()
+        .click();
+      await expect.element(page.getByText(/disconnect from storage/i)).toBeInTheDocument();
+
+      await page.getByRole('button', { name: /^cancel$/i }).click();
+
+      await expect.element(page.getByText(/disconnect from storage/i)).not.toBeInTheDocument();
     });
   });
 
diff --git a/src/lib/editor/completion/completion-metadata.ts b/src/lib/editor/completion/completion-metadata.ts
index 93ae1ac0..80092e52 100644
--- a/src/lib/editor/completion/completion-metadata.ts
+++ b/src/lib/editor/completion/completion-metadata.ts
@@ -1,4 +1,4 @@
-// Typed client for GET /trino/completion/metadata with a short-lived in-memory
+// Typed client for GET /api/trino/completion/metadata with a short-lived in-memory
 // cache. Used by the Monaco completion provider; kept provider-agnostic so it
 // can be shared by other callers that need the same metadata.
 
@@ -46,7 +46,7 @@ async function fetchCached<T>(cacheKey: string, qs: URLSearchParams, empty: T):
   }
 
   const promise = (async () => {
-    const res = await fetch(`/trino/completion/metadata?${qs.toString()}`);
+    const res = await fetch(`/api/trino/completion/metadata?${qs.toString()}`);
     if (!res.ok) return empty;
     const value = (await res.json()) as T;
     clientCache.set(cacheKey, { value, expiresAt: Date.now() + CLIENT_CACHE_TTL_MS });
diff --git a/src/lib/storage/download.ts b/src/lib/storage/download.ts
index ef447a63..8ba9dcc8 100644
--- a/src/lib/storage/download.ts
+++ b/src/lib/storage/download.ts
@@ -35,7 +35,7 @@ export class DownloadError extends Error {
 }
 
 function buildDownloadUrl(bucket: string, key: string): string {
-  return `/storage/api/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
+  return `/api/storage/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
 }
 
 function mapStatusToCode(status: number): DownloadErrorCode {
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 3c2880fa..3e9d7fbc 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -387,7 +387,7 @@ export class StorageState {
     const conn = loadConnectionLocally();
     const headers: HeadersInit = conn ? { 'x-storage-connection': getConnectionHeader(conn) } : {};
 
-    const res = await fetch(`/storage/api/delete?${params}`, { method: 'DELETE', headers });
+    const res = await fetch(`/api/storage/delete?${params}`, { method: 'DELETE', headers });
     if (!res.ok) {
       let code: string;
       if (res.status === 401) code = 'not_connected';
diff --git a/src/lib/storage/upload.ts b/src/lib/storage/upload.ts
index 0f366405..f64199af 100644
--- a/src/lib/storage/upload.ts
+++ b/src/lib/storage/upload.ts
@@ -34,11 +34,11 @@ export class UploadError extends Error {
 }
 
 function buildUploadUrl(bucket: string, key: string): string {
-  return `/storage/api/upload?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
+  return `/api/storage/upload?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
 }
 
 function buildDownloadUrl(bucket: string, key: string): string {
-  return `/storage/api/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
+  return `/api/storage/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
 }
 
 function mapStatusToUploadCode(status: number): UploadErrorCode {
diff --git a/src/routes/(app)/storage/api/buckets/+server.ts b/src/routes/(app)/api/storage/buckets/+server.ts
similarity index 100%
rename from src/routes/(app)/storage/api/buckets/+server.ts
rename to src/routes/(app)/api/storage/buckets/+server.ts
diff --git a/src/routes/(app)/storage/api/delete/+server.ts b/src/routes/(app)/api/storage/delete/+server.ts
similarity index 100%
rename from src/routes/(app)/storage/api/delete/+server.ts
rename to src/routes/(app)/api/storage/delete/+server.ts
diff --git a/src/routes/(app)/storage/api/delete/server.test.ts b/src/routes/(app)/api/storage/delete/server.test.ts
similarity index 100%
rename from src/routes/(app)/storage/api/delete/server.test.ts
rename to src/routes/(app)/api/storage/delete/server.test.ts
diff --git a/src/routes/(app)/storage/api/download/+server.ts b/src/routes/(app)/api/storage/download/+server.ts
similarity index 100%
rename from src/routes/(app)/storage/api/download/+server.ts
rename to src/routes/(app)/api/storage/download/+server.ts
diff --git a/src/routes/(app)/storage/api/download/server.test.ts b/src/routes/(app)/api/storage/download/server.test.ts
similarity index 100%
rename from src/routes/(app)/storage/api/download/server.test.ts
rename to src/routes/(app)/api/storage/download/server.test.ts
diff --git a/src/routes/(app)/storage/api/objects/+server.ts b/src/routes/(app)/api/storage/objects/+server.ts
similarity index 100%
rename from src/routes/(app)/storage/api/objects/+server.ts
rename to src/routes/(app)/api/storage/objects/+server.ts
diff --git a/src/routes/(app)/storage/api/params.test.ts b/src/routes/(app)/api/storage/params.test.ts
similarity index 100%
rename from src/routes/(app)/storage/api/params.test.ts
rename to src/routes/(app)/api/storage/params.test.ts
diff --git a/src/routes/(app)/storage/api/params.ts b/src/routes/(app)/api/storage/params.ts
similarity index 100%
rename from src/routes/(app)/storage/api/params.ts
rename to src/routes/(app)/api/storage/params.ts
diff --git a/src/routes/(app)/storage/api/preview/+server.ts b/src/routes/(app)/api/storage/preview/+server.ts
similarity index 100%
rename from src/routes/(app)/storage/api/preview/+server.ts
rename to src/routes/(app)/api/storage/preview/+server.ts
diff --git a/src/routes/(app)/storage/api/preview/server.test.ts b/src/routes/(app)/api/storage/preview/server.test.ts
similarity index 100%
rename from src/routes/(app)/storage/api/preview/server.test.ts
rename to src/routes/(app)/api/storage/preview/server.test.ts
diff --git a/src/routes/(app)/storage/api/upload/+server.ts b/src/routes/(app)/api/storage/upload/+server.ts
similarity index 100%
rename from src/routes/(app)/storage/api/upload/+server.ts
rename to src/routes/(app)/api/storage/upload/+server.ts
diff --git a/src/routes/(app)/storage/api/upload/server.test.ts b/src/routes/(app)/api/storage/upload/server.test.ts
similarity index 100%
rename from src/routes/(app)/storage/api/upload/server.test.ts
rename to src/routes/(app)/api/storage/upload/server.test.ts
diff --git a/src/routes/(app)/trino/catalog/+server.ts b/src/routes/(app)/api/trino/catalog/+server.ts
similarity index 100%
rename from src/routes/(app)/trino/catalog/+server.ts
rename to src/routes/(app)/api/trino/catalog/+server.ts
diff --git a/src/routes/(app)/trino/completion/metadata/+server.ts b/src/routes/(app)/api/trino/completion/metadata/+server.ts
similarity index 100%
rename from src/routes/(app)/trino/completion/metadata/+server.ts
rename to src/routes/(app)/api/trino/completion/metadata/+server.ts
diff --git a/src/routes/(app)/trino/query/+server.ts b/src/routes/(app)/api/trino/query/+server.ts
similarity index 97%
rename from src/routes/(app)/trino/query/+server.ts
rename to src/routes/(app)/api/trino/query/+server.ts
index 04ee08e7..e726f836 100644
--- a/src/routes/(app)/trino/query/+server.ts
+++ b/src/routes/(app)/api/trino/query/+server.ts
@@ -8,7 +8,7 @@ import {
   removeTabQuery
 } from '$lib/server/trino/queries.js';
 import { resolveTrinoClient } from '$lib/server/trino/client.js';
-import { StatementRequestSchema, TabIdSchema } from '../validation.js';
+import { StatementRequestSchema, TabIdSchema } from '../../../trino/validation.js';
 import type { RequestHandler } from './$types';
 
 export const POST: RequestHandler = async ({ request, locals }) => {
diff --git a/src/routes/(app)/storage/+layout.ts b/src/routes/(app)/storage/+layout.ts
index 4b4c5e10..3cacfad2 100644
--- a/src/routes/(app)/storage/+layout.ts
+++ b/src/routes/(app)/storage/+layout.ts
@@ -21,7 +21,7 @@ export const load: LayoutLoad = async ({ fetch, url }) => {
   const header = getConnectionHeader(connection);
 
   try {
-    const res = await fetch('/storage/api/buckets', {
+    const res = await fetch('/api/storage/buckets', {
       headers: { 'x-storage-connection': header }
     });
 
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
index 47568c1d..dcc0df33 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -32,7 +32,7 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
   if (continuationToken) query.set('continuationToken', continuationToken);
   if (pageSizeParam) query.set('pageSize', pageSizeParam);
 
-  const res = await fetch(`/storage/api/objects?${query}`, {
+  const res = await fetch(`/api/storage/objects?${query}`, {
     headers: { 'x-storage-connection': getConnectionHeader(connection) }
   });
 
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index bb67c769..97db2496 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -373,7 +373,7 @@
     viewStates.delete(id);
     tabStore.closeTab(id);
     // Clean up server-side query state for this tab.
-    fetch(`/trino/query?tabId=${encodeURIComponent(id)}&cleanup=true`, { method: 'DELETE' });
+    fetch(`/api/trino/query?tabId=${encodeURIComponent(id)}&cleanup=true`, { method: 'DELETE' });
   }
 
   function handleTabAdd() {
diff --git a/src/routes/(app)/trino/query-runner.svelte.ts b/src/routes/(app)/trino/query-runner.svelte.ts
index 7b75740c..af6da899 100644
--- a/src/routes/(app)/trino/query-runner.svelte.ts
+++ b/src/routes/(app)/trino/query-runner.svelte.ts
@@ -105,7 +105,7 @@ function createQueryRunner(tabId: string): QueryRunner {
 
     while (polling && !signal.aborted) {
       try {
-        const res = await fetch(`/trino/query?tabId=${encodeURIComponent(tabId)}`, { signal });
+        const res = await fetch(`/api/trino/query?tabId=${encodeURIComponent(tabId)}`, { signal });
 
         if (!res.ok) {
           state = 'FAILED';
@@ -126,7 +126,7 @@ function createQueryRunner(tabId: string): QueryRunner {
         );
         if (hasNewlyCompleted) {
           const fullRes = await fetch(
-            `/trino/query?tabId=${encodeURIComponent(tabId)}&lightweight=false`,
+            `/api/trino/query?tabId=${encodeURIComponent(tabId)}&lightweight=false`,
             { signal }
           );
           if (fullRes.ok) {
@@ -179,7 +179,7 @@ function createQueryRunner(tabId: string): QueryRunner {
     state = 'SUBMITTING';
 
     try {
-      const res = await fetch('/trino/query', {
+      const res = await fetch('/api/trino/query', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({
@@ -234,7 +234,7 @@ function createQueryRunner(tabId: string): QueryRunner {
     state = 'CANCELLED';
 
     try {
-      await fetch(`/trino/query?tabId=${encodeURIComponent(tabId)}`, { method: 'DELETE' });
+      await fetch(`/api/trino/query?tabId=${encodeURIComponent(tabId)}`, { method: 'DELETE' });
     } catch {
       // Best-effort cancel.
     }
@@ -246,7 +246,9 @@ function createQueryRunner(tabId: string): QueryRunner {
     if (results.length > 0 && results[results.length - 1].rows.length > 0) return;
 
     try {
-      const res = await fetch(`/trino/query?tabId=${encodeURIComponent(tabId)}&lightweight=false`);
+      const res = await fetch(
+        `/api/trino/query?tabId=${encodeURIComponent(tabId)}&lightweight=false`
+      );
       if (!res.ok) return;
       const snapshots: QuerySnapshot[] = await res.json();
       if (snapshots.length > 0) {

From 42709ea99a14a78f0efb52efe08f307d2f4851dd Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 09:09:40 +0200
Subject: [PATCH 075/136] #98 add skip and replace all buttons for upload
 conflicts

---
 messages/de.json                              |  4 +-
 messages/en.json                              |  2 +
 .../storage/modals/upload/UploadModal.svelte  | 27 ++++++++++
 .../modals/upload/UploadModal.svelte.spec.ts  | 53 +++++++++++++++++++
 4 files changed, 85 insertions(+), 1 deletion(-)

diff --git a/messages/de.json b/messages/de.json
index c1384db7..f8604df8 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -293,7 +293,9 @@
   "storage_upload_start": "Hochladen",
   "storage_upload_checking": "Auf Konflikte pr\u00fcfen\u2026",
   "storage_upload_conflicts_title": "Dateien bereits vorhanden",
-  "storage_upload_conflicts_desc": "W\u00e4hlen Sie f\u00fcr jede Konfliktdatei eine Aktion.",
+  "storage_upload_conflicts_desc": "Wählen Sie für jede Konfliktdatei eine Aktion.",
+  "storage_upload_skip_all": "Alle überspringen",
+  "storage_upload_replace_all": "Alle ersetzen",
   "storage_upload_resolution_replace": "Ersetzen",
   "storage_upload_resolution_skip": "\u00dcberspringen",
   "storage_upload_resolution_rename": "Umbenennen",
diff --git a/messages/en.json b/messages/en.json
index 1f671aa5..1e837d27 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -294,6 +294,8 @@
   "storage_upload_checking": "Checking for conflicts\u2026",
   "storage_upload_conflicts_title": "Files already exist",
   "storage_upload_conflicts_desc": "Choose what to do for each conflicting file.",
+  "storage_upload_skip_all": "Skip all",
+  "storage_upload_replace_all": "Replace all",
   "storage_upload_resolution_replace": "Replace",
   "storage_upload_resolution_skip": "Skip",
   "storage_upload_resolution_rename": "Rename",
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index c1b2f839..b9c2ecb1 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -197,6 +197,24 @@
     }
   }
 
+  // ── Bulk resolution ────────────────────────────────────────────────────────
+
+  function skipAll() {
+    entries = entries.map((e) =>
+      e.conflict
+        ? { ...e, resolution: 'skip' as Resolution, renameState: 'idle' as RenameState }
+        : e
+    );
+  }
+
+  function replaceAll() {
+    entries = entries.map((e) =>
+      e.conflict
+        ? { ...e, resolution: 'replace' as Resolution, renameState: 'idle' as RenameState }
+        : e
+    );
+  }
+
   // ── Resolution handlers ────────────────────────────────────────────────────
 
   function setResolution(id: string, res: Resolution) {
@@ -379,6 +397,15 @@
         </div>
       </div>
 
+      <div class="mb-2 flex justify-end gap-2">
+        <button class="btn btn-ghost btn-xs" onclick={skipAll}>
+          {m.storage_upload_skip_all()}
+        </button>
+        <button class="btn btn-ghost btn-xs" onclick={replaceAll}>
+          {m.storage_upload_replace_all()}
+        </button>
+      </div>
+
       <ul
         class="border-base-300 mb-4 max-h-72 divide-y overflow-y-auto rounded-lg border"
         aria-label={m.storage_upload_conflicts_title()}
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index e9aefc47..95889ea4 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -261,6 +261,59 @@ describe('UploadModal', () => {
       const list = page.getByRole('list');
       await expect.element(list).toBeInTheDocument();
     });
+
+    it('should show Skip all and Replace all buttons in review phase', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('existing.txt')]);
+
+      await expect.element(page.getByRole('button', { name: /skip all/i })).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: /replace all/i })).toBeInTheDocument();
+    });
+
+    it('should enable upload button after clicking Skip all', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('conflict.txt')]);
+
+      await page.getByRole('button', { name: /skip all/i }).click();
+
+      const uploadBtn = page.getByRole('button', { name: /upload/i });
+      await expect.element(uploadBtn).not.toBeDisabled();
+    });
+
+    it('should enable upload button after clicking Replace all', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('conflict.txt')]);
+
+      await page.getByRole('button', { name: /replace all/i }).click();
+
+      const uploadBtn = page.getByRole('button', { name: /upload/i });
+      await expect.element(uploadBtn).not.toBeDisabled();
+    });
+
+    it('should resolve all conflicts as skip when Skip all is clicked on multiple files', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt'), createFile('b.txt'), createFile('c.txt')]);
+
+      await page.getByRole('button', { name: /skip all/i }).click();
+
+      const uploadBtn = page.getByRole('button', { name: /upload/i });
+      await expect.element(uploadBtn).not.toBeDisabled();
+    });
+
+    it('should resolve all conflicts as replace when Replace all is clicked on multiple files', async () => {
+      mockCheckObjectExists.mockResolvedValue(true);
+      render(UploadModal, defaultProps);
+      await selectAndUpload([createFile('a.txt'), createFile('b.txt'), createFile('c.txt')]);
+
+      await page.getByRole('button', { name: /replace all/i }).click();
+
+      const uploadBtn = page.getByRole('button', { name: /upload/i });
+      await expect.element(uploadBtn).not.toBeDisabled();
+    });
   });
 
   describe('upload flow - error handling', () => {

From cbe1c151c5fa28f5143b37dc316e72c7734006a8 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 11:01:23 +0200
Subject: [PATCH 076/136] #98 fix trino unit tests, limit upload concurrency,
 fix sidebar z index

---
 .env.example                                  |  1 +
 .env.test                                     |  1 +
 dev/setup.sh                                  |  2 ++
 e2e/auth/auth.spec.ts                         | 30 ++++++++++++----
 src/lib/client/feature-flags.ts               | 11 ++++++
 .../storage/explorer/StorageBreadcrumb.svelte |  8 ++---
 .../storage/modals/upload/UploadModal.svelte  | 34 ++++++++++++-------
 .../modals/upload/UploadModal.svelte.spec.ts  | 32 +++++++++++++++++
 .../storage/sidebar/BucketList.svelte         |  2 +-
 src/test/setup-client.ts                      |  3 +-
 10 files changed, 100 insertions(+), 24 deletions(-)

diff --git a/.env.example b/.env.example
index 1c987817..e4890287 100644
--- a/.env.example
+++ b/.env.example
@@ -34,3 +34,4 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # Feature flags
 # STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
 # STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
+# PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
diff --git a/.env.test b/.env.test
index 7e822f9c..55bd5995 100644
--- a/.env.test
+++ b/.env.test
@@ -14,5 +14,6 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 GARAGE_ADMIN_URL=http://localhost:30902
 GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token
diff --git a/dev/setup.sh b/dev/setup.sh
index b428976e..d7d25c6a 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -281,6 +281,7 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 EOF
 else
   cat > "$ENV_FILE" <<EOF
@@ -298,6 +299,7 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 EOF
 fi
 
diff --git a/e2e/auth/auth.spec.ts b/e2e/auth/auth.spec.ts
index c40abcff..7688c44c 100644
--- a/e2e/auth/auth.spec.ts
+++ b/e2e/auth/auth.spec.ts
@@ -1,4 +1,5 @@
 import { test, expect } from '@playwright/test';
+import { waitForHydration } from '../support/helpers.js';
 
 test.describe('Authentication', () => {
   test.use({ locale: 'en-US' });
@@ -45,12 +46,29 @@ test.describe('Authentication', () => {
     await expect(signOutLink).toHaveAttribute('href', '/auth/logout');
   });
 
-  test('sign out redirects to login page', async ({ page }) => {
-    await page.goto('/');
-    await page.getByRole('button', { name: 'User menu' }).click();
-    await page.getByRole('link', { name: 'Sign out' }).click();
+  test('sign out redirects to login page', async ({ browser }) => {
+    // This test must use an isolated context with a freshly-created session.
+    // The sign-out call deletes the session from the database. If we used the
+    // shared storageState session here, subsequent tests whose session_data
+    // cookie cache has expired would fail because the DB session is gone.
+    const context = await browser.newContext({
+      storageState: { cookies: [], origins: [] },
+      locale: 'en-US'
+    });
+    const page = await context.newPage();
+    try {
+      await page.goto('/');
+      await waitForHydration(page);
+      await page.getByRole('button', { name: /sign in with sso/i }).click();
+      await expect(page).toHaveURL('/');
 
-    await expect(page).toHaveURL(/\/auth\/login/);
-    await expect(page.getByRole('button', { name: 'Sign in with SSO' })).toBeVisible();
+      await page.getByRole('button', { name: 'User menu' }).click();
+      await page.getByRole('link', { name: 'Sign out' }).click();
+
+      await expect(page).toHaveURL(/\/auth\/login/);
+      await expect(page.getByRole('button', { name: 'Sign in with SSO' })).toBeVisible();
+    } finally {
+      await context.close();
+    }
   });
 });
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index d15a661e..8e610877 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -58,3 +58,14 @@ export const maxRecentFiles: number = (() => {
   const parsed = parseInt(env.PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES ?? '', 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 15;
 })();
+
+/** Maximum number of parallel HTTP requests fired during the upload conflict
+ *  check and during the upload itself.
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY`. Default: 3.
+ *  Raise for faster bulk uploads on high-throughput connections; lower to
+ *  reduce server pressure on constrained deployments. Must be a positive
+ *  integer. */
+export const uploadConcurrency: number = (() => {
+  const parsed = parseInt(env.PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY ?? '', 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 3;
+})();
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 433fc3e8..7ac0e33d 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -196,7 +196,7 @@
           role="listbox"
           aria-label={m.storage_breadcrumb_more()}
           class="
-            dropdown-content menu rounded-box border-base-300 bg-base-100 z-50 w-48
+            dropdown-content menu rounded-box border-base-300 bg-base-100 z-30 w-48
             border p-1 shadow-lg
           "
         >
@@ -255,14 +255,14 @@
   <!-- Item count badges -->
   <div class="flex shrink-0 items-center gap-1.5">
     <span
-      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-60 gap-1"
+      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-30 gap-1"
       data-tip={m.storage_folder_count({ count: storage.folders.length })}
     >
       <IconFolderOutline class="size-4" aria-hidden="true" />
       <span class="font-bold">{storage.folders.length}</span>
     </span>
     <span
-      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-60 gap-1"
+      class="tooltip tooltip-bottom badge badge-soft badge-primary badge-sm z-30 gap-1"
       data-tip={m.storage_file_count({ count: storage.files.length })}
     >
       <IconDescriptionOutline class="size-4" aria-hidden="true" />
@@ -312,7 +312,7 @@
       tabindex="0"
       role="menu"
       class="
-        dropdown-content menu rounded-box border-base-300 bg-base-100 z-50 w-52
+        dropdown-content menu rounded-box border-base-300 bg-base-100 z-30 w-52
         border p-1 shadow-lg
       "
     >
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index b9c2ecb1..baa67985 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -9,6 +9,7 @@
   import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
   import { formatFileSize } from '$lib/storage/utils.js';
   import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+  import { uploadConcurrency } from '$lib/client/feature-flags.js';
   import UploadDropzone from './UploadDropzone.svelte';
   import UploadConflictEntry from './UploadConflictEntry.svelte';
   import UploadEntryStatus from './UploadEntryStatus.svelte';
@@ -105,15 +106,25 @@
     const conn = loadConnectionLocally();
     const connHeader = conn ? getConnectionHeader(conn) : '';
 
-    const results = await Promise.all(
-      entries.map(async (e) => {
-        try {
-          return { id: e.id, conflict: await checkObjectExists(bucket, e.targetKey, connHeader) };
-        } catch {
-          return { id: e.id, conflict: false };
-        }
-      })
-    );
+    const results: { id: string; conflict: boolean }[] = [];
+    for (let i = 0; i < entries.length; i += uploadConcurrency) {
+      if (cancelRequested) {
+        phase = 'idle';
+        entries = [];
+        return;
+      }
+      const batch = entries.slice(i, i + uploadConcurrency);
+      const batchResults = await Promise.all(
+        batch.map(async (e) => {
+          try {
+            return { id: e.id, conflict: await checkObjectExists(bucket, e.targetKey, connHeader) };
+          } catch {
+            return { id: e.id, conflict: false };
+          }
+        })
+      );
+      results.push(...batchResults);
+    }
 
     if (cancelRequested) {
       phase = 'idle';
@@ -151,8 +162,7 @@
     );
 
     const toUpload = entries.filter((e) => e.status !== 'skipped');
-    const concurrency = 3;
-    for (let i = 0; i < toUpload.length; i += concurrency) {
+    for (let i = 0; i < toUpload.length; i += uploadConcurrency) {
       if (cancelRequested) {
         const pending = new Set(toUpload.slice(i).map((e) => e.id));
         entries = entries.map((e) =>
@@ -160,7 +170,7 @@
         );
         break;
       }
-      await Promise.all(toUpload.slice(i, i + concurrency).map(doUploadEntry));
+      await Promise.all(toUpload.slice(i, i + uploadConcurrency).map(doUploadEntry));
     }
 
     if (!cancelRequested) {
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index 95889ea4..759502bd 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -528,6 +528,38 @@ describe('UploadModal', () => {
       check.resolve(false);
       await expect.element(page.getByRole('status')).toBeInTheDocument();
     });
+
+    it('should check at most 3 files concurrently (default uploadConcurrency)', async () => {
+      // Hold each check until we explicitly resolve it so we can inspect
+      // how many calls are in-flight at the same time.
+      // The mock setup-client.ts sets uploadConcurrency = 3 (the default).
+      const pending: Array<() => void> = [];
+      mockCheckObjectExists.mockImplementation(
+        () => new Promise<boolean>((resolve) => pending.push(() => resolve(false)))
+      );
+
+      render(UploadModal, defaultProps);
+      selectFiles(Array.from({ length: 5 }, (_, i) => createFile(`file${i}.txt`)));
+      await tick();
+
+      await page.getByRole('button', { name: /upload/i }).click();
+
+      // Wait until the checking phase is visible; by this point the first
+      // batch of checks has been fired but is still pending.
+      await expect.element(page.getByText(/checking/i)).toBeInTheDocument();
+
+      // Only the first batch (3) should have started — not all 5.
+      expect(mockCheckObjectExists).toHaveBeenCalledTimes(3);
+
+      // Unblock the first batch; the second batch (2) then fires.
+      pending.splice(0, 3).forEach((fn) => fn());
+      // Drain the second batch too so the component reaches a terminal state.
+      await vi.waitFor(() => expect(pending.length).toBe(2));
+      pending.splice(0).forEach((fn) => fn());
+
+      await expect.element(page.getByRole('status')).toBeInTheDocument();
+      expect(mockCheckObjectExists).toHaveBeenCalledTimes(5);
+    });
   });
 
   describe('accessibility', () => {
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index dcdbe2fd..c6b35e9c 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -222,7 +222,7 @@
         {#each storage.bookmarks.pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
           {@const active = isPinnedActive(pin)}
           <li role="none" class="group relative">
-            <div class="tooltip tooltip-right relative z-50 w-full" data-tip={pinnedLabel(pin)}>
+            <div class="tooltip tooltip-right relative z-30 w-full" data-tip={pinnedLabel(pin)}>
               <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <a
                 href={pinnedHref(pin)}
diff --git a/src/test/setup-client.ts b/src/test/setup-client.ts
index 4cc8f7ff..e01a15bc 100644
--- a/src/test/setup-client.ts
+++ b/src/test/setup-client.ts
@@ -8,7 +8,8 @@ vi.mock('$lib/client/feature-flags.js', () => ({
   storageAutoConnectEnabled: false,
   allowedPageSizes: [25, 50, 100],
   defaultPageSize: 25,
-  maxRecentFiles: 15
+  maxRecentFiles: 15,
+  uploadConcurrency: 3
 }));
 
 // Prevent components from auto-submitting forms in browser tests.

From 047ccb892656079d67a7c54413773c7af5330e49 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 25 Jun 2026 11:37:21 +0200
Subject: [PATCH 077/136] #98 fix e2e tests

---
 e2e/storage/connection.spec.ts   |  3 +++
 e2e/storage/context-menu.spec.ts | 12 ++++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index d314dde3..c22cffd4 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -46,6 +46,9 @@ test.describe('Storage S3 — Connection', () => {
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
     await page.getByRole('button', { name: 'Disconnect' }).click();
+    // Clicking Disconnect opens a confirmation modal; confirm by clicking the
+    // Disconnect button inside the dialog.
+    await page.getByRole('dialog').getByRole('button', { name: 'Disconnect' }).click();
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
   });
 
diff --git a/e2e/storage/context-menu.spec.ts b/e2e/storage/context-menu.spec.ts
index d68bf144..27858f93 100644
--- a/e2e/storage/context-menu.spec.ts
+++ b/e2e/storage/context-menu.spec.ts
@@ -96,8 +96,12 @@ test.describe('Storage S3 — Context Menu', () => {
 
   test('Copy filename copies the bare file name to the clipboard', async ({
     page,
-    context
+    context,
+    browserName
   }, testInfo) => {
+    // Firefox does not support clipboard-read in grantPermissions.
+    test.skip(browserName === 'firefox', 'Firefox does not support clipboard-read permission');
+
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
     const prefix = uniquePrefix(testInfo, 'ctx-copy-name');
@@ -128,8 +132,12 @@ test.describe('Storage S3 — Context Menu', () => {
 
   test('Copy path copies the full s3:// URI to the clipboard', async ({
     page,
-    context
+    context,
+    browserName
   }, testInfo) => {
+    // Firefox does not support clipboard-read in grantPermissions.
+    test.skip(browserName === 'firefox', 'Firefox does not support clipboard-read permission');
+
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
     const prefix = uniquePrefix(testInfo, 'ctx-copy-path');

From b33923b99bfe6014037a8019b367b10bd86c8afb Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 29 Jun 2026 10:38:37 +0200
Subject: [PATCH 078/136] rebuild server for e2e tests

---
 playwright.config.ts | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/playwright.config.ts b/playwright.config.ts
index 568b4946..c81965d7 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -22,17 +22,17 @@ export default defineConfig({
     {
       command: 'npx tsx e2e/support/start-mock-oidc.ts',
       url: 'http://localhost:9090/.well-known/openid-configuration',
-      reuseExistingServer: true
+      reuseExistingServer: false
     },
     {
       command: 'npx tsx e2e/support/start-mock-trino.ts',
       url: 'http://localhost:8080',
-      reuseExistingServer: true
+      reuseExistingServer: false
     },
     {
       command: 'PORT=4173 node --env-file=.env.test build',
       url: baseURL,
-      reuseExistingServer: true
+      reuseExistingServer: false
     }
   ],
   projects: [

From c636494ee770d804fbe6de5d7a0ac37b1526110e Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 29 Jun 2026 11:06:54 +0200
Subject: [PATCH 079/136] Add code editor (#209)

* #153 allow upload of empty files

* test: add test for uploading empty files in S3 storage provider tests

* #173 add create button for empty directories and files

* #173 fix button height

* #207 make text file preview an editor instead

* #207 add syntax highlighting, add truncation security for the editor when saving

* #207 fix unit test, fix lint

* #207 improve loading of code editor

* fix build

* fix e2e test

* #207 prevent tab closing of unsaved changes, make discard button red, fix backdrop click bug

* #207 fix locale format on buttons, limit saving file size in backend, fix creating files and directories

* #207 add comments

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .env.example                                  |   1 +
 dev/setup.sh                                  |   2 +
 messages/de.json                              |  19 ++
 messages/en.json                              |  19 ++
 src/lib/client/feature-flags.ts               |  12 +
 src/lib/components/Modal.svelte               |  23 +-
 src/lib/components/editor/MonacoEditor.svelte |  11 +-
 src/lib/components/editor/TextEditor.svelte   | 208 ++++++++++++++
 .../storage/explorer/StorageBreadcrumb.svelte | 177 +++++++++++-
 .../explorer/file-icon/FileIconAndName.svelte |   3 +-
 .../storage/modals/PreviewModal.svelte        | 270 +++++++++++++++---
 .../modals/PreviewModal.svelte.spec.ts        |   4 +
 .../modals/UnsavedConfirmDialog.svelte        |  63 ++++
 src/lib/server/feature-flags.ts               |  14 +
 src/lib/server/storage/s3-provider.ts         |  97 ++++---
 src/lib/server/storage/service.ts             |  14 +
 .../(app)/api/storage/create/+server.ts       |  27 ++
 .../(app)/api/storage/save-text/+server.ts    | 128 +++++++++
 src/test/setup-client.ts                      |   1 +
 vite.config.ts                                |   3 +
 20 files changed, 995 insertions(+), 101 deletions(-)
 create mode 100644 src/lib/components/editor/TextEditor.svelte
 create mode 100644 src/lib/components/storage/modals/UnsavedConfirmDialog.svelte
 create mode 100644 src/lib/server/storage/service.ts
 create mode 100644 src/routes/(app)/api/storage/create/+server.ts
 create mode 100644 src/routes/(app)/api/storage/save-text/+server.ts

diff --git a/.env.example b/.env.example
index e4890287..d05d0656 100644
--- a/.env.example
+++ b/.env.example
@@ -34,4 +34,5 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # Feature flags
 # STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
 # STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
+# PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=1048576  # Max file size (in bytes) of editable text files in the storage browser (default: 5 MiB)
 # PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
diff --git a/dev/setup.sh b/dev/setup.sh
index 90ec3268..9609283c 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -312,6 +312,7 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 DATABASE_HOST=localhost
 DATABASE_PORT=31432
@@ -335,6 +336,7 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 DATABASE_HOST=localhost
 DATABASE_PORT=31432
diff --git a/messages/de.json b/messages/de.json
index f8604df8..e68cb506 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -281,6 +281,17 @@
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
   "storage_preview_maximise": "Maximieren",
   "storage_preview_restore": "Wiederherstellen",
+  "storage_editor_save": "Speichern",
+  "storage_editor_saving": "Speichern\u2026",
+  "storage_editor_saved": "Gespeichert",
+  "storage_editor_unsaved_title": "Ungespeicherte \u00c4nderungen",
+  "storage_editor_unsaved_desc": "Sie haben ungespeicherte \u00c4nderungen. Was m\u00f6chten Sie tun?",
+  "storage_editor_save_and_close": "Speichern und schlie\u00dfen",
+  "storage_editor_discard": "Verwerfen",
+  "storage_editor_cancel": "Abbrechen",
+  "storage_editor_error": "Datei konnte nicht gespeichert werden.",
+  "storage_editor_too_large": "Datei zu gro\u00df zum Speichern. Die maximal bearbeitbare Dateigr\u00f6\u00dfe betr\u00e4gt {limit}.",
+  "storage_editor_too_large_badge": "Schreibgesch\u00fctzt: \u00fcberschreitet {limit}",
   "storage_context_menu_actions": "Aktionen",
   "storage_action_upload": "Hochladen",
   "storage_upload_title": "Hochladen",
@@ -326,6 +337,14 @@
   "storage_upload_rename_confirm": "Mit diesem Namen hochladen",
   "storage_upload_retry": "Erneut versuchen",
   "storage_upload_close": "Schlie\u00dfen",
+  "storage_action_create": "Erstellen",
+  "storage_create_file": "Neue Textdatei",
+  "storage_create_folder": "Neues Verzeichnis",
+  "storage_create_name": "Name",
+  "storage_create_placeholder": "Namen eingeben\u2026",
+  "storage_create_confirm": "Erstellen",
+  "storage_create_cancel": "Abbrechen",
+  "storage_create_error": "{name} konnte nicht erstellt werden",
   "timestamp_just_now": "gerade eben",
   "timestamp_minutes_ago": [
     {
diff --git a/messages/en.json b/messages/en.json
index 1e837d27..05a4d3ab 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -281,6 +281,17 @@
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
   "storage_preview_maximise": "Maximise",
   "storage_preview_restore": "Restore",
+  "storage_editor_save": "Save",
+  "storage_editor_saving": "Saving\u2026",
+  "storage_editor_saved": "Saved",
+  "storage_editor_unsaved_title": "Unsaved changes",
+  "storage_editor_unsaved_desc": "You have unsaved changes. What would you like to do?",
+  "storage_editor_save_and_close": "Save and close",
+  "storage_editor_discard": "Discard",
+  "storage_editor_cancel": "Cancel",
+  "storage_editor_error": "Failed to save file.",
+  "storage_editor_too_large": "File too large to save. The maximum editable file size is {limit}.",
+  "storage_editor_too_large_badge": "Read-only: exceeds {limit}",
   "storage_context_menu_actions": "Actions",
   "storage_action_upload": "Upload",
   "storage_upload_title": "Upload",
@@ -326,6 +337,14 @@
   "storage_upload_rename_confirm": "Upload with this name",
   "storage_upload_retry": "Retry",
   "storage_upload_close": "Close",
+  "storage_action_create": "Create",
+  "storage_create_file": "New text file",
+  "storage_create_folder": "New directory",
+  "storage_create_name": "Name",
+  "storage_create_placeholder": "Enter name\u2026",
+  "storage_create_confirm": "Create",
+  "storage_create_cancel": "Cancel",
+  "storage_create_error": "Failed to create {name}",
   "timestamp_just_now": "just now",
   "timestamp_minutes_ago": [
     {
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index 8e610877..368aa943 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -47,6 +47,18 @@ export const defaultPageSize: number = (() => {
   return allowedPageSizes.includes(parsed) ? parsed : (allowedPageSizes[0] ?? 25);
 })();
 
+// ── Storage browser: Text editor ─────────────────────────────────────────────
+
+/** Maximum file size (in bytes) that can be edited inline in the text editor.
+ *  Files larger than this will show a read-only preview without the save button.
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE`. Default: 5242880 (5 MiB).
+ *  Raise to allow editing larger files; lower to avoid excessive S3 bandwidth
+ *  when saving truncated files (the full file must be re-uploaded). */
+export const maxEditableFileSize: number = (() => {
+  const parsed = parseInt(env.PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE ?? '', 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 5 * 1024 * 1024;
+})();
+
 // ── Storage browser ──────────────────────────────────────────────────────────
 
 /** Maximum number of recently visited files and locations kept in localStorage
diff --git a/src/lib/components/Modal.svelte b/src/lib/components/Modal.svelte
index 99558c69..1f648e54 100644
--- a/src/lib/components/Modal.svelte
+++ b/src/lib/components/Modal.svelte
@@ -2,11 +2,13 @@
   let {
     open = $bindable(false),
     children,
-    class: className = ''
+    class: className = '',
+    closeguard
   }: {
     open: boolean;
     children: import('svelte').Snippet;
     class?: string;
+    closeguard?: () => boolean;
   } = $props();
 
   let dialogEl = $state<HTMLDialogElement | undefined>(undefined);
@@ -25,16 +27,31 @@
     open = false;
   }
 
+  function handleCancel(e: Event) {
+    if (closeguard && !closeguard()) {
+      e.preventDefault();
+    }
+  }
+
   function handleBackdropClick(e: MouseEvent) {
     // The click target is the <dialog> element itself only when the backdrop is
     // clicked; clicks inside the content bubble up to child elements instead.
-    if (e.target === dialogEl) {
+    if (e.target !== dialogEl) return;
+    if (closeguard && !closeguard()) {
+      e.preventDefault();
+    } else {
       open = false;
     }
   }
 </script>
 
-<dialog bind:this={dialogEl} class={className} onclose={handleClose} onclick={handleBackdropClick}>
+<dialog
+  bind:this={dialogEl}
+  class={className}
+  onclose={handleClose}
+  oncancel={handleCancel}
+  onclick={handleBackdropClick}
+>
   {#if open}
     {@render children()}
   {/if}
diff --git a/src/lib/components/editor/MonacoEditor.svelte b/src/lib/components/editor/MonacoEditor.svelte
index 65a57c93..7a378508 100644
--- a/src/lib/components/editor/MonacoEditor.svelte
+++ b/src/lib/components/editor/MonacoEditor.svelte
@@ -2,6 +2,7 @@
   import { onMount, onDestroy } from 'svelte';
   import { browser } from '$app/environment';
   import { theme } from '$lib/theme.svelte';
+  import { getLocale } from '$lib/paraglide/runtime.js';
   import {
     registerTrinoSql,
     setCompletionDefaultsGetter,
@@ -133,7 +134,6 @@
   // Start loading in parallel with the rest of the page — not deferred to onMount.
   // Guarded by `browser` because SvelteKit evaluates component scripts on the server too.
   const workerImport = browser ? import('monaco-editor/esm/vs/editor/editor.worker?worker') : null;
-  const monacoImport = browser ? import('monaco-editor') : null;
 
   function toMonacoTheme(t: string): string {
     return t === 'dark' ? 'vs-dark' : 'vs';
@@ -144,13 +144,20 @@
   });
 
   onMount(async () => {
+    // Load Monaco's NLS bundle for the active locale. Static import strings are
+    // required — Vite cannot bundle bare-specifier template literals at build time.
+    if (getLocale() === 'de') {
+      // @ts-expect-error — Monaco ESM nls bundle has no types
+      await import('monaco-editor/esm/nls.messages.de.js');
+    }
+
     // By the time onMount fires the imports are likely already resolved.
     const EditorWorker = (await workerImport!).default;
     self.MonacoEnvironment = {
       getWorker: () => new EditorWorker()
     };
 
-    monaco = await monacoImport!;
+    monaco = await import('monaco-editor');
 
     setCompletionDefaultsGetter(() => ({
       catalog: defaultCatalog || undefined,
diff --git a/src/lib/components/editor/TextEditor.svelte b/src/lib/components/editor/TextEditor.svelte
new file mode 100644
index 00000000..181bb4e0
--- /dev/null
+++ b/src/lib/components/editor/TextEditor.svelte
@@ -0,0 +1,208 @@
+<script lang="ts">
+  import { onMount, onDestroy } from 'svelte';
+  import { browser } from '$app/environment';
+  import { theme } from '$lib/theme.svelte';
+  import { getLocale } from '$lib/paraglide/runtime.js';
+
+  let {
+    value = $bindable(),
+    contentType = 'text/plain',
+    filename = '',
+    readonly = false,
+    ready = $bindable(false),
+    onSave
+  }: {
+    value?: string;
+    contentType?: string;
+    filename?: string;
+    readonly?: boolean;
+    ready?: boolean;
+    onSave?: () => void;
+  } = $props();
+
+  let container: HTMLDivElement;
+  let editor: import('monaco-editor').editor.IStandaloneCodeEditor | undefined;
+  let monaco = $state<typeof import('monaco-editor') | undefined>(undefined);
+
+  const extension = $derived(filename.split('.').pop()?.toLowerCase() ?? '');
+
+  const extLanguageMap: Record<string, string> = {
+    ts: 'typescript',
+    tsx: 'typescript',
+    js: 'javascript',
+    jsx: 'javascript',
+    mjs: 'javascript',
+    cjs: 'javascript',
+    json: 'json',
+    jsonc: 'json',
+    html: 'html',
+    htm: 'html',
+    css: 'css',
+    scss: 'scss',
+    less: 'less',
+    md: 'markdown',
+    mdx: 'markdown',
+    xml: 'xml',
+    svg: 'xml',
+    yaml: 'yaml',
+    yml: 'yaml',
+    py: 'python',
+    pyw: 'python',
+    rb: 'ruby',
+    rs: 'rust',
+    go: 'go',
+    java: 'java',
+    kt: 'kotlin',
+    kts: 'kotlin',
+    swift: 'swift',
+    c: 'c',
+    h: 'c',
+    cpp: 'cpp',
+    cxx: 'cpp',
+    hpp: 'cpp',
+    cs: 'csharp',
+    fs: 'fsharp',
+    fsx: 'fsharp',
+    php: 'php',
+    sh: 'shell',
+    bash: 'shell',
+    zsh: 'shell',
+    pl: 'perl',
+    pm: 'perl',
+    lua: 'lua',
+    r: 'r',
+    sql: 'sql',
+    ps1: 'powershell',
+    psd1: 'powershell',
+    psm1: 'powershell',
+    clj: 'clojure',
+    cljs: 'clojure',
+    edn: 'clojure',
+    coffe: 'coffeescript',
+    coffee: 'coffeescript',
+    dockerfile: 'dockerfile',
+    ini: 'ini',
+    cfg: 'ini',
+    conf: 'ini',
+    bat: 'bat',
+    cmd: 'bat',
+    tex: 'latex',
+    vb: 'vb'
+  };
+
+  const language = $derived.by(() => {
+    if (
+      contentType === 'application/json' ||
+      contentType === 'text/json' ||
+      contentType.includes('+json')
+    )
+      return 'json';
+    if (contentType === 'text/css') return 'css';
+    if (contentType === 'text/html') return 'html';
+    if (contentType === 'text/javascript' || contentType === 'application/javascript')
+      return 'javascript';
+    if (contentType === 'text/markdown') return 'markdown';
+    if (contentType === 'application/xml' || contentType === 'text/xml') return 'xml';
+    if (contentType === 'application/yaml' || contentType === 'text/yaml') return 'yaml';
+    if (contentType === 'text/x-python' || contentType === 'application/x-python') return 'python';
+    if (contentType === 'text/x-java') return 'java';
+    if (contentType === 'text/x-go') return 'go';
+    if (contentType === 'text/x-rust') return 'rust';
+    if (contentType === 'text/x-ruby') return 'ruby';
+    if (contentType === 'text/x-php') return 'php';
+    if (contentType === 'text/x-sh' || contentType === 'application/x-sh') return 'shell';
+    if (contentType === 'text/x-sql') return 'sql';
+    if (contentType === 'text/x-typescript') return 'typescript';
+    if (contentType === 'text/x-csharp') return 'csharp';
+    if (contentType === 'text/x-c++') return 'cpp';
+    if (contentType.startsWith('text/') || contentType === 'application/octet-stream') {
+      return extLanguageMap[extension] ?? 'plaintext';
+    }
+    return extLanguageMap[extension] ?? 'plaintext';
+  });
+
+  const workerImport = browser ? import('monaco-editor/esm/vs/editor/editor.worker?worker') : null;
+
+  function toMonacoTheme(t: string): string {
+    return t === 'dark' ? 'vs-dark' : 'vs';
+  }
+
+  $effect(() => {
+    monaco?.editor.setTheme(toMonacoTheme(theme.current));
+  });
+
+  onMount(async () => {
+    if (!browser) return;
+
+    // Load Monaco's NLS bundle for the active locale. Static import strings are
+    // required — Vite cannot bundle bare-specifier template literals at build time.
+    if (getLocale() === 'de') {
+      // @ts-expect-error — Monaco ESM nls bundle has no types
+      await import('monaco-editor/esm/nls.messages.de.js');
+    }
+
+    const EditorWorker = (await workerImport!).default;
+    self.MonacoEnvironment = {
+      getWorker: () => new EditorWorker()
+    };
+
+    monaco = await import('monaco-editor');
+
+    editor = monaco.editor.create(container, {
+      value,
+      language,
+      readOnly: readonly,
+      theme: toMonacoTheme(theme.current),
+      minimap: { enabled: false },
+      fontSize: 13,
+      lineNumbers: 'on',
+      scrollBeyondLastLine: false,
+      automaticLayout: true,
+      padding: { top: 8, bottom: 8 },
+      wordWrap: 'on',
+      quickSuggestions: false,
+      suggestOnTriggerCharacters: false,
+      renderWhitespace: 'boundary',
+      bracketPairColorization: { enabled: true }
+    });
+
+    if (!readonly) {
+      editor.focus();
+    }
+
+    editor.onDidChangeModelContent(() => {
+      value = editor!.getValue();
+    });
+
+    if (onSave) {
+      editor.addAction({
+        id: 'save-file',
+        label: 'Save File',
+        keybindings: [monaco.KeyMod.CtrlCmd | monaco.KeyCode.KeyS],
+        run: onSave
+      });
+    }
+
+    ready = true;
+  });
+
+  onDestroy(() => {
+    editor?.dispose();
+  });
+</script>
+
+<div
+  bind:this={container}
+  class="h-full min-h-0 w-full"
+  class:opacity-0={!ready}
+  data-ready={ready || undefined}
+  role="application"
+  aria-label="Text editor"
+>
+  {#if !browser || !ready}
+    <pre
+      class="text-base-content/90 bg-base-200/50 h-full overflow-auto p-4 font-mono text-xs whitespace-pre-wrap"
+      class:opacity-60={readonly}
+      aria-readonly={readonly || undefined}>{value}</pre>
+  {/if}
+</div>
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 7ac0e33d..58f23aa3 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -10,9 +10,12 @@
   import IconMoreVert from 'virtual:icons/material-symbols/more-vert';
   import IconPushPin from 'virtual:icons/material-symbols/push-pin';
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
+  import IconAdd from 'virtual:icons/material-symbols/add';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import type { StorageLocation } from '$lib/storage/types.js';
+  import { invalidateAll } from '$app/navigation';
+  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 
   const storage = getStorageState();
 
@@ -38,6 +41,80 @@
 
   const currentIsPinned = $derived(storage.bookmarks.isPinned(storage.bucket, storage.prefix));
 
+  // ── Create menu (inline dropdown) ─────────────────────────────────────
+  let createOpen = $state(false);
+  let createType = $state<'file' | 'folder'>('file');
+  let createName = $state('');
+  let createStep = $state<'choose' | 'name'>('choose');
+  let creating = $state(false);
+  let createError = $state('');
+
+  const NAME_INVALID_CHARS = /[^\w\s./()\-+@,:;!$*'=]/g;
+
+  function sanitizeName(raw: string): string {
+    return raw.replace(NAME_INVALID_CHARS, '');
+  }
+
+  function openCreate() {
+    createOpen = true;
+    createStep = 'choose';
+    createType = 'file';
+    createName = '';
+    createError = '';
+  }
+
+  function closeCreate() {
+    createOpen = false;
+  }
+
+  function selectCreateType(type: 'file' | 'folder') {
+    createType = type;
+    createStep = 'name';
+    createName = type === 'file' ? 'untitled.txt' : 'new-folder';
+    createError = '';
+  }
+
+  async function createObject(bucket: string, key: string): Promise<void> {
+    const params = new URLSearchParams({ bucket, key });
+    const conn = loadConnectionLocally();
+    const headers: HeadersInit = conn ? { 'x-storage-connection': getConnectionHeader(conn) } : {};
+    const res = await fetch(`/api/storage/create?${params}`, { method: 'POST', headers });
+    if (!res.ok) throw new Error(`Create failed with status ${res.status}`);
+  }
+
+  async function handleCreate() {
+    const name = sanitizeName(createName.trim());
+    if (!name || name === '.' || name === '..') {
+      createError = m.storage_create_error({ name: createName });
+      return;
+    }
+    creating = true;
+    createError = '';
+
+    try {
+      const isFolder = createType === 'folder';
+      const parts = name.split('/');
+
+      // Create intermediate directory markers for each path segment
+      for (let i = 0; i < parts.length - 1; i++) {
+        const dirKey = storage.prefix + parts.slice(0, i + 1).join('/') + '/';
+        await createObject(storage.bucket, dirKey);
+      }
+
+      // Create the final object (file or directory)
+      const finalKey = storage.prefix + name + (isFolder ? '/' : '');
+      await createObject(storage.bucket, finalKey);
+
+      closeCreate();
+      storage.loading = true;
+      void invalidateAll();
+    } catch {
+      createError = m.storage_create_error({ name: createName });
+    } finally {
+      creating = false;
+    }
+  }
+
   // ── Breadcrumb label context menu (right-click to pin / unpin) ───────────
   let breadcrumbCtx = $state<({ x: number; y: number } & StorageLocation) | null>(null);
 
@@ -177,7 +254,10 @@
       </span>
     {/if}
     {#if collapsedParts.length > 0}
-      <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+      <IconChevronRight
+        class="text-base-content/30 pointer-events-none size-4 shrink-0"
+        aria-hidden="true"
+      />
       <div class="dropdown">
         <button
           tabindex="0"
@@ -219,7 +299,10 @@
     {/if}
     {#each visibleParts as part, i (part.prefix)}
       {@const isCurrent = i === visibleParts.length - 1}
-      <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+      <IconChevronRight
+        class="text-base-content/30 pointer-events-none size-4 shrink-0"
+        aria-hidden="true"
+      />
       <span class="group flex min-w-0 items-center gap-1">
         {#if isCurrent}
           <!-- svelte-ignore a11y_no_static_element_interactions -->
@@ -288,6 +371,96 @@
     {m.storage_select_toggle()}
   </button>
 
+  <!-- Create button -->
+  <div class="dropdown dropdown-end inline-flex" class:dropdown-open={createOpen}>
+    <button
+      class="btn btn-primary btn-xs gap-1"
+      onclick={openCreate}
+      aria-haspopup="menu"
+      aria-expanded={createOpen}
+    >
+      <IconAdd class="size-3.5" aria-hidden="true" />
+      {m.storage_action_create()}
+    </button>
+    {#if createOpen}
+      <!-- svelte-ignore a11y_no_static_element_interactions -->
+      <div
+        class="fixed inset-0 z-40"
+        onmousedown={closeCreate}
+        onkeydown={(e) => e.key === 'Escape' && closeCreate()}
+      ></div>
+      {#if createStep === 'choose'}
+        <ul
+          role="menu"
+          class="
+            dropdown-content menu rounded-box border-base-300 bg-base-100 z-60 w-48
+            border p-1 shadow-lg
+          "
+        >
+          <li role="none">
+            <button
+              role="menuitem"
+              class="justify-start text-sm"
+              onclick={() => selectCreateType('file')}
+            >
+              <IconDescriptionOutline class="size-4 shrink-0" aria-hidden="true" />
+              {m.storage_create_file()}
+            </button>
+          </li>
+          <li role="none">
+            <button
+              role="menuitem"
+              class="justify-start text-sm"
+              onclick={() => selectCreateType('folder')}
+            >
+              <IconFolderOutline class="size-4 shrink-0" aria-hidden="true" />
+              {m.storage_create_folder()}
+            </button>
+          </li>
+        </ul>
+      {:else}
+        <div
+          class="
+            dropdown-content rounded-box border-base-300 bg-base-100 z-60 w-64
+            border p-3 shadow-lg
+          "
+        >
+          <label for="create-name-input" class="label label-text mb-1 p-0">
+            {m.storage_create_name()}
+          </label>
+          <input
+            id="create-name-input"
+            class="input input-bordered input-sm w-full"
+            value={createName}
+            placeholder={m.storage_create_placeholder()}
+            oninput={(e) => {
+              createName = sanitizeName(e.currentTarget.value);
+            }}
+            onkeydown={(e) => {
+              if (e.key === 'Enter') handleCreate();
+              if (e.key === 'Escape') closeCreate();
+            }}
+          />
+          {#if createError}
+            <p class="text-error mt-1 text-xs">{createError}</p>
+          {/if}
+          <div class="mt-2 flex justify-end gap-2">
+            <button class="btn btn-ghost btn-xs" disabled={creating} onclick={closeCreate}>
+              {m.storage_create_cancel()}
+            </button>
+            <button
+              class="btn btn-primary btn-xs"
+              disabled={creating || !createName.trim()}
+              onclick={handleCreate}
+            >
+              {m.storage_create_confirm()}
+            </button>
+          </div>
+        </div>
+      {/if}
+    {/if}
+  </div>
+
   <!-- Upload button -->
   <button
     class="btn btn-primary btn-xs gap-1"
diff --git a/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
index c1a7e6cc..b53d1018 100644
--- a/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
+++ b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
@@ -13,8 +13,7 @@
   const kind = $derived(fileIconKind(file.contentType, file.key));
   const config = $derived(FILE_ICON_CONFIG[kind]);
 
-  const ext = $derived(file.key.split('.').at(-1)?.toLowerCase() ?? '');
-  const badge = $derived(file.contentType ? (file.contentType.split('/').at(-1) ?? '') : ext);
+  const badge = $derived(file.contentType ? (file.contentType.split('/').at(-1) ?? '') : '');
 </script>
 
 <div class="flex items-center gap-2.5">
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index c15b24ae..ab805f0b 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -1,13 +1,18 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
+  import { browser } from '$app/environment';
+  import { SvelteURLSearchParams } from 'svelte/reactivity';
   import IconCloseFullscreen from 'virtual:icons/material-symbols/close-fullscreen';
   import IconOpenInFull from 'virtual:icons/material-symbols/open-in-full';
   import IconClose from 'virtual:icons/material-symbols/close';
   import IconErrorOutline from 'virtual:icons/material-symbols/error-outline';
   import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconSave from 'virtual:icons/material-symbols/save';
+  import IconBlock from 'virtual:icons/material-symbols/block';
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
-  import TextPreview from './preview/TextPreview.svelte';
+  import TextEditor from '$lib/components/editor/TextEditor.svelte';
+  import UnsavedConfirmDialog from './UnsavedConfirmDialog.svelte';
   import CsvPreview from './preview/CsvPreview.svelte';
   import ImagePreview from './preview/ImagePreview.svelte';
   import PdfPreview from './preview/PdfPreview.svelte';
@@ -17,6 +22,7 @@
   import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
   import { addToast } from '$lib/stores/toast.svelte.js';
   import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+  import { maxEditableFileSize } from '$lib/client/feature-flags.js';
 
   interface Props {
     open: boolean;
@@ -52,14 +58,39 @@
     | { kind: 'error'; message: string };
 
   let preview: PreviewKind = $state({ kind: 'idle' });
-  // Not $state — the template never reads blobUrls directly, only preview.blobUrl.
-  // Keeping it non-reactive prevents a read/write cycle inside the $effect below.
   let blobUrls: string[] = [];
   let maximized = $state(false);
   let imageNaturalWidth = $state(0);
   let imageNaturalHeight = $state(0);
 
-  // Revoke blob URLs when the component is destroyed
+  // ── Text editor state ──
+  let editorText = $state('');
+  let originalText = $state('');
+  let saving = $state(false);
+  let showUnsavedConfirm = $state(false);
+  let editorReady = $state(false);
+
+  const dirty = $derived(editorText !== originalText);
+
+  // Prevent accidental browser tab/window close when there are unsaved changes.
+  $effect(() => {
+    if (!dirty) return;
+
+    function handleBeforeUnload(e: BeforeUnloadEvent) {
+      e.preventDefault();
+    }
+
+    window.addEventListener('beforeunload', handleBeforeUnload);
+    return () => window.removeEventListener('beforeunload', handleBeforeUnload);
+  });
+
+  const filename = $derived(objectKey ? keyToName(objectKey) : '');
+
+  function isTooLargeToEdit(): boolean {
+    if (preview.kind !== 'text') return false;
+    return preview.totalSize > maxEditableFileSize;
+  }
+
   onDestroy(() => {
     for (const url of blobUrls) {
       URL.revokeObjectURL(url);
@@ -73,16 +104,24 @@
     blobUrls = [];
   }
 
-  // Load preview whenever the modal opens or the key changes
   $effect(() => {
     if (open && objectKey) {
+      editorReady = false;
       void loadPreview(objectKey, bucket);
+      // Start loading Monaco in parallel with data fetching
+      if (browser) {
+        import('monaco-editor/esm/vs/editor/editor.worker?worker');
+        import('monaco-editor');
+      }
     }
     if (!open) {
       revokeBlobUrls();
       preview = { kind: 'idle' };
       imageNaturalWidth = 0;
       imageNaturalHeight = 0;
+      editorReady = false;
+      editorText = '';
+      originalText = '';
     }
   });
 
@@ -121,14 +160,12 @@
       const totalRows = Number(res.headers.get('X-Preview-Total-Rows') ?? '0');
       const previewRows = Number(res.headers.get('X-Preview-Preview-Rows') ?? '0');
 
-      // Server flagged this as a known-binary type — skip body fetch entirely.
       if (res.headers.get('X-Preview-Renderable') === 'false') {
         await res.body?.cancel();
         preview = { kind: 'fallback', contentType, isBinary: false };
         return;
       }
 
-      // Images — render as blob URL
       if (contentType.startsWith('image/')) {
         const blob = await res.blob();
         const url = URL.createObjectURL(blob);
@@ -137,7 +174,6 @@
         return;
       }
 
-      // PDF — render in iframe
       if (contentType === 'application/pdf') {
         const blob = await res.blob();
         const url = URL.createObjectURL(blob);
@@ -146,22 +182,17 @@
         return;
       }
 
-      // For everything else (text/*, application/json, application/octet-stream,
-      // application/yaml, etc.) attempt UTF-8 decode. Success → text view;
-      // failure → the file is genuinely binary.
       const text = await readTextSafely(res, key);
       if (text === null) {
         preview = { kind: 'fallback', contentType, isBinary: true };
         return;
       }
 
-      // Parquet data pre-parsed by the server and returned as CSV text.
       if (format === 'parquet') {
         preview = { kind: 'parquet', text, truncated, totalSize, totalRows, previewRows };
         return;
       }
 
-      // CSV by content-type or file extension
       if (
         contentType === 'text/csv' ||
         contentType === 'application/csv' ||
@@ -172,25 +203,19 @@
         return;
       }
 
-      // All other decoded text
       preview = { kind: 'text', text, contentType, truncated, totalSize, previewBytes };
+      editorText = text;
+      originalText = text;
     } catch {
       preview = { kind: 'error', message: m.storage_preview_error_desc() };
     }
   }
 
-  /**
-   * Read response body as text. Handles UTF-16 BOMs, strict UTF-8, and falls
-   * back to Windows-1252 for CSV/TSV files (common for Excel-exported CSVs).
-   * Returns null if the content cannot be decoded as any recognised encoding
-   * (indicating genuinely binary content).
-   */
   async function readTextSafely(res: Response, key: string): Promise<string | null> {
     try {
       const buf = await res.arrayBuffer();
       const bytes = new Uint8Array(buf);
 
-      // Detect UTF-16 BOM (common in Excel "Save as CSV (UTF-16)")
       if (bytes.length >= 2) {
         if (bytes[0] === 0xff && bytes[1] === 0xfe) {
           return new TextDecoder('utf-16le').decode(buf);
@@ -200,12 +225,9 @@
         }
       }
 
-      // Try strict UTF-8 (handles UTF-8 with or without BOM)
       try {
         return new TextDecoder('utf-8', { fatal: true }).decode(buf);
       } catch {
-        // For CSV/TSV files try Windows-1252 — the default encoding used by
-        // Excel on Windows when exporting to CSV.
         const lowerKey = key.toLowerCase();
         if (lowerKey.endsWith('.csv') || lowerKey.endsWith('.tsv')) {
           return new TextDecoder('windows-1252').decode(buf);
@@ -217,8 +239,6 @@
     }
   }
 
-  const filename = $derived(objectKey ? keyToName(objectKey) : '');
-
   async function triggerDownload() {
     if (!objectKey) return;
     const conn = loadConnectionLocally();
@@ -237,6 +257,93 @@
     }
   }
 
+  function getSaveTextParams(): URLSearchParams | null {
+    if (preview.kind !== 'text' || !objectKey) return null;
+    const params = new SvelteURLSearchParams({ bucket, key: objectKey });
+    params.set('contentType', preview.contentType);
+    params.set('originalSize', String(preview.totalSize));
+    params.set('previewBytes', String(preview.previewBytes));
+    return params;
+  }
+
+  async function handleSave() {
+    if (!objectKey) return;
+    if (isTooLargeToEdit()) {
+      addToast('error', m.storage_editor_too_large({ limit: formatFileSize(maxEditableFileSize) }));
+      return;
+    }
+    const params = getSaveTextParams();
+    if (!params) return;
+
+    saving = true;
+    try {
+      const conn = loadConnectionLocally();
+      const headers: HeadersInit = {};
+      if (conn) {
+        (headers as Record<string, string>)[STORAGE_CONNECTION_HEADER] = getConnectionHeader(conn);
+      }
+
+      const res = await fetch(`/api/storage/save-text?${params}`, {
+        method: 'POST',
+        headers,
+        body: editorText
+      });
+
+      if (!res.ok) {
+        if (res.status === 401) {
+          addToast('error', m.storage_upload_error_not_connected());
+        } else if (res.status === 403) {
+          addToast('error', m.storage_upload_error_access_denied());
+        } else if (res.status === 413) {
+          addToast(
+            'error',
+            m.storage_editor_too_large({ limit: formatFileSize(maxEditableFileSize) })
+          );
+        } else {
+          addToast('error', m.storage_editor_error());
+        }
+        return;
+      }
+
+      originalText = editorText;
+      addToast('success', m.storage_editor_saved());
+    } catch {
+      addToast('error', m.storage_editor_error());
+    } finally {
+      saving = false;
+    }
+  }
+
+  async function handleSaveAndClose() {
+    await handleSave();
+    if (originalText === editorText) {
+      showUnsavedConfirm = false;
+      close();
+    }
+  }
+
+  function handleDiscard() {
+    showUnsavedConfirm = false;
+    editorText = originalText;
+    close();
+  }
+
+  function handleCloseClick() {
+    if (dirty) {
+      showUnsavedConfirm = true;
+    } else {
+      close();
+    }
+  }
+
+  function closeguard(): boolean {
+    if (dirty) {
+      showUnsavedConfirm = true;
+      return false;
+    }
+    return true;
+  }
+
   function close() {
     open = false;
   }
@@ -246,7 +353,7 @@
   }
 </script>
 
-<Modal bind:open class="modal">
+<Modal bind:open {closeguard} class="modal">
   <div
     class="modal-box flex flex-col p-0 transition-none
       {maximized ? 'h-dvh max-h-dvh w-screen max-w-none rounded-none' : 'w-full max-w-5xl'}"
@@ -319,7 +426,7 @@
       {/if}
       <button
         class="btn btn-ghost btn-sm btn-square"
-        onclick={close}
+        onclick={handleCloseClick}
         aria-label={m.storage_preview_close()}
       >
         <IconClose class="size-5" aria-hidden="true" />
@@ -327,7 +434,7 @@
     </div>
 
     <!-- Body -->
-    <div class="preview-scroll min-h-0 min-w-0 flex-1 overflow-scroll">
+    <div class="min-h-0 min-w-0 flex-1 overflow-hidden">
       {#if preview.kind === 'idle' || preview.kind === 'loading'}
         <div
           class="flex items-center justify-center p-12"
@@ -344,33 +451,80 @@
           <p class="text-base-content/60 text-sm">{preview.message}</p>
         </div>
       {:else if preview.kind === 'text'}
-        <TextPreview text={preview.text} contentType={preview.contentType} />
+        <div class="relative flex h-full flex-col">
+          {#if !editorReady}
+            <div
+              class="bg-base-100/80 absolute inset-0 z-10 flex items-center justify-center"
+              aria-live="polite"
+              aria-label={m.storage_preview_loading()}
+            >
+              <span class="loading loading-spinner loading-md text-primary" aria-hidden="true"
+              ></span>
+              <span class="sr-only">{m.storage_preview_loading()}</span>
+            </div>
+          {/if}
+          {#if isTooLargeToEdit()}
+            <div
+              class="bg-base-200 border-base-300 flex shrink-0 items-center gap-2 border-b px-4 py-2"
+            >
+              <IconBlock class="text-base-content/50 size-4" aria-hidden="true" />
+              <span class="text-base-content/60 text-xs">
+                {m.storage_editor_too_large_badge({ limit: formatFileSize(maxEditableFileSize) })}
+              </span>
+            </div>
+          {/if}
+          <div class="min-h-0 flex-1">
+            <TextEditor
+              bind:value={editorText}
+              bind:ready={editorReady}
+              contentType={preview.contentType}
+              {filename}
+              readonly={isTooLargeToEdit()}
+              onSave={handleSave}
+            />
+          </div>
+        </div>
       {:else if preview.kind === 'csv'}
-        <CsvPreview text={preview.text} />
+        <div class="preview-scroll h-full overflow-scroll">
+          <CsvPreview text={preview.text} />
+        </div>
       {:else if preview.kind === 'parquet'}
-        <CsvPreview text={preview.text} />
+        <div class="preview-scroll h-full overflow-scroll">
+          <CsvPreview text={preview.text} />
+        </div>
       {:else if preview.kind === 'image'}
-        <ImagePreview
-          src={preview.blobUrl}
-          name={filename}
-          bind:naturalWidth={imageNaturalWidth}
-          bind:naturalHeight={imageNaturalHeight}
-        />
+        <div class="preview-scroll h-full overflow-scroll">
+          <ImagePreview
+            src={preview.blobUrl}
+            name={filename}
+            bind:naturalWidth={imageNaturalWidth}
+            bind:naturalHeight={imageNaturalHeight}
+          />
+        </div>
       {:else if preview.kind === 'pdf'}
-        <PdfPreview src={preview.blobUrl} name={filename} />
+        <div class="preview-scroll h-full overflow-scroll">
+          <PdfPreview src={preview.blobUrl} name={filename} />
+        </div>
       {:else if preview.kind === 'fallback'}
-        <FallbackPreview
-          contentType={preview.contentType}
-          onDownload={triggerDownload}
-          isBinary={preview.isBinary}
-        />
+        <div class="preview-scroll h-full overflow-scroll">
+          <FallbackPreview
+            contentType={preview.contentType}
+            onDownload={triggerDownload}
+            isBinary={preview.isBinary}
+          />
+        </div>
       {/if}
     </div>
 
     <!-- Footer -->
     {#if preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'parquet' || preview.kind === 'image' || preview.kind === 'pdf'}
       <div class="border-base-300 flex shrink-0 items-center justify-end gap-2 border-t px-5 py-2">
-        {#if (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
+        {#if preview.kind === 'text' && preview.truncated}
+          <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
+            <IconDownload class="size-4" aria-hidden="true" />
+            {m.storage_preview_download_full()}
+          </button>
+        {:else if preview.kind === 'csv' && preview.truncated}
           <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
@@ -381,10 +535,34 @@
             {m.storage_preview_download_full()}
           </button>
         {/if}
-        <button class="btn btn-primary btn-sm" onclick={close}>
+        {#if preview.kind === 'text' && !isTooLargeToEdit()}
+          <button
+            type="button"
+            class="btn btn-primary btn-sm gap-1.5"
+            onclick={handleSave}
+            disabled={!dirty || saving}
+          >
+            {#if saving}
+              <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+              {m.storage_editor_saving()}
+            {:else}
+              <IconSave class="size-4" aria-hidden="true" />
+              {m.storage_editor_save()}
+            {/if}
+          </button>
+        {/if}
+        <button class="btn btn-ghost btn-sm" onclick={handleCloseClick}>
           {m.storage_preview_close()}
         </button>
       </div>
     {/if}
   </div>
 </Modal>
+
+<!-- Unsaved changes confirmation -->
+<UnsavedConfirmDialog
+  bind:open={showUnsavedConfirm}
+  onSave={handleSaveAndClose}
+  onDiscard={handleDiscard}
+  onCancel={() => (showUnsavedConfirm = false)}
+/>
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
index 9dfa4408..e1905b6d 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
@@ -4,6 +4,10 @@ import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import PreviewModal from './PreviewModal.svelte';
 
+// Prevent Monaco Editor from loading in tests by making $app/environment's
+// `browser` return false. TextEditor renders a plain <pre> as fallback.
+vi.mock('$app/environment', () => ({ browser: false }));
+
 // Mock $app/paths
 vi.mock('$app/paths', () => ({
   resolve: (path: string) => path
diff --git a/src/lib/components/storage/modals/UnsavedConfirmDialog.svelte b/src/lib/components/storage/modals/UnsavedConfirmDialog.svelte
new file mode 100644
index 00000000..274c175b
--- /dev/null
+++ b/src/lib/components/storage/modals/UnsavedConfirmDialog.svelte
@@ -0,0 +1,63 @@
+<script lang="ts">
+  import Modal from '$lib/components/Modal.svelte';
+  import IconWarningRounded from 'virtual:icons/material-symbols/warning-rounded';
+  import * as m from '$lib/paraglide/messages.js';
+
+  interface Props {
+    open: boolean;
+    onSave: () => void;
+    onDiscard: () => void;
+    onCancel: () => void;
+  }
+
+  let { open = $bindable(false), onSave, onDiscard, onCancel }: Props = $props();
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box max-w-sm">
+    <h3 class="mb-3 flex items-center gap-2 text-lg font-bold">
+      <IconWarningRounded class="text-warning size-5 shrink-0" aria-hidden="true" />
+      {m.storage_editor_unsaved_title()}
+    </h3>
+
+    <p class="text-base-content/80 text-sm">
+      {m.storage_editor_unsaved_desc()}
+    </p>
+
+    <div class="modal-action mt-6">
+      <button class="btn btn-ghost btn-sm" onclick={onCancel}>
+        {m.storage_editor_cancel()}
+      </button>
+      <button class="btn btn-outline btn-ghost btn-error btn-sm" onclick={onDiscard}>
+        {m.storage_editor_discard()}
+      </button>
+      <!-- eslint-disable-next-line better-tailwindcss/no-unknown-classes -->
+      <button class="btn btn-primary save-btn" onclick={onSave}>
+        {m.storage_editor_save_and_close()}
+      </button>
+    </div>
+  </div>
+</Modal>
+
+<style>
+  /*
+   * The save button needs to wrap its label text in German ("Speichern und schließen").
+   * DaisyUI places all .btn styles inside @layer daisyui.*, so Svelte's unlayered
+   * component styles unconditionally win the cascade without !important.
+   *
+   * - flex/min-width: button fills remaining row space (cancel+discard are btn-sm,
+   *   leaving ~154 px here — enough for two-line German text).
+   * - height/align-self: removes the fixed --size height and opts out of the
+   *   parent's align-items:stretch so the button can actually grow taller.
+   * - white-space/line-height: allow the label to break at word boundaries.
+   */
+  .save-btn {
+    flex: 1;
+    min-width: 0;
+    white-space: normal;
+    height: auto;
+    min-height: 2.5rem;
+    align-self: center;
+    line-height: 1.25;
+  }
+</style>
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 8d2368cc..66fb70f9 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -2,6 +2,7 @@
 // from the live process env so consumers don't repeat the env-name + parsing.
 
 import { env } from '$env/dynamic/private';
+import { env as publicEnv } from '$env/dynamic/public';
 
 /** When `STACKABLE_COCKPIT_COMPLETION_ENABLED=false`, the SQL editor's
  *  code-completion provider is not registered and the metadata endpoint
@@ -44,3 +45,16 @@ export const pdfPreviewBytes =
  *  Higher values give more data context but increase server-side S3 reads
  *  and the size of the payload sent to the browser. */
 export const filePreviewRows = parseInt(env.STACKABLE_COCKPIT_FILE_PREVIEW_ROWS ?? '', 10) || 250;
+
+// ── Storage browser: Text editor ─────────────────────────────────────────────
+
+/** Maximum file size (in bytes) that may be saved via the inline text editor.
+ *  Files with an `originalSize` exceeding this limit are treated as read-only
+ *  and save requests are rejected with HTTP 413. Mirrors the client-side flag
+ *  `maxEditableFileSize` so that the restriction is enforced even if the client
+ *  check is bypassed.
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE`. Default: 5242880 (5 MiB). */
+export const maxEditableFileSize: number = (() => {
+  const parsed = parseInt(publicEnv.PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE ?? '', 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 5 * 1024 * 1024;
+})();
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 540be68f..e136b5ea 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -222,56 +222,61 @@ export class S3StorageProvider implements StorageProvider {
       return { failed: [] };
     }
 
-    // Expand directory prefixes to their contained keys
-    const resolvedKeys: string[] = [];
-    for (const key of keys) {
-      if (key.endsWith('/')) {
-        const children = await this.listAllKeys(key);
-        if (children.length > 0) {
-          resolvedKeys.push(...children);
-        } else {
-          resolvedKeys.push(key);
+    return withS3Errors(
+      async () => {
+        // Expand directory prefixes to their contained keys
+        const resolvedKeys: string[] = [];
+        for (const key of keys) {
+          if (key.endsWith('/')) {
+            const children = await this.listAllKeys(key);
+            if (children.length > 0) {
+              resolvedKeys.push(...children);
+            } else {
+              resolvedKeys.push(key);
+            }
+          } else {
+            resolvedKeys.push(key);
+          }
         }
-      } else {
-        resolvedKeys.push(key);
-      }
-    }
 
-    // S3 DeleteObjects has a limit of 1000 keys per request.
-    // MinIO/Ionos return MalformedXML when exceeding this limit.
-    const MAX_KEYS = 1000;
-    const allFailed: Array<{ key: string; code?: string; message?: string }> = [];
+        // S3 DeleteObjects has a limit of 1000 keys per request.
+        // MinIO/Ionos return MalformedXML when exceeding this limit.
+        const MAX_KEYS = 1000;
+        const allFailed: Array<{ key: string; code?: string; message?: string }> = [];
 
-    for (let i = 0; i < resolvedKeys.length; i += MAX_KEYS) {
-      const chunk = resolvedKeys.slice(i, i + MAX_KEYS);
-      log.trace(
-        { bucket: this.bucket, chunk_offset: i, chunk_size: chunk.length },
-        'S3 DeleteObjects chunk'
-      );
-      const output = await this.client.send(
-        new DeleteObjectsCommand({
-          Bucket: this.bucket,
-          Delete: {
-            Objects: chunk.map((key) => ({ Key: key })),
-            Quiet: true
-          }
-        })
-      );
-      const failed = (output.Errors ?? []).map((e) => ({
-        key: e.Key ?? '',
-        code: e.Code,
-        message: e.Message
-      }));
-      allFailed.push(...failed);
-    }
+        for (let i = 0; i < resolvedKeys.length; i += MAX_KEYS) {
+          const chunk = resolvedKeys.slice(i, i + MAX_KEYS);
+          log.trace(
+            { bucket: this.bucket, chunk_offset: i, chunk_size: chunk.length },
+            'S3 DeleteObjects chunk'
+          );
+          const output = await this.client.send(
+            new DeleteObjectsCommand({
+              Bucket: this.bucket,
+              Delete: {
+                Objects: chunk.map((key) => ({ Key: key })),
+                Quiet: true
+              }
+            })
+          );
+          const failed = (output.Errors ?? []).map((e) => ({
+            key: e.Key ?? '',
+            code: e.Code,
+            message: e.Message
+          }));
+          allFailed.push(...failed);
+        }
 
-    if (allFailed.length > 0) {
-      log.warn(
-        { bucket: this.bucket, failed_count: allFailed.length },
-        'some objects failed to delete'
-      );
-    }
-    return { failed: allFailed };
+        if (allFailed.length > 0) {
+          log.warn(
+            { bucket: this.bucket, failed_count: allFailed.length },
+            'some objects failed to delete'
+          );
+        }
+        return { failed: allFailed };
+      },
+      { bucket: this.bucket, operation: 'deleteObjects' }
+    );
   }
 
   async listAllKeys(prefix: string): Promise<string[]> {
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
new file mode 100644
index 00000000..2dcea1dd
--- /dev/null
+++ b/src/lib/server/storage/service.ts
@@ -0,0 +1,14 @@
+import { getProvider } from './utils.js';
+import type { S3ConnectionConfig } from './types.js';
+
+export async function uploadObject(
+  config: S3ConnectionConfig,
+  bucket: string,
+  key: string,
+  body: Buffer,
+  contentType: string,
+  contentLength: number
+): Promise<void> {
+  const provider = getProvider(config, bucket);
+  await provider.putObject(key, body, contentType, contentLength);
+}
diff --git a/src/routes/(app)/api/storage/create/+server.ts b/src/routes/(app)/api/storage/create/+server.ts
new file mode 100644
index 00000000..570f5b0f
--- /dev/null
+++ b/src/routes/(app)/api/storage/create/+server.ts
@@ -0,0 +1,27 @@
+import { uploadObject } from '$lib/server/storage/service.js';
+import type { RequestHandler } from '@sveltejs/kit';
+import { requireBucketKey } from '../params.js';
+
+/**
+ * POST /storage/api/create?bucket=<bucket>&key=<object-key>
+ *
+ * Creates an empty object (zero bytes) at the given key.
+ * If the key ends with '/', it creates a directory marker.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
+ */
+export const POST: RequestHandler = async ({ locals, url }) => {
+  const log = locals.logger;
+  const { bucket, key } = requireBucketKey(url);
+
+  log.debug({ bucket, key }, 'creating object');
+
+  const contentType = key.endsWith('/') ? 'application/x-directory' : 'text/plain';
+
+  await uploadObject(locals.storageConfig!, bucket, key, Buffer.alloc(0), contentType, 0);
+
+  log.info({ bucket, key, content_type: contentType }, 'object created');
+
+  return new Response(null, { status: 201 });
+};
diff --git a/src/routes/(app)/api/storage/save-text/+server.ts b/src/routes/(app)/api/storage/save-text/+server.ts
new file mode 100644
index 00000000..f19f40b4
--- /dev/null
+++ b/src/routes/(app)/api/storage/save-text/+server.ts
@@ -0,0 +1,128 @@
+import { error } from '@sveltejs/kit';
+import { uploadObject } from '$lib/server/storage/service.js';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucketKey } from '../params.js';
+import { maxEditableFileSize } from '$lib/server/feature-flags.js';
+import type { RequestHandler } from '@sveltejs/kit';
+
+/**
+ * POST /storage/api/save-text?bucket=<bucket>&key=<key>&contentType=<type>&originalSize=<number>&previewBytes=<number>
+ *
+ * Saves edited text content back to S3. When the original file was truncated
+ * during preview (previewBytes < originalSize), the endpoint fetches the
+ * unseen tail of the original file, concatenates it with the edited text, and
+ * uploads the combined result. This preserves the portion of the file that
+ * was not visible in the editor.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
+ */
+export const POST: RequestHandler = async ({ locals, url, request }) => {
+  const log = locals.logger;
+  const { bucket, key } = requireBucketKey(url);
+
+  const contentType = url.searchParams.get('contentType')?.trim() || 'text/plain';
+  const rawOriginalSize = url.searchParams.get('originalSize');
+  const rawPreviewBytes = url.searchParams.get('previewBytes');
+
+  const originalSize = rawOriginalSize ? parseInt(rawOriginalSize, 10) : 0;
+  const previewBytes = rawPreviewBytes ? parseInt(rawPreviewBytes, 10) : originalSize;
+
+  if (!request.body) {
+    throw error(400, 'Missing request body');
+  }
+
+  if (originalSize > maxEditableFileSize) {
+    log.warn(
+      { bucket, key, original_size: originalSize, max_editable_size: maxEditableFileSize },
+      'save-text rejected: file exceeds max editable size (read-only)'
+    );
+    throw error(413, 'File exceeds the maximum editable size and is read-only');
+  }
+
+  const truncated = previewBytes > 0 && previewBytes < originalSize;
+
+  log.debug(
+    {
+      bucket,
+      key,
+      content_type: contentType,
+      original_size: originalSize,
+      preview_bytes: previewBytes,
+      truncated
+    },
+    'save-text request received'
+  );
+
+  // Read the entire edited text body into a buffer
+  const editReader = request.body.getReader();
+  const editChunks: Uint8Array[] = [];
+  let totalEditBytes = 0;
+  while (true) {
+    const { done, value } = await editReader.read();
+    if (done) break;
+    editChunks.push(value);
+    totalEditBytes += value.length;
+  }
+
+  let mergedBuffer: Buffer;
+  let totalLength: number;
+
+  if (truncated) {
+    const provider = getProvider(locals.storageConfig!, bucket);
+
+    // Fetch the unseen tail of the original file
+    const tailStream = await provider.getObjectRange(key, previewBytes, originalSize - 1);
+    const tailReader = tailStream.getReader();
+    const tailChunks: Uint8Array[] = [];
+    let totalTailBytes = 0;
+    while (true) {
+      const { done, value } = await tailReader.read();
+      if (done) break;
+      tailChunks.push(value);
+      totalTailBytes += value.length;
+    }
+
+    // Concatenate edited text + original tail
+    const merged = new Uint8Array(totalEditBytes + totalTailBytes);
+    let offset = 0;
+    for (const chunk of editChunks) {
+      merged.set(chunk, offset);
+      offset += chunk.length;
+    }
+    for (const chunk of tailChunks) {
+      merged.set(chunk, offset);
+      offset += chunk.length;
+    }
+
+    mergedBuffer = Buffer.from(merged.buffer);
+    totalLength = merged.length;
+
+    log.info(
+      {
+        bucket,
+        key,
+        edit_bytes: totalEditBytes,
+        tail_bytes: totalTailBytes,
+        total_bytes: totalLength
+      },
+      'saving truncated file with tail merge'
+    );
+  } else {
+    // Not truncated — concatenate chunks into a single buffer
+    const merged = new Uint8Array(totalEditBytes);
+    let offset = 0;
+    for (const chunk of editChunks) {
+      merged.set(chunk, offset);
+      offset += chunk.length;
+    }
+    mergedBuffer = Buffer.from(merged.buffer);
+    totalLength = totalEditBytes;
+  }
+
+  await uploadObject(locals.storageConfig!, bucket, key, mergedBuffer, contentType, totalLength);
+
+  log.info({ bucket, key }, 'save-text completed');
+
+  return new Response(null, { status: 200 });
+};
diff --git a/src/test/setup-client.ts b/src/test/setup-client.ts
index e01a15bc..a9ca9117 100644
--- a/src/test/setup-client.ts
+++ b/src/test/setup-client.ts
@@ -9,6 +9,7 @@ vi.mock('$lib/client/feature-flags.js', () => ({
   allowedPageSizes: [25, 50, 100],
   defaultPageSize: 25,
   maxRecentFiles: 15,
+  maxEditableFileSize: 5 * 1024 * 1024,
   uploadConcurrency: 3
 }));
 
diff --git a/vite.config.ts b/vite.config.ts
index 3249345f..b0a399a2 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -16,6 +16,9 @@ export default defineConfig({
       strategy: ['cookie', 'preferredLanguage', 'baseLocale']
     })
   ],
+  optimizeDeps: {
+    include: ['@sveltejs/kit', 'svelte']
+  },
   server: { allowedHosts: true },
   test: {
     coverage: {

From 58e4b9cdf4ff0b7b6ffb36a3fb103302662c4910 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 29 Jun 2026 11:41:44 +0200
Subject: [PATCH 080/136] Add minor visual improvements (#205)

* add overflow fixes, add timeout on bucket connect, add tooltip fix

* move timeout value to flags

* add comment

* update comment

* fix svelte check, unit tests and e2e tests

* fix unit and e2e test

* fix unit test

* fix lint

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .env.example                                  |   1 +
 dev/setup.sh                                  |   2 +
 e2e/storage/connection.spec.ts                |   7 +-
 messages/de.json                              |   2 +
 messages/en.json                              |   2 +
 src/lib/client/feature-flags.ts               |   7 +
 .../storage/explorer/ContextMenu.svelte       |   2 +-
 .../explorer/file-icon/FileIconAndName.svelte |   9 +-
 .../storage/landing/StorageConnectForm.svelte |  43 +++++-
 .../landing/StorageConnectForm.svelte.spec.ts |   3 +-
 .../storage/sidebar/BucketList.svelte         | 135 +++++++++++-------
 .../storage/sidebar/BucketList.svelte.spec.ts |   6 +-
 src/routes/(app)/storage/+page.svelte         |   4 +-
 src/test/setup-client.ts                      |   5 +
 14 files changed, 166 insertions(+), 62 deletions(-)

diff --git a/.env.example b/.env.example
index d05d0656..7ebff1e1 100644
--- a/.env.example
+++ b/.env.example
@@ -34,5 +34,6 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # Feature flags
 # STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
 # STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000  # Auto-connect to last used storage after this many milliseconds (default: 15000)
 # PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=1048576  # Max file size (in bytes) of editable text files in the storage browser (default: 5 MiB)
 # PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
diff --git a/dev/setup.sh b/dev/setup.sh
index 9609283c..ce3674f3 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -312,6 +312,7 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
 PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 DATABASE_HOST=localhost
@@ -336,6 +337,7 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
 PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 DATABASE_HOST=localhost
diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index c22cffd4..410bb6cd 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -20,7 +20,9 @@ test.describe('Storage S3 — Connection', () => {
     await expect(page).toHaveURL('/storage');
     const main = page.locator('main');
     await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
-    await expect(main.getByRole('link', { name: credentials.bucket, exact: true })).toBeVisible();
+    await expect(
+      main.getByRole('link', { name: credentials.bucket, exact: true }).first()
+    ).toBeVisible();
   });
 
   test('shows an error for invalid Garage credentials', async ({ page }) => {
@@ -97,7 +99,8 @@ test.describe('Storage S3 — Connection', () => {
 
     const bucketLink = page
       .locator('main')
-      .getByRole('link', { name: credentials.bucket, exact: true });
+      .getByRole('link', { name: credentials.bucket, exact: true })
+      .first();
     await expect(bucketLink).toBeVisible();
     await bucketLink.click();
 
diff --git a/messages/de.json b/messages/de.json
index e68cb506..426bcced 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -136,6 +136,8 @@
   "storage_connect_secret_key": "Geheimer Zugriffsschlüssel",
   "storage_connect_submit": "Verbinden",
   "storage_connect_reconnecting": "Verbindung zum Speicher wird wiederhergestellt…",
+  "storage_connect_timeout": "Zeitüberschreitung der Verbindung. Das Speicher-Backend hat nicht geantwortet.",
+  "storage_connect_cancel": "Abbrechen",
   "storage_connect_error": "Verbindung fehlgeschlagen — Endpunkt und Zugangsdaten prüfen.",
   "storage_connect_saved": "Gespeicherte Verbindungen",
   "storage_connect_no_saved": "Noch keine gespeicherten Verbindungen",
diff --git a/messages/en.json b/messages/en.json
index 05a4d3ab..a1cd0279 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -136,6 +136,8 @@
   "storage_connect_secret_key": "Secret access key",
   "storage_connect_submit": "Connect",
   "storage_connect_reconnecting": "Reconnecting to storage…",
+  "storage_connect_timeout": "Connection timed out. The storage backend did not respond.",
+  "storage_connect_cancel": "Cancel",
   "storage_connect_error": "Could not connect — check the endpoint and credentials.",
   "storage_connect_saved": "Saved connections",
   "storage_connect_no_saved": "No saved connections yet",
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index 368aa943..944468a7 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -11,6 +11,13 @@ import { env } from '$env/dynamic/public';
 export const storageAutoConnectEnabled =
   (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT ?? 'false') === 'true';
 
+/** Timeout in milliseconds for the storage auto-connect attempt. Default: 15 000 (15 s).
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS`. */
+export const storageAutoConnectTimeoutMs: number = (() => {
+  const parsed = parseInt(env.PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS ?? '', 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 15_000;
+})();
+
 // ── Pagination ───────────────────────────────────────────────────────────────
 
 /** Parse a comma-separated page-sizes string into a deduplicated, sorted list
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index 981e88da..b060bfdc 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -117,7 +117,7 @@
 <ul
   bind:this={menuEl}
   class="
-    menu menu-sm border-base-300 bg-base-100 absolute z-70 w-48 rounded-lg
+    menu menu-sm border-base-300 bg-base-100 fixed z-70 w-48 rounded-lg
     border p-1 shadow-lg
   "
   role="menu"
diff --git a/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
index b53d1018..96633c5f 100644
--- a/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
+++ b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
@@ -13,7 +13,14 @@
   const kind = $derived(fileIconKind(file.contentType, file.key));
   const config = $derived(FILE_ICON_CONFIG[kind]);
 
-  const badge = $derived(file.contentType ? (file.contentType.split('/').at(-1) ?? '') : '');
+  // Only extract an extension when the key actually contains a dot. Without
+  // the guard, files without a dot (e.g. "Makefile") produce a badge whose
+  // text is the entire filename, which is both incorrect and breaks tests that
+  // expect a unique match for the filename text.
+  const ext = $derived(
+    file.key.includes('.') ? (file.key.split('.').at(-1)?.toLowerCase() ?? '') : ''
+  );
+  const badge = $derived(file.contentType ? (file.contentType.split('/').at(-1) ?? '') : ext);
 </script>
 
 <div class="flex items-center gap-2.5">
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte b/src/lib/components/storage/landing/StorageConnectForm.svelte
index 7341b8ef..c2ed4e5a 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte
@@ -2,7 +2,7 @@
   import type { SuperValidated } from 'sveltekit-superforms';
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
-  import { onMount, tick, untrack } from 'svelte';
+  import { onMount, onDestroy, tick, untrack } from 'svelte';
   import IconClose from 'virtual:icons/material-symbols/close';
   import IconStorage from 'virtual:icons/material-symbols/storage';
   import * as m from '$lib/paraglide/messages.js';
@@ -13,7 +13,11 @@
     loadAllConnectionsLocally,
     removeConnectionLocally
   } from '$lib/storage/connection-storage.js';
-  import { storageAutoConnectEnabled } from '$lib/client/feature-flags.js';
+  import {
+    storageAutoConnectEnabled,
+    storageAutoConnectTimeoutMs
+  } from '$lib/client/feature-flags.js';
+  import { addToast } from '$lib/stores/toast.svelte.js';
   import type { z } from 'zod';
 
   type StoredConnection = z.infer<typeof StorageConnectionSchema>;
@@ -34,11 +38,17 @@
   /** Connection pending the "Forget" confirmation. */
   let forgetCandidate: StoredConnection | null = $state(null);
 
+  let connectTimeout: ReturnType<typeof setTimeout> | null = $state(null);
+
   const { form, errors, enhance, submitting, message } = superForm(
     untrack(() => connectionForm),
     {
       validators: zod(StorageConnectionSchema),
       onResult: ({ result }) => {
+        if (connectTimeout) {
+          clearTimeout(connectTimeout);
+          connectTimeout = null;
+        }
         if (result.type === 'redirect') {
           saveConnectionLocally($form);
         } else {
@@ -78,6 +88,15 @@
     forgetCandidate = null;
   }
 
+  /** Cancel an in-progress auto-connect attempt. */
+  function cancelAutoConnect() {
+    if (connectTimeout) {
+      clearTimeout(connectTimeout);
+      connectTimeout = null;
+    }
+    autoConnecting = false;
+  }
+
   onMount(() => {
     allConnections = loadAllConnectionsLocally();
     connectionsLoaded = true;
@@ -92,7 +111,20 @@
       $form.region = saved.region;
       $form.accessKeyId = saved.accessKeyId ?? '';
       $form.secretAccessKey = saved.secretAccessKey ?? '';
-      tick().then(() => formRef?.requestSubmit());
+      tick().then(() => {
+        formRef?.requestSubmit();
+        connectTimeout = setTimeout(() => {
+          autoConnecting = false;
+          connectTimeout = null;
+          addToast('error', m.storage_connect_timeout(), 8000);
+        }, storageAutoConnectTimeoutMs);
+      });
+    }
+  });
+
+  onDestroy(() => {
+    if (connectTimeout) {
+      clearTimeout(connectTimeout);
     }
   });
 </script>
@@ -102,6 +134,9 @@
     <div class="flex flex-col items-center gap-3 py-8">
       <span class="loading loading-spinner loading-md"></span>
       <p class="text-base-content/60 text-sm">{m.storage_connect_reconnecting()}</p>
+      <button type="button" class="btn btn-ghost btn-sm mt-2" onclick={cancelAutoConnect}>
+        {m.storage_connect_cancel()}
+      </button>
     </div>
   {/if}
 
@@ -127,7 +162,7 @@
           role="list"
           aria-label={m.storage_connect_saved()}
         >
-          {#each allConnections as conn (conn.type + '|' + (conn.endpoint ?? '') + '|' + (conn.accessKeyId ?? ''))}
+          {#each [...allConnections].reverse() as conn (conn.type + '|' + (conn.endpoint ?? '') + '|' + (conn.accessKeyId ?? ''))}
             <div class="relative shrink-0" role="listitem">
               <button
                 type="button"
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
index 26cd521e..d291d116 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
@@ -9,7 +9,8 @@ type ConnectionFormProp = ComponentProps<typeof StorageConnectForm>['connectionF
 
 // Mock feature flags to disable auto-connect
 vi.mock('$lib/client/feature-flags.js', () => ({
-  storageAutoConnectEnabled: false
+  storageAutoConnectEnabled: false,
+  storageAutoConnectTimeoutMs: 15_000
 }));
 
 // Mock connection-storage module
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index c6b35e9c..58a3105d 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -160,6 +160,24 @@
       closeUnpinMenu();
     }
   }
+
+  // ── Fixed tooltip (avoids overflow clipping that breaks DaisyUI tooltips) ──
+  // TODO: This is a temporary solution until it's fixed in daisyUI 5.6: https://github.com/saadeghi/daisyui/issues/3346#issuecomment-4544975800
+  let tooltipText = $state<string | null>(null);
+  let tooltipX = $state(0);
+  let tooltipY = $state(0);
+
+  function showTooltip(e: MouseEvent | FocusEvent, text: string) {
+    const el = e.currentTarget as HTMLElement;
+    const rect = el.getBoundingClientRect();
+    tooltipX = rect.right + 8;
+    tooltipY = rect.top + rect.height / 2;
+    tooltipText = text;
+  }
+
+  function hideTooltip() {
+    tooltipText = null;
+  }
 </script>
 
 <svelte:window onkeydown={handleKeydown} />
@@ -212,7 +230,7 @@
 >
   <!-- Pinned Access section -->
   {#if storage.bookmarks.pinnedLocations.length > 0}
-    <div class="border-base-300 border-b">
+    <div class="border-base-300 max-h-1/2 overflow-y-auto border-b">
       <div class="flex items-center px-3 py-2">
         <span class="text-base-content/50 text-xs font-semibold tracking-wide uppercase">
           {m.storage_pinned_label()}
@@ -222,26 +240,28 @@
         {#each storage.bookmarks.pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
           {@const active = isPinnedActive(pin)}
           <li role="none" class="group relative">
-            <div class="tooltip tooltip-right relative z-30 w-full" data-tip={pinnedLabel(pin)}>
-              <!-- eslint-disable svelte/no-navigation-without-resolve -->
-              <a
-                href={pinnedHref(pin)}
-                data-sveltekit-preload-data="off"
-                class="
-                hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
-                pr-7 text-sm
-                {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}"
-                aria-current={active ? 'page' : undefined}
-              >
-                <!-- eslint-enable svelte/no-navigation-without-resolve -->
-                {#if pin.prefix === ''}
-                  <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-                {:else}
-                  <IconFolderOutline class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-                {/if}
-                <span class="truncate">{pinnedLabel(pin)}</span>
-              </a>
-            </div>
+            <!-- eslint-disable svelte/no-navigation-without-resolve -->
+            <a
+              href={pinnedHref(pin)}
+              data-sveltekit-preload-data="off"
+              class="
+              hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+              pr-7 text-sm
+              {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}"
+              aria-current={active ? 'page' : undefined}
+              onmouseenter={(e) => showTooltip(e, pinnedLabel(pin))}
+              onmouseleave={hideTooltip}
+              onfocus={(e) => showTooltip(e, pinnedLabel(pin))}
+              onblur={hideTooltip}
+            >
+              <!-- eslint-enable svelte/no-navigation-without-resolve -->
+              {#if pin.prefix === ''}
+                <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+              {:else}
+                <IconFolderOutline class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+              {/if}
+              <span class="truncate">{pinnedLabel(pin)}</span>
+            </a>
             <button
               class="
                 btn btn-ghost btn-xs absolute top-1/2 right-1 z-60 -translate-y-1/2
@@ -286,36 +306,41 @@
     </a>
   </div>
 
-  <ul class="flex-1 py-1" role="list">
-    {#if storage.buckets.length === 0}
-      <li class="text-base-content/40 px-3 py-4 text-center text-xs">
-        {m.storage_buckets_empty()}
-      </li>
-    {:else}
-      {#each storage.buckets as bucket (bucket)}
-        <li role="none">
-          <a
-            href={resolve('/(app)/storage/[bucket]/[...prefix]', {
-              bucket: encodeURIComponent(bucket),
-              prefix: ''
-            })}
-            data-sveltekit-preload-data="off"
-            class="
-              hover:bg-base-200 tooltip tooltip-right flex items-center gap-2
-              px-3 py-1.5 text-sm
-              {activeBucket === bucket
-              ? 'bg-primary/10 text-primary font-medium'
-              : 'text-base-content'}"
-            data-tip={bucket}
-            aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
-          >
-            <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-            <span class="truncate">{bucket}</span>
-          </a>
+  <div class="min-h-0 flex-1 overflow-y-auto">
+    <ul class="py-1" role="list">
+      {#if storage.buckets.length === 0}
+        <li class="text-base-content/40 px-3 py-4 text-center text-xs">
+          {m.storage_buckets_empty()}
         </li>
-      {/each}
-    {/if}
-  </ul>
+      {:else}
+        {#each storage.buckets as bucket (bucket)}
+          <li role="none">
+            <a
+              href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+                bucket: encodeURIComponent(bucket),
+                prefix: ''
+              })}
+              data-sveltekit-preload-data="off"
+              class="
+                hover:bg-base-200 flex items-center gap-2
+                px-3 py-1.5 text-sm
+                {activeBucket === bucket
+                ? 'bg-primary/10 text-primary font-medium'
+                : 'text-base-content'}"
+              aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
+              onmouseenter={(e) => showTooltip(e, bucket)}
+              onmouseleave={hideTooltip}
+              onfocus={(e) => showTooltip(e, bucket)}
+              onblur={hideTooltip}
+            >
+              <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+              <span class="truncate">{bucket}</span>
+            </a>
+          </li>
+        {/each}
+      {/if}
+    </ul>
+  </div>
 
   <!-- Disconnect button -->
   <div class="border-base-300 border-t p-2">
@@ -383,3 +408,13 @@
     ></div>
   </div>
 </nav>
+
+{#if tooltipText}
+  <div
+    class="bg-neutral text-neutral-content pointer-events-none fixed z-150 rounded px-2 py-1 text-sm whitespace-nowrap shadow-lg"
+    style="left: {tooltipX}px; top: {tooltipY}px; transform: translateY(-50%)"
+    role="tooltip"
+  >
+    {tooltipText}
+  </div>
+{/if}
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
index f880a727..5620a959 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
+++ b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
@@ -272,8 +272,10 @@ describe('BucketList', () => {
       await moreButton.click();
       await expect.element(page.getByRole('menuitem', { name: /unpin/i })).toBeInTheDocument();
 
-      const nav = page.getByRole('navigation');
-      await nav.first().click();
+      // Click on the "Buckets" section header — a non-interactive span that is
+      // outside the context menu but does not trigger browser navigation.
+      const bucketsHeader = page.getByRole('navigation').getByText('Buckets', { exact: true });
+      await bucketsHeader.click();
 
       await expect.element(page.getByRole('menuitem', { name: /unpin/i })).not.toBeInTheDocument();
     });
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index c674b0c2..355141e9 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -11,7 +11,7 @@
 </script>
 
 {#if data.connected}
-  <div class="relative flex h-full min-h-0 flex-col overflow-hidden p-2">
+  <div class="relative flex h-full min-h-0 flex-col overflow-x-hidden overflow-y-auto p-2">
     {#if navigating?.to?.url.pathname.startsWith('/storage/')}
       <div
         class="bg-base-100/70 absolute inset-0 z-10 flex items-center justify-center rounded-xl"
@@ -24,6 +24,8 @@
     <h1 class="mb-1 text-xl font-semibold">{m.storage_buckets_label()}</h1>
     <p class="text-base-content/60 mb-6 text-sm">{m.storage_buckets_subtitle()}</p>
     <BucketGrid buckets={storage.buckets} />
+  </div>
+  <div class="relative flex h-full min-h-0 flex-col overflow-y-auto p-2">
     <RecentItems />
   </div>
 {:else}
diff --git a/src/test/setup-client.ts b/src/test/setup-client.ts
index a9ca9117..3c147948 100644
--- a/src/test/setup-client.ts
+++ b/src/test/setup-client.ts
@@ -21,4 +21,9 @@ vi.mock('$lib/client/feature-flags.js', () => ({
 // with a no-op for the duration of each test.
 beforeEach(() => {
   vi.spyOn(HTMLFormElement.prototype, 'requestSubmit').mockImplementation(() => {});
+
+  // Clear localStorage before each test to prevent BookmarksState (and any
+  // other localStorage-backed state) from leaking pinned locations, recent
+  // files, or other browser-storage data between tests.
+  localStorage.clear();
 });

From 80e7aa619df62ea7aa450552295890a7565febfa Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 29 Jun 2026 12:08:13 +0200
Subject: [PATCH 081/136] Feat/s3 file browser preview parquet (#202)

* #142 add working parquet preview that still has to be optimized

* #142 optimize parquet data retrieval

* #142 reduce preview limit to open parquet files more quickly with no downside

* #142 add infinite scrolling

* #142 remove deprecated parquet preview

* #142 remove comment

* #142 add unit and e2e tests

* #142 show row total in locale format, fix layout, update header shown row total

* #142 add line numbers to previews

* #142 add line numbers to previews

* #142 optimize parquet loading with async column fetching and using onChunk streaming

* #142 calculate parquet column width per load, remove double scrollbars in chrome

* #142 fix column width calculation for firefox

* #142 fix lint

* #142 fix e2e tests

* #142 fix lint

* #142 fix lint

* #142 fix lint

* #142 fix unit test

* #98 fix lint

* #142 migrate changes manually from v0, add parquet metadata tab preview, disallow compression types

* #142 fix lint, use comma instead of semicolon for disallowed compression types

* #142 fix unit tests

* #142 fix e2e test, fix lint

* #142 add more infos to parquet metadata page

* #142 fix unit test

* fix unit and e2e tests

* fix e2e test

* fix broken route

* #142 fix metadata overflow, better illustrate metadata statistics column data

* #142 update unit test

* fix lint

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .env.example                                  |   1 +
 .env.test                                     |   1 +
 dev/setup.sh                                  |   2 +
 e2e/storage/preview.spec.ts                   | 111 +++
 messages/de.json                              |  37 +-
 messages/en.json                              |  37 +-
 .../storage/explorer/FileRow.svelte.spec.ts   |   2 +-
 .../storage/explorer/FolderRow.svelte         |   2 +-
 .../storage/explorer/StorageBreadcrumb.svelte |   2 +-
 .../explorer/file-icon/FileIconAndName.svelte |   2 +-
 .../storage/modals/PreviewModal.svelte        | 360 +++++++-
 .../modals/PreviewModal.svelte.spec.ts        | 271 +++++-
 .../storage/modals/preview/CsvPreview.svelte  |   6 +
 .../modals/preview/CsvPreview.svelte.spec.ts  |  22 +-
 .../modals/preview/ParquetMetadata.svelte     | 337 ++++++++
 .../preview/ParquetMetadata.svelte.spec.ts    | 202 +++++
 .../modals/preview/ParquetPreview.svelte      | 271 ++++++
 .../preview/ParquetPreview.svelte.spec.ts     | 191 +++++
 .../storage/modals/preview/TextPreview.svelte |  22 +-
 src/lib/server/feature-flags.ts               |  36 +
 .../server/storage/preview/parquet.test.ts    | 767 +++++++++++++++++
 src/lib/server/storage/preview/parquet.ts     | 808 +++++++++++++++---
 .../(app)/api/storage/preview/+server.ts      |  15 +-
 .../(app)/api/storage/preview/server.test.ts  |  88 ++
 24 files changed, 3367 insertions(+), 226 deletions(-)
 create mode 100644 src/lib/components/storage/modals/preview/ParquetMetadata.svelte
 create mode 100644 src/lib/components/storage/modals/preview/ParquetMetadata.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/preview/ParquetPreview.svelte
 create mode 100644 src/lib/components/storage/modals/preview/ParquetPreview.svelte.spec.ts
 create mode 100644 src/lib/server/storage/preview/parquet.test.ts

diff --git a/.env.example b/.env.example
index 7ebff1e1..c2918e4f 100644
--- a/.env.example
+++ b/.env.example
@@ -34,6 +34,7 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # Feature flags
 # STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
 # STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
+# STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset  # Comma-separated list of compression types to disallow from parquet data preview (default: "gzip-no_offset")
 # PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000  # Auto-connect to last used storage after this many milliseconds (default: 15000)
 # PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=1048576  # Max file size (in bytes) of editable text files in the storage browser (default: 5 MiB)
 # PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
diff --git a/.env.test b/.env.test
index 55bd5995..9375569d 100644
--- a/.env.test
+++ b/.env.test
@@ -10,6 +10,7 @@ STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
diff --git a/dev/setup.sh b/dev/setup.sh
index ce3674f3..ecff397d 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -308,6 +308,7 @@ STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
@@ -333,6 +334,7 @@ STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
diff --git a/e2e/storage/preview.spec.ts b/e2e/storage/preview.spec.ts
index 84bd1b52..e829a28a 100644
--- a/e2e/storage/preview.spec.ts
+++ b/e2e/storage/preview.spec.ts
@@ -277,6 +277,117 @@ test.describe('Storage S3 — Preview', () => {
     }
   });
 
+  test('previews parquet files with column headers and data rows', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-parquet');
+    const cleanupKeys = [`${prefix}data.parquet`];
+
+    try {
+      // A minimal valid parquet file generated by pyarrow:
+      //   id | name    | score
+      //   1  | Alice   | 95.5
+      //   2  | Bob     | 87.0
+      //   3  | Charlie | 72.3
+      const parquetBase64 =
+        'UEFSMRUEFSAVIEwVBBUAEgAAAQAAAAAAAAACAAAAAAAAABUAFRIVEiwVBBUQFQYVBhwYCAIAAAAAAAAAGAgBAAAAAAAAABYAKAgCAAAAAAAAABgIAQAAAAAAAAAREQAAAAIAAAAEAQEDAhUEFSAVIEwVBBUAEgAABQAAAEFsaWNlAwAAAEJvYhUAFRIVEiwVBBUQFQYVBhw2ACgDQm9iGAVBbGljZRERAAAAAgAAAAQBAQMCFQQVIBUgTBUEFQASAAAAAAAAAOBXQAAAAAAAwFVAFQAVEhUSLBUEFRAVBhUGHBgIAAAAAADgV0AYCAAAAAAAwFVAFgAoCAAAAAAA4FdAGAgAAAAAAMBVQBERAAAAAgAAAAQBAQMCFQQVEBUQTBUCFQASAAADAAAAAAAAABUAFRIVEiwVAhUQFQYVBhwYCAMAAAAAAAAAGAgDAAAAAAAAABYAKAgDAAAAAAAAABgIAwAAAAAAAAAREQAAAAIAAAACAQECABUEFRYVFkwVAhUAEgAABwAAAENoYXJsaWUVABUSFRIsFQIVEBUGFQYcNgAoB0NoYXJsaWUYB0NoYXJsaWUREQAAAAIAAAACAQECABUEFRAVEEwVAhUAEgAAMzMzMzMTUkAVABUSFRIsFQIVEBUGFQYcGAgzMzMzMxNSQBgIMzMzMzMTUkAWACgIMzMzMzMTUkAYCDMzMzMzE1JAEREAAAACAAAAAgEBAgAVBBlMNQAYBnNjaGVtYRUGABUEJQIYAmlkABUMJQIYBG5hbWUlAEwcAAAAFQolAhgFc2NvcmUAFgYZLBk8JgAcFQQZNQAGEBkYAmlkFQAWBBbMARbMASZEJggcGAgCAAAAAAAAABgIAQAAAAAAAAAWACgIAgAAAAAAAAAYCAEAAAAAAAAAEREAGSwVBBUAFQIAFQAVEBUCADwpBhkmAAQAAAAmABwVDBk1AAYQGRgEbmFtZRUAFgQWlAEWlAEmkAIm1AEcNgAoA0JvYhgFQWxpY2UREQAZLBUEFQAVAgAVABUQFQIAPBYQGQYZJgAEAAAAJgAcFQoZNQAGEBkYBXNjb3JlFQAWBBbMARbMASakAyboAhwYCAAAAAAA4FdAGAgAAAAAAMBVQBYAKAgAAAAAAOBXQBgIAAAAAADAVUAREQAZLBUEFQAVAgAVABUQFQIAPCkGGSYABAAAABasBBYEJggWrAQAGTwmABwVBBk1AAYQGRgCaWQVABYCFrwBFrwBJuAEJrQEHBgIAwAAAAAAAAAYCAMAAAAAAAAAFgAoCAMAAAAAAAAAGAgDAAAAAAAAABERABksFQQVABUCABUAFRAVAgA8KQYZJgACAAAAJgAcFQwZNQAGEBkYBG5hbWUVABYCFpYBFpYBJqIGJvAFHDYAKAdDaGFybGllGAdDaGFybGllEREAGSwVBBUAFQIAFQAVEBUCADwWDhkGGSYAAgAAACYAHBUKGTUABhAZGAVzY29yZRUAFgIWvAEWvAEmsgcmhgccGAgzMzMzMxNSQBgIMzMzMzMTUkAWACgIMzMzMzMTUkAYCDMzMzMzE1JAEREAGSwVBBUAFQIAFQAVEBUCADwpBhkmAAIAAAAWjgQWAia0BBaOBAAZHBgMQVJST1c6c2NoZW1hGLgCLy8vLy8rQUFBQUFRQUFBQUFBQUtBQXdBQmdBRkFBZ0FDZ0FBQUFBQkJBQU1BQUFBQ0FBSUFBQUFCQUFJQUFBQUJBQUFBQU1BQUFCNEFBQUFPQUFBQUFRQUFBQ2svLy8vQUFBQkF4QUFBQUFjQUFBQUJBQUFBQUFBQUFBRkFBQUFjMk52Y21VQUJnQUlBQVlBQmdBQUFBQUFBZ0RVLy8vL0FBQUJCUkFBQUFBY0FBQUFCQUFBQUFBQUFBQUVBQUFBYm1GdFpRQUFBQUFFQUFRQUJBQUFBQkFBRkFBSUFBWUFCd0FNQUFBQUVBQVFBQUFBQUFBQkFoQUFBQUFjQUFBQUJBQUFBQUFBQUFBQ0FBQUFhV1FBQUFnQURBQUlBQWNBQ0FBQUFBQUFBQUZBQUFBQUFBQUFBQT09ABggcGFycXVldC1jcHAtYXJyb3cgdmVyc2lvbiAyNC4wLjAZPBwAABwAABwAAAAUBAAAUEFSMQ==';
+
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}data.parquet`,
+          Body: Buffer.from(parquetBase64, 'base64'),
+          ContentType: 'application/vnd.apache.parquet'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'data.parquet').dblclick();
+
+      // Modal heading
+      await expect(page.getByRole('heading', { name: 'data.parquet' })).toBeVisible();
+
+      // Default view is Metadata tab — schema column names should be visible in the Schema table
+      const schemaTable = page.getByRole('table', { name: 'Schema' });
+      await expect(schemaTable.getByRole('cell', { name: 'id' })).toBeVisible();
+      await expect(schemaTable.getByRole('cell', { name: 'name' })).toBeVisible();
+      await expect(schemaTable.getByRole('cell', { name: 'score' })).toBeVisible();
+
+      // Tabs are visible
+      await expect(page.getByRole('tab', { name: 'Metadata' })).toBeVisible();
+      await expect(page.getByRole('tab', { name: 'Data', exact: true })).toBeVisible();
+
+      // Click the Data tab to view the data table
+      await page.getByRole('tab', { name: 'Data', exact: true }).click();
+
+      // Parquet preview table with correct aria label
+      const table = page.getByRole('table', { name: 'Parquet preview' });
+      await expect(table).toBeVisible();
+
+      // Column headers in data table
+      await expect(table.locator('th', { hasText: 'id' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'name' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'score' })).toBeVisible();
+
+      // Data rows
+      await expect(table.locator('td', { hasText: 'Alice' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'Bob' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'Charlie' })).toBeVisible();
+
+      // File size badge
+      await expect(page.locator('.badge', { hasText: /B$/ })).toBeVisible();
+
+      // Close button works
+      await page.getByRole('button', { name: 'Close' }).last().click();
+      await expect(page.getByRole('heading', { name: 'data.parquet' })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews parquet file with application/x-parquet content type', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-parquet-x');
+    const cleanupKeys = [`${prefix}measurements.parquet`];
+
+    try {
+      const parquetBase64 =
+        'UEFSMRUEFSAVIEwVBBUAEgAAAQAAAAAAAAACAAAAAAAAABUAFRIVEiwVBBUQFQYVBhwYCAIAAAAAAAAAGAgBAAAAAAAAABYAKAgCAAAAAAAAABgIAQAAAAAAAAAREQAAAAIAAAAEAQEDAhUEFSAVIEwVBBUAEgAABQAAAEFsaWNlAwAAAEJvYhUAFRIVEiwVBBUQFQYVBhw2ACgDQm9iGAVBbGljZRERAAAAAgAAAAQBAQMCFQQVIBUgTBUEFQASAAAAAAAAAOBXQAAAAAAAwFVAFQAVEhUSLBUEFRAVBhUGHBgIAAAAAADgV0AYCAAAAAAAwFVAFgAoCAAAAAAA4FdAGAgAAAAAAMBVQBERAAAAAgAAAAQBAQMCFQQVEBUQTBUCFQASAAADAAAAAAAAABUAFRIVEiwVAhUQFQYVBhwYCAMAAAAAAAAAGAgDAAAAAAAAABYAKAgDAAAAAAAAABgIAwAAAAAAAAAREQAAAAIAAAACAQECABUEFRYVFkwVAhUAEgAABwAAAENoYXJsaWUVABUSFRIsFQIVEBUGFQYcNgAoB0NoYXJsaWUYB0NoYXJsaWUREQAAAAIAAAACAQECABUEFRAVEEwVAhUAEgAAMzMzMzMTUkAVABUSFRIsFQIVEBUGFQYcGAgzMzMzMxNSQBgIMzMzMzMTUkAWACgIMzMzMzMTUkAYCDMzMzMzE1JAEREAAAACAAAAAgEBAgAVBBlMNQAYBnNjaGVtYRUGABUEJQIYAmlkABUMJQIYBG5hbWUlAEwcAAAAFQolAhgFc2NvcmUAFgYZLBk8JgAcFQQZNQAGEBkYAmlkFQAWBBbMARbMASZEJggcGAgCAAAAAAAAABgIAQAAAAAAAAAWACgIAgAAAAAAAAAYCAEAAAAAAAAAEREAGSwVBBUAFQIAFQAVEBUCADwpBhkmAAQAAAAmABwVDBk1AAYQGRgEbmFtZRUAFgQWlAEWlAEmkAIm1AEcNgAoA0JvYhgFQWxpY2UREQAZLBUEFQAVAgAVABUQFQIAPBYQGQYZJgAEAAAAJgAcFQoZNQAGEBkYBXNjb3JlFQAWBBbMARbMASakAyboAhwYCAAAAAAA4FdAGAgAAAAAAMBVQBYAKAgAAAAAAOBXQBgIAAAAAADAVUAREQAZLBUEFQAVAgAVABUQFQIAPCkGGSYABAAAABasBBYEJggWrAQAGTwmABwVBBk1AAYQGRgCaWQVABYCFrwBFrwBJuAEJrQEHBgIAwAAAAAAAAAYCAMAAAAAAAAAFgAoCAMAAAAAAAAAGAgDAAAAAAAAABERABksFQQVABUCABUAFRAVAgA8KQYZJgACAAAAJgAcFQwZNQAGEBkYBG5hbWUVABYCFpYBFpYBJqIGJvAFHDYAKAdDaGFybGllGAdDaGFybGllEREAGSwVBBUAFQIAFQAVEBUCADwWDhkGGSYAAgAAACYAHBUKGTUABhAZGAVzY29yZRUAFgIWvAEWvAEmsgcmhgccGAgzMzMzMxNSQBgIMzMzMzMTUkAWACgIMzMzMzMTUkAYCDMzMzMzE1JAEREAGSwVBBUAFQIAFQAVEBUCADwpBhkmAAIAAAAWjgQWAia0BBaOBAAZHBgMQVJST1c6c2NoZW1hGLgCLy8vLy8rQUFBQUFRQUFBQUFBQUtBQXdBQmdBRkFBZ0FDZ0FBQUFBQkJBQU1BQUFBQ0FBSUFBQUFCQUFJQUFBQUJBQUFBQU1BQUFCNEFBQUFPQUFBQUFRQUFBQ2svLy8vQUFBQkF4QUFBQUFjQUFBQUJBQUFBQUFBQUFBRkFBQUFjMk52Y21VQUJnQUlBQVlBQmdBQUFBQUFBZ0RVLy8vL0FBQUJCUkFBQUFBY0FBQUFCQUFBQUFBQUFBQUVBQUFBYm1GdFpRQUFBQUFFQUFRQUJBQUFBQkFBRkFBSUFBWUFCd0FNQUFBQUVBQVFBQUFBQUFBQkFoQUFBQUFjQUFBQUJBQUFBQUFBQUFBQ0FBQUFhV1FBQUFnQURBQUlBQWNBQ0FBQUFBQUFBQUZBQUFBQUFBQUFBQT09ABggcGFycXVldC1jcHAtYXJyb3cgdmVyc2lvbiAyNC4wLjAZPBwAABwAABwAAAAUBAAAUEFSMQ==';
+
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}measurements.parquet`,
+          Body: Buffer.from(parquetBase64, 'base64'),
+          ContentType: 'application/x-parquet'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'measurements.parquet').dblclick();
+
+      await expect(page.getByRole('heading', { name: 'measurements.parquet' })).toBeVisible();
+
+      // Schema column names should be visible in default metadata tab
+      await expect(
+        page.getByRole('table', { name: 'Schema' }).getByRole('cell', { name: 'name' })
+      ).toBeVisible();
+
+      // Click Data tab to view data table
+      await page.getByRole('tab', { name: 'Data', exact: true }).click();
+      const table = page.getByRole('table', { name: 'Parquet preview' });
+      await expect(table).toBeVisible();
+      await expect(table.locator('th', { hasText: 'name' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
   test('closes preview modal when the Escape key is pressed', async ({ page }, testInfo) => {
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
diff --git a/messages/de.json b/messages/de.json
index 426bcced..17afb4dd 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -397,5 +397,40 @@
         "n=other": "vor {count} J."
       }
     }
-  ]
+  ],
+  "storage_preview_parquet_tab_aria": "Parquet-Vorschau-Registerkarten",
+  "storage_preview_parquet_tab_metadata": "Metadaten",
+  "storage_preview_parquet_tab_data": "Daten",
+  "storage_preview_parquet_blocked_title": "Vorschau blockiert",
+  "storage_preview_parquet_blocked_desc": "Diese Parquet-Datei verwendet einen Kompressionstyp, der vom Administrator deaktiviert wurde. Wenden Sie sich an Ihren Administrator, wenn Sie dies für ein Problem halten.",
+  "storage_preview_parquet_overview": "Übersicht",
+  "storage_preview_parquet_file_size": "Dateigröße",
+  "storage_preview_parquet_total_rows": "Zeilen gesamt",
+  "storage_preview_parquet_total_columns": "Spalten gesamt",
+  "storage_preview_parquet_version": "Version",
+  "storage_preview_parquet_created_by": "Erstellt von",
+  "storage_preview_parquet_schema": "Schema",
+  "storage_preview_parquet_column": "Spalte",
+  "storage_preview_parquet_type": "Typ",
+  "storage_preview_parquet_compression_indexes": "Kompression & Indexe",
+  "storage_preview_parquet_row_groups": "Zeilengruppen",
+  "storage_preview_parquet_row_group": "Gruppe",
+  "storage_preview_parquet_offset_index": "Offset-Index",
+  "storage_preview_parquet_column_index": "Spalten-Index",
+  "storage_preview_parquet_available": "Verfügbar",
+  "storage_preview_parquet_missing": "Fehlt",
+  "storage_preview_parquet_none": "Keine",
+  "storage_preview_parquet_compression": "Kompression",
+  "storage_preview_parquet_uncompressed": "Unkomprimiert",
+  "storage_preview_parquet_compressed": "Komprimiert",
+  "storage_preview_parquet_size": "Größe",
+  "storage_preview_parquet_statistics": "Statistiken",
+  "storage_preview_parquet_min": "Min",
+  "storage_preview_parquet_max": "Max",
+  "storage_preview_parquet_null_count": "Null-Anzahl",
+  "storage_preview_parquet_distinct_count": "Distinct-Anzahl",
+  "storage_preview_parquet_not_stored": "Nicht gespeichert",
+  "storage_preview_parquet_arrow_schema": "Arrow-Schema",
+  "storage_preview_parquet_arrow_schema_present": "Eingebettetes Arrow-Schema ({size})",
+  "storage_preview_parquet_uniform": "einheitlich"
 }
diff --git a/messages/en.json b/messages/en.json
index a1cd0279..0da5ee21 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -397,5 +397,40 @@
         "n=other": "{count}y ago"
       }
     }
-  ]
+  ],
+  "storage_preview_parquet_tab_aria": "Parquet preview tabs",
+  "storage_preview_parquet_tab_metadata": "Metadata",
+  "storage_preview_parquet_tab_data": "Data",
+  "storage_preview_parquet_blocked_title": "Preview blocked",
+  "storage_preview_parquet_blocked_desc": "This parquet file uses a compression type that has been disallowed by the administrator. Contact your administrator if you believe this to be an issue.",
+  "storage_preview_parquet_overview": "Overview",
+  "storage_preview_parquet_file_size": "File size",
+  "storage_preview_parquet_total_rows": "Total rows",
+  "storage_preview_parquet_total_columns": "Total columns",
+  "storage_preview_parquet_version": "Version",
+  "storage_preview_parquet_created_by": "Created by",
+  "storage_preview_parquet_schema": "Schema",
+  "storage_preview_parquet_column": "Column",
+  "storage_preview_parquet_type": "Type",
+  "storage_preview_parquet_compression_indexes": "Compression & Indexes",
+  "storage_preview_parquet_row_groups": "Row groups",
+  "storage_preview_parquet_row_group": "Group",
+  "storage_preview_parquet_offset_index": "Offset index",
+  "storage_preview_parquet_column_index": "Column index",
+  "storage_preview_parquet_available": "Available",
+  "storage_preview_parquet_missing": "Missing",
+  "storage_preview_parquet_none": "None",
+  "storage_preview_parquet_compression": "Compression",
+  "storage_preview_parquet_uncompressed": "Uncompressed",
+  "storage_preview_parquet_compressed": "Compressed",
+  "storage_preview_parquet_size": "Size",
+  "storage_preview_parquet_statistics": "Statistics",
+  "storage_preview_parquet_min": "Min",
+  "storage_preview_parquet_max": "Max",
+  "storage_preview_parquet_null_count": "Null count",
+  "storage_preview_parquet_distinct_count": "Distinct count",
+  "storage_preview_parquet_not_stored": "Not stored",
+  "storage_preview_parquet_arrow_schema": "Arrow schema",
+  "storage_preview_parquet_arrow_schema_present": "Embedded Arrow schema ({size})",
+  "storage_preview_parquet_uniform": "uniform"
 }
diff --git a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
index e8acb5e5..f9ddf182 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
@@ -74,7 +74,7 @@ describe('FileRow', () => {
     const state = createState([file]);
     render(FileRowWrapper, { state, file });
 
-    await expect.element(page.getByText('unknown-file')).toBeInTheDocument();
+    await expect.element(page.getByText('unknown-file').first()).toBeInTheDocument();
   });
 
   it('should show checkbox when showCheckboxes is true', async () => {
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte b/src/lib/components/storage/explorer/FolderRow.svelte
index 5ec0645c..f25da5c7 100644
--- a/src/lib/components/storage/explorer/FolderRow.svelte
+++ b/src/lib/components/storage/explorer/FolderRow.svelte
@@ -52,7 +52,7 @@
   </td>
   <td>
     <div class="flex items-center gap-2.5">
-      <IconFolder class="text-warning size-5 shrink-0" aria-hidden="true" />
+      <IconFolder class="text-warning pointer-events-none size-5 shrink-0" aria-hidden="true" />
       <span class="font-medium">{keyToName(folder.key)}</span>
     </div>
   </td>
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 58f23aa3..33fd862e 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -230,7 +230,7 @@
           aria-current="page"
           oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, '')}
         >
-          <IconStorage class="size-4" aria-hidden="true" />
+          <IconStorage class="pointer-events-none size-4" aria-hidden="true" />
           {storage.bucket}
         </span>
         {@render pinButton(storage.bucket, '')}
diff --git a/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
index 96633c5f..c510f0e5 100644
--- a/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
+++ b/src/lib/components/storage/explorer/file-icon/FileIconAndName.svelte
@@ -34,5 +34,5 @@
 </div>
 
 {#snippet renderIcon(cfg: IconConfig)}
-  <cfg.component class="size-5 shrink-0" aria-hidden="true" />
+  <cfg.component class="pointer-events-none size-5 shrink-0" aria-hidden="true" />
 {/snippet}
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index ab805f0b..4af7f89c 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -7,13 +7,17 @@
   import IconClose from 'virtual:icons/material-symbols/close';
   import IconErrorOutline from 'virtual:icons/material-symbols/error-outline';
   import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconFilePresent from 'virtual:icons/material-symbols/file-present';
   import IconSave from 'virtual:icons/material-symbols/save';
   import IconBlock from 'virtual:icons/material-symbols/block';
   import * as m from '$lib/paraglide/messages.js';
+  import { getLocale } from '$lib/paraglide/runtime.js';
   import Modal from '$lib/components/Modal.svelte';
   import TextEditor from '$lib/components/editor/TextEditor.svelte';
   import UnsavedConfirmDialog from './UnsavedConfirmDialog.svelte';
   import CsvPreview from './preview/CsvPreview.svelte';
+  import ParquetPreview from './preview/ParquetPreview.svelte';
+  import ParquetMetadata from './preview/ParquetMetadata.svelte';
   import ImagePreview from './preview/ImagePreview.svelte';
   import PdfPreview from './preview/PdfPreview.svelte';
   import FallbackPreview from './preview/FallbackPreview.svelte';
@@ -25,12 +29,37 @@
   import { maxEditableFileSize } from '$lib/client/feature-flags.js';
 
   interface Props {
-    open: boolean;
-    bucket: string;
-    objectKey: string | null;
+    open?: boolean;
+    bucket?: string;
+    objectKey?: string | null;
   }
 
-  let { open = $bindable(false), bucket, objectKey }: Props = $props();
+  interface ColumnStats {
+    nullCount: number | null;
+    distinctCount: number | null;
+    min: string | null;
+    max: string | null;
+  }
+
+  interface ColumnTypeInfo {
+    name: string;
+    type: string;
+    codec: string;
+    compressedSize: number;
+    uncompressedSize: number;
+    stats: ColumnStats;
+  }
+
+  interface ParquetFileMeta {
+    rowGroups: number;
+    compressionCodecs: string[];
+    compressionUniform: boolean;
+    hasOffsetIndex: boolean;
+    hasColumnIndex: boolean;
+    createdBy: string | null;
+    version: number;
+    arrowSchema: string | null;
+  }
 
   type PreviewKind =
     | { kind: 'idle' }
@@ -46,22 +75,29 @@
     | { kind: 'csv'; text: string; truncated: boolean; totalSize: number; previewBytes: number }
     | {
         kind: 'parquet';
-        text: string;
+        headers: string[];
+        columnTypes: ColumnTypeInfo[];
+        metadata: ParquetFileMeta;
+        rows: unknown[][];
+        dataBlocked: boolean;
         truncated: boolean;
         totalSize: number;
         totalRows: number;
-        previewRows: number;
       }
     | { kind: 'image'; blobUrl: string; contentType: string; totalSize: number }
     | { kind: 'pdf'; blobUrl: string; totalSize: number }
     | { kind: 'fallback'; contentType: string; isBinary: boolean }
     | { kind: 'error'; message: string };
 
+  let { open = $bindable(false), bucket = '', objectKey = null }: Props = $props();
+
   let preview: PreviewKind = $state({ kind: 'idle' });
   let blobUrls: string[] = [];
   let maximized = $state(false);
   let imageNaturalWidth = $state(0);
   let imageNaturalHeight = $state(0);
+  let parquetShowingRowsCount = $state(0);
+  let parquetTab: 'metadata' | 'data' = $state('metadata');
 
   // ── Text editor state ──
   let editorText = $state('');
@@ -90,7 +126,6 @@
     if (preview.kind !== 'text') return false;
     return preview.totalSize > maxEditableFileSize;
   }
-
   onDestroy(() => {
     for (const url of blobUrls) {
       URL.revokeObjectURL(url);
@@ -114,18 +149,20 @@
         import('monaco-editor');
       }
     }
+
     if (!open) {
       revokeBlobUrls();
       preview = { kind: 'idle' };
       imageNaturalWidth = 0;
       imageNaturalHeight = 0;
+      parquetTab = 'metadata';
       editorReady = false;
       editorText = '';
       originalText = '';
     }
   });
 
-  async function loadPreview(key: string, bkt: string) {
+  async function loadPreview(key: string, activeBucket: string) {
     preview = { kind: 'loading' };
     revokeBlobUrls();
 
@@ -135,7 +172,7 @@
       : {};
 
     try {
-      const params = new URLSearchParams({ bucket: bkt, key });
+      const params = new URLSearchParams({ bucket: activeBucket, key });
       const res = await fetch(`/api/storage/preview?${params}`, { headers });
 
       if (!res.ok) {
@@ -157,8 +194,35 @@
       const truncated = res.headers.get('X-Preview-Truncated') === 'true';
       const totalSize = Number(res.headers.get('X-Preview-Total-Size') ?? '0');
       const previewBytes = Number(res.headers.get('X-Preview-Bytes') ?? '0');
-      const totalRows = Number(res.headers.get('X-Preview-Total-Rows') ?? '0');
-      const previewRows = Number(res.headers.get('X-Preview-Preview-Rows') ?? '0');
+
+      // Parquet takes priority — parse header for metadata (always), load data on-demand
+      if (format === 'parquet') {
+        try {
+          const dataBlocked = res.headers.get('X-Preview-Data-Blocked') === 'true';
+          await parseParquetStream(
+            res,
+            (headers, totalRows, columnTypes, metadata) => {
+              preview = {
+                kind: 'parquet',
+                headers,
+                columnTypes,
+                metadata,
+                rows: [],
+                dataBlocked,
+                truncated,
+                totalSize,
+                totalRows
+              };
+            },
+            () => {
+              // Ignore any column data in the initial load (metadata-only request)
+            }
+          );
+        } catch {
+          preview = { kind: 'error', message: m.storage_preview_error_desc() };
+        }
+        return;
+      }
 
       if (res.headers.get('X-Preview-Renderable') === 'false') {
         await res.body?.cancel();
@@ -188,11 +252,6 @@
         return;
       }
 
-      if (format === 'parquet') {
-        preview = { kind: 'parquet', text, truncated, totalSize, totalRows, previewRows };
-        return;
-      }
-
       if (
         contentType === 'text/csv' ||
         contentType === 'application/csv' ||
@@ -239,13 +298,118 @@
     }
   }
 
+  /** Parse an NDJSON parquet stream with callbacks for headers (incl. schema/metadata) and columns. */
+  async function parseParquetStream(
+    res: Response,
+    onHeaders: (
+      headers: string[],
+      totalRows: number,
+      columnTypes: ColumnTypeInfo[],
+      metadata: ParquetFileMeta
+    ) => void,
+    onColumn: (name: string, values: unknown[]) => void
+  ): Promise<void> {
+    const reader = res.body!.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split('\n');
+      buffer = lines.pop() || '';
+
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        const msg = JSON.parse(line);
+
+        if (msg.t === 'h') {
+          onHeaders(
+            msg.h,
+            msg.tr,
+            msg.s ?? [],
+            msg.m ?? {
+              rowGroups: 0,
+              compressionCodecs: [],
+              compressionUniform: true,
+              hasOffsetIndex: false,
+              hasColumnIndex: false,
+              createdBy: null,
+              version: 0,
+              arrowSchema: null
+            }
+          );
+        } else if (msg.t === 'c') {
+          onColumn(msg.n, msg.v);
+        } else if (msg.t === 'e') {
+          throw new Error('Server error reading parquet data');
+        }
+      }
+    }
+  }
+
+  /** Read an NDJSON streaming response and progressively fill column data. */
+  async function readNdjsonStream(
+    res: Response,
+    onColumn?: (name: string, values: unknown[]) => void
+  ): Promise<{ headers: string[]; rows: unknown[][]; totalRows: number }> {
+    const reader = res.body!.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let resultHeaders: string[] = [];
+    let rows: unknown[][] = [];
+    let resultTotalRows = 0;
+    const columnPos: Record<string, number> = {};
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split('\n');
+      buffer = lines.pop() || '';
+
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        const msg = JSON.parse(line);
+
+        if (msg.t === 'h') {
+          resultHeaders = msg.h;
+          resultTotalRows = msg.tr;
+        } else if (msg.t === 'c') {
+          const colIdx = resultHeaders.indexOf(msg.n);
+          if (colIdx < 0) continue;
+          const values = msg.v as unknown[];
+          let pos = columnPos[msg.n] ?? 0;
+          for (let i = 0; i < values.length; i++) {
+            while (rows.length <= pos) {
+              rows.push(new Array(resultHeaders.length).fill(undefined));
+            }
+            rows[pos][colIdx] = values[i];
+            pos++;
+          }
+          columnPos[msg.n] = pos;
+          onColumn?.(msg.n, values);
+        } else if (msg.t === 'e') {
+          throw new Error('Server error reading parquet data');
+        }
+      }
+    }
+
+    return { headers: resultHeaders, rows, totalRows: resultTotalRows };
+  }
+
   async function triggerDownload() {
     if (!objectKey) return;
+
     const conn = loadConnectionLocally();
     if (!conn) {
       addToast('error', m.storage_download_error_unknown());
       return;
     }
+
     try {
       await downloadObject(bucket, objectKey, getConnectionHeader(conn));
     } catch (err) {
@@ -348,18 +512,56 @@
     open = false;
   }
 
+  // Sync parquetShowingRowsCount with the preview data
+  $effect(() => {
+    if (preview.kind === 'parquet') {
+      parquetShowingRowsCount = preview.rows.length;
+    }
+  });
+
   function toggleMaximized() {
     maximized = !maximized;
   }
+
+  // Function to fetch additional parquet chunks during infinite scroll
+  async function fetchParquetRows(
+    offset: number,
+    limit: number,
+    onColumn?: (name: string, values: unknown[]) => void
+  ): Promise<unknown[][]> {
+    if (!objectKey) return [];
+
+    const conn = loadConnectionLocally();
+    const fetchHeaders: HeadersInit = conn
+      ? { [STORAGE_CONNECTION_HEADER]: getConnectionHeader(conn) }
+      : {};
+
+    const params = new URLSearchParams({
+      bucket,
+      key: objectKey,
+      offset: String(offset),
+      limit: String(limit),
+      data: 'true'
+    });
+
+    const res = await fetch(`/api/storage/preview?${params}`, { headers: fetchHeaders });
+
+    if (!res.ok) {
+      throw new Error('Failed to fetch parquet chunk');
+    }
+
+    const { rows } = await readNdjsonStream(res, onColumn);
+    return rows;
+  }
 </script>
 
 <Modal bind:open {closeguard} class="modal">
   <div
-    class="modal-box flex flex-col p-0 transition-none
-      {maximized ? 'h-dvh max-h-dvh w-screen max-w-none rounded-none' : 'w-full max-w-5xl'}"
+    class="modal-box flex flex-col p-0 transition-none {maximized
+      ? 'h-dvh max-h-dvh w-screen max-w-none rounded-none'
+      : 'w-full max-w-5xl'}"
     style={maximized ? '' : 'height: min(88dvh, 900px)'}
   >
-    <!-- Header -->
     <div class="border-base-300 flex shrink-0 items-center gap-3 border-b px-5 py-2">
       <div class="min-w-0 flex-1">
         <h2 class="text-base-content truncate font-semibold" id="preview-modal-title">
@@ -372,9 +574,7 @@
             >
             {#if preview.truncated}
               <span class="badge badge-soft badge-warning badge-sm">
-                {m.storage_preview_truncated({
-                  size: formatFileSize(preview.previewBytes)
-                })}
+                {m.storage_preview_truncated({ size: formatFileSize(preview.previewBytes) })}
               </span>
             {/if}
           </div>
@@ -383,11 +583,15 @@
             <span class="badge badge-neutral badge-sm font-mono"
               >{formatFileSize(preview.totalSize)}</span
             >
-            {#if preview.truncated}
+            {#if preview.dataBlocked}
+              <span class="badge badge-soft badge-warning badge-sm">
+                {m.storage_preview_parquet_blocked_title()}
+              </span>
+            {:else if preview.truncated}
               <span class="badge badge-soft badge-warning badge-sm">
                 {m.storage_preview_parquet_rows({
-                  count: preview.previewRows,
-                  total: preview.totalRows
+                  count: parquetShowingRowsCount.toLocaleString(getLocale()),
+                  total: preview.totalRows.toLocaleString(getLocale())
                 })}
               </span>
             {/if}
@@ -398,32 +602,32 @@
               >{formatFileSize(preview.totalSize)}</span
             >
             {#if preview.kind === 'image' && imageNaturalWidth > 0}
-              <span class="badge badge-neutral badge-sm font-mono"
-                >{imageNaturalWidth} &times; {imageNaturalHeight} px</span
-              >
+              <span class="badge badge-neutral badge-sm font-mono">
+                {imageNaturalWidth} &times; {imageNaturalHeight} px
+              </span>
             {/if}
           </div>
         {/if}
       </div>
+
       {#if maximized}
-        {@const MaximizeIcon = IconCloseFullscreen}
         <button
           class="btn btn-ghost btn-sm btn-square"
           onclick={toggleMaximized}
           aria-label={m.storage_preview_restore()}
         >
-          <MaximizeIcon class="size-4" aria-hidden="true" />
+          <IconCloseFullscreen class="size-4" aria-hidden="true" />
         </button>
       {:else}
-        {@const MaximizeIcon = IconOpenInFull}
         <button
           class="btn btn-ghost btn-sm btn-square"
           onclick={toggleMaximized}
           aria-label={m.storage_preview_maximise()}
         >
-          <MaximizeIcon class="size-4" aria-hidden="true" />
+          <IconOpenInFull class="size-4" aria-hidden="true" />
         </button>
       {/if}
+
       <button
         class="btn btn-ghost btn-sm btn-square"
         onclick={handleCloseClick}
@@ -433,8 +637,45 @@
       </button>
     </div>
 
+    {#if preview.kind === 'parquet'}
+      <div
+        class="bg-base-200 border-base-300 flex gap-0 border-b"
+        role="tablist"
+        aria-label={m.storage_preview_parquet_tab_aria()}
+      >
+        <button
+          class="relative flex-1 px-4 py-2.5 text-sm font-medium transition-colors {parquetTab ===
+          'metadata'
+            ? 'bg-base-100 text-primary'
+            : 'text-base-content/60 hover:bg-base-100/50 hover:text-base-content'}"
+          role="tab"
+          aria-selected={parquetTab === 'metadata'}
+          onclick={() => (parquetTab = 'metadata')}
+        >
+          {m.storage_preview_parquet_tab_metadata()}
+          {#if parquetTab === 'metadata'}
+            <span class="bg-primary absolute inset-x-0 bottom-0 h-0.5" aria-hidden="true"></span>
+          {/if}
+        </button>
+        <button
+          class="relative flex-1 px-4 py-2.5 text-sm font-medium transition-colors {parquetTab ===
+          'data'
+            ? 'bg-base-100 text-primary'
+            : 'text-base-content/60 hover:bg-base-100/50 hover:text-base-content'}"
+          role="tab"
+          aria-selected={parquetTab === 'data'}
+          onclick={() => (parquetTab = 'data')}
+        >
+          {m.storage_preview_parquet_tab_data()}
+          {#if parquetTab === 'data'}
+            <span class="bg-primary absolute inset-x-0 bottom-0 h-0.5" aria-hidden="true"></span>
+          {/if}
+        </button>
+      </div>
+    {/if}
+
     <!-- Body -->
-    <div class="min-h-0 min-w-0 flex-1 overflow-hidden">
+    <div class="min-h-0 min-w-0 flex-1 overflow-auto">
       {#if preview.kind === 'idle' || preview.kind === 'loading'}
         <div
           class="flex items-center justify-center p-12"
@@ -450,6 +691,46 @@
           <p class="text-base-content font-semibold">{m.storage_preview_error_title()}</p>
           <p class="text-base-content/60 text-sm">{preview.message}</p>
         </div>
+      {:else if preview.kind === 'parquet'}
+        <!-- Metadata tab: always mounted, hidden when Data tab is active -->
+        <div class={parquetTab === 'metadata' ? 'h-full' : 'hidden h-full'}>
+          <ParquetMetadata
+            headers={preview.headers}
+            columnTypes={preview.columnTypes}
+            totalRows={preview.totalRows}
+            totalSize={preview.totalSize}
+            metadata={preview.metadata}
+          />
+        </div>
+        <!-- Data tab: always mounted (preserves scroll + chunks), hidden when Metadata tab is active -->
+        <div class={parquetTab === 'data' ? 'h-full' : 'hidden h-full'}>
+          {#if preview.dataBlocked}
+            <div class="flex min-h-full flex-col items-center justify-center gap-4 p-8 text-center">
+              <IconFilePresent class="text-base-content/30 size-16" aria-hidden="true" />
+              <div>
+                <p class="text-base-content font-semibold">
+                  {m.storage_preview_parquet_blocked_title()}
+                </p>
+                <p class="text-base-content/60 mt-1 text-sm">
+                  {m.storage_preview_parquet_blocked_desc()}
+                </p>
+              </div>
+              <button type="button" class="btn btn-primary btn-sm gap-2" onclick={triggerDownload}>
+                <IconDownload class="size-4" aria-hidden="true" />
+                {m.storage_preview_download_full()}
+              </button>
+            </div>
+          {:else}
+            <ParquetPreview
+              headers={preview.headers}
+              initialRows={preview.rows}
+              totalRows={preview.totalRows}
+              fetchRows={fetchParquetRows}
+              bind:showingRowsCount={parquetShowingRowsCount}
+              hidden={parquetTab !== 'data'}
+            />
+          {/if}
+        </div>
       {:else if preview.kind === 'text'}
         <div class="relative flex h-full flex-col">
           {#if !editorReady}
@@ -485,13 +766,7 @@
           </div>
         </div>
       {:else if preview.kind === 'csv'}
-        <div class="preview-scroll h-full overflow-scroll">
-          <CsvPreview text={preview.text} />
-        </div>
-      {:else if preview.kind === 'parquet'}
-        <div class="preview-scroll h-full overflow-scroll">
-          <CsvPreview text={preview.text} />
-        </div>
+        <CsvPreview text={preview.text} />
       {:else if preview.kind === 'image'}
         <div class="preview-scroll h-full overflow-scroll">
           <ImagePreview
@@ -516,15 +791,14 @@
       {/if}
     </div>
 
-    <!-- Footer -->
     {#if preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'parquet' || preview.kind === 'image' || preview.kind === 'pdf'}
       <div class="border-base-300 flex shrink-0 items-center justify-end gap-2 border-t px-5 py-2">
-        {#if preview.kind === 'text' && preview.truncated}
+        {#if preview.kind === 'parquet' && preview.dataBlocked}
           <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
           </button>
-        {:else if preview.kind === 'csv' && preview.truncated}
+        {:else if (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
           <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
index e1905b6d..02b95c8b 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
@@ -277,45 +277,276 @@ describe('PreviewModal', () => {
   });
 
   describe('parquet preview', () => {
-    it('should render parquet preview when format header is parquet', async () => {
+    /** Create a mock Response-like object whose body yields NDJSON lines. */
+    function ndjsonResponse(
+      messages: Record<string, unknown>[],
+      options: {
+        contentType?: string;
+        format?: string;
+        truncated?: boolean;
+        totalSize?: number;
+        totalRows?: number;
+        previewRows?: number;
+        previewBytes?: number;
+        dataBlocked?: boolean;
+      }
+    ): Response {
+      const ndjson = messages.map((m) => JSON.stringify(m)).join('\n') + '\n';
+      const headerMap: Record<string, string> = {
+        'content-type': options.contentType ?? 'application/json',
+        'x-preview-format': options.format ?? 'parquet',
+        'x-preview-truncated': String(options.truncated ?? false),
+        'x-preview-total-size': String(options.totalSize ?? 0),
+        'x-preview-bytes': String(options.previewBytes ?? 0),
+        'x-preview-renderable': 'true'
+      };
+      if (options.dataBlocked) {
+        headerMap['x-preview-data-blocked'] = 'true';
+      }
+      if (options.totalRows !== undefined) {
+        headerMap['x-preview-total-rows'] = String(options.totalRows);
+      }
+      if (options.previewRows !== undefined) {
+        headerMap['x-preview-preview-rows'] = String(options.previewRows);
+      }
+      const encoded = new TextEncoder().encode(ndjson);
+      const mockResponse = {
+        ok: true,
+        status: 200,
+        headers: { get: (name: string) => headerMap[name.toLowerCase()] ?? null },
+        body: {
+          getReader() {
+            let done = false;
+            return {
+              read() {
+                if (done) return Promise.resolve({ done: true, value: undefined });
+                done = true;
+                return Promise.resolve({ done: false, value: encoded });
+              },
+              cancel() {}
+            };
+          }
+        },
+        json: async () => ({ error: 'not available' })
+      };
+      return mockResponse as unknown as Response;
+    }
+
+    it('should render metadata tab by default and show schema info', async () => {
       vi.stubGlobal(
         'fetch',
         vi.fn().mockResolvedValue(
-          mockFetchResponse('col1,col2\nval1,val2', {
-            contentType: 'text/csv',
-            format: 'parquet',
-            truncated: false,
-            totalSize: 5000,
-            totalRows: 100,
-            previewRows: 50
-          })
+          ndjsonResponse(
+            [
+              {
+                t: 'h',
+                h: ['col1', 'col2'],
+                tr: 100,
+                s: [
+                  {
+                    name: 'col1',
+                    type: 'string',
+                    codec: 'SNAPPY',
+                    compressedSize: 100,
+                    uncompressedSize: 200,
+                    stats: { nullCount: 0, distinctCount: null, min: null, max: null }
+                  },
+                  {
+                    name: 'col2',
+                    type: 'int64',
+                    codec: 'SNAPPY',
+                    compressedSize: 50,
+                    uncompressedSize: 80,
+                    stats: { nullCount: null, distinctCount: null, min: null, max: null }
+                  }
+                ],
+                m: {
+                  rowGroups: 1,
+                  compressionCodecs: ['SNAPPY'],
+                  compressionUniform: true,
+                  hasOffsetIndex: true,
+                  hasColumnIndex: true,
+                  createdBy: null,
+                  version: 1,
+                  arrowSchema: null
+                }
+              },
+              { t: 'c', n: 'col1', v: ['val1'] },
+              { t: 'c', n: 'col2', v: ['val2'] }
+            ],
+            {
+              format: 'parquet',
+              truncated: false,
+              totalSize: 5000,
+              totalRows: 100,
+              previewRows: 50
+            }
+          )
         )
       );
       render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
 
       await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
-      // Parquet shows a size badge in the header
-      await expect.element(page.getByText('val1')).toBeInTheDocument();
+      // Metadata tab should be active by default showing schema info
+      await expect.element(page.getByText('col1').first()).toBeInTheDocument();
+      await expect.element(page.getByText('col2').first()).toBeInTheDocument();
+      // Tab labels should be visible
+      await expect.element(page.getByText('Metadata')).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('tab', { name: 'Data', exact: true }))
+        .toBeInTheDocument();
     });
 
     it('should show row count badge when parquet is truncated', async () => {
       vi.stubGlobal(
         'fetch',
         vi.fn().mockResolvedValue(
-          mockFetchResponse('col1,col2\nval1,val2', {
-            contentType: 'text/csv',
-            format: 'parquet',
-            truncated: true,
-            totalSize: 50000,
-            totalRows: 10000,
-            previewRows: 500
-          })
+          ndjsonResponse(
+            [
+              {
+                t: 'h',
+                h: ['col1', 'col2'],
+                tr: 10000,
+                s: [],
+                m: {
+                  rowGroups: 1,
+                  compressionCodecs: ['SNAPPY'],
+                  compressionUniform: true,
+                  hasOffsetIndex: true,
+                  hasColumnIndex: true,
+                  createdBy: null,
+                  version: 1,
+                  arrowSchema: null
+                }
+              },
+              { t: 'c', n: 'col1', v: ['val1'] },
+              { t: 'c', n: 'col2', v: ['val2'] }
+            ],
+            {
+              format: 'parquet',
+              truncated: true,
+              totalSize: 50000,
+              totalRows: 10000,
+              previewRows: 500
+            }
+          )
         )
       );
       render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
 
       await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
-      await expect.element(page.getByText('val1')).toBeInTheDocument();
+      await expect.element(page.getByText('col1').first()).toBeInTheDocument();
+      await expect
+        .element(page.getByText('Showing first 0 of 10,000 rows (parquet)').first())
+        .toBeInTheDocument();
+    });
+
+    it('should show data table when clicking Data tab', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          ndjsonResponse(
+            [
+              {
+                t: 'h',
+                h: ['col1', 'col2'],
+                tr: 100,
+                s: [],
+                m: {
+                  rowGroups: 1,
+                  compressionCodecs: ['SNAPPY'],
+                  compressionUniform: true,
+                  hasOffsetIndex: true,
+                  hasColumnIndex: true,
+                  createdBy: null,
+                  version: 1,
+                  arrowSchema: null
+                }
+              },
+              { t: 'c', n: 'col1', v: ['val1'] },
+              { t: 'c', n: 'col2', v: ['val2'] }
+            ],
+            {
+              format: 'parquet',
+              truncated: false,
+              totalSize: 5000,
+              totalRows: 100,
+              previewRows: 50
+            }
+          )
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
+
+      await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
+
+      // Click the Data tab
+      await page.getByRole('tab', { name: 'Data' }).first().click();
+
+      // Parquet preview table should be visible with column headers
+      await expect
+        .element(page.getByRole('table', { name: 'Parquet preview' }))
+        .toBeInTheDocument();
+      await expect.element(page.getByText('col1').first()).toBeInTheDocument();
+      await expect.element(page.getByText('col2').first()).toBeInTheDocument();
+    });
+
+    it('should show blocked message when parquet is not renderable', async () => {
+      vi.stubGlobal(
+        'fetch',
+        vi.fn().mockResolvedValue(
+          ndjsonResponse(
+            [
+              {
+                t: 'h',
+                h: ['col1', 'col2'],
+                tr: 100,
+                s: [
+                  {
+                    name: 'col1',
+                    type: 'string',
+                    codec: 'SNAPPY',
+                    compressedSize: 100,
+                    uncompressedSize: 200,
+                    stats: { nullCount: null, distinctCount: null, min: null, max: null }
+                  },
+                  {
+                    name: 'col2',
+                    type: 'int64',
+                    codec: 'GZIP',
+                    compressedSize: 50,
+                    uncompressedSize: 80,
+                    stats: { nullCount: null, distinctCount: null, min: null, max: null }
+                  }
+                ],
+                m: {
+                  rowGroups: 1,
+                  compressionCodecs: ['SNAPPY', 'GZIP'],
+                  compressionUniform: false,
+                  hasOffsetIndex: true,
+                  hasColumnIndex: true,
+                  createdBy: null,
+                  version: 1,
+                  arrowSchema: null
+                }
+              }
+            ],
+            {
+              format: 'parquet',
+              dataBlocked: true,
+              truncated: false,
+              totalSize: 5000,
+              totalRows: 100,
+              previewRows: 50
+            }
+          )
+        )
+      );
+
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/blocked.parquet' });
+
+      await expect.element(page.getByText('blocked.parquet')).toBeInTheDocument();
+      await expect.element(page.getByText('Preview blocked').first()).toBeInTheDocument();
     });
   });
 
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index a40e3d23..d9c1f9f7 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -49,6 +49,8 @@
     const lines = text.split('\n').filter((l) => l.trim() !== '');
     return lines.length > MAX_ROWS + 1;
   });
+
+  const uid = $props.id();
 </script>
 
 <div>
@@ -58,6 +60,7 @@
     <table class="table-xs table min-w-max" aria-label="CSV preview">
       <thead>
         <tr class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs">
+          <th class="text-base-content/30 w-10 text-right font-normal" id="{uid}-line-hdr"></th>
           {#each headers as header, i (i)}
             <th class="font-semibold whitespace-nowrap">{header}</th>
           {/each}
@@ -66,6 +69,9 @@
       <tbody>
         {#each rows as row, i (i)}
           <tr class="hover:bg-base-200 transition-colors">
+            <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
+              >{(i + 1).toLocaleString()}</td
+            >
             <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
             {#each headers as _h, j (j)}
               <td class="text-base-content/80 max-w-xs truncate text-xs">{row[j] ?? ''}</td>
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
index 96a56808..fd72b452 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
@@ -45,7 +45,10 @@ describe('CsvPreview', () => {
     const text = 'A,B,C\n1,,3\n,,';
     render(CsvPreview, { text });
 
-    await expect.element(page.getByText('1')).toBeInTheDocument();
+    // nth(1) to skip the line-number cell, get the data cell
+    await expect
+      .element(page.getByRole('cell', { name: '1', exact: true }).nth(1))
+      .toBeInTheDocument();
     await expect.element(page.getByText('3')).toBeInTheDocument();
   });
 
@@ -59,7 +62,7 @@ describe('CsvPreview', () => {
     render(CsvPreview, { text });
 
     // Should show truncation notice
-    const notice = page.getByText(/250/);
+    const notice = page.getByText('Showing first 250 rows');
     await expect.element(notice).toBeInTheDocument();
   });
 
@@ -81,14 +84,21 @@ describe('CsvPreview', () => {
     render(CsvPreview, { text });
 
     // Row has only 1 field but 3 headers, so columns B and C should render as empty via ?? ''
-    await expect.element(page.getByRole('cell', { name: '1', exact: true })).toBeInTheDocument();
-    // There should be 3 cells in the body row
+    await expect
+      .element(page.getByRole('cell', { name: '1', exact: true }).nth(1))
+      .toBeInTheDocument();
+    // There should be 3 data cells + 1 line number cell in the body row
     const rows = page.getByRole('row');
     // row 0 is header, row 1 is data
     const dataCells = rows.nth(1).getByRole('cell');
+    // Line number cell
     await expect.element(dataCells.nth(0)).toHaveTextContent('1');
-    await expect.element(dataCells.nth(1)).toHaveTextContent('');
-    await expect.element(dataCells.nth(2)).toHaveTextContent('');
+    // Column A: value '1'
+    await expect.element(dataCells.nth(1)).toHaveTextContent('1');
+    // Column B: missing, renders as empty
+    await expect.element(dataCells.nth(2)).toHaveTextContent(/^$/);
+    // Column C: missing, renders as empty
+    await expect.element(dataCells.nth(3)).toHaveTextContent(/^$/);
   });
 
   it('should handle header-only CSV', async () => {
diff --git a/src/lib/components/storage/modals/preview/ParquetMetadata.svelte b/src/lib/components/storage/modals/preview/ParquetMetadata.svelte
new file mode 100644
index 00000000..38358f31
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/ParquetMetadata.svelte
@@ -0,0 +1,337 @@
+<script lang="ts">
+  import IconSchema from 'virtual:icons/material-symbols/schema';
+  import IconStorage from 'virtual:icons/material-symbols/database';
+  import IconCompress from 'virtual:icons/material-symbols/compress';
+  import Info from 'virtual:icons/material-symbols/info';
+  import IconArrow from 'virtual:icons/material-symbols/arrow-circle-right';
+  import IconUnfold from 'virtual:icons/material-symbols/unfold-more';
+  import * as m from '$lib/paraglide/messages.js';
+  import { getLocale } from '$lib/paraglide/runtime.js';
+  import { formatFileSize } from '$lib/storage/utils.js';
+
+  interface ColumnStats {
+    nullCount: number | null;
+    distinctCount: number | null;
+    min: string | null;
+    max: string | null;
+  }
+
+  interface ColumnInfo {
+    name: string;
+    type: string;
+    codec: string;
+    compressedSize: number;
+    uncompressedSize: number;
+    stats: ColumnStats;
+  }
+
+  interface ParquetFileMeta {
+    rowGroups: number;
+    compressionCodecs: string[];
+    compressionUniform: boolean;
+    hasOffsetIndex: boolean;
+    hasColumnIndex: boolean;
+    createdBy: string | null;
+    version: number;
+    arrowSchema: string | null;
+  }
+
+  interface Props {
+    headers: string[];
+    columnTypes: ColumnInfo[];
+    totalRows: number;
+    totalSize: number;
+    metadata: ParquetFileMeta;
+  }
+
+  let { headers, columnTypes, totalRows, totalSize, metadata }: Props = $props();
+
+  let hasOffsetBadge = $derived(
+    metadata.hasOffsetIndex ? 'badge-success' : 'badge-soft badge-warning'
+  );
+  let hasColumnBadge = $derived(
+    metadata.hasColumnIndex ? 'badge-success' : 'badge-soft badge-warning'
+  );
+
+  let totalUncompressed = $derived(columnTypes.reduce((sum, col) => sum + col.uncompressedSize, 0));
+
+  let showArrowSchema = $state(false);
+</script>
+
+<div class="flex h-full flex-col gap-4 overflow-auto p-4">
+  <!-- File Overview -->
+  <section aria-label={m.storage_preview_parquet_overview()}>
+    <h3 class="text-base-content mb-3 flex items-center gap-2 text-sm font-semibold">
+      <Info class="size-4" aria-hidden="true" />
+      {m.storage_preview_parquet_overview()}
+    </h3>
+    <dl class="grid grid-cols-2 gap-x-6 gap-y-2 text-sm sm:grid-cols-3">
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_file_size()}</dt>
+        <dd class="text-base-content font-mono font-medium">{formatFileSize(totalSize)}</dd>
+      </div>
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_total_rows()}</dt>
+        <dd class="text-base-content font-mono font-medium">
+          {totalRows.toLocaleString(getLocale())}
+        </dd>
+      </div>
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_total_columns()}</dt>
+        <dd class="text-base-content font-mono font-medium">{headers.length}</dd>
+      </div>
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_version()}</dt>
+        <dd class="text-base-content font-mono font-medium">v{metadata.version}</dd>
+      </div>
+      {#if metadata.createdBy}
+        <div class="col-span-2 sm:col-span-2">
+          <dt class="text-base-content/50">{m.storage_preview_parquet_created_by()}</dt>
+          <dd class="text-base-content truncate font-mono text-xs">{metadata.createdBy}</dd>
+        </div>
+      {/if}
+    </dl>
+  </section>
+
+  <!-- Schema -->
+  <section aria-label={m.storage_preview_parquet_schema()}>
+    <h3 class="text-base-content mb-3 flex items-center gap-2 text-sm font-semibold">
+      <IconSchema class="size-4" aria-hidden="true" />
+      {m.storage_preview_parquet_schema()}
+    </h3>
+    <div>
+      <table class="table-xs w-full table-fixed" aria-label={m.storage_preview_parquet_schema()}>
+        <colgroup>
+          <col class="w-8" />
+          <col class="w-2/12" />
+          <col class="w-1/12" />
+          <col class="w-[10%]" />
+          <col class="w-[28%]" />
+          <col class="w-[30%]" />
+        </colgroup>
+        <thead>
+          <tr class="text-base-content/50 text-left">
+            <th>#</th>
+            <th>{m.storage_preview_parquet_column()}</th>
+            <th>{m.storage_preview_parquet_type()}</th>
+            <th>{m.storage_preview_parquet_compression()}</th>
+            <th>{m.storage_preview_parquet_size()}</th>
+            <th>{m.storage_preview_parquet_statistics()}</th>
+          </tr>
+        </thead>
+        <tbody>
+          {#each columnTypes as col, i (col.name)}
+            <tr class="hover:bg-base-200 transition-colors">
+              <td class="text-base-content/30 font-mono text-xs">{i + 1}</td>
+              <td class="max-w-40 truncate font-mono text-xs font-medium" title={col.name}>
+                {col.name}
+              </td>
+              <td>
+                <span class="badge badge-soft badge-sm font-mono">{col.type}</span>
+              </td>
+              <td>
+                <span class="badge badge-soft badge-sm font-mono">{col.codec}</span>
+              </td>
+              <td class="min-w-36">
+                {#if col.uncompressedSize > 0 || col.compressedSize > 0}
+                  <div class="flex flex-col gap-0.5">
+                    <div class="flex items-center gap-1 text-xs">
+                      <span
+                        class="tooltip tooltip-bottom"
+                        data-tip="{m.storage_preview_parquet_compressed()}: {formatFileSize(
+                          col.compressedSize
+                        )} / {m.storage_preview_parquet_uncompressed()}: {formatFileSize(
+                          col.uncompressedSize
+                        )}"
+                      >
+                        <span class="text-base-content/70" aria-hidden="true">&#8595;</span>
+                        <span class="font-mono">{formatFileSize(col.compressedSize)}</span>
+                      </span>
+                      {#if totalUncompressed > 0}
+                        <span
+                          class="tooltip tooltip-bottom text-base-content/40 text-[10px]"
+                          data-tip="{Math.round(
+                            (col.uncompressedSize / totalUncompressed) * 100
+                          )}% of file uncompressed size"
+                        >
+                          ({Math.round((col.uncompressedSize / totalUncompressed) * 100)}%)
+                        </span>
+                      {/if}
+                    </div>
+                    <div
+                      class="tooltip tooltip-bottom bg-base-300 h-1 w-full overflow-hidden rounded-full"
+                      data-tip="{m.storage_preview_parquet_compressed()}: {formatFileSize(
+                        col.compressedSize
+                      )} / {m.storage_preview_parquet_uncompressed()}: {formatFileSize(
+                        col.uncompressedSize
+                      )}"
+                      role="progressbar"
+                      aria-valuenow={Math.round(
+                        (col.compressedSize / Math.max(col.uncompressedSize, 1)) * 100
+                      )}
+                      aria-valuemin={0}
+                      aria-valuemax={100}
+                      aria-label="{formatFileSize(col.compressedSize)} compressed / {formatFileSize(
+                        col.uncompressedSize
+                      )} uncompressed"
+                    >
+                      <div
+                        class="bg-primary h-full rounded-full transition-all"
+                        style="width: {Math.min(
+                          100,
+                          col.uncompressedSize > 0
+                            ? Math.round((col.compressedSize / col.uncompressedSize) * 100)
+                            : 100
+                        )}%"
+                      ></div>
+                    </div>
+                  </div>
+                {:else}
+                  <span class="text-base-content/30 text-xs">&mdash;</span>
+                {/if}
+              </td>
+              <td class="min-w-36 overflow-hidden text-xs">
+                {#if col.stats.min !== null || col.stats.max !== null || col.stats.nullCount !== null || col.stats.distinctCount !== null}
+                  <dl class="grid grid-cols-[auto_1fr] gap-x-1.5 gap-y-0.5">
+                    {#if col.stats.min !== null}
+                      <dt class="text-base-content/50 shrink-0 text-[10px]">
+                        {m.storage_preview_parquet_min()}
+                      </dt>
+                      <dd class="m-0 truncate font-mono text-[10px]" title={col.stats.min}>
+                        {col.stats.min}
+                      </dd>
+                    {/if}
+                    {#if col.stats.max !== null}
+                      <dt class="text-base-content/50 shrink-0 text-[10px]">
+                        {m.storage_preview_parquet_max()}
+                      </dt>
+                      <dd class="m-0 truncate font-mono text-[10px]" title={col.stats.max}>
+                        {col.stats.max}
+                      </dd>
+                    {/if}
+                    {#if col.stats.nullCount !== null}
+                      <dt class="text-base-content/50 shrink-0 text-[10px]">
+                        {m.storage_preview_parquet_null_count()}
+                      </dt>
+                      <dd class="m-0 font-mono text-[10px]">
+                        {col.stats.nullCount.toLocaleString(getLocale())}
+                      </dd>
+                    {/if}
+                    {#if col.stats.distinctCount !== null}
+                      <dt class="text-base-content/50 shrink-0 text-[10px]">
+                        {m.storage_preview_parquet_distinct_count()}
+                      </dt>
+                      <dd class="m-0 font-mono text-[10px]">
+                        {col.stats.distinctCount.toLocaleString(getLocale())}
+                      </dd>
+                    {/if}
+                  </dl>
+                {:else}
+                  <span class="text-base-content/30 italic"
+                    >{m.storage_preview_parquet_not_stored()}</span
+                  >
+                {/if}
+              </td>
+            </tr>
+          {/each}
+        </tbody>
+      </table>
+    </div>
+  </section>
+
+  <!-- Compression & Indexes -->
+  <section aria-label={m.storage_preview_parquet_compression_indexes()}>
+    <h3 class="text-base-content mb-3 flex items-center gap-2 text-sm font-semibold">
+      <IconCompress class="size-4" aria-hidden="true" />
+      {m.storage_preview_parquet_compression_indexes()}
+    </h3>
+    <dl class="grid grid-cols-2 gap-x-6 gap-y-3 text-sm sm:grid-cols-3">
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_row_groups()}</dt>
+        <dd class="text-base-content font-mono font-medium">{metadata.rowGroups}</dd>
+      </div>
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_compression()}</dt>
+        <dd class="flex flex-wrap items-center gap-1">
+          {#if metadata.compressionCodecs.length === 0}
+            <span class="text-base-content/50 text-xs italic"
+              >{m.storage_preview_parquet_none()}</span
+            >
+          {:else}
+            {#each metadata.compressionCodecs as codec (codec)}
+              <span class="badge badge-soft badge-sm font-mono">{codec}</span>
+            {/each}
+            {#if metadata.compressionUniform && metadata.compressionCodecs.length === 1}
+              <span class="text-base-content/40 text-[10px]"
+                >({m.storage_preview_parquet_uniform()})</span
+              >
+            {/if}
+          {/if}
+        </dd>
+      </div>
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_offset_index()}</dt>
+        <dd>
+          <span class="badge {hasOffsetBadge} badge-sm">
+            {metadata.hasOffsetIndex
+              ? m.storage_preview_parquet_available()
+              : m.storage_preview_parquet_missing()}
+          </span>
+        </dd>
+      </div>
+      <div>
+        <dt class="text-base-content/50">{m.storage_preview_parquet_column_index()}</dt>
+        <dd>
+          <span class="badge {hasColumnBadge} badge-sm">
+            {metadata.hasColumnIndex
+              ? m.storage_preview_parquet_available()
+              : m.storage_preview_parquet_missing()}
+          </span>
+        </dd>
+      </div>
+    </dl>
+  </section>
+
+  <!-- Arrow Schema -->
+  {#if metadata.arrowSchema}
+    <section aria-label={m.storage_preview_parquet_arrow_schema()}>
+      <h3 class="text-base-content mb-3 flex items-center gap-2 text-sm font-semibold">
+        <IconArrow class="size-4" aria-hidden="true" />
+        {m.storage_preview_parquet_arrow_schema()}
+      </h3>
+      <div class="text-base-content/70 text-sm">
+        <span class="italic">
+          {m.storage_preview_parquet_arrow_schema_present({ size: metadata.arrowSchema.length })}
+        </span>
+        <button
+          class="btn btn-ghost btn-xs gap-1"
+          onclick={() => (showArrowSchema = !showArrowSchema)}
+          aria-expanded={showArrowSchema}
+        >
+          <IconUnfold class="size-3" aria-hidden="true" />
+          {showArrowSchema ? 'Hide' : 'Show'}
+        </button>
+      </div>
+      {#if showArrowSchema}
+        <pre
+          class="bg-base-200 text-base-content/80 mt-1 overflow-x-auto rounded-md p-3 font-mono text-xs leading-relaxed">{metadata.arrowSchema}</pre>
+      {/if}
+    </section>
+  {/if}
+
+  <!-- Row Groups Detail -->
+  {#if metadata.rowGroups > 0}
+    <section aria-label={m.storage_preview_parquet_row_groups()}>
+      <h3 class="text-base-content mb-3 flex items-center gap-2 text-sm font-semibold">
+        <IconStorage class="size-4" aria-hidden="true" />
+        {m.storage_preview_parquet_row_groups()}
+      </h3>
+      <dl class="grid grid-cols-2 gap-x-6 gap-y-3 text-sm sm:grid-cols-3">
+        <div>
+          <dt class="text-base-content/50">{m.storage_preview_parquet_row_groups()}</dt>
+          <dd class="text-base-content font-mono font-medium">{metadata.rowGroups}</dd>
+        </div>
+      </dl>
+    </section>
+  {/if}
+</div>
diff --git a/src/lib/components/storage/modals/preview/ParquetMetadata.svelte.spec.ts b/src/lib/components/storage/modals/preview/ParquetMetadata.svelte.spec.ts
new file mode 100644
index 00000000..5e0d9bfc
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/ParquetMetadata.svelte.spec.ts
@@ -0,0 +1,202 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import ParquetMetadata from './ParquetMetadata.svelte';
+
+describe('ParquetMetadata', () => {
+  const defaultColumnTypes = [
+    {
+      name: 'id',
+      type: 'int64',
+      codec: 'SNAPPY',
+      compressedSize: 100,
+      uncompressedSize: 500,
+      stats: { nullCount: 0, distinctCount: 100, min: '1', max: '100' }
+    },
+    {
+      name: 'name',
+      type: 'string',
+      codec: 'SNAPPY',
+      compressedSize: 800,
+      uncompressedSize: 2000,
+      stats: { nullCount: 0, distinctCount: null, min: 'Alice', max: 'Bob' }
+    },
+    {
+      name: 'score',
+      type: 'double',
+      codec: 'GZIP',
+      compressedSize: 50,
+      uncompressedSize: 300,
+      stats: { nullCount: null, distinctCount: null, min: null, max: null }
+    }
+  ];
+
+  const defaultMetadata = {
+    rowGroups: 3,
+    compressionCodecs: ['SNAPPY', 'GZIP'],
+    compressionUniform: false,
+    hasOffsetIndex: true,
+    hasColumnIndex: false,
+    createdBy: 'pyarrow',
+    version: 2,
+    arrowSchema: null
+  };
+
+  it('should render file overview', async () => {
+    render(ParquetMetadata, {
+      headers: ['id', 'name', 'score'],
+      columnTypes: defaultColumnTypes,
+      totalRows: 1000,
+      totalSize: 50000,
+      metadata: defaultMetadata
+    });
+
+    await expect.element(page.getByText('Overview')).toBeInTheDocument();
+    await expect.element(page.getByText('File size')).toBeInTheDocument();
+    await expect.element(page.getByText('Total rows')).toBeInTheDocument();
+    await expect.element(page.getByText('1,000')).toBeInTheDocument();
+  });
+
+  it('should render schema table with column types, compression, sizes and stats', async () => {
+    render(ParquetMetadata, {
+      headers: ['id', 'name', 'score'],
+      columnTypes: defaultColumnTypes,
+      totalRows: 1000,
+      totalSize: 50000,
+      metadata: defaultMetadata
+    });
+
+    await expect.element(page.getByText('Schema')).toBeInTheDocument();
+    await expect.element(page.getByText('id')).toBeInTheDocument();
+    await expect.element(page.getByText('name')).toBeInTheDocument();
+    await expect.element(page.getByText('score')).toBeInTheDocument();
+    await expect.element(page.getByText('int64')).toBeInTheDocument();
+    await expect.element(page.getByText('string')).toBeInTheDocument();
+    await expect.element(page.getByText('double')).toBeInTheDocument();
+
+    // Per-column compression
+    await expect.element(page.getByText('SNAPPY').first()).toBeInTheDocument();
+    await expect.element(page.getByText('GZIP').first()).toBeInTheDocument();
+
+    // Stats labels
+    await expect.element(page.getByText('Min').first()).toBeInTheDocument();
+    await expect.element(page.getByText('Max').first()).toBeInTheDocument();
+    await expect.element(page.getByText('Null count').first()).toBeInTheDocument();
+    await expect.element(page.getByText('Distinct count').first()).toBeInTheDocument();
+    // Stats values for id column
+    await expect.element(page.getByText('1').first()).toBeInTheDocument();
+    await expect.element(page.getByText('100').first()).toBeInTheDocument();
+
+    // Not stored for score column (no stats)
+    await expect.element(page.getByText('Not stored')).toBeInTheDocument();
+  });
+
+  it('should render compression and indexes section', async () => {
+    render(ParquetMetadata, {
+      headers: ['id'],
+      columnTypes: [defaultColumnTypes[0]],
+      totalRows: 100,
+      totalSize: 2000,
+      metadata: defaultMetadata
+    });
+
+    await expect.element(page.getByText('Compression & Indexes').first()).toBeInTheDocument();
+    await expect.element(page.getByText('SNAPPY').first()).toBeInTheDocument();
+    await expect.element(page.getByText('GZIP')).toBeInTheDocument();
+    await expect.element(page.getByText('Available')).toBeInTheDocument();
+    await expect.element(page.getByText('Missing')).toBeInTheDocument();
+  });
+
+  it('should show uniform label when compression is uniform', async () => {
+    render(ParquetMetadata, {
+      headers: ['id'],
+      columnTypes: [
+        {
+          ...defaultColumnTypes[0],
+          codec: 'SNAPPY'
+        }
+      ],
+      totalRows: 100,
+      totalSize: 2000,
+      metadata: { ...defaultMetadata, compressionCodecs: ['SNAPPY'], compressionUniform: true }
+    });
+
+    await expect.element(page.getByText('uniform')).toBeInTheDocument();
+  });
+
+  it('should render row groups section when rowGroups > 0', async () => {
+    render(ParquetMetadata, {
+      headers: ['id'],
+      columnTypes: [defaultColumnTypes[0]],
+      totalRows: 100,
+      totalSize: 2000,
+      metadata: defaultMetadata
+    });
+
+    await expect.element(page.getByText('Row groups').first()).toBeInTheDocument();
+  });
+
+  it('should render created by when present', async () => {
+    render(ParquetMetadata, {
+      headers: ['id'],
+      columnTypes: [defaultColumnTypes[0]],
+      totalRows: 100,
+      totalSize: 2000,
+      metadata: defaultMetadata
+    });
+
+    await expect.element(page.getByText('pyarrow')).toBeInTheDocument();
+  });
+
+  it('should show Arrow schema section when present', async () => {
+    render(ParquetMetadata, {
+      headers: ['id'],
+      columnTypes: [defaultColumnTypes[0]],
+      totalRows: 100,
+      totalSize: 2000,
+      metadata: { ...defaultMetadata, arrowSchema: 'id, name, score' }
+    });
+
+    await expect.element(page.getByText('Arrow schema').first()).toBeInTheDocument();
+
+    // Click "Show" to reveal the arrow schema content
+    const showBtn = page.getByRole('button', { name: 'Show' });
+    await expect.element(showBtn).toBeInTheDocument();
+    await showBtn.click();
+
+    await expect.element(page.getByText('id, name, score')).toBeInTheDocument();
+  });
+
+  it('should handle empty column types', async () => {
+    render(ParquetMetadata, {
+      headers: [],
+      columnTypes: [],
+      totalRows: 0,
+      totalSize: 0,
+      metadata: { ...defaultMetadata, rowGroups: 0, arrowSchema: null }
+    });
+
+    await expect.element(page.getByText('Overview')).toBeInTheDocument();
+    await expect.element(page.getByText('0 B')).toBeInTheDocument();
+  });
+
+  it('should show None for empty compression codecs', async () => {
+    render(ParquetMetadata, {
+      headers: ['id'],
+      columnTypes: [
+        {
+          ...defaultColumnTypes[0],
+          codec: 'SNAPPY',
+          compressedSize: 0,
+          uncompressedSize: 0,
+          stats: { nullCount: null, distinctCount: null, min: null, max: null }
+        }
+      ],
+      totalRows: 100,
+      totalSize: 2000,
+      metadata: { ...defaultMetadata, compressionCodecs: [] }
+    });
+
+    await expect.element(page.getByText('None')).toBeInTheDocument();
+  });
+});
diff --git a/src/lib/components/storage/modals/preview/ParquetPreview.svelte b/src/lib/components/storage/modals/preview/ParquetPreview.svelte
new file mode 100644
index 00000000..aedf4e67
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/ParquetPreview.svelte
@@ -0,0 +1,271 @@
+<script lang="ts">
+  import { untrack, onMount } from 'svelte';
+  import * as m from '$lib/paraglide/messages.js';
+  import { getLocale } from '$lib/paraglide/runtime.js';
+
+  interface Props {
+    headers: string[];
+    initialRows: unknown[][];
+    totalRows?: number;
+
+    fetchRows?: (
+      offset: number,
+      limit: number,
+      onColumn?: (name: string, values: unknown[]) => void
+    ) => Promise<unknown[][]>;
+    showingRowsCount?: number;
+    /** When true, skip scroll-based chunk loading (e.g. tab is visually hidden). */
+    hidden?: boolean;
+  }
+
+  let {
+    headers,
+    initialRows,
+    totalRows = 0,
+    fetchRows,
+    showingRowsCount = $bindable(0),
+    hidden = false
+  }: Props = $props();
+
+  const CHUNK_SIZE = 250; // magic number: rows to display
+  const ROW_HEIGHT = 32; // Exact height of table-xs (h-8)
+
+  let containerHeight = $state(400);
+  let scrollTop = $state(0);
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let loadedChunks = $state<Record<number, any[][]>>({});
+  let loadingChunks = $state<Set<number>>(new Set());
+
+  // Calculate column widths once on load to prevent width shifts during scrolling
+  let columnWidths = $state<number[]>([]);
+
+  // Measure actual rendered text width using canvas for cross-browser consistency
+  function textWidth(text: string): number {
+    if (typeof document === 'undefined') return text.length * 7;
+    const ctx = document.createElement('canvas').getContext('2d');
+    if (!ctx) return text.length * 7;
+    ctx.font =
+      '600 12px system-ui, -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif';
+    return ctx.measureText(text).width;
+  }
+
+  // Sync initial data from parent into the virtual-scroll chunk system.
+  // When initialRows changes (e.g. streaming NDJSON data arrived), replace chunk 0.
+  function populateChunk0() {
+    if (initialRows && initialRows.length > 0) {
+      loadedChunks = { 0: initialRows };
+      loadingChunks.clear();
+      scrollTop = 0;
+      // Scan initial data to determine max content width per column
+      const CELL_PADDING = 16;
+      const widths = headers.map((h) => textWidth(h));
+      for (const row of initialRows) {
+        if (!row) continue;
+        for (let i = 0; i < headers.length; i++) {
+          const val = row[i];
+          const str = val !== null && val !== undefined ? String(val) : '';
+          const w = textWidth(str);
+          if (w > widths[i]) widths[i] = w;
+        }
+      }
+      columnWidths = widths.map((w) => Math.max(w + CELL_PADDING, 80));
+    }
+  }
+
+  onMount(populateChunk0);
+
+  $effect(() => {
+    if (initialRows && initialRows.length > 0 && !hidden) {
+      untrack(() => {
+        populateChunk0();
+      });
+    }
+  });
+
+  // Limit the scroll canvas to the highest loaded chunk PLUS a 10-row buffer.
+  let highestLoadedChunk = $derived.by(() => {
+    const keys = Object.keys(loadedChunks).map(Number);
+    if (keys.length === 0) return 0;
+    return Math.max(...keys);
+  });
+  let virtualTotalRows = $derived(Math.min(totalRows, (highestLoadedChunk + 1) * CHUNK_SIZE + 10));
+
+  let startIndex = $derived(Math.max(0, Math.floor(scrollTop / ROW_HEIGHT) - 5));
+  let endIndex = $derived(
+    Math.min(virtualTotalRows, Math.floor((scrollTop + containerHeight) / ROW_HEIGHT) + 15)
+  );
+
+  let paddingTop = $derived(startIndex * ROW_HEIGHT);
+  let paddingBottom = $derived(Math.max(0, (virtualTotalRows - endIndex) * ROW_HEIGHT));
+
+  // purely computes visual logic, no side-effects here
+  let visibleRows = $derived.by(() => {
+    const rowsToRender = [];
+    for (let i = startIndex; i < endIndex; i++) {
+      const chunkIdx = Math.floor(i / CHUNK_SIZE);
+      const chunkOffset = i % CHUNK_SIZE;
+      const chunk = loadedChunks[chunkIdx];
+
+      if (chunk && chunk[chunkOffset] !== undefined) {
+        rowsToRender.push({ index: i, data: chunk[chunkOffset] });
+      } else {
+        rowsToRender.push({ index: i, data: null }); // Render Skeleton
+      }
+    }
+    return rowsToRender;
+  });
+
+  // Monitor scroll boundaries to safely trigger background chunk fetching
+  $effect(() => {
+    if (!fetchRows || hidden) return;
+
+    const currentStart = startIndex;
+    const currentEnd = endIndex;
+
+    const startChunk = Math.floor(currentStart / CHUNK_SIZE);
+    const endChunk = Math.floor(currentEnd / CHUNK_SIZE);
+
+    untrack(() => {
+      for (let c = startChunk; c <= endChunk; c++) {
+        if (!loadedChunks[c] && !loadingChunks.has(c)) {
+          loadingChunks.add(c);
+
+          // Initialize chunk with empty placeholder rows (undefined = not loaded yet)
+          const placeholder = Array.from({ length: CHUNK_SIZE }, () =>
+            new Array(headers.length).fill(undefined)
+          );
+          loadedChunks[c] = placeholder;
+
+          fetchRows(
+            c * CHUNK_SIZE,
+            CHUNK_SIZE,
+            (() => {
+              // Track per-column position within this chunk because hyparquet
+              // may split column data across multiple messages.
+              const colPos: Record<string, number> = {};
+              return (name: string, values: unknown[]) => {
+                const colIdx = headers.indexOf(name);
+                if (colIdx < 0) return;
+                const chunk = loadedChunks[c];
+                if (!chunk) return;
+                let pos = colPos[name] ?? 0;
+                for (let i = 0; i < values.length && pos < chunk.length; i++) {
+                  if (chunk[pos]) chunk[pos][colIdx] = values[i];
+                  pos++;
+                }
+                colPos[name] = pos;
+                // Create new reference so Svelte detects the update immediately
+                loadedChunks = { ...loadedChunks };
+              };
+            })()
+          )
+            .then((data) => {
+              loadingChunks.delete(c);
+              // Replace placeholder with fully populated data
+              loadedChunks = { ...loadedChunks, [c]: data };
+            })
+            .catch(() => {
+              loadingChunks.delete(c);
+              const next = { ...loadedChunks };
+              delete next[c];
+              loadedChunks = next;
+            });
+        }
+      }
+    });
+  });
+
+  const loadedRowsCount = $derived(Object.keys(loadedChunks).length * CHUNK_SIZE);
+  const isTruncated = $derived(totalRows > loadedRowsCount);
+  const formattedLoadedRowsCount = $derived(loadedRowsCount.toLocaleString(getLocale()));
+  const formattedTotalRows = $derived(totalRows.toLocaleString(getLocale()));
+
+  $effect(() => {
+    showingRowsCount = loadedRowsCount;
+  });
+</script>
+
+<div class="relative flex h-full flex-col">
+  {#if headers.length === 0}
+    <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
+  {:else}
+    <!-- eslint-disable-next-line svelte/valid-compile -->
+    <div
+      class="min-h-0 w-full flex-1 overflow-auto"
+      bind:clientHeight={containerHeight}
+      onscroll={(e) => (scrollTop = e.currentTarget.scrollTop)}
+    >
+      <table class="table-xs table table-fixed" aria-label="Parquet preview">
+        <thead class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs shadow-sm">
+          <tr>
+            <th class="text-base-content/30 w-10 text-right font-normal"></th>
+            {#each headers as header, j (header)}
+              <th
+                class="truncate font-semibold"
+                style={columnWidths.length > 0 ? `width: ${columnWidths[j]}px` : ''}>{header}</th
+              >
+            {/each}
+          </tr>
+        </thead>
+        <tbody>
+          <!-- Top Spacer -->
+          {#if paddingTop > 0}
+            <tr style="height: {paddingTop}px;">
+              <td colspan={headers.length + 1} class="border-0 p-0"></td>
+            </tr>
+          {/if}
+
+          <!-- Visible Rows & Skeletons -->
+          {#each visibleRows as row (row.index)}
+            <tr class="hover:bg-base-200 h-8 transition-colors">
+              <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
+                >{(row.index + 1).toLocaleString(getLocale())}</td
+              >
+              {#if row.data !== null && row.data !== undefined}
+                <!-- eslint-disable-next-line @typescript-eslint/no-unused-vars -->
+                {#each headers as _h, j (j)}
+                  {#if row.data[j] !== undefined}
+                    <td class="text-base-content/80 truncate text-xs">
+                      {row.data[j] !== null ? String(row.data[j]) : ''}
+                    </td>
+                  {:else}
+                    <td class="p-1">
+                      <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
+                    </td>
+                  {/if}
+                {/each}
+              {:else}
+                <!-- Skeleton State (full row not yet initialized) -->
+                <!-- eslint-disable-next-line @typescript-eslint/no-unused-vars -->
+                {#each headers as _h, j (j)}
+                  <td class="p-1">
+                    <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
+                  </td>
+                {/each}
+              {/if}
+            </tr>
+          {/each}
+
+          <!-- Bottom Spacer -->
+          {#if paddingBottom > 0}
+            <tr style="height: {paddingBottom}px;">
+              <td colspan={headers.length + 1} class="border-0 p-0"></td>
+            </tr>
+          {/if}
+        </tbody>
+      </table>
+    </div>
+
+    {#if isTruncated}
+      <p class="text-base-content/50 px-4 py-2 text-xs italic">
+        {m.storage_preview_parquet_rows
+          ? m.storage_preview_parquet_rows({
+              count: formattedLoadedRowsCount,
+              total: formattedTotalRows
+            })
+          : `Showing ${formattedLoadedRowsCount} of ${formattedTotalRows} rows. Scroll to load more.`}
+      </p>
+    {/if}
+  {/if}
+</div>
diff --git a/src/lib/components/storage/modals/preview/ParquetPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/ParquetPreview.svelte.spec.ts
new file mode 100644
index 00000000..7f8622f2
--- /dev/null
+++ b/src/lib/components/storage/modals/preview/ParquetPreview.svelte.spec.ts
@@ -0,0 +1,191 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import ParquetPreview from './ParquetPreview.svelte';
+
+describe('ParquetPreview', () => {
+  const defaultHeaders = ['id', 'name', 'email'];
+  const defaultRows = [
+    ['1', 'Alice', 'alice@example.com'],
+    ['2', 'Bob', 'bob@example.com'],
+    ['3', 'Charlie', 'charlie@example.com']
+  ];
+
+  it('should show empty state when headers array is empty', async () => {
+    render(ParquetPreview, { headers: [], initialRows: [] });
+
+    await expect.element(page.getByText('This bucket is empty')).toBeInTheDocument();
+  });
+
+  it('should render a table with headers', async () => {
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: defaultRows
+    });
+
+    const table = page.getByRole('table', { name: 'Parquet preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    for (const header of defaultHeaders) {
+      await expect.element(page.getByText(header)).toBeInTheDocument();
+    }
+  });
+
+  it('should render initial rows in the table', async () => {
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: defaultRows,
+      totalRows: 3
+    });
+
+    await expect
+      .element(page.getByRole('cell', { name: 'Alice', exact: true }))
+      .toBeInTheDocument();
+    await expect
+      .element(page.getByRole('cell', { name: 'bob@example.com', exact: true }))
+      .toBeInTheDocument();
+    await expect
+      .element(page.getByRole('cell', { name: 'Charlie', exact: true }))
+      .toBeInTheDocument();
+  });
+
+  it('should show row count message when totalRows exceeds loaded rows', async () => {
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: defaultRows,
+      totalRows: 1000
+    });
+
+    // With default CHUNK_SIZE=250, loadedRowsCount = 250 (one chunk)
+    // totalRows = 1000, so isTruncated = true
+    await expect.element(page.getByText(/rows/)).toBeInTheDocument();
+  });
+
+  it('should not show row count message when totalRows equals loaded rows', async () => {
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: defaultRows,
+      totalRows: 3
+    });
+
+    // Only 3 rows loaded, totalRows = 3 — not truncated
+    const rowsMessages = page.getByText(/rows/i);
+    // The only text with "rows" should be the row count message.
+    // When not truncated, no such message appears.
+    expect(await rowsMessages.all()).toHaveLength(0);
+  });
+
+  it('should not show row count when totalRows is 0', async () => {
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: defaultRows,
+      totalRows: 0
+    });
+
+    // 0 total rows, no truncation message
+    await expect.element(page.getByText(/Showing/i)).not.toBeInTheDocument();
+  });
+
+  it('should render cell content using String() so null becomes empty string', async () => {
+    const rowsWithNull = [['1', 'Alice', null]];
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: rowsWithNull,
+      totalRows: 1
+    });
+
+    // Alice should be visible
+    await expect.element(page.getByText('Alice')).toBeInTheDocument();
+    // The null cell should render as empty (not "null" string)
+    await expect.element(page.getByText(/null/)).not.toBeInTheDocument();
+  });
+
+  it('should call fetchRows when scrolling to unloaded chunk', async () => {
+    const fetchRows = vi.fn().mockResolvedValue([
+      ['4', 'Diana', 'diana@example.com'],
+      ['5', 'Eve', 'eve@example.com']
+    ]);
+
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: defaultRows,
+      totalRows: 500,
+      fetchRows
+    });
+
+    // The effect triggers fetchRows for chunks visible within the viewport
+
+    // Wait for initial render and effect cycle
+    await vi.waitFor(
+      () => {
+        expect(fetchRows).toHaveBeenCalled();
+      },
+      { timeout: 2000 }
+    );
+  });
+
+  it('should render skeleton rows while chunk is loading', async () => {
+    // Create a fetchRows that never resolves to simulate loading state
+    const fetchRows = vi.fn().mockReturnValue(new Promise(() => {}));
+
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: defaultRows,
+      totalRows: 500,
+      fetchRows
+    });
+
+    // The loading skeleton is an animated pulse div inside the unloaded rows
+    // This is tricky to assert directly, so we verify fetchRows was called
+    // and no crash occurs
+    await vi.waitFor(
+      () => {
+        expect(fetchRows).toHaveBeenCalled();
+      },
+      { timeout: 2000 }
+    );
+  });
+
+  it('should handle a single large initial data page', async () => {
+    const manyRows = Array.from({ length: 250 }, (_, i) => [
+      String(i + 1),
+      `User-${i + 1}`,
+      `user${i + 1}@example.com`
+    ]);
+
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: manyRows,
+      totalRows: 1000
+    });
+
+    await expect.element(page.getByText('User-250')).toBeInTheDocument();
+  });
+
+  it('should display all headers including those with special characters', async () => {
+    const specialHeaders = ['first name', 'last.name', 'email-address'];
+    render(ParquetPreview, {
+      headers: specialHeaders,
+      initialRows: [['John', 'Doe', 'john@example.com']]
+    });
+
+    for (const header of specialHeaders) {
+      await expect.element(page.getByText(header)).toBeInTheDocument();
+    }
+  });
+
+  it('should handle empty rows array', async () => {
+    render(ParquetPreview, {
+      headers: defaultHeaders,
+      initialRows: [],
+      totalRows: 0
+    });
+
+    const table = page.getByRole('table', { name: 'Parquet preview' });
+    await expect.element(table).toBeInTheDocument();
+    // Headers still render even when no rows
+    for (const header of defaultHeaders) {
+      await expect.element(page.getByText(header)).toBeInTheDocument();
+    }
+  });
+});
diff --git a/src/lib/components/storage/modals/preview/TextPreview.svelte b/src/lib/components/storage/modals/preview/TextPreview.svelte
index 6c4bb607..d397dd87 100644
--- a/src/lib/components/storage/modals/preview/TextPreview.svelte
+++ b/src/lib/components/storage/modals/preview/TextPreview.svelte
@@ -22,6 +22,9 @@
     }
   });
 
+  const lines = $derived(formatted.split('\n'));
+  const lastLineNumber = $derived(lines.length);
+
   const language = $derived.by(() => {
     if (isJson) return 'json';
     if (contentType === 'text/css') return 'css';
@@ -34,7 +37,18 @@
   });
 </script>
 
-<pre
-  class="text-base-content/90 bg-base-200/50 min-h-full p-4 font-mono text-xs leading-relaxed whitespace-pre"
-  data-language={language}
-  aria-label="File content preview">{formatted}</pre>
+<div class="bg-base-200/50 flex min-h-full">
+  <div
+    class="text-base-content/30 p-4 pr-2 pb-4 text-right font-mono text-xs leading-relaxed select-none"
+    aria-hidden="true"
+  >
+    <!-- eslint-disable-next-line @typescript-eslint/no-unused-vars -->
+    {#each Array(lastLineNumber) as _n, i (i)}
+      {i + 1}<br />
+    {/each}
+  </div>
+  <pre
+    class="text-base-content/90 min-h-full flex-1 overflow-x-auto p-4 pl-0 font-mono text-xs leading-relaxed whitespace-pre"
+    data-language={language}
+    aria-label="File content preview">{formatted}</pre>
+</div>
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 66fb70f9..1c08201b 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -46,6 +46,42 @@ export const pdfPreviewBytes =
  *  and the size of the payload sent to the browser. */
 export const filePreviewRows = parseInt(env.STACKABLE_COCKPIT_FILE_PREVIEW_ROWS ?? '', 10) || 250;
 
+// ── Parquet preview restrictions ───────────────────────────────────────────
+
+export interface ParquetDisallowedCompression {
+  /** Upper-case compression codec name (e.g. `GZIP`, `ZSTD`, `SNAPPY`). */
+  codec: string;
+  /** When true, only block files using this codec if they lack an offset index. */
+  requireOffsetIndex: boolean;
+}
+
+function parseParquetDisallowed(value: string | undefined): ParquetDisallowedCompression[] {
+  if (!value) return [{ codec: 'GZIP', requireOffsetIndex: true }];
+  return value
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .map((entry) => {
+      if (entry.endsWith('-no_offset')) {
+        return {
+          codec: entry.slice(0, -'-no_offset'.length).toUpperCase(),
+          requireOffsetIndex: true
+        };
+      }
+      return { codec: entry.toUpperCase(), requireOffsetIndex: false };
+    });
+}
+
+/** Comma-separated list of compression types to disallow from parquet
+ *  data preview. Each entry is either a compression codec name (e.g. `gzip`,
+ *  `zstd`, `snappy`) or a codec suffixed with `-no_offset` (e.g.
+ *  `gzip-no_offset`) to only block when the file lacks an offset index.
+ *  Controlled by `STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES`.
+ *  Default: `gzip-no_offset`. */
+export const parquetDisallowedCompression = parseParquetDisallowed(
+  env.STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES ?? 'gzip-no_offset'
+);
+
 // ── Storage browser: Text editor ─────────────────────────────────────────────
 
 /** Maximum file size (in bytes) that may be saved via the inline text editor.
diff --git a/src/lib/server/storage/preview/parquet.test.ts b/src/lib/server/storage/preview/parquet.test.ts
new file mode 100644
index 00000000..69215b2f
--- /dev/null
+++ b/src/lib/server/storage/preview/parquet.test.ts
@@ -0,0 +1,767 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type pino from 'pino';
+import type { StorageProvider } from '$lib/server/storage/provider.js';
+
+const mockParquetMetadataAsync = vi.fn();
+const mockParquetRead = vi.fn();
+const mockParquetSchema = vi.fn();
+
+vi.mock('hyparquet', () => ({
+  parquetMetadataAsync: (...args: unknown[]) => mockParquetMetadataAsync(...args),
+  parquetRead: (...args: unknown[]) => mockParquetRead(...args),
+  parquetSchema: (...args: unknown[]) => mockParquetSchema(...args)
+}));
+
+vi.mock('hyparquet-compressors', () => ({
+  compressors: { UNCOMPRESSED: vi.fn() }
+}));
+
+vi.mock('$lib/server/logging', () => ({
+  logger: {
+    child: () => ({
+      info: vi.fn(),
+      debug: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+      trace: vi.fn(),
+      child: vi.fn()
+    })
+  }
+}));
+
+vi.mock('$lib/server/feature-flags', () => ({
+  parquetDisallowedCompression: [{ codec: 'GZIP', requireOffsetIndex: true }],
+  storageBrowserEnabled: true,
+  completionEnabled: true,
+  filePreviewRows: 250,
+  textPreviewBytes: 256 * 1024,
+  imagePreviewBytes: 5 * 1024 * 1024,
+  pdfPreviewBytes: 25 * 1024 * 1024
+}));
+
+import { getParquetPreview } from './parquet.js';
+
+const mockLog = {
+  info: vi.fn(),
+  debug: vi.fn(),
+  warn: vi.fn(),
+  error: vi.fn(),
+  trace: vi.fn(),
+  child: vi.fn(() => mockLog)
+} as unknown as pino.Logger;
+
+function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider {
+  return {
+    listContainers: vi.fn(),
+    listObjects: vi.fn(),
+    getObject: vi.fn(),
+    getObjectRange: vi.fn(),
+    getMetadata: vi.fn(),
+    exists: vi.fn(),
+    putObject: vi.fn(),
+    deleteObjects: vi.fn(),
+    listAllKeys: vi.fn(),
+    ...overrides
+  };
+}
+
+function makeStream(bytes?: Uint8Array): ReadableStream {
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(bytes ?? new Uint8Array([0, 0]));
+      controller.close();
+    }
+  });
+}
+
+/**
+ * Read an NDJSON streaming response into a plain object, simulating the client-side stream parser.
+ * Returns the first "h" (headers) message followed by accumulated column data and the final message.
+ */
+async function readNdjsonResponse(res: Response): Promise<{
+  headers: string[];
+  rows: unknown[][];
+  totalRows: number;
+  truncated: boolean;
+  error?: string;
+  schema?: Array<{ name: string; type: string }>;
+  metadata?: {
+    rowGroups: number;
+    compressionCodecs: string[];
+    hasOffsetIndex: boolean;
+    hasColumnIndex: boolean;
+    createdBy: string | null;
+    version: number;
+  };
+}> {
+  const reader = res.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+  let resultHeaders: string[] = [];
+  const rows: unknown[][] = [];
+  let resultTotalRows = 0;
+  let error: string | undefined;
+  let schema: Array<{ name: string; type: string }> | undefined;
+  let metadata:
+    | {
+        rowGroups: number;
+        compressionCodecs: string[];
+        hasOffsetIndex: boolean;
+        hasColumnIndex: boolean;
+        createdBy: string | null;
+        version: number;
+      }
+    | undefined;
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split('\n');
+    buffer = lines.pop() || '';
+
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      const msg = JSON.parse(line);
+
+      if (msg.t === 'h') {
+        resultHeaders = msg.h;
+        resultTotalRows = msg.tr;
+        schema = msg.s;
+        metadata = msg.m;
+      } else if (msg.t === 'c') {
+        const colIdx = resultHeaders.indexOf(msg.n);
+        if (colIdx < 0) continue;
+        const values = msg.v as unknown[];
+        while (rows.length < values.length) {
+          rows.push(new Array(resultHeaders.length).fill(undefined));
+        }
+        for (let i = 0; i < values.length; i++) {
+          if (!rows[i]) rows[i] = new Array(resultHeaders.length).fill(undefined);
+          rows[i][colIdx] = values[i];
+        }
+      } else if (msg.t === 'e') {
+        error = 'Server error';
+      }
+    }
+  }
+
+  return {
+    headers: resultHeaders,
+    rows,
+    totalRows: resultTotalRows,
+    truncated: res.headers.get('X-Preview-Truncated') === 'true',
+    error,
+    schema,
+    metadata
+  };
+}
+
+/**
+ * Invoke the onChunk / onComplete callbacks that parquetRead would normally call,
+ * to simulate streaming column data.
+ */
+function invokeParquetReadCallbacks(
+  args: unknown[],
+  columnDataMap: Record<string, unknown[]>
+): void {
+  const options = args[0] as {
+    onChunk?: (chunk: { columnName: string; columnData: unknown[] }) => void;
+    onComplete?: () => void;
+  };
+
+  // Simulate column data streaming: fire onChunk for each column.
+  // NOT passing rowStart/rowEnd so the trimming logic in parquet.ts uses
+  // undefined → NaN → false comparison → passes through full columnData.
+  for (const [colName, values] of Object.entries(columnDataMap)) {
+    if (options.onChunk) {
+      options.onChunk({ columnName: colName, columnData: values });
+    }
+  }
+
+  // Then fire onComplete
+  if (options.onComplete) {
+    options.onComplete();
+  }
+}
+
+/**
+ * Return a resolved promise mimicking parquetRead's async behaviour.
+ */
+function resolvedMockParquetRead(args: unknown[], columnDataMap: Record<string, unknown[]>) {
+  invokeParquetReadCallbacks(args, columnDataMap);
+  return Promise.resolve();
+}
+
+describe('getParquetPreview', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+
+    mockParquetSchema.mockReturnValue({
+      children: [
+        { element: { name: 'id', type: 'INT64' } },
+        {
+          element: {
+            name: 'name',
+            type: 'BYTE_ARRAY',
+            converted_type: 'UTF8',
+            logical_type: { type: 'STRING' }
+          }
+        },
+        { element: { name: 'active', type: 'BOOLEAN' } }
+      ]
+    });
+  });
+
+  afterEach(() => {
+    vi.resetModules();
+  });
+
+  it('returns empty response for zero-size parquet file', async () => {
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 0, contentType: 'application/x-parquet' })
+    });
+
+    const res = await getParquetPreview(provider, 'empty.parquet', 0, 250, mockLog);
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('X-Preview-Format')).toBe('parquet');
+    expect(res.headers.get('X-Preview-Renderable')).toBe('true');
+    expect(res.headers.get('X-Preview-Total-Rows')).toBe('0');
+    const body = await readNdjsonResponse(res);
+    expect(body.headers).toEqual([]);
+    expect(body.rows).toEqual([]);
+    expect(body.totalRows).toBe(0);
+    expect(body.schema).toEqual([]);
+    expect(body.metadata).toBeDefined();
+    expect(body.metadata?.rowGroups).toBe(0);
+    expect(mockParquetMetadataAsync).not.toHaveBeenCalled();
+  });
+
+  it('parses parquet metadata and returns headers and rows with schema and metadata', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({
+      num_rows: 2n,
+      row_groups: [],
+      created_by: 'test',
+      version: 1
+    });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, {
+        id: [1n, 2n],
+        name: ['Alice', 'Bob'],
+        active: [true, false]
+      })
+    );
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(provider, 'data.parquet', 0, 250, mockLog, undefined, true);
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('X-Preview-Format')).toBe('parquet');
+    expect(res.headers.get('X-Preview-Renderable')).toBe('true');
+    expect(res.headers.get('X-Preview-Total-Rows')).toBe('2');
+    expect(res.headers.get('X-Preview-Total-Size')).toBe('1024');
+    expect(res.headers.get('X-Preview-Offset')).toBe('0');
+
+    const body = await readNdjsonResponse(res);
+    expect(body.headers).toEqual(['id', 'name', 'active']);
+    expect(body.rows).toEqual([
+      ['1', 'Alice', true],
+      ['2', 'Bob', false]
+    ]);
+    expect(body.totalRows).toBe(2);
+
+    // Schema info
+    expect(body.schema).toBeDefined();
+    expect(body.schema).toHaveLength(3);
+    expect(body.schema![0]).toMatchObject({ name: 'id', type: 'int64' });
+    expect(body.schema![1]).toMatchObject({ name: 'name', type: 'string' });
+    expect(body.schema![2]).toMatchObject({ name: 'active', type: 'boolean' });
+
+    // Metadata
+    expect(body.metadata).toBeDefined();
+    expect(body.metadata?.rowGroups).toBe(0);
+    expect(body.metadata?.version).toBe(1);
+  });
+
+  it('handles pagination with offset and limit', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 1000n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) => {
+      const rows = Array.from({ length: 50 }, (_, i) => BigInt(500 + i));
+      const names = Array.from({ length: 50 }, (_, i) => `User-${500 + i}`);
+      return resolvedMockParquetRead(args, {
+        id: rows,
+        name: names
+      });
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 10240, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'large.parquet',
+      500,
+      50,
+      mockLog,
+      undefined,
+      true
+    );
+
+    expect(res.headers.get('X-Preview-Offset')).toBe('500');
+
+    const body = await readNdjsonResponse(res);
+    expect(body.rows).toHaveLength(50);
+    expect(body.totalRows).toBe(1000);
+    expect(body.rows[0][1]).toBe('User-500');
+
+    expect(mockParquetRead).toHaveBeenCalledWith(
+      expect.objectContaining({
+        rowStart: 500,
+        rowEnd: 550
+      })
+    );
+  });
+
+  it('returns empty rows when offset exceeds total rows', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 100n, row_groups: [] });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(provider, 'small.parquet', 200, 250, mockLog);
+
+    const body = await readNdjsonResponse(res);
+    expect(body.rows).toHaveLength(0);
+    expect(body.totalRows).toBe(100);
+    expect(body.truncated).toBe(false);
+  });
+
+  it('returns truncated false for final page', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 60n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) => {
+      const data = Array.from({ length: 10 }, (_, i) => BigInt(50 + i));
+      return resolvedMockParquetRead(args, { id: data });
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'final.parquet',
+      50,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+
+    expect(res.headers.get('X-Preview-Truncated')).toBe('false');
+    const body = await readNdjsonResponse(res);
+    expect(body.rows).toHaveLength(10);
+  });
+
+  it('serialises BigInt values as strings', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 1n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, { large_id: [9007199254740993n] })
+    );
+    mockParquetSchema.mockReturnValue({
+      children: [{ element: { name: 'large_id' } }]
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'bigint.parquet',
+      0,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+    const body = await readNdjsonResponse(res);
+    expect(body.rows[0][0]).toBe('9007199254740993');
+  });
+
+  it('serialises Date values as ISO strings', async () => {
+    const date = new Date('2025-06-15T10:30:00.000Z');
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 1n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, { created_at: [date] })
+    );
+    mockParquetSchema.mockReturnValue({
+      children: [{ element: { name: 'created_at' } }]
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'dates.parquet',
+      0,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+    const body = await readNdjsonResponse(res);
+    expect(body.rows[0][0]).toBe('2025-06-15T10:30:00.000Z');
+  });
+
+  it('serialises Uint8Array values as comma-separated numbers', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 1n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, { blob: [new Uint8Array([1, 2, 3, 255])] })
+    );
+    mockParquetSchema.mockReturnValue({
+      children: [{ element: { name: 'blob' } }]
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(provider, 'blob.parquet', 0, 250, mockLog, undefined, true);
+    const body = await readNdjsonResponse(res);
+    expect(body.rows[0][0]).toBe('1,2,3,255');
+  });
+
+  it('serialises nested objects as JSON strings', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 1n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, { nested: [{ foo: 'bar', num: 42 }] })
+    );
+    mockParquetSchema.mockReturnValue({
+      children: [{ element: { name: 'nested' } }]
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'nested.parquet',
+      0,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+    const body = await readNdjsonResponse(res);
+    expect(body.rows[0][0]).toBe(JSON.stringify({ foo: 'bar', num: 42 }));
+  });
+
+  it('handles null and undefined values', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 2n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, {
+        a: ['x', 'y'],
+        b: [null, null],
+        c: [undefined, 'z']
+      })
+    );
+    mockParquetSchema.mockReturnValue({
+      children: [{ element: { name: 'a' } }, { element: { name: 'b' } }, { element: { name: 'c' } }]
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'nulls.parquet',
+      0,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+    const body = await readNdjsonResponse(res);
+    expect(body.rows[0]).toEqual(['x', null, null]);
+    expect(body.rows[1]).toEqual(['y', null, 'z']);
+  });
+
+  it('handles boolean and number values directly', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 1n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, {
+        flag: [true],
+        score: [98.5],
+        count: [42]
+      })
+    );
+    mockParquetSchema.mockReturnValue({
+      children: [
+        { element: { name: 'flag' } },
+        { element: { name: 'score' } },
+        { element: { name: 'count' } }
+      ]
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'values.parquet',
+      0,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+    const body = await readNdjsonResponse(res);
+    expect(body.rows[0]).toEqual([true, 98.5, 42]);
+  });
+
+  it('returns empty rows and logs error when parquet parsing fails', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 1n, row_groups: [] });
+    mockParquetRead.mockRejectedValue(new Error('Corrupt parquet data'));
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'corrupt.parquet',
+      0,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+
+    expect(res.status).toBe(200);
+    const body = await readNdjsonResponse(res);
+    expect(body.error).toBe('Server error');
+  });
+
+  it('caches metadata in memory for subsequent calls', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({ num_rows: 5n, row_groups: [] });
+    mockParquetRead.mockImplementation((...args: unknown[]) => {
+      const data = Array.from({ length: 5 }, (_, i) => BigInt(i));
+      return resolvedMockParquetRead(args, { id: data });
+    });
+    mockParquetSchema.mockReturnValue({
+      children: [{ element: { name: 'id' } }]
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    // First call — parses metadata
+    await getParquetPreview(provider, 'cached.parquet', 0, 5, mockLog);
+    expect(mockParquetMetadataAsync).toHaveBeenCalledTimes(1);
+
+    // Second call — should hit cache, not call parquetMetadataAsync again
+    await getParquetPreview(provider, 'cached.parquet', 0, 5, mockLog);
+    expect(mockParquetMetadataAsync).toHaveBeenCalledTimes(1);
+  });
+
+  it('blocks preview for GZIP parquet without offset index', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({
+      num_rows: 5n,
+      row_groups: [
+        {
+          num_rows: 5n,
+          total_byte_size: 1000n,
+          columns: [
+            {
+              file_offset: 100n,
+              meta_data: {
+                type: 'BYTE_ARRAY',
+                codec: 'GZIP',
+                path_in_schema: ['name'],
+                num_values: 5n,
+                total_compressed_size: 200n,
+                total_uncompressed_size: 100n,
+                data_page_offset: 100n,
+                encodings: ['PLAIN']
+              },
+              offset_index_offset: null,
+              offset_index_length: null
+            }
+          ]
+        }
+      ],
+      created_by: 'test',
+      version: 1
+    });
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(provider, 'gzip-no-offset.parquet', 0, 250, mockLog);
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('X-Preview-Format')).toBe('parquet');
+    expect(res.headers.get('X-Preview-Renderable')).toBe('true');
+    expect(res.headers.get('X-Preview-Data-Blocked')).toBe('true');
+    expect(res.headers.get('X-Preview-Total-Size')).toBe('1024');
+    const body = await readNdjsonResponse(res);
+    expect(body.headers).toEqual(['id', 'name', 'active']);
+    expect(body.metadata).toBeDefined();
+    expect(body.metadata?.rowGroups).toBe(1);
+    expect(body.rows).toEqual([]);
+  });
+
+  it('allows preview for GZIP parquet when offset index is present', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({
+      num_rows: 2n,
+      row_groups: [
+        {
+          num_rows: 2n,
+          total_byte_size: 500n,
+          columns: [
+            {
+              file_offset: 100n,
+              meta_data: {
+                type: 'BYTE_ARRAY',
+                codec: 'GZIP',
+                path_in_schema: ['name'],
+                num_values: 2n,
+                total_compressed_size: 100n,
+                total_uncompressed_size: 50n,
+                data_page_offset: 100n,
+                encodings: ['PLAIN']
+              },
+              offset_index_offset: 500n,
+              offset_index_length: 50
+            }
+          ]
+        }
+      ],
+      created_by: 'test',
+      version: 1
+    });
+    mockParquetSchema.mockReturnValue({
+      children: [
+        {
+          element: {
+            name: 'name',
+            type: 'BYTE_ARRAY',
+            converted_type: 'UTF8',
+            logical_type: { type: 'STRING' }
+          }
+        }
+      ]
+    });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, { name: ['Alice', 'Bob'] })
+    );
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(
+      provider,
+      'gzip-with-offset.parquet',
+      0,
+      250,
+      mockLog,
+      undefined,
+      true
+    );
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('X-Preview-Format')).toBe('parquet');
+    expect(res.headers.get('X-Preview-Renderable')).toBe('true');
+    const body = await readNdjsonResponse(res);
+    expect(body.headers).toEqual(['name']);
+    expect(body.rows).toEqual([['Alice'], ['Bob']]);
+  });
+
+  it('allows preview for non-GZIP parquet without offset index', async () => {
+    mockParquetMetadataAsync.mockResolvedValue({
+      num_rows: 2n,
+      row_groups: [
+        {
+          num_rows: 2n,
+          total_byte_size: 500n,
+          columns: [
+            {
+              file_offset: 100n,
+              meta_data: {
+                type: 'BYTE_ARRAY',
+                codec: 'SNAPPY',
+                path_in_schema: ['name'],
+                num_values: 2n,
+                total_compressed_size: 100n,
+                total_uncompressed_size: 50n,
+                data_page_offset: 100n,
+                encodings: ['PLAIN']
+              },
+              offset_index_offset: null,
+              offset_index_length: null
+            }
+          ]
+        }
+      ],
+      created_by: 'test',
+      version: 1
+    });
+    mockParquetSchema.mockReturnValue({
+      children: [
+        {
+          element: {
+            name: 'name',
+            type: 'BYTE_ARRAY',
+            converted_type: 'UTF8',
+            logical_type: { type: 'STRING' }
+          }
+        }
+      ]
+    });
+    mockParquetRead.mockImplementation((...args: unknown[]) =>
+      resolvedMockParquetRead(args, { name: ['Alice'] })
+    );
+
+    const provider = makeProvider({
+      getMetadata: vi.fn().mockResolvedValue({ size: 1024, contentType: 'application/x-parquet' }),
+      getObjectRange: vi.fn(() => Promise.resolve(makeStream()))
+    });
+
+    const res = await getParquetPreview(provider, 'snappy-no-offset.parquet', 0, 250, mockLog);
+
+    expect(res.status).toBe(200);
+    expect(res.headers.get('X-Preview-Format')).toBe('parquet');
+    expect(res.headers.get('X-Preview-Renderable')).toBe('true');
+    const body = await readNdjsonResponse(res);
+    expect(body.headers).toEqual(['name']);
+  });
+});
diff --git a/src/lib/server/storage/preview/parquet.ts b/src/lib/server/storage/preview/parquet.ts
index 993b32dc..a6cc4328 100644
--- a/src/lib/server/storage/preview/parquet.ts
+++ b/src/lib/server/storage/preview/parquet.ts
@@ -1,30 +1,416 @@
 import { gunzipSync } from 'node:zlib';
-import { parquetMetadataAsync, parquetReadObjects, parquetSchema } from 'hyparquet';
+import {
+  parquetMetadataAsync,
+  parquetRead,
+  parquetSchema,
+  type FileMetaData,
+  type CompressionCodec,
+  type SchemaTree
+} from 'hyparquet';
 import { compressors } from 'hyparquet-compressors';
 import type pino from 'pino';
+import { logger } from '$lib/server/logging';
 import type { StorageProvider } from '$lib/server/storage/provider.js';
-import { filePreviewRows } from '$lib/server/feature-flags.js';
+import {
+  parquetDisallowedCompression,
+  type ParquetDisallowedCompression
+} from '$lib/server/feature-flags';
+
+const fallbackLog = logger.child({ module: 'parquet-preview' });
 
-/**
- * Override the pure-JS GZIP decompressor from hyparquet-compressors with
- * Node's native zlib binding — orders of magnitude faster for large payloads.
- */
 const nodeCompressors = {
   ...compressors,
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars -- signature must match hyparquet's expectation of (input, outputLength)
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
   GZIP: (input: Uint8Array, _outputLength: number): Uint8Array => new Uint8Array(gunzipSync(input))
 };
 
-/** Read a ReadableStream into an ArrayBuffer. */
+// --- IN-MEMORY CACHE FOR METADATA ---
+const metadataCache = new Map<string, { meta: FileMetaData; lastAccessed: number }>();
+
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, entry] of metadataCache.entries()) {
+    if (now - entry.lastAccessed > 5 * 60 * 1000) {
+      metadataCache.delete(key);
+    }
+  }
+}, 60 * 1000).unref();
+// -------------------------------------
+
+/**
+ * Check whether a parquet file's row groups contain any column matching a
+ * disallowed compression rule.
+ */
+function findBlockingRule(
+  meta: FileMetaData,
+  disallowed: ParquetDisallowedCompression[]
+): ParquetDisallowedCompression | undefined {
+  return disallowed.find((rule) =>
+    meta.row_groups.some((group) =>
+      group.columns.some((col) => {
+        if (col.meta_data?.codec !== rule.codec) return false;
+        if (!rule.requireOffsetIndex) return true;
+        const hasOffsetIndex =
+          col.offset_index_offset !== undefined &&
+          col.offset_index_offset !== null &&
+          col.offset_index_length !== undefined &&
+          col.offset_index_length > 0;
+        return !hasOffsetIndex;
+      })
+    )
+  );
+}
+
+function stringifyStructuredParquetValue(value: object): string {
+  return JSON.stringify(value, (_key, nestedValue: unknown) => {
+    if (typeof nestedValue === 'bigint') return nestedValue.toString();
+    if (nestedValue instanceof Date) return nestedValue.toISOString();
+    if (nestedValue instanceof Uint8Array) return Array.from(nestedValue);
+    return nestedValue;
+  });
+}
+
+/**
+ * Statistics aggregated across all row groups for a single column.
+ */
+interface ColumnStats {
+  nullCount: number | null;
+  distinctCount: number | null;
+  min: string | null;
+  max: string | null;
+}
+
+/**
+ * Per-column detail assembled from all row groups.
+ */
+interface ColumnDetail {
+  name: string;
+  type: string;
+  codec: string;
+  compressedSize: number;
+  uncompressedSize: number;
+  stats: ColumnStats;
+}
+
+/** Serialize a min/max stat value to a string for client transmission. */
+function statToString(value: unknown): string | null {
+  if (value === null || value === undefined) return null;
+  if (typeof value === 'bigint') return value.toString();
+  if (value instanceof Date) return value.toISOString();
+  if (value instanceof Uint8Array)
+    return `<${Array.from(value.slice(0, 8)).join(',')}${value.length > 8 ? '...' : ''}>`;
+  if (typeof value === 'string') return value.length > 100 ? value.slice(0, 100) + '…' : value;
+  if (typeof value === 'number') return String(value);
+  if (typeof value === 'boolean') return String(value);
+  return String(value);
+}
+
+/**
+ * Collect per-column details (sizes, codec, stats) from all row groups.
+ */
+function collectColumnDetails(meta: FileMetaData, schemaTree: SchemaTree): ColumnDetail[] {
+  return schemaTree.children.map((entry) => {
+    const colName = entry.element.name;
+    let compressedSize = 0;
+    let uncompressedSize = 0;
+    const codecs = new Set<string>();
+    let aggNullCount: number | null = null;
+    let aggDistinctCount: number | null = null;
+    let aggMin: string | null = null;
+    let aggMax: string | null = null;
+    let hasAnyStats = false;
+
+    for (const group of meta.row_groups) {
+      for (const col of group.columns) {
+        const md = col.meta_data;
+        if (!md) continue;
+        if (
+          md.path_in_schema.length === 0 ||
+          md.path_in_schema[md.path_in_schema.length - 1] !== colName
+        )
+          continue;
+
+        codecs.add(md.codec);
+        compressedSize += Number(md.total_compressed_size);
+        uncompressedSize += Number(md.total_uncompressed_size);
+
+        const st = md.statistics;
+        if (st) {
+          hasAnyStats = true;
+          const nullCount = st.null_count !== undefined ? Number(st.null_count) : null;
+          const distinctCount = st.distinct_count !== undefined ? Number(st.distinct_count) : null;
+
+          if (nullCount !== null) {
+            aggNullCount = (aggNullCount ?? 0) + nullCount;
+          }
+          if (distinctCount !== null) {
+            aggDistinctCount = (aggDistinctCount ?? 0) + distinctCount;
+          }
+
+          const minVal = statToString(st.min ?? st.min_value ?? null);
+          const maxVal = statToString(st.max ?? st.max_value ?? null);
+
+          if (minVal !== null) {
+            if (aggMin === null || minVal < aggMin) aggMin = minVal;
+          }
+          if (maxVal !== null) {
+            if (aggMax === null || maxVal > aggMax) aggMax = maxVal;
+          }
+        }
+      }
+    }
+
+    const codec = codecs.size === 1 ? codecs.values().next().value! : 'MIXED';
+
+    return {
+      name: colName,
+      type: describeColumnType(entry.element),
+      codec,
+      compressedSize,
+      uncompressedSize,
+      stats: {
+        nullCount: hasAnyStats ? aggNullCount : null,
+        distinctCount: hasAnyStats ? aggDistinctCount : null,
+        min: hasAnyStats ? aggMin : null,
+        max: hasAnyStats ? aggMax : null
+      }
+    };
+  });
+}
+
+/**
+ * Try to decode the embedded Arrow schema from Parquet key_value_metadata.
+ * Returns a human-readable description (field names & types), or null on failure.
+ *
+ * The ARROW:schema value is a base64-encoded Arrow IPC serialised Schema
+ * (Flatbuffers format inside an IPC message framing).
+ */
+function extractArrowSchema(meta: FileMetaData): string | null {
+  if (!meta.key_value_metadata) return null;
+  const kv = meta.key_value_metadata.find((e) => e.key === 'ARROW:schema');
+  if (!kv?.value) return null;
+
+  try {
+    const bytes = Uint8Array.from(atob(kv.value), (c) => c.charCodeAt(0));
+    if (bytes.length < 8) return null;
+
+    const dv = (pos: number) => new DataView(bytes.buffer, bytes.byteOffset + pos);
+
+    // IPC framing: optional 0xFFFFFFFF continuation indicator, then 4-byte metadata length
+    let pos = 0;
+    let metaLen: number;
+    const first = dv(0).getInt32(0, true);
+    if (first === -1) {
+      pos = 8;
+      metaLen = dv(4).getInt32(0, true);
+    } else {
+      metaLen = first;
+      pos = 4;
+    }
+    if (pos + metaLen > bytes.length) return null;
+
+    // Flatbuffers helpers operating on the metadata slice
+    const fb = {
+      buf: bytes.slice(pos, pos + metaLen),
+      i32(at: number) {
+        return new DataView(this.buf.buffer, this.buf.byteOffset + at).getInt32(0, true);
+      },
+      i16(at: number) {
+        return new DataView(this.buf.buffer, this.buf.byteOffset + at).getInt16(0, true);
+      },
+      i8(at: number) {
+        return new DataView(this.buf.buffer, this.buf.byteOffset + at).getInt8(0);
+      }
+    };
+
+    // Parse a Flatbuffers table: return field offsets (0 = absent)
+    function tableFields(tab: number): number[] {
+      const vtOff = tab - fb.i32(tab); // vtable location
+      const n = fb.i16(vtOff + 2); // number of fields
+      const offs: number[] = [];
+      for (let i = 0; i < n; i++) offs.push(fb.i16(vtOff + 4 + i * 2));
+      return offs;
+    }
+
+    // Read a string at a uoffset_t pointer
+    function fbStr(at: number): string {
+      const strOff = fb.i32(at); // uoffset_t relative to `at`
+      const start = at + strOff;
+      const len = fb.i32(start);
+      return new TextDecoder().decode(fb.buf.slice(start + 4, start + 4 + len));
+    }
+
+    // Read a uoffset_t and return the absolute offset
+    function fbOff(at: number): number {
+      return at + fb.i32(at);
+    }
+
+    // Read a vector (returns element start offset and count)
+    function fbVec(at: number): { elemStart: number; count: number } | null {
+      const vecOff = fb.i32(at);
+      const start = at + vecOff;
+      const count = fb.i32(start);
+      return { elemStart: start + 4, count };
+    }
+
+    // Message table starts at 0 within the metadata block
+    const msgFields = tableFields(0);
+    if (msgFields.length < 3) return null;
+
+    // Field 1 (header_type, ubyte) — tab=0 so fieldPos = msgFields[1]
+    if (msgFields[1] === 0) return null;
+    const headerType = fb.i8(msgFields[1]);
+    if (headerType !== 1) return null; // 1 = Schema
+
+    // Field 2 (header, table offset) — tab=0 so fieldPos = msgFields[2]
+    if (msgFields[2] === 0) return null;
+    const schemaTab = fbOff(msgFields[2]);
+
+    // Schema table: field 1 = fields vector
+    const schemaFields = tableFields(schemaTab);
+    if (schemaFields.length < 2 || schemaFields[1] === 0) return null;
+    // fieldPos for fields vector: schemaTab + schemaFields[1]
+    const vec = fbVec(schemaTab + schemaFields[1]);
+    if (!vec || vec.count === 0) return null;
+
+    const fieldEntries: string[] = [];
+    for (let i = 0; i < vec.count; i++) {
+      const fieldTabOff = fb.i32(vec.elemStart + i * 4);
+      const fieldTabAbs = vec.elemStart + i * 4 + fieldTabOff;
+      const ff = tableFields(fieldTabAbs);
+      if (ff.length > 0 && ff[0] !== 0) {
+        const name = fbStr(fieldTabAbs + ff[0]);
+        fieldEntries.push(name);
+      }
+    }
+
+    if (fieldEntries.length === 0) return null;
+    return fieldEntries.join(', ');
+  } catch {
+    return null;
+  }
+}
+
+/** Extract a human-readable type string from a schema element. */
+function describeColumnType(element: SchemaTree['element']): string {
+  if (element.logical_type) {
+    const lt = element.logical_type;
+    if (lt.type === 'STRING') return 'string';
+    if (lt.type === 'INTEGER') return `int(${lt.bitWidth})`;
+    if (lt.type === 'DECIMAL') return `decimal(${lt.precision},${lt.scale})`;
+    if (lt.type === 'DATE') return 'date';
+    if (lt.type === 'TIME') return 'time';
+    if (lt.type === 'TIMESTAMP') return 'timestamp';
+    if (lt.type === 'ENUM') return 'enum';
+    if (lt.type === 'UUID') return 'uuid';
+    if (lt.type === 'JSON') return 'json';
+    if (lt.type === 'BSON') return 'bson';
+    if (lt.type === 'MAP') return 'map';
+    if (lt.type === 'LIST') return 'list';
+    if (lt.type === 'FLOAT16') return 'float16';
+    if (lt.type === 'VARIANT') return 'variant';
+    if (lt.type === 'NULL') return 'null';
+    if (lt.type === 'INTERVAL') return 'interval';
+    if (lt.type === 'GEOMETRY') return 'geometry';
+    if (lt.type === 'GEOGRAPHY') return 'geography';
+  }
+  if (element.converted_type) {
+    if (element.converted_type === 'UTF8') return 'string';
+    if (element.converted_type === 'MAP') return 'map';
+    if (element.converted_type === 'LIST') return 'list';
+    if (element.converted_type === 'ENUM') return 'enum';
+    if (element.converted_type === 'DECIMAL')
+      return `decimal(${element.precision},${element.scale})`;
+    if (element.converted_type === 'DATE') return 'date';
+    if (element.converted_type === 'TIME_MILLIS') return 'time_ms';
+    if (element.converted_type === 'TIME_MICROS') return 'time_us';
+    if (element.converted_type === 'TIMESTAMP_MILLIS') return 'timestamp_ms';
+    if (element.converted_type === 'TIMESTAMP_MICROS') return 'timestamp_us';
+    if (element.converted_type === 'UINT_8') return 'uint8';
+    if (element.converted_type === 'UINT_16') return 'uint16';
+    if (element.converted_type === 'UINT_32') return 'uint32';
+    if (element.converted_type === 'UINT_64') return 'uint64';
+    if (element.converted_type === 'INT_8') return 'int8';
+    if (element.converted_type === 'INT_16') return 'int16';
+    if (element.converted_type === 'INT_32') return 'int32';
+    if (element.converted_type === 'INT_64') return 'int64';
+    if (element.converted_type === 'JSON') return 'json';
+    if (element.converted_type === 'BSON') return 'bson';
+    if (element.converted_type === 'INTERVAL') return 'interval';
+  }
+  if (element.type === 'BOOLEAN') return 'boolean';
+  if (element.type === 'INT32') return 'int32';
+  if (element.type === 'INT64') return 'int64';
+  if (element.type === 'INT96') return 'int96';
+  if (element.type === 'FLOAT') return 'float';
+  if (element.type === 'DOUBLE') return 'double';
+  if (element.type === 'BYTE_ARRAY') return 'binary';
+  if (element.type === 'FIXED_LEN_BYTE_ARRAY') return 'fixed_binary';
+  return 'unknown';
+}
+
+/** Collect the unique compression codecs used across all row groups. */
+function collectCompressionCodecs(meta: FileMetaData): CompressionCodec[] {
+  const codecs = new Set<CompressionCodec>();
+  for (const group of meta.row_groups) {
+    for (const col of group.columns) {
+      if (col.meta_data?.codec) {
+        codecs.add(col.meta_data.codec);
+      }
+    }
+  }
+  return Array.from(codecs);
+}
+
+/** Check whether the file has an offset index on at least one column. */
+function hasOffsetIndex(meta: FileMetaData): boolean {
+  return meta.row_groups.some((group) =>
+    group.columns.some(
+      (col) =>
+        col.offset_index_offset !== undefined &&
+        col.offset_index_offset !== null &&
+        col.offset_index_length !== undefined &&
+        col.offset_index_length > 0
+    )
+  );
+}
+
+/** Check whether the file has a column index on at least one column. */
+function hasColumnIndex(meta: FileMetaData): boolean {
+  return meta.row_groups.some((group) =>
+    group.columns.some(
+      (col) =>
+        col.column_index_offset !== undefined &&
+        col.column_index_offset !== null &&
+        col.column_index_length !== undefined &&
+        col.column_index_length > 0
+    )
+  );
+}
+
+function toSerializableParquetCell(value: unknown): string | number | boolean | null {
+  if (value === null || value === undefined) return null;
+  if (typeof value === 'bigint') return value.toString();
+  if (value instanceof Date) return value.toISOString();
+  if (value instanceof Uint8Array) return Array.from(value).join(',');
+  if (Array.isArray(value) || typeof value === 'object')
+    return stringifyStructuredParquetValue(value as object);
+  if (typeof value === 'number' || typeof value === 'boolean' || typeof value === 'string')
+    return value;
+  return String(value);
+}
+
 async function streamToArrayBuffer(stream: ReadableStream): Promise<ArrayBuffer> {
   const chunks: Uint8Array[] = [];
   const reader = stream.getReader();
+
   while (true) {
     const { done, value } = await reader.read();
     if (done) break;
     chunks.push(value as Uint8Array);
   }
-  const totalLength = chunks.reduce((acc, c) => acc + c.length, 0);
+
+  const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
   const result = new Uint8Array(totalLength);
   let offset = 0;
   for (const chunk of chunks) {
@@ -34,160 +420,304 @@ async function streamToArrayBuffer(stream: ReadableStream): Promise<ArrayBuffer>
   return result.buffer;
 }
 
-/** Serialise a parquet cell value to a string suitable for CSV embedding. */
-function formatParquetValue(value: unknown): string {
-  if (value === null || value === undefined) return '';
-  if (typeof value === 'bigint') return value.toString();
-  if (value instanceof Date) return value.toISOString();
-  if (typeof value === 'object') return JSON.stringify(value);
-  return String(value);
-}
-
-/** Escape a single CSV field (RFC 4180). */
-function escapeCSVField(field: string): string {
-  if (field.includes(',') || field.includes('"') || field.includes('\n') || field.includes('\r')) {
-    return '"' + field.replace(/"/g, '""') + '"';
-  }
-  return field;
-}
-
-export async function parquetPreview(
+export async function getParquetPreview(
   provider: StorageProvider,
   key: string,
-  totalSize: number,
-  userId: string,
-  log: pino.Logger
+  offset = 0,
+  limit = 250,
+  requestLog: pino.Logger = fallbackLog,
+  totalSize?: number,
+  includeData = false
 ): Promise<Response> {
-  // ── Step 1: footer (serial, ≤ 2 range requests) ────────────────────────
-  // hyparquet fetches the last 512 KB first; if the footer is larger it
-  // makes a second request. Serial avoids ETIMEDOUT.
-  let footerQueue: Promise<void> = Promise.resolve();
-  const footerBuffer = {
-    byteLength: totalSize,
-    slice: (start: number, end?: number): Promise<ArrayBuffer> => {
-      const rangeEnd = end !== undefined ? end - 1 : totalSize - 1;
-      const req = footerQueue.then(async () => {
-        const stream = await provider.getObjectRange(key, start, rangeEnd);
-        return streamToArrayBuffer(stream as ReadableStream);
-      });
-      footerQueue = req.then(
-        () => {},
-        () => {}
-      );
-      return req;
-    }
-  };
+  const log = requestLog.child({ module: 'parquet-preview' });
+  const byteLength = totalSize ?? (await provider.getMetadata(key)).size;
+
+  if (byteLength === 0) {
+    const meta = {
+      rowGroups: 0,
+      compressionCodecs: [] as string[],
+      compressionUniform: true,
+      hasOffsetIndex: false,
+      hasColumnIndex: false,
+      createdBy: null as string | null,
+      version: 0,
+      arrowSchema: null as string | null
+    };
+    return new Response(JSON.stringify({ t: 'h', h: [], tr: 0, s: [], m: meta }) + '\n', {
+      headers: {
+        'Content-Type': 'application/x-ndjson',
+        'X-Preview-Format': 'parquet',
+        'X-Preview-Renderable': 'true',
+        'X-Preview-Data-Blocked': 'false',
+        'X-Preview-Total-Size': '0',
+        'X-Preview-Total-Rows': '0',
+        'X-Preview-Offset': String(offset),
+        'Cache-Control': 'no-store'
+      }
+    });
+  }
+
+  let parquetMeta: FileMetaData;
+
+  const cached = metadataCache.get(key);
+  if (cached) {
+    cached.lastAccessed = Date.now();
+    parquetMeta = cached.meta;
+    log.debug({ key }, 'Used in-memory cached Parquet metadata');
+  } else {
+    let footerQueue: Promise<void> = Promise.resolve();
+    const footerBuffer = {
+      byteLength,
+      slice: (start: number, end?: number): Promise<ArrayBuffer> => {
+        const rangeEnd = end !== undefined ? end - 1 : byteLength - 1;
+        const request = footerQueue.then(async () => {
+          const stream = await provider.getObjectRange(key, start, rangeEnd);
+          return streamToArrayBuffer(stream as ReadableStream);
+        });
+        footerQueue = request.then(
+          () => {},
+          () => {}
+        );
+        return request;
+      }
+    };
+
+    parquetMeta = await parquetMetadataAsync(footerBuffer);
+
+    metadataCache.set(key, {
+      meta: parquetMeta,
+      lastAccessed: Date.now()
+    });
+  }
 
-  const parquetMeta = await parquetMetadataAsync(footerBuffer);
   const totalRows = Number(parquetMeta.num_rows);
-  const previewRows = Math.min(totalRows, filePreviewRows);
-  const truncated = previewRows < totalRows;
-  const schema = parquetSchema(parquetMeta);
-  const columnNames = schema.children.map((e) => e.element.name);
-
-  // ── Step 2: pre-fetch OffsetIndex in ONE merged range request ───────────
-  // OffsetIndex entries for all columns are stored contiguously near the
-  // end of the file (written just before the file metadata). Fetching them
-  // together eliminates one S3 round-trip per column (~30 saved requests).
-  let oiMin = Infinity;
-  let oiMax = 0;
-  let rowsScanned = 0;
-  for (const rg of parquetMeta.row_groups) {
-    if (rowsScanned >= previewRows) break;
-    rowsScanned += Number(rg.num_rows);
-    for (const col of rg.columns) {
-      if (col.offset_index_offset && col.offset_index_length) {
-        const s = Number(col.offset_index_offset);
-        const e = s + col.offset_index_length;
-        if (s < oiMin) oiMin = s;
-        if (e > oiMax) oiMax = e;
+  const schemaTree = parquetSchema(parquetMeta);
+  const headers = schemaTree.children.map((entry) => entry.element.name);
+
+  const columnDetails = collectColumnDetails(parquetMeta, schemaTree);
+  const arrowSchema = extractArrowSchema(parquetMeta);
+  const metadata = {
+    rowGroups: parquetMeta.row_groups.length,
+    compressionCodecs: collectCompressionCodecs(parquetMeta),
+    compressionUniform: new Set(columnDetails.map((c) => c.codec)).size <= 1,
+    hasOffsetIndex: hasOffsetIndex(parquetMeta),
+    hasColumnIndex: hasColumnIndex(parquetMeta),
+    createdBy: parquetMeta.created_by ?? null,
+    version: parquetMeta.version,
+    arrowSchema
+  };
+
+  // ── Check if compression rules disallow data preview ─────────
+  const blockingRule = findBlockingRule(parquetMeta, parquetDisallowedCompression);
+
+  // Always return header message with schema + metadata (even when blocked).
+  // When blocked, set data-blocked header and never stream column data.
+  if (blockingRule || !includeData) {
+    log.warn(
+      { key, codec: blockingRule?.codec, require_offset_index: blockingRule?.requireOffsetIndex },
+      blockingRule ? 'Blocked parquet preview by compression rule' : 'Metadata-only parquet request'
+    );
+    const extraHeaders: Record<string, string> = {};
+    if (blockingRule) extraHeaders['X-Preview-Data-Blocked'] = 'true';
+    return new Response(
+      JSON.stringify({ t: 'h', h: headers, tr: totalRows, s: columnDetails, m: metadata }) + '\n',
+      {
+        headers: {
+          'Content-Type': 'application/x-ndjson',
+          'X-Preview-Format': 'parquet',
+          'X-Preview-Renderable': 'true',
+          ...extraHeaders,
+          'X-Preview-Total-Size': String(byteLength),
+          'X-Preview-Total-Rows': String(totalRows),
+          'X-Preview-Offset': String(offset),
+          'Cache-Control': 'no-store'
+        }
+      }
+    );
+  }
+
+  const actualLimit = Math.min(limit, Math.max(0, totalRows - offset));
+
+  if (actualLimit <= 0) {
+    return new Response(
+      JSON.stringify({ t: 'h', h: headers, tr: totalRows, s: columnDetails, m: metadata }) + '\n',
+      {
+        headers: {
+          'Content-Type': 'application/x-ndjson',
+          'X-Preview-Format': 'parquet',
+          'X-Preview-Renderable': 'true',
+          'X-Preview-Truncated': 'false',
+          'X-Preview-Total-Size': String(byteLength),
+          'X-Preview-Total-Rows': String(totalRows),
+          'X-Preview-Offset': String(offset),
+          'Cache-Control': 'no-store'
+        }
+      }
+    );
+  }
+
+  const requestedEnd = offset + actualLimit;
+
+  // Pre-fetch up to MAX_PREVIEW_FETCH_BYTES from the start of the file.
+  // For the common case (data of the first row group fits within the limit),
+  // this means hyparquet reads entirely from memory — only 2 HTTP requests
+  // total (footer + this).  When column data extends beyond the limit,
+  // individual slice() calls fall through to per-request HTTP fetches
+  // (bounded by useOffsetIndex to only pages needed for the requested rows).
+  const MAX_PREVIEW_FETCH_BYTES = 5 * 1024 * 1024; // magic number: amount of data in column to load
+  const previewLimit = Math.min(MAX_PREVIEW_FETCH_BYTES, byteLength);
+
+  /** In-memory buffer plus any extra ranges fetched for out-of-preview data. */
+  const bufferCache: Array<{ start: number; buffer: ArrayBuffer }> = [];
+
+  if (previewLimit > 0) {
+    const stream = await provider.getObjectRange(key, 0, previewLimit - 1);
+    bufferCache.push({ start: 0, buffer: await streamToArrayBuffer(stream as ReadableStream) });
+  }
+
+  // Also fetch exact byte spans for any row groups whose data starts beyond
+  // the preview limit, so we don't degrade to per-slice HTTP for those.
+  const extraFetches: Array<{ start: number; end: number }> = [];
+  let groupRowStart = 0;
+  for (const rowGroup of parquetMeta.row_groups) {
+    const groupRows = Number(rowGroup.num_rows);
+    const groupRowEnd = groupRowStart + groupRows;
+
+    if (groupRowEnd > offset && groupRowStart < requestedEnd) {
+      let minByte = Infinity;
+      let maxByte = -Infinity;
+
+      for (const column of rowGroup.columns) {
+        const meta = column.meta_data;
+        if (!meta) continue;
+
+        const colStart = Number(meta.dictionary_page_offset ?? meta.data_page_offset);
+        const colEnd = colStart + Number(meta.total_compressed_size);
+        if (colStart < minByte) minByte = colStart;
+        if (colEnd > maxByte) maxByte = colEnd;
+
+        if (column.offset_index_offset != null && column.offset_index_length != null) {
+          const offEnd = Number(column.offset_index_offset) + Number(column.offset_index_length);
+          if (offEnd > maxByte) maxByte = offEnd;
+        }
+        if (column.column_index_offset != null && column.column_index_length != null) {
+          const ciEnd = Number(column.column_index_offset) + Number(column.column_index_length);
+          if (ciEnd > maxByte) maxByte = ciEnd;
+        }
+      }
+
+      if (isFinite(minByte) && maxByte > minByte && minByte >= previewLimit) {
+        extraFetches.push({ start: minByte, end: maxByte });
       }
     }
+
+    groupRowStart = groupRowEnd;
   }
-  let oiCache: { start: number; buf: ArrayBuffer } | null = null;
-  if (isFinite(oiMin)) {
-    const oiStream = await provider.getObjectRange(key, oiMin, oiMax - 1);
-    oiCache = { start: oiMin, buf: await streamToArrayBuffer(oiStream as ReadableStream) };
-    log.debug({ user_id: userId, key, oi_bytes: oiMax - oiMin }, 'parquet OffsetIndex pre-fetched');
+
+  if (extraFetches.length > 0) {
+    const results = await Promise.all(
+      extraFetches.map((r) =>
+        provider
+          .getObjectRange(key, r.start, r.end - 1)
+          .then((s) => streamToArrayBuffer(s as ReadableStream))
+          .then((buf) => ({ start: r.start, buffer: buf }))
+      )
+    );
+    bufferCache.push(...results);
   }
 
-  // ── Step 3: concurrency-limited buffer for data page reads ──────────────
-  // prefetchAsyncBuffer inside hyparquet calls file.slice() for every fetch
-  // in one synchronous pass. Limit to 4 concurrent S3 connections to stay
-  // well below the threshold that triggers ETIMEDOUT on the S3 endpoint,
-  // while being 4× faster than serial (30 pages / 4 = 8 batches × ~1.5s).
-  const CONCURRENCY = 4;
-  let running = 0;
-  const waiters: Array<() => void> = [];
-  const acquire = (): Promise<void> =>
-    running < CONCURRENCY
-      ? (running++, Promise.resolve())
-      : new Promise((resolve) => waiters.push(resolve));
-  const release = () => {
-    const next = waiters.shift();
-    if (next) next();
-    else running--;
+  const asyncFile = {
+    byteLength,
+    slice: async (_start: number, _end?: number): Promise<ArrayBuffer> => {
+      const end = _end ?? byteLength;
+      for (const { start, buffer } of bufferCache) {
+        const bufEnd = start + buffer.byteLength;
+        if (_start >= start && end <= bufEnd) {
+          return buffer.slice(_start - start, end - start);
+        }
+      }
+      const stream = await provider.getObjectRange(key, _start, end - 1);
+      return streamToArrayBuffer(stream as ReadableStream);
+    }
   };
 
-  const asyncBuffer = {
-    byteLength: totalSize,
-    slice: (start: number, end?: number): Promise<ArrayBuffer> => {
-      const rangeEnd = end ?? totalSize;
-      // Serve OffsetIndex reads from the pre-fetched in-memory cache.
-      if (oiCache && start >= oiCache.start && rangeEnd <= oiCache.start + oiCache.buf.byteLength) {
-        return Promise.resolve(oiCache.buf.slice(start - oiCache.start, rangeEnd - oiCache.start));
-      }
-      // All other reads (data pages): rate-limited S3 range request.
-      return acquire().then(async () => {
+  const encoder = new TextEncoder();
+
+  const stream = new ReadableStream({
+    start(controller) {
+      // Send headers immediately with schema and metadata
+      controller.enqueue(
+        encoder.encode(
+          JSON.stringify({ t: 'h', h: headers, tr: totalRows, s: columnDetails, m: metadata }) +
+            '\n'
+        )
+      );
+
+      // Use parquetRead with onChunk to stream columns as they load.
+      // Trim columnData to the requested [offset, requestedEnd) range because
+      // hyparquet's onChunk fires with page-granularity data that can include
+      // rows outside the requested range (intra-page trimming only happens in
+      // asyncGroupToRows called by onComplete, not in onChunk).
+      const readPromise = parquetRead({
+        file: asyncFile,
+        metadata: parquetMeta,
+        rowStart: offset,
+        rowEnd: requestedEnd,
+        useOffsetIndex: true,
+        compressors: nodeCompressors,
+        rowFormat: 'object',
+        onChunk: ({ columnName, columnData, rowStart: chunkStart, rowEnd: chunkEnd }) => {
+          try {
+            const trimStart = Math.max(0, offset - chunkStart);
+            const trimEnd = Math.max(0, chunkEnd - requestedEnd);
+            const sliced =
+              trimStart > 0 || trimEnd > 0
+                ? columnData.slice(trimStart, columnData.length - trimEnd)
+                : columnData;
+            const values = Array.from(sliced, (v: unknown) => toSerializableParquetCell(v));
+            controller.enqueue(
+              encoder.encode(JSON.stringify({ t: 'c', n: columnName, v: values }) + '\n')
+            );
+          } catch (err) {
+            log.error({ err, key, column: columnName }, 'Error serializing parquet column chunk');
+          }
+        },
+        onComplete: () => {
+          try {
+            controller.enqueue(encoder.encode(JSON.stringify({ t: 'd' }) + '\n'));
+            controller.close();
+          } catch {
+            // stream already closed (e.g. client disconnected)
+          }
+        }
+      });
+
+      readPromise.catch((err) => {
+        log.error({ err, key }, 'Failed to parse Parquet chunk');
         try {
-          const stream = await provider.getObjectRange(key, start, rangeEnd - 1);
-          return await streamToArrayBuffer(stream as ReadableStream);
-        } finally {
-          release();
+          controller.enqueue(encoder.encode(JSON.stringify({ t: 'e' }) + '\n'));
+          controller.close();
+        } catch {
+          // stream already closed
         }
       });
+    },
+    cancel() {
+      // Client disconnected — no cleanup needed
     }
-  };
-
-  // useOffsetIndex: true — fetch only the specific pages covering the first
-  // previewRows rows (requires OffsetIndex in file; falls back to full column
-  // chunks if absent, which is unavoidable without page-level metadata).
-  const rows = await parquetReadObjects({
-    file: asyncBuffer,
-    metadata: parquetMeta,
-    rowEnd: previewRows,
-    useOffsetIndex: true,
-    compressors: nodeCompressors
   });
 
-  const csvLines = [
-    columnNames.map(escapeCSVField).join(','),
-    ...rows.map((row) =>
-      columnNames.map((col) => escapeCSVField(formatParquetValue(row[col]))).join(',')
-    )
-  ];
-  const csvText = csvLines.join('\n');
-
-  log.info(
-    {
-      user_id: userId,
-      key,
-      total_rows: totalRows,
-      preview_rows: previewRows,
-      truncated
-    },
-    'parquet preview ready'
-  );
+  const truncated = totalRows > offset + actualLimit;
 
-  return new Response(csvText, {
+  return new Response(stream, {
     headers: {
-      'Content-Type': 'text/csv',
+      'Content-Type': 'application/x-ndjson',
       'X-Preview-Format': 'parquet',
       'X-Preview-Renderable': 'true',
       'X-Preview-Truncated': String(truncated),
-      'X-Preview-Total-Size': String(totalSize),
+      'X-Preview-Total-Size': String(byteLength),
       'X-Preview-Total-Rows': String(totalRows),
-      'X-Preview-Preview-Rows': String(previewRows),
+      'X-Preview-Offset': String(offset),
       'Cache-Control': 'no-store'
     }
   });
diff --git a/src/routes/(app)/api/storage/preview/+server.ts b/src/routes/(app)/api/storage/preview/+server.ts
index ffb51b24..83df24aa 100644
--- a/src/routes/(app)/api/storage/preview/+server.ts
+++ b/src/routes/(app)/api/storage/preview/+server.ts
@@ -1,7 +1,7 @@
 import { S3ServiceException } from '@aws-sdk/client-s3';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 import { getProvider } from '$lib/server/storage/utils.js';
-// import { parquetPreview } from '$lib/server/storage/preview/parquet.js';
+import { getParquetPreview } from '$lib/server/storage/preview/parquet';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { requireBucketKey } from '../params.js';
@@ -25,19 +25,18 @@ export const GET: RequestHandler = async ({ url, locals }) => {
     const totalSize = metadata.size;
     const lowerKey = key.toLowerCase();
 
-    // Parquet files (by content-type or extension) — parse server-side and emit CSV rows.
+    // Parquet files (by content-type or extension) — parse server-side and emit structured preview rows.
     const isParquet =
       rawContentType === 'application/vnd.apache.parquet' ||
       rawContentType === 'application/x-parquet' ||
       lowerKey.endsWith('.parquet');
 
+    const offset = parseInt(url.searchParams.get('offset') ?? '0', 10);
+    const limit = parseInt(url.searchParams.get('limit') ?? '250', 10);
+    const includeData = url.searchParams.get('data') === 'true';
+
     if (isParquet) {
-      log.info(
-        { bucket, key, content_type: rawContentType, total_size: totalSize },
-        'parquet preview disabled'
-      );
-      // TODO: re-enable once we have a more robust parquet preview solution in place
-      // return await parquetPreview(provider, key, totalSize, userId, log);
+      return await getParquetPreview(provider, key, offset, limit, log, totalSize, includeData);
     }
 
     // Skip body fetch for known-binary formats — client will show fallback immediately.
diff --git a/src/routes/(app)/api/storage/preview/server.test.ts b/src/routes/(app)/api/storage/preview/server.test.ts
index 10c18fdd..ca44fcf7 100644
--- a/src/routes/(app)/api/storage/preview/server.test.ts
+++ b/src/routes/(app)/api/storage/preview/server.test.ts
@@ -15,6 +15,15 @@ vi.mock('$lib/server/storage/preview/stream.js', () => ({
   streamPreview: vi.fn(async () => new Response('preview content'))
 }));
 
+vi.mock('$lib/server/storage/preview/parquet.js', () => ({
+  getParquetPreview: vi.fn(async () => {
+    const body = JSON.stringify({ headers: ['a'], rows: [['1']], totalRows: 1 });
+    return new Response(body, {
+      headers: { 'X-Preview-Format': 'parquet', 'X-Preview-Renderable': 'true' }
+    });
+  })
+}));
+
 vi.mock('$lib/server/storage/s3-errors.js', () => ({
   mapS3ErrorToHttp: vi.fn((err) => {
     throw err;
@@ -24,6 +33,7 @@ vi.mock('$lib/server/storage/s3-errors.js', () => ({
 import { GET } from './+server.js';
 import { binaryPreview } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
+import { getParquetPreview } from '$lib/server/storage/preview/parquet.js';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 
 const CONNECTION_HEADER = {
@@ -84,6 +94,84 @@ describe('GET /storage/api/preview', () => {
     );
   });
 
+  it('detects parquet by content-type and delegates to getParquetPreview', async () => {
+    mockGetMetadata.mockResolvedValue({
+      contentType: 'application/vnd.apache.parquet',
+      size: 5000
+    });
+
+    const res = await GET(mockEvent('bucket=b1&key=data.parquet'));
+
+    expect(getParquetPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'data.parquet',
+      0,
+      250,
+      expect.anything(),
+      5000,
+      false
+    );
+    expect(res.headers.get('X-Preview-Format')).toBe('parquet');
+  });
+
+  it('detects parquet by .parquet extension', async () => {
+    mockGetMetadata.mockResolvedValue({
+      contentType: 'application/octet-stream',
+      size: 5000
+    });
+
+    const res = await GET(mockEvent('bucket=b1&key=measurements.parquet'));
+
+    expect(getParquetPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'measurements.parquet',
+      0,
+      250,
+      expect.anything(),
+      5000,
+      false
+    );
+    expect(res.headers.get('X-Preview-Format')).toBe('parquet');
+  });
+
+  it('passes offset and limit query params to getParquetPreview', async () => {
+    mockGetMetadata.mockResolvedValue({
+      contentType: 'application/x-parquet',
+      size: 50000
+    });
+
+    await GET(mockEvent('bucket=b1&key=large.parquet&offset=500&limit=100'));
+
+    expect(getParquetPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'large.parquet',
+      500,
+      100,
+      expect.anything(),
+      50000,
+      false
+    );
+  });
+
+  it('handles zero-size parquet file gracefully', async () => {
+    mockGetMetadata.mockResolvedValue({
+      contentType: 'application/vnd.apache.parquet',
+      size: 0
+    });
+
+    await GET(mockEvent('bucket=b1&key=empty.parquet'));
+
+    expect(getParquetPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'empty.parquet',
+      0,
+      250,
+      expect.anything(),
+      0,
+      false
+    );
+  });
+
   it('maps S3 errors to HTTP errors', async () => {
     const s3Err = new S3ServiceException({
       name: 'NoSuchKey',

From 2463e0d5c1c54bfd4146db35bcd0072f55a64bab Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 29 Jun 2026 12:32:11 +0200
Subject: [PATCH 082/136] S3 File Browser: Tab View (#178)

* #153 allow upload of empty files

* #136 add tab view to the file explorer

* #136 add tab restore option

* #135 Add s3 Garage instance for e2e tests (#162)

* #135 add garage instance to GitHub workflow for e2e tests

* #135 fix yaml lint

* #135 fix docker command in action

* #135 fix docker options in action

* #135 fix yaml format

* #135 refactor GitHub action for s3 deployment with code fixes

* #135 fix missing entrypoint in container

* #135 remove format use on s3 creation

* #135 add e2e tests that require a bucket

* #135 allow local starting of s3 e2e tests, fix lint

* #135 fix lint

* #135 move garage.toml to permanent repository

* #135 create keys and bucket via curl

* #135 fix lint

* #135 fix lint

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* Implement Garage S3 deployment and configuration for E2E testing

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* #135 Add E2E Tests to S3 File Browser (#166)

* #135 add garage instance to GitHub workflow for e2e tests

* #135 fix yaml lint

* #135 fix docker command in action

* #135 fix docker options in action

* #135 fix yaml format

* #135 refactor GitHub action for s3 deployment with code fixes

* #135 fix missing entrypoint in container

* #135 remove format use on s3 creation

* #135 add e2e tests that require a bucket

* #135 allow local starting of s3 e2e tests, fix lint

* #135 fix lint

* #135 move garage.toml to permanent repository

* #135 create keys and bucket via curl

* #135 fix lint

* #135 fix lint

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* #135 add e2e tests for s3 file browser

* #135 add coverage report in markdown

* Filebrowser: Refactor Filebrowser by using global state  (#163)

* feat: Trino functions in Code Completion (#78)

* Add Trino functions to completion list

* fix: Unclosed subqueries (#110)

* correctly classify completion slots inside unclosed parenthesised subqueries

* chore: Helm cleanup (#109)

* add missing envs to helm chart & add probes with /healthz endpoint

* update tech debt

* change trino.completionDisabled to features.trino.completion.enabled

* refactor: use global states

* refactor: reorganise component structure

* #159 Add VS Code Settings and Extensions (#160)

* #159 add vs code settings and extensions

* #159 update deprecated setting

* #159 remove ruler

* refactor: improve logging levels and clean up unused code

* fix: fix bookmarks handling and improve loading state management

* refactor: adjust z-index values for improved layering in BucketList component

* refactor: enhance unpin menu functionality and add close button

* refactor: enhance unpin context menu with improved positioning and close button

* refactor: streamline unpin menu handling and improve focus management

* refactor(frontend): clean up and restructure app (#84)

* refactor(frontend): clean up and restructure app

* fix: add lint:fix script to package.json and clean up trailing comma in +layout.svelte

* docs: update AGENTS.md to include Material UI icon library usage

* refactor(header): move components for header into own directory

* chore: dedupe lockfile

* fix(sidebar): add hover cursor style to toggle button

* chore(types): centralise navigation and auth types; update header/sidebar imports

Co-authored-by: Copilot <copilot@github.com>

* #114 save sidebar collapse state in localStorage

* refactor: merge if statements

* refactor: increase timeout for new clusters

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: unused export

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore hr seperator

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: restore previous layout css

Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: replace Iconify with unplugin-icons

* refactor: update icon library usage to unplugin-icons with material-symbols

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* refactor: update bucket icons to use gravity-ui and add new dependency

* chore: move gravity-ui to dev-dependencies

---------

Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: F3l1x1vo <fli@ordix.de>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>

* #135 fix lint

* Implement Garage S3 deployment and configuration for E2E testing

* #135 fix lint

* #135 refactor e2e directory structure, split storage test file into smaller files

* #135 fix lint

* #135 fix lint

* #135 fix missing admin token in s3 config for tests

* #135 add e2e tests for csv and image previews

* #135 Delete E2E_COVERAGE.md

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

* #136 add banner notification for tab restore

* test: add test for uploading empty files in S3 storage provider tests

* #136 add e2e tests, change URL on tab switch, embed connection in tab restore

* #136 add unit tests for tab view

* #136 fix end to end tests

* #178 fix layout of new tab button, fix e2e tests

* #178 fix e2e test

* #178 merge user connection branch into tab view branch

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
Co-authored-by: Benedikt Labrenz <benedikt@labrenz.org>
Co-authored-by: Lukas Krug <lukas.krug@stackable.tech>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .env.example                                  |   1 +
 .env.test                                     |   1 +
 dev/setup.sh                                  |   3 +-
 e2e/i18n.spec.ts                              |   9 +
 e2e/smoke.spec.ts                             |   9 +
 e2e/storage/helpers.ts                        |  16 +
 e2e/storage/tabs.spec.ts                      | 389 ++++++++++++
 messages/de.json                              |  43 +-
 messages/en.json                              |  23 +-
 src/lib/client/feature-flags.ts               |   9 +
 src/lib/components/ToastHost.svelte           |  37 +-
 .../components/layout/sidebar/Sidebar.svelte  |   9 +-
 .../storage/explorer/FileExplorer.svelte      |  63 ++
 .../storage/explorer/StorageBreadcrumb.svelte |  16 +
 .../explorer/StorageBreadcrumb.svelte.spec.ts |  42 +-
 .../components/storage/explorer/TabBar.svelte | 274 +++++++++
 .../storage/explorer/TabBar.svelte.spec.ts    | 207 +++++++
 .../__tests__/StorageBreadcrumbWrapper.svelte |  11 +-
 src/lib/storage/persistence.ts                |   1 +
 src/lib/storage/state.svelte.ts               |  21 +-
 src/lib/storage/tabs-context.ts               |   4 +
 src/lib/storage/tabs.svelte.spec.ts           | 576 ++++++++++++++++++
 src/lib/storage/tabs.svelte.ts                | 339 +++++++++++
 src/lib/stores/toast.svelte.ts                |  16 +-
 src/routes/(app)/storage/+layout.server.ts    |   2 +-
 src/routes/(app)/storage/+page.svelte         |  81 +++
 .../storage/[bucket]/[...prefix]/+page.svelte |  37 +-
 .../(app)/storage/layout.server.test.ts       |   7 +-
 src/test/setup-client.ts                      |   1 +
 29 files changed, 2190 insertions(+), 57 deletions(-)
 create mode 100644 e2e/storage/tabs.spec.ts
 create mode 100644 src/lib/components/storage/explorer/TabBar.svelte
 create mode 100644 src/lib/components/storage/explorer/TabBar.svelte.spec.ts
 create mode 100644 src/lib/storage/tabs-context.ts
 create mode 100644 src/lib/storage/tabs.svelte.spec.ts
 create mode 100644 src/lib/storage/tabs.svelte.ts

diff --git a/.env.example b/.env.example
index c2918e4f..455336a1 100644
--- a/.env.example
+++ b/.env.example
@@ -36,5 +36,6 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
 # STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset  # Comma-separated list of compression types to disallow from parquet data preview (default: "gzip-no_offset")
 # PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000  # Auto-connect to last used storage after this many milliseconds (default: 15000)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true  # File browser: continue where you left off — restore open tabs from the last session (default: false)
 # PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=1048576  # Max file size (in bytes) of editable text files in the storage browser (default: 5 MiB)
 # PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
diff --git a/.env.test b/.env.test
index 9375569d..46722865 100644
--- a/.env.test
+++ b/.env.test
@@ -12,6 +12,7 @@ STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
 STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
diff --git a/dev/setup.sh b/dev/setup.sh
index ecff397d..828e628f 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -310,6 +310,7 @@ STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
 STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
@@ -336,6 +337,7 @@ STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
 STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
@@ -352,7 +354,6 @@ fi
 
 echo "Wrote $ENV_FILE"
 
-# ------------------------------------------------------------------
 # 9. Create Kubernetes Secret for the Helm chart
 # ------------------------------------------------------------------
 echo ""
diff --git a/e2e/i18n.spec.ts b/e2e/i18n.spec.ts
index 73b9ce29..4fc51a85 100644
--- a/e2e/i18n.spec.ts
+++ b/e2e/i18n.spec.ts
@@ -16,9 +16,18 @@ function loadAuthState(projectName: string, { withoutLocale = false } = {}) {
 test.describe('Internationalisation', () => {
   test.use({ locale: 'en-US' });
 
+  // Firefox is slower to hydrate and navigate; triple the default timeout for
+  // all tests in this block so they don't time out on slow CI runners.
+  test.beforeEach(() => {
+    test.slow();
+  });
+
   test('renders in English by default with lang="en"', async ({ page }) => {
     await page.goto('/');
 
+    // Wait for hydration so reactive state has settled before checking content.
+    await waitForHydration(page);
+
     const html = page.locator('html');
     await expect(html).toHaveAttribute('lang', 'en');
 
diff --git a/e2e/smoke.spec.ts b/e2e/smoke.spec.ts
index 271256ef..28d920af 100644
--- a/e2e/smoke.spec.ts
+++ b/e2e/smoke.spec.ts
@@ -5,8 +5,15 @@ test.describe('Smoke tests', () => {
   test.use({ locale: 'en-US' });
 
   test('home page loads with app shell', async ({ page }) => {
+    // Firefox is slower to hydrate; triple the default timeout.
+    test.slow();
+
     await page.goto('/');
 
+    // Wait for hydration so reactive state (page.url.pathname) has settled
+    // before checking aria-current, which depends on it.
+    await waitForHydration(page);
+
     // Sidebar brand is visible
     await expect(page.getByText('Stackable', { exact: true })).toBeVisible();
 
@@ -28,6 +35,8 @@ test.describe('Smoke tests', () => {
   });
 
   test('theme toggle switches between light and dark', async ({ page }) => {
+    // Firefox is slower to hydrate; triple the default timeout.
+    test.slow();
     await page.goto('/');
 
     const html = page.locator('html');
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 95e26ae0..a334d957 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -195,3 +195,19 @@ export async function headObject(client: S3Client, bucket: string, key: string)
 
 // Re-export expect for convenience
 export { expect };
+
+/** Seeds the `storage_tabs` localStorage key before the first page load of a
+ *  test, simulating a previous session's saved tab state. Because this uses
+ *  `addInitScript` it runs on every navigation within the test context, so the
+ *  data is available regardless of which page triggers the initial load. */
+export async function seedStorageTabsState(
+  page: Page,
+  state: {
+    tabs: Array<{ id: string; label: string; bucket: string; prefix: string }>;
+    activeTabId: string;
+  }
+): Promise<void> {
+  await page.addInitScript((data) => {
+    localStorage.setItem('storage_tabs', JSON.stringify(data));
+  }, state);
+}
diff --git a/e2e/storage/tabs.spec.ts b/e2e/storage/tabs.spec.ts
new file mode 100644
index 00000000..d69cf371
--- /dev/null
+++ b/e2e/storage/tabs.spec.ts
@@ -0,0 +1,389 @@
+import { test, expect } from '@playwright/test';
+import { hasGarageCredentials, requireGarageCredentials } from '../support/garage.js';
+import { waitForHydration } from '../support/helpers.js';
+import {
+  connectToStorage,
+  connectAndOpenPrefix,
+  bucketRoute,
+  seedStorageTabsState
+} from './helpers.js';
+
+// ── Tab bar ───────────────────────────────────────────────────────────────────
+
+test.describe('Storage — Explorer tab bar', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('tab bar is hidden when there is only one tab', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await expect(page.getByRole('tablist', { name: 'Explorer tabs' })).not.toBeVisible();
+  });
+
+  test('add tab via + button shows the tab bar with two tabs', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await expect(tablist).toBeVisible();
+    await expect(tablist.getByRole('tab')).toHaveCount(2);
+    // Newly added tab becomes active
+    await expect(tablist.getByRole('tab').nth(1)).toHaveAttribute('aria-selected', 'true');
+  });
+
+  test('clicking a tab switches the active tab', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    const tabs = tablist.getByRole('tab');
+
+    // Second tab is currently active; click the first
+    await tabs.nth(0).click();
+    await expect(tabs.nth(0)).toHaveAttribute('aria-selected', 'true');
+    await expect(tabs.nth(1)).toHaveAttribute('aria-selected', 'false');
+  });
+
+  test('closing a tab removes it and hides the tab bar when only one remains', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await expect(tablist.getByRole('tab')).toHaveCount(2);
+
+    // Hover the tab to make the close button visible (it is opacity-0 by default)
+    const firstTab = tablist.getByRole('tab').nth(0);
+    await firstTab.hover();
+    await firstTab.getByRole('button', { name: 'Close tab' }).click();
+
+    await expect(tablist).not.toBeVisible();
+  });
+
+  test('close button is absent when only one tab exists', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await expect(page.getByRole('button', { name: 'Close tab' })).toHaveCount(0);
+  });
+
+  test('middle-click on a tab closes it', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await expect(tablist.getByRole('tab')).toHaveCount(2);
+
+    await tablist.getByRole('tab').nth(1).click({ button: 'middle' });
+
+    await expect(tablist).not.toBeVisible();
+  });
+
+  test('double-click on a tab starts inline rename', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await tablist.getByRole('tab').nth(0).dblclick();
+
+    const input = page.getByRole('textbox', { name: 'Rename tab' });
+    await expect(input).toBeVisible();
+
+    await input.fill('My renamed tab');
+    await input.press('Enter');
+
+    await expect(tablist.getByRole('tab').nth(0)).toContainText('My renamed tab');
+  });
+
+  test('Escape cancels rename without changing the label', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    const firstTab = tablist.getByRole('tab').nth(0);
+
+    // The initial label is the bucket name (prefix is empty)
+    const originalLabel = credentials.bucket;
+
+    await firstTab.dblclick();
+    await page.getByRole('textbox', { name: 'Rename tab' }).fill('discarded name');
+    await page.keyboard.press('Escape');
+
+    // Input disappears and the original label is preserved
+    await expect(page.getByRole('textbox', { name: 'Rename tab' })).not.toBeVisible();
+    await expect(firstTab).toHaveAttribute('title', originalLabel);
+  });
+
+  test('right-click opens a context menu with Rename and Close options', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await tablist.getByRole('tab').nth(0).click({ button: 'right' });
+
+    const tabmenu = page.getByRole('menu', { name: 'Tab options' });
+    await expect(tabmenu).toBeVisible();
+    await expect(tabmenu.getByRole('menuitem', { name: 'Rename tab' })).toBeVisible();
+    await expect(tabmenu.getByRole('menuitem', { name: 'Close tab' })).toBeVisible();
+  });
+
+  test('rename via right-click context menu', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await tablist.getByRole('tab').nth(0).click({ button: 'right' });
+    await page.getByRole('menuitem', { name: 'Rename tab' }).click();
+
+    const input = page.getByRole('textbox', { name: 'Rename tab' });
+    await expect(input).toBeVisible();
+    await input.fill('Context menu rename');
+    await input.press('Enter');
+
+    await expect(tablist.getByRole('tab').nth(0)).toContainText('Context menu rename');
+  });
+
+  test('close tab via right-click context menu', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await expect(tablist.getByRole('tab')).toHaveCount(2);
+
+    await tablist.getByRole('tab').nth(0).click({ button: 'right' });
+    await page.getByRole('menuitem', { name: 'Close tab' }).click();
+
+    // Closing down to one tab hides the tablist (hasTabs is false when only one tab remains)
+    await expect(tablist).not.toBeVisible();
+  });
+
+  test('New Tab via breadcrumb More Options adds a tab and closes the dropdown', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+
+    // Dropdown must close after the click
+    await expect(menu).not.toBeVisible();
+
+    // Tab bar must appear with 2 tabs
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await expect(tablist).toBeVisible();
+    await expect(tablist.getByRole('tab')).toHaveCount(2);
+  });
+});
+
+// ── Restore banner ────────────────────────────────────────────────────────────
+
+test.describe('Storage — Restore tabs banner', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('banner appears when there are 2 or more saved tabs', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await seedStorageTabsState(page, {
+      tabs: [
+        { id: 'tab-a', label: credentials.bucket, bucket: credentials.bucket, prefix: '' },
+        { id: 'tab-b', label: 'subfolder', bucket: credentials.bucket, prefix: 'subfolder/' }
+      ],
+      activeTabId: 'tab-a'
+    });
+
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await expect(page.getByRole('alert')).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Restore tabs' })).toBeVisible();
+    await expect(page.getByRole('button', { name: 'Dismiss' })).toBeVisible();
+  });
+
+  test('banner message includes the saved tab count', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await seedStorageTabsState(page, {
+      tabs: [
+        { id: 'tab-a', label: credentials.bucket, bucket: credentials.bucket, prefix: '' },
+        { id: 'tab-b', label: 'folder-1', bucket: credentials.bucket, prefix: 'folder-1/' },
+        { id: 'tab-c', label: 'folder-2', bucket: credentials.bucket, prefix: 'folder-2/' }
+      ],
+      activeTabId: 'tab-a'
+    });
+
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await expect(page.getByRole('alert')).toContainText('3');
+  });
+
+  test('banner does not appear when there is only one saved tab', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await seedStorageTabsState(page, {
+      tabs: [{ id: 'tab-a', label: credentials.bucket, bucket: credentials.bucket, prefix: '' }],
+      activeTabId: 'tab-a'
+    });
+
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await expect(page.getByRole('button', { name: 'Restore tabs' })).not.toBeVisible();
+  });
+
+  test('Dismiss hides the banner', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    await seedStorageTabsState(page, {
+      tabs: [
+        { id: 'tab-a', label: credentials.bucket, bucket: credentials.bucket, prefix: '' },
+        { id: 'tab-b', label: 'subfolder', bucket: credentials.bucket, prefix: 'subfolder/' }
+      ],
+      activeTabId: 'tab-a'
+    });
+
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await page.getByRole('button', { name: 'Dismiss' }).click();
+
+    await expect(page.getByRole('button', { name: 'Restore tabs' })).not.toBeVisible();
+  });
+
+  test('Dismiss does not clear saved tabs — banner reappears on re-visit', async ({ page }) => {
+    test.slow(); // navigates to / (Trino editor) which is slow in Firefox
+    const credentials = requireGarageCredentials();
+
+    // Step 1: navigate to bucket and add a second tab via natural interaction
+    await connectAndOpenPrefix(page, credentials);
+
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await expect(page.getByRole('tablist', { name: 'Explorer tabs' }).getByRole('tab')).toHaveCount(
+      2
+    );
+
+    // Step 2: navigate back to /storage — banner should appear
+    await page.goto('/storage');
+    await waitForHydration(page);
+    await expect(page.getByRole('button', { name: 'Restore tabs' })).toBeVisible();
+
+    // Step 3: dismiss
+    await page.getByRole('button', { name: 'Dismiss' }).click();
+    await expect(page.getByRole('button', { name: 'Restore tabs' })).not.toBeVisible();
+
+    // Step 4: navigate to dashboard and back — banner must reappear because
+    // localStorage was not cleared by Dismiss
+    await page.goto('/');
+    await waitForHydration(page);
+    await page.goto('/storage');
+    await waitForHydration(page);
+
+    await expect(page.getByRole('button', { name: 'Restore tabs' })).toBeVisible();
+  });
+
+  test('Restore tabs navigates to the active-tab bucket and loads all tabs', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+
+    // Step 1: navigate to bucket and add a second tab via natural interaction
+    await connectAndOpenPrefix(page, credentials);
+    await page.getByRole('button', { name: 'More options' }).click();
+
+    const menu = page.getByRole('menu');
+    await expect(menu).toBeVisible();
+    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await expect(page.getByRole('tablist', { name: 'Explorer tabs' }).getByRole('tab')).toHaveCount(
+      2
+    );
+
+    // Step 2: navigate back to /storage — banner appears
+    await page.goto('/storage');
+    await waitForHydration(page);
+    await expect(page.getByRole('button', { name: 'Restore tabs' })).toBeVisible();
+
+    // Step 3: click Restore tabs
+    await page.getByRole('button', { name: 'Restore tabs' }).click();
+
+    // Should navigate to the bucket route
+    await expect(page).toHaveURL(bucketRoute(credentials.bucket));
+
+    // Step 4: tab bar must render with 2 restored tabs
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await expect(tablist).toBeVisible();
+    await expect(tablist.getByRole('tab')).toHaveCount(2);
+  });
+});
diff --git a/messages/de.json b/messages/de.json
index 17afb4dd..a1690847 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -221,9 +221,9 @@
   "storage_loading": "Wird geladen…",
   "storage_breadcrumb_more": "Weitere Ordner",
   "storage_error_title": "Speicherfehler",
-  "storage_error_access_denied": "Sie haben keine Berechtigung, auf den Bucket \u201e{bucket}\u201c zuzugreifen.",
-  "storage_error_not_found": "Der Bucket \u201e{bucket}\u201c existiert nicht.",
-  "storage_error_storage_error": "Beim Zugriff auf den Bucket \u201e{bucket}\u201c ist ein Fehler aufgetreten.",
+  "storage_error_access_denied": "Sie haben keine Berechtigung, auf den Bucket „{bucket}“ zuzugreifen.",
+  "storage_error_not_found": "Der Bucket „{bucket}“ existiert nicht.",
+  "storage_error_storage_error": "Beim Zugriff auf den Bucket „{bucket}“ ist ein Fehler aufgetreten.",
   "storage_error_back_to_storage": "Zurück zum Speicher",
   "storage_error_go_back": "Zurück",
   "storage_download_error_title": "Download fehlgeschlagen",
@@ -233,7 +233,7 @@
   "storage_download_error_server_error": "Beim Herunterladen der Datei ist ein Serverfehler aufgetreten. Bitte versuchen Sie es erneut.",
   "storage_download_error_unknown": "Ein unerwarteter Fehler ist aufgetreten. Bitte versuchen Sie es erneut.",
   "storage_download_dismiss": "Schließen",
-  "storage_delete_confirm_title_one": "\u201e{name}\u201c löschen?",
+  "storage_delete_confirm_title_one": "„{name}“ löschen?",
   "storage_delete_confirm_title_many": "{count} Elemente löschen?",
   "storage_delete_confirm_message": "Diese Aktion kann nicht rückgängig gemacht werden.",
   "storage_delete_dir_warning_heading": "Alle Inhalte werden dauerhaft gelöscht",
@@ -298,47 +298,47 @@
   "storage_action_upload": "Hochladen",
   "storage_upload_title": "Hochladen",
   "storage_upload_drop_prompt": "Dateien oder Ordner hier ablegen oder klicken zum Durchsuchen",
-  "storage_upload_select_files": "Dateien ausw\u00e4hlen",
-  "storage_upload_select_folder": "Ordner ausw\u00e4hlen",
-  "storage_upload_selected": "Ausgew\u00e4hlt: {name}",
+  "storage_upload_select_files": "Dateien auswählen",
+  "storage_upload_select_folder": "Ordner auswählen",
+  "storage_upload_selected": "Ausgewählt: {name}",
   "storage_upload_to_prefix": "Hochladen nach: {prefix}",
   "storage_upload_total_size": "Gesamt: {size}",
   "storage_upload_start": "Hochladen",
-  "storage_upload_checking": "Auf Konflikte pr\u00fcfen\u2026",
+  "storage_upload_checking": "Auf Konflikte prüfen…",
   "storage_upload_conflicts_title": "Dateien bereits vorhanden",
   "storage_upload_conflicts_desc": "Wählen Sie für jede Konfliktdatei eine Aktion.",
   "storage_upload_skip_all": "Alle überspringen",
   "storage_upload_replace_all": "Alle ersetzen",
   "storage_upload_resolution_replace": "Ersetzen",
-  "storage_upload_resolution_skip": "\u00dcberspringen",
+  "storage_upload_resolution_skip": "Überspringen",
   "storage_upload_resolution_rename": "Umbenennen",
   "storage_upload_rename_label": "Neuer Dateiname",
-  "storage_upload_rename_same_name_error": "Bitte geben Sie einen anderen Namen ein oder w\u00e4hlen Sie Ersetzen bzw. \u00dcberspringen.",
-  "storage_upload_rename_confirm_action": "Namen best\u00e4tigen",
-  "storage_upload_rename_taken": "Dieser Name existiert bereits an diesem Speicherort. Bitte w\u00e4hlen Sie einen anderen Namen.",
-  "storage_upload_uploading": "Wird hochgeladen\u2026 {pct}%",
+  "storage_upload_rename_same_name_error": "Bitte geben Sie einen anderen Namen ein oder wählen Sie Ersetzen bzw. Überspringen.",
+  "storage_upload_rename_confirm_action": "Namen bestätigen",
+  "storage_upload_rename_taken": "Dieser Name existiert bereits an diesem Speicherort. Bitte wählen Sie einen anderen Namen.",
+  "storage_upload_uploading": "Wird hochgeladen… {pct}%",
   "storage_upload_status_queued": "ausstehend",
   "storage_upload_status_done": "fertig",
-  "storage_upload_status_skipped": "\u00fcbersprungen",
+  "storage_upload_status_skipped": "übersprungen",
   "storage_upload_status_failed": "fehlgeschlagen",
   "storage_upload_complete_title": "Upload abgeschlossen",
-  "storage_upload_complete_summary": "{uploaded} hochgeladen \u00b7 {skipped} \u00fcbersprungen \u00b7 {failed} fehlgeschlagen",
+  "storage_upload_complete_summary": "{uploaded} hochgeladen · {skipped} übersprungen · {failed} fehlgeschlagen",
   "storage_upload_done": "Fertig",
   "storage_upload_success": "Datei erfolgreich hochgeladen.",
   "storage_upload_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
   "storage_upload_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung, hier hochzuladen.",
   "storage_upload_error_no_such_bucket": "Bucket nicht gefunden.",
-  "storage_upload_error_invalid_part": "Upload fehlgeschlagen (Datenintegrit\u00e4tsfehler). Bitte erneut versuchen.",
+  "storage_upload_error_invalid_part": "Upload fehlgeschlagen (Datenintegritätsfehler). Bitte erneut versuchen.",
   "storage_upload_error_server_error": "Serverfehler aufgetreten. Bitte erneut versuchen.",
   "storage_upload_error_unknown": "Unerwarteter Fehler. Bitte erneut versuchen.",
   "storage_upload_overwrite_title": "Datei bereits vorhanden",
-  "storage_upload_overwrite_message": "Ein Objekt namens \u201e{name}\u201c ist bereits vorhanden. Was m\u00f6chten Sie tun?",
+  "storage_upload_overwrite_message": "Ein Objekt namens „{name}“ ist bereits vorhanden. Was möchten Sie tun?",
   "storage_upload_overwrite_replace": "Ersetzen",
   "storage_upload_overwrite_cancel": "Abbrechen",
   "storage_upload_overwrite_rename": "Umbenennen",
   "storage_upload_rename_confirm": "Mit diesem Namen hochladen",
   "storage_upload_retry": "Erneut versuchen",
-  "storage_upload_close": "Schlie\u00dfen",
+  "storage_upload_close": "Schließen",
   "storage_action_create": "Erstellen",
   "storage_create_file": "Neue Textdatei",
   "storage_create_folder": "Neues Verzeichnis",
@@ -398,6 +398,13 @@
       }
     }
   ],
+  "storage_tab_new": "Neuer Tab",
+  "storage_tab_close": "Tab schließen",
+  "storage_tab_rename": "Tab umbenennen",
+  "storage_tab_list": "Explorer-Tabs",
+  "storage_tab_context_menu": "Tab-Optionen",
+  "storage_restore_tabs_message": "Sie haben {count} gespeicherte(n) Tab(s) aus Ihrer letzten Sitzung.",
+  "storage_restore_tabs_action": "Tabs wiederherstellen",
   "storage_preview_parquet_tab_aria": "Parquet-Vorschau-Registerkarten",
   "storage_preview_parquet_tab_metadata": "Metadaten",
   "storage_preview_parquet_tab_data": "Daten",
diff --git a/messages/en.json b/messages/en.json
index 0da5ee21..0490f343 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -92,7 +92,7 @@
   "trino_catalog_error": "Failed to load catalog",
   "trino_catalog_load_children_error": "Failed to load",
   "trino_view_in_trino": "View in Trino",
-  "trino_tab_new": "New tab",
+  "trino_tab_new": "New Tab",
   "trino_tab_close": "Close tab {name}",
   "trino_tab_default_name": "Untitled",
   "trino_tab_rename": "Rename tab",
@@ -221,9 +221,9 @@
   "storage_loading": "Loading…",
   "storage_breadcrumb_more": "More folders",
   "storage_error_title": "Storage error",
-  "storage_error_access_denied": "You do not have permission to access the bucket \u201c{bucket}\u201d.",
-  "storage_error_not_found": "The bucket \u201c{bucket}\u201d does not exist.",
-  "storage_error_storage_error": "An error occurred while accessing the bucket \u201c{bucket}\u201d.",
+  "storage_error_access_denied": "You do not have permission to access the bucket “{bucket}”.",
+  "storage_error_not_found": "The bucket “{bucket}” does not exist.",
+  "storage_error_storage_error": "An error occurred while accessing the bucket “{bucket}”.",
   "storage_error_back_to_storage": "Back to storage",
   "storage_error_go_back": "Go back",
   "storage_download_error_title": "Download failed",
@@ -304,7 +304,7 @@
   "storage_upload_to_prefix": "Uploading to: {prefix}",
   "storage_upload_total_size": "Total: {size}",
   "storage_upload_start": "Upload",
-  "storage_upload_checking": "Checking for conflicts\u2026",
+  "storage_upload_checking": "Checking for conflicts…",
   "storage_upload_conflicts_title": "Files already exist",
   "storage_upload_conflicts_desc": "Choose what to do for each conflicting file.",
   "storage_upload_skip_all": "Skip all",
@@ -316,13 +316,13 @@
   "storage_upload_rename_same_name_error": "Please enter a different name, or select Replace or Skip.",
   "storage_upload_rename_confirm_action": "Confirm name",
   "storage_upload_rename_taken": "This name already exists here. Please choose a different name.",
-  "storage_upload_uploading": "Uploading\u2026 {pct}%",
+  "storage_upload_uploading": "Uploading… {pct}%",
   "storage_upload_status_queued": "queued",
   "storage_upload_status_done": "done",
   "storage_upload_status_skipped": "skipped",
   "storage_upload_status_failed": "failed",
   "storage_upload_complete_title": "Upload complete",
-  "storage_upload_complete_summary": "{uploaded} uploaded \u00b7 {skipped} skipped \u00b7 {failed} failed",
+  "storage_upload_complete_summary": "{uploaded} uploaded · {skipped} skipped · {failed} failed",
   "storage_upload_done": "Done",
   "storage_upload_success": "File uploaded successfully.",
   "storage_upload_error_not_connected": "No storage connection configured. Please connect first.",
@@ -332,7 +332,7 @@
   "storage_upload_error_server_error": "A server error occurred. Please retry.",
   "storage_upload_error_unknown": "An unexpected error occurred. Please retry.",
   "storage_upload_overwrite_title": "File already exists",
-  "storage_upload_overwrite_message": "An object named \u201c{name}\u201d already exists in this location. What would you like to do?",
+  "storage_upload_overwrite_message": "An object named “{name}” already exists in this location. What would you like to do?",
   "storage_upload_overwrite_replace": "Replace",
   "storage_upload_overwrite_cancel": "Cancel",
   "storage_upload_overwrite_rename": "Rename",
@@ -398,6 +398,13 @@
       }
     }
   ],
+  "storage_tab_new": "New Tab",
+  "storage_tab_close": "Close tab",
+  "storage_tab_rename": "Rename tab",
+  "storage_tab_list": "Explorer tabs",
+  "storage_tab_context_menu": "Tab options",
+  "storage_restore_tabs_message": "You have {count} saved tab(s) from your last session.",
+  "storage_restore_tabs_action": "Restore tabs",
   "storage_preview_parquet_tab_aria": "Parquet preview tabs",
   "storage_preview_parquet_tab_metadata": "Metadata",
   "storage_preview_parquet_tab_data": "Data",
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index 944468a7..56ae5cc4 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -11,6 +11,15 @@ import { env } from '$env/dynamic/public';
 export const storageAutoConnectEnabled =
   (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT ?? 'false') === 'true';
 
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true`, the file browser
+ *  saves open tabs (their name, order, and location) to localStorage and
+ *  restores them the next time the user navigates to `/storage`.
+ *  Disabled by default. */
+export const storageRestoreTabsEnabled =
+  (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS ??
+    env.PUBLIC_STACKABLE_UI_STORAGE_RESTORE_TABS ??
+    'false') === 'true';
+
 /** Timeout in milliseconds for the storage auto-connect attempt. Default: 15 000 (15 s).
  *  Controlled by `PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS`. */
 export const storageAutoConnectTimeoutMs: number = (() => {
diff --git a/src/lib/components/ToastHost.svelte b/src/lib/components/ToastHost.svelte
index e215f7da..6f0cced4 100644
--- a/src/lib/components/ToastHost.svelte
+++ b/src/lib/components/ToastHost.svelte
@@ -28,17 +28,34 @@
     {@const ToastIcon = iconMap[toast.type]}
     <div
       role="alert"
-      class="alert {alertClassMap[toast.type]} flex max-w-sm items-start gap-2 shadow-lg"
+      class="alert {alertClassMap[toast.type]} flex max-w-sm flex-col items-start gap-2 shadow-lg"
     >
-      <ToastIcon class="mt-0.5 h-5 w-5 shrink-0" aria-hidden="true" />
-      <span class="flex-1 text-sm">{toast.message}</span>
-      <button
-        class="btn btn-ghost btn-xs ml-1 shrink-0"
-        aria-label="Dismiss"
-        onclick={() => removeToast(toast.id)}
-      >
-        <IconClose class="h-4 w-4" aria-hidden="true" />
-      </button>
+      <div class="flex w-full items-start gap-2">
+        <ToastIcon class="mt-0.5 h-5 w-5 shrink-0" aria-hidden="true" />
+        <span class="flex-1 text-sm">{toast.message}</span>
+        <button
+          class="btn btn-ghost btn-xs ml-1 shrink-0"
+          aria-label="Dismiss"
+          onclick={() => removeToast(toast.id)}
+        >
+          <IconClose class="h-4 w-4" aria-hidden="true" />
+        </button>
+      </div>
+      {#if toast.actions && toast.actions.length > 0}
+        <div class="flex w-full justify-end gap-2">
+          {#each toast.actions as action, i (i)}
+            <button
+              class="btn btn-sm btn-neutral"
+              onclick={() => {
+                action.onClick();
+                removeToast(toast.id);
+              }}
+            >
+              {action.label}
+            </button>
+          {/each}
+        </div>
+      {/if}
     </div>
   {/each}
 </div>
diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index 2ae05a16..22ab531f 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -19,9 +19,14 @@
 
   const sections = $derived(getNavSections({ storageBrowserEnabled }));
 
+  // Explicitly derive currentPath so Svelte 5 tracks page.url.pathname
+  // as a reactive dependency. Without this, changes to page.url.pathname
+  // may not reliably trigger re-renders in all browsers during hydration.
+  const currentPath = $derived(page.url.pathname);
+
   function isActive(href: string): boolean {
-    if (href === '/') return page.url.pathname === '/';
-    return page.url.pathname.startsWith(href);
+    if (href === '/') return currentPath === '/';
+    return currentPath.startsWith(href);
   }
 
   function handleNavClick(event: MouseEvent, item: NavItem) {
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 615cf043..7d84d965 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -1,9 +1,15 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import { untrack } from 'svelte';
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
   import { navigating } from '$app/state';
   import { getStorageState } from '$lib/storage/context.js';
+  import { TabsState } from '$lib/storage/tabs.svelte.js';
+  import { setTabsState } from '$lib/storage/tabs-context.js';
+  import { storageRestoreTabsEnabled } from '$lib/client/feature-flags.js';
   import StorageBreadcrumb from './StorageBreadcrumb.svelte';
+  import TabBar from './TabBar.svelte';
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
   import StorageModals from '../modals/StorageModals.svelte';
@@ -11,6 +17,61 @@
 
   const storage = getStorageState();
 
+  function navigateToLocation(bucket: string, prefix: string): void {
+    const encodedPrefix = prefix
+      ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+      : '';
+    const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
+      bucket: encodeURIComponent(bucket),
+      prefix: encodedPrefix
+    });
+    const url = new URL(basePath, location.origin);
+    if (storage.pageSize) url.searchParams.set('pageSize', String(storage.pageSize));
+    // eslint-disable-next-line svelte/no-navigation-without-resolve -- base path is built with resolve(); URL object is needed to append query params
+    goto(url, { replaceState: false });
+  }
+
+  /** Updates the browser URL bar to reflect the active tab's location without
+   *  triggering a SvelteKit navigation or server refetch. Used when restoring
+   *  an in-memory snapshot on tab switch. */
+  function replaceLocationUrl(bucket: string, prefix: string): void {
+    const encodedPrefix = prefix
+      ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+      : '';
+    const newPath = resolve('/(app)/storage/[bucket]/[...prefix]', {
+      bucket: encodeURIComponent(bucket),
+      prefix: encodedPrefix
+    });
+    history.replaceState(history.state, '', newPath);
+  }
+
+  const tabsState = new TabsState(storage, {
+    persistEnabled: storageRestoreTabsEnabled,
+    connectionId: storage.connectionId,
+    navigateToLocation,
+    replaceLocationUrl
+  });
+  setTabsState(tabsState);
+
+  // Initialise tabs once storage has bucket data.
+  $effect(() => {
+    if (storage.bucket) {
+      untrack(() => tabsState.ensureInitialTab());
+    }
+  });
+
+  // Keep the active tab snapshot in sync whenever location or page data
+  // changes. Both methods are called inside untrack to prevent a reactive
+  // loop: they read from this.tabs internally, and writing this.tabs would
+  // otherwise re-trigger the effect.
+  $effect(() => {
+    void [storage.bucket, storage.prefix, storage.objects];
+    untrack(() => {
+      tabsState.markActiveTabLoaded();
+      tabsState.syncActiveTab();
+    });
+  });
+
   // Record location visit whenever the current bucket/prefix changes.
   $effect(() => {
     const b = storage.bucket;
@@ -36,6 +97,8 @@
 <svelte:window onkeydown={storage.handleKeydown} />
 
 <div class="bg-base-100 flex flex-1 flex-col overflow-hidden">
+  <TabBar {tabsState} />
+
   <StorageBreadcrumb />
 
   <div bind:this={objectListEl} class="relative min-h-0 flex-1 overflow-hidden">
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 33fd862e..94602e2a 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -10,14 +10,17 @@
   import IconMoreVert from 'virtual:icons/material-symbols/more-vert';
   import IconPushPin from 'virtual:icons/material-symbols/push-pin';
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
+  import IconTab from 'virtual:icons/material-symbols/tab';
   import IconAdd from 'virtual:icons/material-symbols/add';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
+  import { getTabsState } from '$lib/storage/tabs-context.js';
   import type { StorageLocation } from '$lib/storage/types.js';
   import { invalidateAll } from '$app/navigation';
   import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 
   const storage = getStorageState();
+  const tabsState = getTabsState();
 
   const breadcrumbParts = $derived(
     storage.prefix
@@ -489,6 +492,19 @@
         border p-1 shadow-lg
       "
     >
+      <li role="none">
+        <button
+          role="menuitem"
+          class="justify-start text-sm"
+          onclick={() => {
+            tabsState.addTab();
+            (document.activeElement as HTMLElement | null)?.blur();
+          }}
+        >
+          <IconTab class="size-4 shrink-0" aria-hidden="true" />
+          {m.storage_tab_new()}
+        </button>
+      </li>
       <li role="none">
         {#if currentIsPinned}
           {@const PinIcon2 = IconPushPin}
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
index 44e0a6d8..b2a86095 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
@@ -4,6 +4,7 @@ import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import StorageBreadcrumbWrapper from './__tests__/StorageBreadcrumbWrapper.svelte';
 import { StorageState } from '$lib/storage/state.svelte.js';
+import { TabsState } from '$lib/storage/tabs.svelte.js';
 import type { StorageObject } from '$lib/storage/types.js';
 
 function makeFolders(count: number): StorageObject[] {
@@ -222,10 +223,10 @@ describe('StorageBreadcrumb', () => {
       const moreBtn = page.getByRole('button', { name: /more options/i });
       await moreBtn.click();
 
-      // DaisyUI dropdown uses focus to show content; click the menuitem
+      // The more-options dropdown now has: 0="New Tab", 1="Pin this location"
+      // Use .nth(1) to target the pin item, with direct DOM dispatch as fallback
       const menuItems = page.getByRole('menuitem');
-      // Force the click by using element()
-      const el = menuItems.first();
+      const el = menuItems.nth(1);
       await el.click();
 
       // If DaisyUI dropdown prevents click, try direct dispatch
@@ -249,8 +250,9 @@ describe('StorageBreadcrumb', () => {
       const moreBtn = page.getByRole('button', { name: /more options/i });
       await moreBtn.click();
 
-      const menuItem = page.getByRole('menuitem');
-      await menuItem.first().click();
+      // Click the unpin menuitem specifically (not the first one which is now "New Tab")
+      const menuItem = page.getByRole('menuitem', { name: /unpin/i });
+      await menuItem.click();
       expect(spy).toHaveBeenCalledWith('test-bucket', 'data/');
     });
   });
@@ -392,8 +394,8 @@ describe('StorageBreadcrumb', () => {
       backdrop.dispatchEvent(new MouseEvent('mousedown', { bubbles: true }));
 
       // Context menu should be closed - menuitem from ctx menu should be gone
-      // The only remaining menuitem should be from the more options dropdown
-      await expect.element(page.getByRole('menuitem')).toBeInTheDocument(); // the one in more options
+      // The remaining menuitems should be from the more options dropdown (New Tab + Pin)
+      await expect.element(page.getByRole('menuitem').first()).toBeInTheDocument(); // the one in more options
     });
 
     it('should open context menu on right-click of bucket with prefix', async () => {
@@ -455,4 +457,30 @@ describe('StorageBreadcrumb', () => {
       await expect.element(moreBtn).not.toBeInTheDocument();
     });
   });
+
+  describe('new tab', () => {
+    it('should show "New Tab" option in the more options menu', async () => {
+      const state = createState();
+      render(StorageBreadcrumbWrapper, { state });
+
+      const moreBtn = page.getByRole('button', { name: /more options/i });
+      await moreBtn.click();
+
+      await expect.element(page.getByRole('menuitem', { name: 'New Tab' })).toBeInTheDocument();
+    });
+
+    it('should call tabsState.addTab when "New Tab" is clicked', async () => {
+      const state = createState({ bucket: 'test-bucket', prefix: 'data/' });
+      const tabsState = new TabsState(state);
+      const spy = vi.spyOn(tabsState, 'addTab');
+      render(StorageBreadcrumbWrapper, { state, tabsState });
+
+      const moreBtn = page.getByRole('button', { name: /more options/i });
+      await moreBtn.click();
+
+      await page.getByRole('menuitem', { name: 'New Tab' }).click();
+
+      expect(spy).toHaveBeenCalled();
+    });
+  });
 });
diff --git a/src/lib/components/storage/explorer/TabBar.svelte b/src/lib/components/storage/explorer/TabBar.svelte
new file mode 100644
index 00000000..391e4be3
--- /dev/null
+++ b/src/lib/components/storage/explorer/TabBar.svelte
@@ -0,0 +1,274 @@
+<script lang="ts">
+  import IconAdd from 'virtual:icons/material-symbols/add';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import * as m from '$lib/paraglide/messages.js';
+  import type { TabsState } from '$lib/storage/tabs.svelte.js';
+
+  interface Props {
+    tabsState: TabsState;
+  }
+
+  let { tabsState }: Props = $props();
+
+  // ── Overflow detection ──
+  let containerEl = $state<HTMLElement | null>(null);
+  let isOverflowRight = $state(false);
+  let isOverflowLeft = $state(false);
+
+  function checkOverflow() {
+    if (containerEl) {
+      const { scrollLeft, scrollWidth, clientWidth } = containerEl;
+      isOverflowLeft = scrollLeft > 0;
+      isOverflowRight = scrollLeft + clientWidth < scrollWidth - 1;
+    }
+  }
+
+  $effect(() => {
+    // Re-check overflow whenever tabs change
+    checkOverflow();
+  });
+
+  // ── Drag state ──
+  let dragIdx = $state<number | null>(null);
+  let dragOverIdx = $state<number | null>(null);
+
+  // ── Context menu ──
+  let ctxMenu = $state<{ x: number; y: number; tabId: string } | null>(null);
+
+  // ── Rename state ──
+  let renamingId = $state<string | null>(null);
+  let renameValue = $state('');
+
+  function handleMiddleClick(e: MouseEvent, tabId: string) {
+    if (e.button === 1) {
+      e.preventDefault();
+      tabsState.closeTab(tabId);
+    }
+  }
+
+  function openCtxMenu(e: MouseEvent, tabId: string) {
+    e.preventDefault();
+    ctxMenu = { x: e.clientX, y: e.clientY, tabId };
+  }
+
+  function closeCtxMenu() {
+    ctxMenu = null;
+  }
+
+  function startRename(tabId: string) {
+    const tab = tabsState.tabs.find((t) => t.id === tabId);
+    if (!tab) return;
+    renamingId = tabId;
+    renameValue = tab.label;
+    closeCtxMenu();
+  }
+
+  function commitRename() {
+    if (renamingId && renameValue.trim()) {
+      tabsState.renameTab(renamingId, renameValue.trim());
+    }
+    renamingId = null;
+    renameValue = '';
+  }
+
+  function cancelRename() {
+    renamingId = null;
+    renameValue = '';
+  }
+
+  function handleRenameKeydown(e: KeyboardEvent) {
+    if (e.key === 'Enter') {
+      e.preventDefault();
+      commitRename();
+    } else if (e.key === 'Escape') {
+      e.preventDefault();
+      cancelRename();
+    }
+  }
+
+  function handleWheel(e: WheelEvent) {
+    const container = e.currentTarget as HTMLElement;
+    if (container.scrollWidth > container.clientWidth) {
+      e.preventDefault();
+      container.scrollLeft += e.deltaY;
+    }
+  }
+
+  // ── Drag handlers ──
+  function handleDragStart(e: DragEvent, idx: number) {
+    dragIdx = idx;
+    if (e.dataTransfer) {
+      e.dataTransfer.effectAllowed = 'move';
+      e.dataTransfer.setData('text/plain', String(idx));
+    }
+  }
+
+  function handleDragOver(e: DragEvent, idx: number) {
+    e.preventDefault();
+    dragOverIdx = idx;
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+  }
+
+  function handleDrop(e: DragEvent, toIdx: number) {
+    e.preventDefault();
+    if (dragIdx !== null && dragIdx !== toIdx) {
+      tabsState.reorderTabs(dragIdx, toIdx);
+    }
+    dragIdx = null;
+    dragOverIdx = null;
+  }
+
+  function handleDragEnd() {
+    dragIdx = null;
+    dragOverIdx = null;
+  }
+</script>
+
+{#if ctxMenu}
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div class="fixed inset-0 z-40" onmousedown={closeCtxMenu}></div>
+  <ul
+    class="menu menu-sm border-base-300 bg-base-100 fixed z-60 w-44 rounded-lg border p-1 shadow-lg"
+    role="menu"
+    aria-label={m.storage_tab_context_menu()}
+    style="left: {ctxMenu.x}px; top: {ctxMenu.y}px;"
+  >
+    <li role="none">
+      <button
+        role="menuitem"
+        class="justify-start text-sm"
+        onclick={() => startRename(ctxMenu!.tabId)}
+      >
+        {m.storage_tab_rename()}
+      </button>
+    </li>
+    <li role="none">
+      <button
+        role="menuitem"
+        class="text-error justify-start text-sm"
+        onclick={() => {
+          tabsState.closeTab(ctxMenu!.tabId);
+          closeCtxMenu();
+        }}
+      >
+        {m.storage_tab_close()}
+      </button>
+    </li>
+  </ul>
+{/if}
+
+{#if tabsState.hasTabs}
+  <div class="bg-base-200/60 relative flex items-end pt-1.5 pl-2">
+    <!-- Tab list container — hidden scrollbar, overlapping tabs -->
+    <div
+      bind:this={containerEl}
+      class="tab-strip flex min-w-0 flex-1 items-end"
+      role="tablist"
+      aria-label={m.storage_tab_list()}
+      onwheel={handleWheel}
+      onscroll={checkOverflow}
+    >
+      {#each tabsState.tabs as tab, idx (tab.id)}
+        {@const isActive = tab.id === tabsState.activeTabId}
+        {#if renamingId === tab.id}
+          <div
+            class="bg-base-100 border-base-300 relative z-30 flex shrink-0 items-center rounded-t-lg border border-b-0 px-3 py-1.5 shadow-sm"
+            style="margin-right: -8px;"
+          >
+            <input
+              type="text"
+              class="border-base-300 focus:border-primary h-4 w-24 rounded border bg-transparent px-1 py-0 text-xs focus:outline-none"
+              bind:value={renameValue}
+              onblur={commitRename}
+              onkeydown={handleRenameKeydown}
+              autofocus
+              aria-label={m.storage_tab_rename()}
+            />
+          </div>
+        {:else}
+          <button
+            role="tab"
+            aria-selected={isActive}
+            class="group relative flex max-w-44 shrink-0 items-center gap-1.5 rounded-t-lg border border-b-0 px-4 py-1.5 text-xs
+              transition-all select-none
+              {isActive
+              ? 'bg-base-100 border-base-300 text-base-content z-20 font-medium shadow-sm'
+              : 'text-base-content/60 hover:text-base-content/80 hover:bg-base-100/50 z-10 border-transparent'}"
+            style="margin-right: -8px;"
+            draggable="true"
+            class:opacity-50={dragIdx === idx}
+            class:!border-primary={dragOverIdx === idx && dragIdx !== idx}
+            onclick={() => tabsState.switchTo(tab.id)}
+            ondblclick={() => startRename(tab.id)}
+            onmousedown={(e) => handleMiddleClick(e, tab.id)}
+            onauxclick={(e) => handleMiddleClick(e, tab.id)}
+            oncontextmenu={(e) => openCtxMenu(e, tab.id)}
+            ondragstart={(e) => handleDragStart(e, idx)}
+            ondragover={(e) => handleDragOver(e, idx)}
+            ondrop={(e) => handleDrop(e, idx)}
+            ondragend={handleDragEnd}
+            title={tab.label}
+          >
+            <span class="truncate">{tab.label}</span>
+            {#if tabsState.tabs.length > 1}
+              <span
+                class="text-base-content/40 hover:text-error shrink-0 rounded-full p-0.5 opacity-0 transition-opacity group-hover:opacity-100"
+                role="button"
+                tabindex="-1"
+                aria-label={m.storage_tab_close()}
+                onclick={(e) => {
+                  e.stopPropagation();
+                  tabsState.closeTab(tab.id);
+                }}
+                onkeydown={(e) => {
+                  if (e.key === 'Enter' || e.key === ' ') {
+                    e.stopPropagation();
+                    tabsState.closeTab(tab.id);
+                  }
+                }}
+              >
+                <IconClose class="size-3" aria-hidden="true" />
+              </span>
+            {/if}
+          </button>
+        {/if}
+      {/each}
+
+      <!-- Plus button — sits inline next to the last tab -->
+      <button
+        class="btn btn-ghost btn-xs z-20 ml-2 shrink-0"
+        title={m.storage_tab_new()}
+        aria-label={m.storage_tab_new()}
+        onclick={() => tabsState.addTab()}
+      >
+        <IconAdd class="size-3.5" aria-hidden="true" />
+      </button>
+    </div>
+
+    <!-- Fade-out gradient indicating more tabs to the left -->
+    {#if isOverflowLeft}
+      <div
+        class="from-base-200/60 pointer-events-none absolute top-0 bottom-0 left-0 z-30 w-12 bg-gradient-to-r to-transparent"
+        aria-hidden="true"
+      ></div>
+    {/if}
+
+    <!-- Fade-out gradient indicating more tabs to the right -->
+    {#if isOverflowRight}
+      <div
+        class="from-base-200/60 pointer-events-none absolute top-0 right-0 bottom-0 z-30 w-12 bg-gradient-to-l to-transparent"
+        aria-hidden="true"
+      ></div>
+    {/if}
+  </div>
+{/if}
+
+<style>
+  .tab-strip {
+    overflow-x: auto;
+    scrollbar-width: none; /* Firefox */
+  }
+  .tab-strip::-webkit-scrollbar {
+    display: none; /* Chrome/Safari */
+  }
+</style>
diff --git a/src/lib/components/storage/explorer/TabBar.svelte.spec.ts b/src/lib/components/storage/explorer/TabBar.svelte.spec.ts
new file mode 100644
index 00000000..9df5896c
--- /dev/null
+++ b/src/lib/components/storage/explorer/TabBar.svelte.spec.ts
@@ -0,0 +1,207 @@
+import { page, userEvent } from 'vitest/browser';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import TabBar from './TabBar.svelte';
+import { TabsState } from '$lib/storage/tabs.svelte.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function makeStorage(bucket = 'test-bucket', prefix = ''): StorageState {
+  const state = new StorageState({ connected: true });
+  state.bucket = bucket;
+  state.prefix = prefix;
+  state.objects = { objects: [], hasNextPage: false, currentPage: 1, pageSize: 25 };
+  return state;
+}
+
+function makeTabsState(storage: StorageState, tabCount = 2): TabsState {
+  const ts = new TabsState(storage, { persistEnabled: false });
+  ts.ensureInitialTab();
+  for (let i = 1; i < tabCount; i++) {
+    ts.addTab();
+  }
+  return ts;
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────────
+
+describe('TabBar', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it('renders a tab for each entry in tabsState.tabs', async () => {
+    const storage = makeStorage('bucket-a');
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    const tabs = page.getByRole('tab');
+    // 2 tabs rendered
+    await expect.element(tabs.nth(0)).toBeInTheDocument();
+    await expect.element(tabs.nth(1)).toBeInTheDocument();
+  });
+
+  it('marks the active tab with aria-selected="true"', async () => {
+    const storage = makeStorage('bucket-a');
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    const activeTab = page.getByRole('tab', { selected: true });
+    await expect.element(activeTab).toBeInTheDocument();
+  });
+
+  it('has a tablist with an accessible label', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    await expect.element(page.getByRole('tablist')).toBeInTheDocument();
+  });
+
+  it('renders a "New Tab" plus button', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    await expect.element(page.getByRole('button', { name: 'New Tab' })).toBeInTheDocument();
+  });
+
+  it('calls addTab when the plus button is clicked', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    const spy = vi.spyOn(tabsState, 'addTab');
+    render(TabBar, { tabsState });
+
+    await page.getByRole('button', { name: 'New Tab' }).click();
+
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('calls switchTo with the correct id when a non-active tab is clicked', async () => {
+    const storage = makeStorage('bucket', '');
+    const tabsState = makeTabsState(storage, 2);
+    // After makeTabsState(2): tabs[0] is the initial tab (not active), tabs[1] is active
+    const spy = vi.spyOn(tabsState, 'switchTo');
+    render(TabBar, { tabsState });
+
+    // Click the first tab (not the active one)
+    await page.getByRole('tab').nth(0).click();
+
+    expect(spy).toHaveBeenCalledWith(tabsState.tabs[0].id);
+  });
+
+  it('shows close buttons when multiple tabs exist', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    // Close tab buttons have aria-label="Close tab"
+    const closeButtons = page.getByRole('button', { name: 'Close tab' });
+    await expect.element(closeButtons.first()).toBeInTheDocument();
+  });
+
+  it('calls closeTab when a close button is clicked', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    const spy = vi.spyOn(tabsState, 'closeTab');
+    render(TabBar, { tabsState });
+
+    await page.getByRole('button', { name: 'Close tab' }).first().click();
+
+    expect(spy).toHaveBeenCalled();
+  });
+
+  it('opens a context menu on right-click of a tab', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    await page.getByRole('tab').first().click({ button: 'right' });
+
+    await expect.element(page.getByRole('menu')).toBeInTheDocument();
+  });
+
+  it('context menu contains Rename tab and Close tab options', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    await page.getByRole('tab').first().click({ button: 'right' });
+
+    await expect.element(page.getByRole('menuitem', { name: 'Rename tab' })).toBeInTheDocument();
+    await expect.element(page.getByRole('menuitem', { name: 'Close tab' })).toBeInTheDocument();
+  });
+
+  it('calls renameTab via context menu rename action', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    const spy = vi.spyOn(tabsState, 'renameTab');
+    render(TabBar, { tabsState });
+
+    const firstTabId = tabsState.tabs[0].id;
+    await page.getByRole('tab').first().click({ button: 'right' });
+    await page.getByRole('menuitem', { name: 'Rename tab' }).click();
+
+    // The rename input should appear (context menu closes and rename mode starts)
+    await expect.element(page.getByRole('textbox', { name: 'Rename tab' })).toBeInTheDocument();
+
+    await page.getByRole('textbox', { name: 'Rename tab' }).fill('Renamed');
+    await userEvent.keyboard('{Enter}');
+
+    expect(spy).toHaveBeenCalledWith(firstTabId, 'Renamed');
+  });
+
+  it('shows rename input on double-click of a tab', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    render(TabBar, { tabsState });
+
+    await page.getByRole('tab').first().dblClick();
+
+    await expect.element(page.getByRole('textbox', { name: 'Rename tab' })).toBeInTheDocument();
+  });
+
+  it('commits rename on Enter key', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    const spy = vi.spyOn(tabsState, 'renameTab');
+    render(TabBar, { tabsState });
+
+    const firstTabId = tabsState.tabs[0].id;
+    await page.getByRole('tab').first().dblClick();
+
+    await page.getByRole('textbox', { name: 'Rename tab' }).fill('My New Name');
+    await userEvent.keyboard('{Enter}');
+
+    expect(spy).toHaveBeenCalledWith(firstTabId, 'My New Name');
+  });
+
+  it('cancels rename on Escape key without calling renameTab', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    const spy = vi.spyOn(tabsState, 'renameTab');
+    render(TabBar, { tabsState });
+
+    await page.getByRole('tab').first().dblClick();
+
+    await page.getByRole('textbox', { name: 'Rename tab' }).fill('Something');
+    await userEvent.keyboard('{Escape}');
+
+    expect(spy).not.toHaveBeenCalled();
+    await expect.element(page.getByRole('textbox', { name: 'Rename tab' })).not.toBeInTheDocument();
+  });
+
+  it('calls closeTab via context menu close action', async () => {
+    const storage = makeStorage();
+    const tabsState = makeTabsState(storage, 2);
+    const spy = vi.spyOn(tabsState, 'closeTab');
+    const firstTabId = tabsState.tabs[0].id;
+    render(TabBar, { tabsState });
+
+    await page.getByRole('tab').first().click({ button: 'right' });
+    await page.getByRole('menuitem', { name: 'Close tab' }).click();
+
+    expect(spy).toHaveBeenCalledWith(firstTabId);
+  });
+});
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
index 073599f2..4fb7235f 100644
--- a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
@@ -1,15 +1,22 @@
 <script lang="ts">
   import { untrack } from 'svelte';
   import { setStorageState } from '$lib/storage/context.js';
+  import { setTabsState } from '$lib/storage/tabs-context.js';
+  import { TabsState } from '$lib/storage/tabs.svelte.js';
   import type { StorageState } from '$lib/storage/state.svelte.js';
   import StorageBreadcrumb from '../StorageBreadcrumb.svelte';
 
   interface Props {
     state: StorageState;
+    tabsState?: TabsState;
   }
 
-  let { state }: Props = $props();
-  untrack(() => setStorageState(state));
+  let { state, tabsState: tabsStateProp }: Props = $props();
+  const effectiveTabsState = tabsStateProp ?? new TabsState(state);
+  untrack(() => {
+    setStorageState(state);
+    setTabsState(effectiveTabsState);
+  });
 </script>
 
 <StorageBreadcrumb />
diff --git a/src/lib/storage/persistence.ts b/src/lib/storage/persistence.ts
index d295fd7b..47afae5b 100644
--- a/src/lib/storage/persistence.ts
+++ b/src/lib/storage/persistence.ts
@@ -5,6 +5,7 @@ import { browser } from '$app/environment';
 export const LS_PINS = 'pinned_storage_locations';
 export const LS_RECENT_FILES = 'recent_storage_files';
 export const LS_RECENT_LOCATIONS = 'recent_storage_locations';
+export const LS_TABS = 'storage_tabs';
 
 // ── Utilities ────────────────────────────────────────────────────────────────
 
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 3e9d7fbc..f0cb6d8a 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -76,6 +76,9 @@ export class StorageState {
   loading = $state(false);
   deleting = $state(false);
 
+  // ── Connection identity ──
+  connectionId = $state<string | null>(null);
+
   // ── Pagination ──
   prevTokens = $state<(string | null)[]>([]);
   pageSize = $state<PageSize>(initPageSize('storage_page_size'));
@@ -86,14 +89,20 @@ export class StorageState {
 
   // ── Navigation handler (injected by page component) ──
   private _onNavigate: NavigateFn = () => {};
+  // ── Refresh handler (injected by page component) ──
+  // Navigates to the current bucket/prefix using replaceState so that a
+  // refresh does not add an extra browser history entry. Falls back to
+  // invalidateAll when no handler has been set (e.g. in tests).
+  private _onRefreshNavigate: (() => void) | null = null;
 
   // ────────────────────────────────────────────────────────────────────────────
   // Constructor
   // ────────────────────────────────────────────────────────────────────────────
 
-  constructor(options?: { connected?: boolean; buckets?: string[] }) {
+  constructor(options?: { connected?: boolean; buckets?: string[]; connectionId?: string | null }) {
     if (options?.connected !== undefined) this.connected = options.connected;
     if (options?.buckets) this.buckets = options.buckets;
+    if (options?.connectionId !== undefined) this.connectionId = options.connectionId;
   }
 
   // ────────────────────────────────────────────────────────────────────────────
@@ -115,6 +124,10 @@ export class StorageState {
     this._onNavigate = fn;
   }
 
+  setRefreshHandler(fn: () => void): void {
+    this._onRefreshNavigate = fn;
+  }
+
   // ────────────────────────────────────────────────────────────────────────────
   // Selection
   // ────────────────────────────────────────────────────────────────────────────
@@ -184,7 +197,11 @@ export class StorageState {
 
   refresh = (): void => {
     this.loading = true;
-    void invalidateAll();
+    if (this._onRefreshNavigate) {
+      this._onRefreshNavigate();
+    } else {
+      void invalidateAll();
+    }
   };
 
   onPageSizeChange = (): void => {
diff --git a/src/lib/storage/tabs-context.ts b/src/lib/storage/tabs-context.ts
new file mode 100644
index 00000000..6dfeb939
--- /dev/null
+++ b/src/lib/storage/tabs-context.ts
@@ -0,0 +1,4 @@
+import { createContext } from 'svelte';
+import type { TabsState } from './tabs.svelte.js';
+
+export const [getTabsState, setTabsState] = createContext<TabsState>();
diff --git a/src/lib/storage/tabs.svelte.spec.ts b/src/lib/storage/tabs.svelte.spec.ts
new file mode 100644
index 00000000..6f39d943
--- /dev/null
+++ b/src/lib/storage/tabs.svelte.spec.ts
@@ -0,0 +1,576 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import {
+  TabsState,
+  requestTabsRestore,
+  type PersistedTabsState
+} from '$lib/storage/tabs.svelte.js';
+import { StorageState } from '$lib/storage/state.svelte.js';
+import { LS_TABS } from '$lib/storage/persistence.js';
+
+// ── Helpers ──────────────────────────────────────────────────────────────────
+
+function makeStorage(bucket = 'test-bucket', prefix = ''): StorageState {
+  const state = new StorageState({ connected: true });
+  state.bucket = bucket;
+  state.prefix = prefix;
+  state.objects = { objects: [], hasNextPage: false, currentPage: 1, pageSize: 25 };
+  return state;
+}
+
+function makeTabs(
+  storage: StorageState,
+  opts?: { persistEnabled?: boolean; connectionId?: string | null }
+) {
+  const navigateToLocation = vi.fn();
+  const replaceLocationUrl = vi.fn();
+  const ts = new TabsState(storage, {
+    persistEnabled: opts?.persistEnabled ?? false,
+    connectionId: opts?.connectionId ?? null,
+    navigateToLocation,
+    replaceLocationUrl
+  });
+  return { ts, navigateToLocation, replaceLocationUrl };
+}
+
+// ── Tests ─────────────────────────────────────────────────────────────────────
+
+describe('TabsState', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  // ── ensureInitialTab ──────────────────────────────────────────────────────
+
+  describe('ensureInitialTab', () => {
+    it('creates an initial tab from storage state', () => {
+      const storage = makeStorage('my-bucket', '');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      expect(ts.tabs.length).toBe(1);
+      expect(ts.tabs[0].label).toBe('my-bucket');
+      expect(ts.tabs[0].stub).toBe(false);
+      expect(ts.activeTabId).toBe(ts.tabs[0].id);
+    });
+
+    it('uses last path segment as label when prefix is set', () => {
+      const storage = makeStorage('bucket', 'reports/2024/');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      expect(ts.tabs[0].label).toBe('2024');
+    });
+
+    it('is a no-op when tabs already exist', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.ensureInitialTab();
+
+      expect(ts.tabs.length).toBe(1);
+    });
+  });
+
+  // ── hasTabs ───────────────────────────────────────────────────────────────
+
+  describe('hasTabs', () => {
+    it('returns false with one tab', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      expect(ts.hasTabs).toBe(false);
+    });
+
+    it('returns true with two or more tabs', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+
+      expect(ts.hasTabs).toBe(true);
+    });
+  });
+
+  // ── addTab ────────────────────────────────────────────────────────────────
+
+  describe('addTab', () => {
+    it('appends a tab at the current location', () => {
+      const storage = makeStorage('bucket', 'folder/');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+
+      expect(ts.tabs.length).toBe(2);
+      expect(ts.activeTabId).toBe(ts.tabs[1].id);
+      expect(ts.tabs[1].label).toBe('folder');
+    });
+
+    it('new tab is not a stub', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+
+      expect(ts.tabs[1].stub).toBe(false);
+    });
+
+    it('snapshot captures current storage state', () => {
+      const storage = makeStorage('bucket', 'data/');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      storage.prefix = 'other/';
+      ts.addTab();
+
+      expect(ts.tabs[1].snapshot.prefix).toBe('other/');
+    });
+  });
+
+  // ── switchTo ──────────────────────────────────────────────────────────────
+
+  describe('switchTo', () => {
+    it('is a no-op when switching to the already-active tab', () => {
+      const storage = makeStorage();
+      const { ts, replaceLocationUrl, navigateToLocation } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      ts.switchTo(ts.activeTabId!);
+
+      expect(replaceLocationUrl).not.toHaveBeenCalled();
+      expect(navigateToLocation).not.toHaveBeenCalled();
+    });
+
+    it('restores snapshot and calls replaceLocationUrl for non-stub tab', () => {
+      const storage = makeStorage('bucket', 'a/');
+      const { ts, replaceLocationUrl } = makeTabs(storage);
+      ts.ensureInitialTab(); // tabs[0] = {prefix:'a/'}, active
+
+      // Add a second tab at the same location, then navigate the second tab to 'b/'
+      ts.addTab(); // tabs[1] = {prefix:'a/'}, active = tabs[1]
+      storage.prefix = 'b/';
+      ts.syncActiveTab(); // tabs[1].snapshot.prefix = 'b/'
+
+      // Now: tabs[0]={prefix:'a/'}, tabs[1]={prefix:'b/'} (active)
+      ts.switchTo(ts.tabs[0].id);
+
+      expect(storage.prefix).toBe('a/');
+      expect(replaceLocationUrl).toHaveBeenCalledWith('bucket', 'a/');
+    });
+
+    it('calls navigateToLocation for a stub tab', () => {
+      const storage = makeStorage('bucket', 'a/');
+      const { ts, navigateToLocation } = makeTabs(storage);
+
+      const saved: PersistedTabsState = {
+        tabs: [
+          { id: 'a', label: 'A', bucket: 'bucket', prefix: 'a/' },
+          { id: 'b', label: 'B', bucket: 'bucket', prefix: 'b/' }
+        ],
+        activeTabId: 'a'
+      };
+      ts.restorePersistedTabs(saved);
+      // tabs[0] gets markActiveTabLoaded() because storage matches 'a/'
+      // tabs[1] stays as a stub
+
+      ts.switchTo(ts.tabs[1].id);
+
+      expect(navigateToLocation).toHaveBeenCalledWith('bucket', 'b/');
+    });
+
+    it('sets activeTabId to the switched-to tab', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+      const firstId = ts.tabs[0].id;
+
+      ts.switchTo(firstId);
+
+      expect(ts.activeTabId).toBe(firstId);
+    });
+  });
+
+  // ── closeTab ──────────────────────────────────────────────────────────────
+
+  describe('closeTab', () => {
+    it('removes the tab from the list', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+      const firstId = ts.tabs[0].id;
+
+      ts.closeTab(firstId);
+
+      expect(ts.tabs.length).toBe(1);
+      expect(ts.tabs.find((t) => t.id === firstId)).toBeUndefined();
+    });
+
+    it('switches to an adjacent tab when the active tab is closed', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+      const secondId = ts.tabs[1].id;
+
+      ts.closeTab(secondId); // active tab closed
+
+      expect(ts.activeTabId).toBe(ts.tabs[0].id);
+    });
+
+    it('does not close the only remaining tab', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      ts.closeTab(ts.tabs[0].id);
+
+      expect(ts.tabs.length).toBe(1);
+    });
+  });
+
+  // ── renameTab ─────────────────────────────────────────────────────────────
+
+  describe('renameTab', () => {
+    it('renames the tab with the given id', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      ts.renameTab(ts.tabs[0].id, 'My Custom Name');
+
+      expect(ts.tabs[0].label).toBe('My Custom Name');
+    });
+
+    it('is a no-op for an unknown id', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      ts.renameTab('nonexistent-id', 'New Name');
+
+      expect(ts.tabs[0].label).toBe('test-bucket');
+    });
+  });
+
+  // ── reorderTabs ───────────────────────────────────────────────────────────
+
+  describe('reorderTabs', () => {
+    it('moves a tab from one index to another', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+      ts.addTab();
+      const ids = ts.tabs.map((t) => t.id);
+
+      ts.reorderTabs(0, 2);
+
+      expect(ts.tabs[2].id).toBe(ids[0]);
+      expect(ts.tabs[0].id).toBe(ids[1]);
+    });
+
+    it('is a no-op when fromIdx === toIdx', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+      const ids = ts.tabs.map((t) => t.id);
+
+      ts.reorderTabs(0, 0);
+
+      expect(ts.tabs.map((t) => t.id)).toEqual(ids);
+    });
+  });
+
+  // ── syncActiveTab ─────────────────────────────────────────────────────────
+
+  describe('syncActiveTab', () => {
+    it('updates snapshot bucket and prefix from current storage state', () => {
+      const storage = makeStorage('bucket', 'old/');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      storage.prefix = 'new/';
+      ts.syncActiveTab();
+
+      expect(ts.tabs[0].snapshot.prefix).toBe('new/');
+    });
+
+    it('updates the auto-generated label to match new location', () => {
+      const storage = makeStorage('bucket', 'old/');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      storage.prefix = 'new/';
+      ts.syncActiveTab();
+
+      expect(ts.tabs[0].label).toBe('new');
+    });
+
+    it('preserves a custom label that was manually set', () => {
+      const storage = makeStorage('bucket', 'folder/');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.renameTab(ts.tabs[0].id, 'My Custom');
+
+      storage.prefix = 'other/';
+      ts.syncActiveTab();
+
+      expect(ts.tabs[0].label).toBe('My Custom');
+    });
+  });
+
+  // ── markActiveTabLoaded ───────────────────────────────────────────────────
+
+  describe('markActiveTabLoaded', () => {
+    it('clears the stub flag on the active tab', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      // Force it to be a stub
+      ts.tabs = [{ ...ts.tabs[0], stub: true }];
+
+      ts.markActiveTabLoaded();
+
+      expect(ts.tabs[0].stub).toBe(false);
+    });
+
+    it('is a no-op when the active tab is not a stub', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+
+      // Should not throw or mutate
+      ts.markActiveTabLoaded();
+
+      expect(ts.tabs[0].stub).toBe(false);
+    });
+  });
+
+  // ── persistence ───────────────────────────────────────────────────────────
+
+  describe('peekPersistedTabs', () => {
+    it('returns null when persistence is disabled', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage, { persistEnabled: false });
+
+      expect(ts.peekPersistedTabs()).toBeNull();
+    });
+
+    it('returns null when nothing is saved in localStorage', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage, { persistEnabled: true });
+
+      expect(ts.peekPersistedTabs()).toBeNull();
+    });
+
+    it('returns saved data after ensureInitialTab saves it', () => {
+      const storage = makeStorage('bucket', '');
+      const { ts } = makeTabs(storage, { persistEnabled: true });
+      ts.ensureInitialTab();
+
+      const peeked = ts.peekPersistedTabs();
+
+      expect(peeked).not.toBeNull();
+      expect(peeked!.tabs[0].bucket).toBe('bucket');
+    });
+
+    it('returns null for a different connectionId', () => {
+      const saved: PersistedTabsState = {
+        tabs: [{ id: '1', label: 'Bucket', bucket: 'bucket', prefix: '' }],
+        activeTabId: '1',
+        connectionId: 'conn-a'
+      };
+      localStorage.setItem(LS_TABS, JSON.stringify(saved));
+
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage, { persistEnabled: true, connectionId: 'conn-b' });
+
+      expect(ts.peekPersistedTabs()).toBeNull();
+    });
+
+    it('accepts saved data with no connectionId (backward compatibility)', () => {
+      const saved: PersistedTabsState = {
+        tabs: [{ id: '1', label: 'Bucket', bucket: 'bucket', prefix: '' }],
+        activeTabId: '1'
+        // connectionId absent intentionally
+      };
+      localStorage.setItem(LS_TABS, JSON.stringify(saved));
+
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage, { persistEnabled: true, connectionId: 'conn-a' });
+
+      expect(ts.peekPersistedTabs()).not.toBeNull();
+    });
+
+    it('accepts saved data when connectionIds match', () => {
+      const saved: PersistedTabsState = {
+        tabs: [{ id: '1', label: 'Bucket', bucket: 'bucket', prefix: '' }],
+        activeTabId: '1',
+        connectionId: 'conn-a'
+      };
+      localStorage.setItem(LS_TABS, JSON.stringify(saved));
+
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage, { persistEnabled: true, connectionId: 'conn-a' });
+
+      expect(ts.peekPersistedTabs()).not.toBeNull();
+    });
+  });
+
+  describe('clearPersistedTabs', () => {
+    it('removes the entry from localStorage', () => {
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage, { persistEnabled: true });
+      ts.ensureInitialTab();
+
+      ts.clearPersistedTabs();
+
+      expect(localStorage.getItem(LS_TABS)).toBeNull();
+    });
+  });
+
+  describe('ensureInitialTab persistence write', () => {
+    it('writes tab data to localStorage when persistEnabled', () => {
+      const storage = makeStorage('bucket', '');
+      const { ts } = makeTabs(storage, { persistEnabled: true });
+      ts.ensureInitialTab();
+
+      const raw = localStorage.getItem(LS_TABS);
+      expect(raw).not.toBeNull();
+      const parsed = JSON.parse(raw!) as PersistedTabsState;
+      expect(parsed.tabs.length).toBe(1);
+      expect(parsed.tabs[0].bucket).toBe('bucket');
+    });
+  });
+
+  // ── restorePersistedTabs ──────────────────────────────────────────────────
+
+  describe('restorePersistedTabs', () => {
+    it('creates stub tabs from saved data', () => {
+      const saved: PersistedTabsState = {
+        tabs: [
+          { id: 'old1', label: 'Tab A', bucket: 'bucket', prefix: 'folder/' },
+          { id: 'old2', label: 'Tab B', bucket: 'bucket', prefix: 'other/' }
+        ],
+        activeTabId: 'old2'
+      };
+      const storage = makeStorage('bucket', 'folder/');
+      const { ts } = makeTabs(storage);
+      ts.restorePersistedTabs(saved);
+
+      expect(ts.tabs.length).toBe(2);
+      expect(ts.tabs[0].label).toBe('Tab A');
+      expect(ts.tabs[1].label).toBe('Tab B');
+    });
+
+    it('sets activeTabId to the saved active tab (by position)', () => {
+      const saved: PersistedTabsState = {
+        tabs: [
+          { id: 'a', label: 'A', bucket: 'b', prefix: '' },
+          { id: 'b', label: 'B', bucket: 'b', prefix: 'x/' }
+        ],
+        activeTabId: 'b'
+      };
+      const storage = makeStorage('b', '');
+      const { ts } = makeTabs(storage);
+      ts.restorePersistedTabs(saved);
+
+      // activeTabId should correspond to the second tab (position index 1)
+      expect(ts.activeTabId).toBe(ts.tabs[1].id);
+    });
+
+    it('generates fresh UUIDs — does not reuse the saved ids', () => {
+      const saved: PersistedTabsState = {
+        tabs: [{ id: 'old-id', label: 'A', bucket: 'b', prefix: '' }],
+        activeTabId: 'old-id'
+      };
+      const storage = makeStorage();
+      const { ts } = makeTabs(storage);
+      ts.restorePersistedTabs(saved);
+
+      expect(ts.tabs[0].id).not.toBe('old-id');
+    });
+
+    it('marks active tab as loaded when storage is already at that location', () => {
+      const saved: PersistedTabsState = {
+        tabs: [{ id: '1', label: 'Bucket', bucket: 'test-bucket', prefix: '' }],
+        activeTabId: '1'
+      };
+      const storage = makeStorage('test-bucket', '');
+      const { ts } = makeTabs(storage);
+      ts.restorePersistedTabs(saved);
+
+      expect(ts.tabs[0].stub).toBe(false);
+    });
+
+    it('leaves tab as stub when storage location differs from active tab', () => {
+      const saved: PersistedTabsState = {
+        tabs: [
+          { id: 'a', label: 'A', bucket: 'bucket', prefix: 'a/' },
+          { id: 'b', label: 'B', bucket: 'bucket', prefix: 'b/' }
+        ],
+        activeTabId: 'b'
+      };
+      const storage = makeStorage('bucket', 'a/'); // at a/, but active tab is b/
+      const { ts, navigateToLocation } = makeTabs(storage);
+      ts.restorePersistedTabs(saved);
+
+      // Active tab (b/) is a stub and storage is at a/ → navigate is called
+      expect(navigateToLocation).toHaveBeenCalledWith('bucket', 'b/');
+    });
+  });
+
+  // ── requestTabsRestore ────────────────────────────────────────────────────
+
+  describe('requestTabsRestore', () => {
+    it('triggers restore on the next ensureInitialTab call when persistEnabled', () => {
+      const saved: PersistedTabsState = {
+        tabs: [
+          { id: 'a', label: 'A', bucket: 'b1', prefix: '' },
+          { id: 'b', label: 'B', bucket: 'b2', prefix: '' }
+        ],
+        activeTabId: 'a'
+      };
+      localStorage.setItem(LS_TABS, JSON.stringify(saved));
+
+      requestTabsRestore();
+
+      const storage = makeStorage('b1', '');
+      const { ts } = makeTabs(storage, { persistEnabled: true });
+      ts.ensureInitialTab();
+
+      // Should have restored 2 tabs rather than creating 1 fresh tab
+      expect(ts.tabs.length).toBe(2);
+    });
+
+    it('flag is consumed after ensureInitialTab so subsequent calls start fresh', () => {
+      const saved: PersistedTabsState = {
+        tabs: [
+          { id: 'a', label: 'A', bucket: 'b1', prefix: '' },
+          { id: 'b', label: 'B', bucket: 'b2', prefix: '' }
+        ],
+        activeTabId: 'a'
+      };
+      localStorage.setItem(LS_TABS, JSON.stringify(saved));
+
+      requestTabsRestore();
+
+      // First TabsState consumes the flag
+      const storage1 = makeStorage('b1', '');
+      const { ts: ts1 } = makeTabs(storage1, { persistEnabled: true });
+      ts1.ensureInitialTab();
+      expect(ts1.tabs.length).toBe(2);
+
+      // Reset localStorage to simulate a fresh session
+      localStorage.setItem(LS_TABS, JSON.stringify(saved));
+
+      // Second TabsState — flag is already consumed, starts fresh
+      const storage2 = makeStorage('b1', '');
+      const { ts: ts2 } = makeTabs(storage2, { persistEnabled: true });
+      ts2.ensureInitialTab();
+      expect(ts2.tabs.length).toBe(1);
+    });
+  });
+});
diff --git a/src/lib/storage/tabs.svelte.ts b/src/lib/storage/tabs.svelte.ts
new file mode 100644
index 00000000..dc237d01
--- /dev/null
+++ b/src/lib/storage/tabs.svelte.ts
@@ -0,0 +1,339 @@
+import { browser } from '$app/environment';
+import type { StoragePage } from '$lib/storage/types.js';
+import type { PageSize } from '$lib/types/pagination.js';
+import type { StorageState } from './state.svelte.js';
+import { LS_TABS } from './persistence.js';
+
+// ── Tab data ─────────────────────────────────────────────────────────────────
+
+export interface TabSnapshot {
+  bucket: string;
+  prefix: string;
+  objects: StoragePage;
+  prevTokens: (string | null)[];
+  pageSize: PageSize;
+}
+
+export interface Tab {
+  id: string;
+  label: string;
+  /** True when this tab was restored from persistence and has not yet loaded
+   *  fresh data. Switching to a stub triggers a full navigation instead of a
+   *  snapshot restore. */
+  stub: boolean;
+  snapshot: TabSnapshot;
+}
+
+// ── Persistence schema ────────────────────────────────────────────────────────
+
+export interface PersistedTab {
+  id: string;
+  label: string;
+  bucket: string;
+  prefix: string;
+}
+
+export interface PersistedTabsState {
+  tabs: PersistedTab[];
+  activeTabId: string;
+  /** Fingerprint of the connection that saved these tabs.
+   *  Absent in data saved before this field was introduced (treated as a match
+   *  for any connection to preserve backward compatibility). */
+  connectionId?: string;
+}
+
+// ── Module-level restore request flag ────────────────────────────────────────
+// Set by the /storage banner when the user clicks "Restore tabs". Consumed
+// once by the next ensureInitialTab() call so the FileExplorer knows to
+// restore rather than start fresh. A module-level variable works here because
+// the banner navigates via SvelteKit (SPA navigation — no full page reload).
+
+let restoreRequestedOnNextMount = false;
+
+export function requestTabsRestore(): void {
+  restoreRequestedOnNextMount = true;
+}
+
+// ── Internal helpers ──────────────────────────────────────────────────────────
+
+const EMPTY_PAGE: StoragePage = { objects: [], hasNextPage: false, currentPage: 1, pageSize: 25 };
+
+// ── Tabs state ───────────────────────────────────────────────────────────────
+
+export class TabsState {
+  tabs = $state<Tab[]>([]);
+  activeTabId = $state<string | null>(null);
+
+  private storage: StorageState;
+  private persistEnabled: boolean;
+  private connectionId: string | null;
+  private navigateToLocation: ((bucket: string, prefix: string) => void) | null;
+  private replaceLocationUrl: ((bucket: string, prefix: string) => void) | null;
+
+  get hasTabs(): boolean {
+    return this.tabs.length > 1;
+  }
+
+  constructor(
+    storage: StorageState,
+    options?: {
+      persistEnabled?: boolean;
+      connectionId?: string | null;
+      navigateToLocation?: (bucket: string, prefix: string) => void;
+      replaceLocationUrl?: (bucket: string, prefix: string) => void;
+    }
+  ) {
+    this.storage = storage;
+    this.persistEnabled = options?.persistEnabled ?? false;
+    this.connectionId = options?.connectionId ?? null;
+    this.navigateToLocation = options?.navigateToLocation ?? null;
+    this.replaceLocationUrl = options?.replaceLocationUrl ?? null;
+  }
+
+  // ── Snapshot helpers ─────────────────────────────────────────────────────
+
+  private captureSnapshot(): TabSnapshot {
+    return {
+      bucket: this.storage.bucket,
+      prefix: this.storage.prefix,
+      objects: this.storage.objects,
+      prevTokens: [...this.storage.prevTokens],
+      pageSize: this.storage.pageSize
+    };
+  }
+
+  private restoreSnapshot(snapshot: TabSnapshot): void {
+    this.storage.bucket = snapshot.bucket;
+    this.storage.prefix = snapshot.prefix;
+    this.storage.objects = snapshot.objects;
+    this.storage.prevTokens = [...snapshot.prevTokens];
+    this.storage.pageSize = snapshot.pageSize;
+    this.storage.loading = false;
+    this.storage.clearSelection();
+    this.replaceLocationUrl?.(snapshot.bucket, snapshot.prefix);
+  }
+
+  // ── Persistence ──────────────────────────────────────────────────────────
+
+  private saveToPersistence(): void {
+    if (!this.persistEnabled || !browser) return;
+    const data: PersistedTabsState = {
+      tabs: this.tabs.map((t) => ({
+        id: t.id,
+        label: t.label,
+        bucket: t.snapshot.bucket,
+        prefix: t.snapshot.prefix
+      })),
+      activeTabId: this.activeTabId ?? '',
+      connectionId: this.connectionId ?? undefined
+    };
+    localStorage.setItem(LS_TABS, JSON.stringify(data));
+  }
+
+  /** Reads persisted tab state from localStorage without modifying any state.
+   *  Returns null if nothing is saved, persistence is disabled, or the saved
+   *  state belongs to a different connection. */
+  peekPersistedTabs(): PersistedTabsState | null {
+    if (!this.persistEnabled || !browser) return null;
+    try {
+      const raw = localStorage.getItem(LS_TABS);
+      if (!raw) return null;
+      const data = JSON.parse(raw) as PersistedTabsState;
+      if (!Array.isArray(data.tabs) || data.tabs.length === 0) return null;
+      // If both sides have a connectionId and they don't match, this save belongs
+      // to a different connection — do not offer restore.
+      if (data.connectionId && this.connectionId && data.connectionId !== this.connectionId) {
+        return null;
+      }
+      return data;
+    } catch {
+      return null;
+    }
+  }
+
+  /** Restores tabs from a previously peeked snapshot. Creates stub tabs for
+   *  all locations and navigates to the active one. Each tab gets a fresh UUID
+   *  to guarantee no key collisions with concurrently created tabs. */
+  restorePersistedTabs(saved: PersistedTabsState): void {
+    // Generate a fresh UUID per tab slot so that any duplicate IDs that may
+    // exist in older persisted data (from the previous counter-based scheme)
+    // never collide in the rendered each block.
+    const activeIdx = saved.tabs.findIndex((pt) => pt.id === saved.activeTabId);
+
+    this.tabs = saved.tabs.map((pt) => ({
+      id: crypto.randomUUID(),
+      label: pt.label,
+      stub: true,
+      snapshot: {
+        bucket: pt.bucket,
+        prefix: pt.prefix,
+        objects: EMPTY_PAGE,
+        prevTokens: [],
+        pageSize: this.storage.pageSize
+      }
+    }));
+
+    const mappedActiveId = activeIdx >= 0 ? this.tabs[activeIdx].id : this.tabs[0].id;
+    this.activeTabId = mappedActiveId;
+
+    // Persist immediately with the new UUIDs so the banner won't re-offer on
+    // the next visit to /storage.
+    this.saveToPersistence();
+
+    const activeTab = this.tabs.find((t) => t.id === mappedActiveId)!;
+
+    if (
+      this.storage.bucket === activeTab.snapshot.bucket &&
+      this.storage.prefix === activeTab.snapshot.prefix
+    ) {
+      this.markActiveTabLoaded();
+    } else if (this.navigateToLocation) {
+      this.navigateToLocation(activeTab.snapshot.bucket, activeTab.snapshot.prefix);
+    } else {
+      this.markActiveTabLoaded();
+    }
+  }
+
+  /** Removes the persisted tabs entry from localStorage. */
+  clearPersistedTabs(): void {
+    if (browser) localStorage.removeItem(LS_TABS);
+  }
+
+  // ── Tab operations ───────────────────────────────────────────────────────
+
+  /** Initialises tabs from the current storage state. If a restore was
+   *  requested via requestTabsRestore(), restores persisted tabs instead of
+   *  starting fresh. */
+  ensureInitialTab(): void {
+    if (this.tabs.length > 0) return;
+
+    if (restoreRequestedOnNextMount && this.persistEnabled) {
+      restoreRequestedOnNextMount = false;
+      const saved = this.peekPersistedTabs();
+      if (saved && saved.tabs.length > 0) {
+        this.restorePersistedTabs(saved);
+        return;
+      }
+    }
+
+    const id = crypto.randomUUID();
+    const label = this.buildLabel(this.storage.bucket, this.storage.prefix);
+    this.tabs = [{ id, label, stub: false, snapshot: this.captureSnapshot() }];
+    this.activeTabId = id;
+    this.saveToPersistence();
+  }
+
+  /** Marks the active tab as loaded with current storage data (clears stub). */
+  markActiveTabLoaded(): void {
+    if (!this.activeTabId) return;
+    const idx = this.tabs.findIndex((t) => t.id === this.activeTabId);
+    if (idx === -1) return;
+    const tab = this.tabs[idx];
+    if (!tab.stub) return;
+    this.tabs = [
+      ...this.tabs.slice(0, idx),
+      { ...tab, stub: false, snapshot: this.captureSnapshot() },
+      ...this.tabs.slice(idx + 1)
+    ];
+  }
+
+  /** Updates the active tab's snapshot to reflect current storage state. */
+  syncActiveTab(): void {
+    if (!this.activeTabId) return;
+    const idx = this.tabs.findIndex((t) => t.id === this.activeTabId);
+    if (idx === -1) return;
+    const tab = this.tabs[idx];
+    const updatedTab: Tab = {
+      ...tab,
+      stub: false,
+      snapshot: this.captureSnapshot(),
+      label:
+        tab.label === this.buildLabel(tab.snapshot.bucket, tab.snapshot.prefix)
+          ? this.buildLabel(this.storage.bucket, this.storage.prefix)
+          : tab.label
+    };
+    this.tabs = [...this.tabs.slice(0, idx), updatedTab, ...this.tabs.slice(idx + 1)];
+    this.saveToPersistence();
+  }
+
+  /** Adds a new tab at the current location and switches to it. */
+  addTab(): void {
+    this.syncActiveTab();
+    const id = crypto.randomUUID();
+    const label = this.buildLabel(this.storage.bucket, this.storage.prefix);
+    const newTab: Tab = { id, label, stub: false, snapshot: this.captureSnapshot() };
+    this.tabs = [...this.tabs, newTab];
+    this.activeTabId = id;
+    this.saveToPersistence();
+  }
+
+  /** Switches to a tab by id. Stub tabs trigger a navigation to load fresh data. */
+  switchTo(id: string): void {
+    if (id === this.activeTabId) return;
+    const tab = this.tabs.find((t) => t.id === id);
+    if (!tab) return;
+    this.syncActiveTab();
+    this.activeTabId = id;
+    this.saveToPersistence();
+
+    if (tab.stub && this.navigateToLocation) {
+      this.navigateToLocation(tab.snapshot.bucket, tab.snapshot.prefix);
+    } else {
+      this.restoreSnapshot(tab.snapshot);
+    }
+  }
+
+  /** Closes a tab by id. If it's the active tab, switches to an adjacent one. */
+  closeTab(id: string): void {
+    if (this.tabs.length <= 1) return;
+    const idx = this.tabs.findIndex((t) => t.id === id);
+    if (idx === -1) return;
+
+    const newTabs = this.tabs.filter((t) => t.id !== id);
+    this.tabs = newTabs;
+
+    if (id === this.activeTabId) {
+      const newIdx = Math.min(idx, newTabs.length - 1);
+      const nextTab = newTabs[newIdx];
+      this.activeTabId = nextTab.id;
+      if (nextTab.stub && this.navigateToLocation) {
+        this.navigateToLocation(nextTab.snapshot.bucket, nextTab.snapshot.prefix);
+      } else {
+        this.restoreSnapshot(nextTab.snapshot);
+      }
+    }
+
+    this.saveToPersistence();
+  }
+
+  /** Renames a tab. */
+  renameTab(id: string, newLabel: string): void {
+    const idx = this.tabs.findIndex((t) => t.id === id);
+    if (idx === -1) return;
+    const tab = this.tabs[idx];
+    this.tabs = [
+      ...this.tabs.slice(0, idx),
+      { ...tab, label: newLabel },
+      ...this.tabs.slice(idx + 1)
+    ];
+    this.saveToPersistence();
+  }
+
+  /** Reorders tabs by moving from one index to another. */
+  reorderTabs(fromIdx: number, toIdx: number): void {
+    if (fromIdx === toIdx) return;
+    const copy = [...this.tabs];
+    const [moved] = copy.splice(fromIdx, 1);
+    copy.splice(toIdx, 0, moved);
+    this.tabs = copy;
+    this.saveToPersistence();
+  }
+
+  // ── Helpers ──────────────────────────────────────────────────────────────
+
+  private buildLabel(bucket: string, prefix: string): string {
+    if (!prefix) return bucket;
+    const parts = prefix.replace(/\/$/, '').split('/');
+    return parts[parts.length - 1];
+  }
+}
diff --git a/src/lib/stores/toast.svelte.ts b/src/lib/stores/toast.svelte.ts
index 7a405679..3880ed0b 100644
--- a/src/lib/stores/toast.svelte.ts
+++ b/src/lib/stores/toast.svelte.ts
@@ -1,19 +1,31 @@
 export type ToastType = 'info' | 'success' | 'warning' | 'error';
 
+export interface ToastAction {
+  label: string;
+  onClick: () => void;
+}
+
 interface Toast {
   id: string;
   type: ToastType;
   message: string;
+  actions?: ToastAction[];
 }
 
 export const toasts = $state<Toast[]>([]);
 
-export function addToast(type: ToastType, message: string, durationMs = 5000): void {
+export function addToast(
+  type: ToastType,
+  message: string,
+  durationMs = 5000,
+  actions?: ToastAction[]
+): string {
   const id = crypto.randomUUID();
-  toasts.push({ id, type, message });
+  toasts.push({ id, type, message, actions });
   if (durationMs > 0) {
     setTimeout(() => removeToast(id), durationMs);
   }
+  return id;
 }
 
 export function removeToast(id: string): void {
diff --git a/src/routes/(app)/storage/+layout.server.ts b/src/routes/(app)/storage/+layout.server.ts
index 17175c59..34422970 100644
--- a/src/routes/(app)/storage/+layout.server.ts
+++ b/src/routes/(app)/storage/+layout.server.ts
@@ -11,5 +11,5 @@ export const load: LayoutServerLoad = async ({ locals }) => {
 
   // Connected state and bucket list are determined client-side from localStorage
   // and populated by the universal +layout.ts load after hydration.
-  return { connected: false, buckets: [] as string[], connectionType: null };
+  return { connected: false, buckets: [] as string[], connectionType: null, connectionId: null };
 };
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 355141e9..c6cb3ad9 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -1,13 +1,70 @@
 <script lang="ts">
+  import { browser } from '$app/environment';
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
   import { navigating } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
+  import { storageRestoreTabsEnabled } from '$lib/client/feature-flags.js';
+  import { requestTabsRestore, type PersistedTabsState } from '$lib/storage/tabs.svelte.js';
+  import { LS_TABS } from '$lib/storage/persistence.js';
+  import IconTabOutline from 'virtual:icons/material-symbols/tab-outline';
+  import IconClose from 'virtual:icons/material-symbols/close';
   import BucketGrid from '$lib/components/storage/landing/BucketGrid.svelte';
   import StorageConnectForm from '$lib/components/storage/landing/StorageConnectForm.svelte';
   import RecentItems from '$lib/components/storage/landing/RecentItems.svelte';
 
   let { data } = $props();
   const storage = getStorageState();
+
+  // ── Restore-tabs banner ───────────────────────────────────────────────────
+
+  let savedTabs = $state<PersistedTabsState | null>(null);
+
+  $effect(() => {
+    if (!browser || !storageRestoreTabsEnabled) return;
+
+    try {
+      const raw = localStorage.getItem(LS_TABS);
+      if (!raw) return;
+      const parsed = JSON.parse(raw) as PersistedTabsState;
+      if (!Array.isArray(parsed?.tabs) || parsed.tabs.length <= 1) return;
+      // If the saved data carries a connectionId that differs from the current
+      // connection, do not offer restore (tabs are from a different connection).
+      if (
+        parsed.connectionId &&
+        storage.connectionId &&
+        parsed.connectionId !== storage.connectionId
+      )
+        return;
+      savedTabs = parsed;
+    } catch {
+      // ignore malformed data
+    }
+  });
+
+  function handleRestore() {
+    if (!savedTabs) return;
+
+    requestTabsRestore();
+
+    const active = savedTabs.tabs.find((t) => t.id === savedTabs!.activeTabId) ?? savedTabs.tabs[0];
+    const encodedPrefix = active.prefix
+      ? active.prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+      : '';
+
+    savedTabs = null;
+    goto(
+      resolve('/(app)/storage/[bucket]/[...prefix]', {
+        bucket: encodeURIComponent(active.bucket),
+        prefix: encodedPrefix
+      })
+    );
+  }
+
+  function handleDismiss() {
+    savedTabs = null;
+  }
 </script>
 
 {#if data.connected}
@@ -21,7 +78,31 @@
         <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
       </div>
     {/if}
+
+    {#if savedTabs}
+      <div
+        role="alert"
+        class="alert alert-info mb-3 flex items-center gap-3 py-2.5 pr-2 pl-3 text-sm"
+      >
+        <IconTabOutline class="size-4 shrink-0" aria-hidden="true" />
+        <span class="flex-1">
+          {m.storage_restore_tabs_message({ count: savedTabs.tabs.length })}
+        </span>
+        <button class="btn btn-sm btn-neutral shrink-0" onclick={handleRestore}>
+          {m.storage_restore_tabs_action()}
+        </button>
+        <button
+          class="btn btn-ghost btn-sm btn-square shrink-0"
+          aria-label={m.storage_download_dismiss()}
+          onclick={handleDismiss}
+        >
+          <IconClose class="size-4" aria-hidden="true" />
+        </button>
+      </div>
+    {/if}
+
     <h1 class="mb-1 text-xl font-semibold">{m.storage_buckets_label()}</h1>
+
     <p class="text-base-content/60 mb-6 text-sm">{m.storage_buckets_subtitle()}</p>
     <BucketGrid buckets={storage.buckets} />
   </div>
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index 49c8f26b..cbac7474 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
-  import { goto } from '$app/navigation';
+  import { goto, invalidateAll } from '$app/navigation';
   import { resolve } from '$app/paths';
+  import { page } from '$app/state';
   import { getStorageState } from '$lib/storage/context.js';
   import FileExplorer from '$lib/components/storage/explorer/FileExplorer.svelte';
   import IconWarning from 'virtual:icons/material-symbols/warning';
@@ -9,14 +10,16 @@
   let { data } = $props();
   const storage = getStorageState();
 
-  // Inject navigation handler — page owns URL construction
+  // Inject navigation handler — page owns URL construction.
+  // Uses storage.bucket (not data.bucket) so that after a tab switch via
+  // snapshot restore the handler still builds URLs for the active tab's bucket.
   storage.setNavigationHandler((prefix, continuationToken, pageSize) => {
     const encodedPrefix = prefix
       ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';
 
     const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
-      bucket: encodeURIComponent(data.bucket),
+      bucket: encodeURIComponent(storage.bucket),
       prefix: encodedPrefix
     });
 
@@ -28,6 +31,34 @@
     goto(url, { replaceState: false });
   });
 
+  // Inject refresh handler — navigates to the current bucket/prefix using
+  // replaceState so that a refresh does not add a browser history entry.
+  // Reads storage.bucket/prefix at call time so it always reflects the active
+  // tab's location, even after a snapshot restore via history.replaceState.
+  storage.setRefreshHandler(() => {
+    const encodedPrefix = storage.prefix
+      ? storage.prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+      : '';
+
+    const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
+      bucket: encodeURIComponent(storage.bucket),
+      prefix: encodedPrefix
+    });
+
+    const url = new URL(basePath, location.origin);
+    if (storage.pageSize) url.searchParams.set('pageSize', String(storage.pageSize));
+
+    // If SvelteKit's internal route already points at the correct location,
+    // goto() would be a no-op (same URL) and loading would never clear.
+    // Use invalidateAll() instead — the route params are already correct.
+    if (page.url.pathname === basePath) {
+      void invalidateAll();
+    } else {
+      // eslint-disable-next-line svelte/no-navigation-without-resolve -- base path is built with resolve(); URL object is needed to append query params
+      void goto(url, { replaceState: true });
+    }
+  });
+
   // Sync server data into state whenever SvelteKit load runs
   $effect(() => {
     storage.syncFromServer(data.bucket, data.prefix, data.objects);
diff --git a/src/routes/(app)/storage/layout.server.test.ts b/src/routes/(app)/storage/layout.server.test.ts
index 7edce12a..ac2bef5f 100644
--- a/src/routes/(app)/storage/layout.server.test.ts
+++ b/src/routes/(app)/storage/layout.server.test.ts
@@ -26,6 +26,11 @@ describe('storage layout server load', () => {
   it('returns disconnected default state', async () => {
     mockStorageBrowserEnabled.mockReturnValue(true);
     const result = await load(mockEvent());
-    expect(result).toEqual({ connected: false, buckets: [], connectionType: null });
+    expect(result).toEqual({
+      connected: false,
+      buckets: [],
+      connectionType: null,
+      connectionId: null
+    });
   });
 });
diff --git a/src/test/setup-client.ts b/src/test/setup-client.ts
index 3c147948..d029071b 100644
--- a/src/test/setup-client.ts
+++ b/src/test/setup-client.ts
@@ -6,6 +6,7 @@ import { vi, beforeEach } from 'vitest';
 // env vars are set.
 vi.mock('$lib/client/feature-flags.js', () => ({
   storageAutoConnectEnabled: false,
+  storageRestoreTabsEnabled: false,
   allowedPageSizes: [25, 50, 100],
   defaultPageSize: 25,
   maxRecentFiles: 15,

From 6397e0d18cf9aea3c56f8d073be22c540ce297a8 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 29 Jun 2026 14:41:33 +0200
Subject: [PATCH 083/136] fix unconfirmed save button size

---
 .../modals/UnsavedConfirmDialog.svelte        | 26 +------------------
 1 file changed, 1 insertion(+), 25 deletions(-)

diff --git a/src/lib/components/storage/modals/UnsavedConfirmDialog.svelte b/src/lib/components/storage/modals/UnsavedConfirmDialog.svelte
index 274c175b..8e5579d8 100644
--- a/src/lib/components/storage/modals/UnsavedConfirmDialog.svelte
+++ b/src/lib/components/storage/modals/UnsavedConfirmDialog.svelte
@@ -31,33 +31,9 @@
       <button class="btn btn-outline btn-ghost btn-error btn-sm" onclick={onDiscard}>
         {m.storage_editor_discard()}
       </button>
-      <!-- eslint-disable-next-line better-tailwindcss/no-unknown-classes -->
-      <button class="btn btn-primary save-btn" onclick={onSave}>
+      <button class="btn btn-primary btn-sm" onclick={onSave}>
         {m.storage_editor_save_and_close()}
       </button>
     </div>
   </div>
 </Modal>
-
-<style>
-  /*
-   * The save button needs to wrap its label text in German ("Speichern und schließen").
-   * DaisyUI places all .btn styles inside @layer daisyui.*, so Svelte's unlayered
-   * component styles unconditionally win the cascade without !important.
-   *
-   * - flex/min-width: button fills remaining row space (cancel+discard are btn-sm,
-   *   leaving ~154 px here — enough for two-line German text).
-   * - height/align-self: removes the fixed --size height and opts out of the
-   *   parent's align-items:stretch so the button can actually grow taller.
-   * - white-space/line-height: allow the label to break at word boundaries.
-   */
-  .save-btn {
-    flex: 1;
-    min-width: 0;
-    white-space: normal;
-    height: auto;
-    min-height: 2.5rem;
-    align-self: center;
-    line-height: 1.25;
-  }
-</style>

From d06fba759723fbb6e070c9f148352ad861a6ce19 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 1 Jul 2026 07:16:01 +0200
Subject: [PATCH 084/136] Feat/s3 file browser csv zip preview (#203)

* #142 add working parquet preview that still has to be optimized

* #142 optimize parquet data retrieval

* #142 reduce preview limit to open parquet files more quickly with no downside

* #142 add infinite scrolling

* #142 remove deprecated parquet preview

* #142 remove comment

* #142 add unit and e2e tests

* #155 allow preview of tsv files and custom csv delimiters

* #155 add unit and e2e tests for TSV and custom delimiter CSV preview

* #142 show row total in locale format, fix layout, update header shown row total

* #142 add line numbers to previews

* #142 add line numbers to previews

* #142 optimize parquet loading with async column fetching and using onChunk streaming

* #155 add archive preview

* #155 fix some minor bugs in archive preview

* #155 fix remaining bugs and issues of the archive preview

* #155 add e2e and unit tests for archive preview, open archive on preview action

* #155 add explanation to tech debt for partial archive previews

* #155 fix e2e and unit tests, fix lint

* #142 show row total in locale format, fix layout, update header shown row total

* #142 add line numbers to previews

* #142 add line numbers to previews

* #142 optimize parquet loading with async column fetching and using onChunk streaming

* #155 fix all failing unit and e2e tests including those of the parent branch

* Merge branch 'feat/s3-file-browser-preview-parquet' into feat/s3-file-browser-csv-zip-preview

* #142 calculate parquet column width per load, remove double scrollbars in chrome

* #155 fix breadcrumb navigation from inside archives

* #142 fix column width calculation for firefox

* #142 fix lint

* #142 protect from zip bombs via archive size limit

* #142 fix e2e tests

* #142 fix lint

* #142 fix lint

* #142 fix lint

* #142 fix unit test

* #98 fix lint

* Resolve merge conflicts with feat/s3-file-browser-preview-parquet

* fix build, rename api route

* fix parquet preview

* fix lint

* fix unit and e2e test

* #155 add title hovers, fix tab view for archives, fix breadcrumb exit archive, fix tab name in archive

* remove deprecated unit test

* fix unit test

* fix e2e test

* fix e2e test

* #155 remove unnecessary stub files

* #155 fix typebox dependency

* #155 reduce max archive size, refactor duplicate code

* #155 fixed SAST issues

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .env.example                                  |    1 +
 TECH_DEBT.md                                  |   72 +-
 dev/setup.sh                                  |    1 +
 e2e/storage/archive.spec.ts                   |  346 +
 e2e/storage/preview.spec.ts                   |  157 +-
 messages/de.json                              |  103 +-
 messages/en.json                              |   93 +-
 package-lock.json                             | 9641 ++++++++---------
 package.json                                  |   11 +
 src/lib/components/Modal.svelte               |   14 +
 .../storage/explorer/ContextMenu.svelte       |   30 +-
 .../storage/explorer/FileExplorer.svelte      |    2 +-
 .../storage/explorer/FileRow.svelte           |   11 +-
 .../storage/explorer/FileRow.svelte.spec.ts   |   44 +
 .../storage/explorer/FolderRow.svelte         |    8 +-
 .../storage/explorer/ObjectTable.svelte       |   45 +-
 .../storage/explorer/SelectionToolbar.svelte  |   26 +-
 .../storage/explorer/StorageBreadcrumb.svelte |  198 +-
 .../explorer/StorageBreadcrumb.svelte.spec.ts |   57 +
 .../components/storage/explorer/TabBar.svelte |    1 +
 .../PreviewModal.complex.svelte.spec.ts       |  249 +
 .../PreviewModal.preview.svelte.spec.ts       |  253 +
 .../storage/modals/PreviewModal.svelte        |  141 +-
 .../modals/PreviewModal.svelte.spec.ts        |   83 +-
 .../storage/modals/StorageModals.svelte       |    3 +
 .../storage/modals/preview/CsvPreview.svelte  |   46 +-
 .../modals/preview/CsvPreview.svelte.spec.ts  |  184 +-
 .../upload/UploadDropzone.svelte.spec.ts      |   12 +-
 src/lib/server/feature-flags.ts               |    9 +
 src/lib/server/storage/archive.test.ts        |  430 +
 src/lib/server/storage/archive.ts             |  919 ++
 src/lib/server/storage/service.ts             |   24 +-
 src/lib/server/storage/utils.ts               |    9 +-
 src/lib/storage/state.svelte.ts               |  272 +-
 src/lib/storage/tabs.svelte.ts                |   72 +-
 src/lib/storage/types.ts                      |   41 +-
 src/lib/storage/utils.ts                      |   14 +-
 .../api/storage/archive/extract/+server.ts    |  103 +
 .../api/storage/archive/listing/+server.ts    |   50 +
 .../(app)/api/storage/buckets/+server.ts      |    2 +-
 .../(app)/api/storage/create/+server.ts       |    2 +-
 .../(app)/api/storage/delete/+server.ts       |    2 +-
 .../(app)/api/storage/delete/server.test.ts   |    4 +-
 .../(app)/api/storage/download/+server.ts     |    4 +-
 .../(app)/api/storage/download/server.test.ts |    6 +-
 .../(app)/api/storage/objects/+server.ts      |    2 +-
 src/routes/(app)/api/storage/params.test.ts   |   16 +-
 .../(app)/api/storage/preview/+server.ts      |   15 +-
 .../(app)/api/storage/preview/server.test.ts  |   70 +-
 .../(app)/api/storage/save-text/+server.ts    |    6 +-
 .../(app)/api/storage/upload/+server.ts       |    2 +-
 .../(app)/api/storage/upload/server.test.ts   |    4 +-
 .../storage/[bucket]/[...prefix]/+page.svelte |    2 +
 53 files changed, 8332 insertions(+), 5580 deletions(-)
 create mode 100644 e2e/storage/archive.spec.ts
 create mode 100644 src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
 create mode 100644 src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts
 create mode 100644 src/lib/server/storage/archive.test.ts
 create mode 100644 src/lib/server/storage/archive.ts
 create mode 100644 src/routes/(app)/api/storage/archive/extract/+server.ts
 create mode 100644 src/routes/(app)/api/storage/archive/listing/+server.ts

diff --git a/.env.example b/.env.example
index 455336a1..99a6b7af 100644
--- a/.env.example
+++ b/.env.example
@@ -34,6 +34,7 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # Feature flags
 # STACKABLE_COCKPIT_COMPLETION_ENABLED=false    # Disable SQL editor code completion (default: true)
 # STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true  # Enable S3/HDFS file browser (default: false)
+# STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB=100  # Max decompressed size for archive preview in megabytes (default: 100)
 # STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset  # Comma-separated list of compression types to disallow from parquet data preview (default: "gzip-no_offset")
 # PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000  # Auto-connect to last used storage after this many milliseconds (default: 15000)
 # PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true  # File browser: continue where you left off — restore open tabs from the last session (default: false)
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index fac5094d..5fce8b90 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -34,7 +34,7 @@ S3 connection credentials (access key ID and secret access key) are persisted in
 
 **File:** `src/lib/storage/download.ts`
 
-`downloadObject` fetches the full S3 object body via the `/storage/api/download` endpoint, buffers it as a `Blob` in browser memory, then triggers a programmatic anchor click. This is simpler than streaming directly to disk but means the entire object must fit in browser memory before the save dialog appears. Acceptable for the current object sizes; for very large files (multiple GiB) this will cause memory pressure. Long-term fix: use the [File System Access API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API) `createWritable()` to stream bytes directly to disk without buffering, with a fallback to the current Blob approach for Firefox (which does not support `showSaveFilePicker`).
+`downloadObject` fetches the full S3 object body via the `/api/storage/download` endpoint, buffers it as a `Blob` in browser memory, then triggers a programmatic anchor click. This is simpler than streaming directly to disk but means the entire object must fit in browser memory before the save dialog appears. Acceptable for the current object sizes; for very large files (multiple GiB) this will cause memory pressure. Long-term fix: use the [File System Access API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API) `createWritable()` to stream bytes directly to disk without buffering, with a fallback to the current Blob approach for Firefox (which does not support `showSaveFilePicker`).
 
 ---
 
@@ -128,9 +128,77 @@ The dev server accepts requests from any host. This enables DNS rebinding attack
 
 ---
 
+### Archive browsing downloads entire file before parsing
+
+**File:** `src/lib/server/storage/archive.ts`
+
+Archive browsing (ZIP, TAR.GZ, RAR, 7z) downloads the entire archive from S3 to a temporary file on the server before listing or extracting entries. The feasibility of partial/random-access reading depends entirely on the archive format.
+
+#### ZIP (fixable with S3 Range requests)
+
+ZIP stores a **Central Directory** (full file listing) at the end of the file, preceded by an **EOCD** (End of Central Directory) record. This allows true random access:
+
+1. **HEAD** the S3 object to get `Content-Length`
+2. **Range request for the last ~100 bytes** → parse EOCD to locate the Central Directory
+3. **Range request for the Central Directory** → get full file listing (typically <50 KB)
+4. **To extract one file**: single Range request to that file's compressed data offset
+
+Total data transferred for listing: 2 Range requests, often under 50 KB regardless of archive size. Extraction costs only what the user opens — no temp file I/O needed for ZIPs at all.
+
+Available libraries with S3 Range support:
+
+- **`unzipper`** (`ZJONSSON/node-unzipper`) — `Open.s3()` for AWS SDK v2; `Open.custom()` with S3 Range workaround for v3 (see [issue #241](https://github.com/ZJONSSON/node-unzipper/issues/241)). Most mature option.
+- **`s3-range-zip`** (`numtel/s3-range-zip`) — Purpose-built for S3 Range-based ZIP reading with `@aws-sdk/client-s3`. Smaller and simpler.
+- **`unzipit`** (`greggman/unzipit`) — `HTTPRangeReader` requires presigned S3 URLs; better suited for browser use.
+
+**Recommendation**: Replace `adm-zip` with `unzipper.Open.custom()` using the AWS SDK v3 workaround. This eliminates download latency for ZIPs entirely (the most common archive format) and naturally supports nested archives (inner ZIP's central directory read the same way). Implementation steps:
+
+1. Install `unzipper` npm package, remove `adm-zip`
+2. Implement S3 custom reader using `HeadObjectCommand` + `GetObjectCommand` with `Range` header
+3. Replace `listZip()` with central directory parsing (no extraction needed for listing)
+4. Replace `extractFromZip()` with offset-based single-file extraction
+5. Keep `extractFromZip` as fallback name but implement via `unzipper`
+6. Remove ZIP from temp-file caching (TAR.GZ/RAR/7z still need it)
+7. Remove `adm-zip` dependency
+
+#### TAR.GZ (fundamentally limited — format constraint)
+
+TAR has no central index (sequential tape format). Gzip is a streaming compressor. Together they force full sequential decompression from the start. Three tiers of mitigation exist:
+
+- **Stream + skip** (Node.js `node-tar` + `zlib.createGunzip()`): decompress everything but avoid writing to disk. This is what the current approach effectively does after download. Bandwidth + CPU cost same as full download.
+- **Index-on-first-pass** (e.g. Rust [`iluvatar`](https://docs.rs/crate/iluvatar/latest)): records decompressor checkpoints on first pass, subsequent extractions restore nearest checkpoint and seek forward. No Node.js equivalent exists.
+- **Specialised format** ([`estargz`](https://github.com/containerd/stargz-snapshotter), [`tarzan`](https://github.com/astraw/tarzan-rs)): archives must be created in these formats; existing `.tar.gz` files cannot be retrofitted.
+
+**Recommendation**: Keep current full-download + temp cache. This is unavoidable for arbitrary `.tar.gz` files.
+
+#### RAR & 7z (limited — solid compression blocks)
+
+Both use solid compression where a single file's data may be interleaved across a compressed block. Without format-level block-to-file index (which neither exposes easily), extracting one file requires decompressing the entire solid block.
+
+**Recommendation**: Keep full-download + temp cache.
+
+#### Summary
+
+| Format | Partial access | Approach                | Bandwidth per listing  |
+| ------ | -------------- | ----------------------- | ---------------------- |
+| ZIP    | ✅ Yes         | S3 Range via `unzipper` | ~50 KB (2 Range calls) |
+| TAR.GZ | ❌ No          | Full download + cache   | Full archive           |
+| RAR    | ❌ No          | Full download + cache   | Full archive           |
+| 7z     | ❌ No          | Full download + cache   | Full archive           |
+
+---
+
+### RAR and 7z archive support requires system binaries
+
+**File:** `src/lib/server/storage/archive.ts`
+
+RAR and 7z archive parsing shells out to `unrar` and `7zz`/`7z` system binaries respectively. These may not be installed in the production container image. If absent, the user sees a clear error message telling them to install the binary. ZIP and TAR.GZ work without system dependencies (pure JS). The Dockerfile should be updated to include `unrar` and `p7zip` (or similar) packages when RAR/7z support is needed in production.
+
+---
+
 ### No server-side file size limit on uploads (v0)
 
-**File:** `src/routes/(app)/storage/api/upload/+server.ts`
+**File:** `src/routes/(app)/api/storage/upload/+server.ts`
 
 The upload endpoint imposes no maximum file size. S3's 5 TB single-object limit applies as a natural backstop. For v0 this is acceptable; large uploads will consume server-side streaming resources proportionally but do not buffer the body in memory (the stream is piped directly to the `@aws-sdk/lib-storage` Upload). Add a configurable `MAX_UPLOAD_BYTES` guard in a future iteration once typical object sizes are known.
 
diff --git a/dev/setup.sh b/dev/setup.sh
index 828e628f..76e23a7b 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -308,6 +308,7 @@ STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB=100
 STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
diff --git a/e2e/storage/archive.spec.ts b/e2e/storage/archive.spec.ts
new file mode 100644
index 00000000..f756623e
--- /dev/null
+++ b/e2e/storage/archive.spec.ts
@@ -0,0 +1,346 @@
+import { PutObjectCommand } from '@aws-sdk/client-s3';
+import { test, expect } from '@playwright/test';
+import AdmZip from 'adm-zip';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  rowByName,
+  uniquePrefix,
+  waitForObjectsLoaded
+} from './helpers.js';
+
+function makeZip(entries: Record<string, string>): Buffer {
+  const zip = new AdmZip();
+  for (const [name, content] of Object.entries(entries)) {
+    zip.addFile(name, Buffer.from(content, 'utf-8'));
+  }
+  return Buffer.from(zip.toBuffer());
+}
+
+test.describe('Storage S3 — Archive preview', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('opens archive by double-clicking and shows its contents', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-open');
+    const zipBuffer = makeZip({
+      'README.md': '# Archive test',
+      'data/notes.txt': 'some notes',
+      'data/results.csv': 'a,b,c\n1,2,3'
+    });
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: zipBuffer,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Double-click the archive file
+      await rowByName(page, 'archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Should see archive contents — top-level folder and file
+      await expect(rowByName(page, 'README.md')).toBeVisible();
+      await expect(rowByName(page, 'data')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('navigates into directories within archive', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-navigate');
+    const zipBuffer = makeZip({
+      'a/b/c/file.txt': 'deep',
+      'a/b/other.txt': 'other',
+      'a/root.txt': 'root'
+    });
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: zipBuffer,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Navigate into a/
+      await rowByName(page, 'a').click();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'root.txt')).toBeVisible();
+      await expect(rowByName(page, 'b')).toBeVisible();
+
+      // Navigate into b/
+      await rowByName(page, 'b').click();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'other.txt')).toBeVisible();
+      await expect(rowByName(page, 'c')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews text file inside archive', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-preview');
+    const zipBuffer = makeZip({
+      'hello.txt': 'Hello from inside archive!'
+    });
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: zipBuffer,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Double-click the text file inside archive
+      await rowByName(page, 'hello.txt').dblclick();
+
+      // Preview modal should show the file content
+      await expect(page.getByRole('heading', { name: 'hello.txt' })).toBeVisible();
+      await expect(page.getByText('Hello from inside archive!')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('exits archive via breadcrumb bucket click', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-exit');
+    const zipBuffer = makeZip({ 'file.txt': 'content' });
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: zipBuffer,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'file.txt')).toBeVisible();
+
+      // Click bucket name in breadcrumb to exit archive
+      await page.getByRole('button', { name: credentials.bucket }).click();
+      await waitForObjectsLoaded(page);
+
+      // Should be at the bucket root (archive exited)
+      await expect(page).toHaveURL(new RegExp(`/storage/${credentials.bucket}(\\?|$)`));
+      await expect(page.getByText('archive.zip')).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('exits archive via parent directory row', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-exit-parent');
+    const zipBuffer = makeZip({ 'inner/file.txt': 'content' });
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: zipBuffer,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Navigate into inner/
+      await rowByName(page, 'inner').click();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'file.txt')).toBeVisible();
+
+      // Click parent directory ...
+      await rowByName(page, '...').click();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'inner')).toBeVisible();
+
+      // Click ... again at archive root to exit
+      await rowByName(page, '...').click();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'archive.zip')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('opens nested archive inside another archive', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-nested');
+
+    // Create inner zip
+    const innerZip = new AdmZip();
+    innerZip.addFile('nested.txt', Buffer.from('nested content', 'utf-8'));
+    const innerBuf = Buffer.from(innerZip.toBuffer());
+
+    // Create outer zip containing the inner zip
+    const outerZip = new AdmZip();
+    outerZip.addFile('outer.txt', Buffer.from('outer content', 'utf-8'));
+    outerZip.addFile('inner_archive.zip', innerBuf);
+    const outerBuf = Buffer.from(outerZip.toBuffer());
+
+    const cleanupKeys = [`${prefix}outer.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}outer.zip`,
+          Body: outerBuf,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'outer.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Should see outer archive contents
+      await expect(rowByName(page, 'outer.txt')).toBeVisible();
+      await expect(rowByName(page, 'inner_archive.zip')).toBeVisible();
+
+      // Double-click the nested archive to enter it
+      await rowByName(page, 'inner_archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Should see nested archive contents
+      await expect(rowByName(page, 'nested.txt')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('shows archive breadcrumb and navigates back to archive root', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-breadcrumb');
+    const zipBuffer = makeZip({
+      'sub/readme.txt': 'hello',
+      'sub/deep/doc.md': '# doc'
+    });
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: zipBuffer,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Navigate into sub/
+      await rowByName(page, 'sub').click();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'readme.txt')).toBeVisible();
+
+      // Navigate into deep/
+      await rowByName(page, 'deep').click();
+      await waitForObjectsLoaded(page);
+      await expect(rowByName(page, 'doc.md')).toBeVisible();
+
+      // Click archive name in breadcrumb to go back to archive root
+      await page.getByRole('button', { name: 'archive.zip' }).click();
+      await waitForObjectsLoaded(page);
+
+      // Should see archive root contents
+      await expect(rowByName(page, 'sub')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews image file inside archive', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'archive-image');
+    const svgContent =
+      '<svg xmlns="http://www.w3.org/2000/svg" width="50" height="50"><rect width="50" height="50" fill="blue"/></svg>';
+    const zipBuffer = makeZip({ 'diagram.svg': svgContent });
+    const cleanupKeys = [`${prefix}archive.zip`];
+
+    try {
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}archive.zip`,
+          Body: zipBuffer,
+          ContentType: 'application/zip'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'archive.zip').dblclick();
+      await waitForObjectsLoaded(page);
+
+      // Double-click the SVG file
+      await rowByName(page, 'diagram.svg').dblclick();
+
+      // Preview modal should show image
+      await expect(page.getByRole('heading', { name: 'diagram.svg' })).toBeVisible();
+      await expect(page.getByAltText('Preview of diagram.svg')).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/preview.spec.ts b/e2e/storage/preview.spec.ts
index e829a28a..db87c55a 100644
--- a/e2e/storage/preview.spec.ts
+++ b/e2e/storage/preview.spec.ts
@@ -51,34 +51,6 @@ test.describe('Storage S3 — Preview', () => {
     }
   });
 
-  test('shows fallback preview for a known binary file type', async ({ page }, testInfo) => {
-    const credentials = requireGarageCredentials();
-    const client = createS3Client(credentials);
-    const prefix = uniquePrefix(testInfo, 'preview-zip');
-    const cleanupKeys = [`${prefix}archive.zip`];
-
-    try {
-      await client.send(
-        new PutObjectCommand({
-          Bucket: credentials.bucket,
-          Key: `${prefix}archive.zip`,
-          Body: Buffer.from([0x50, 0x4b, 0x03, 0x04, 0x00, 0x00]),
-          ContentType: 'application/zip'
-        })
-      );
-
-      await connectAndOpenPrefix(page, credentials, prefix);
-
-      await rowByName(page, 'archive.zip').dblclick();
-
-      await expect(page.getByRole('heading', { name: 'archive.zip' })).toBeVisible();
-      await expect(page.getByText('Preview unavailable')).toBeVisible();
-      await expect(page.getByRole('button', { name: 'Download full file' })).toBeVisible();
-    } finally {
-      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
-    }
-  });
-
   test('shows binary fallback preview for non-decodable binary content', async ({
     page
   }, testInfo) => {
@@ -388,6 +360,135 @@ test.describe('Storage S3 — Preview', () => {
     }
   });
 
+  test('previews TSV files with table headers and data rows', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-tsv');
+    const cleanupKeys = [`${prefix}data.tsv`];
+
+    try {
+      const tsvContent = ['name\tcity\tscore', 'Alice\tBerlin\t95', 'Bob\tMunich\t88'].join('\n');
+
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}data.tsv`,
+        tsvContent,
+        'text/tab-separated-values'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'data.tsv').dblclick();
+
+      // Modal heading
+      await expect(page.getByRole('heading', { name: 'data.tsv' })).toBeVisible();
+
+      // CSV/TSV table is rendered with correct aria label
+      const table = page.getByRole('table', { name: 'CSV preview' });
+      await expect(table).toBeVisible();
+
+      // Headers are present
+      await expect(table.locator('th', { hasText: 'name' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'city' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'score' })).toBeVisible();
+
+      // Data rows are present
+      await expect(table.locator('td', { hasText: 'Alice' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'Berlin' })).toBeVisible();
+      await expect(table.locator('td', { hasText: '95' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'Bob' })).toBeVisible();
+
+      // File size badge is displayed
+      await expect(page.locator('.badge', { hasText: /B$/ })).toBeVisible();
+
+      // Close button works
+      await page.getByRole('button', { name: 'Close' }).last().click();
+      await expect(page.getByRole('heading', { name: 'data.tsv' })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews TSV files with quoted fields containing tabs', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-tsv-quoted');
+    const cleanupKeys = [`${prefix}notes.tsv`];
+
+    try {
+      const tsvContent = ['name\tnotes', 'Alice\t"likes\ttabs\tin\tdata"', 'Bob\tplain text'].join(
+        '\n'
+      );
+
+      await putTextObject(
+        client,
+        credentials.bucket,
+        `${prefix}notes.tsv`,
+        tsvContent,
+        'text/tab-separated-values'
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'notes.tsv').dblclick();
+
+      await expect(page.getByRole('heading', { name: 'notes.tsv' })).toBeVisible();
+
+      const table = page.getByRole('table', { name: 'CSV preview' });
+      await expect(table).toBeVisible();
+
+      // Quoted fields with tabs are parsed correctly
+      await expect(table.locator('td', { hasText: 'likes\ttabs\tin\tdata' })).toBeVisible();
+      await expect(table.locator('td', { hasText: 'plain text' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('previews TSV files with application/vnd.ms-excel content type', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'preview-tsv-excel');
+    const cleanupKeys = [`${prefix}export.tsv`];
+
+    try {
+      const tsvContent = ['product\tprice\tqty', 'Widget\t19.99\t100', 'Gadget\t49.95\t50'].join(
+        '\n'
+      );
+
+      await client.send(
+        new PutObjectCommand({
+          Bucket: credentials.bucket,
+          Key: `${prefix}export.tsv`,
+          Body: Buffer.from(tsvContent),
+          ContentType: 'application/vnd.ms-excel'
+        })
+      );
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'export.tsv').dblclick();
+
+      await expect(page.getByRole('heading', { name: 'export.tsv' })).toBeVisible();
+
+      const table = page.getByRole('table', { name: 'CSV preview' });
+      await expect(table).toBeVisible();
+
+      await expect(table.locator('th', { hasText: 'product' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'price' })).toBeVisible();
+      await expect(table.locator('th', { hasText: 'qty' })).toBeVisible();
+
+      await expect(table.locator('td', { hasText: 'Widget' })).toBeVisible();
+      await expect(table.locator('td', { hasText: '19.99' })).toBeVisible();
+      await expect(table.locator('td', { hasText: '100' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
   test('closes preview modal when the Escape key is pressed', async ({ page }, testInfo) => {
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
diff --git a/messages/de.json b/messages/de.json
index a1690847..97fc488d 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -284,16 +284,16 @@
   "storage_preview_maximise": "Maximieren",
   "storage_preview_restore": "Wiederherstellen",
   "storage_editor_save": "Speichern",
-  "storage_editor_saving": "Speichern\u2026",
+  "storage_editor_saving": "Speichern…",
   "storage_editor_saved": "Gespeichert",
-  "storage_editor_unsaved_title": "Ungespeicherte \u00c4nderungen",
-  "storage_editor_unsaved_desc": "Sie haben ungespeicherte \u00c4nderungen. Was m\u00f6chten Sie tun?",
-  "storage_editor_save_and_close": "Speichern und schlie\u00dfen",
+  "storage_editor_unsaved_title": "Ungespeicherte Änderungen",
+  "storage_editor_unsaved_desc": "Sie haben ungespeicherte Änderungen. Was möchten Sie tun?",
+  "storage_editor_save_and_close": "Speichern und schließen",
   "storage_editor_discard": "Verwerfen",
   "storage_editor_cancel": "Abbrechen",
   "storage_editor_error": "Datei konnte nicht gespeichert werden.",
-  "storage_editor_too_large": "Datei zu gro\u00df zum Speichern. Die maximal bearbeitbare Dateigr\u00f6\u00dfe betr\u00e4gt {limit}.",
-  "storage_editor_too_large_badge": "Schreibgesch\u00fctzt: \u00fcberschreitet {limit}",
+  "storage_editor_too_large": "Datei zu groß zum Speichern. Die maximal bearbeitbare Dateigröße beträgt {limit}.",
+  "storage_editor_too_large_badge": "Schreibgeschützt: überschreitet {limit}",
   "storage_context_menu_actions": "Aktionen",
   "storage_action_upload": "Hochladen",
   "storage_upload_title": "Hochladen",
@@ -343,10 +343,55 @@
   "storage_create_file": "Neue Textdatei",
   "storage_create_folder": "Neues Verzeichnis",
   "storage_create_name": "Name",
-  "storage_create_placeholder": "Namen eingeben\u2026",
+  "storage_create_placeholder": "Namen eingeben…",
   "storage_create_confirm": "Erstellen",
   "storage_create_cancel": "Abbrechen",
   "storage_create_error": "{name} konnte nicht erstellt werden",
+  "storage_tab_new": "Neuer Tab",
+  "storage_tab_close": "Tab schließen",
+  "storage_tab_rename": "Tab umbenennen",
+  "storage_tab_list": "Explorer-Tabs",
+  "storage_tab_context_menu": "Tab-Optionen",
+  "storage_restore_tabs_message": "Sie haben {count} gespeicherte(n) Tab(s) aus Ihrer letzten Sitzung.",
+  "storage_restore_tabs_action": "Tabs wiederherstellen",
+  "storage_preview_parquet_tab_aria": "Parquet-Vorschau-Registerkarten",
+  "storage_preview_parquet_tab_metadata": "Metadaten",
+  "storage_preview_parquet_tab_data": "Daten",
+  "storage_preview_parquet_blocked_title": "Vorschau blockiert",
+  "storage_preview_parquet_blocked_desc": "Diese Parquet-Datei verwendet einen Kompressionstyp, der vom Administrator deaktiviert wurde. Wenden Sie sich an Ihren Administrator, wenn Sie dies für ein Problem halten.",
+  "storage_preview_parquet_overview": "Übersicht",
+  "storage_preview_parquet_file_size": "Dateigröße",
+  "storage_preview_parquet_total_rows": "Zeilen gesamt",
+  "storage_preview_parquet_total_columns": "Spalten gesamt",
+  "storage_preview_parquet_version": "Version",
+  "storage_preview_parquet_created_by": "Erstellt von",
+  "storage_preview_parquet_schema": "Schema",
+  "storage_preview_parquet_column": "Spalte",
+  "storage_preview_parquet_type": "Typ",
+  "storage_preview_parquet_compression_indexes": "Kompression & Indexe",
+  "storage_preview_parquet_row_groups": "Zeilengruppen",
+  "storage_preview_parquet_row_group": "Gruppe",
+  "storage_preview_parquet_offset_index": "Offset-Index",
+  "storage_preview_parquet_column_index": "Spalten-Index",
+  "storage_preview_parquet_available": "Verfügbar",
+  "storage_preview_parquet_missing": "Fehlt",
+  "storage_preview_parquet_none": "Keine",
+  "storage_preview_parquet_compression": "Kompression",
+  "storage_preview_parquet_uncompressed": "Unkomprimiert",
+  "storage_preview_parquet_compressed": "Komprimiert",
+  "storage_preview_parquet_size": "Größe",
+  "storage_preview_parquet_statistics": "Statistiken",
+  "storage_preview_parquet_min": "Min",
+  "storage_preview_parquet_max": "Max",
+  "storage_preview_parquet_null_count": "Null-Anzahl",
+  "storage_preview_parquet_distinct_count": "Distinct-Anzahl",
+  "storage_preview_parquet_not_stored": "Nicht gespeichert",
+  "storage_preview_parquet_arrow_schema": "Arrow-Schema",
+  "storage_preview_parquet_arrow_schema_present": "Eingebettetes Arrow-Schema ({size})",
+  "storage_preview_parquet_uniform": "einheitlich",
+  "storage_archive_open_error": "Archiv konnte nicht geöffnet werden. Das Format wird möglicherweise nicht unterstützt oder das Archiv ist beschädigt.",
+  "storage_archive_too_large": "Archiv ist zu groß für die Vorschau.",
+  "storage_archive_exit": "Archiv verlassen",
   "timestamp_just_now": "gerade eben",
   "timestamp_minutes_ago": [
     {
@@ -397,47 +442,5 @@
         "n=other": "vor {count} J."
       }
     }
-  ],
-  "storage_tab_new": "Neuer Tab",
-  "storage_tab_close": "Tab schließen",
-  "storage_tab_rename": "Tab umbenennen",
-  "storage_tab_list": "Explorer-Tabs",
-  "storage_tab_context_menu": "Tab-Optionen",
-  "storage_restore_tabs_message": "Sie haben {count} gespeicherte(n) Tab(s) aus Ihrer letzten Sitzung.",
-  "storage_restore_tabs_action": "Tabs wiederherstellen",
-  "storage_preview_parquet_tab_aria": "Parquet-Vorschau-Registerkarten",
-  "storage_preview_parquet_tab_metadata": "Metadaten",
-  "storage_preview_parquet_tab_data": "Daten",
-  "storage_preview_parquet_blocked_title": "Vorschau blockiert",
-  "storage_preview_parquet_blocked_desc": "Diese Parquet-Datei verwendet einen Kompressionstyp, der vom Administrator deaktiviert wurde. Wenden Sie sich an Ihren Administrator, wenn Sie dies für ein Problem halten.",
-  "storage_preview_parquet_overview": "Übersicht",
-  "storage_preview_parquet_file_size": "Dateigröße",
-  "storage_preview_parquet_total_rows": "Zeilen gesamt",
-  "storage_preview_parquet_total_columns": "Spalten gesamt",
-  "storage_preview_parquet_version": "Version",
-  "storage_preview_parquet_created_by": "Erstellt von",
-  "storage_preview_parquet_schema": "Schema",
-  "storage_preview_parquet_column": "Spalte",
-  "storage_preview_parquet_type": "Typ",
-  "storage_preview_parquet_compression_indexes": "Kompression & Indexe",
-  "storage_preview_parquet_row_groups": "Zeilengruppen",
-  "storage_preview_parquet_row_group": "Gruppe",
-  "storage_preview_parquet_offset_index": "Offset-Index",
-  "storage_preview_parquet_column_index": "Spalten-Index",
-  "storage_preview_parquet_available": "Verfügbar",
-  "storage_preview_parquet_missing": "Fehlt",
-  "storage_preview_parquet_none": "Keine",
-  "storage_preview_parquet_compression": "Kompression",
-  "storage_preview_parquet_uncompressed": "Unkomprimiert",
-  "storage_preview_parquet_compressed": "Komprimiert",
-  "storage_preview_parquet_size": "Größe",
-  "storage_preview_parquet_statistics": "Statistiken",
-  "storage_preview_parquet_min": "Min",
-  "storage_preview_parquet_max": "Max",
-  "storage_preview_parquet_null_count": "Null-Anzahl",
-  "storage_preview_parquet_distinct_count": "Distinct-Anzahl",
-  "storage_preview_parquet_not_stored": "Nicht gespeichert",
-  "storage_preview_parquet_arrow_schema": "Arrow-Schema",
-  "storage_preview_parquet_arrow_schema_present": "Eingebettetes Arrow-Schema ({size})",
-  "storage_preview_parquet_uniform": "einheitlich"
+  ]
 }
diff --git a/messages/en.json b/messages/en.json
index 0490f343..254b7de2 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -284,7 +284,7 @@
   "storage_preview_maximise": "Maximise",
   "storage_preview_restore": "Restore",
   "storage_editor_save": "Save",
-  "storage_editor_saving": "Saving\u2026",
+  "storage_editor_saving": "Saving…",
   "storage_editor_saved": "Saved",
   "storage_editor_unsaved_title": "Unsaved changes",
   "storage_editor_unsaved_desc": "You have unsaved changes. What would you like to do?",
@@ -343,10 +343,55 @@
   "storage_create_file": "New text file",
   "storage_create_folder": "New directory",
   "storage_create_name": "Name",
-  "storage_create_placeholder": "Enter name\u2026",
+  "storage_create_placeholder": "Enter name…",
   "storage_create_confirm": "Create",
   "storage_create_cancel": "Cancel",
   "storage_create_error": "Failed to create {name}",
+  "storage_tab_new": "New Tab",
+  "storage_tab_close": "Close tab",
+  "storage_tab_rename": "Rename tab",
+  "storage_tab_list": "Explorer tabs",
+  "storage_tab_context_menu": "Tab options",
+  "storage_restore_tabs_message": "You have {count} saved tab(s) from your last session.",
+  "storage_restore_tabs_action": "Restore tabs",
+  "storage_preview_parquet_tab_aria": "Parquet preview tabs",
+  "storage_preview_parquet_tab_metadata": "Metadata",
+  "storage_preview_parquet_tab_data": "Data",
+  "storage_preview_parquet_blocked_title": "Preview blocked",
+  "storage_preview_parquet_blocked_desc": "This parquet file uses a compression type that has been disallowed by the administrator. Contact your administrator if you believe this to be an issue.",
+  "storage_preview_parquet_overview": "Overview",
+  "storage_preview_parquet_file_size": "File size",
+  "storage_preview_parquet_total_rows": "Total rows",
+  "storage_preview_parquet_total_columns": "Total columns",
+  "storage_preview_parquet_version": "Version",
+  "storage_preview_parquet_created_by": "Created by",
+  "storage_preview_parquet_schema": "Schema",
+  "storage_preview_parquet_column": "Column",
+  "storage_preview_parquet_type": "Type",
+  "storage_preview_parquet_compression_indexes": "Compression & Indexes",
+  "storage_preview_parquet_row_groups": "Row groups",
+  "storage_preview_parquet_row_group": "Group",
+  "storage_preview_parquet_offset_index": "Offset index",
+  "storage_preview_parquet_column_index": "Column index",
+  "storage_preview_parquet_available": "Available",
+  "storage_preview_parquet_missing": "Missing",
+  "storage_preview_parquet_none": "None",
+  "storage_preview_parquet_compression": "Compression",
+  "storage_preview_parquet_uncompressed": "Uncompressed",
+  "storage_preview_parquet_compressed": "Compressed",
+  "storage_preview_parquet_size": "Size",
+  "storage_preview_parquet_statistics": "Statistics",
+  "storage_preview_parquet_min": "Min",
+  "storage_preview_parquet_max": "Max",
+  "storage_preview_parquet_null_count": "Null count",
+  "storage_preview_parquet_distinct_count": "Distinct count",
+  "storage_preview_parquet_not_stored": "Not stored",
+  "storage_preview_parquet_arrow_schema": "Arrow schema",
+  "storage_preview_parquet_arrow_schema_present": "Embedded Arrow schema ({size})",
+  "storage_preview_parquet_uniform": "uniform",
+  "storage_archive_open_error": "Could not open archive. The format may be unsupported or the archive is corrupt.",
+  "storage_archive_too_large": "Archive is too large to preview.",
+  "storage_archive_exit": "Exit archive",
   "timestamp_just_now": "just now",
   "timestamp_minutes_ago": [
     {
@@ -397,47 +442,5 @@
         "n=other": "{count}y ago"
       }
     }
-  ],
-  "storage_tab_new": "New Tab",
-  "storage_tab_close": "Close tab",
-  "storage_tab_rename": "Rename tab",
-  "storage_tab_list": "Explorer tabs",
-  "storage_tab_context_menu": "Tab options",
-  "storage_restore_tabs_message": "You have {count} saved tab(s) from your last session.",
-  "storage_restore_tabs_action": "Restore tabs",
-  "storage_preview_parquet_tab_aria": "Parquet preview tabs",
-  "storage_preview_parquet_tab_metadata": "Metadata",
-  "storage_preview_parquet_tab_data": "Data",
-  "storage_preview_parquet_blocked_title": "Preview blocked",
-  "storage_preview_parquet_blocked_desc": "This parquet file uses a compression type that has been disallowed by the administrator. Contact your administrator if you believe this to be an issue.",
-  "storage_preview_parquet_overview": "Overview",
-  "storage_preview_parquet_file_size": "File size",
-  "storage_preview_parquet_total_rows": "Total rows",
-  "storage_preview_parquet_total_columns": "Total columns",
-  "storage_preview_parquet_version": "Version",
-  "storage_preview_parquet_created_by": "Created by",
-  "storage_preview_parquet_schema": "Schema",
-  "storage_preview_parquet_column": "Column",
-  "storage_preview_parquet_type": "Type",
-  "storage_preview_parquet_compression_indexes": "Compression & Indexes",
-  "storage_preview_parquet_row_groups": "Row groups",
-  "storage_preview_parquet_row_group": "Group",
-  "storage_preview_parquet_offset_index": "Offset index",
-  "storage_preview_parquet_column_index": "Column index",
-  "storage_preview_parquet_available": "Available",
-  "storage_preview_parquet_missing": "Missing",
-  "storage_preview_parquet_none": "None",
-  "storage_preview_parquet_compression": "Compression",
-  "storage_preview_parquet_uncompressed": "Uncompressed",
-  "storage_preview_parquet_compressed": "Compressed",
-  "storage_preview_parquet_size": "Size",
-  "storage_preview_parquet_statistics": "Statistics",
-  "storage_preview_parquet_min": "Min",
-  "storage_preview_parquet_max": "Max",
-  "storage_preview_parquet_null_count": "Null count",
-  "storage_preview_parquet_distinct_count": "Distinct count",
-  "storage_preview_parquet_not_stored": "Not stored",
-  "storage_preview_parquet_arrow_schema": "Arrow schema",
-  "storage_preview_parquet_arrow_schema_present": "Embedded Arrow schema ({size})",
-  "storage_preview_parquet_uniform": "uniform"
+  ]
 }
diff --git a/package-lock.json b/package-lock.json
index 3b0b96cd..47842151 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,6 +12,7 @@
         "@aws-sdk/client-s3": "^3.1041.0",
         "@aws-sdk/lib-storage": "^3.1045.0",
         "@internationalized/date": "^3.11.0",
+        "adm-zip": "^0.5.17",
         "antlr4-c3": "^3.4.4",
         "antlr4ng": "^3.0.16",
         "better-auth": "^1.5.4",
@@ -19,10 +20,12 @@
         "hyparquet": "^1.25.8",
         "hyparquet-compressors": "^1.1.1",
         "monaco-editor": "^0.55.1",
+        "papaparse": "^5.5.3",
         "pg": "^8.21.0",
         "pino": "^10.3.1",
         "pretty-bytes": "^7.1.0",
         "prom-client": "^15.1.3",
+        "tar-stream": "^3.2.0",
         "undici": "^7.24.4"
       },
       "devDependencies": {
@@ -40,8 +43,11 @@
         "@sveltejs/kit": "^2.53.0",
         "@sveltejs/vite-plugin-svelte": "^6.2.4",
         "@tailwindcss/vite": "^4.2.1",
+        "@types/adm-zip": "^0.5.8",
         "@types/node": "^24",
+        "@types/papaparse": "^5.5.2",
         "@types/pg": "^8.20.0",
+        "@types/tar-stream": "^3.1.4",
         "@vitest/browser-playwright": "^4.0.18",
         "@vitest/coverage-v8": "^4.0.18",
         "antlr-ng": "^1.0.10",
@@ -192,61 +198,63 @@
         "tslib": "^2.6.2"
       }
     },
-    "node_modules/@aws-sdk/client-s3": {
-      "version": "3.1053.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1053.0.tgz",
-      "integrity": "sha512-/oGxoB6p1Nqs935Blt+v1o+anSCEf2n3RjIrcLz84i4cn2Gr+Z7JpDdUkG5+74r5ctqEPG7k/phTGbJ9fNKnHg==",
+    "node_modules/@aws-sdk/checksums": {
+      "version": "3.1000.8",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/checksums/-/checksums-3.1000.8.tgz",
+      "integrity": "sha512-v0U9S7gBIme3OTgt1LdbAF4RpvavCc+4GK1+1xqAcqtbrHsEhjQo6R45LKcjhs/+WrRJij1Y0Gztw7QPAIeUfA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-crypto/sha1-browser": "5.2.0",
-        "@aws-crypto/sha256-browser": "5.2.0",
-        "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/credential-provider-node": "^3.972.44",
-        "@aws-sdk/middleware-bucket-endpoint": "^3.972.15",
-        "@aws-sdk/middleware-expect-continue": "^3.972.13",
-        "@aws-sdk/middleware-flexible-checksums": "^3.974.21",
-        "@aws-sdk/middleware-location-constraint": "^3.972.11",
-        "@aws-sdk/middleware-sdk-s3": "^3.972.42",
-        "@aws-sdk/middleware-ssec": "^3.972.11",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/fetch-http-handler": "^5.4.3",
-        "@smithy/node-http-handler": "^4.7.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-crypto/crc32": "5.2.0",
+        "@aws-crypto/crc32c": "5.2.0",
+        "@aws-crypto/util": "5.2.0",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/core": {
-      "version": "3.974.13",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.13.tgz",
-      "integrity": "sha512-+Y5/4tHki0uYgyx8eun146DegRVQBpdKGK5RbV0FTKJPpaKTchvqVxrrRFK6Wk0JksO4iAZKw3eqxGEIwtO98w==",
+    "node_modules/@aws-sdk/client-s3": {
+      "version": "3.1075.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1075.0.tgz",
+      "integrity": "sha512-h1A6nIl1YX6Y45enGsTK7ef3ZrOnBiQJ1qF5R2K/nMWfsu6A9mc2Y5T66nxerABzyjjyyvign3MrzafnFoQKmA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.9",
-        "@aws-sdk/xml-builder": "^3.972.25",
-        "@aws/lambda-invoke-store": "^0.2.2",
-        "@smithy/core": "^3.24.3",
-        "@smithy/signature-v4": "^5.4.2",
-        "@smithy/types": "^4.14.2",
-        "bowser": "^2.11.0",
+        "@aws-crypto/sha1-browser": "5.2.0",
+        "@aws-crypto/sha256-browser": "5.2.0",
+        "@aws-crypto/sha256-js": "5.2.0",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/credential-provider-node": "^3.972.58",
+        "@aws-sdk/middleware-flexible-checksums": "^3.974.33",
+        "@aws-sdk/middleware-sdk-s3": "^3.972.54",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.35",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/crc64-nvme": {
-      "version": "3.972.9",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/crc64-nvme/-/crc64-nvme-3.972.9.tgz",
-      "integrity": "sha512-P+QGozmXn2mZZI7sDgk+aUm+RTI61MPSFB+Ir2vjEjEbEsE4e7hYtzrDvAUxZy9ko81h53e11+F/GYlvwDkaOQ==",
+    "node_modules/@aws-sdk/core": {
+      "version": "3.974.23",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.23.tgz",
+      "integrity": "sha512-MiWR/uWjxjFXGzrE0Ghc5lWxUxzHsUWFhV+OX7M4cR9SrmrnZs6TXavnCWnzzdwJeFri34xQo81rvGNzK3c4BQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/types": "^3.973.13",
+        "@aws-sdk/xml-builder": "^3.972.31",
+        "@aws/lambda-invoke-store": "^0.2.2",
+        "@smithy/core": "^3.24.6",
+        "@smithy/signature-v4": "^5.4.6",
+        "@smithy/types": "^4.14.3",
+        "bowser": "^2.11.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -254,15 +262,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-env": {
-      "version": "3.972.39",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.39.tgz",
-      "integrity": "sha512-29wX9zpAvEt1vcj0psha+y6ygBHy2V/S72mp6e7q0KARLWXq+pwE/lR6qGkwknQvruh52lXvlqZIga8Hdxkucw==",
+      "version": "3.972.49",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.49.tgz",
+      "integrity": "sha512-liB3yQNHCM9k/gu/w36XHMKPluT7HTlnGUhRbBGSISDQkcr/Sy1zsZabiuvQj8WG5yW573u9RehrBvvnIQ9OEQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -270,17 +278,17 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-http": {
-      "version": "3.972.41",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.41.tgz",
-      "integrity": "sha512-IA3CQTjtJkb6u1H4mE4936c8OPBMa9Jggtwe8U2Mqw/vvb/tZ5Ebd0mcZcX0uKWQhOyYo/+qNIwkV5Xh+FeJJA==",
+      "version": "3.972.51",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.51.tgz",
+      "integrity": "sha512-XET0H2oofciJ5lMRWNIvRjAP7Q3wv2XT+JtJJEdhPWUMwe3TvQ9qcxonpu7vXmNngncvFpi4E2It+Tamas/naA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/fetch-http-handler": "^5.4.3",
-        "@smithy/node-http-handler": "^4.7.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -288,23 +296,23 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-ini": {
-      "version": "3.972.43",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.43.tgz",
-      "integrity": "sha512-4mzII+3mZEVXXE1xzrLQrCJL7/r62A63bA6SVzZoNL5rqCJghpf+xgGltVrIBBs0n+mOZBKrQl2tRREtvZ5l6A==",
+      "version": "3.972.56",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.56.tgz",
+      "integrity": "sha512-IAmc61hbgQiHht9U3x0tnRwz0lzdwOwD/i9voRgdJrKamF+JtmrBOsW9GwB7mfFonNWOWL4qARWYrF8veEMe3w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/credential-provider-env": "^3.972.39",
-        "@aws-sdk/credential-provider-http": "^3.972.41",
-        "@aws-sdk/credential-provider-login": "^3.972.43",
-        "@aws-sdk/credential-provider-process": "^3.972.39",
-        "@aws-sdk/credential-provider-sso": "^3.972.43",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.43",
-        "@aws-sdk/nested-clients": "^3.997.11",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/credential-provider-imds": "^4.3.2",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/credential-provider-env": "^3.972.49",
+        "@aws-sdk/credential-provider-http": "^3.972.51",
+        "@aws-sdk/credential-provider-login": "^3.972.55",
+        "@aws-sdk/credential-provider-process": "^3.972.49",
+        "@aws-sdk/credential-provider-sso": "^3.972.55",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.55",
+        "@aws-sdk/nested-clients": "^3.997.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/credential-provider-imds": "^4.3.7",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -312,16 +320,16 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-login": {
-      "version": "3.972.43",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.43.tgz",
-      "integrity": "sha512-HG7kQCwXtbv3oBV61Ins0oNX8KKyvrMqqRkb6ZiAfQHbMuHaiNaEb2KnpKLPkNpqImSBK82UkVE/kaY6IfWikA==",
+      "version": "3.972.55",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.55.tgz",
+      "integrity": "sha512-hBBkANo3cDn+h2qxxzER4a+J8JCO9o9Z/YYmU7iky6AcaarX5RRdRcHNC6SLdwY0vAXQygn6soUbDqPn3GghaA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/nested-clients": "^3.997.11",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/nested-clients": "^3.997.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -329,21 +337,21 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-node": {
-      "version": "3.972.44",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.44.tgz",
-      "integrity": "sha512-sDaBIT0yrNNIPfvlsiTCmANm07zKju+ipWODjEXgZlsjMeIJR3LVp7RDyAOzUoAsTbDfYKDWp+i5WrFiQP6rmQ==",
+      "version": "3.972.58",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.58.tgz",
+      "integrity": "sha512-OyCLVmSI7pZO8hxwNVX6pXhTVlJqRBTp+ijdEfJSUj0RyjHnF602OfAarOzGq6wkGodeFkYBt8MmJ6A6ycRgWw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/credential-provider-env": "^3.972.39",
-        "@aws-sdk/credential-provider-http": "^3.972.41",
-        "@aws-sdk/credential-provider-ini": "^3.972.43",
-        "@aws-sdk/credential-provider-process": "^3.972.39",
-        "@aws-sdk/credential-provider-sso": "^3.972.43",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.43",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/credential-provider-imds": "^4.3.2",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/credential-provider-env": "^3.972.49",
+        "@aws-sdk/credential-provider-http": "^3.972.51",
+        "@aws-sdk/credential-provider-ini": "^3.972.56",
+        "@aws-sdk/credential-provider-process": "^3.972.49",
+        "@aws-sdk/credential-provider-sso": "^3.972.55",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.55",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/credential-provider-imds": "^4.3.7",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -351,15 +359,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-process": {
-      "version": "3.972.39",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.39.tgz",
-      "integrity": "sha512-2k/amBifLd75eXNwgvPw/2lKYSQ3NhvHQgkVKVjfUq13/eJ3JRtHmznuFenn74OK3sSfp4SMy1YB2w+UVXoKqA==",
+      "version": "3.972.49",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.49.tgz",
+      "integrity": "sha512-C8h36lBuC/RnBSsjlO+dn6xZm3KbAl5vpJaVPAfQnMmz2/OISmKOc8XZcqMQgO2ADwBYNRMM6Kf3vz9G/TulMQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -367,17 +375,17 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-sso": {
-      "version": "3.972.43",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.43.tgz",
-      "integrity": "sha512-LPc3+Y4vhH1T4x6CMqwCM6hk5+SRf/Lwmgm8INm95wxTtIRHcMwQUVkDzWu4Iw/RSncxYM2BC01OrYbxOPZvyg==",
+      "version": "3.972.55",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.55.tgz",
+      "integrity": "sha512-1FkOz74Ea5QGS9jtIoXp55T/IkSS3spv+nLTT07fRY/+T5xmEOqaYBVIaEmX4zTNvbV6g2lrtlaVKWEoNyJt3w==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/nested-clients": "^3.997.11",
-        "@aws-sdk/token-providers": "3.1052.0",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/nested-clients": "^3.997.23",
+        "@aws-sdk/token-providers": "3.1074.0",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -385,16 +393,16 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-web-identity": {
-      "version": "3.972.43",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.43.tgz",
-      "integrity": "sha512-wQtL34lUD/09VXjwAUo2T+I3aEXRDxMB3DKmTJL/Zj0Gi6sLDTrVhae1XVt01yzkquOWajI/sZW72JGDZ1ciTw==",
+      "version": "3.972.55",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.55.tgz",
+      "integrity": "sha512-g2BoECD1q01kTPByi56+VLVvdWDzMkKIcr77qixpqH0okw2t0U5CoPv+6S8v/D1Y2Wa6QKKtn6XAtDzP+Kfpvg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/nested-clients": "^3.997.11",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/nested-clients": "^3.997.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -402,13 +410,13 @@
       }
     },
     "node_modules/@aws-sdk/lib-storage": {
-      "version": "3.1053.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/lib-storage/-/lib-storage-3.1053.0.tgz",
-      "integrity": "sha512-Y5fyrJ2Qln3lmU0I335no+zdyytpM7svvYOYadZiV2bXGDXEO26A8B+4iGW264GvBO4jnl/iPHVZ/hJIqXekAA==",
+      "version": "3.1075.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/lib-storage/-/lib-storage-3.1075.0.tgz",
+      "integrity": "sha512-Npdac3/Fv994iCdFFeqloPel+95Zv6dRiRUpfey6W/CqpB/QdnYP60U4YBhBgJj6V5020Pm3ad0HV4WzCE5hHQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "buffer": "5.6.0",
         "events": "3.3.0",
         "stream-browserify": "3.0.0",
@@ -418,68 +426,16 @@
         "node": ">=20.0.0"
       },
       "peerDependencies": {
-        "@aws-sdk/client-s3": "^3.1053.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-bucket-endpoint": {
-      "version": "3.972.15",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-bucket-endpoint/-/middleware-bucket-endpoint-3.972.15.tgz",
-      "integrity": "sha512-O2HDANa+MrvbxpaRVQDiH3T13uAa9AkMjKyZmDygwauAmmvqZ5B0iRmKW+fuVGW6NPXuyXurFgIx69lSvmAWGA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-expect-continue": {
-      "version": "3.972.13",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-expect-continue/-/middleware-expect-continue-3.972.13.tgz",
-      "integrity": "sha512-sHiqIFg8o2ipT7t40B89Vj0ubSUtY6OSt/+Ee/OXhHch5K4+81zP2+QX8Lkc/nJ2QSmCySxOke7TEbmX69fe2g==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
+        "@aws-sdk/client-s3": "^3.1075.0"
       }
     },
     "node_modules/@aws-sdk/middleware-flexible-checksums": {
-      "version": "3.974.21",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.974.21.tgz",
-      "integrity": "sha512-alAu9heyiBK/OmRNXVxq8mmPTgeW2AQ6EYjRsI38kPZa1MZvt2Jh+BlGq7/GG9OVXOaEgD7DlGj/Lzfy5OmuEg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-crypto/crc32": "5.2.0",
-        "@aws-crypto/crc32c": "5.2.0",
-        "@aws-crypto/util": "5.2.0",
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/crc64-nvme": "^3.972.9",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-location-constraint": {
-      "version": "3.972.11",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-location-constraint/-/middleware-location-constraint-3.972.11.tgz",
-      "integrity": "sha512-hkfspNUP4criAH6ton6BGKgnm5dZx+7bUOy1YqlTfejDeUPAM23D81q/IX+hdlS3KUsfwGz5ADTqZWKBEUpf4A==",
+      "version": "3.974.33",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.974.33.tgz",
+      "integrity": "sha512-qMgQSPemQq2/eW/e/0+SpY4kYR5L7dUgBiVdEc5bd+ztHNv07ZMYiI+sTiir3TgKndFfglSw/VFi7oZJ6bZ63g==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/checksums": "^3.1000.8",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -487,31 +443,16 @@
       }
     },
     "node_modules/@aws-sdk/middleware-sdk-s3": {
-      "version": "3.972.42",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.42.tgz",
-      "integrity": "sha512-/xNqNGXv9LaxZd25L9VV4pnSOw9OdDNO4rAHamM+h3KQBSITljIH9vk3dveGga1I2j36lQd0rdG3gjNEXvtNew==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/signature-v4": "^5.4.2",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
-      },
-      "engines": {
-        "node": ">=20.0.0"
-      }
-    },
-    "node_modules/@aws-sdk/middleware-ssec": {
-      "version": "3.972.11",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-ssec/-/middleware-ssec-3.972.11.tgz",
-      "integrity": "sha512-7PQvGNhtveKlvVqNahqWx5yrwxP7ecwAoB1dYBf8eKwfo2tzzCbNnW+q2nO3N066ktQaB4iBQbDRWtizm+amoQ==",
+      "version": "3.972.54",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.54.tgz",
+      "integrity": "sha512-GDfDQ0gwLFRKN9gWIKcmVrHJ3e7XagnY7N1LLzMVNgnOnuY7f/ALgmy3CuBjosWD95T/Z6e+gs1IeWmLPkyLKQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.35",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -519,20 +460,20 @@
       }
     },
     "node_modules/@aws-sdk/nested-clients": {
-      "version": "3.997.11",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.11.tgz",
-      "integrity": "sha512-nWXXJ1r/r8N2Gw1pWolRgED38/A9A8DHR2ETWIv220zh4PZHcybbR4hUVWWktmNXTRHzDJwRluapHn0rZxuoqA==",
+      "version": "3.997.23",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.23.tgz",
+      "integrity": "sha512-gO93ZPsI2bxeFZD42f1/qjDw6FAZkNZcKRO94LIiT03fzOmcJ9e/tunxjVjA1Rl69ClmVJzz8H3G9CdKef10PA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/fetch-http-handler": "^5.4.3",
-        "@smithy/node-http-handler": "^4.7.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.35",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/fetch-http-handler": "^5.4.6",
+        "@smithy/node-http-handler": "^4.7.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -540,15 +481,14 @@
       }
     },
     "node_modules/@aws-sdk/signature-v4-multi-region": {
-      "version": "3.996.28",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.28.tgz",
-      "integrity": "sha512-qs9z5LqXO/CZC2Lg9SGKpoLU8Rhi+m2pFKZqfO9pytX1clc0katqtsDNupJxFy0xT9wsZSPzM2v1y+/H/zfp5Q==",
+      "version": "3.996.35",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.35.tgz",
+      "integrity": "sha512-6L/VWs+Wch2stHemCGTmUNqKLMzURxQDK5boNG3Jn3kAOp71meDUuS5sbObpEvFxHDq0uWeSLFDNSYsjNt+Dlg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/signature-v4": "^5.4.2",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/signature-v4": "^5.4.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -556,16 +496,16 @@
       }
     },
     "node_modules/@aws-sdk/token-providers": {
-      "version": "3.1052.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1052.0.tgz",
-      "integrity": "sha512-QqZNB3so7UIDxZtroc85TQaLVxdZRFm0eWM1CSR2N+b06as9TOrilvrlTZuj3guYlxMs6yLOgGxnklJ5qMYtTw==",
+      "version": "3.1074.0",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1074.0.tgz",
+      "integrity": "sha512-pv80IzgGW4RnXWtft692chZOM9i6PhebVsLCcnaM4dBEPZva2fE6FXAHs76G7Rc7s3yGyX/68G0nZMrUy+Vmpg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.13",
-        "@aws-sdk/nested-clients": "^3.997.11",
-        "@aws-sdk/types": "^3.973.9",
-        "@smithy/core": "^3.24.3",
-        "@smithy/types": "^4.14.2",
+        "@aws-sdk/core": "^3.974.23",
+        "@aws-sdk/nested-clients": "^3.997.23",
+        "@aws-sdk/types": "^3.973.13",
+        "@smithy/core": "^3.24.6",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -573,12 +513,12 @@
       }
     },
     "node_modules/@aws-sdk/types": {
-      "version": "3.973.9",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.9.tgz",
-      "integrity": "sha512-kuBfgQVdcz5Bmapc4A13YbpVw/pXkesfhetcFYwbntqas8sF41OHyd4o28+/TG2ZQdHBsv90Lsu5y6oitvYCdg==",
+      "version": "3.973.13",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.13.tgz",
+      "integrity": "sha512-pEHZqRkAlHfnfAU9tK+WpKv/gBNjGJrHMgA3A0iYRGyswBS2t0pfez+lWlwktb3Bqa0ovh7w/QJTFwp3fDxLNg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.2",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -586,9 +526,9 @@
       }
     },
     "node_modules/@aws-sdk/util-locate-window": {
-      "version": "3.965.5",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-locate-window/-/util-locate-window-3.965.5.tgz",
-      "integrity": "sha512-WhlJNNINQB+9qtLtZJcpQdgZw3SCDCpXdUJP7cToGwHbCWCnRckGlc6Bx/OhWwIYFNAn+FIydY8SZ0QmVu3xTQ==",
+      "version": "3.965.8",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/util-locate-window/-/util-locate-window-3.965.8.tgz",
+      "integrity": "sha512-uUbMs1cBZPafD0ohUj6EwNf0fPZ534NvBxHox4hjX+0Rxq5paSYUem7+hi833pYrzrcnBATKIYpR02MDXT5M9g==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -598,14 +538,12 @@
       }
     },
     "node_modules/@aws-sdk/xml-builder": {
-      "version": "3.972.25",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.25.tgz",
-      "integrity": "sha512-GH+Kjz4nPKWKHnsiQpnhP1MJdTGIcK4rAka6tzakgjjUkVgNsmPeEbbRAf09SzS1hjGu6duGHCBsxYke0BhHjQ==",
+      "version": "3.972.31",
+      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.31.tgz",
+      "integrity": "sha512-SzE4Pgyl+hDF+BuyuzxUSpwnuUu9lJuO1YGgteG89/4Qv0+2IQiVQqdbPV32IozLvXWQChPQcdkk/sKvb1QHiQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@nodable/entities": "2.1.0",
-        "@smithy/types": "^4.14.2",
-        "fast-xml-parser": "5.7.3",
+        "@smithy/types": "^4.14.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -658,9 +596,9 @@
       }
     },
     "node_modules/@babel/runtime": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.6.tgz",
-      "integrity": "sha512-05WQkdpL9COIMz4LjTxGpPNCdlpyimKppYNoJ5Di5EUObifl8t4tuLuUBBZEpoLYOmfvIWrsp9fCl0HoPRVTdA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
+      "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -686,98 +624,156 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz",
       "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"
       }
     },
-    "node_modules/@better-auth/utils": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.3.1.tgz",
-      "integrity": "sha512-+CGp4UmZSUrHHnpHhLPYu6cV+wSUSvVbZbNykxhUDocpVNTo9uFFxw/NqJlh1iC4wQ9HKKWGCKuZ5wUgS0v6Kg==",
-      "license": "MIT"
-    },
-    "node_modules/@better-fetch/fetch": {
-      "version": "1.1.21",
-      "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.1.21.tgz",
-      "integrity": "sha512-/ImESw0sskqlVR94jB+5+Pxjf+xBwDZF/N5+y2/q4EqD7IARUTSpPfIo8uf39SYpCxyOCtbyYpUrZ3F/k0zT4A=="
-    },
-    "node_modules/@chevrotain/cst-dts-gen": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/cst-dts-gen/-/cst-dts-gen-10.5.0.tgz",
-      "integrity": "sha512-lhmC/FyqQ2o7pGK4Om+hzuDrm9rhFYIJ/AXoQBeongmn870Xeb0L6oGEiuR8nohFNL5sMaQEJWCxr1oIVIVXrw==",
-      "license": "Apache-2.0",
-      "peer": true,
+    "node_modules/@better-auth/core": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.6.20.tgz",
+      "integrity": "sha512-y73I1xNXuNYiHBFduWGRcJ2ro2rNuVDEYkgVMJtIaRXtbosdXHs9gfyQrHecgeHMHKx1SYSBT/CExak0vVMTng==",
+      "license": "MIT",
       "dependencies": {
-        "@chevrotain/gast": "10.5.0",
-        "@chevrotain/types": "10.5.0",
-        "lodash": "4.17.21"
+        "@opentelemetry/semantic-conventions": "^1.39.0",
+        "@standard-schema/spec": "^1.1.0",
+        "zod": "^4.3.6"
+      },
+      "peerDependencies": {
+        "@better-auth/utils": "0.4.2",
+        "@better-fetch/fetch": "1.3.1",
+        "@cloudflare/workers-types": ">=4",
+        "@opentelemetry/api": "^1.9.0",
+        "better-call": "1.3.6",
+        "jose": "^6.1.0",
+        "kysely": "^0.28.5 || ^0.29.0",
+        "nanostores": "^1.0.1"
+      },
+      "peerDependenciesMeta": {
+        "@cloudflare/workers-types": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@chevrotain/gast": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/gast/-/gast-10.5.0.tgz",
-      "integrity": "sha512-pXdMJ9XeDAbgOWKuD1Fldz4ieCs6+nLNmyVhe2gZVqoO7v8HXuHYs5OV2EzUtbuai37TlOAQHrTDvxMnvMJz3A==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@chevrotain/types": "10.5.0",
-        "lodash": "4.17.21"
+    "node_modules/@better-auth/drizzle-adapter": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/@better-auth/drizzle-adapter/-/drizzle-adapter-1.6.20.tgz",
+      "integrity": "sha512-hJHfCdAiZrC7EmZAt3NAiGgcNo9Y5Qz3PLL+a9rODXaAJGCMvzUJniqef9wHuJBwU0SWW+2f4wXe8xQmaC/IKQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@better-auth/core": "^1.6.20",
+        "@better-auth/utils": "0.4.2",
+        "drizzle-orm": "^0.45.2"
+      },
+      "peerDependenciesMeta": {
+        "drizzle-orm": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@chevrotain/types": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/types/-/types-10.5.0.tgz",
-      "integrity": "sha512-f1MAia0x/pAVPWH/T73BJVyO2XU5tI4/iE7cnxb7tqdNTNhQI3Uq3XkqcoteTmD4t1aM0LbHCJOhgIDn07kl2A==",
-      "license": "Apache-2.0",
-      "peer": true
+    "node_modules/@better-auth/kysely-adapter": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/@better-auth/kysely-adapter/-/kysely-adapter-1.6.20.tgz",
+      "integrity": "sha512-Uvpmgbx5y8JqXroVanNzDdKzOl3HojoTz+/X6MR6zOUr25IzlYz660mjnu0rxKiIF55kD3CroqFsDzjNUw7ERw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@better-auth/core": "^1.6.20",
+        "@better-auth/utils": "0.4.2",
+        "kysely": "^0.28.17 || ^0.29.0"
+      },
+      "peerDependenciesMeta": {
+        "kysely": {
+          "optional": true
+        }
+      }
     },
-    "node_modules/@chevrotain/utils": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@chevrotain/utils/-/utils-10.5.0.tgz",
-      "integrity": "sha512-hBzuU5+JjB2cqNZyszkDHZgOSrUUT8V3dhgRl8Q9Gp6dAj/H5+KILGjbhDpc3Iy9qmqlm/akuOI2ut9VUtzJxQ==",
-      "license": "Apache-2.0",
-      "peer": true
+    "node_modules/@better-auth/memory-adapter": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/@better-auth/memory-adapter/-/memory-adapter-1.6.20.tgz",
+      "integrity": "sha512-J5Ni0LlFijbzXlwu2rFHaD8zEFocmajyzWkRnHsq8LhV/Dk4iWQwwnqzLrPoDQEj8roECAUF03hrIeMzqWRqJQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@better-auth/core": "^1.6.20",
+        "@better-auth/utils": "0.4.2"
+      }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-4.2.1.tgz",
-      "integrity": "sha512-SOA/96sf0wsgUYCRtFkLFm6WoFhG+q1BxdC84hPSn9J3xWlH1e7OnTPJT+WNUzTqzX1nSm5JhjRX4krozu2X+g==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
-        }
-      ],
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@cyclonedx/cyclonedx-library": "^10.0.0",
-        "commander": "^14.0.0",
-        "normalize-package-data": "^7.0.0 || ^8.0.0",
-        "packageurl-js": "^2.0.1",
-        "spdx-expression-parse": "^3.0.1 || ^4.0.0",
-        "xmlbuilder2": "^3.0.2 || ^4.0.3"
-      },
-      "bin": {
-        "cyclonedx-npm": "bin/cyclonedx-npm-cli.js"
+    "node_modules/@better-auth/mongo-adapter": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/@better-auth/mongo-adapter/-/mongo-adapter-1.6.20.tgz",
+      "integrity": "sha512-ClDBJf6h4g85WJswxwQwxLaiyRU67Gmz/uaIf19tY1gqlLJDykSGjmqRNSBMG5rWABNzcNqbO4KG31rYUldbIw==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@better-auth/core": "^1.6.20",
+        "@better-auth/utils": "0.4.2",
+        "mongodb": "^6.0.0 || ^7.0.0"
       },
-      "engines": {
-        "node": ">=20.18.0",
-        "npm": ">=9"
+      "peerDependenciesMeta": {
+        "mongodb": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@better-auth/prisma-adapter": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/@better-auth/prisma-adapter/-/prisma-adapter-1.6.20.tgz",
+      "integrity": "sha512-WhYdhSGuVSfu1peCSf2snmmVzfWjRaEvbSrsNCusiwGE9l94HlES4mjSPM48fed24hL7yg4j1dYK/yjEt87FpQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@better-auth/core": "^1.6.20",
+        "@better-auth/utils": "0.4.2",
+        "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
+        "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0"
       },
-      "optionalDependencies": {
-        "ajv": "^8.12.0",
-        "ajv-formats": "^3.0.1",
-        "ajv-formats-draft2019": "^1.6.1",
-        "libxmljs2": "^0.35||^0.37"
+      "peerDependenciesMeta": {
+        "@prisma/client": {
+          "optional": true
+        },
+        "prisma": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/@cyclonedx/cyclonedx-library": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-library/-/cyclonedx-library-10.0.0.tgz",
-      "integrity": "sha512-xDXf2eqzeFHdjamj6oBV3duRSfrlmsJ5+2z9tXp7q5qxJP5Awmjf4ABSutS4qkVHHj7JzKFL/EM0V0Nihc7zPg==",
+    "node_modules/@better-auth/telemetry": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.6.20.tgz",
+      "integrity": "sha512-3BhbY3naQDERvdJvJ7fGszVY6rpsVfc6c9uyBVZlC1coVEF/rkM0rIcjtMVI1GUH7vWy1wjR6qF5vQnMun3XNQ==",
+      "license": "MIT",
+      "peerDependencies": {
+        "@better-auth/core": "^1.6.20",
+        "@better-auth/utils": "0.4.2",
+        "@better-fetch/fetch": "1.3.1"
+      }
+    },
+    "node_modules/@better-auth/utils": {
+      "version": "0.4.2",
+      "resolved": "https://registry.npmjs.org/@better-auth/utils/-/utils-0.4.2.tgz",
+      "integrity": "sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==",
+      "license": "MIT",
+      "dependencies": {
+        "@noble/hashes": "^2.0.1"
+      }
+    },
+    "node_modules/@better-fetch/fetch": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@better-fetch/fetch/-/fetch-1.3.1.tgz",
+      "integrity": "sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==",
+      "license": "MIT"
+    },
+    "node_modules/@blazediff/core": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@blazediff/core/-/core-1.9.1.tgz",
+      "integrity": "sha512-ehg3jIkYKulZh+8om/O25vkvSsXXwC+skXmyA87FFx6A/45eqOkZsBltMw/TVteb0mloiGT8oGRTcjRAz66zaA==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@cyclonedx/cyclonedx-library": {
+      "version": "10.1.0",
+      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-library/-/cyclonedx-library-10.1.0.tgz",
+      "integrity": "sha512-4yq0KTQIA32UHJwFMDeY5xj2asp3Mk5lzx4JRVXLOb0YE8w1KeR61c1m/gJ4sjMXpiiEDfaITVQu8BLUuy7t3A==",
       "dev": true,
       "funding": [
         {
@@ -822,42 +818,40 @@
         }
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+    "node_modules/@cyclonedx/cyclonedx-npm": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-4.2.1.tgz",
+      "integrity": "sha512-SOA/96sf0wsgUYCRtFkLFm6WoFhG+q1BxdC84hPSn9J3xWlH1e7OnTPJT+WNUzTqzX1nSm5JhjRX4krozu2X+g==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        }
+      ],
+      "license": "Apache-2.0",
       "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
+        "@cyclonedx/cyclonedx-library": "^10.0.0",
+        "commander": "^14.0.0",
+        "normalize-package-data": "^7.0.0 || ^8.0.0",
+        "packageurl-js": "^2.0.1",
+        "spdx-expression-parse": "^3.0.1 || ^4.0.0",
+        "xmlbuilder2": "^3.0.2 || ^4.0.3"
+      },
+      "bin": {
+        "cyclonedx-npm": "bin/cyclonedx-npm-cli.js"
       },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/commander": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
-      "dev": true,
-      "license": "MIT",
       "engines": {
-        "node": ">=20"
+        "node": ">=20.18.0",
+        "npm": ">=9"
+      },
+      "optionalDependencies": {
+        "ajv": "^8.12.0",
+        "ajv-formats": "^3.0.1",
+        "ajv-formats-draft2019": "^1.6.1",
+        "libxmljs2": "^0.35||^0.37"
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/@drizzle-team/brocli": {
       "version": "0.10.2",
       "resolved": "https://registry.npmjs.org/@drizzle-team/brocli/-/brocli-0.10.2.tgz",
@@ -865,165 +859,19 @@
       "devOptional": true,
       "license": "Apache-2.0"
     },
-    "node_modules/@electric-sql/pglite": {
-      "version": "0.3.15",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite/-/pglite-0.3.15.tgz",
-      "integrity": "sha512-Cj++n1Mekf9ETfdc16TlDi+cDDQF0W7EcbyRHYOAeZdsAe8M/FJg18itDTSwyHfar2WIezawM9o0EKaRGVKygQ==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/@electric-sql/pglite-socket": {
-      "version": "0.0.20",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-socket/-/pglite-socket-0.0.20.tgz",
-      "integrity": "sha512-J5nLGsicnD9wJHnno9r+DGxfcZWh+YJMCe0q/aCgtG6XOm9Z7fKeite8IZSNXgZeGltSigM9U/vAWZQWdgcSFg==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "bin": {
-        "pglite-server": "dist/scripts/server.js"
-      },
-      "peerDependencies": {
-        "@electric-sql/pglite": "0.3.15"
-      }
-    },
-    "node_modules/@electric-sql/pglite-tools": {
-      "version": "0.2.20",
-      "resolved": "https://registry.npmjs.org/@electric-sql/pglite-tools/-/pglite-tools-0.2.20.tgz",
-      "integrity": "sha512-BK50ZnYa3IG7ztXhtgYf0Q7zijV32Iw1cYS8C+ThdQlwx12V5VZ9KRJ42y82Hyb4PkTxZQklVQA9JHyUlex33A==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "peerDependencies": {
-        "@electric-sql/pglite": "0.3.15"
-      }
-    },
-    "node_modules/@emnapi/core": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/core/-/core-1.9.0.tgz",
-      "integrity": "sha512-0DQ98G9ZQZOxfUcQn1waV2yS8aWdZ6kJMbYCJB3oUBecjWYO1fqJ+a1DRfPF3O5JEkwqwP1A9QEN/9mYm2Yd0w==",
-      "dev": true,
+    "node_modules/@esbuild-kit/core-utils": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/@esbuild-kit/core-utils/-/core-utils-3.3.2.tgz",
+      "integrity": "sha512-sPRAnw9CdSsRmEtnsl2WXWdyquogVpB3yZ3dgwJfe8zrOzTsV7cJvmwrKVa+0ma5BoiGJ+BoqkMvawbayKUsqQ==",
+      "deprecated": "Merged into tsx: https://tsx.is",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "@emnapi/wasi-threads": "1.2.0",
-        "tslib": "^2.4.0"
+        "esbuild": "~0.18.20",
+        "source-map-support": "^0.5.21"
       }
     },
-    "node_modules/@emnapi/runtime": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/runtime/-/runtime-1.9.0.tgz",
-      "integrity": "sha512-QN75eB0IH2ywSpRpNddCRfQIhmJYBCJ1x5Lb3IscKAL8bMnVAKnRg8dCoXbHzVLLH7P38N2Z3mtulB7W0J0FKw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/@emnapi/wasi-threads/-/wasi-threads-1.2.0.tgz",
-      "integrity": "sha512-N10dEJNSsUx41Z6pZsXU8FjPjpBEplgH24sfkmITrBED1/U2Esum9F3lfLrMjKHHjmi557zQn7kR9R+XWXu5Rg==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@esbuild-kit/core-utils": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/@esbuild-kit/core-utils/-/core-utils-3.3.2.tgz",
-      "integrity": "sha512-sPRAnw9CdSsRmEtnsl2WXWdyquogVpB3yZ3dgwJfe8zrOzTsV7cJvmwrKVa+0ma5BoiGJ+BoqkMvawbayKUsqQ==",
-      "deprecated": "Merged into tsx: https://tsx.is",
-      "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "esbuild": "~0.18.20",
-        "source-map-support": "^0.5.21"
-      }
-    },
-    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-x64": {
-      "version": "0.18.20",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.18.20.tgz",
-      "integrity": "sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=12"
-      }
-    },
-    "node_modules/@esbuild-kit/core-utils/node_modules/esbuild": {
-      "version": "0.18.20",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.18.20.tgz",
-      "integrity": "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==",
-      "devOptional": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "bin": {
-        "esbuild": "bin/esbuild"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "optionalDependencies": {
-        "@esbuild/android-arm": "0.18.20",
-        "@esbuild/android-arm64": "0.18.20",
-        "@esbuild/android-x64": "0.18.20",
-        "@esbuild/darwin-arm64": "0.18.20",
-        "@esbuild/darwin-x64": "0.18.20",
-        "@esbuild/freebsd-arm64": "0.18.20",
-        "@esbuild/freebsd-x64": "0.18.20",
-        "@esbuild/linux-arm": "0.18.20",
-        "@esbuild/linux-arm64": "0.18.20",
-        "@esbuild/linux-ia32": "0.18.20",
-        "@esbuild/linux-loong64": "0.18.20",
-        "@esbuild/linux-mips64el": "0.18.20",
-        "@esbuild/linux-ppc64": "0.18.20",
-        "@esbuild/linux-riscv64": "0.18.20",
-        "@esbuild/linux-s390x": "0.18.20",
-        "@esbuild/linux-x64": "0.18.20",
-        "@esbuild/netbsd-x64": "0.18.20",
-        "@esbuild/openbsd-x64": "0.18.20",
-        "@esbuild/sunos-x64": "0.18.20",
-        "@esbuild/win32-arm64": "0.18.20",
-        "@esbuild/win32-ia32": "0.18.20",
-        "@esbuild/win32-x64": "0.18.20"
-      }
-    },
-    "node_modules/@esbuild-kit/esm-loader": {
-      "version": "2.6.5",
-      "resolved": "https://registry.npmjs.org/@esbuild-kit/esm-loader/-/esm-loader-2.6.5.tgz",
-      "integrity": "sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA==",
-      "deprecated": "Merged into tsx: https://tsx.is",
-      "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "@esbuild-kit/core-utils": "^3.3.2",
-        "get-tsconfig": "^4.7.0"
-      }
-    },
-    "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
-      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/android-arm": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/android-arm": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.18.20.tgz",
       "integrity": "sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw==",
@@ -1039,7 +887,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/android-arm64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/android-arm64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.18.20.tgz",
       "integrity": "sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ==",
@@ -1055,7 +903,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/android-x64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/android-x64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.18.20.tgz",
       "integrity": "sha512-8GDdlePJA8D6zlZYJV/jnrRAi6rOiNaCC/JclcXpB+KIuvfBN4owLtgzY2bsxnx666XjJx2kDPUmnTtR8qKQUg==",
@@ -1071,7 +919,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/darwin-arm64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/darwin-arm64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.18.20.tgz",
       "integrity": "sha512-bxRHW5kHU38zS2lPTPOyuyTm+S+eobPUnTNkdJEfAddYgEcll4xkT8DB9d2008DtTbl7uJag2HuE5NZAZgnNEA==",
@@ -1087,7 +935,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/darwin-x64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/darwin-x64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.18.20.tgz",
       "integrity": "sha512-pc5gxlMDxzm513qPGbCbDukOdsGtKhfxD1zJKXjCCcU7ju50O7MeAZ8c4krSJcOIJGFR+qx21yMMVYwiQvyTyQ==",
@@ -1103,7 +951,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/freebsd-arm64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/freebsd-arm64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.18.20.tgz",
       "integrity": "sha512-yqDQHy4QHevpMAaxhhIwYPMv1NECwOvIpGCZkECn8w2WFHXjEwrBn3CeNIYsibZ/iZEUemj++M26W3cNR5h+Tw==",
@@ -1119,7 +967,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/freebsd-x64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/freebsd-x64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.18.20.tgz",
       "integrity": "sha512-tgWRPPuQsd3RmBZwarGVHZQvtzfEBOreNuxEMKFcd5DaDn2PbBxfwLcj4+aenoh7ctXcbXmOQIn8HI6mCSw5MQ==",
@@ -1135,7 +983,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-arm": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-arm": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.18.20.tgz",
       "integrity": "sha512-/5bHkMWnq1EgKr1V+Ybz3s1hWXok7mDFUMQ4cG10AfW3wL02PSZi5kFpYKrptDsgb2WAJIvRcDm+qIvXf/apvg==",
@@ -1151,7 +999,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-arm64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-arm64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.18.20.tgz",
       "integrity": "sha512-2YbscF+UL7SQAVIpnWvYwM+3LskyDmPhe31pE7/aoTMFKKzIc9lLbyGUpmmb8a8AixOL61sQ/mFh3jEjHYFvdA==",
@@ -1167,7 +1015,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-ia32": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-ia32": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.18.20.tgz",
       "integrity": "sha512-P4etWwq6IsReT0E1KHU40bOnzMHoH73aXp96Fs8TIT6z9Hu8G6+0SHSw9i2isWrD2nbx2qo5yUqACgdfVGx7TA==",
@@ -1183,7 +1031,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-loong64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-loong64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.18.20.tgz",
       "integrity": "sha512-nXW8nqBTrOpDLPgPY9uV+/1DjxoQ7DoB2N8eocyq8I9XuqJ7BiAMDMf9n1xZM9TgW0J8zrquIb/A7s3BJv7rjg==",
@@ -1199,7 +1047,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-mips64el": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-mips64el": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.18.20.tgz",
       "integrity": "sha512-d5NeaXZcHp8PzYy5VnXV3VSd2D328Zb+9dEq5HE6bw6+N86JVPExrA6O68OPwobntbNJ0pzCpUFZTo3w0GyetQ==",
@@ -1215,7 +1063,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-ppc64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-ppc64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.18.20.tgz",
       "integrity": "sha512-WHPyeScRNcmANnLQkq6AfyXRFr5D6N2sKgkFo2FqguP44Nw2eyDlbTdZwd9GYk98DZG9QItIiTlFLHJHjxP3FA==",
@@ -1231,7 +1079,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-riscv64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-riscv64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.18.20.tgz",
       "integrity": "sha512-WSxo6h5ecI5XH34KC7w5veNnKkju3zBRLEQNY7mv5mtBmrP/MjNBCAlsM2u5hDBlS3NGcTQpoBvRzqBcRtpq1A==",
@@ -1247,7 +1095,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-s390x": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-s390x": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.18.20.tgz",
       "integrity": "sha512-+8231GMs3mAEth6Ja1iK0a1sQ3ohfcpzpRLH8uuc5/KVDFneH6jtAJLFGafpzpMRO6DzJ6AvXKze9LfFMrIHVQ==",
@@ -1263,10 +1111,10 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/linux-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-x64": {
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.18.20.tgz",
+      "integrity": "sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==",
       "cpu": [
         "x64"
       ],
@@ -1276,26 +1124,10 @@
         "linux"
       ],
       "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
+        "node": ">=12"
       }
     },
-    "node_modules/@esbuild/netbsd-x64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/netbsd-x64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.18.20.tgz",
       "integrity": "sha512-iO1c++VP6xUBUmltHZoMtCUdPlnPGdBom6IrO4gyKPFFVBKioIImVooR5I83nTew5UOYrk3gIJhbZh8X44y06A==",
@@ -1311,23 +1143,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/openbsd-x64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/openbsd-x64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.18.20.tgz",
       "integrity": "sha512-e5e4YSsuQfX4cxcygw/UCPIEP6wbIL+se3sxPdCiMbFLBWu0eiZOJ7WoD+ptCLrmjZBK1Wk7I6D/I3NglUGOxg==",
@@ -1343,23 +1159,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
-      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/@esbuild/sunos-x64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/sunos-x64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.18.20.tgz",
       "integrity": "sha512-kDbFRFp0YpTQVVrqUd5FTYmWo45zGaXe0X8E1G/LKFC0v8x0vWrhOWSLITcCn63lmZIxfOMXtCfti/RxN/0wnQ==",
@@ -1375,7 +1175,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/win32-arm64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/win32-arm64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.18.20.tgz",
       "integrity": "sha512-ddYFR6ItYgoaq4v4JmQQaAI5s7npztfV4Ag6NrhiaW0RrnOXqBkgwZLofVTlq1daVTQNhtI5oieTvkRPfZrePg==",
@@ -1391,7 +1191,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/win32-ia32": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/win32-ia32": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.18.20.tgz",
       "integrity": "sha512-Wv7QBi3ID/rROT08SABTS7eV4hX26sVduqDOTe1MvGMjNd3EjOz4b7zeexIR62GTIEKrfJXKL9LFxTYgkyeu7g==",
@@ -1407,7 +1207,7 @@
         "node": ">=12"
       }
     },
-    "node_modules/@esbuild/win32-x64": {
+    "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/win32-x64": {
       "version": "0.18.20",
       "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.18.20.tgz",
       "integrity": "sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ==",
@@ -1423,4690 +1223,4481 @@
         "node": ">=12"
       }
     },
-    "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
-      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
-      "dev": true,
+    "node_modules/@esbuild-kit/core-utils/node_modules/esbuild": {
+      "version": "0.18.20",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.18.20.tgz",
+      "integrity": "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==",
+      "devOptional": true,
+      "hasInstallScript": true,
       "license": "MIT",
-      "dependencies": {
-        "eslint-visitor-keys": "^3.4.3"
+      "bin": {
+        "esbuild": "bin/esbuild"
       },
       "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+        "node": ">=12"
       },
-      "peerDependencies": {
-        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
+      "optionalDependencies": {
+        "@esbuild/android-arm": "0.18.20",
+        "@esbuild/android-arm64": "0.18.20",
+        "@esbuild/android-x64": "0.18.20",
+        "@esbuild/darwin-arm64": "0.18.20",
+        "@esbuild/darwin-x64": "0.18.20",
+        "@esbuild/freebsd-arm64": "0.18.20",
+        "@esbuild/freebsd-x64": "0.18.20",
+        "@esbuild/linux-arm": "0.18.20",
+        "@esbuild/linux-arm64": "0.18.20",
+        "@esbuild/linux-ia32": "0.18.20",
+        "@esbuild/linux-loong64": "0.18.20",
+        "@esbuild/linux-mips64el": "0.18.20",
+        "@esbuild/linux-ppc64": "0.18.20",
+        "@esbuild/linux-riscv64": "0.18.20",
+        "@esbuild/linux-s390x": "0.18.20",
+        "@esbuild/linux-x64": "0.18.20",
+        "@esbuild/netbsd-x64": "0.18.20",
+        "@esbuild/openbsd-x64": "0.18.20",
+        "@esbuild/sunos-x64": "0.18.20",
+        "@esbuild/win32-arm64": "0.18.20",
+        "@esbuild/win32-ia32": "0.18.20",
+        "@esbuild/win32-x64": "0.18.20"
       }
     },
-    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
-      "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+    "node_modules/@esbuild-kit/esm-loader": {
+      "version": "2.6.5",
+      "resolved": "https://registry.npmjs.org/@esbuild-kit/esm-loader/-/esm-loader-2.6.5.tgz",
+      "integrity": "sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA==",
+      "deprecated": "Merged into tsx: https://tsx.is",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@esbuild-kit/core-utils": "^3.3.2",
+        "get-tsconfig": "^4.7.0"
       }
     },
-    "node_modules/@eslint-community/regexpp": {
-      "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
-      "dev": true,
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
+      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
+      "cpu": [
+        "ppc64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
       "engines": {
-        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/compat": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.0.2.tgz",
-      "integrity": "sha512-pR1DoD0h3HfF675QZx0xsyrsU8q70Z/plx7880NOhS02NuWLgBCOMDL787nUeQ7EWLkxv3bPQJaarjcPQb2Dwg==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^1.1.0"
-      },
-      "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
-      },
-      "peerDependencies": {
-        "eslint": "^8.40 || 9 || 10"
-      },
-      "peerDependenciesMeta": {
-        "eslint": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@eslint/config-array": {
-      "version": "0.21.1",
-      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.1.tgz",
-      "integrity": "sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/object-schema": "^2.1.7",
-        "debug": "^4.3.1",
-        "minimatch": "^3.1.2"
-      },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
+      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
+      "cpu": [
+        "arm"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/config-helpers": {
-      "version": "0.4.2",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
-      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.17.0"
-      },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
+      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/config-helpers/node_modules/@eslint/core": {
-      "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
+      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/core": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
-      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
+      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/css-tree": {
-      "version": "3.6.9",
-      "resolved": "https://registry.npmjs.org/@eslint/css-tree/-/css-tree-3.6.9.tgz",
-      "integrity": "sha512-3D5/OHibNEGk+wKwNwMbz63NMf367EoR4mVNNpxddCHKEb2Nez7z62J2U6YjtErSsZDoY0CsccmoUpdEbkogNA==",
-      "dev": true,
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
+      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "mdn-data": "2.23.0",
-        "source-map-js": "^1.0.1"
-      },
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/eslintrc": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.3.tgz",
-      "integrity": "sha512-Kr+LPIUVKz2qkx1HAMH8q1q6azbqBAsXJUxBl/ODDuVPX45Z9DfwB8tPjTi6nNZ8BuM3nbJxC5zCAg5elnBUTQ==",
-      "dev": true,
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "ajv": "^6.12.4",
-        "debug": "^4.3.2",
-        "espree": "^10.0.1",
-        "globals": "^14.0.0",
-        "ignore": "^5.2.0",
-        "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.1",
-        "minimatch": "^3.1.2",
-        "strip-json-comments": "^3.1.1"
-      },
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/eslintrc/node_modules/globals": {
-      "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
-      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
-      "dev": true,
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
+      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
       "engines": {
         "node": ">=18"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@eslint/js": {
-      "version": "9.39.2",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.2.tgz",
-      "integrity": "sha512-q1mjIoW1VX4IvSocvM/vbTiveKC4k9eLrajNEuSsmjymSDEbpGddtpfOoN7YGAqBK3NG+uqo8ia4PDTt8buCYA==",
-      "dev": true,
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
+      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
+      "cpu": [
+        "arm"
+      ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "url": "https://eslint.org/donate"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/object-schema": {
-      "version": "2.1.7",
-      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
-      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
+      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/plugin-kit": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
-      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@eslint/core": "^0.17.0",
-        "levn": "^0.4.1"
-      },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
+      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
+      "cpu": [
+        "ia32"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@eslint/plugin-kit/node_modules/@eslint/core": {
-      "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
+      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
+      "cpu": [
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@exodus/schemasafe": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@exodus/schemasafe/-/schemasafe-1.3.0.tgz",
-      "integrity": "sha512-5Aap/GaRupgNx/feGBwLLTVv8OQFfv3pq2lPRzPg9R+IOBnDgghTGW7l7EuVXOvg5cc/xSAlRW8rBrjIC3Nvqw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/@faker-js/faker": {
-      "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-10.4.0.tgz",
-      "integrity": "sha512-sDBWI3yLy8EcDzgobvJTWq1MJYzAkQdpjXuPukga9wXonhpMRvd1Izuo2Qgwey2OiEoRIBr35RMU9HJRoOHzpw==",
-      "dev": true,
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fakerjs"
-        }
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
+      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
+      "cpu": [
+        "mips64el"
       ],
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0",
-        "npm": ">=10"
+        "node": ">=18"
       }
     },
-    "node_modules/@hapi/hoek": {
-      "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
-      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
-    "node_modules/@hapi/topo": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
-      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
+      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "@hapi/hoek": "^9.0.0"
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@hono/node-server": {
-      "version": "1.19.9",
-      "resolved": "https://registry.npmjs.org/@hono/node-server/-/node-server-1.19.9.tgz",
-      "integrity": "sha512-vHL6w3ecZsky+8P5MD+eFfaGTyCeOHUIFYMGpQGbrBTSmNNoxv0if69rEZ5giu36weC5saFuznL411gRX7bJDw==",
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
+      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
+      "cpu": [
+        "riscv64"
+      ],
       "license": "MIT",
-      "peer": true,
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=18.14.1"
-      },
-      "peerDependencies": {
-        "hono": "^4"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
+      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=18.18.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@humanfs/core": "^0.19.1",
-        "@humanwhocodes/retry": "^0.4.0"
-      },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
+      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": ">=18.18.0"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanwhocodes/module-importer": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
       "engines": {
-        "node": ">=12.22"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "node": ">=18"
       }
     },
-    "node_modules/@humanwhocodes/retry": {
-      "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
-      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
-      "dev": true,
-      "license": "Apache-2.0",
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
       "engines": {
-        "node": ">=18.18"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/nzakas"
+        "node": ">=18"
       }
     },
-    "node_modules/@iconify-json/lsicon": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/@iconify-json/lsicon/-/lsicon-1.2.5.tgz",
-      "integrity": "sha512-dXmYFljtE+xYf/QKzs3WYjHjJuJIbagiUsIT5NL5z+qsWrCOHojfoL0inivGSSpGJjRQM18GPjspzzPaTfJVtw==",
-      "dev": true,
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
+      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@iconify/types": "*"
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@iconify-json/material-icon-theme": {
-      "version": "1.2.67",
-      "resolved": "https://registry.npmjs.org/@iconify-json/material-icon-theme/-/material-icon-theme-1.2.67.tgz",
-      "integrity": "sha512-SouqLxahwVOuIVqED8Spl1wSy3DM7sYwNOPxFW7Eh4hVNqR4L4zTkEXFP4V6bQegkhl9kFWbNGlYKDFjXh92iQ==",
-      "dev": true,
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
+      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@iconify/types": "*"
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@iconify-json/material-symbols": {
-      "version": "1.2.74",
-      "resolved": "https://registry.npmjs.org/@iconify-json/material-symbols/-/material-symbols-1.2.74.tgz",
-      "integrity": "sha512-GKJcvvm8A25pkh3Z2M430olvP4hDpDKg2sg7cpVnesM4bT7rExH74ThtRLWjdB86qhkxT3XrMuHRJa8LFCRmSw==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@iconify/types": "*"
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
+      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@iconify-json/vscode-icons": {
-      "version": "1.2.55",
-      "resolved": "https://registry.npmjs.org/@iconify-json/vscode-icons/-/vscode-icons-1.2.55.tgz",
-      "integrity": "sha512-7c6yep/OW7/xVWPedBeFbHv5wM4PnRcrZvlsaB+l5cBNWL/6thNE1yuN+PDPQZoEGdXRMUfwDAI3qF0ZVftwag==",
-      "dev": true,
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
+      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@iconify/types": "*"
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@iconify/types": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
-      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@iconify/utils": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.3.tgz",
-      "integrity": "sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw==",
-      "dev": true,
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
+      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
+      "cpu": [
+        "arm64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@antfu/install-pkg": "^1.1.0",
-        "@iconify/types": "^2.0.0",
-        "import-meta-resolve": "^4.2.0"
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@inlang/paraglide-js": {
-      "version": "2.12.0",
-      "resolved": "https://registry.npmjs.org/@inlang/paraglide-js/-/paraglide-js-2.12.0.tgz",
-      "integrity": "sha512-wnqTeSLcMMS2usL8zjS8bDGs9r16X00aeoGk2wVAnPfAgCChYalKdG20pS2XtJVMM1H6nBBBLKt3ZQMnKrusKQ==",
-      "dev": true,
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
+      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
+      "cpu": [
+        "ia32"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@inlang/recommend-sherlock": "^0.2.1",
-        "@inlang/sdk": "^2.7.0",
-        "commander": "11.1.0",
-        "consola": "3.4.0",
-        "json5": "2.2.3",
-        "unplugin": "^2.1.2",
-        "urlpattern-polyfill": "^10.0.0"
-      },
-      "bin": {
-        "paraglide-js": "bin/run.js"
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@inlang/recommend-sherlock": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@inlang/recommend-sherlock/-/recommend-sherlock-0.2.1.tgz",
-      "integrity": "sha512-ckv8HvHy/iTqaVAEKrr+gnl+p3XFNwe5D2+6w6wJk2ORV2XkcRkKOJ/XsTUJbPSiyi4PI+p+T3bqbmNx/rDUlg==",
-      "dev": true,
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.25.12",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
+      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
+      "cpu": [
+        "x64"
+      ],
       "license": "MIT",
-      "dependencies": {
-        "comment-json": "^4.2.3"
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@inlang/sdk": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/@inlang/sdk/-/sdk-2.7.0.tgz",
-      "integrity": "sha512-yJNBD0o8i29TTJqWX5uDRHxnalDGcsUDctxepzFXsUfkzqGWfiFBxODdxvReqvM2CuKAAOo/kib/F1UcgdYFNQ==",
+    "node_modules/@eslint-community/eslint-utils": {
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
+      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@lix-js/sdk": "0.4.7",
-        "@sinclair/typebox": "^0.31.17",
-        "kysely": "^0.27.4",
-        "sqlite-wasm-kysely": "0.3.0",
-        "uuid": "^13.0.0"
+        "eslint-visitor-keys": "^3.4.3"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || >=8.0.0"
       }
     },
-    "node_modules/@internationalized/date": {
-      "version": "3.11.0",
-      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.11.0.tgz",
-      "integrity": "sha512-BOx5huLAWhicM9/ZFs84CzP+V3gBW6vlpM02yzsdYC7TGlZJX1OJiEEHcSayF00Z+3jLlm4w79amvSt6RqKN3Q==",
+    "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+      "dev": true,
       "license": "Apache-2.0",
-      "dependencies": {
-        "@swc/helpers": "^0.5.0"
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/@isaacs/cliui": {
-      "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+    "node_modules/@eslint-community/regexpp": {
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
+      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "dependencies": {
-        "string-width": "^5.1.2",
-        "string-width-cjs": "npm:string-width@^4.2.0",
-        "strip-ansi": "^7.0.1",
-        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
-        "wrap-ansi": "^8.1.0",
-        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
-      },
+      "license": "MIT",
       "engines": {
-        "node": ">=12"
+        "node": "^12.0.0 || ^14.0.0 || >=16.0.0"
       }
     },
-    "node_modules/@isaacs/fs-minipass": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
-      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+    "node_modules/@eslint/compat": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.1.0.tgz",
+      "integrity": "sha512-LgaSCymEpw7tF53xvDw9SNsraPb1IBHxpdABIOM0hW8UAlP8znrjYtuxfR58FSJ3L9BhwD+FaPRFQpZq84Nh6g==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "minipass": "^7.0.4"
+        "@eslint/core": "^1.2.1"
       },
       "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/@jridgewell/gen-mapping": {
-      "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
-      "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@jridgewell/trace-mapping": "^0.3.24"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "peerDependencies": {
+        "eslint": "^8.40 || 9 || 10"
+      },
+      "peerDependenciesMeta": {
+        "eslint": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@jridgewell/remapping": {
-      "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
-      "devOptional": true,
-      "license": "MIT",
+    "node_modules/@eslint/config-array": {
+      "version": "0.21.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.2.tgz",
+      "integrity": "sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==",
+      "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "@jridgewell/gen-mapping": "^0.3.5",
-        "@jridgewell/trace-mapping": "^0.3.24"
-      }
-    },
-    "node_modules/@jridgewell/resolve-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
-      "devOptional": true,
-      "license": "MIT",
+        "@eslint/object-schema": "^2.1.7",
+        "debug": "^4.3.1",
+        "minimatch": "^3.1.5"
+      },
       "engines": {
-        "node": ">=6.0.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
-      "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/@jridgewell/trace-mapping": {
-      "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
-      "devOptional": true,
-      "license": "MIT",
+    "node_modules/@eslint/config-helpers": {
+      "version": "0.4.2",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
+      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
+      "dev": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "@jridgewell/resolve-uri": "^3.1.0",
-        "@jridgewell/sourcemap-codec": "^1.4.14"
+        "@eslint/core": "^0.17.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@lix-js/sdk": {
-      "version": "0.4.7",
-      "resolved": "https://registry.npmjs.org/@lix-js/sdk/-/sdk-0.4.7.tgz",
-      "integrity": "sha512-pRbW+joG12L0ULfMiWYosIW0plmW4AsUdiPCp+Z8rAsElJ+wJ6in58zhD3UwUcd4BNcpldEGjg6PdA7e0RgsDQ==",
+    "node_modules/@eslint/config-helpers/node_modules/@eslint/core": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
+      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@lix-js/server-protocol-schema": "0.1.1",
-        "dedent": "1.5.1",
-        "human-id": "^4.1.1",
-        "js-sha256": "^0.11.0",
-        "kysely": "^0.27.4",
-        "sqlite-wasm-kysely": "0.3.0",
-        "uuid": "^10.0.0"
+        "@types/json-schema": "^7.0.15"
       },
       "engines": {
-        "node": ">=18"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@lix-js/sdk/node_modules/uuid": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-10.0.0.tgz",
-      "integrity": "sha512-8XkAphELsDnEGrDxUOHB3RGvXz6TeuYSGEZBOjtTtPm2lwhGBjLgOzLHB63IUWfBpNucQjND6d3AOudO+H3RWQ==",
+    "node_modules/@eslint/core": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
+      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
       "dev": true,
-      "funding": [
-        "https://github.com/sponsors/broofa",
-        "https://github.com/sponsors/ctavan"
-      ],
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       }
     },
-    "node_modules/@lix-js/server-protocol-schema": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/@lix-js/server-protocol-schema/-/server-protocol-schema-0.1.1.tgz",
-      "integrity": "sha512-jBeALB6prAbtr5q4vTuxnRZZv1M2rKe8iNqRQhFJ4Tv7150unEa0vKyz0hs8Gl3fUGsWaNJBh3J8++fpbrpRBQ==",
+    "node_modules/@eslint/css-tree": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/@eslint/css-tree/-/css-tree-4.0.4.tgz",
+      "integrity": "sha512-nxMparyhqVWQvadx9x8dIfubfIPOE+X2b2waua8fzdnM9vdp9rgVtwEZlG0TmCwEUz/d/f40fzvO/eqBwdxz0A==",
       "dev": true,
-      "license": "Apache-2.0"
-    },
-    "node_modules/@mongodb-js/saslprep": {
-      "version": "1.4.6",
-      "resolved": "https://registry.npmjs.org/@mongodb-js/saslprep/-/saslprep-1.4.6.tgz",
-      "integrity": "sha512-y+x3H1xBZd38n10NZF/rEBlvDOOMQ6LKUTHqr8R9VkJ+mmQOYtJFxIlkkK8fZrtOiL6VixbOBWMbZGBdal3Z1g==",
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "sparse-bitfield": "^3.0.3"
+        "mdn-data": "2.28.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=24"
       }
     },
-    "node_modules/@mrleebo/prisma-ast": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/@mrleebo/prisma-ast/-/prisma-ast-0.13.1.tgz",
-      "integrity": "sha512-XyroGQXcHrZdvmrGJvsA9KNeOOgGMg1Vg9OlheUsBOSKznLMDl+YChxbkboRHvtFYJEMRYmlV3uoo/njCw05iw==",
+    "node_modules/@eslint/eslintrc": {
+      "version": "3.3.5",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz",
+      "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "chevrotain": "^10.5.0",
-        "lilconfig": "^2.1.0"
+        "ajv": "^6.14.0",
+        "debug": "^4.3.2",
+        "espree": "^10.0.1",
+        "globals": "^14.0.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.1",
+        "minimatch": "^3.1.5",
+        "strip-json-comments": "^3.1.1"
       },
       "engines": {
-        "node": ">=16"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/@napi-rs/wasm-runtime": {
-      "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
-      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
+    "node_modules/@eslint/eslintrc/node_modules/ajv": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.4.3",
-        "@emnapi/runtime": "^1.4.3",
-        "@tybys/wasm-util": "^0.10.0"
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/@noble/ciphers": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.1.1.tgz",
-      "integrity": "sha512-bysYuiVfhxNJuldNXlFEitTVdNnYUc+XNJZd7Qm2a5j1vZHgY+fazadNFWFaMK/2vye0JVlxV3gHmC0WDfAOQw==",
+    "node_modules/@eslint/eslintrc/node_modules/globals": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
+      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
+      "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 20.19.0"
+        "node": ">=18"
       },
       "funding": {
-        "url": "https://paulmillr.com/funding/"
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@noble/hashes": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.0.1.tgz",
-      "integrity": "sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==",
+    "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@eslint/js": {
+      "version": "9.39.4",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz",
+      "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==",
+      "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 20.19.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "url": "https://paulmillr.com/funding/"
+        "url": "https://eslint.org/donate"
       }
     },
-    "node_modules/@nodable/entities": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
-      "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodable"
-        }
-      ],
-      "license": "MIT"
-    },
-    "node_modules/@npmcli/agent": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
-      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
+    "node_modules/@eslint/object-schema": {
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
+      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
-      "dependencies": {
-        "agent-base": "^7.1.0",
-        "http-proxy-agent": "^7.0.0",
-        "https-proxy-agent": "^7.0.1",
-        "lru-cache": "^10.0.1",
-        "socks-proxy-agent": "^8.0.3"
-      },
+      "license": "Apache-2.0",
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@npmcli/fs": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
-      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
+    "node_modules/@eslint/plugin-kit": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
+      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
       "dev": true,
-      "license": "ISC",
-      "optional": true,
+      "license": "Apache-2.0",
       "dependencies": {
-        "semver": "^7.3.5"
+        "@eslint/core": "^0.17.0",
+        "levn": "^0.4.1"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@oozcitak/dom": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz",
-      "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==",
+    "node_modules/@eslint/plugin-kit/node_modules/@eslint/core": {
+      "version": "0.17.0",
+      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
+      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
       "dev": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@oozcitak/infra": "^2.0.2",
-        "@oozcitak/url": "^3.0.0",
-        "@oozcitak/util": "^10.0.0"
+        "@types/json-schema": "^7.0.15"
       },
       "engines": {
-        "node": ">=20.0"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/@oozcitak/infra": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz",
-      "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==",
+    "node_modules/@exodus/schemasafe": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@exodus/schemasafe/-/schemasafe-1.3.0.tgz",
+      "integrity": "sha512-5Aap/GaRupgNx/feGBwLLTVv8OQFfv3pq2lPRzPg9R+IOBnDgghTGW7l7EuVXOvg5cc/xSAlRW8rBrjIC3Nvqw==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@oozcitak/util": "^10.0.0"
-      },
-      "engines": {
-        "node": ">=20.0"
-      }
+      "optional": true
     },
-    "node_modules/@oozcitak/url": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz",
-      "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==",
+    "node_modules/@faker-js/faker": {
+      "version": "10.5.0",
+      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-10.5.0.tgz",
+      "integrity": "sha512-bsxD8WLS5lIj7aaoCx1YJkktqYj5vlBUE6HWzu2Q51ksrGJ0H737ECCKlFU7Yf8Br45z9t99frBp/J7kzbMPAg==",
       "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fakerjs"
+        }
+      ],
       "license": "MIT",
-      "dependencies": {
-        "@oozcitak/infra": "^2.0.2",
-        "@oozcitak/util": "^10.0.0"
-      },
       "engines": {
-        "node": ">=20.0"
+        "node": "^20.19.0 || ^22.13.0 || ^23.5.0 || >=24.0.0",
+        "npm": ">=10"
       }
     },
-    "node_modules/@oozcitak/util": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz",
-      "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==",
+    "node_modules/@hapi/hoek": {
+      "version": "9.3.0",
+      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
+      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=20.0"
-      }
-    },
-    "node_modules/@opentelemetry/api": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
-      "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@pinojs/redact": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
-      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
-      "license": "MIT"
+      "license": "BSD-3-Clause",
+      "optional": true
     },
-    "node_modules/@pkgjs/parseargs": {
-      "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+    "node_modules/@hapi/topo": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
+      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-3-Clause",
       "optional": true,
-      "engines": {
-        "node": ">=14"
+      "dependencies": {
+        "@hapi/hoek": "^9.0.0"
       }
     },
-    "node_modules/@pkgr/core": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
-      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
+    "node_modules/@humanfs/core": {
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
       },
-      "funding": {
-        "url": "https://opencollective.com/pkgr"
+      "engines": {
+        "node": ">=18.18.0"
       }
     },
-    "node_modules/@playwright/test": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.58.2.tgz",
-      "integrity": "sha512-akea+6bHYBBfA9uQqSYmlJXn61cTa+jbO87xVLCWbTqbWadRVmhxlXATaOjOgcBaWU4ePo0wB41KMFv3o35IXA==",
+    "node_modules/@humanfs/node": {
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.58.2"
-      },
-      "bin": {
-        "playwright": "cli.js"
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
+        "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=18.18.0"
       }
     },
-    "node_modules/@polka/url": {
-      "version": "1.0.0-next.29",
-      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
-      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
-      "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/@poppinss/macroable": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@poppinss/macroable/-/macroable-1.1.0.tgz",
-      "integrity": "sha512-y/YKzZDuG8XrpXpM7Z1RdQpiIc0MAKyva24Ux1PB4aI7RiSI/79K8JVDcdyubriTm7vJ1LhFs8CrZpmPnx/8Pw==",
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/@prisma/client": {
-      "version": "5.22.0",
-      "resolved": "https://registry.npmjs.org/@prisma/client/-/client-5.22.0.tgz",
-      "integrity": "sha512-M0SVXfyHnQREBKxCgyo7sffrKttwE6R8PMq330MIUF0pTwjUhLbW84pFDlf06B27XyCR++VtjugEnIHdr07SVA==",
-      "hasInstallScript": true,
       "license": "Apache-2.0",
-      "peer": true,
       "engines": {
-        "node": ">=16.13"
-      },
-      "peerDependencies": {
-        "prisma": "*"
-      },
-      "peerDependenciesMeta": {
-        "prisma": {
-          "optional": true
-        }
+        "node": ">=18.18.0"
       }
     },
-    "node_modules/@prisma/config": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/config/-/config-7.4.2.tgz",
-      "integrity": "sha512-CftBjWxav99lzY1Z4oDgomdb1gh9BJFAOmWF6P2v1xRfXqQb56DfBub+QKcERRdNoAzCb3HXy3Zii8Vb4AsXhg==",
+    "node_modules/@humanwhocodes/module-importer": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
+      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
+      "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "c12": "3.1.0",
-        "deepmerge-ts": "7.1.5",
-        "effect": "3.18.4",
-        "empathic": "2.0.0"
-      }
-    },
-    "node_modules/@prisma/config/node_modules/c12": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/c12/-/c12-3.1.0.tgz",
-      "integrity": "sha512-uWoS8OU1MEIsOv8p/5a82c3H31LsWVR5qiyXVfBNOzfffjUWtPnhAb4BYI2uG2HfGmZmFjCtui5XNWaps+iFuw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "chokidar": "^4.0.3",
-        "confbox": "^0.2.2",
-        "defu": "^6.1.4",
-        "dotenv": "^16.6.1",
-        "exsolve": "^1.0.7",
-        "giget": "^2.0.0",
-        "jiti": "^2.4.2",
-        "ohash": "^2.0.11",
-        "pathe": "^2.0.3",
-        "perfect-debounce": "^1.0.0",
-        "pkg-types": "^2.2.0",
-        "rc9": "^2.1.2"
-      },
-      "peerDependencies": {
-        "magicast": "^0.3.5"
+      "engines": {
+        "node": ">=12.22"
       },
-      "peerDependenciesMeta": {
-        "magicast": {
-          "optional": true
-        }
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
       }
     },
-    "node_modules/@prisma/config/node_modules/dotenv": {
-      "version": "16.6.1",
-      "resolved": "https://registry.npmjs.org/dotenv/-/dotenv-16.6.1.tgz",
-      "integrity": "sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==",
-      "license": "BSD-2-Clause",
-      "peer": true,
+    "node_modules/@humanwhocodes/retry": {
+      "version": "0.4.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
+      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
+      "dev": true,
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">=12"
+        "node": ">=18.18"
       },
       "funding": {
-        "url": "https://dotenvx.com"
+        "type": "github",
+        "url": "https://github.com/sponsors/nzakas"
       }
     },
-    "node_modules/@prisma/config/node_modules/effect": {
-      "version": "3.18.4",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-3.18.4.tgz",
-      "integrity": "sha512-b1LXQJLe9D11wfnOKAk3PKxuqYshQ0Heez+y5pnkd3jLj1yx9QhM72zZ9uUrOQyNvrs2GZZd/3maL0ZV18YuDA==",
+    "node_modules/@iconify-json/lsicon": {
+      "version": "1.2.5",
+      "resolved": "https://registry.npmjs.org/@iconify-json/lsicon/-/lsicon-1.2.5.tgz",
+      "integrity": "sha512-dXmYFljtE+xYf/QKzs3WYjHjJuJIbagiUsIT5NL5z+qsWrCOHojfoL0inivGSSpGJjRQM18GPjspzzPaTfJVtw==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
-        "fast-check": "^3.23.1"
+        "@iconify/types": "*"
       }
     },
-    "node_modules/@prisma/config/node_modules/perfect-debounce": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/perfect-debounce/-/perfect-debounce-1.0.0.tgz",
-      "integrity": "sha512-xCy9V055GLEqoFaHoC1SoLIaLmWctgCUaBaWxDZ7/Zx4CTyX7cJQLJOok/orfjZAh9kEYpjJa4d0KcJmCbctZA==",
+    "node_modules/@iconify-json/material-icon-theme": {
+      "version": "1.2.68",
+      "resolved": "https://registry.npmjs.org/@iconify-json/material-icon-theme/-/material-icon-theme-1.2.68.tgz",
+      "integrity": "sha512-08ZX1L3Lt1lKvcflvp57ZTpXwpMBtr1KI2CxTRQ1ryPkiDI3WacoSXVfE7/nO7CeV9RewfegjfgsPbidF1BxLA==",
+      "dev": true,
       "license": "MIT",
-      "peer": true
-    },
-    "node_modules/@prisma/debug": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.4.2.tgz",
-      "integrity": "sha512-aP7qzu+g/JnbF6U69LMwHoUkELiserKmWsE2shYuEpNUJ4GrtxBCvZwCyCBHFSH2kLTF2l1goBlBh4wuvRq62w==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/@prisma/dev": {
-      "version": "0.20.0",
-      "resolved": "https://registry.npmjs.org/@prisma/dev/-/dev-0.20.0.tgz",
-      "integrity": "sha512-ovlBYwWor0OzG+yH4J3Ot+AneD818BttLA+Ii7wjbcLHUrnC4tbUPVGyNd3c/+71KETPKZfjhkTSpdS15dmXNQ==",
-      "license": "ISC",
-      "peer": true,
-      "dependencies": {
-        "@electric-sql/pglite": "0.3.15",
-        "@electric-sql/pglite-socket": "0.0.20",
-        "@electric-sql/pglite-tools": "0.2.20",
-        "@hono/node-server": "1.19.9",
-        "@mrleebo/prisma-ast": "0.13.1",
-        "@prisma/get-platform": "7.2.0",
-        "@prisma/query-plan-executor": "7.2.0",
-        "foreground-child": "3.3.1",
-        "get-port-please": "3.2.0",
-        "hono": "4.11.4",
-        "http-status-codes": "2.3.0",
-        "pathe": "2.0.3",
-        "proper-lockfile": "4.1.2",
-        "remeda": "2.33.4",
-        "std-env": "3.10.0",
-        "valibot": "1.2.0",
-        "zeptomatch": "2.1.0"
-      }
-    },
-    "node_modules/@prisma/engines": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/engines/-/engines-7.4.2.tgz",
-      "integrity": "sha512-B+ZZhI4rXlzjVqRw/93AothEKOU5/x4oVyJFGo9RpHPnBwaPwk4Pi0Q4iGXipKxeXPs/dqljgNBjK0m8nocOJA==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@prisma/debug": "7.4.2",
-        "@prisma/engines-version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
-        "@prisma/fetch-engine": "7.4.2",
-        "@prisma/get-platform": "7.4.2"
-      }
-    },
-    "node_modules/@prisma/engines-version": {
-      "version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
-      "resolved": "https://registry.npmjs.org/@prisma/engines-version/-/engines-version-7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919.tgz",
-      "integrity": "sha512-5FIKY3KoYQlBuZC2yc16EXfVRQ8HY+fLqgxkYfWCtKhRb3ajCRzP/rPeoSx11+NueJDANdh4hjY36mdmrTcGSg==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/@prisma/engines/node_modules/@prisma/get-platform": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.4.2.tgz",
-      "integrity": "sha512-UTnChXRwiauzl/8wT4hhe7Xmixja9WE28oCnGpBtRejaHhvekx5kudr3R4Y9mLSA0kqGnAMeyTiKwDVMjaEVsw==",
-      "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@prisma/debug": "7.4.2"
+        "@iconify/types": "*"
       }
     },
-    "node_modules/@prisma/fetch-engine": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/fetch-engine/-/fetch-engine-7.4.2.tgz",
-      "integrity": "sha512-f/c/MwYpdJO7taLETU8rahEstLeXfYgQGlz5fycG7Fbmva3iPdzGmjiSWHeSWIgNnlXnelUdCJqyZnFocurZuA==",
+    "node_modules/@iconify-json/material-symbols": {
+      "version": "1.2.79",
+      "resolved": "https://registry.npmjs.org/@iconify-json/material-symbols/-/material-symbols-1.2.79.tgz",
+      "integrity": "sha512-WRLBReaTNJAeHxsFlD7pJ/K6il2vOZ4va3XTAUdTDkn4rWzRYu6dnI1bAW/4pANlTCt5eemtP65gBBNxt8Xd7Q==",
+      "dev": true,
       "license": "Apache-2.0",
-      "peer": true,
       "dependencies": {
-        "@prisma/debug": "7.4.2",
-        "@prisma/engines-version": "7.5.0-10.94a226be1cf2967af2541cca5529f0f7ba866919",
-        "@prisma/get-platform": "7.4.2"
+        "@iconify/types": "*"
       }
     },
-    "node_modules/@prisma/fetch-engine/node_modules/@prisma/get-platform": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.4.2.tgz",
-      "integrity": "sha512-UTnChXRwiauzl/8wT4hhe7Xmixja9WE28oCnGpBtRejaHhvekx5kudr3R4Y9mLSA0kqGnAMeyTiKwDVMjaEVsw==",
-      "license": "Apache-2.0",
-      "peer": true,
+    "node_modules/@iconify-json/vscode-icons": {
+      "version": "1.2.59",
+      "resolved": "https://registry.npmjs.org/@iconify-json/vscode-icons/-/vscode-icons-1.2.59.tgz",
+      "integrity": "sha512-6RN+ixRubu3UKrUEqV24iuwvh2DgY541h2QWdxBeK3kJvXuDpaFNxw2dUSUqp80IU7f+QAU5sh718tXgyynnbQ==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@prisma/debug": "7.4.2"
+        "@iconify/types": "*"
       }
     },
-    "node_modules/@prisma/get-platform": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/@prisma/get-platform/-/get-platform-7.2.0.tgz",
-      "integrity": "sha512-k1V0l0Td1732EHpAfi2eySTezyllok9dXb6UQanajkJQzPUGi3vO2z7jdkz67SypFTdmbnyGYxvEvYZdZsMAVA==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@prisma/debug": "7.2.0"
-      }
-    },
-    "node_modules/@prisma/get-platform/node_modules/@prisma/debug": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/@prisma/debug/-/debug-7.2.0.tgz",
-      "integrity": "sha512-YSGTiSlBAVJPzX4ONZmMotL+ozJwQjRmZweQNIq/ER0tQJKJynNkRB3kyvt37eOfsbMCXk3gnLF6J9OJ4QWftw==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
-    "node_modules/@prisma/query-plan-executor": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/@prisma/query-plan-executor/-/query-plan-executor-7.2.0.tgz",
-      "integrity": "sha512-EOZmNzcV8uJ0mae3DhTsiHgoNCuu1J9mULQpGCh62zN3PxPTd+qI9tJvk5jOst8WHKQNwJWR3b39t0XvfBB0WQ==",
-      "license": "Apache-2.0",
-      "peer": true
+    "node_modules/@iconify/types": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
+      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/@prisma/studio-core": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/@prisma/studio-core/-/studio-core-0.13.1.tgz",
-      "integrity": "sha512-agdqaPEePRHcQ7CexEfkX1RvSH9uWDb6pXrZnhCRykhDFAV0/0P3d07WtfiY8hZWb7oRU4v+NkT4cGFHkQJIPg==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "peerDependencies": {
-        "@types/react": "^18.0.0 || ^19.0.0",
-        "react": "^18.0.0 || ^19.0.0",
-        "react-dom": "^18.0.0 || ^19.0.0"
+    "node_modules/@iconify/utils": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.3.tgz",
+      "integrity": "sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@antfu/install-pkg": "^1.1.0",
+        "@iconify/types": "^2.0.0",
+        "import-meta-resolve": "^4.2.0"
       }
     },
-    "node_modules/@rollup/plugin-commonjs": {
-      "version": "29.0.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-29.0.0.tgz",
-      "integrity": "sha512-U2YHaxR2cU/yAiwKJtJRhnyLk7cifnQw0zUpISsocBDoHDJn+HTV74ABqnwr5bEgWUwFZC9oFL6wLe21lHu5eQ==",
+    "node_modules/@inlang/paraglide-js": {
+      "version": "2.20.1",
+      "resolved": "https://registry.npmjs.org/@inlang/paraglide-js/-/paraglide-js-2.20.1.tgz",
+      "integrity": "sha512-8mDhvcociFkWZDy3J+ZIIWkl0GTtJjVXS/kcBT2QG2l88y7+bFT45s8I00a7Hp1eFP9y6ScJMmNXWy87Krt7wA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rollup/pluginutils": "^5.0.1",
-        "commondir": "^1.0.1",
-        "estree-walker": "^2.0.2",
-        "fdir": "^6.2.0",
-        "is-reference": "1.2.1",
-        "magic-string": "^0.30.3",
-        "picomatch": "^4.0.2"
+        "@inlang/recommend-sherlock": "^0.2.1",
+        "@inlang/sdk": "^2.10.0",
+        "commander": "11.1.0",
+        "consola": "3.4.0",
+        "json5": "2.2.3",
+        "unplugin": "^2.1.2",
+        "urlpattern-polyfill": "^10.0.0"
       },
-      "engines": {
-        "node": ">=16.0.0 || 14 >= 14.17"
+      "bin": {
+        "paraglide-js": "bin/run.js"
       },
       "peerDependencies": {
-        "rollup": "^2.68.0||^3.0.0||^4.0.0"
+        "typescript": ">=5.6"
       },
       "peerDependenciesMeta": {
-        "rollup": {
+        "typescript": {
           "optional": true
         }
       }
     },
-    "node_modules/@rollup/plugin-json": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-json/-/plugin-json-6.1.0.tgz",
-      "integrity": "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA==",
+    "node_modules/@inlang/paraglide-js/node_modules/commander": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
+      "integrity": "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@rollup/pluginutils": "^5.1.0"
-      },
       "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+        "node": ">=16"
       }
     },
-    "node_modules/@rollup/plugin-node-resolve": {
-      "version": "16.0.3",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-16.0.3.tgz",
-      "integrity": "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==",
+    "node_modules/@inlang/recommend-sherlock": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/@inlang/recommend-sherlock/-/recommend-sherlock-0.2.1.tgz",
+      "integrity": "sha512-ckv8HvHy/iTqaVAEKrr+gnl+p3XFNwe5D2+6w6wJk2ORV2XkcRkKOJ/XsTUJbPSiyi4PI+p+T3bqbmNx/rDUlg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rollup/pluginutils": "^5.0.1",
-        "@types/resolve": "1.20.2",
-        "deepmerge": "^4.2.2",
-        "is-module": "^1.0.0",
-        "resolve": "^1.22.1"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^2.78.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+        "comment-json": "^4.2.3"
       }
     },
-    "node_modules/@rollup/pluginutils": {
-      "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.3.0.tgz",
-      "integrity": "sha512-5EdhGZtnu3V88ces7s53hhfK5KSASnJZv8Lulpc04cWO3REESroJXg73DFsOmgbU2BhwV0E20bu2IDZb3VKW4Q==",
+    "node_modules/@inlang/sdk": {
+      "version": "2.10.2",
+      "resolved": "https://registry.npmjs.org/@inlang/sdk/-/sdk-2.10.2.tgz",
+      "integrity": "sha512-O1ki72SNK6LPagaGrvlioBb1mWKvump7cO7P85hfGZjdFTmDdn3icI0A6MvaBsB3P9KQHAjzyubnN1OslGufTw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "^1.0.0",
-        "estree-walker": "^2.0.2",
-        "picomatch": "^4.0.2"
+        "@lix-js/sdk": "0.4.10",
+        "@sinclair/typebox": "^0.31.17",
+        "kysely": "^0.28.12",
+        "sqlite-wasm-kysely": "0.3.0",
+        "uuid": "^14.0.0"
       },
       "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
+        "node": ">=20.0.0"
       }
     },
-    "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.57.1.tgz",
-      "integrity": "sha512-A6ehUVSiSaaliTxai040ZpZ2zTevHYbvu/lDoeAteHI8QnaosIzm4qwtezfRg1jOYaUmnzLX1AOD6Z+UJjtifg==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ]
+    "node_modules/@internationalized/date": {
+      "version": "3.12.2",
+      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.2.tgz",
+      "integrity": "sha512-FY1Y+H64NDs+HAF6omlnWxm3mEpfgaCSWtL5l551ZZfImA+kGjPFgrnJrGjH6lfmLL0g8Z/mBu1R3kufeCp6Jw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@swc/helpers": "^0.5.0"
+      }
     },
-    "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.57.1.tgz",
-      "integrity": "sha512-dQaAddCY9YgkFHZcFNS/606Exo8vcLHwArFZ7vxXq4rigo2bb494/xKMMwRRQW6ug7Js6yXmBZhSBRuBvCCQ3w==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dev": true,
+      "license": "ISC",
       "optional": true,
-      "os": [
-        "android"
-      ]
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
     },
-    "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.57.1.tgz",
-      "integrity": "sha512-crNPrwJOrRxagUYeMn/DZwqN88SDmwaJ8Cvi/TN1HnWBU7GwknckyosC2gd0IqYRsHDEnXf328o9/HC6OkPgOg==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
+    "node_modules/@isaacs/fs-minipass": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
+      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
+      "dev": true,
+      "license": "ISC",
       "optional": true,
-      "os": [
-        "darwin"
-      ]
+      "dependencies": {
+        "minipass": "^7.0.4"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.57.1.tgz",
-      "integrity": "sha512-Ji8g8ChVbKrhFtig5QBV7iMaJrGtpHelkB3lsaKzadFBe58gmjfGXAOfI5FV0lYMH8wiqsxKQ1C9B0YTRXVy4w==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ]
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.0",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
     },
-    "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.57.1.tgz",
-      "integrity": "sha512-R+/WwhsjmwodAcz65guCGFRkMb4gKWTcIeLy60JJQbXrJ97BOXHxnkPFrP+YwFlaS0m+uWJTstrUA9o+UchFug==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/@jridgewell/remapping": {
+      "version": "2.3.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
+      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.5",
+        "@jridgewell/trace-mapping": "^0.3.24"
+      }
     },
-    "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.57.1.tgz",
-      "integrity": "sha512-IEQTCHeiTOnAUC3IDQdzRAGj3jOAYNr9kBguI7MQAAZK3caezRrg0GxAb6Hchg4lxdZEI5Oq3iov/w/hnFWY9Q==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ]
+      "engines": {
+        "node": ">=6.0.0"
+      }
     },
-    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.57.1.tgz",
-      "integrity": "sha512-F8sWbhZ7tyuEfsmOxwc2giKDQzN3+kuBLPwwZGyVkLlKGdV1nvnNwYD0fKQ8+XS6hp9nY7B+ZeK01EBUE7aHaw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "devOptional": true,
+      "license": "MIT"
     },
-    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.57.1.tgz",
-      "integrity": "sha512-rGfNUfn0GIeXtBP1wL5MnzSj98+PZe/AXaGBCRmT0ts80lU5CATYGxXukeTX39XBKsxzFpEeK+Mrp9faXOlmrw==",
-      "cpu": [
-        "arm"
-      ],
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.31",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.1.0",
+        "@jridgewell/sourcemap-codec": "^1.4.14"
+      }
     },
-    "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.57.1.tgz",
-      "integrity": "sha512-MMtej3YHWeg/0klK2Qodf3yrNzz6CGjo2UntLvk2RSPlhzgLvYEB3frRvbEF2wRKh1Z2fDIg9KRPe1fawv7C+g==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.57.1.tgz",
-      "integrity": "sha512-1a/qhaaOXhqXGpMFMET9VqwZakkljWHLmZOX48R0I/YLbhdxr1m4gtG1Hq7++VhVUmf+L3sTAf9op4JlhQ5u1Q==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.57.1.tgz",
-      "integrity": "sha512-QWO6RQTZ/cqYtJMtxhkRkidoNGXc7ERPbZN7dVW5SdURuLeVU7lwKMpo18XdcmpWYd0qsP1bwKPf7DNSUinhvA==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.57.1.tgz",
-      "integrity": "sha512-xpObYIf+8gprgWaPP32xiN5RVTi/s5FCR+XMXSKmhfoJjrpRAjCuuqQXyxUa/eJTdAE6eJ+KDKaoEqjZQxh3Gw==",
-      "cpu": [
-        "loong64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.57.1.tgz",
-      "integrity": "sha512-4BrCgrpZo4hvzMDKRqEaW1zeecScDCR+2nZ86ATLhAoJ5FQ+lbHVD3ttKe74/c7tNT9c6F2viwB3ufwp01Oh2w==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.57.1.tgz",
-      "integrity": "sha512-NOlUuzesGauESAyEYFSe3QTUguL+lvrN1HtwEEsU2rOwdUDeTMJdO5dUYl/2hKf9jWydJrO9OL/XSSf65R5+Xw==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ptA88htVp0AwUUqhVghwDIKlvJMD/fmL/wrQj99PRHFRAG6Z5nbWoWG4o81Nt9FT+IuqUQi+L31ZKAFeJ5Is+A==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.57.1.tgz",
-      "integrity": "sha512-S51t7aMMTNdmAMPpBg7OOsTdn4tySRQvklmL3RpDRyknk87+Sp3xaumlatU+ppQ+5raY7sSTcC2beGgvhENfuw==",
-      "cpu": [
-        "riscv64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.57.1.tgz",
-      "integrity": "sha512-Bl00OFnVFkL82FHbEqy3k5CUCKH6OEJL54KCyx2oqsmZnFTR8IoNqBF+mjQVcRCT5sB6yOvK8A37LNm/kPJiZg==",
-      "cpu": [
-        "s390x"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-ABca4ceT4N+Tv/GtotnWAeXZUZuM/9AQyCyKYyKnpk4yoA7QIAuBt6Hkgpw8kActYlew2mvckXkvx0FfoInnLg==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.57.1.tgz",
-      "integrity": "sha512-HFps0JeGtuOR2convgRRkHCekD7j+gdAuXM+/i6kGzQtFhlCtQkpwtNzkNj6QhCDp7DRJ7+qC/1Vg2jt5iSOFw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ]
-    },
-    "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.57.1.tgz",
-      "integrity": "sha512-H+hXEv9gdVQuDTgnqD+SQffoWoc0Of59AStSzTEj/feWTBAnSfSD3+Dql1ZruJQxmykT/JVY0dE8Ka7z0DH1hw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ]
-    },
-    "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.57.1.tgz",
-      "integrity": "sha512-4wYoDpNg6o/oPximyc/NG+mYUejZrCU2q+2w6YZqrAs2UcNUChIZXjtafAiiZSUc7On8v5NyNj34Kzj/Ltk6dQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openharmony"
-      ]
-    },
-    "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.57.1.tgz",
-      "integrity": "sha512-O54mtsV/6LW3P8qdTcamQmuC990HDfR71lo44oZMZlXU4tzLrbvTii87Ni9opq60ds0YzuAlEr/GNwuNluZyMQ==",
-      "cpu": [
-        "arm64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+    "node_modules/@lix-js/sdk": {
+      "version": "0.4.10",
+      "resolved": "https://registry.npmjs.org/@lix-js/sdk/-/sdk-0.4.10.tgz",
+      "integrity": "sha512-0dMInAJK/67guTG5rRZaCEhvzC5cCXENOjaePA5AqMXrCE97kaY7SRor9e2vnoGsFIiGqXKlT0MCIoZj36G0gg==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@lix-js/server-protocol-schema": "0.1.1",
+        "dedent": "1.5.1",
+        "human-id": "^4.1.1",
+        "js-sha256": "^0.11.0",
+        "kysely": "^0.28.12",
+        "sqlite-wasm-kysely": "0.3.0",
+        "uuid": "^14.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.57.1.tgz",
-      "integrity": "sha512-P3dLS+IerxCT/7D2q2FYcRdWRl22dNbrbBEtxdWhXrfIMPP9lQhb5h4Du04mdl5Woq05jVCDPCMF7Ub0NAjIew==",
-      "cpu": [
-        "ia32"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+    "node_modules/@lix-js/server-protocol-schema": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@lix-js/server-protocol-schema/-/server-protocol-schema-0.1.1.tgz",
+      "integrity": "sha512-jBeALB6prAbtr5q4vTuxnRZZv1M2rKe8iNqRQhFJ4Tv7150unEa0vKyz0hs8Gl3fUGsWaNJBh3J8++fpbrpRBQ==",
+      "dev": true,
+      "license": "Apache-2.0"
     },
-    "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
-      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@noble/ciphers": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.2.0.tgz",
+      "integrity": "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
     },
-    "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
-      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/@noble/hashes": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.2.0.tgz",
+      "integrity": "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==",
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ]
+      "engines": {
+        "node": ">= 20.19.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
     },
-    "node_modules/@sideway/address": {
-      "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
-      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
+    "node_modules/@npmcli/agent": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
+      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
       "dev": true,
-      "license": "BSD-3-Clause",
+      "license": "ISC",
       "optional": true,
       "dependencies": {
-        "@hapi/hoek": "^9.0.0"
+        "agent-base": "^7.1.0",
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.1",
+        "lru-cache": "^10.0.1",
+        "socks-proxy-agent": "^8.0.3"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/@sideway/formula": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
-      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
-    "node_modules/@sideway/pinpoint": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
-      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "optional": true
-    },
-    "node_modules/@sinclair/typebox": {
-      "version": "0.31.28",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.31.28.tgz",
-      "integrity": "sha512-/s55Jujywdw/Jpan+vsy6JZs1z2ZTGxTmbZTPiuSL2wz9mfzA2gN1zzaqmvfi4pq+uOt7Du85fkiwv5ymW84aQ==",
+    "node_modules/@npmcli/fs": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
+      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@smithy/core": {
-      "version": "3.24.4",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
-      "integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
-      "license": "Apache-2.0",
+      "license": "ISC",
+      "optional": true,
       "dependencies": {
-        "@aws-crypto/crc32": "5.2.0",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
+        "semver": "^7.3.5"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/@smithy/credential-provider-imds": {
-      "version": "4.3.4",
-      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.3.4.tgz",
-      "integrity": "sha512-vKW0MEFRU4Y3MkVZUkpJm+g9qyPGLCXhc0YLggUdSdBB4g7IaSSsCE75P9rBXyWHrXY1UYSQUl8/DwsTR7QciA==",
-      "license": "Apache-2.0",
+    "node_modules/@oozcitak/dom": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz",
+      "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@smithy/core": "^3.24.4",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
+        "@oozcitak/infra": "^2.0.2",
+        "@oozcitak/url": "^3.0.0",
+        "@oozcitak/util": "^10.0.0"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0"
       }
     },
-    "node_modules/@smithy/fetch-http-handler": {
-      "version": "5.4.4",
-      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.4.4.tgz",
-      "integrity": "sha512-qM7AUKI4G6d7lNgaZD3lA1tWSolh5r6gcixfTZAPstVURfjIbvreVTPz+994M0yC3HbX4YYhDRgr31Xy3XwWOQ==",
-      "license": "Apache-2.0",
+    "node_modules/@oozcitak/infra": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz",
+      "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "@smithy/core": "^3.24.4",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
+        "@oozcitak/util": "^10.0.0"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0"
       }
     },
-    "node_modules/@smithy/is-array-buffer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
-      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
-      "license": "Apache-2.0",
+    "node_modules/@oozcitak/url": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz",
+      "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "tslib": "^2.6.2"
+        "@oozcitak/infra": "^2.0.2",
+        "@oozcitak/util": "^10.0.0"
       },
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=20.0"
       }
     },
-    "node_modules/@smithy/node-http-handler": {
-      "version": "4.7.4",
-      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
-      "integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/core": "^3.24.4",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
-      },
+    "node_modules/@oozcitak/util": {
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz",
+      "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0"
       }
     },
-    "node_modules/@smithy/signature-v4": {
-      "version": "5.4.4",
-      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.4.4.tgz",
-      "integrity": "sha512-e5UtkMvsatzBfbeBZjEOt0k0Z3BEsjTFL/n6fdO5vtBLe67tdy0dX7xw2DU7uZ3acwoHyeCqpU2Fzb7pxwHb6Q==",
+    "node_modules/@opentelemetry/api": {
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
+      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/core": "^3.24.4",
-        "@smithy/types": "^4.14.2",
-        "tslib": "^2.6.2"
-      },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=8.0.0"
       }
     },
-    "node_modules/@smithy/types": {
-      "version": "4.14.2",
-      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.2.tgz",
-      "integrity": "sha512-P+otAxbV4CqBybp7EkcJCrig63yE2E7PuNVOmilVMRcx/O+QDzGULTrKsq4DV13gSfak9ObPrWaHl/9bL5YcWw==",
+    "node_modules/@opentelemetry/semantic-conventions": {
+      "version": "1.41.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.41.1.tgz",
+      "integrity": "sha512-/UhIkaZgPutTFmQ7RnIJGgDXZmtEJ7Dvi86xNTFWcnRxVRNk/aotsqDJYeEvDP+FSMB2SdW+pQzNMcWP0rwuNA==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.6.2"
-      },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=14"
       }
     },
-    "node_modules/@smithy/util-buffer-from": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
-      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/is-array-buffer": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
+    "node_modules/@pinojs/redact": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
+      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
+      "license": "MIT"
+    },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=14"
       }
     },
-    "node_modules/@smithy/util-utf8": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
-      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@smithy/util-buffer-from": "^2.2.0",
-        "tslib": "^2.6.2"
-      },
+    "node_modules/@pkgr/core": {
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz",
+      "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=14.0.0"
+        "node": "^14.18.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/pkgr"
       }
     },
-    "node_modules/@sqlite.org/sqlite-wasm": {
-      "version": "3.48.0-build4",
-      "resolved": "https://registry.npmjs.org/@sqlite.org/sqlite-wasm/-/sqlite-wasm-3.48.0-build4.tgz",
-      "integrity": "sha512-hI6twvUkzOmyGZhQMza1gpfqErZxXRw6JEsiVjUbo7tFanVD+8Oil0Ih3l2nGzHdxPI41zFmfUQG7GHqhciKZQ==",
+    "node_modules/@playwright/test": {
+      "version": "1.61.0",
+      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.0.tgz",
+      "integrity": "sha512-cKA5B6lpFEMyMGjxF54QihfYpB4FkEGH+qZhtArDEG+wezQAJY8Pq6C7T1SjWz+FFzt3TbyoXBQYk/0292TdJA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "playwright": "1.61.0"
+      },
       "bin": {
-        "sqlite-wasm": "bin/index.js"
+        "playwright": "cli.js"
+      },
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/@standard-schema/spec": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
+    "node_modules/@polka/url": {
+      "version": "1.0.0-next.29",
+      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
+      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
+      "devOptional": true,
       "license": "MIT"
     },
-    "node_modules/@sveltejs/acorn-typescript": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.9.tgz",
-      "integrity": "sha512-lVJX6qEgs/4DOcRTpo56tmKzVPtoWAaVbL4hfO7t7NVwl9AAXzQR6cihesW1BmNMPl+bK6dreu2sOKBP2Q9CIA==",
-      "devOptional": true,
+    "node_modules/@poppinss/macroable": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@poppinss/macroable/-/macroable-1.1.2.tgz",
+      "integrity": "sha512-FAVBRzzWhYP5mA3lCwLH1A0fKBqq5anyjGet90Z81aRK5c/+LTGUE1zJhZrErjaenBSOOI9BVUs3WVmotneFQA==",
+      "dev": true,
       "license": "MIT",
-      "peerDependencies": {
-        "acorn": "^8.9.0"
-      }
+      "optional": true
     },
-    "node_modules/@sveltejs/adapter-node": {
-      "version": "5.5.3",
-      "resolved": "https://registry.npmjs.org/@sveltejs/adapter-node/-/adapter-node-5.5.3.tgz",
-      "integrity": "sha512-yeWbKXBL9vqDb/7R8ebvRHeuBHN4cRYYBSquNJSMQtS6rIYkXxsVSveaMTUaLvHYQsb1zNa+nH2iLTOMawBohA==",
+    "node_modules/@rollup/plugin-commonjs": {
+      "version": "29.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-29.0.3.tgz",
+      "integrity": "sha512-ZaOxZceP7SOUW7Lqw5IRVweSQYWaeIPnXIGLiB690EBA3FGJTO40EEr2L5yZplJWsgTCogILRSpcAe7+U0Otdg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@rollup/plugin-commonjs": "^29.0.0",
-        "@rollup/plugin-json": "^6.1.0",
-        "@rollup/plugin-node-resolve": "^16.0.0",
-        "rollup": "^4.9.5"
+        "@rollup/pluginutils": "^5.0.1",
+        "commondir": "^1.0.1",
+        "estree-walker": "^2.0.2",
+        "fdir": "^6.2.0",
+        "is-reference": "1.2.1",
+        "magic-string": "^0.30.3",
+        "picomatch": "^4.0.2"
+      },
+      "engines": {
+        "node": ">=16.0.0 || 14 >= 14.17"
       },
       "peerDependencies": {
-        "@sveltejs/kit": "^2.4.0"
+        "rollup": "^2.68.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@sveltejs/kit": {
-      "version": "2.53.2",
-      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.53.2.tgz",
-      "integrity": "sha512-M+MqAvFve12T1HWws/2npP/s3hFtyjw3GB/OXW/8a1jZBk48qnvPJrtgE+VOMc3RnjUMxc4mv/vQ73nvj2uNMg==",
-      "devOptional": true,
+    "node_modules/@rollup/plugin-json": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-json/-/plugin-json-6.1.0.tgz",
+      "integrity": "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
-        "@sveltejs/acorn-typescript": "^1.0.5",
-        "@types/cookie": "^0.6.0",
-        "acorn": "^8.14.1",
-        "cookie": "^0.6.0",
-        "devalue": "^5.6.3",
-        "esm-env": "^1.2.2",
-        "kleur": "^4.1.5",
-        "magic-string": "^0.30.5",
-        "mrmime": "^2.0.0",
-        "set-cookie-parser": "^3.0.0",
-        "sirv": "^3.0.0"
-      },
-      "bin": {
-        "svelte-kit": "svelte-kit.js"
+        "@rollup/pluginutils": "^5.1.0"
       },
       "engines": {
-        "node": ">=18.13"
+        "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "@opentelemetry/api": "^1.0.0",
-        "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
-        "svelte": "^4.0.0 || ^5.0.0-next.0",
-        "typescript": "^5.3.3",
-        "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
       },
       "peerDependenciesMeta": {
-        "@opentelemetry/api": {
-          "optional": true
-        },
-        "typescript": {
+        "rollup": {
           "optional": true
         }
       }
     },
-    "node_modules/@sveltejs/vite-plugin-svelte": {
-      "version": "6.2.4",
-      "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-6.2.4.tgz",
-      "integrity": "sha512-ou/d51QSdTyN26D7h6dSpusAKaZkAiGM55/AKYi+9AGZw7q85hElbjK3kEyzXHhLSnRISHOYzVge6x0jRZ7DXA==",
-      "devOptional": true,
+    "node_modules/@rollup/plugin-node-resolve": {
+      "version": "16.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-16.0.3.tgz",
+      "integrity": "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@sveltejs/vite-plugin-svelte-inspector": "^5.0.0",
-        "deepmerge": "^4.3.1",
-        "magic-string": "^0.30.21",
-        "obug": "^2.1.0",
-        "vitefu": "^1.1.1"
+        "@rollup/pluginutils": "^5.0.1",
+        "@types/resolve": "1.20.2",
+        "deepmerge": "^4.2.2",
+        "is-module": "^1.0.0",
+        "resolve": "^1.22.1"
       },
       "engines": {
-        "node": "^20.19 || ^22.12 || >=24"
+        "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "svelte": "^5.0.0",
-        "vite": "^6.3.0 || ^7.0.0"
+        "rollup": "^2.78.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@sveltejs/vite-plugin-svelte-inspector": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-5.0.2.tgz",
-      "integrity": "sha512-TZzRTcEtZffICSAoZGkPSl6Etsj2torOVrx6Uw0KpXxrec9Gg6jFWQ60Q3+LmNGfZSxHRCZL7vXVZIWmuV50Ig==",
-      "devOptional": true,
+    "node_modules/@rollup/plugin-replace": {
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/@rollup/plugin-replace/-/plugin-replace-6.0.3.tgz",
+      "integrity": "sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "obug": "^2.1.0"
+        "@rollup/pluginutils": "^5.0.1",
+        "magic-string": "^0.30.3"
       },
       "engines": {
-        "node": "^20.19 || ^22.12 || >=24"
+        "node": ">=14.0.0"
       },
       "peerDependencies": {
-        "@sveltejs/vite-plugin-svelte": "^6.0.0-next.0",
-        "svelte": "^5.0.0",
-        "vite": "^6.3.0 || ^7.0.0"
-      }
-    },
-    "node_modules/@swc/helpers": {
-      "version": "0.5.18",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.18.tgz",
-      "integrity": "sha512-TXTnIcNJQEKwThMMqBXsZ4VGAza6bvN4pa41Rkqoio6QBKMvo+5lexeTMScGCIxtzgQJzElcvIltani+adC5PQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "tslib": "^2.8.0"
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@tailwindcss/node": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.2.1.tgz",
-      "integrity": "sha512-jlx6sLk4EOwO6hHe1oCGm1Q4AN/s0rSrTTPBGPM0/RQ6Uylwq17FuU8IeJJKEjtc6K6O07zsvP+gDO6MMWo7pg==",
+    "node_modules/@rollup/pluginutils": {
+      "version": "5.4.0",
+      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.4.0.tgz",
+      "integrity": "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/remapping": "^2.3.5",
-        "enhanced-resolve": "^5.19.0",
-        "jiti": "^2.6.1",
-        "lightningcss": "1.31.1",
-        "magic-string": "^0.30.21",
-        "source-map-js": "^1.2.1",
-        "tailwindcss": "4.2.1"
-      }
-    },
-    "node_modules/@tailwindcss/oxide": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.2.1.tgz",
-      "integrity": "sha512-yv9jeEFWnjKCI6/T3Oq50yQEOqmpmpfzG1hcZsAOaXFQPfzWprWrlHSdGPEF3WQTi8zu8ohC9Mh9J470nT5pUw==",
-      "dev": true,
-      "license": "MIT",
+        "@types/estree": "^1.0.0",
+        "estree-walker": "^2.0.2",
+        "picomatch": "^4.0.2"
+      },
       "engines": {
-        "node": ">= 20"
+        "node": ">=14.0.0"
       },
-      "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.2.1",
-        "@tailwindcss/oxide-darwin-arm64": "4.2.1",
-        "@tailwindcss/oxide-darwin-x64": "4.2.1",
-        "@tailwindcss/oxide-freebsd-x64": "4.2.1",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.2.1",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.2.1",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.2.1",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.2.1",
-        "@tailwindcss/oxide-linux-x64-musl": "4.2.1",
-        "@tailwindcss/oxide-wasm32-wasi": "4.2.1",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.2.1",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.2.1"
+      "peerDependencies": {
+        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "rollup": {
+          "optional": true
+        }
       }
     },
-    "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.2.1.tgz",
-      "integrity": "sha512-eZ7G1Zm5EC8OOKaesIKuw77jw++QJ2lL9N+dDpdQiAB/c/B2wDh0QPFHbkBVrXnwNugvrbJFk1gK2SsVjwWReg==",
+    "node_modules/@rollup/rollup-android-arm-eabi": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.2.tgz",
+      "integrity": "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==",
       "cpu": [
-        "arm64"
+        "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-android-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.62.2.tgz",
+      "integrity": "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==",
+      "cpu": [
+        "arm64"
       ],
-      "engines": {
-        "node": ">= 20"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.2.1.tgz",
-      "integrity": "sha512-q/LHkOstoJ7pI1J0q6djesLzRvQSIfEto148ppAd+BVQK0JYjQIFSK3JgYZJa+Yzi0DDa52ZsQx2rqytBnf8Hw==",
+    "node_modules/@rollup/rollup-darwin-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.62.2.tgz",
+      "integrity": "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==",
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
-      ],
-      "engines": {
-        "node": ">= 20"
-      }
+      ]
     },
-    "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.2.1.tgz",
-      "integrity": "sha512-/f/ozlaXGY6QLbpvd/kFTro2l18f7dHKpB+ieXz+Cijl4Mt9AI2rTrpq7V+t04nK+j9XBQHnSMdeQRhbGyt6fw==",
+    "node_modules/@rollup/rollup-darwin-x64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.62.2.tgz",
+      "integrity": "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==",
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.62.2.tgz",
+      "integrity": "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==",
+      "cpu": [
+        "arm64"
       ],
-      "engines": {
-        "node": ">= 20"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.2.1.tgz",
-      "integrity": "sha512-5e/AkgYJT/cpbkys/OU2Ei2jdETCLlifwm7ogMC7/hksI2fC3iiq6OcXwjibcIjPung0kRtR3TxEITkqgn0TcA==",
+    "node_modules/@rollup/rollup-freebsd-x64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.62.2.tgz",
+      "integrity": "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==",
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.62.2.tgz",
+      "integrity": "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==",
+      "cpu": [
+        "arm"
       ],
-      "engines": {
-        "node": ">= 20"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.2.1.tgz",
-      "integrity": "sha512-Uny1EcVTTmerCKt/1ZuKTkb0x8ZaiuYucg2/kImO5A5Y/kBz41/+j0gxUZl+hTF3xkWpDmHX+TaWhOtba2Fyuw==",
+    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.62.2.tgz",
+      "integrity": "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==",
       "cpu": [
         "arm"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.62.2.tgz",
+      "integrity": "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==",
+      "cpu": [
+        "arm64"
       ],
-      "engines": {
-        "node": ">= 20"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.2.1.tgz",
-      "integrity": "sha512-CTrwomI+c7n6aSSQlsPL0roRiNMDQ/YzMD9EjcR+H4f0I1SQ8QqIuPnsVp7QgMkC1Qi8rtkekLkOFjo7OlEFRQ==",
+    "node_modules/@rollup/rollup-linux-arm64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.62.2.tgz",
+      "integrity": "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==",
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.62.2.tgz",
+      "integrity": "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==",
+      "cpu": [
+        "loong64"
       ],
-      "engines": {
-        "node": ">= 20"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.2.1.tgz",
-      "integrity": "sha512-WZA0CHRL/SP1TRbA5mp9htsppSEkWuQ4KsSUumYQnyl8ZdT39ntwqmz4IUHGN6p4XdSlYfJwM4rRzZLShHsGAQ==",
+    "node_modules/@rollup/rollup-linux-loong64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.62.2.tgz",
+      "integrity": "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==",
       "cpu": [
-        "arm64"
+        "loong64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.62.2.tgz",
+      "integrity": "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.62.2.tgz",
+      "integrity": "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.62.2.tgz",
+      "integrity": "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.62.2.tgz",
+      "integrity": "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==",
+      "cpu": [
+        "riscv64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-s390x-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.62.2.tgz",
+      "integrity": "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==",
+      "cpu": [
+        "s390x"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.62.2.tgz",
+      "integrity": "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==",
+      "cpu": [
+        "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": ">= 20"
-      }
+      ]
     },
-    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.2.1.tgz",
-      "integrity": "sha512-qMFzxI2YlBOLW5PhblzuSWlWfwLHaneBE0xHzLrBgNtqN6mWfs+qYbhryGSXQjFYB1Dzf5w+LN5qbUTPhW7Y5g==",
+    "node_modules/@rollup/rollup-linux-x64-musl": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.62.2.tgz",
+      "integrity": "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==",
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
-      ],
-      "engines": {
-        "node": ">= 20"
-      }
+      ]
     },
-    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.2.1.tgz",
-      "integrity": "sha512-5r1X2FKnCMUPlXTWRYpHdPYUY6a1Ar/t7P24OuiEdEOmms5lyqjDRvVY1yy9Rmioh+AunQ0rWiOTPE8F9A3v5g==",
+    "node_modules/@rollup/rollup-openbsd-x64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.62.2.tgz",
+      "integrity": "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==",
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">= 20"
-      }
+        "openbsd"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.2.1.tgz",
-      "integrity": "sha512-MGFB5cVPvshR85MTJkEvqDUnuNoysrsRxd6vnk1Lf2tbiqNlXpHYZqkqOQalydienEWOHHFyyuTSYRsLfxFJ2Q==",
-      "bundleDependencies": [
-        "@napi-rs/wasm-runtime",
-        "@emnapi/core",
-        "@emnapi/runtime",
-        "@tybys/wasm-util",
-        "@emnapi/wasi-threads",
-        "tslib"
-      ],
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.62.2.tgz",
+      "integrity": "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==",
       "cpu": [
-        "wasm32"
+        "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "@emnapi/core": "^1.8.1",
-        "@emnapi/runtime": "^1.8.1",
-        "@emnapi/wasi-threads": "^1.1.0",
-        "@napi-rs/wasm-runtime": "^1.1.1",
-        "@tybys/wasm-util": "^0.10.1",
-        "tslib": "^2.8.1"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      }
+      "os": [
+        "openharmony"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.2.1.tgz",
-      "integrity": "sha512-YlUEHRHBGnCMh4Nj4GnqQyBtsshUPdiNroZj8VPkvTZSoHsilRCwXcVKnG9kyi0ZFAS/3u+qKHBdDc81SADTRA==",
+    "node_modules/@rollup/rollup-win32-arm64-msvc": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.62.2.tgz",
+      "integrity": "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==",
       "cpu": [
         "arm64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-ia32-msvc": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.62.2.tgz",
+      "integrity": "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==",
+      "cpu": [
+        "ia32"
       ],
-      "engines": {
-        "node": ">= 20"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
     },
-    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.2.1.tgz",
-      "integrity": "sha512-rbO34G5sMWWyrN/idLeVxAZgAKWrn5LiR3/I90Q9MkA67s6T1oB0xtTe+0heoBvHSpbU9Mk7i6uwJnpo4u21XQ==",
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.62.2.tgz",
+      "integrity": "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==",
       "cpu": [
         "x64"
       ],
-      "dev": true,
       "license": "MIT",
       "optional": true,
       "os": [
         "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.62.2.tgz",
+      "integrity": "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==",
+      "cpu": [
+        "x64"
       ],
-      "engines": {
-        "node": ">= 20"
-      }
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
     },
-    "node_modules/@tailwindcss/vite": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.2.1.tgz",
-      "integrity": "sha512-TBf2sJjYeb28jD2U/OhwdW0bbOsxkWPwQ7SrqGf9sVcoYwZj7rkXljroBO9wKBut9XnmQLXanuDUeqQK0lGg/w==",
+    "node_modules/@sideway/address": {
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
+      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
       "dev": true,
-      "license": "MIT",
+      "license": "BSD-3-Clause",
+      "optional": true,
       "dependencies": {
-        "@tailwindcss/node": "4.2.1",
-        "@tailwindcss/oxide": "4.2.1",
-        "tailwindcss": "4.2.1"
-      },
-      "peerDependencies": {
-        "vite": "^5.2.0 || ^6 || ^7"
+        "@hapi/hoek": "^9.0.0"
       }
     },
-    "node_modules/@testing-library/svelte-core": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/@testing-library/svelte-core/-/svelte-core-1.0.0.tgz",
-      "integrity": "sha512-VkUePoLV6oOYwSUvX6ShA8KLnJqZiYMIbP2JW2t0GLWLkJxKGvuH5qrrZBV/X7cXFnLGuFQEC7RheYiZOW68KQ==",
+    "node_modules/@sideway/formula": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
+      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
       "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=16"
-      },
-      "peerDependencies": {
-        "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0"
-      }
+      "license": "BSD-3-Clause",
+      "optional": true
+    },
+    "node_modules/@sideway/pinpoint": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
+      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "optional": true
     },
-    "node_modules/@tybys/wasm-util": {
-      "version": "0.10.1",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.1.tgz",
-      "integrity": "sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==",
+    "node_modules/@sinclair/typebox": {
+      "version": "0.31.28",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.31.28.tgz",
+      "integrity": "sha512-/s55Jujywdw/Jpan+vsy6JZs1z2ZTGxTmbZTPiuSL2wz9mfzA2gN1zzaqmvfi4pq+uOt7Du85fkiwv5ymW84aQ==",
       "dev": true,
-      "license": "MIT",
-      "optional": true,
+      "license": "MIT"
+    },
+    "node_modules/@smithy/core": {
+      "version": "3.26.0",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.26.0.tgz",
+      "integrity": "sha512-mLUktFAn+Pa2agl1J7VgtYNFWCX8/b4GMJSK1hCu4YCvtBfM6F8Os3EP4ry+DFFlXOf3wyvlgXhuUdFoy52D3g==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "tslib": "^2.4.0"
+        "@aws-crypto/crc32": "5.2.0",
+        "@smithy/types": "^4.15.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/@types/chai": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
-      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
-      "devOptional": true,
-      "license": "MIT",
+    "node_modules/@smithy/credential-provider-imds": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.4.2.tgz",
+      "integrity": "sha512-18UMDMyrAbDcpmL1gLUA7ww0fRTcdCrSjSJOi2Sbld+tVjwD/pW+OAwjlScFLR7vvBnhZrIPQ7kVuTf1mnJLug==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@types/deep-eql": "*",
-        "assertion-error": "^2.0.1"
+        "@smithy/core": "^3.26.0",
+        "@smithy/types": "^4.15.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/@types/cookie": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
-      "integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
-      "devOptional": true,
-      "license": "MIT"
+    "node_modules/@smithy/fetch-http-handler": {
+      "version": "5.5.2",
+      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.5.2.tgz",
+      "integrity": "sha512-Ei/UK/QMhq0rKaMqGPlOAkE2yS9DZeYmZdk1RAKc3vp3zxgleZHZyBLlZv8yLsxljX4svCRuMTD6u3LLIcU4Bg==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/core": "^3.26.0",
+        "@smithy/types": "^4.15.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@types/deep-eql": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
-      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
-      "devOptional": true,
-      "license": "MIT"
+    "node_modules/@smithy/is-array-buffer": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
+      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
     },
-    "node_modules/@types/estree": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
-      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
-      "devOptional": true,
-      "license": "MIT"
+    "node_modules/@smithy/node-http-handler": {
+      "version": "4.8.2",
+      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.8.2.tgz",
+      "integrity": "sha512-wfl1uwrAqMH9/pi4kqBo5LBcFwrJLxuDLqL7p7qNcJIFcyZDUc6pzhYk4CYv+DP7fIUpQCZumwNnkhPKS52osQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/core": "^3.26.0",
+        "@smithy/types": "^4.15.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@types/json-schema": {
-      "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/@smithy/signature-v4": {
+      "version": "5.5.2",
+      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.5.2.tgz",
+      "integrity": "sha512-7xHpmPY4rt0IOmeAA8EfjgEH8isT+587TCdy9H6a7d4OMi5CQ0oEHhWllunvPu4j4Cq0vTFwdxXN/kABWPjdyA==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@smithy/core": "^3.26.0",
+        "@smithy/types": "^4.15.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
     },
-    "node_modules/@types/node": {
-      "version": "24.10.13",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.13.tgz",
-      "integrity": "sha512-oH72nZRfDv9lADUBSo104Aq7gPHpQZc4BTx38r9xf9pg5LfP6EzSyH2n7qFmmxRQXh7YlUXODcYsg6PuTDSxGg==",
-      "devOptional": true,
-      "license": "MIT",
+    "node_modules/@smithy/types": {
+      "version": "4.15.0",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.15.0.tgz",
+      "integrity": "sha512-Z5TAOxygoFvybJV3igo5SloFflSokHx2hu1eFA+DxDTcn+FtKxUSui+rbTRG1pAafMA888Z3MVvCWUuvCrTXjg==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "undici-types": "~7.16.0"
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/@types/pg": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/@types/pg/-/pg-8.20.0.tgz",
-      "integrity": "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==",
-      "devOptional": true,
-      "license": "MIT",
+    "node_modules/@smithy/util-buffer-from": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
+      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@types/node": "*",
-        "pg-protocol": "*",
-        "pg-types": "^2.2.0"
+        "@smithy/is-array-buffer": "^2.2.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@types/react": {
-      "version": "19.2.14",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.14.tgz",
-      "integrity": "sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==",
-      "license": "MIT",
-      "peer": true,
+    "node_modules/@smithy/util-utf8": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
+      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "csstype": "^3.2.2"
+        "@smithy/util-buffer-from": "^2.2.0",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@types/resolve": {
-      "version": "1.20.2",
-      "resolved": "https://registry.npmjs.org/@types/resolve/-/resolve-1.20.2.tgz",
-      "integrity": "sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==",
+    "node_modules/@sqlite.org/sqlite-wasm": {
+      "version": "3.48.0-build4",
+      "resolved": "https://registry.npmjs.org/@sqlite.org/sqlite-wasm/-/sqlite-wasm-3.48.0-build4.tgz",
+      "integrity": "sha512-hI6twvUkzOmyGZhQMza1gpfqErZxXRw6JEsiVjUbo7tFanVD+8Oil0Ih3l2nGzHdxPI41zFmfUQG7GHqhciKZQ==",
       "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "sqlite-wasm": "bin/index.js"
+      }
+    },
+    "node_modules/@standard-schema/spec": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
+      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
       "license": "MIT"
     },
-    "node_modules/@types/trusted-types": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
-      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
+    "node_modules/@sveltejs/acorn-typescript": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.10.tgz",
+      "integrity": "sha512-4WfKk68eTih+MiJD4fSbxN7E8kVBmTMPWHUPYjvl2N0rMs53YLTT8/YjKU5Dtnz5LqDjl7LEw4U7lXR2W3J5WA==",
       "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/@types/validator": {
-      "version": "13.15.10",
-      "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.15.10.tgz",
-      "integrity": "sha512-T8L6i7wCuyoK8A/ZeLYt1+q0ty3Zb9+qbSSvrIVitzT3YjZqkTZ40IbRsPanlB4h1QB3JVL1SYCdR6ngtFYcuA==",
-      "dev": true,
       "license": "MIT",
-      "optional": true
-    },
-    "node_modules/@types/webidl-conversions": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/@types/webidl-conversions/-/webidl-conversions-7.0.3.tgz",
-      "integrity": "sha512-CiJJvcRtIgzadHCYXw7dqEnMNRjhGZlYK05Mj9OyktqV8uVT8fD2BFOB7S1uwBE3Kj2Z+4UyPmFw/Ixgw/LAlA==",
-      "license": "MIT",
-      "peer": true
+      "peerDependencies": {
+        "acorn": "^8.9.0"
+      }
     },
-    "node_modules/@types/whatwg-url": {
-      "version": "13.0.0",
-      "resolved": "https://registry.npmjs.org/@types/whatwg-url/-/whatwg-url-13.0.0.tgz",
-      "integrity": "sha512-N8WXpbE6Wgri7KUSvrmQcqrMllKZ9uxkYWMt+mCSGwNc0Hsw9VQTW7ApqI4XNrx6/SaM2QQJCzMPDEXE058s+Q==",
+    "node_modules/@sveltejs/adapter-node": {
+      "version": "5.5.6",
+      "resolved": "https://registry.npmjs.org/@sveltejs/adapter-node/-/adapter-node-5.5.6.tgz",
+      "integrity": "sha512-OSclz7clrNzpks+CHoPVmc/eZ/+Kz/0VSf4t65TIrw+FXPBXGuqtHOCMITel2ovbyKrx05MQ4HiUj4X0nhueWA==",
+      "dev": true,
       "license": "MIT",
-      "peer": true,
       "dependencies": {
-        "@types/webidl-conversions": "*"
+        "@rollup/plugin-commonjs": "^29.0.0",
+        "@rollup/plugin-json": "^6.1.0",
+        "@rollup/plugin-node-resolve": "^16.0.0",
+        "@rollup/plugin-replace": "^6.0.3",
+        "rollup": "^4.59.0"
+      },
+      "peerDependencies": {
+        "@sveltejs/kit": "^2.4.0"
       }
     },
-    "node_modules/@typeschema/class-validator": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/@typeschema/class-validator/-/class-validator-0.3.0.tgz",
-      "integrity": "sha512-OJSFeZDIQ8EK1HTljKLT5CItM2wsbgczLN8tMEfz3I1Lmhc5TBfkZ0eikFzUC16tI3d1Nag7um6TfCgp2I2Bww==",
-      "dev": true,
+    "node_modules/@sveltejs/kit": {
+      "version": "2.67.0",
+      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.67.0.tgz",
+      "integrity": "sha512-JXHbsDwRes1Wgyof3q5ApzzpbCWvinKXMQCiV67TFO6xlZPYLoK0fq3xQMqSicDMgCtFGqLkrQXkseOcASdZ8A==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "@typeschema/core": "0.14.0"
+        "@standard-schema/spec": "^1.0.0",
+        "@sveltejs/acorn-typescript": "^1.0.9",
+        "@types/cookie": "^0.6.0",
+        "acorn": "^8.16.0",
+        "cookie": "^0.6.0",
+        "devalue": "^5.8.1",
+        "esm-env": "^1.2.2",
+        "kleur": "^4.1.5",
+        "magic-string": "^0.30.5",
+        "mrmime": "^2.0.0",
+        "set-cookie-parser": "^3.0.0",
+        "sirv": "^3.0.0"
+      },
+      "bin": {
+        "svelte-kit": "svelte-kit.js"
+      },
+      "engines": {
+        "node": ">=18.13"
       },
       "peerDependencies": {
-        "class-validator": "^0.14.1"
+        "@opentelemetry/api": "^1.0.0",
+        "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
+        "svelte": "^4.0.0 || ^5.0.0-next.0",
+        "typescript": "^5.3.3 || ^6.0.0",
+        "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
-        "class-validator": {
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "typescript": {
           "optional": true
         }
       }
     },
-    "node_modules/@typeschema/core": {
-      "version": "0.14.0",
-      "resolved": "https://registry.npmjs.org/@typeschema/core/-/core-0.14.0.tgz",
-      "integrity": "sha512-Ia6PtZHcL3KqsAWXjMi5xIyZ7XMH4aSnOQes8mfMLx+wGFGtGRNlwe6Y7cYvX+WfNK67OL0/HSe9t8QDygV0/w==",
+    "node_modules/@sveltejs/load-config": {
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/@sveltejs/load-config/-/load-config-0.1.1.tgz",
+      "integrity": "sha512-BXXm+VOH/9X4N7Dd1iZ2MqA1h7M+9i2noI8QYuLDY8QcN2WHYn7D/VK/+IJNfcAmRw7ACNJ538UT9GXIhnBTiA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "peerDependencies": {
-        "@types/json-schema": "^7.0.15"
-      },
-      "peerDependenciesMeta": {
-        "@types/json-schema": {
-          "optional": true
-        }
+      "engines": {
+        "node": ">= 18.0.0"
       }
     },
-    "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.56.1.tgz",
-      "integrity": "sha512-Jz9ZztpB37dNC+HU2HI28Bs9QXpzCz+y/twHOwhyrIRdbuVDxSytJNDl6z/aAKlaRIwC7y8wJdkBv7FxYGgi0A==",
-      "dev": true,
+    "node_modules/@sveltejs/vite-plugin-svelte": {
+      "version": "6.2.4",
+      "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-6.2.4.tgz",
+      "integrity": "sha512-ou/d51QSdTyN26D7h6dSpusAKaZkAiGM55/AKYi+9AGZw7q85hElbjK3kEyzXHhLSnRISHOYzVge6x0jRZ7DXA==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/type-utils": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
-        "ignore": "^7.0.5",
-        "natural-compare": "^1.4.0",
-        "ts-api-utils": "^2.4.0"
+        "@sveltejs/vite-plugin-svelte-inspector": "^5.0.0",
+        "deepmerge": "^4.3.1",
+        "magic-string": "^0.30.21",
+        "obug": "^2.1.0",
+        "vitefu": "^1.1.1"
       },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
+        "node": "^20.19 || ^22.12 || >=24"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.56.1",
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
-      }
-    },
-    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 4"
+        "svelte": "^5.0.0",
+        "vite": "^6.3.0 || ^7.0.0"
       }
     },
-    "node_modules/@typescript-eslint/parser": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.56.1.tgz",
-      "integrity": "sha512-klQbnPAAiGYFyI02+znpBRLyjL4/BrBd0nyWkdC0s/6xFLkXYQ8OoRrSkqacS1ddVxf/LDyODIKbQ5TgKAf/Fg==",
-      "dev": true,
+    "node_modules/@sveltejs/vite-plugin-svelte-inspector": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-5.0.2.tgz",
+      "integrity": "sha512-TZzRTcEtZffICSAoZGkPSl6Etsj2torOVrx6Uw0KpXxrec9Gg6jFWQ60Q3+LmNGfZSxHRCZL7vXVZIWmuV50Ig==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
-        "debug": "^4.4.3"
+        "obug": "^2.1.0"
       },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
+        "node": "^20.19 || ^22.12 || >=24"
       },
       "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "@sveltejs/vite-plugin-svelte": "^6.0.0-next.0",
+        "svelte": "^5.0.0",
+        "vite": "^6.3.0 || ^7.0.0"
       }
     },
-    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.56.1.tgz",
-      "integrity": "sha512-TAdqQTzHNNvlVFfR+hu2PDJrURiwKsUvxFn1M0h95BB8ah5jejas08jUWG4dBA68jDMI988IvtfdAI53JzEHOQ==",
+    "node_modules/@swc/helpers": {
+      "version": "0.5.23",
+      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
+      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "tslib": "^2.8.0"
+      }
+    },
+    "node_modules/@tailwindcss/node": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.1.tgz",
+      "integrity": "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.56.1",
-        "@typescript-eslint/types": "^8.56.1",
-        "debug": "^4.4.3"
-      },
-      "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "@jridgewell/remapping": "^2.3.5",
+        "enhanced-resolve": "5.21.6",
+        "jiti": "^2.7.0",
+        "lightningcss": "1.32.0",
+        "magic-string": "^0.30.21",
+        "source-map-js": "^1.2.1",
+        "tailwindcss": "4.3.1"
       }
     },
-    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.56.1.tgz",
-      "integrity": "sha512-YAi4VDKcIZp0O4tz/haYKhmIDZFEUPOreKbfdAN3SzUDMcPhJ8QI99xQXqX+HoUVq8cs85eRKnD+rne2UAnj2w==",
+    "node_modules/@tailwindcss/oxide": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.1.tgz",
+      "integrity": "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1"
-      },
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+        "node": ">= 20"
       },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
+      "optionalDependencies": {
+        "@tailwindcss/oxide-android-arm64": "4.3.1",
+        "@tailwindcss/oxide-darwin-arm64": "4.3.1",
+        "@tailwindcss/oxide-darwin-x64": "4.3.1",
+        "@tailwindcss/oxide-freebsd-x64": "4.3.1",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.3.1",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.3.1",
+        "@tailwindcss/oxide-linux-x64-musl": "4.3.1",
+        "@tailwindcss/oxide-wasm32-wasi": "4.3.1",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.3.1"
       }
     },
-    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.56.1.tgz",
-      "integrity": "sha512-qOtCYzKEeyr3aR9f28mPJqBty7+DBqsdd63eO0yyDwc6vgThj2UjWfJIcsFeSucYydqcuudMOprZ+x1SpF3ZuQ==",
+    "node_modules/@tailwindcss/oxide-android-arm64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz",
+      "integrity": "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.56.1.tgz",
-      "integrity": "sha512-yB/7dxi7MgTtGhZdaHCemf7PuwrHMenHjmzgUW1aJpO+bBU43OycnM3Wn+DdvDO/8zzA9HlhaJ0AUGuvri4oGg==",
+    "node_modules/@tailwindcss/oxide-darwin-arm64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz",
+      "integrity": "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1",
-        "debug": "^4.4.3",
-        "ts-api-utils": "^2.4.0"
-      },
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/types": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.56.1.tgz",
-      "integrity": "sha512-dbMkdIUkIkchgGDIv7KLUpa0Mda4IYjo4IAMJUZ+3xNoUXxMsk9YtKpTHSChRS85o+H9ftm51gsK1dZReY9CVw==",
+    "node_modules/@tailwindcss/oxide-darwin-x64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz",
+      "integrity": "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.56.1.tgz",
-      "integrity": "sha512-qzUL1qgalIvKWAf9C1HpvBjif+Vm6rcT5wZd4VoMb9+Km3iS3Cv9DY6dMRMDtPnwRAFyAi7YXJpTIEXLvdfPxg==",
+    "node_modules/@tailwindcss/oxide-freebsd-x64": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz",
+      "integrity": "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/project-service": "8.56.1",
-        "@typescript-eslint/tsconfig-utils": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/visitor-keys": "8.56.1",
-        "debug": "^4.4.3",
-        "minimatch": "^10.2.2",
-        "semver": "^7.7.3",
-        "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.4.0"
-      },
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "typescript": ">=4.8.4 <6.0.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+    "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz",
+      "integrity": "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==",
+      "cpu": [
+        "arm"
+      ],
       "dev": true,
       "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz",
+      "integrity": "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "brace-expansion": "^5.0.5"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "18 || 20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/utils": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.56.1.tgz",
-      "integrity": "sha512-HPAVNIME3tABJ61siYlHzSWCGtOoeP2RTIaHXFMPqjrQKCGB9OgUVdiNgH7TJS2JNIQ5qQ4RsAUDuGaGme/KOA==",
+    "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz",
+      "integrity": "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.56.1",
-        "@typescript-eslint/types": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
-      },
-      "peerDependencies": {
-        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.56.1.tgz",
-      "integrity": "sha512-KiROIzYdEV85YygXw6BI/Dx4fnBlFQu6Mq4QE4MOH9fFnhohw6wX/OAvDY2/C+ut0I3RSPKenvZJIVYqJNkhEw==",
+    "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz",
+      "integrity": "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@typescript-eslint/types": "8.56.1",
-        "eslint-visitor-keys": "^5.0.0"
-      },
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/typescript-eslint"
+        "node": ">= 20"
       }
     },
-    "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
-      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
+    "node_modules/@tailwindcss/oxide-linux-x64-musl": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz",
+      "integrity": "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
-      },
-      "funding": {
-        "url": "https://opencollective.com/eslint"
+        "node": ">= 20"
       }
     },
-    "node_modules/@valibot/to-json-schema": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/@valibot/to-json-schema/-/to-json-schema-1.5.0.tgz",
-      "integrity": "sha512-GE7DmSr1C2UCWPiV0upRH6mv0cCPsqYGs819fb6srCS1tWhyXrkGGe+zxUiwzn/L1BOfADH4sNjY/YHCuP8phQ==",
+    "node_modules/@tailwindcss/oxide-wasm32-wasi": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz",
+      "integrity": "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==",
+      "bundleDependencies": [
+        "@napi-rs/wasm-runtime",
+        "@emnapi/core",
+        "@emnapi/runtime",
+        "@tybys/wasm-util",
+        "@emnapi/wasi-threads",
+        "tslib"
+      ],
+      "cpu": [
+        "wasm32"
+      ],
       "dev": true,
       "license": "MIT",
-      "peerDependencies": {
-        "valibot": "^1.2.0"
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.10.0",
+        "@emnapi/runtime": "^1.10.0",
+        "@emnapi/wasi-threads": "^1.2.1",
+        "@napi-rs/wasm-runtime": "^1.1.4",
+        "@tybys/wasm-util": "^0.10.2",
+        "tslib": "^2.8.1"
+      },
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
-    "node_modules/@vinejs/compiler": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@vinejs/compiler/-/compiler-3.0.0.tgz",
-      "integrity": "sha512-v9Lsv59nR56+bmy2p0+czjZxsLHwaibJ+SV5iK9JJfehlJMa501jUJQqqz4X/OqKXrxtE3uTQmSqjUqzF3B2mw==",
+    "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz",
+      "integrity": "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==",
+      "cpu": [
+        "arm64"
+      ],
       "dev": true,
       "license": "MIT",
       "optional": true,
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@vinejs/vine": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@vinejs/vine/-/vine-3.0.1.tgz",
-      "integrity": "sha512-ZtvYkYpZOYdvbws3uaOAvTFuvFXoQGAtmzeiXu+XSMGxi5GVsODpoI9Xu9TplEMuD/5fmAtBbKb9cQHkWkLXDQ==",
+    "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz",
+      "integrity": "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==",
+      "cpu": [
+        "x64"
+      ],
       "dev": true,
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "@poppinss/macroable": "^1.0.4",
-        "@types/validator": "^13.12.2",
-        "@vinejs/compiler": "^3.0.0",
-        "camelcase": "^8.0.0",
-        "dayjs": "^1.11.13",
-        "dlv": "^1.1.3",
-        "normalize-url": "^8.0.1",
-        "validator": "^13.12.0"
-      },
+      "os": [
+        "win32"
+      ],
       "engines": {
-        "node": ">=18.16.0"
+        "node": ">= 20"
       }
     },
-    "node_modules/@vitest/browser": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.0.18.tgz",
-      "integrity": "sha512-gVQqh7paBz3gC+ZdcCmNSWJMk70IUjDeVqi+5m5vYpEHsIwRgw3Y545jljtajhkekIpIp5Gg8oK7bctgY0E2Ng==",
-      "devOptional": true,
+    "node_modules/@tailwindcss/vite": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.1.tgz",
+      "integrity": "sha512-hItDHuIIlEV61R+faXu66s1K36aTurO/Qw0e45Vskz57gXl9pWOT6eg3zmcEui6CZXddbN7zd41bwmvag4JGwQ==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/mocker": "4.0.18",
-        "@vitest/utils": "4.0.18",
-        "magic-string": "^0.30.21",
-        "pixelmatch": "7.1.0",
-        "pngjs": "^7.0.0",
-        "sirv": "^3.0.2",
-        "tinyrainbow": "^3.0.3",
-        "ws": "^8.18.3"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
+        "@tailwindcss/node": "4.3.1",
+        "@tailwindcss/oxide": "4.3.1",
+        "tailwindcss": "4.3.1"
       },
       "peerDependencies": {
-        "vitest": "4.0.18"
+        "vite": "^5.2.0 || ^6 || ^7 || ^8"
       }
     },
-    "node_modules/@vitest/browser-playwright": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.0.18.tgz",
-      "integrity": "sha512-gfajTHVCiwpxRj1qh0Sh/5bbGLG4F/ZH/V9xvFVoFddpITfMta9YGow0W6ZpTTORv2vdJuz9TnrNSmjKvpOf4g==",
-      "devOptional": true,
+    "node_modules/@testing-library/svelte-core": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@testing-library/svelte-core/-/svelte-core-1.1.3.tgz",
+      "integrity": "sha512-KkMAvXeWorxN2Yn0kdC1lfoAItxpoj4uOWzxK5leDrNxonLvS5nwBFvztrroyTszQ0Wf/EU6iLT8JhY5qcn22g==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@vitest/browser": "4.0.18",
-        "@vitest/mocker": "4.0.18",
-        "tinyrainbow": "^3.0.3"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
+      "engines": {
+        "node": ">=16"
       },
       "peerDependencies": {
-        "playwright": "*",
-        "vitest": "4.0.18"
-      },
-      "peerDependenciesMeta": {
-        "playwright": {
-          "optional": false
-        }
+        "svelte": "^3 || ^4 || ^5 || ^5.0.0-next.0"
       }
     },
-    "node_modules/@vitest/coverage-v8": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.0.18.tgz",
-      "integrity": "sha512-7i+N2i0+ME+2JFZhfuz7Tg/FqKtilHjGyGvoHYQ6iLV0zahbsJ9sljC9OcFcPDbhYKCet+sG8SsVqlyGvPflZg==",
+    "node_modules/@types/adm-zip": {
+      "version": "0.5.8",
+      "resolved": "https://registry.npmjs.org/@types/adm-zip/-/adm-zip-0.5.8.tgz",
+      "integrity": "sha512-RVVH7QvZYbN+ihqZ4kX/dMiowf6o+Jk1fNwiSdx0NahBJLU787zkULhGhJM8mf/obmLGmgdMM0bXsQTmyfbR7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@bcoe/v8-coverage": "^1.0.2",
-        "@vitest/utils": "4.0.18",
-        "ast-v8-to-istanbul": "^0.3.10",
-        "istanbul-lib-coverage": "^3.2.2",
-        "istanbul-lib-report": "^3.0.1",
-        "istanbul-reports": "^3.2.0",
-        "magicast": "^0.5.1",
-        "obug": "^2.1.1",
-        "std-env": "^3.10.0",
-        "tinyrainbow": "^3.0.3"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
-      },
-      "peerDependencies": {
-        "@vitest/browser": "4.0.18",
-        "vitest": "4.0.18"
-      },
-      "peerDependenciesMeta": {
-        "@vitest/browser": {
-          "optional": true
-        }
+        "@types/node": "*"
       }
     },
-    "node_modules/@vitest/expect": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.0.18.tgz",
-      "integrity": "sha512-8sCWUyckXXYvx4opfzVY03EOiYVxyNrHS5QxX3DAIi5dpJAAkyJezHCP77VMX4HKA2LDT/Jpfo8i2r5BE3GnQQ==",
+    "node_modules/@types/chai": {
+      "version": "5.2.3",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
+      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
-        "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.0.18",
-        "@vitest/utils": "4.0.18",
-        "chai": "^6.2.1",
-        "tinyrainbow": "^3.0.3"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
+        "@types/deep-eql": "*",
+        "assertion-error": "^2.0.1"
       }
     },
-    "node_modules/@vitest/mocker": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.0.18.tgz",
-      "integrity": "sha512-HhVd0MDnzzsgevnOWCBj5Otnzobjy5wLBe4EdeeFGv8luMsGcYqDuFRMcttKWZA5vVO8RFjexVovXvAM4JoJDQ==",
+    "node_modules/@types/cookie": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
+      "integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
       "devOptional": true,
-      "license": "MIT",
-      "dependencies": {
-        "@vitest/spy": "4.0.18",
-        "estree-walker": "^3.0.3",
-        "magic-string": "^0.30.21"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
-      },
-      "peerDependencies": {
-        "msw": "^2.4.9",
-        "vite": "^6.0.0 || ^7.0.0-0"
-      },
-      "peerDependenciesMeta": {
-        "msw": {
-          "optional": true
-        },
-        "vite": {
-          "optional": true
-        }
-      }
+      "license": "MIT"
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
+      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.15",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
+      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/@vitest/mocker/node_modules/estree-walker": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+    "node_modules/@types/node": {
+      "version": "24.13.2",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
+      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "^1.0.0"
+        "undici-types": "~7.18.0"
       }
     },
-    "node_modules/@vitest/pretty-format": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.0.18.tgz",
-      "integrity": "sha512-P24GK3GulZWC5tz87ux0m8OADrQIUVDPIjjj65vBXYG17ZeU3qD7r+MNZ1RNv4l8CGU2vtTRqixrOi9fYk/yKw==",
-      "devOptional": true,
+    "node_modules/@types/papaparse": {
+      "version": "5.5.2",
+      "resolved": "https://registry.npmjs.org/@types/papaparse/-/papaparse-5.5.2.tgz",
+      "integrity": "sha512-gFnFp/JMzLHCwRf7tQHrNnfhN4eYBVYYI897CGX4MY1tzY9l2aLkVyx2IlKZ/SAqDbB3I1AOZW5gTMGGsqWliA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "tinyrainbow": "^3.0.3"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
+        "@types/node": "*"
       }
     },
-    "node_modules/@vitest/runner": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.0.18.tgz",
-      "integrity": "sha512-rpk9y12PGa22Jg6g5M3UVVnTS7+zycIGk9ZNGN+m6tZHKQb7jrP7/77WfZy13Y/EUDd52NDsLRQhYKtv7XfPQw==",
+    "node_modules/@types/pg": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/@types/pg/-/pg-8.20.0.tgz",
+      "integrity": "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.0.18",
-        "pathe": "^2.0.3"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
+        "@types/node": "*",
+        "pg-protocol": "*",
+        "pg-types": "^2.2.0"
       }
     },
-    "node_modules/@vitest/snapshot": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.0.18.tgz",
-      "integrity": "sha512-PCiV0rcl7jKQjbgYqjtakly6T1uwv/5BQ9SwBLekVg/EaYeQFPiXcgrC2Y7vDMA8dM1SUEAEV82kgSQIlXNMvA==",
-      "devOptional": true,
+    "node_modules/@types/resolve": {
+      "version": "1.20.2",
+      "resolved": "https://registry.npmjs.org/@types/resolve/-/resolve-1.20.2.tgz",
+      "integrity": "sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/tar-stream": {
+      "version": "3.1.4",
+      "resolved": "https://registry.npmjs.org/@types/tar-stream/-/tar-stream-3.1.4.tgz",
+      "integrity": "sha512-921gW0+g29mCJX0fRvqeHzBlE/XclDaAG0Ousy1LCghsOhvaKacDeRGEVzQP9IPfKn8Vysy7FEXAIxycpc/CMg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.0.18",
-        "magic-string": "^0.30.21",
-        "pathe": "^2.0.3"
-      },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
+        "@types/node": "*"
       }
     },
-    "node_modules/@vitest/spy": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.0.18.tgz",
-      "integrity": "sha512-cbQt3PTSD7P2OARdVW3qWER5EGq7PHlvE+QfzSC0lbwO+xnt7+XH06ZzFjFRgzUX//JmpxrCu92VdwvEPlWSNw==",
+    "node_modules/@types/trusted-types": {
+      "version": "2.0.7",
+      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
+      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
       "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/validator": {
+      "version": "13.15.10",
+      "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.15.10.tgz",
+      "integrity": "sha512-T8L6i7wCuyoK8A/ZeLYt1+q0ty3Zb9+qbSSvrIVitzT3YjZqkTZ40IbRsPanlB4h1QB3JVL1SYCdR6ngtFYcuA==",
+      "dev": true,
       "license": "MIT",
-      "funding": {
-        "url": "https://opencollective.com/vitest"
-      }
+      "optional": true
     },
-    "node_modules/@vitest/utils": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.0.18.tgz",
-      "integrity": "sha512-msMRKLMVLWygpK3u2Hybgi4MNjcYJvwTb0Ru09+fOyCXIgT5raYP041DRRdiJiI3k/2U6SEbAETB3YtBrUkCFA==",
-      "devOptional": true,
+    "node_modules/@typeschema/class-validator": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/@typeschema/class-validator/-/class-validator-0.3.0.tgz",
+      "integrity": "sha512-OJSFeZDIQ8EK1HTljKLT5CItM2wsbgczLN8tMEfz3I1Lmhc5TBfkZ0eikFzUC16tI3d1Nag7um6TfCgp2I2Bww==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "@vitest/pretty-format": "4.0.18",
-        "tinyrainbow": "^3.0.3"
+        "@typeschema/core": "0.14.0"
       },
-      "funding": {
-        "url": "https://opencollective.com/vitest"
+      "peerDependencies": {
+        "class-validator": "^0.14.1"
+      },
+      "peerDependenciesMeta": {
+        "class-validator": {
+          "optional": true
+        }
       }
     },
-    "node_modules/abbrev": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
-      "integrity": "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==",
+    "node_modules/@typeschema/core": {
+      "version": "0.14.0",
+      "resolved": "https://registry.npmjs.org/@typeschema/core/-/core-0.14.0.tgz",
+      "integrity": "sha512-Ia6PtZHcL3KqsAWXjMi5xIyZ7XMH4aSnOQes8mfMLx+wGFGtGRNlwe6Y7cYvX+WfNK67OL0/HSe9t8QDygV0/w==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
       "optional": true,
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+      "peerDependencies": {
+        "@types/json-schema": "^7.0.15"
+      },
+      "peerDependenciesMeta": {
+        "@types/json-schema": {
+          "optional": true
+        }
       }
     },
-    "node_modules/accepts": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
-      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
+    "node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.0.tgz",
+      "integrity": "sha512-o+mpz7EYiMzXoySXiKmzlabIvTVqUuK5yLrAedRPRDA0IpPFMUV1IXt6OqljIxX/kumN6EjUYp41Hqelh6p/Dw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "mime-types": "^3.0.0",
-        "negotiator": "^1.0.0"
+        "@eslint-community/regexpp": "^4.12.2",
+        "@typescript-eslint/scope-manager": "8.62.0",
+        "@typescript-eslint/type-utils": "8.62.0",
+        "@typescript-eslint/utils": "8.62.0",
+        "@typescript-eslint/visitor-keys": "8.62.0",
+        "ignore": "^7.0.5",
+        "natural-compare": "^1.4.0",
+        "ts-api-utils": "^2.5.0"
       },
       "engines": {
-        "node": ">= 0.6"
-      }
-    },
-    "node_modules/acorn": {
-      "version": "8.16.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
-      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
-      "devOptional": true,
-      "license": "MIT",
-      "bin": {
-        "acorn": "bin/acorn"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
       },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/acorn-jsx": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
-      "dev": true,
-      "license": "MIT",
       "peerDependencies": {
-        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+        "@typescript-eslint/parser": "^8.62.0",
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/agent-base": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
+      "version": "7.0.5",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">= 14"
+        "node": ">= 4"
       }
     },
-    "node_modules/ajv": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+    "node_modules/@typescript-eslint/parser": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.0.tgz",
+      "integrity": "sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
+        "@typescript-eslint/scope-manager": "8.62.0",
+        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/typescript-estree": "8.62.0",
+        "@typescript-eslint/visitor-keys": "8.62.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/ajv-formats": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
-      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "ajv": "^8.0.0"
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "ajv": "^8.0.0"
-      },
-      "peerDependenciesMeta": {
-        "ajv": {
-          "optional": true
-        }
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/ajv-formats-draft2019": {
-      "version": "1.6.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats-draft2019/-/ajv-formats-draft2019-1.6.1.tgz",
-      "integrity": "sha512-JQPvavpkWDvIsBp2Z33UkYCtXCSpW4HD3tAZ+oL4iEFOk9obQZffx0yANwECt6vzr6ET+7HN5czRyqXbnq/u0Q==",
+    "node_modules/@typescript-eslint/project-service": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.0.tgz",
+      "integrity": "sha512-wexnCqiTg7BOGtbLDftYpRWlmLq4xfoMd7BKFR6Y75sZS3QmRKLdN3yWLhmIYgqMmP/OXWpj3H8odkb5nGURCQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "punycode": "^2.1.1",
-        "schemes": "^1.4.0",
-        "smtp-address-parser": "^1.0.3",
-        "uri-js": "^4.4.1"
+        "@typescript-eslint/tsconfig-utils": "^8.62.0",
+        "@typescript-eslint/types": "^8.62.0",
+        "debug": "^4.4.3"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "ajv": "*"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/ajv-formats/node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.0.tgz",
+      "integrity": "sha512-1lX38kNxXIRb8mEc3lbq5mdHq1Pf2+U0nFU65KfT18mtPxxl0fvjuEE92mHuXPuCtElJhOrddOpyMlM3Z0umEA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
+        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/visitor-keys": "8.62.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
       }
     },
-    "node_modules/ajv-formats/node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/ansi-regex": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+    "node_modules/@typescript-eslint/tsconfig-utils": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.0.tgz",
+      "integrity": "sha512-y2GAdB6ykaXUvuspbYnizQc4oDDz0Tz/Yc7iWrXf9mx8vm/L/0vLHCe0tS2boG96Zy+DivnVDQ9ZUEWoHqqx1g==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=12"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.0.tgz",
+      "integrity": "sha512-+g5O3j0w2ldzC86Pv6fvbO/xhAonbJFIdf/MKQ1d30gndlsVzUOE83ldfSE15Qrl9fhFjK6AovHs5Wpp6vx86w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "color-convert": "^2.0.1"
+        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/typescript-estree": "8.62.0",
+        "@typescript-eslint/utils": "8.62.0",
+        "debug": "^4.4.3",
+        "ts-api-utils": "^2.5.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
       },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
+      }
+    },
+    "node_modules/@typescript-eslint/types": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.0.tgz",
+      "integrity": "sha512-KvAclkktORPvM54TgLgA4z9HIV1M8zOgw9ZVNXl9f/8dLYfXYX1wkMXP7qmabpijQRV5bHJLOmoyGQbLMaUYeg==",
+      "devOptional": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=8"
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       },
       "funding": {
-        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
       }
     },
-    "node_modules/antlr-ng": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/antlr-ng/-/antlr-ng-1.0.10.tgz",
-      "integrity": "sha512-fw3NdsQP3dabuZrDhKAMewrBsY5KSAcMrvhWBVDmHYegv5D51pypzCYK1PpjaRVKcVeP/5xKfqJY31TvXACOdA==",
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.0.tgz",
+      "integrity": "sha512-+hVbNxtW64pIcZWDPGbyaKF7vp2IBTVY5ma1blwwksrjdsbdqqEKvJWMGbBofei4F6Dovx1M0RJgoFeNu2279A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "antlr4ng": "3.0.16",
-        "commander": "13.1.0",
-        "stringtemplate4ts": "1.0.9",
-        "unicode-properties": "1.4.1"
+        "@typescript-eslint/project-service": "8.62.0",
+        "@typescript-eslint/tsconfig-utils": "8.62.0",
+        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/visitor-keys": "8.62.0",
+        "debug": "^4.4.3",
+        "minimatch": "^10.2.2",
+        "semver": "^7.7.3",
+        "tinyglobby": "^0.2.15",
+        "ts-api-utils": "^2.5.0"
       },
-      "bin": {
-        "antlr-ng": "dist/cli/runner.js",
-        "grun": "dist/cli/TestRig.js",
-        "interpreter": "dist/cli/Interpreter.js",
-        "testrig": "dist/cli/TestRig.js"
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/antlr-ng/node_modules/commander": {
-      "version": "13.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
-      "integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18"
+        "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/antlr4-c3": {
-      "version": "3.4.4",
-      "resolved": "https://registry.npmjs.org/antlr4-c3/-/antlr4-c3-3.4.4.tgz",
-      "integrity": "sha512-ixp1i17ypbRzZnffdarIfCVEXJwPydtDt61SHMGkc+UCD7rrbfvHESTMTgx8jFhUgKAgcHyt9060kQ8nU3vlxA==",
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "antlr4ng": "3.0.16"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/antlr4ng": {
-      "version": "3.0.16",
-      "resolved": "https://registry.npmjs.org/antlr4ng/-/antlr4ng-3.0.16.tgz",
-      "integrity": "sha512-DQuJkC7kX3xunfF4K2KsWTSvoxxslv+FQp/WHQZTJSsH2Ec3QfFmrxC3Nky2ok9yglXn6nHM4zUaVDxcN5f6kA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/argparse": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+    "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
-      "license": "Python-2.0"
-    },
-    "node_modules/aria-query": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
-      "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==",
-      "devOptional": true,
-      "license": "Apache-2.0",
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.5"
+      },
       "engines": {
-        "node": ">= 0.4"
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/arkregex": {
-      "version": "0.0.5",
-      "resolved": "https://registry.npmjs.org/arkregex/-/arkregex-0.0.5.tgz",
-      "integrity": "sha512-ncYjBdLlh5/QnVsAA8De16Tc9EqmYM7y/WU9j+236KcyYNUXogpz3sC4ATIZYzzLxwI+0sEOaQLEmLmRleaEXw==",
+    "node_modules/@typescript-eslint/utils": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.0.tgz",
+      "integrity": "sha512-82r66fi9zYwZ+mTq3vKgwjbZ1PVk/DJzrXFLpG6RnBbdvH8TEGVHIs9H4d2drhkOzf0syZuD/OZvvlu6GDbP4g==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "@ark/util": "0.56.0"
+        "@eslint-community/eslint-utils": "^4.9.1",
+        "@typescript-eslint/scope-manager": "8.62.0",
+        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/typescript-estree": "8.62.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/arktype": {
-      "version": "2.1.29",
-      "resolved": "https://registry.npmjs.org/arktype/-/arktype-2.1.29.tgz",
-      "integrity": "sha512-jyfKk4xIOzvYNayqnD8ZJQqOwcrTOUbIU4293yrzAjA3O1dWh61j71ArMQ6tS/u4pD7vabSPe7nG3RCyoXW6RQ==",
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.0.tgz",
+      "integrity": "sha512-CY3uyFSRbcQv3nnSv8S0+lDftMVz6P963PoRlxrV7ew/Md564g9ut60PYzdLM5qW4jFn93GBF+Soi90ISAN+GQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "@ark/schema": "0.56.0",
-        "@ark/util": "0.56.0",
-        "arkregex": "0.0.5"
+        "@typescript-eslint/types": "8.62.0",
+        "eslint-visitor-keys": "^5.0.0"
+      },
+      "engines": {
+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
       }
     },
-    "node_modules/array-timsort": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/array-timsort/-/array-timsort-1.0.3.tgz",
-      "integrity": "sha512-/+3GRL7dDAGEfM6TseQk/U+mi18TU2Ms9I3UlLdUMhz2hbvGNTKdj9xniwXfUqgYhHxRx0+8UnKkvlNwVU+cWQ==",
+    "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
+      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/assertion-error": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
-      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
-      "devOptional": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">=12"
+        "node": "^20.19.0 || ^22.13.0 || >=24"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/ast-v8-to-istanbul": {
-      "version": "0.3.12",
-      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-0.3.12.tgz",
-      "integrity": "sha512-BRRC8VRZY2R4Z4lFIL35MwNXmwVqBityvOIwETtsCSwvjl0IdgFsy9NhdaA6j74nUdtJJlIypeRhpDam19Wq3g==",
+    "node_modules/@valibot/to-json-schema": {
+      "version": "1.7.1",
+      "resolved": "https://registry.npmjs.org/@valibot/to-json-schema/-/to-json-schema-1.7.1.tgz",
+      "integrity": "sha512-3qkmU6KXWh8GIThEAW3kuRHPQBMjWkKy+Ppz3WkUucx53DTpOa6siMn4xDGSOhlVyMrDaJTCTMLYPZVAIk1P0A==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.31",
-        "estree-walker": "^3.0.3",
-        "js-tokens": "^10.0.0"
+      "peerDependencies": {
+        "valibot": "^1.4.0"
       }
     },
-    "node_modules/ast-v8-to-istanbul/node_modules/estree-walker": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+    "node_modules/@vinejs/compiler": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@vinejs/compiler/-/compiler-3.0.0.tgz",
+      "integrity": "sha512-v9Lsv59nR56+bmy2p0+czjZxsLHwaibJ+SV5iK9JJfehlJMa501jUJQqqz4X/OqKXrxtE3uTQmSqjUqzF3B2mw==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "@types/estree": "^1.0.0"
+      "optional": true,
+      "engines": {
+        "node": ">=18.0.0"
       }
     },
-    "node_modules/atomic-sleep": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
-      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
+    "node_modules/@vinejs/vine": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@vinejs/vine/-/vine-3.0.1.tgz",
+      "integrity": "sha512-ZtvYkYpZOYdvbws3uaOAvTFuvFXoQGAtmzeiXu+XSMGxi5GVsODpoI9Xu9TplEMuD/5fmAtBbKb9cQHkWkLXDQ==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@poppinss/macroable": "^1.0.4",
+        "@types/validator": "^13.12.2",
+        "@vinejs/compiler": "^3.0.0",
+        "camelcase": "^8.0.0",
+        "dayjs": "^1.11.13",
+        "dlv": "^1.1.3",
+        "normalize-url": "^8.0.1",
+        "validator": "^13.12.0"
+      },
       "engines": {
-        "node": ">=8.0.0"
+        "node": ">=18.16.0"
       }
     },
-    "node_modules/aws-ssl-profiles": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/aws-ssl-profiles/-/aws-ssl-profiles-1.1.2.tgz",
-      "integrity": "sha512-NZKeq9AfyQvEeNlN0zSYAaWrmBffJh3IELMZfRpJVWgrpEbtEpnjvzqBPf+mxoI287JohRDoa+/nsfqqiZmF6g==",
+    "node_modules/@vitest/browser": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.1.9.tgz",
+      "integrity": "sha512-j1BKtWmPcqpMhmx/L9EPLgAJpCb0zKfwoWLmqBbxaogCXHjOwHFSEoHCBfnGtx93xKQwilZ26m+UOsHqHMkRNg==",
+      "devOptional": true,
       "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 6.0.0"
+      "dependencies": {
+        "@blazediff/core": "1.9.1",
+        "@vitest/mocker": "4.1.9",
+        "@vitest/utils": "4.1.9",
+        "magic-string": "^0.30.21",
+        "pngjs": "^7.0.0",
+        "sirv": "^3.0.2",
+        "tinyrainbow": "^3.1.0",
+        "ws": "^8.19.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "vitest": "4.1.9"
       }
     },
-    "node_modules/axobject-query": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
-      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
+    "node_modules/@vitest/browser-playwright": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.1.9.tgz",
+      "integrity": "sha512-Bq1rOGf9waevzG3EOkO/dene6bvKTUsZMVg8S1i+WH3JcMjuXEjiahP9rAqZRELUqjBySOJsvvSWqK/B3wjKQw==",
       "devOptional": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">= 0.4"
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/browser": "4.1.9",
+        "@vitest/mocker": "4.1.9",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "playwright": "*",
+        "vitest": "4.1.9"
+      },
+      "peerDependenciesMeta": {
+        "playwright": {
+          "optional": false
+        }
       }
     },
-    "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/base64-js": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
+    "node_modules/@vitest/coverage-v8": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.9.tgz",
+      "integrity": "sha512-G9/lgqibheLVBDRuya45EbsEXTYcWoSG+TLg7i2axuzx0Eq62eXn+aWXyaVdV5vKvFSWd6ywcX8hA7la9Pvu8g==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@bcoe/v8-coverage": "^1.0.2",
+        "@vitest/utils": "4.1.9",
+        "ast-v8-to-istanbul": "^1.0.0",
+        "istanbul-lib-coverage": "^3.2.2",
+        "istanbul-lib-report": "^3.0.1",
+        "istanbul-reports": "^3.2.0",
+        "magicast": "^0.5.2",
+        "obug": "^2.1.1",
+        "std-env": "^4.0.0-rc.1",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@vitest/browser": "4.1.9",
+        "vitest": "4.1.9"
+      },
+      "peerDependenciesMeta": {
+        "@vitest/browser": {
+          "optional": true
         }
-      ],
-      "license": "MIT"
+      }
     },
-    "node_modules/basic-auth": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
-      "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==",
-      "dev": true,
+    "node_modules/@vitest/expect": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
+      "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "safe-buffer": "5.1.2"
+        "@standard-schema/spec": "^1.1.0",
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
+        "chai": "^6.2.2",
+        "tinyrainbow": "^3.1.0"
       },
-      "engines": {
-        "node": ">= 0.8"
+      "funding": {
+        "url": "https://opencollective.com/vitest"
       }
     },
-    "node_modules/better-auth": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.5.4.tgz",
-      "integrity": "sha512-ReykcEKx6Kp9560jG1wtlDBnftA7L7xb3ZZdDWm5yGXKKe2pUf+oBjH0fqekrkRII0m4XBVQbQ0mOrFv+3FdYg==",
-      "license": "MIT",
-      "dependencies": {
-        "@better-auth/core": "1.5.4",
-        "@better-auth/drizzle-adapter": "1.5.4",
-        "@better-auth/kysely-adapter": "1.5.4",
-        "@better-auth/memory-adapter": "1.5.4",
-        "@better-auth/mongo-adapter": "1.5.4",
-        "@better-auth/prisma-adapter": "1.5.4",
-        "@better-auth/telemetry": "1.5.4",
-        "@better-auth/utils": "0.3.1",
-        "@better-fetch/fetch": "1.1.21",
-        "@noble/ciphers": "^2.1.1",
-        "@noble/hashes": "^2.0.1",
-        "better-call": "1.3.2",
-        "defu": "^6.1.4",
-        "jose": "^6.1.3",
-        "kysely": "^0.28.11",
-        "nanostores": "^1.1.1",
-        "zod": "^4.3.6"
+    "node_modules/@vitest/mocker": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
+      "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
+      "devOptional": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "4.1.9",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.21"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@lynx-js/react": "*",
-        "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
-        "@sveltejs/kit": "^2.0.0",
-        "@tanstack/react-start": "^1.0.0",
-        "@tanstack/solid-start": "^1.0.0",
-        "better-sqlite3": "^12.0.0",
-        "drizzle-kit": ">=0.31.4",
-        "drizzle-orm": ">=0.41.0",
-        "mongodb": "^6.0.0 || ^7.0.0",
-        "mysql2": "^3.0.0",
-        "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
-        "pg": "^8.0.0",
-        "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0",
-        "react": "^18.0.0 || ^19.0.0",
-        "react-dom": "^18.0.0 || ^19.0.0",
-        "solid-js": "^1.0.0",
-        "svelte": "^4.0.0 || ^5.0.0",
-        "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0",
-        "vue": "^3.0.0"
+        "msw": "^2.4.9",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
-        "@lynx-js/react": {
-          "optional": true
-        },
-        "@prisma/client": {
-          "optional": true
-        },
-        "@sveltejs/kit": {
-          "optional": true
-        },
-        "@tanstack/react-start": {
-          "optional": true
-        },
-        "@tanstack/solid-start": {
-          "optional": true
-        },
-        "better-sqlite3": {
-          "optional": true
-        },
-        "drizzle-kit": {
-          "optional": true
-        },
-        "drizzle-orm": {
-          "optional": true
-        },
-        "mongodb": {
-          "optional": true
-        },
-        "mysql2": {
-          "optional": true
-        },
-        "next": {
-          "optional": true
-        },
-        "pg": {
-          "optional": true
-        },
-        "prisma": {
-          "optional": true
-        },
-        "react": {
-          "optional": true
-        },
-        "react-dom": {
-          "optional": true
-        },
-        "solid-js": {
-          "optional": true
-        },
-        "svelte": {
-          "optional": true
-        },
-        "vitest": {
+        "msw": {
           "optional": true
         },
-        "vue": {
+        "vite": {
           "optional": true
         }
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/core": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/core/-/core-1.5.4.tgz",
-      "integrity": "sha512-k5AdwPRQETZn0vdB60EB9CDxxfllpJXKqVxTjyXIUSRz7delNGlU0cR/iRP3VfVJwvYR1NbekphBDNo+KGoEzQ==",
+    "node_modules/@vitest/mocker/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@standard-schema/spec": "^1.1.0",
-        "zod": "^4.3.6"
-      },
-      "peerDependencies": {
-        "@better-auth/utils": "0.3.1",
-        "@better-fetch/fetch": "1.1.21",
-        "@cloudflare/workers-types": ">=4",
-        "better-call": "1.3.2",
-        "jose": "^6.1.0",
-        "kysely": "^0.28.5",
-        "nanostores": "^1.0.1"
-      },
-      "peerDependenciesMeta": {
-        "@cloudflare/workers-types": {
-          "optional": true
-        }
+        "@types/estree": "^1.0.0"
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/drizzle-adapter": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/drizzle-adapter/-/drizzle-adapter-1.5.4.tgz",
-      "integrity": "sha512-4M4nMAWrDd3TmpV6dONkJjybBVKRZghe5Oj0NNyDEoXubxastQdO7Sb5B54I1rTx5yoMgsqaB+kbJnu/9UgjQg==",
+    "node_modules/@vitest/pretty-format": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
+      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
+      "devOptional": true,
       "license": "MIT",
-      "peerDependencies": {
-        "@better-auth/core": "1.5.4",
-        "@better-auth/utils": "^0.3.0",
-        "drizzle-orm": ">=0.41.0"
+      "dependencies": {
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/kysely-adapter": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/kysely-adapter/-/kysely-adapter-1.5.4.tgz",
-      "integrity": "sha512-DPww7rIfz6Ed7dZlJSW9xMQ42VKaJLB5Cs+pPqd+UHKRyighKjf3VgvMIcAdFPc4olQ0qRHo3+ZJhFlBCxRhxA==",
+    "node_modules/@vitest/runner": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
+      "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
+      "devOptional": true,
       "license": "MIT",
-      "peerDependencies": {
-        "@better-auth/core": "1.5.4",
-        "@better-auth/utils": "^0.3.0",
-        "kysely": "^0.27.0 || ^0.28.0"
+      "dependencies": {
+        "@vitest/utils": "4.1.9",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/memory-adapter": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/memory-adapter/-/memory-adapter-1.5.4.tgz",
-      "integrity": "sha512-iiWYut9rbQqiAsgRBtj6+nxanwjapxRgpIJbiS2o81h7b9iclE0AiDA0Foes590gdFQvskNauZcCpuF8ytxthg==",
+    "node_modules/@vitest/snapshot": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
+      "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
+      "devOptional": true,
       "license": "MIT",
-      "peerDependencies": {
-        "@better-auth/core": "1.5.4",
-        "@better-auth/utils": "^0.3.0"
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/utils": "4.1.9",
+        "magic-string": "^0.30.21",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/mongo-adapter": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/mongo-adapter/-/mongo-adapter-1.5.4.tgz",
-      "integrity": "sha512-ArzJN5Obk6i6+vLK1HpPzLIcsjxZYXPPUvxVU8eyU5HyoUT2MlswWfPQ8UJAKPn0iq/T4PVp/wZcQMhWk1tuNA==",
+    "node_modules/@vitest/spy": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
+      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
+      "devOptional": true,
       "license": "MIT",
-      "peerDependencies": {
-        "@better-auth/core": "1.5.4",
-        "@better-auth/utils": "^0.3.0",
-        "mongodb": "^6.0.0 || ^7.0.0"
+      "funding": {
+        "url": "https://opencollective.com/vitest"
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/prisma-adapter": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/prisma-adapter/-/prisma-adapter-1.5.4.tgz",
-      "integrity": "sha512-ZQTbcBopw/ezjjbNFsfR3CRp0QciC4tJCarAnB5G9fZtUYbDjfY0vZOxIRmU4kI3x755CXQpGqTrkwmXaMRa3w==",
+    "node_modules/@vitest/utils": {
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
+      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
+      "devOptional": true,
       "license": "MIT",
-      "peerDependencies": {
-        "@better-auth/core": "1.5.4",
-        "@better-auth/utils": "^0.3.0",
-        "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
-        "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0"
+      "dependencies": {
+        "@vitest/pretty-format": "4.1.9",
+        "convert-source-map": "^2.0.0",
+        "tinyrainbow": "^3.1.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/abbrev": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
+      "integrity": "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true,
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/better-auth/node_modules/@better-auth/telemetry": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/@better-auth/telemetry/-/telemetry-1.5.4.tgz",
-      "integrity": "sha512-mGXTY7Ecxo7uvlMr6TFCBUvlH0NUMOeE9LKgPhG4HyhBN6VfCEg/DD9PG0Z2IatmMWQbckkt7ox5A0eBpG9m5w==",
+    "node_modules/accepts": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
+      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@better-auth/utils": "0.3.1",
-        "@better-fetch/fetch": "1.1.21"
+        "mime-types": "^3.0.0",
+        "negotiator": "^1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/acorn": {
+      "version": "8.17.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
+      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
+      "devOptional": true,
+      "license": "MIT",
+      "bin": {
+        "acorn": "bin/acorn"
       },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "license": "MIT",
       "peerDependencies": {
-        "@better-auth/core": "1.5.4"
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
       }
     },
-    "node_modules/better-auth/node_modules/kysely": {
-      "version": "0.28.17",
-      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz",
-      "integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==",
+    "node_modules/adm-zip": {
+      "version": "0.5.17",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.17.tgz",
+      "integrity": "sha512-+Ut8d9LLqwEvHHJl1+PIHqoyDxFgVN847JTVM3Izi3xHDWPE4UtzzXysMZQs64DMcrJfBeS/uoEP4AD3HQHnQQ==",
       "license": "MIT",
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=12.0"
       }
     },
-    "node_modules/better-call": {
-      "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.3.2.tgz",
-      "integrity": "sha512-4cZIfrerDsNTn3cm+MhLbUePN0gdwkhSXEuG7r/zuQ8c/H7iU0/jSK5TD3FW7U0MgKHce/8jGpPYNO4Ve+4NBw==",
+    "node_modules/agent-base": {
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "@better-auth/utils": "^0.3.1",
-        "@better-fetch/fetch": "^1.1.21",
-        "rou3": "^0.7.12",
-        "set-cookie-parser": "^3.0.1"
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "ajv": "^8.0.0"
       },
       "peerDependencies": {
-        "zod": "^4.0.0"
+        "ajv": "^8.0.0"
       },
       "peerDependenciesMeta": {
-        "zod": {
+        "ajv": {
           "optional": true
         }
       }
     },
-    "node_modules/bindings": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
-      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
+    "node_modules/ajv-formats-draft2019": {
+      "version": "1.6.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats-draft2019/-/ajv-formats-draft2019-1.6.1.tgz",
+      "integrity": "sha512-JQPvavpkWDvIsBp2Z33UkYCtXCSpW4HD3tAZ+oL4iEFOk9obQZffx0yANwECt6vzr6ET+7HN5czRyqXbnq/u0Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "file-uri-to-path": "1.0.0"
+        "punycode": "^2.1.1",
+        "schemes": "^1.4.0",
+        "smtp-address-parser": "^1.0.3",
+        "uri-js": "^4.4.1"
+      },
+      "peerDependencies": {
+        "ajv": "*"
       }
     },
-    "node_modules/bintrees": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/bintrees/-/bintrees-1.0.2.tgz",
-      "integrity": "sha512-VOMgTMwjAaUG580SXn3LacVgjurrbMme7ZZNYGSSV7mmtY6QQRh0Eg3pwIcntQ77DErK1L0NxkbetjcoXzVwKw==",
-      "license": "MIT"
-    },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
+    "node_modules/ansi-regex": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
       }
     },
-    "node_modules/body-parser": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.2.2.tgz",
-      "integrity": "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA==",
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "bytes": "^3.1.2",
-        "content-type": "^1.0.5",
-        "debug": "^4.4.3",
-        "http-errors": "^2.0.0",
-        "iconv-lite": "^0.7.0",
-        "on-finished": "^2.4.1",
-        "qs": "^6.14.1",
-        "raw-body": "^3.0.1",
-        "type-is": "^2.0.1"
+        "color-convert": "^2.0.1"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=8"
       },
       "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/bowser": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/bowser/-/bowser-2.14.1.tgz",
-      "integrity": "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==",
-      "license": "MIT"
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
-      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+    "node_modules/antlr-ng": {
+      "version": "1.0.10",
+      "resolved": "https://registry.npmjs.org/antlr-ng/-/antlr-ng-1.0.10.tgz",
+      "integrity": "sha512-fw3NdsQP3dabuZrDhKAMewrBsY5KSAcMrvhWBVDmHYegv5D51pypzCYK1PpjaRVKcVeP/5xKfqJY31TvXACOdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
+        "antlr4ng": "3.0.16",
+        "commander": "13.1.0",
+        "stringtemplate4ts": "1.0.9",
+        "unicode-properties": "1.4.1"
+      },
+      "bin": {
+        "antlr-ng": "dist/cli/runner.js",
+        "grun": "dist/cli/TestRig.js",
+        "interpreter": "dist/cli/Interpreter.js",
+        "testrig": "dist/cli/TestRig.js"
       }
     },
-    "node_modules/bson": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/bson/-/bson-7.2.0.tgz",
-      "integrity": "sha512-YCEo7KjMlbNlyHhz7zAZNDpIpQbd+wOEHJYezv0nMYTn4x31eIUM2yomNNubclAt63dObUzKHWsBLJ9QcZNSnQ==",
-      "license": "Apache-2.0",
-      "peer": true,
+    "node_modules/antlr-ng/node_modules/commander": {
+      "version": "13.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
+      "integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=20.19.0"
+        "node": ">=18"
       }
     },
-    "node_modules/buffer": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
-      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
+    "node_modules/antlr4-c3": {
+      "version": "3.4.4",
+      "resolved": "https://registry.npmjs.org/antlr4-c3/-/antlr4-c3-3.4.4.tgz",
+      "integrity": "sha512-ixp1i17ypbRzZnffdarIfCVEXJwPydtDt61SHMGkc+UCD7rrbfvHESTMTgx8jFhUgKAgcHyt9060kQ8nU3vlxA==",
       "license": "MIT",
       "dependencies": {
-        "base64-js": "^1.0.2",
-        "ieee754": "^1.1.4"
+        "antlr4ng": "3.0.16"
       }
     },
-    "node_modules/buffer-from": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-      "devOptional": true,
-      "license": "MIT"
+    "node_modules/antlr4ng": {
+      "version": "3.0.16",
+      "resolved": "https://registry.npmjs.org/antlr4ng/-/antlr4ng-3.0.16.tgz",
+      "integrity": "sha512-DQuJkC7kX3xunfF4K2KsWTSvoxxslv+FQp/WHQZTJSsH2Ec3QfFmrxC3Nky2ok9yglXn6nHM4zUaVDxcN5f6kA==",
+      "license": "BSD-3-Clause"
     },
-    "node_modules/bytes": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
       "dev": true,
-      "license": "MIT",
+      "license": "Python-2.0"
+    },
+    "node_modules/aria-query": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
+      "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==",
+      "devOptional": true,
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">= 0.8"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/cacache": {
-      "version": "19.0.1",
-      "resolved": "https://registry.npmjs.org/cacache/-/cacache-19.0.1.tgz",
-      "integrity": "sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==",
+    "node_modules/arkregex": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/arkregex/-/arkregex-0.0.6.tgz",
+      "integrity": "sha512-9mvuMKQuibfWhBrsNYhsKhNb6k9oEHoAJ/FvDiqe8h+E9Siwe0/cro1WVOGgpajXQ9ZHd24yCOf2k35Q/QqUQw==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@npmcli/fs": "^4.0.0",
-        "fs-minipass": "^3.0.0",
-        "glob": "^10.2.2",
-        "lru-cache": "^10.0.1",
-        "minipass": "^7.0.3",
-        "minipass-collect": "^2.0.1",
-        "minipass-flush": "^1.0.5",
-        "minipass-pipeline": "^1.2.4",
-        "p-map": "^7.0.2",
-        "ssri": "^12.0.0",
-        "tar": "^7.4.3",
-        "unique-filename": "^4.0.0"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "@ark/util": "0.56.0"
       }
     },
-    "node_modules/call-bind-apply-helpers": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+    "node_modules/arktype": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/arktype/-/arktype-2.2.1.tgz",
+      "integrity": "sha512-CWPJxNoSxrS+NYGB3ufwc/blFonESEW5vBQyYPVS0rf4STu8VWoAWfKJSl5vVVm56h4yxpwbODeYwy6XFKvojA==",
       "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "es-errors": "^1.3.0",
-        "function-bind": "^1.1.2"
-      },
+        "@ark/schema": "0.56.0",
+        "@ark/util": "0.56.0",
+        "arkregex": "0.0.6"
+      }
+    },
+    "node_modules/array-timsort": {
+      "version": "1.0.3",
+      "resolved": "https://registry.npmjs.org/array-timsort/-/array-timsort-1.0.3.tgz",
+      "integrity": "sha512-/+3GRL7dDAGEfM6TseQk/U+mi18TU2Ms9I3UlLdUMhz2hbvGNTKdj9xniwXfUqgYhHxRx0+8UnKkvlNwVU+cWQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "devOptional": true,
+      "license": "MIT",
       "engines": {
-        "node": ">= 0.4"
+        "node": ">=12"
       }
     },
-    "node_modules/call-bound": {
+    "node_modules/ast-v8-to-istanbul": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
-      "dev": true,
+      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.4.tgz",
+      "integrity": "sha512-0bC0/4bTSrnwdhU3IsZDwEdojvuPrSg59OYZfKsLRtJZ0u8VBx9DebfqqG8bRdCC0I7vjgxmPi41P0lpkhJHtA==",
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "call-bind-apply-helpers": "^1.0.2",
-        "get-intrinsic": "^1.3.0"
-      },
-      "engines": {
-        "node": ">= 0.4"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/ljharb"
+        "@jridgewell/trace-mapping": "^0.3.31",
+        "estree-walker": "^3.0.3",
+        "js-tokens": "^10.0.0"
       }
     },
-    "node_modules/callsites": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
-      "dev": true,
+    "node_modules/ast-v8-to-istanbul/node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "devOptional": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=6"
+      "dependencies": {
+        "@types/estree": "^1.0.0"
       }
     },
-    "node_modules/camelcase": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-8.0.0.tgz",
-      "integrity": "sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA==",
-      "dev": true,
+    "node_modules/atomic-sleep": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
+      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=16"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": ">=8.0.0"
       }
     },
-    "node_modules/chai": {
-      "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
+    "node_modules/axobject-query": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
+      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
       "devOptional": true,
-      "license": "MIT",
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/chalk": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
+    "node_modules/b4a": {
+      "version": "1.8.1",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.1.tgz",
+      "integrity": "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "react-native-b4a": "*"
       },
-      "funding": {
-        "url": "https://github.com/chalk/chalk?sponsor=1"
+      "peerDependenciesMeta": {
+        "react-native-b4a": {
+          "optional": true
+        }
       }
     },
-    "node_modules/chevrotain": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/chevrotain/-/chevrotain-10.5.0.tgz",
-      "integrity": "sha512-Pkv5rBY3+CsHOYfV5g/Vs5JY9WTHHDEKOlohI2XeygaZhUeqhAlldZ8Hz9cRmxu709bvS08YzxHdTPHhffc13A==",
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/bare-events": {
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.9.1.tgz",
+      "integrity": "sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg==",
       "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@chevrotain/cst-dts-gen": "10.5.0",
-        "@chevrotain/gast": "10.5.0",
-        "@chevrotain/types": "10.5.0",
-        "@chevrotain/utils": "10.5.0",
-        "lodash": "4.17.21",
-        "regexp-to-ast": "0.5.0"
+      "peerDependencies": {
+        "bare-abort-controller": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        }
       }
     },
-    "node_modules/chokidar": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
-      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
-      "license": "MIT",
+    "node_modules/bare-fs": {
+      "version": "4.7.2",
+      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.2.tgz",
+      "integrity": "sha512-aTvMFUWkBmjzKtEQMDGGDNF8bkfpD5N1b/FCwt7A3wrU4t1o/e/85Wzkluh6JlODCjqVESYCkQCdTXqZ9G7VFg==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "readdirp": "^4.0.1"
+        "bare-events": "^2.5.4",
+        "bare-path": "^3.0.0",
+        "bare-stream": "^2.6.4",
+        "bare-url": "^2.2.2",
+        "fast-fifo": "^1.3.2"
       },
       "engines": {
-        "node": ">= 14.16.0"
+        "bare": ">=1.16.0"
       },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
+      "peerDependencies": {
+        "bare-buffer": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-buffer": {
+          "optional": true
+        }
       }
     },
-    "node_modules/chownr": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
-    "node_modules/citty": {
-      "version": "0.1.6",
-      "resolved": "https://registry.npmjs.org/citty/-/citty-0.1.6.tgz",
-      "integrity": "sha512-tskPPKEs8D2KPafUypv2gxwJP8h/OaJmC82QQGGDQcHvXX43xF2VDACcJVmZ0EuSxkpO9Kc4MlrA3q0+FG58AQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "consola": "^3.2.3"
+    "node_modules/bare-os": {
+      "version": "3.9.1",
+      "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.9.1.tgz",
+      "integrity": "sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ==",
+      "license": "Apache-2.0",
+      "engines": {
+        "bare": ">=1.14.0"
       }
     },
-    "node_modules/class-validator": {
-      "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/class-validator/-/class-validator-0.14.4.tgz",
-      "integrity": "sha512-AwNusCCam51q703dW82x95tOqQp6oC9HNUl724KxJJOfnKscI8dOloXFgyez7LbTTKWuRBA37FScqVbJEoq8Yw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
+    "node_modules/bare-path": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.1.tgz",
+      "integrity": "sha512-ghj2DSK/2e99a1anTVPCV4m4YIYtrbXhfM7V3D7XZLOTsybnYyaJloymGqssQc8l/or0UoDyRtNQkmkEF/ysgQ==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "@types/validator": "^13.15.3",
-        "libphonenumber-js": "^1.11.1",
-        "validator": "^13.15.22"
-      }
-    },
-    "node_modules/clsx": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
-      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
+        "bare-os": "^3.0.1"
       }
     },
-    "node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "dev": true,
-      "license": "MIT",
+    "node_modules/bare-stream": {
+      "version": "2.13.3",
+      "resolved": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.13.3.tgz",
+      "integrity": "sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ==",
+      "license": "Apache-2.0",
       "dependencies": {
-        "color-name": "~1.1.4"
+        "b4a": "^1.8.1",
+        "streamx": "^2.25.0",
+        "teex": "^1.0.1"
       },
-      "engines": {
-        "node": ">=7.0.0"
+      "peerDependencies": {
+        "bare-abort-controller": "*",
+        "bare-buffer": "*",
+        "bare-events": "*"
+      },
+      "peerDependenciesMeta": {
+        "bare-abort-controller": {
+          "optional": true
+        },
+        "bare-buffer": {
+          "optional": true
+        },
+        "bare-events": {
+          "optional": true
+        }
       }
     },
-    "node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
-      "dev": true,
-      "license": "MIT"
+    "node_modules/bare-url": {
+      "version": "2.4.5",
+      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.4.5.tgz",
+      "integrity": "sha512-K+y9xF1tN+CdPu4qWwr0QiK1Al07eFPGYK5M2pDXcmHdMdgC/tT/bpmMe1hrmRHaidKLkXrC+cRNYf3XVDUhSQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-path": "^3.0.0"
+      }
     },
-    "node_modules/colorette": {
-      "version": "2.0.20",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
-      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
-      "dev": true,
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
       "license": "MIT"
     },
-    "node_modules/commander": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
-      "integrity": "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=16"
-      }
-    },
-    "node_modules/comment-json": {
-      "version": "4.5.1",
-      "resolved": "https://registry.npmjs.org/comment-json/-/comment-json-4.5.1.tgz",
-      "integrity": "sha512-taEtr3ozUmOB7it68Jll7s0Pwm+aoiHyXKrEC8SEodL4rNpdfDLqa7PfBlrgFoCNNdR8ImL+muti5IGvktJAAg==",
+    "node_modules/basic-auth": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
+      "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "array-timsort": "^1.0.3",
-        "core-util-is": "^1.0.3",
-        "esprima": "^4.0.1"
+        "safe-buffer": "5.1.2"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 0.8"
       }
     },
-    "node_modules/commondir": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
-      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/confbox": {
-      "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
-      "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
-      "license": "MIT"
-    },
-    "node_modules/consola": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/consola/-/consola-3.4.0.tgz",
-      "integrity": "sha512-EiPU8G6dQG0GFHNR8ljnZFki/8a+cQwEQ+7wpxdChl02Q8HXlwEZWD5lqAF8vC2sEC3Tehr8hy7vErz88LHyUA==",
-      "license": "MIT",
-      "engines": {
-        "node": "^14.18.0 || >=16.10.0"
+    "node_modules/better-auth": {
+      "version": "1.6.20",
+      "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.6.20.tgz",
+      "integrity": "sha512-fSpGHGRKiGRiYVd3QTQtuVZ8oxpiSe/7ip0Rpvt/Sy8zQbEbVKUPMOhE0gLXg+FjqTUsIo7582hxUYxtEcqUpA==",
+      "license": "MIT",
+      "dependencies": {
+        "@better-auth/core": "1.6.20",
+        "@better-auth/drizzle-adapter": "1.6.20",
+        "@better-auth/kysely-adapter": "1.6.20",
+        "@better-auth/memory-adapter": "1.6.20",
+        "@better-auth/mongo-adapter": "1.6.20",
+        "@better-auth/prisma-adapter": "1.6.20",
+        "@better-auth/telemetry": "1.6.20",
+        "@better-auth/utils": "0.4.2",
+        "@better-fetch/fetch": "1.3.1",
+        "@noble/ciphers": "^2.1.1",
+        "@noble/hashes": "^2.0.1",
+        "better-call": "1.3.6",
+        "defu": "^6.1.4",
+        "jose": "^6.1.3",
+        "kysely": "^0.28.17 || ^0.29.0",
+        "nanostores": "^1.1.1",
+        "zod": "^4.3.6"
+      },
+      "peerDependencies": {
+        "@lynx-js/react": "*",
+        "@prisma/client": "^5.0.0 || ^6.0.0 || ^7.0.0",
+        "@sveltejs/kit": "^2.0.0",
+        "@tanstack/react-start": "^1.0.0",
+        "@tanstack/solid-start": "^1.0.0",
+        "better-sqlite3": "^12.0.0",
+        "drizzle-kit": ">=0.31.4",
+        "drizzle-orm": "^0.45.2",
+        "mongodb": "^6.0.0 || ^7.0.0",
+        "mysql2": "^3.0.0",
+        "next": "^14.0.0 || ^15.0.0 || ^16.0.0",
+        "pg": "^8.0.0",
+        "prisma": "^5.0.0 || ^6.0.0 || ^7.0.0",
+        "react": "^18.0.0 || ^19.0.0",
+        "react-dom": "^18.0.0 || ^19.0.0",
+        "solid-js": "^1.0.0",
+        "svelte": "^4.0.0 || ^5.0.0",
+        "vitest": "^2.0.0 || ^3.0.0 || ^4.0.0",
+        "vue": "^3.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@lynx-js/react": {
+          "optional": true
+        },
+        "@prisma/client": {
+          "optional": true
+        },
+        "@sveltejs/kit": {
+          "optional": true
+        },
+        "@tanstack/react-start": {
+          "optional": true
+        },
+        "@tanstack/solid-start": {
+          "optional": true
+        },
+        "better-sqlite3": {
+          "optional": true
+        },
+        "drizzle-kit": {
+          "optional": true
+        },
+        "drizzle-orm": {
+          "optional": true
+        },
+        "mongodb": {
+          "optional": true
+        },
+        "mysql2": {
+          "optional": true
+        },
+        "next": {
+          "optional": true
+        },
+        "pg": {
+          "optional": true
+        },
+        "prisma": {
+          "optional": true
+        },
+        "react": {
+          "optional": true
+        },
+        "react-dom": {
+          "optional": true
+        },
+        "solid-js": {
+          "optional": true
+        },
+        "svelte": {
+          "optional": true
+        },
+        "vitest": {
+          "optional": true
+        },
+        "vue": {
+          "optional": true
+        }
       }
     },
-    "node_modules/content-disposition": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.0.1.tgz",
-      "integrity": "sha512-oIXISMynqSqm241k6kcQ5UwttDILMK4BiurCfGEREw6+X9jkkpEe5T9FZaApyLGGOnFuyMWZpdolTXMtvEJ08Q==",
-      "dev": true,
+    "node_modules/better-call": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/better-call/-/better-call-1.3.6.tgz",
+      "integrity": "sha512-no1jI+h6Bkxs1NVBo4rONbVIzsPjZ8IUu7IHaJBiFwVX1XEQGN8KpHots5fSWmXe9nNyLuLIcgx6WEUcE6EDaA==",
       "license": "MIT",
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@better-auth/utils": "^0.4.0",
+        "@better-fetch/fetch": "^1.1.21",
+        "rou3": "^0.7.12",
+        "set-cookie-parser": "^3.0.1"
       },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+      "peerDependencies": {
+        "zod": "^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "zod": {
+          "optional": true
+        }
       }
     },
-    "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+    "node_modules/bindings": {
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
+      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
+      "optional": true,
+      "dependencies": {
+        "file-uri-to-path": "1.0.0"
       }
     },
-    "node_modules/cookie": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
-      "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
-      "devOptional": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.6"
-      }
+    "node_modules/bintrees": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/bintrees/-/bintrees-1.0.2.tgz",
+      "integrity": "sha512-VOMgTMwjAaUG580SXn3LacVgjurrbMme7ZZNYGSSV7mmtY6QQRh0Eg3pwIcntQ77DErK1L0NxkbetjcoXzVwKw==",
+      "license": "MIT"
     },
-    "node_modules/cookie-signature": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
-      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
+    "node_modules/bl": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
+      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=6.6.0"
+      "optional": true,
+      "dependencies": {
+        "buffer": "^5.5.0",
+        "inherits": "^2.0.4",
+        "readable-stream": "^3.4.0"
       }
     },
-    "node_modules/core-util-is": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/cors": {
-      "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
-      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
+    "node_modules/body-parser": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "object-assign": "^4",
-        "vary": "^1"
+        "bytes": "^3.1.2",
+        "content-type": "^2.0.0",
+        "debug": "^4.4.3",
+        "http-errors": "^2.0.1",
+        "iconv-lite": "^0.7.2",
+        "on-finished": "^2.4.1",
+        "qs": "^6.15.2",
+        "raw-body": "^3.0.2",
+        "type-is": "^2.1.0"
       },
       "engines": {
-        "node": ">= 0.10"
+        "node": ">=18"
       },
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+    "node_modules/body-parser/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
       "engines": {
-        "node": ">= 8"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/cssesc": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+    "node_modules/body-parser/node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
       "dev": true,
       "license": "MIT",
-      "bin": {
-        "cssesc": "bin/cssesc"
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
       "engines": {
-        "node": ">=4"
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/csstype": {
-      "version": "3.2.3",
-      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
-      "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==",
-      "license": "MIT",
-      "peer": true
+    "node_modules/bowser": {
+      "version": "2.14.1",
+      "resolved": "https://registry.npmjs.org/bowser/-/bowser-2.14.1.tgz",
+      "integrity": "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==",
+      "license": "MIT"
     },
-    "node_modules/daisyui": {
-      "version": "5.5.19",
-      "resolved": "https://registry.npmjs.org/daisyui/-/daisyui-5.5.19.tgz",
-      "integrity": "sha512-pbFAkl1VCEh/MPCeclKL61I/MqRIFFhNU7yiXoDDRapXN4/qNCoMxeCCswyxEEhqL5eiTTfwHvucFtOE71C9sA==",
+    "node_modules/brace-expansion": {
+      "version": "1.1.15",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
+      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
       "dev": true,
       "license": "MIT",
-      "funding": {
-        "url": "https://github.com/saadeghi/daisyui?sponsor=1"
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
       }
     },
-    "node_modules/dateformat": {
-      "version": "4.6.3",
-      "resolved": "https://registry.npmjs.org/dateformat/-/dateformat-4.6.3.tgz",
-      "integrity": "sha512-2P0p0pFGzHS5EMnhdxQi7aJN+iMheud0UhG4dlE1DLAlvL8JHjJJTX/CSm4JXwV0Ka5nGk3zC5mcb5bUQUxxMA==",
-      "dev": true,
+    "node_modules/buffer": {
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
+      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
       "license": "MIT",
-      "engines": {
-        "node": "*"
+      "dependencies": {
+        "base64-js": "^1.0.2",
+        "ieee754": "^1.1.4"
       }
     },
-    "node_modules/dayjs": {
-      "version": "1.11.19",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.19.tgz",
-      "integrity": "sha512-t5EcLVS6QPBNqM2z8fakk/NKel+Xzshgt8FFKAn+qwlD1pzZWxh0nVCrvFK7ZDb6XucZeF9z8C7CBWTRIVApAw==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "devOptional": true,
+      "license": "MIT"
     },
-    "node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+    "node_modules/bytes": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "ms": "^2.1.3"
-      },
       "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
+        "node": ">= 0.8"
       }
     },
-    "node_modules/decompress-response": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
-      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+    "node_modules/cacache": {
+      "version": "19.0.1",
+      "resolved": "https://registry.npmjs.org/cacache/-/cacache-19.0.1.tgz",
+      "integrity": "sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==",
       "dev": true,
-      "license": "MIT",
+      "license": "ISC",
       "optional": true,
       "dependencies": {
-        "mimic-response": "^3.1.0"
+        "@npmcli/fs": "^4.0.0",
+        "fs-minipass": "^3.0.0",
+        "glob": "^10.2.2",
+        "lru-cache": "^10.0.1",
+        "minipass": "^7.0.3",
+        "minipass-collect": "^2.0.1",
+        "minipass-flush": "^1.0.5",
+        "minipass-pipeline": "^1.2.4",
+        "p-map": "^7.0.2",
+        "ssri": "^12.0.0",
+        "tar": "^7.4.3",
+        "unique-filename": "^4.0.0"
       },
       "engines": {
-        "node": ">=10"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
-    "node_modules/dedent": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.5.1.tgz",
-      "integrity": "sha512-+LxW+KLWxu3HW3M2w2ympwtqPrqYRzU8fqi6Fhd18fBALe15blJPI/I4+UHveMVG6lJqB4JNd4UG0S5cnVHwIg==",
+    "node_modules/call-bind-apply-helpers": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
       "dev": true,
       "license": "MIT",
-      "peerDependencies": {
-        "babel-plugin-macros": "^3.1.0"
+      "dependencies": {
+        "es-errors": "^1.3.0",
+        "function-bind": "^1.1.2"
       },
-      "peerDependenciesMeta": {
-        "babel-plugin-macros": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/deep-extend": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
-      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=4.0.0"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/deep-is": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+    "node_modules/call-bound": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
       "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/deepmerge": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
-      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
-      "devOptional": true,
       "license": "MIT",
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.2",
+        "get-intrinsic": "^1.3.0"
+      },
       "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/deepmerge-ts": {
-      "version": "7.1.5",
-      "resolved": "https://registry.npmjs.org/deepmerge-ts/-/deepmerge-ts-7.1.5.tgz",
-      "integrity": "sha512-HOJkrhaYsweh+W+e74Yn7YStZOilkoPb6fycpwNLKzSPtruFs48nYis0zy5yJz1+ktUhHxoRDJ27RQAWLIJVJw==",
-      "license": "BSD-3-Clause",
-      "peer": true,
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
-    "node_modules/defu": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.4.tgz",
-      "integrity": "sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==",
-      "license": "MIT"
-    },
-    "node_modules/denque": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
-      "integrity": "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10"
+        "node": ">= 0.4"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/depd": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+    "node_modules/callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=6"
       }
     },
-    "node_modules/destr": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/destr/-/destr-2.0.5.tgz",
-      "integrity": "sha512-ugFTXCtDZunbzasqBxrK93Ik/DRYsO6S/fedkWEMKqt04xZ4csmnmwGDBAb07QWNaGMAmnTIemsYZCksjATwsA==",
+    "node_modules/camelcase": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-8.0.0.tgz",
+      "integrity": "sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA==",
+      "dev": true,
       "license": "MIT",
-      "peer": true
-    },
-    "node_modules/detect-libc": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
-      "devOptional": true,
-      "license": "Apache-2.0",
+      "optional": true,
       "engines": {
-        "node": ">=8"
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/devalue": {
-      "version": "5.6.3",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.3.tgz",
-      "integrity": "sha512-nc7XjUU/2Lb+SvEFVGcWLiKkzfw8+qHI7zn8WYXKkLMgfGSHbgCEaR6bJpev8Cm6Rmrb19Gfd/tZvGqx9is3wg==",
+    "node_modules/chai": {
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
       "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/discontinuous-range": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/discontinuous-range/-/discontinuous-range-1.0.0.tgz",
-      "integrity": "sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/dlv": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
-      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
-      "dev": true,
       "license": "MIT",
-      "optional": true
-    },
-    "node_modules/dompurify": {
-      "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.7.tgz",
-      "integrity": "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==",
-      "license": "(MPL-2.0 OR Apache-2.0)",
-      "optionalDependencies": {
-        "@types/trusted-types": "^2.0.7"
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/drizzle-kit": {
-      "version": "0.31.10",
-      "resolved": "https://registry.npmjs.org/drizzle-kit/-/drizzle-kit-0.31.10.tgz",
-      "integrity": "sha512-7OZcmQUrdGI+DUNNsKBn1aW8qSoKuTH7d0mYgSP8bAzdFzKoovxEFnoGQp2dVs82EOJeYycqRtciopszwUf8bw==",
-      "devOptional": true,
+    "node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@drizzle-team/brocli": "^0.10.2",
-        "@esbuild-kit/esm-loader": "^2.5.5",
-        "esbuild": "^0.25.4",
-        "tsx": "^4.21.0"
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
       },
-      "bin": {
-        "drizzle-kit": "bin.cjs"
-      }
-    },
-    "node_modules/drizzle-orm": {
-      "version": "0.45.2",
-      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.2.tgz",
-      "integrity": "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==",
-      "license": "Apache-2.0",
-      "peerDependencies": {
-        "@aws-sdk/client-rds-data": ">=3",
-        "@cloudflare/workers-types": ">=4",
-        "@electric-sql/pglite": ">=0.2.0",
-        "@libsql/client": ">=0.10.0",
-        "@libsql/client-wasm": ">=0.10.0",
-        "@neondatabase/serverless": ">=0.10.0",
-        "@op-engineering/op-sqlite": ">=2",
-        "@opentelemetry/api": "^1.4.1",
-        "@planetscale/database": ">=1.13",
-        "@prisma/client": "*",
-        "@tidbcloud/serverless": "*",
-        "@types/better-sqlite3": "*",
-        "@types/pg": "*",
-        "@types/sql.js": "*",
-        "@upstash/redis": ">=1.34.7",
-        "@vercel/postgres": ">=0.8.0",
-        "@xata.io/client": "*",
-        "better-sqlite3": ">=7",
-        "bun-types": "*",
-        "expo-sqlite": ">=14.0.0",
-        "gel": ">=2",
-        "knex": "*",
-        "kysely": "*",
-        "mysql2": ">=2",
-        "pg": ">=8",
-        "postgres": ">=3",
-        "sql.js": ">=1",
-        "sqlite3": ">=5"
+      "engines": {
+        "node": ">=10"
       },
-      "peerDependenciesMeta": {
-        "@aws-sdk/client-rds-data": {
-          "optional": true
-        },
-        "@cloudflare/workers-types": {
-          "optional": true
-        },
-        "@electric-sql/pglite": {
-          "optional": true
-        },
-        "@libsql/client": {
-          "optional": true
-        },
-        "@libsql/client-wasm": {
-          "optional": true
-        },
-        "@neondatabase/serverless": {
-          "optional": true
-        },
-        "@op-engineering/op-sqlite": {
-          "optional": true
-        },
-        "@opentelemetry/api": {
-          "optional": true
-        },
-        "@planetscale/database": {
-          "optional": true
-        },
-        "@prisma/client": {
-          "optional": true
-        },
-        "@tidbcloud/serverless": {
-          "optional": true
-        },
-        "@types/better-sqlite3": {
-          "optional": true
-        },
-        "@types/pg": {
-          "optional": true
-        },
-        "@types/sql.js": {
-          "optional": true
-        },
-        "@upstash/redis": {
-          "optional": true
-        },
-        "@vercel/postgres": {
-          "optional": true
-        },
-        "@xata.io/client": {
-          "optional": true
-        },
-        "better-sqlite3": {
-          "optional": true
-        },
-        "bun-types": {
-          "optional": true
-        },
-        "expo-sqlite": {
-          "optional": true
-        },
-        "gel": {
-          "optional": true
-        },
-        "knex": {
-          "optional": true
-        },
-        "kysely": {
-          "optional": true
-        },
-        "mysql2": {
-          "optional": true
-        },
-        "pg": {
-          "optional": true
-        },
-        "postgres": {
-          "optional": true
-        },
-        "prisma": {
-          "optional": true
-        },
-        "sql.js": {
-          "optional": true
-        },
-        "sqlite3": {
-          "optional": true
-        }
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
       }
     },
-    "node_modules/dunder-proto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+    "node_modules/chokidar": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
+      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "call-bind-apply-helpers": "^1.0.1",
-        "es-errors": "^1.3.0",
-        "gopd": "^1.2.0"
+        "readdirp": "^4.0.1"
       },
       "engines": {
-        "node": ">= 0.4"
+        "node": ">= 14.16.0"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
       }
     },
-    "node_modules/eastasianwidth": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
-    "node_modules/ee-first": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/effect": {
-      "version": "3.21.3",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.3.tgz",
-      "integrity": "sha512-RqwU7WnJ6CqYhyjpOVJA5vh1Sgkn6eVECO6mnD0EjlbWcC2M3LJaPglXXr13Rdo/Y+B+wTEPzGRYFNL2xKxNeQ==",
+    "node_modules/chownr": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
+      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
       "dev": true,
-      "license": "MIT",
+      "license": "BlueOak-1.0.0",
       "optional": true,
-      "dependencies": {
-        "@standard-schema/spec": "^1.0.0",
-        "fast-check": "^3.23.1"
+      "engines": {
+        "node": ">=18"
       }
     },
-    "node_modules/emoji-regex": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+    "node_modules/class-validator": {
+      "version": "0.14.4",
+      "resolved": "https://registry.npmjs.org/class-validator/-/class-validator-0.14.4.tgz",
+      "integrity": "sha512-AwNusCCam51q703dW82x95tOqQp6oC9HNUl724KxJJOfnKscI8dOloXFgyez7LbTTKWuRBA37FScqVbJEoq8Yw==",
       "dev": true,
       "license": "MIT",
-      "optional": true
+      "optional": true,
+      "dependencies": {
+        "@types/validator": "^13.15.3",
+        "libphonenumber-js": "^1.11.1",
+        "validator": "^13.15.22"
+      }
     },
-    "node_modules/empathic": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/empathic/-/empathic-2.0.0.tgz",
-      "integrity": "sha512-i6UzDscO/XfAcNYD75CfICkmfLedpyPDdozrLMmQc5ORaQcdMoc21OnlEylMIqI7U8eniKrPMxxtj8k0vhmJhA==",
+    "node_modules/clsx": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
+      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
+      "devOptional": true,
       "license": "MIT",
-      "peer": true,
       "engines": {
-        "node": ">=14"
+        "node": ">=6"
       }
     },
-    "node_modules/encodeurl": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
       "engines": {
-        "node": ">= 0.8"
+        "node": ">=7.0.0"
       }
     },
-    "node_modules/encoding": {
-      "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
-      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/colorette": {
+      "version": "2.0.20",
+      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
+      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/commander": {
+      "version": "14.0.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
+      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "iconv-lite": "^0.6.2"
+      "engines": {
+        "node": ">=20"
       }
     },
-    "node_modules/encoding/node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+    "node_modules/comment-json": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/comment-json/-/comment-json-4.6.2.tgz",
+      "integrity": "sha512-R2rze/hDX30uul4NZoIZ76ImSJLFxn/1/ZxtKC1L77y2X1k+yYu1joKbAtMA2Fg3hZrTOiw0I5mwVMo0cf250w==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
+        "array-timsort": "^1.0.3",
+        "esprima": "^4.0.1"
       },
       "engines": {
-        "node": ">=0.10.0"
+        "node": ">= 6"
       }
     },
-    "node_modules/end-of-stream": {
-      "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
-      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+    "node_modules/commondir": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
+      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/confbox": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
+      "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/consola": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/consola/-/consola-3.4.0.tgz",
+      "integrity": "sha512-EiPU8G6dQG0GFHNR8ljnZFki/8a+cQwEQ+7wpxdChl02Q8HXlwEZWD5lqAF8vC2sEC3Tehr8hy7vErz88LHyUA==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "once": "^1.4.0"
+      "engines": {
+        "node": "^14.18.0 || >=16.10.0"
       }
     },
-    "node_modules/enhanced-resolve": {
-      "version": "5.19.0",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.19.0.tgz",
-      "integrity": "sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==",
+    "node_modules/content-disposition": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
+      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
       "dev": true,
       "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.4",
-        "tapable": "^2.3.0"
-      },
       "engines": {
-        "node": ">=10.13.0"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/env-paths": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
-      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
+    "node_modules/content-type": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
-        "node": ">=6"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/err-code": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
-      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
-      "dev": true,
+    "node_modules/convert-source-map": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
+      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/cookie": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
+      "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true
+      "engines": {
+        "node": ">= 0.6"
+      }
     },
-    "node_modules/es-define-property": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+    "node_modules/cookie-signature": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 0.4"
+        "node": ">=6.6.0"
       }
     },
-    "node_modules/es-errors": {
-      "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+    "node_modules/cors": {
+      "version": "2.8.6",
+      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
+      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
       "dev": true,
       "license": "MIT",
+      "dependencies": {
+        "object-assign": "^4",
+        "vary": "^1"
+      },
       "engines": {
-        "node": ">= 0.4"
+        "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/es-module-lexer": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
-      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
-      "devOptional": true,
-      "license": "MIT"
-    },
-    "node_modules/es-object-atoms": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
-      "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "es-errors": "^1.3.0"
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
       },
       "engines": {
-        "node": ">= 0.4"
+        "node": ">= 8"
       }
     },
-    "node_modules/esbuild": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
-      "devOptional": true,
-      "hasInstallScript": true,
+    "node_modules/cssesc": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
+      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
+      "dev": true,
       "license": "MIT",
       "bin": {
-        "esbuild": "bin/esbuild"
+        "cssesc": "bin/cssesc"
       },
       "engines": {
-        "node": ">=18"
-      },
-      "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.25.12",
-        "@esbuild/android-arm": "0.25.12",
-        "@esbuild/android-arm64": "0.25.12",
-        "@esbuild/android-x64": "0.25.12",
-        "@esbuild/darwin-arm64": "0.25.12",
-        "@esbuild/darwin-x64": "0.25.12",
-        "@esbuild/freebsd-arm64": "0.25.12",
-        "@esbuild/freebsd-x64": "0.25.12",
-        "@esbuild/linux-arm": "0.25.12",
-        "@esbuild/linux-arm64": "0.25.12",
-        "@esbuild/linux-ia32": "0.25.12",
-        "@esbuild/linux-loong64": "0.25.12",
-        "@esbuild/linux-mips64el": "0.25.12",
-        "@esbuild/linux-ppc64": "0.25.12",
-        "@esbuild/linux-riscv64": "0.25.12",
-        "@esbuild/linux-s390x": "0.25.12",
-        "@esbuild/linux-x64": "0.25.12",
-        "@esbuild/netbsd-arm64": "0.25.12",
-        "@esbuild/netbsd-x64": "0.25.12",
-        "@esbuild/openbsd-arm64": "0.25.12",
-        "@esbuild/openbsd-x64": "0.25.12",
-        "@esbuild/openharmony-arm64": "0.25.12",
-        "@esbuild/sunos-x64": "0.25.12",
-        "@esbuild/win32-arm64": "0.25.12",
-        "@esbuild/win32-ia32": "0.25.12",
-        "@esbuild/win32-x64": "0.25.12"
+        "node": ">=4"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/aix-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.12.tgz",
-      "integrity": "sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==",
-      "cpu": [
-        "ppc64"
-      ],
+    "node_modules/daisyui": {
+      "version": "5.5.23",
+      "resolved": "https://registry.npmjs.org/daisyui/-/daisyui-5.5.23.tgz",
+      "integrity": "sha512-xuheNUSL4T6ZVtWXoioqcNkjoyGX85QTDz4HTw2aBPfqk4fuMjax5HDo8qCmpV6M1YN8bGvfx5BpYCoDeRlt+A==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "aix"
-      ],
-      "engines": {
-        "node": ">=18"
+      "funding": {
+        "url": "https://github.com/saadeghi/daisyui?sponsor=1"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/android-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.12.tgz",
-      "integrity": "sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==",
-      "cpu": [
-        "arm"
-      ],
+    "node_modules/dateformat": {
+      "version": "4.6.3",
+      "resolved": "https://registry.npmjs.org/dateformat/-/dateformat-4.6.3.tgz",
+      "integrity": "sha512-2P0p0pFGzHS5EMnhdxQi7aJN+iMheud0UhG4dlE1DLAlvL8JHjJJTX/CSm4JXwV0Ka5nGk3zC5mcb5bUQUxxMA==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": "*"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/android-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.12.tgz",
-      "integrity": "sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/dayjs": {
+      "version": "1.11.21",
+      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz",
+      "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "android"
-      ],
+      "optional": true
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/android-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.12.tgz",
-      "integrity": "sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/decompress-response": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
-      "os": [
-        "android"
-      ],
+      "dependencies": {
+        "mimic-response": "^3.1.0"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/darwin-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.12.tgz",
-      "integrity": "sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/dedent": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.5.1.tgz",
+      "integrity": "sha512-+LxW+KLWxu3HW3M2w2ympwtqPrqYRzU8fqi6Fhd18fBALe15blJPI/I4+UHveMVG6lJqB4JNd4UG0S5cnVHwIg==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": ">=18"
+      "peerDependencies": {
+        "babel-plugin-macros": "^3.1.0"
+      },
+      "peerDependenciesMeta": {
+        "babel-plugin-macros": {
+          "optional": true
+        }
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/darwin-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.12.tgz",
-      "integrity": "sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/deep-extend": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
-      "os": [
-        "darwin"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">=4.0.0"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/deepmerge": {
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
+      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">=0.10.0"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/freebsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.12.tgz",
-      "integrity": "sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/defu": {
+      "version": "6.1.7",
+      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
+      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
+      "license": "MIT"
+    },
+    "node_modules/depd": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "freebsd"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.8"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-arm": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.12.tgz",
-      "integrity": "sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==",
-      "cpu": [
-        "arm"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "devOptional": true,
+      "license": "Apache-2.0",
       "engines": {
-        "node": ">=18"
+        "node": ">=8"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.12.tgz",
-      "integrity": "sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/devalue": {
+      "version": "5.8.1",
+      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.1.tgz",
+      "integrity": "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/discontinuous-range": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/discontinuous-range/-/discontinuous-range-1.0.0.tgz",
+      "integrity": "sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
+      "optional": true
+    },
+    "node_modules/dlv": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
+      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/dompurify": {
+      "version": "3.2.7",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.7.tgz",
+      "integrity": "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==",
+      "license": "(MPL-2.0 OR Apache-2.0)",
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.12.tgz",
-      "integrity": "sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==",
-      "cpu": [
-        "ia32"
-      ],
+    "node_modules/drizzle-kit": {
+      "version": "0.31.10",
+      "resolved": "https://registry.npmjs.org/drizzle-kit/-/drizzle-kit-0.31.10.tgz",
+      "integrity": "sha512-7OZcmQUrdGI+DUNNsKBn1aW8qSoKuTH7d0mYgSP8bAzdFzKoovxEFnoGQp2dVs82EOJeYycqRtciopszwUf8bw==",
+      "devOptional": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@drizzle-team/brocli": "^0.10.2",
+        "@esbuild-kit/esm-loader": "^2.5.5",
+        "esbuild": "^0.25.4",
+        "tsx": "^4.21.0"
+      },
+      "bin": {
+        "drizzle-kit": "bin.cjs"
+      }
+    },
+    "node_modules/drizzle-orm": {
+      "version": "0.45.2",
+      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.2.tgz",
+      "integrity": "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==",
+      "license": "Apache-2.0",
+      "peerDependencies": {
+        "@aws-sdk/client-rds-data": ">=3",
+        "@cloudflare/workers-types": ">=4",
+        "@electric-sql/pglite": ">=0.2.0",
+        "@libsql/client": ">=0.10.0",
+        "@libsql/client-wasm": ">=0.10.0",
+        "@neondatabase/serverless": ">=0.10.0",
+        "@op-engineering/op-sqlite": ">=2",
+        "@opentelemetry/api": "^1.4.1",
+        "@planetscale/database": ">=1.13",
+        "@prisma/client": "*",
+        "@tidbcloud/serverless": "*",
+        "@types/better-sqlite3": "*",
+        "@types/pg": "*",
+        "@types/sql.js": "*",
+        "@upstash/redis": ">=1.34.7",
+        "@vercel/postgres": ">=0.8.0",
+        "@xata.io/client": "*",
+        "better-sqlite3": ">=7",
+        "bun-types": "*",
+        "expo-sqlite": ">=14.0.0",
+        "gel": ">=2",
+        "knex": "*",
+        "kysely": "*",
+        "mysql2": ">=2",
+        "pg": ">=8",
+        "postgres": ">=3",
+        "sql.js": ">=1",
+        "sqlite3": ">=5"
+      },
+      "peerDependenciesMeta": {
+        "@aws-sdk/client-rds-data": {
+          "optional": true
+        },
+        "@cloudflare/workers-types": {
+          "optional": true
+        },
+        "@electric-sql/pglite": {
+          "optional": true
+        },
+        "@libsql/client": {
+          "optional": true
+        },
+        "@libsql/client-wasm": {
+          "optional": true
+        },
+        "@neondatabase/serverless": {
+          "optional": true
+        },
+        "@op-engineering/op-sqlite": {
+          "optional": true
+        },
+        "@opentelemetry/api": {
+          "optional": true
+        },
+        "@planetscale/database": {
+          "optional": true
+        },
+        "@prisma/client": {
+          "optional": true
+        },
+        "@tidbcloud/serverless": {
+          "optional": true
+        },
+        "@types/better-sqlite3": {
+          "optional": true
+        },
+        "@types/pg": {
+          "optional": true
+        },
+        "@types/sql.js": {
+          "optional": true
+        },
+        "@upstash/redis": {
+          "optional": true
+        },
+        "@vercel/postgres": {
+          "optional": true
+        },
+        "@xata.io/client": {
+          "optional": true
+        },
+        "better-sqlite3": {
+          "optional": true
+        },
+        "bun-types": {
+          "optional": true
+        },
+        "expo-sqlite": {
+          "optional": true
+        },
+        "gel": {
+          "optional": true
+        },
+        "knex": {
+          "optional": true
+        },
+        "kysely": {
+          "optional": true
+        },
+        "mysql2": {
+          "optional": true
+        },
+        "pg": {
+          "optional": true
+        },
+        "postgres": {
+          "optional": true
+        },
+        "prisma": {
+          "optional": true
+        },
+        "sql.js": {
+          "optional": true
+        },
+        "sqlite3": {
+          "optional": true
+        }
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-loong64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.12.tgz",
-      "integrity": "sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==",
-      "cpu": [
-        "loong64"
-      ],
+    "node_modules/dunder-proto": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
+      "dependencies": {
+        "call-bind-apply-helpers": "^1.0.1",
+        "es-errors": "^1.3.0",
+        "gopd": "^1.2.0"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-mips64el": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.12.tgz",
-      "integrity": "sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==",
-      "cpu": [
-        "mips64el"
-      ],
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
+      "optional": true
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-ppc64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.12.tgz",
-      "integrity": "sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==",
-      "cpu": [
-        "ppc64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
+    "node_modules/ee-first": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
+      "dev": true,
+      "license": "MIT"
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-riscv64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.12.tgz",
-      "integrity": "sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==",
-      "cpu": [
-        "riscv64"
-      ],
+    "node_modules/effect": {
+      "version": "3.21.4",
+      "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.4.tgz",
+      "integrity": "sha512-B89v/xSgPbl1J2Ai2u18jxq3odpFauU1rC6/eSs4FeNHi72kwKdJp12VGigvRV2lK+kRnx+OOz41XV8guZd4gQ==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "@standard-schema/spec": "^1.0.0",
+        "fast-check": "^3.23.1"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/linux-s390x": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.12.tgz",
-      "integrity": "sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==",
-      "cpu": [
-        "s390x"
-      ],
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "linux"
-      ],
-      "engines": {
-        "node": ">=18"
-      }
+      "optional": true
     },
-    "node_modules/esbuild/node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "netbsd"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.8"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/netbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/encoding": {
+      "version": "0.1.13",
+      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
+      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
-      "os": [
-        "netbsd"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "iconv-lite": "^0.6.2"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.12.tgz",
-      "integrity": "sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/end-of-stream": {
+      "version": "1.4.5",
+      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
+      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
-      "engines": {
-        "node": ">=18"
+      "dependencies": {
+        "once": "^1.4.0"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/openbsd-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.12.tgz",
-      "integrity": "sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==",
-      "cpu": [
-        "x64"
-      ],
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "openbsd"
-      ],
+    "node_modules/enhanced-resolve": {
+      "version": "5.21.6",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.6.tgz",
+      "integrity": "sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "tapable": "^2.3.3"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">=10.13.0"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.12.tgz",
-      "integrity": "sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/env-paths": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
+      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
-      "os": [
-        "openharmony"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">=6"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/sunos-x64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.12.tgz",
-      "integrity": "sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==",
-      "cpu": [
-        "x64"
-      ],
+    "node_modules/err-code": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
+      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
+    "node_modules/es-define-property": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "sunos"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/win32-arm64": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.12.tgz",
-      "integrity": "sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==",
-      "cpu": [
-        "arm64"
-      ],
+    "node_modules/es-errors": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/win32-ia32": {
-      "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.12.tgz",
-      "integrity": "sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==",
-      "cpu": [
-        "ia32"
-      ],
+    "node_modules/es-module-lexer": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
+      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
+      "devOptional": true,
+      "license": "MIT"
+    },
+    "node_modules/es-object-atoms": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
+      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "dev": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+      "dependencies": {
+        "es-errors": "^1.3.0"
+      },
       "engines": {
-        "node": ">=18"
+        "node": ">= 0.4"
       }
     },
-    "node_modules/esbuild/node_modules/@esbuild/win32-x64": {
+    "node_modules/esbuild": {
       "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.12.tgz",
-      "integrity": "sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==",
-      "cpu": [
-        "x64"
-      ],
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
+      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
+      "devOptional": true,
+      "hasInstallScript": true,
       "license": "MIT",
-      "optional": true,
-      "os": [
-        "win32"
-      ],
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
       "engines": {
         "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.12",
+        "@esbuild/android-arm": "0.25.12",
+        "@esbuild/android-arm64": "0.25.12",
+        "@esbuild/android-x64": "0.25.12",
+        "@esbuild/darwin-arm64": "0.25.12",
+        "@esbuild/darwin-x64": "0.25.12",
+        "@esbuild/freebsd-arm64": "0.25.12",
+        "@esbuild/freebsd-x64": "0.25.12",
+        "@esbuild/linux-arm": "0.25.12",
+        "@esbuild/linux-arm64": "0.25.12",
+        "@esbuild/linux-ia32": "0.25.12",
+        "@esbuild/linux-loong64": "0.25.12",
+        "@esbuild/linux-mips64el": "0.25.12",
+        "@esbuild/linux-ppc64": "0.25.12",
+        "@esbuild/linux-riscv64": "0.25.12",
+        "@esbuild/linux-s390x": "0.25.12",
+        "@esbuild/linux-x64": "0.25.12",
+        "@esbuild/netbsd-arm64": "0.25.12",
+        "@esbuild/netbsd-x64": "0.25.12",
+        "@esbuild/openbsd-arm64": "0.25.12",
+        "@esbuild/openbsd-x64": "0.25.12",
+        "@esbuild/openharmony-arm64": "0.25.12",
+        "@esbuild/sunos-x64": "0.25.12",
+        "@esbuild/win32-arm64": "0.25.12",
+        "@esbuild/win32-ia32": "0.25.12",
+        "@esbuild/win32-x64": "0.25.12"
       }
     },
     "node_modules/escape-html": {
@@ -6130,25 +5721,25 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.39.2",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.2.tgz",
-      "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
+      "version": "9.39.4",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz",
+      "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
-        "@eslint/config-array": "^0.21.1",
+        "@eslint/config-array": "^0.21.2",
         "@eslint/config-helpers": "^0.4.2",
         "@eslint/core": "^0.17.0",
-        "@eslint/eslintrc": "^3.3.1",
-        "@eslint/js": "9.39.2",
+        "@eslint/eslintrc": "^3.3.5",
+        "@eslint/js": "9.39.4",
         "@eslint/plugin-kit": "^0.4.1",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.4.2",
         "@types/estree": "^1.0.6",
-        "ajv": "^6.12.4",
+        "ajv": "^6.14.0",
         "chalk": "^4.0.0",
         "cross-spawn": "^7.0.6",
         "debug": "^4.3.2",
@@ -6167,7 +5758,7 @@
         "is-glob": "^4.0.0",
         "json-stable-stringify-without-jsonify": "^1.0.1",
         "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.2",
+        "minimatch": "^3.1.5",
         "natural-compare": "^1.4.0",
         "optionator": "^0.9.3"
       },
@@ -6206,20 +5797,20 @@
       }
     },
     "node_modules/eslint-plugin-better-tailwindcss": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-better-tailwindcss/-/eslint-plugin-better-tailwindcss-4.3.0.tgz",
-      "integrity": "sha512-AYNFAeqExOS/yt1qn7kg1il0VZvAxGwBuW/6xAQtmKDRZXkdkWzwWCYF6Ou2/0tza42K8xh4q420DBq+QvXzjA==",
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-better-tailwindcss/-/eslint-plugin-better-tailwindcss-4.6.0.tgz",
+      "integrity": "sha512-Xeh/6KzLeays6jXSqTKx6iCdJL1qo5ant/mAabbz7dJqADYebKUUPR2zXp1xuiqqJ3HIm+MN+Ql2m4Jp0BxkMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint/css-tree": "^3.6.8",
-        "@valibot/to-json-schema": "^1.5.0",
-        "enhanced-resolve": "^5.19.0",
+        "@eslint/css-tree": "^4.0.1",
+        "@valibot/to-json-schema": "^1.6.0",
+        "enhanced-resolve": "^5.20.1",
         "jiti": "^2.6.1",
         "synckit": "^0.11.12",
-        "tailwind-csstree": "^0.1.4",
+        "tailwind-csstree": "^0.3.2",
         "tsconfig-paths-webpack-plugin": "^4.2.0",
-        "valibot": "^1.2.0"
+        "valibot": "^1.3.1"
       },
       "engines": {
         "node": "^20.19.0 || ^22.12.0 || >=23.0.0"
@@ -6239,9 +5830,9 @@
       }
     },
     "node_modules/eslint-plugin-security": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-security/-/eslint-plugin-security-4.0.0.tgz",
-      "integrity": "sha512-tfuQT8K/Li1ZxhFzyD8wPIKtlzZxqBcPr9q0jFMQ77wWAbKBVEhaMPVQRTMTvCMUDhwBe5vPVqQPwAGk/ASfxQ==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-security/-/eslint-plugin-security-4.0.1.tgz",
+      "integrity": "sha512-/lZCkOxPOWaf1jXAqgICrS8St3BMBccIPvhOSUYuV6VCr1o5nFVG998FnTLt6w2Nxb8Uo0nM8fzmnhp+GY/aEg==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -6255,9 +5846,9 @@
       }
     },
     "node_modules/eslint-plugin-svelte": {
-      "version": "3.15.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.15.0.tgz",
-      "integrity": "sha512-QKB7zqfuB8aChOfBTComgDptMf2yxiJx7FE04nneCmtQzgTHvY8UJkuh8J2Rz7KB9FFV9aTHX6r7rdYGvG8T9Q==",
+      "version": "3.19.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.19.0.tgz",
+      "integrity": "sha512-t3rNaZeXz4d2gG4uJyMEYfJCFKf22+SWbSizIIXIWKu4wM+XPLiMWuSSr/C5821JmFeN9ogK+eExbG+z+twyxw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6270,7 +5861,7 @@
         "postcss-load-config": "^3.1.4",
         "postcss-safe-parser": "^7.0.0",
         "semver": "^7.6.3",
-        "svelte-eslint-parser": "^1.4.0"
+        "svelte-eslint-parser": "^1.7.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -6331,6 +5922,30 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/eslint/node_modules/ajv": {
+      "version": "6.15.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
+      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/eslint/node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/esm-env": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
@@ -6384,13 +5999,21 @@
       }
     },
     "node_modules/esrap": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.3.tgz",
-      "integrity": "sha512-8fOS+GIGCQZl/ZIlhl59htOlms6U8NvX6ZYgYHpRU/b6tVSh3uHkOHZikl3D4cMbYM0JlpBe+p/BkZEi8J9XIQ==",
+      "version": "2.2.12",
+      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.12.tgz",
+      "integrity": "sha512-On0QbLyaiAkVC4eXtgnXK9Kh2opit+3rcUSOc45DqJ2s/X2eXAHsGOKRSJ6IDagQEW5vPyivANfXUiqgXC67Rw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.4.15"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/types": "^8.2.0"
+      },
+      "peerDependenciesMeta": {
+        "@typescript-eslint/types": {
+          "optional": true
+        }
       }
     },
     "node_modules/esrecurse": {
@@ -6452,6 +6075,15 @@
         "node": ">=0.8.x"
       }
     },
+    "node_modules/events-universal": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
+      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "bare-events": "^2.7.0"
+      }
+    },
     "node_modules/expand-template": {
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
@@ -6536,9 +6168,10 @@
       }
     },
     "node_modules/exsolve": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.0.8.tgz",
-      "integrity": "sha512-LmDxfWXwcTArk8fUEnOfSZpHOJ6zOMUJKOtFLFqJLoKJetuQG874Uc7/Kki7zFLzYybmZhp1M7+98pfMqeX8yA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.0.tgz",
+      "integrity": "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw==",
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/extend": {
@@ -6553,6 +6186,7 @@
       "version": "3.23.2",
       "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
       "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==",
+      "dev": true,
       "funding": [
         {
           "type": "individual",
@@ -6564,6 +6198,7 @@
         }
       ],
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "pure-rand": "^6.1.0"
       },
@@ -6572,9 +6207,9 @@
       }
     },
     "node_modules/fast-copy": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.2.tgz",
-      "integrity": "sha512-ybA6PDXIXOXivLJK/z9e+Otk7ve13I4ckBvGO5I2RRmBU1gMHLVDJYEuJYhGwez7YNlYji2M2DvVU+a9mSFDlw==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.3.tgz",
+      "integrity": "sha512-58apWr0GUiDFM8+3afrO6eYwJBn9ZAhDOzG3L+/9llab/haCARS2UIfffmOurYLwbgDRs8n0rfr6qAAPEAuAQw==",
       "dev": true,
       "license": "MIT"
     },
@@ -6585,6 +6220,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
+      "license": "MIT"
+    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
@@ -6617,9 +6258,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.0.tgz",
-      "integrity": "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==",
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
+      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
       "dev": true,
       "funding": [
         {
@@ -6634,43 +6275,6 @@
       "license": "BSD-3-Clause",
       "optional": true
     },
-    "node_modules/fast-xml-builder": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.2.0.tgz",
-      "integrity": "sha512-00aAWieqff+ZJhsXA4g1g7M8k+7AYoMUUHF+/zFb5U6Uv/P0Vl4QZo84/IcufzYalLuEj9928bXN9PbbFzMF0Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "path-expression-matcher": "^1.5.0",
-        "xml-naming": "^0.1.0"
-      }
-    },
-    "node_modules/fast-xml-parser": {
-      "version": "5.7.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.3.tgz",
-      "integrity": "sha512-C0AaNuC+mscy6vrAQKAc/rMq+zAPHodfHGZu4sGVehvAQt/JLG1O5zEcYcXSY5zSqr4YVgxsB+pHXTq0i7eDlg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "@nodable/entities": "^2.1.0",
-        "fast-xml-builder": "^1.1.7",
-        "path-expression-matcher": "^1.5.0",
-        "strnum": "^2.2.3"
-      },
-      "bin": {
-        "fxparser": "src/cli/cli.js"
-      }
-    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
@@ -6764,9 +6368,9 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.3.3.tgz",
-      "integrity": "sha512-GX+ysw4PBCz0PzosHDepZGANEuFCMLrnRTiEy9McGjmkCQYwRq4A/X786G/fjM/+OjsWSU1ZrY5qyARZmO/uwg==",
+      "version": "3.4.2",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
+      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
       "dev": true,
       "license": "ISC"
     },
@@ -6774,7 +6378,9 @@
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
       "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "dev": true,
       "license": "ISC",
+      "optional": true,
       "dependencies": {
         "cross-spawn": "^7.0.6",
         "signal-exit": "^4.0.1"
@@ -6858,16 +6464,6 @@
       "integrity": "sha512-dkuVSOKKwh3eas5VkJy1AW1vFpet8TA/fGmVA5krThl8YcOVE/8ZIoEA1+U1vEn5ckxxhLirSdY837azmbaNHA==",
       "license": "MIT"
     },
-    "node_modules/generate-function": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",
-      "integrity": "sha512-eeB5GfMNeevm/GRYq20ShmsaGcmI81kIX2K9XQx5miC8KdHaC6Jm0qQ8ZNeGOi7wYB8OsdxKs+Y2oVuTFuVwKQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "is-property": "^1.0.2"
-      }
-    },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
@@ -6893,13 +6489,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/get-port-please": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/get-port-please/-/get-port-please-3.2.0.tgz",
-      "integrity": "sha512-I9QVvBw5U/hw3RmWpYKRumUeaDgxTPd401x364rLmWBJcOQ753eov1eTgzDqRG9bqFIfDc7gfzcQEWrUri3o1A==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/get-proto": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
@@ -6927,24 +6516,6 @@
         "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
       }
     },
-    "node_modules/giget": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/giget/-/giget-2.0.0.tgz",
-      "integrity": "sha512-L5bGsVkxJbJgdnwyuheIunkGatUF/zssUoxxjACCseZYAVbaqdh9Tsmmlkl8vYan09H7sbvKt4pS8GqKLBrEzA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "citty": "^0.1.6",
-        "consola": "^3.4.0",
-        "defu": "^6.1.4",
-        "node-fetch-native": "^1.6.6",
-        "nypm": "^0.6.0",
-        "pathe": "^2.0.3"
-      },
-      "bin": {
-        "giget": "dist/cli.mjs"
-      }
-    },
     "node_modules/github-from-package": {
       "version": "0.0.0",
       "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
@@ -7047,27 +6618,14 @@
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
       "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true,
       "license": "ISC"
     },
-    "node_modules/grammex": {
-      "version": "3.1.12",
-      "resolved": "https://registry.npmjs.org/grammex/-/grammex-3.1.12.tgz",
-      "integrity": "sha512-6ufJOsSA7LcQehIJNCO7HIBykfM7DXQual0Ny780/DEcJIpBlHRvcqEBWGPYd7hrXL2GJ3oJI1MIhaXjWmLQOQ==",
-      "license": "MIT",
-      "peer": true
-    },
-    "node_modules/graphmatch": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/graphmatch/-/graphmatch-1.1.1.tgz",
-      "integrity": "sha512-5ykVn/EXM1hF0XCaWh05VbYvEiOL2lY1kBxZtaYsyvjp7cmWOU1XsAdfQBwClraEofXDT197lFbXOEVMHpvQOg==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
       "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -7087,9 +6645,9 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
-      "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
+      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7116,20 +6674,10 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/hono": {
-      "version": "4.11.4",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.11.4.tgz",
-      "integrity": "sha512-U7tt8JsyrxSRKspfhtLET79pU8K+tInj5QZXs1jSugO1Vq5dFj3kmZsRldo29mTBfcjDRVRXrEZ6LS63Cog9ZA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=16.9.0"
-      }
-    },
     "node_modules/hosted-git-info": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.2.tgz",
-      "integrity": "sha512-M422h7o/BR3rmCQ8UHi7cyyMqKltdP9Uo+J2fXK+RSAY+wTcKOIRyhTuKv4qn+DJf3g+PL890AzId5KZpX+CBg==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.3.tgz",
+      "integrity": "sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7153,7 +6701,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
       "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/http-cache-semantics": {
@@ -7200,13 +6748,6 @@
         "node": ">= 14"
       }
     },
-    "node_modules/http-status-codes": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/http-status-codes/-/http-status-codes-2.3.0.tgz",
-      "integrity": "sha512-RJ8XvFvpPM/Dmc5SV+dC4y5PCeOhT3x1Hq0NU3rjGeg5a/CqlhZ7uudknPwZFz4aeAXDcbAyaeP7GAo9lvngtA==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/https-proxy-agent": {
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
@@ -7223,9 +6764,9 @@
       }
     },
     "node_modules/human-id": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/human-id/-/human-id-4.1.3.tgz",
-      "integrity": "sha512-tsYlhAYpjCKa//8rXZ9DqKEawhPoSytweBC2eNvcaDK+57RZLHGqNs3PZTQO6yekLFSuvA6AlnAfrw1uBvtb+Q==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/human-id/-/human-id-4.2.0.tgz",
+      "integrity": "sha512-K3GbkIWqyvvlpfhBPlbEvD97TtqBpAYA4kt+cn2lD2x2HuohzZCibcA2nOlnJT6exqvJLggoB5nv2dNf192nEA==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -7233,9 +6774,9 @@
       }
     },
     "node_modules/hyparquet": {
-      "version": "1.26.0",
-      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.26.0.tgz",
-      "integrity": "sha512-yxUiViPZ+z5h+xdX4rA1G+k30jXoEsG9I2xEpjaM84imGznbKjZzxuZFsdzqg6C4LxNnnAlDFvzpk4uxQWTbTQ==",
+      "version": "1.26.1",
+      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.26.1.tgz",
+      "integrity": "sha512-Me2psKksCqJGR8+TbalUYUyK4Ao+ReA6XmMSiOVPhOBswULbl3ojT06PQajyTafbNPW1vD0tCA7H6dXJAC1TPw==",
       "license": "MIT"
     },
     "node_modules/hyparquet-compressors": {
@@ -7255,19 +6796,17 @@
       "license": "MIT"
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.6.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
-      "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+      "engines": {
+        "node": ">=0.10.0"
       }
     },
     "node_modules/ieee754": {
@@ -7353,9 +6892,10 @@
       "optional": true
     },
     "node_modules/ip-address": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
-      "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -7373,13 +6913,13 @@
       }
     },
     "node_modules/is-core-module": {
-      "version": "2.16.1",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
-      "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
+      "version": "2.16.2",
+      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
+      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hasown": "^2.0.2"
+        "hasown": "^2.0.3"
       },
       "engines": {
         "node": ">= 0.4"
@@ -7449,13 +6989,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/is-property": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/is-property/-/is-property-1.0.2.tgz",
-      "integrity": "sha512-Ks/IoX00TtClbGQr4TWXemAnktAQvYB7HzcCxDGqEZU6oCmb2INHuOoKxbtR+HFkmYWBKv/dOZtGRiAjDhj92g==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/is-reference": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-1.2.1.tgz",
@@ -7470,13 +7003,14 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/istanbul-lib-coverage": {
       "version": "3.2.2",
       "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
       "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
-      "dev": true,
+      "devOptional": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=8"
@@ -7486,7 +7020,7 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
       "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
-      "dev": true,
+      "devOptional": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "istanbul-lib-coverage": "^3.0.0",
@@ -7501,7 +7035,7 @@
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
       "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
-      "dev": true,
+      "devOptional": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "html-escaper": "^2.0.0",
@@ -7529,18 +7063,19 @@
       }
     },
     "node_modules/jiti": {
-      "version": "2.6.1",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.6.1.tgz",
-      "integrity": "sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==",
+      "version": "2.7.0",
+      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
+      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "devOptional": true,
       "license": "MIT",
       "bin": {
         "jiti": "lib/jiti-cli.mjs"
       }
     },
     "node_modules/joi": {
-      "version": "17.13.3",
-      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.3.tgz",
-      "integrity": "sha512-otDA4ldcIx+ZXsKHWmp0YizCweVRZG96J10b0FevjfuncLO1oX59THoAmHkNubYJ+9gWsYsp5k8v4ib6oDv1fA==",
+      "version": "17.13.4",
+      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.4.tgz",
+      "integrity": "sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true,
@@ -7553,9 +7088,9 @@
       }
     },
     "node_modules/jose": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.1.tgz",
-      "integrity": "sha512-jUaKr1yrbfaImV7R2TN/b3IcZzsw38/chqMpo2XJ7i2F8AfM/lA4G1goC3JVEwg0H7UldTmSt3P68nt31W7/mw==",
+      "version": "6.2.3",
+      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
+      "integrity": "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -7582,14 +7117,24 @@
       "version": "10.0.0",
       "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
       "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
       "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -7621,11 +7166,12 @@
       }
     },
     "node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
@@ -7675,13 +7221,12 @@
       "license": "MIT"
     },
     "node_modules/kysely": {
-      "version": "0.27.6",
-      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.27.6.tgz",
-      "integrity": "sha512-FIyV/64EkKhJmjgC0g2hygpBv5RNWVPyNCqSAD7eTCv6eFWNIi4PN1UvdSJGicN/o35bnevgis4Y0UDC0qi8jQ==",
-      "devOptional": true,
+      "version": "0.28.17",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz",
+      "integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==",
       "license": "MIT",
       "engines": {
-        "node": ">=14.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/levn": {
@@ -7699,9 +7244,9 @@
       }
     },
     "node_modules/libphonenumber-js": {
-      "version": "1.12.36",
-      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.12.36.tgz",
-      "integrity": "sha512-woWhKMAVx1fzzUnMCyOzglgSgf6/AFHLASdOBcchYCyvWSGWt12imw3iu2hdI5d4dGZRsNWAmWiz37sDKUPaRQ==",
+      "version": "1.13.7",
+      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.13.7.tgz",
+      "integrity": "sha512-rvr3HIMdOgzhz1RFGjftji+wjoAFlzhqCNqJOU/MKTZQ8d9NZxAR/tI+0weDicyoucqVR0U1GCniqHJ0f8aM2A==",
       "dev": true,
       "license": "MIT",
       "optional": true
@@ -7725,9 +7270,9 @@
       }
     },
     "node_modules/lightningcss": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.31.1.tgz",
-      "integrity": "sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
+      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
       "devOptional": true,
       "license": "MPL-2.0",
       "dependencies": {
@@ -7741,23 +7286,23 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "lightningcss-android-arm64": "1.31.1",
-        "lightningcss-darwin-arm64": "1.31.1",
-        "lightningcss-darwin-x64": "1.31.1",
-        "lightningcss-freebsd-x64": "1.31.1",
-        "lightningcss-linux-arm-gnueabihf": "1.31.1",
-        "lightningcss-linux-arm64-gnu": "1.31.1",
-        "lightningcss-linux-arm64-musl": "1.31.1",
-        "lightningcss-linux-x64-gnu": "1.31.1",
-        "lightningcss-linux-x64-musl": "1.31.1",
-        "lightningcss-win32-arm64-msvc": "1.31.1",
-        "lightningcss-win32-x64-msvc": "1.31.1"
+        "lightningcss-android-arm64": "1.32.0",
+        "lightningcss-darwin-arm64": "1.32.0",
+        "lightningcss-darwin-x64": "1.32.0",
+        "lightningcss-freebsd-x64": "1.32.0",
+        "lightningcss-linux-arm-gnueabihf": "1.32.0",
+        "lightningcss-linux-arm64-gnu": "1.32.0",
+        "lightningcss-linux-arm64-musl": "1.32.0",
+        "lightningcss-linux-x64-gnu": "1.32.0",
+        "lightningcss-linux-x64-musl": "1.32.0",
+        "lightningcss-win32-arm64-msvc": "1.32.0",
+        "lightningcss-win32-x64-msvc": "1.32.0"
       }
     },
     "node_modules/lightningcss-android-arm64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.31.1.tgz",
-      "integrity": "sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
       "cpu": [
         "arm64"
       ],
@@ -7775,9 +7320,9 @@
       }
     },
     "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.31.1.tgz",
-      "integrity": "sha512-02uTEqf3vIfNMq3h/z2cJfcOXnQ0GRwQrkmPafhueLb2h7mqEidiCzkE4gBMEH65abHRiQvhdcQ+aP0D0g67sg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
+      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
       "cpu": [
         "arm64"
       ],
@@ -7795,9 +7340,9 @@
       }
     },
     "node_modules/lightningcss-darwin-x64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.31.1.tgz",
-      "integrity": "sha512-1ObhyoCY+tGxtsz1lSx5NXCj3nirk0Y0kB/g8B8DT+sSx4G9djitg9ejFnjb3gJNWo7qXH4DIy2SUHvpoFwfTA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
+      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
       "cpu": [
         "x64"
       ],
@@ -7815,9 +7360,9 @@
       }
     },
     "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.31.1.tgz",
-      "integrity": "sha512-1RINmQKAItO6ISxYgPwszQE1BrsVU5aB45ho6O42mu96UiZBxEXsuQ7cJW4zs4CEodPUioj/QrXW1r9pLUM74A==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
+      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
       "cpu": [
         "x64"
       ],
@@ -7835,9 +7380,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.31.1.tgz",
-      "integrity": "sha512-OOCm2//MZJ87CdDK62rZIu+aw9gBv4azMJuA8/KB74wmfS3lnC4yoPHm0uXZ/dvNNHmnZnB8XLAZzObeG0nS1g==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
+      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
       "cpu": [
         "arm"
       ],
@@ -7855,9 +7400,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.31.1.tgz",
-      "integrity": "sha512-WKyLWztD71rTnou4xAD5kQT+982wvca7E6QoLpoawZ1gP9JM0GJj4Tp5jMUh9B3AitHbRZ2/H3W5xQmdEOUlLg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
+      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
       "cpu": [
         "arm64"
       ],
@@ -7875,9 +7420,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.31.1.tgz",
-      "integrity": "sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
+      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
       "cpu": [
         "arm64"
       ],
@@ -7895,9 +7440,9 @@
       }
     },
     "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.31.1.tgz",
-      "integrity": "sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
+      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
       "cpu": [
         "x64"
       ],
@@ -7915,9 +7460,9 @@
       }
     },
     "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.31.1.tgz",
-      "integrity": "sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
+      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
       "cpu": [
         "x64"
       ],
@@ -7935,9 +7480,9 @@
       }
     },
     "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.31.1.tgz",
-      "integrity": "sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
+      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
       "cpu": [
         "arm64"
       ],
@@ -7955,9 +7500,9 @@
       }
     },
     "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.31.1",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.31.1.tgz",
-      "integrity": "sha512-I9aiFrbd7oYHwlnQDqr1Roz+fTz61oDDJX7n9tYF9FJymH1cIN1DtKw3iYt6b8WZgEjoNwVSncwF4wx/ZedMhw==",
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
+      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
       "cpu": [
         "x64"
       ],
@@ -7978,6 +7523,7 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
       "integrity": "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -8024,13 +7570,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -8038,13 +7577,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0",
-      "peer": true
-    },
     "node_modules/lru-cache": {
       "version": "10.4.3",
       "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
@@ -8053,22 +7585,6 @@
       "license": "ISC",
       "optional": true
     },
-    "node_modules/lru.min": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/lru.min/-/lru.min-1.1.4.tgz",
-      "integrity": "sha512-DqC6n3QQ77zdFpCMASA1a3Jlb64Hv2N2DciFGkO/4L9+q/IpIAuRlKOvCXabtRW6cQf8usbmM6BE/TOPysCdIA==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "bun": ">=1.0.0",
-        "deno": ">=1.30.0",
-        "node": ">=8.0.0"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/wellwelwel"
-      }
-    },
     "node_modules/luxon": {
       "version": "3.5.0",
       "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.5.0.tgz",
@@ -8093,7 +7609,7 @@
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.3.tgz",
       "integrity": "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.29.3",
@@ -8105,7 +7621,7 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
       "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "semver": "^7.5.3"
@@ -8164,9 +7680,9 @@
       }
     },
     "node_modules/mdn-data": {
-      "version": "2.23.0",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.23.0.tgz",
-      "integrity": "sha512-786vq1+4079JSeu2XdcDjrhi/Ry7BWtjDl9WtGPWLiIHb2T66GvIVflZTBoSNZ5JqTtJGYEVMuFA/lbQlMOyDQ==",
+      "version": "2.28.1",
+      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.28.1.tgz",
+      "integrity": "sha512-U9w+PzSZ00Z5m9rZ5ARVFL5xOfuCHdKYi/1RRwDCJsboFgJDNT3zT6PIPD7mZQYaQLhsZM3GfDRgSMRHhSmVng==",
       "dev": true,
       "license": "CC0-1.0"
     },
@@ -8187,13 +7703,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/memory-pager": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/memory-pager/-/memory-pager-1.5.0.tgz",
-      "integrity": "sha512-ZS4Bp4r/Zoeq6+NLJpP+0Zzm0pR8whtGPf1XExKLJBAczGMnSi3It14OiNCStjQjM6NU1okjQGSxgEZN8eBYKg==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/merge-descriptors": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
@@ -8316,11 +7825,11 @@
       }
     },
     "node_modules/minipass-flush": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
-      "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz",
+      "integrity": "sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "optional": true,
       "dependencies": {
         "minipass": "^3.0.0"
@@ -8487,67 +7996,6 @@
         "marked": "14.0.0"
       }
     },
-    "node_modules/mongodb": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/mongodb/-/mongodb-7.1.0.tgz",
-      "integrity": "sha512-kMfnKunbolQYwCIyrkxNJFB4Ypy91pYqua5NargS/f8ODNSJxT03ZU3n1JqL4mCzbSih8tvmMEMLpKTT7x5gCg==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@mongodb-js/saslprep": "^1.3.0",
-        "bson": "^7.1.1",
-        "mongodb-connection-string-url": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=20.19.0"
-      },
-      "peerDependencies": {
-        "@aws-sdk/credential-providers": "^3.806.0",
-        "@mongodb-js/zstd": "^7.0.0",
-        "gcp-metadata": "^7.0.1",
-        "kerberos": "^7.0.0",
-        "mongodb-client-encryption": ">=7.0.0 <7.1.0",
-        "snappy": "^7.3.2",
-        "socks": "^2.8.6"
-      },
-      "peerDependenciesMeta": {
-        "@aws-sdk/credential-providers": {
-          "optional": true
-        },
-        "@mongodb-js/zstd": {
-          "optional": true
-        },
-        "gcp-metadata": {
-          "optional": true
-        },
-        "kerberos": {
-          "optional": true
-        },
-        "mongodb-client-encryption": {
-          "optional": true
-        },
-        "snappy": {
-          "optional": true
-        },
-        "socks": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/mongodb-connection-string-url": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/mongodb-connection-string-url/-/mongodb-connection-string-url-7.0.1.tgz",
-      "integrity": "sha512-h0AZ9A7IDVwwHyMxmdMXKy+9oNlF0zFoahHiX3vQ8e3KFcSP3VmsmfvtRSuLPxmyv2vjIDxqty8smTgie/SNRQ==",
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@types/whatwg-url": "^13.0.0",
-        "whatwg-url": "^14.1.0"
-      },
-      "engines": {
-        "node": ">=20.19.0"
-      }
-    },
     "node_modules/moo": {
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/moo/-/moo-0.5.3.tgz",
@@ -8583,40 +8031,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/mysql2": {
-      "version": "3.15.3",
-      "resolved": "https://registry.npmjs.org/mysql2/-/mysql2-3.15.3.tgz",
-      "integrity": "sha512-FBrGau0IXmuqg4haEZRBfHNWB5mUARw6hNwPDXXGg0XzVJ50mr/9hb267lvpVMnhZ1FON3qNd4Xfcez1rbFwSg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "aws-ssl-profiles": "^1.1.1",
-        "denque": "^2.1.0",
-        "generate-function": "^2.3.1",
-        "iconv-lite": "^0.7.0",
-        "long": "^5.2.1",
-        "lru.min": "^1.0.0",
-        "named-placeholders": "^1.1.3",
-        "seq-queue": "^0.0.5",
-        "sqlstring": "^2.3.2"
-      },
-      "engines": {
-        "node": ">= 8.0"
-      }
-    },
-    "node_modules/named-placeholders": {
-      "version": "1.1.6",
-      "resolved": "https://registry.npmjs.org/named-placeholders/-/named-placeholders-1.1.6.tgz",
-      "integrity": "sha512-Tz09sEL2EEuv5fFowm419c1+a/jSMiBjI9gHxVLrVdbUkkNUUfjsVYs9pVZu5oCon/kmRh9TfLEObFtkVxmY0w==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "lru.min": "^1.1.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
     "node_modules/nan": {
       "version": "2.22.2",
       "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
@@ -8626,9 +8040,9 @@
       "optional": true
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.15",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
+      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
       "devOptional": true,
       "funding": [
         {
@@ -8645,9 +8059,9 @@
       }
     },
     "node_modules/nanostores": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.1.1.tgz",
-      "integrity": "sha512-EYJqS25r2iBeTtGQCHidXl1VfZ1jXM7Q04zXJOrMlxVVmD0ptxJaNux92n1mJ7c5lN3zTq12MhH/8x59nP+qmg==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/nanostores/-/nanostores-1.3.0.tgz",
+      "integrity": "sha512-XPUa/jz+P1oJvN9VBxw4L9MtdFfaH3DAryqPssqhb2kXjmb9npz0dly6rCsgFWOPr4Yg9mTfM3MDZgZZ+7A3lA==",
       "funding": [
         {
           "type": "github",
@@ -8717,9 +8131,9 @@
       }
     },
     "node_modules/node-abi": {
-      "version": "3.87.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.87.0.tgz",
-      "integrity": "sha512-+CGM1L1CgmtheLcBuleyYOn7NWPVu0s0EJH2C4puxgEZb9h8QpR9G2dBfZJOAUhi7VQxuBPMd0hiISWcTyiYyQ==",
+      "version": "3.92.0",
+      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.92.0.tgz",
+      "integrity": "sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8730,13 +8144,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/node-fetch-native": {
-      "version": "1.6.7",
-      "resolved": "https://registry.npmjs.org/node-fetch-native/-/node-fetch-native-1.6.7.tgz",
-      "integrity": "sha512-g9yhqoedzIUm0nTnTqAQvueMPVOuIY16bqgAJJC8XOOubYFNwz6IER9qs0Gq2Xd0+CecCKFjtdDTMA4u4xG06Q==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/node-gyp": {
       "version": "11.5.0",
       "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
@@ -8837,35 +8244,10 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/nypm": {
-      "version": "0.6.5",
-      "resolved": "https://registry.npmjs.org/nypm/-/nypm-0.6.5.tgz",
-      "integrity": "sha512-K6AJy1GMVyfyMXRVB88700BJqNUkByijGJM8kEHpLdcAt+vSQAVfkWWHYzuRXHSY6xA2sNc5RjTj0p9rE2izVQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "citty": "^0.2.0",
-        "pathe": "^2.0.3",
-        "tinyexec": "^1.0.2"
-      },
-      "bin": {
-        "nypm": "dist/cli.mjs"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/nypm/node_modules/citty": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/citty/-/citty-0.2.2.tgz",
-      "integrity": "sha512-+6vJA3L98yv+IdfKGZHBNiGW5KHn22e/JwID0Strsz8h4S/csAu/OuICwxrg44k5MRiZHWIo8XXuJgQTriRP4w==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/oauth2-mock-server": {
-      "version": "8.2.2",
-      "resolved": "https://registry.npmjs.org/oauth2-mock-server/-/oauth2-mock-server-8.2.2.tgz",
-      "integrity": "sha512-ZjMFtomGM4q1DflxEJpq2WVtSLbOjqlJYkkuGWdq9nL3oAbDExamFyhDN/bUqcooCHWeI0n99K/NU+gXEZLNiA==",
+      "version": "8.2.3",
+      "resolved": "https://registry.npmjs.org/oauth2-mock-server/-/oauth2-mock-server-8.2.3.tgz",
+      "integrity": "sha512-Lgem1ZjVYG6NuzJ7J6MC2OchMkJWzwb1SFvwuGunQ1VPmQIU+/ydG3LzgBu/cnFWriYD8ZTd2CQpjHtvcVZy3A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8873,10 +8255,10 @@
         "cors": "^2.8.6",
         "express": "^5.2.1",
         "is-plain-obj": "^4.1.0",
-        "jose": "^6.1.3"
+        "jose": "^6.2.3"
       },
       "bin": {
-        "oauth2-mock-server": "dist/oauth2-mock-server.js"
+        "oauth2-mock-server": "dist/oauth2-mock-server.mjs"
       },
       "engines": {
         "node": "^20.19 || ^22.12 || ^24"
@@ -8906,22 +8288,18 @@
       }
     },
     "node_modules/obug": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.1.tgz",
-      "integrity": "sha512-uTqF9MuPraAQ+IsnPf366RG4cP9RtUi7MLO1N3KEc+wb0a6yKpeL0lmk2IB1jY5KHPAlTc6T/JRdC/YqxHNwkQ==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
+      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
       "devOptional": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
         "https://opencollective.com/debug"
       ],
-      "license": "MIT"
-    },
-    "node_modules/ohash": {
-      "version": "2.0.11",
-      "resolved": "https://registry.npmjs.org/ohash/-/ohash-2.0.11.tgz",
-      "integrity": "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ==",
       "license": "MIT",
-      "peer": true
+      "engines": {
+        "node": ">=12.20.0"
+      }
     },
     "node_modules/on-exit-leak-free": {
       "version": "2.1.2",
@@ -9048,6 +8426,12 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/papaparse": {
+      "version": "5.5.4",
+      "resolved": "https://registry.npmjs.org/papaparse/-/papaparse-5.5.4.tgz",
+      "integrity": "sha512-SwzWD9gl/ElwYLCI0nUja1mFJzjq2D8ziShfNBa7zCHzkOozeOGDwHWQ+tvCzEZcewecWZ5U7kUopDnG+DFYEQ==",
+      "license": "MIT"
+    },
     "node_modules/parent-module": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
@@ -9081,25 +8465,11 @@
         "node": ">=8"
       }
     },
-    "node_modules/path-expression-matcher": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
-      "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=14.0.0"
-      }
-    },
     "node_modules/path-key": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -9131,9 +8501,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
-      "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+      "version": "8.4.2",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
+      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -9145,17 +8515,18 @@
       "version": "2.0.3",
       "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
       "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/pg": {
-      "version": "8.21.0",
-      "resolved": "https://registry.npmjs.org/pg/-/pg-8.21.0.tgz",
-      "integrity": "sha512-AUP1EYJuHraQGsVoCQVIcM7TEJVGtDzxWtGFZd8rds9d+CCXlU5Js1rYgfLNvxy9iJrpHjGrRjoi/3BT9fRyiA==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/pg/-/pg-8.22.0.tgz",
+      "integrity": "sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA==",
       "license": "MIT",
       "dependencies": {
-        "pg-connection-string": "^2.13.0",
+        "pg-connection-string": "^2.14.0",
         "pg-pool": "^3.14.0",
-        "pg-protocol": "^1.14.0",
+        "pg-protocol": "^1.15.0",
         "pg-types": "2.2.0",
         "pgpass": "1.0.5"
       },
@@ -9182,9 +8553,9 @@
       "optional": true
     },
     "node_modules/pg-connection-string": {
-      "version": "2.13.0",
-      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.13.0.tgz",
-      "integrity": "sha512-EMnU9E2fSULdsbErBbMaXJvFeD9B4+nPcM3f+4lsiCR0BHLPrLVjv3DbyM2hgQQviKJaTWIRRTjKjWlHg3p2ig==",
+      "version": "2.14.0",
+      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.0.tgz",
+      "integrity": "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==",
       "license": "MIT"
     },
     "node_modules/pg-int8": {
@@ -9206,9 +8577,9 @@
       }
     },
     "node_modules/pg-protocol": {
-      "version": "1.14.0",
-      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.14.0.tgz",
-      "integrity": "sha512-n5taZ1kO3s9ngDTVxsEznOqCyToTgz0FLuPq0B33COy5pPpuWJpY3/2oRBVETuOgzdqRXfWpM9HIhp2LBBT1BA==",
+      "version": "1.15.0",
+      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.15.0.tgz",
+      "integrity": "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==",
       "license": "MIT"
     },
     "node_modules/pg-types": {
@@ -9244,9 +8615,9 @@
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -9331,23 +8702,11 @@
       "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
       "license": "MIT"
     },
-    "node_modules/pixelmatch": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/pixelmatch/-/pixelmatch-7.1.0.tgz",
-      "integrity": "sha512-1wrVzJ2STrpmONHKBy228LM1b84msXDUoAzVEl0R8Mz4Ce6EPr+IVtxm8+yvrqLYMHswREkjYFaMxnyGnaY3Ng==",
-      "devOptional": true,
-      "license": "ISC",
-      "dependencies": {
-        "pngjs": "^7.0.0"
-      },
-      "bin": {
-        "pixelmatch": "bin/pixelmatch"
-      }
-    },
     "node_modules/pkg-types": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.1.tgz",
       "integrity": "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "confbox": "^0.2.4",
@@ -9356,13 +8715,13 @@
       }
     },
     "node_modules/playwright": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.58.2.tgz",
-      "integrity": "sha512-vA30H8Nvkq/cPBnNw4Q8TWz1EJyqgpuinBcHET0YVJVFldr8JDNiU9LaWAE1KqSkRYazuaBhTpB5ZzShOezQ6A==",
+      "version": "1.61.0",
+      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.0.tgz",
+      "integrity": "sha512-Z+7BeeqQPRRzklHsVFP4KTGIyMxKUmfeRA4WisM6G3/XW6nwGeX6fX9qYaDa+CiUqpOkb2f6X3nar05R3kSuJQ==",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.58.2"
+        "playwright-core": "1.61.0"
       },
       "bin": {
         "playwright": "cli.js"
@@ -9375,9 +8734,9 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.58.2",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.58.2.tgz",
-      "integrity": "sha512-yZkEtftgwS8CsfYo7nm0KE8jsvm6i/PTgVtB8DL726wNf6H2IMsDuxCpJj59KDaxCtSnrWan2AeDqM7JBaultg==",
+      "version": "1.61.0",
+      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.0.tgz",
+      "integrity": "sha512-caX7TrY3Ml6egyDX0WUcTHDxodl/b51y5wJOdCEA36QviK/s2g081hvmGs8eaE3DWb6NYZQ6BjO/QkNRPenoPA==",
       "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
@@ -9398,9 +8757,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.6",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
-      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "version": "8.5.15",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
       "devOptional": true,
       "funding": [
         {
@@ -9418,7 +8777,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.12",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -9457,9 +8816,9 @@
       }
     },
     "node_modules/postcss-load-config/node_modules/yaml": {
-      "version": "1.10.2",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz",
-      "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==",
+      "version": "1.10.3",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
+      "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -9521,9 +8880,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.1.tgz",
-      "integrity": "sha512-orRsuYpJVw8LdAwqqLykBj9ecS5/cRHlI5+nvTo8LcCKmzDmqVORXtOIYEEQuL9D4BxtA1lm5isAqzQZCoQ6Eg==",
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.4.tgz",
+      "integrity": "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9534,20 +8893,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/postgres": {
-      "version": "3.4.7",
-      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
-      "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
-      "license": "Unlicense",
-      "peer": true,
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "type": "individual",
-        "url": "https://github.com/sponsors/porsager"
-      }
-    },
     "node_modules/postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -9627,9 +8972,9 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.8.1",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.1.tgz",
-      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
+      "version": "3.8.4",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.4.tgz",
+      "integrity": "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -9643,9 +8988,9 @@
       }
     },
     "node_modules/prettier-plugin-svelte": {
-      "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-3.5.0.tgz",
-      "integrity": "sha512-2lLO/7EupnjO/95t+XZesXs8Bf3nYLIDfCo270h5QWbj/vjLqmrQ1LiRk9LPggxSDsnVYfehamZNf+rgQYApZg==",
+      "version": "3.5.2",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-3.5.2.tgz",
+      "integrity": "sha512-ItFouLvzSFE3ulNl4DKoWM3BGcbDCNVpIyy/Y3F2gC3aNiGLxtFUdffVqO5Z5hhYG+DFT5KULWaxmeFFpdbvaQ==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -9654,9 +8999,9 @@
       }
     },
     "node_modules/prettier-plugin-tailwindcss": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.7.2.tgz",
-      "integrity": "sha512-LkphyK3Fw+q2HdMOoiEHWf93fNtYJwfamoKPl7UwtjFQdei/iIBoX11G6j706FzN3ymX9mPVi97qIY8328vdnA==",
+      "version": "0.7.4",
+      "resolved": "https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.7.4.tgz",
+      "integrity": "sha512-UKii4RjY05SNt/WQi6/NcOn/LsT0/ILLXsxygjbRg5/YZelsSu5jTqorYHPDGq4nZy5q5hpCu+XdGZ1xaJEQgw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9744,40 +9089,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/prisma": {
-      "version": "7.4.2",
-      "resolved": "https://registry.npmjs.org/prisma/-/prisma-7.4.2.tgz",
-      "integrity": "sha512-2bP8Ruww3Q95Z2eH4Yqh4KAENRsj/SxbdknIVBfd6DmjPwmpsC4OVFMLOeHt6tM3Amh8ebjvstrUz3V/hOe1dA==",
-      "hasInstallScript": true,
-      "license": "Apache-2.0",
-      "peer": true,
-      "dependencies": {
-        "@prisma/config": "7.4.2",
-        "@prisma/dev": "0.20.0",
-        "@prisma/engines": "7.4.2",
-        "@prisma/studio-core": "0.13.1",
-        "mysql2": "3.15.3",
-        "postgres": "3.4.7"
-      },
-      "bin": {
-        "prisma": "build/index.js"
-      },
-      "engines": {
-        "node": "^20.19 || ^22.12 || >=24.0"
-      },
-      "peerDependencies": {
-        "better-sqlite3": ">=9.0.0",
-        "typescript": ">=5.4.0"
-      },
-      "peerDependenciesMeta": {
-        "better-sqlite3": {
-          "optional": true
-        },
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/proc-log": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
@@ -9833,25 +9144,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/proper-lockfile": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/proper-lockfile/-/proper-lockfile-4.1.2.tgz",
-      "integrity": "sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "graceful-fs": "^4.2.4",
-        "retry": "^0.12.0",
-        "signal-exit": "^3.0.2"
-      }
-    },
-    "node_modules/proper-lockfile/node_modules/signal-exit": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
-      "license": "ISC",
-      "peer": true
-    },
     "node_modules/property-expr": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/property-expr/-/property-expr-2.0.6.tgz",
@@ -9875,9 +9167,9 @@
       }
     },
     "node_modules/pump": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.3.tgz",
-      "integrity": "sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==",
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
+      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9889,6 +9181,7 @@
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
       "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6"
@@ -9898,6 +9191,7 @@
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
       "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
+      "dev": true,
       "funding": [
         {
           "type": "individual",
@@ -9908,12 +9202,13 @@
           "url": "https://opencollective.com/fast-check"
         }
       ],
-      "license": "MIT"
+      "license": "MIT",
+      "optional": true
     },
     "node_modules/qs": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.0.tgz",
-      "integrity": "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==",
+      "version": "6.15.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
+      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -9998,6 +9293,23 @@
         "node": ">= 0.10"
       }
     },
+    "node_modules/raw-body/node_modules/iconv-lite": {
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
+      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/rc": {
       "version": "1.2.8",
       "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
@@ -10026,40 +9338,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/rc9": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/rc9/-/rc9-2.1.2.tgz",
-      "integrity": "sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "defu": "^6.1.4",
-        "destr": "^2.0.3"
-      }
-    },
-    "node_modules/react": {
-      "version": "19.2.4",
-      "resolved": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
-      "integrity": "sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/react-dom": {
-      "version": "19.2.4",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.4.tgz",
-      "integrity": "sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "scheduler": "^0.27.0"
-      },
-      "peerDependencies": {
-        "react": "^19.2.4"
-      }
-    },
     "node_modules/readable-stream": {
       "version": "3.6.2",
       "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
@@ -10078,6 +9356,7 @@
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
       "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 14.18.0"
@@ -10096,13 +9375,6 @@
         "node": ">= 12.13.0"
       }
     },
-    "node_modules/regexp-to-ast": {
-      "version": "0.5.0",
-      "resolved": "https://registry.npmjs.org/regexp-to-ast/-/regexp-to-ast-0.5.0.tgz",
-      "integrity": "sha512-tlbJqcMHnPKI9zSrystikWKwHkBqu2a/Sgw01h3zFjvYrMxEDYHzzoMZnUrbIfpTFEsoRnnviOXNCzFiSc54Qw==",
-      "license": "MIT",
-      "peer": true
-    },
     "node_modules/regexp-tree": {
       "version": "0.1.27",
       "resolved": "https://registry.npmjs.org/regexp-tree/-/regexp-tree-0.1.27.tgz",
@@ -10113,16 +9385,6 @@
         "regexp-tree": "bin/regexp-tree"
       }
     },
-    "node_modules/remeda": {
-      "version": "2.33.4",
-      "resolved": "https://registry.npmjs.org/remeda/-/remeda-2.33.4.tgz",
-      "integrity": "sha512-ygHswjlc/opg2VrtiYvUOPLjxjtdKvjGz1/plDhkG66hjNjFr1xmfrs2ClNFo/E6TyUFiwYNh53bKV26oBoMGQ==",
-      "license": "MIT",
-      "peer": true,
-      "funding": {
-        "url": "https://github.com/sponsors/remeda"
-      }
-    },
     "node_modules/require-from-string": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
@@ -10135,12 +9397,13 @@
       }
     },
     "node_modules/resolve": {
-      "version": "1.22.11",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
-      "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
+      "version": "1.22.12",
+      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
+      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
+        "es-errors": "^1.3.0",
         "is-core-module": "^2.16.1",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
@@ -10190,19 +9453,21 @@
       "version": "0.12.0",
       "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
       "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+      "dev": true,
       "license": "MIT",
+      "optional": true,
       "engines": {
         "node": ">= 4"
       }
     },
     "node_modules/rollup": {
-      "version": "4.57.1",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.57.1.tgz",
-      "integrity": "sha512-oQL6lgK3e2QZeQ7gcgIkS2YZPg5slw37hYufJ3edKlfQSGGm8ICoxswK15ntSzF/a8+h7ekRy7k7oWc3BQ7y8A==",
+      "version": "4.62.2",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.2.tgz",
+      "integrity": "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "1.0.8"
+        "@types/estree": "1.0.9"
       },
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -10212,31 +9477,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.57.1",
-        "@rollup/rollup-android-arm64": "4.57.1",
-        "@rollup/rollup-darwin-arm64": "4.57.1",
-        "@rollup/rollup-darwin-x64": "4.57.1",
-        "@rollup/rollup-freebsd-arm64": "4.57.1",
-        "@rollup/rollup-freebsd-x64": "4.57.1",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.57.1",
-        "@rollup/rollup-linux-arm-musleabihf": "4.57.1",
-        "@rollup/rollup-linux-arm64-gnu": "4.57.1",
-        "@rollup/rollup-linux-arm64-musl": "4.57.1",
-        "@rollup/rollup-linux-loong64-gnu": "4.57.1",
-        "@rollup/rollup-linux-loong64-musl": "4.57.1",
-        "@rollup/rollup-linux-ppc64-gnu": "4.57.1",
-        "@rollup/rollup-linux-ppc64-musl": "4.57.1",
-        "@rollup/rollup-linux-riscv64-gnu": "4.57.1",
-        "@rollup/rollup-linux-riscv64-musl": "4.57.1",
-        "@rollup/rollup-linux-s390x-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-gnu": "4.57.1",
-        "@rollup/rollup-linux-x64-musl": "4.57.1",
-        "@rollup/rollup-openbsd-x64": "4.57.1",
-        "@rollup/rollup-openharmony-arm64": "4.57.1",
-        "@rollup/rollup-win32-arm64-msvc": "4.57.1",
-        "@rollup/rollup-win32-ia32-msvc": "4.57.1",
-        "@rollup/rollup-win32-x64-gnu": "4.57.1",
-        "@rollup/rollup-win32-x64-msvc": "4.57.1",
+        "@rollup/rollup-android-arm-eabi": "4.62.2",
+        "@rollup/rollup-android-arm64": "4.62.2",
+        "@rollup/rollup-darwin-arm64": "4.62.2",
+        "@rollup/rollup-darwin-x64": "4.62.2",
+        "@rollup/rollup-freebsd-arm64": "4.62.2",
+        "@rollup/rollup-freebsd-x64": "4.62.2",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.62.2",
+        "@rollup/rollup-linux-arm-musleabihf": "4.62.2",
+        "@rollup/rollup-linux-arm64-gnu": "4.62.2",
+        "@rollup/rollup-linux-arm64-musl": "4.62.2",
+        "@rollup/rollup-linux-loong64-gnu": "4.62.2",
+        "@rollup/rollup-linux-loong64-musl": "4.62.2",
+        "@rollup/rollup-linux-ppc64-gnu": "4.62.2",
+        "@rollup/rollup-linux-ppc64-musl": "4.62.2",
+        "@rollup/rollup-linux-riscv64-gnu": "4.62.2",
+        "@rollup/rollup-linux-riscv64-musl": "4.62.2",
+        "@rollup/rollup-linux-s390x-gnu": "4.62.2",
+        "@rollup/rollup-linux-x64-gnu": "4.62.2",
+        "@rollup/rollup-linux-x64-musl": "4.62.2",
+        "@rollup/rollup-openbsd-x64": "4.62.2",
+        "@rollup/rollup-openharmony-arm64": "4.62.2",
+        "@rollup/rollup-win32-arm64-msvc": "4.62.2",
+        "@rollup/rollup-win32-ia32-msvc": "4.62.2",
+        "@rollup/rollup-win32-x64-gnu": "4.62.2",
+        "@rollup/rollup-win32-x64-msvc": "4.62.2",
         "fsevents": "~2.3.2"
       }
     },
@@ -10306,14 +9571,8 @@
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
       "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
-      "license": "MIT"
-    },
-    "node_modules/scheduler": {
-      "version": "0.27.0",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.27.0.tgz",
-      "integrity": "sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==",
-      "license": "MIT",
-      "peer": true
+      "dev": true,
+      "license": "MIT"
     },
     "node_modules/schemes": {
       "version": "1.4.0",
@@ -10344,10 +9603,10 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/semver": {
-      "version": "7.7.4",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
-      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
-      "dev": true,
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
+      "devOptional": true,
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -10383,12 +9642,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/seq-queue": {
-      "version": "0.0.5",
-      "resolved": "https://registry.npmjs.org/seq-queue/-/seq-queue-0.0.5.tgz",
-      "integrity": "sha512-hr3Wtp/GZIc/6DAGPDcV4/9WoZhjrkXsi5B/07QgX8tsdc6ilr7BFM6PM6rbdAX1kFSDYeZGLipIZZKyQP0O5Q==",
-      "peer": true
-    },
     "node_modules/serve-static": {
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
@@ -10410,9 +9663,9 @@
       }
     },
     "node_modules/set-cookie-parser": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.0.1.tgz",
-      "integrity": "sha512-n7Z7dXZhJbwuAHhNzkTti6Aw9QDDjZtm3JTpTGATIdNzdQz5GuFs22w90BcvF4INfnrL5xrX3oGsuqO5Dx3A1Q==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.1.0.tgz",
+      "integrity": "sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw==",
       "license": "MIT"
     },
     "node_modules/setprototypeof": {
@@ -10426,6 +9679,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -10438,21 +9692,22 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
       }
     },
     "node_modules/side-channel": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
-      "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
+      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3",
-        "side-channel-list": "^1.0.0",
+        "object-inspect": "^1.13.4",
+        "side-channel-list": "^1.0.1",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -10464,14 +9719,14 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
-      "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
+      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.3"
+        "object-inspect": "^1.13.4"
       },
       "engines": {
         "node": ">= 0.4"
@@ -10530,7 +9785,9 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
       "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
       "license": "ISC",
+      "optional": true,
       "engines": {
         "node": ">=14"
       },
@@ -10606,6 +9863,7 @@
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
       "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "engines": {
@@ -10628,13 +9886,14 @@
       }
     },
     "node_modules/socks": {
-      "version": "2.8.7",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
-      "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
+      "version": "2.8.9",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
+      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
+      "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "ip-address": "^10.0.1",
+        "ip-address": "^10.1.1",
         "smart-buffer": "^4.2.0"
       },
       "engines": {
@@ -10698,16 +9957,6 @@
         "source-map": "^0.6.0"
       }
     },
-    "node_modules/sparse-bitfield": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/sparse-bitfield/-/sparse-bitfield-3.0.3.tgz",
-      "integrity": "sha512-kvzhi7vqKTfkh0PZU+2D2PIllw2ymqJKujUcyPMd9Y75Nv4nPbGJZXNhxsgdQab2BmlDct1YnfQCguEvHr7VsQ==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "memory-pager": "^1.0.2"
-      }
-    },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
@@ -10719,6 +9968,17 @@
         "spdx-license-ids": "^3.0.0"
       }
     },
+    "node_modules/spdx-correct/node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
@@ -10727,9 +9987,9 @@
       "license": "CC-BY-3.0"
     },
     "node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-4.0.0.tgz",
+      "integrity": "sha512-Clya5JIij/7C6bRR22+tnGXbc4VKlibKSVj2iHvVeX5iMW7s1SIQlqu699JkODJJIhh/pUu8L0/VLh8xflD+LQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10765,16 +10025,6 @@
         "kysely": "*"
       }
     },
-    "node_modules/sqlstring": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/sqlstring/-/sqlstring-2.3.3.tgz",
-      "integrity": "sha512-qC9iz2FlN7DQl3+wjwn3802RTyjCx7sDvfQEXchwa6CWOx07/WVfh91gBmQ9fahw8snwGEWU3xGzOt4tFyHLxg==",
-      "license": "MIT",
-      "peer": true,
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/ssri": {
       "version": "12.0.0",
       "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
@@ -10807,9 +10057,10 @@
       }
     },
     "node_modules/std-env": {
-      "version": "3.10.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.10.0.tgz",
-      "integrity": "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz",
+      "integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==",
+      "devOptional": true,
       "license": "MIT"
     },
     "node_modules/stream-browserify": {
@@ -10822,6 +10073,17 @@
         "readable-stream": "^3.5.0"
       }
     },
+    "node_modules/streamx": {
+      "version": "2.28.0",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.28.0.tgz",
+      "integrity": "sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==",
+      "license": "MIT",
+      "dependencies": {
+        "events-universal": "^1.0.0",
+        "fast-fifo": "^1.3.2",
+        "text-decoder": "^1.1.0"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -11006,18 +10268,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/strnum": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.3.0.tgz",
-      "integrity": "sha512-ums3KNd42PGyx5xaoVTO1mjU1bH3NpY4vsrVlnv9PNGqQj8wd7rJ6nEypLrJ7z5vxK5RP0yMLo6J/Gsm62DI5Q==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/superstruct": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/superstruct/-/superstruct-2.0.2.tgz",
@@ -11033,7 +10283,7 @@
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
       "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "dev": true,
+      "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "has-flag": "^4.0.0"
@@ -11056,24 +10306,24 @@
       }
     },
     "node_modules/svelte": {
-      "version": "5.53.5",
-      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.53.5.tgz",
-      "integrity": "sha512-YkqERnF05g8KLdDZwZrF8/i1eSbj6Eoat8Jjr2IfruZz9StLuBqo8sfCSzjosNKd+ZrQ8DkKZDjpO5y3ht1Pow==",
+      "version": "5.56.3",
+      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.56.3.tgz",
+      "integrity": "sha512-w7JvrM5IFl5cmfbY0TLik9o7mjRUJmRMhOR51tBPu708Gr/MjbGs7VnJnr/B0CaXeI4vtnOh7RKxDr0cwhMdDA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/remapping": "^2.3.4",
         "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@sveltejs/acorn-typescript": "^1.0.5",
+        "@sveltejs/acorn-typescript": "^1.0.10",
         "@types/estree": "^1.0.5",
         "@types/trusted-types": "^2.0.7",
         "acorn": "^8.12.1",
         "aria-query": "5.3.1",
         "axobject-query": "^4.1.0",
         "clsx": "^2.1.1",
-        "devalue": "^5.6.3",
+        "devalue": "^5.8.1",
         "esm-env": "^1.2.1",
-        "esrap": "^2.2.2",
+        "esrap": "^2.2.11",
         "is-reference": "^3.0.3",
         "locate-character": "^3.0.0",
         "magic-string": "^0.30.11",
@@ -11084,13 +10334,14 @@
       }
     },
     "node_modules/svelte-check": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/svelte-check/-/svelte-check-4.4.3.tgz",
-      "integrity": "sha512-4HtdEv2hOoLCEsSXI+RDELk9okP/4sImWa7X02OjMFFOWeSdFF3NFy3vqpw0z+eH9C88J9vxZfUXz/Uv2A1ANw==",
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/svelte-check/-/svelte-check-4.6.0.tgz",
+      "integrity": "sha512-KhVnDFDSid57mmZtHz8gfW8AAGylOZ0vPnOIzVmAL+urzwK8sBYXRss953gD8T0OdgAQ11mdWhE6uadmtOz8TQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.25",
+        "@sveltejs/load-config": "0.1.1",
         "chokidar": "^4.0.1",
         "fdir": "^6.2.0",
         "picocolors": "^1.0.0",
@@ -11108,9 +10359,9 @@
       }
     },
     "node_modules/svelte-eslint-parser": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-1.4.1.tgz",
-      "integrity": "sha512-1eqkfQ93goAhjAXxZiu1SaKI9+0/sxp4JIWQwUpsz7ybehRE5L8dNuz7Iry7K22R47p5/+s9EM+38nHV2OlgXA==",
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-1.8.0.tgz",
+      "integrity": "sha512-mikR1qwIVy3t5WthUoAXkMwxkXvabZP9FJgdx35Ei7EbGWmctva1Pih16Koeor/bdNNq8NXHlwKGS6NkYTawLg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11119,11 +10370,12 @@
         "espree": "^10.0.0",
         "postcss": "^8.4.49",
         "postcss-scss": "^4.0.9",
-        "postcss-selector-parser": "^7.0.0"
+        "postcss-selector-parser": "^7.0.0",
+        "semver": "^7.7.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0",
-        "pnpm": "10.24.0"
+        "pnpm": "10.34.1"
       },
       "funding": {
         "url": "https://github.com/sponsors/ota-meshi"
@@ -11148,9 +10400,9 @@
       }
     },
     "node_modules/sveltekit-superforms": {
-      "version": "2.30.0",
-      "resolved": "https://registry.npmjs.org/sveltekit-superforms/-/sveltekit-superforms-2.30.0.tgz",
-      "integrity": "sha512-EzXD7sHbi7yBU/eNtzVm6P6axcrVM8BArkbiT96Vdx48s5m4KXte/tbbp3UULtEW8Nk9wt2hYkGeq7nDBwVceg==",
+      "version": "2.30.1",
+      "resolved": "https://registry.npmjs.org/sveltekit-superforms/-/sveltekit-superforms-2.30.1.tgz",
+      "integrity": "sha512-wBzyqsE0idvEJWuNJ+HCiAtdxa7Z55GZ8jmtlVHJfonrk9bRYC49MoPaloYyFoYuU3QPy6Omna/Qzn1kaIkgew==",
       "dev": true,
       "funding": [
         {
@@ -11168,26 +10420,26 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "devalue": "^5.6.3",
+        "devalue": "^5.6.4",
         "memoize-weak": "^1.0.2",
         "ts-deepmerge": "^7.0.3"
       },
       "optionalDependencies": {
         "@exodus/schemasafe": "^1.3.0",
-        "@standard-schema/spec": "^1.0.0",
+        "@standard-schema/spec": "^1.1.0",
         "@typeschema/class-validator": "^0.3.0",
-        "@valibot/to-json-schema": "^1.5.0",
+        "@valibot/to-json-schema": "^1.6.0",
         "@vinejs/vine": "^3.0.1",
-        "arktype": "^2.1.29",
-        "class-validator": "^0.14.3",
-        "effect": "^3.19.12",
+        "arktype": "^2.2.0",
+        "class-validator": "^0.14.4",
+        "effect": "^3.21.0",
         "joi": "^17.13.3",
         "json-schema-to-ts": "^3.1.1",
         "superstruct": "^2.0.2",
-        "typebox": "^1.0.62",
-        "valibot": "^1.2.0",
+        "typebox": "^1.1.6",
+        "valibot": "^1.3.1",
         "yup": "^1.7.1",
-        "zod": "^4.1.13",
+        "zod": "^4.3.6",
         "zod-v3-to-json-schema": "^4.0.0"
       },
       "peerDependencies": {
@@ -11197,7 +10449,7 @@
         "@vinejs/vine": "^1.8.0 || ^2.0.0 || ^3.0.0",
         "arktype": ">=2.0.0-rc.23",
         "class-validator": "^0.14.1",
-        "effect": "^3.13.7",
+        "effect": "^3.21.0",
         "joi": "^17.13.1",
         "superstruct": "^2.0.2",
         "svelte": "3.x || 4.x || >=5.0.0-next.51",
@@ -11245,14 +10497,22 @@
         }
       }
     },
+    "node_modules/sveltekit-superforms/node_modules/typebox": {
+      "version": "1.2.19",
+      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.2.19.tgz",
+      "integrity": "sha512-9stLVZhos9aUXJzu0Yf717xbcv3vFsE5APzsQ7j/honIUFtern451IdTlqmVzPzuGxHkeWwWc2cerw6m2lqKOQ==",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/synckit": {
-      "version": "0.11.12",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
-      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
+      "version": "0.11.13",
+      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz",
+      "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@pkgr/core": "^0.2.9"
+        "@pkgr/core": "^0.3.6"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -11262,9 +10522,9 @@
       }
     },
     "node_modules/tailwind-csstree": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/tailwind-csstree/-/tailwind-csstree-0.1.4.tgz",
-      "integrity": "sha512-FzD187HuFIZEyeR7Xy6sJbJll2d4SybS90satC8SKIuaNRC05CxMvdzN7BUsfDQffcnabckRM5OIcfArjsZ0mg==",
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/tailwind-csstree/-/tailwind-csstree-0.3.3.tgz",
+      "integrity": "sha512-je9J5UYRsTJqAjYrIBMMlge8T/rreRd44pJxgG5Zx/zeo4kAC/liUKqzztRZrGlYRJLvIf2Cb1DVJMTXSzEShA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -11273,19 +10533,27 @@
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/nzakas"
+      },
+      "peerDependencies": {
+        "@eslint/css": ">=1.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@eslint/css": {
+          "optional": true
+        }
       }
     },
     "node_modules/tailwindcss": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.2.1.tgz",
-      "integrity": "sha512-/tBrSQ36vCleJkAOsy9kbNTgaxvGbyOamC30PRePTQe/o1MFwEKHQk4Cn7BNGaPtjp+PuUrByJehM1hgxfq4sw==",
+      "version": "4.3.1",
+      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.1.tgz",
+      "integrity": "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/tapable": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.0.tgz",
-      "integrity": "sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==",
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
+      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11297,9 +10565,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.11",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.11.tgz",
-      "integrity": "sha512-ChjMH33/KetonMTAtpYdgUFr0tbz69Fp2v7zWxQfYZX4g5ZN2nOBXm1R2xyA+lMIKrLKIoKAwFj93jE/avX9cQ==",
+      "version": "7.5.16",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
+      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "optional": true,
@@ -11328,7 +10596,15 @@
         "tar-stream": "^2.1.4"
       }
     },
-    "node_modules/tar-stream": {
+    "node_modules/tar-fs/node_modules/chownr": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
+      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+      "dev": true,
+      "license": "ISC",
+      "optional": true
+    },
+    "node_modules/tar-fs/node_modules/tar-stream": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
       "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
@@ -11346,15 +10622,16 @@
         "node": ">=6"
       }
     },
-    "node_modules/tar/node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
-      "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true,
-      "engines": {
-        "node": ">=18"
+    "node_modules/tar-stream": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.2.0.tgz",
+      "integrity": "sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==",
+      "license": "MIT",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "bare-fs": "^4.5.5",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
       }
     },
     "node_modules/tdigest": {
@@ -11366,18 +10643,42 @@
         "bintrees": "1.0.2"
       }
     },
+    "node_modules/teex": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz",
+      "integrity": "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==",
+      "license": "MIT",
+      "dependencies": {
+        "streamx": "^2.12.5"
+      }
+    },
+    "node_modules/text-decoder": {
+      "version": "1.2.7",
+      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
+      "integrity": "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "b4a": "^1.6.4"
+      }
+    },
     "node_modules/thread-stream": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.0.0.tgz",
-      "integrity": "sha512-4iMVL6HAINXWf1ZKZjIPcz5wYaOdPhtO8ATvZ+Xqp3BTdaqtAwQkNmKORqcIo5YkQqGXq5cwfswDwMqqQNrpJA==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.2.0.tgz",
+      "integrity": "sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==",
       "license": "MIT",
       "dependencies": {
-        "real-require": "^0.2.0"
+        "real-require": "^1.0.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
+    "node_modules/thread-stream/node_modules/real-require": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-1.0.0.tgz",
+      "integrity": "sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==",
+      "license": "MIT"
+    },
     "node_modules/tiny-case": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/tiny-case/-/tiny-case-1.0.3.tgz",
@@ -11401,23 +10702,24 @@
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.0.2.tgz",
-      "integrity": "sha512-W/KYk+NFhkmsYpuHq5JykngiOCnxeVL8v8dFnqxSD8qEEdRfXk1SDM6JzNqcERbcGYj9tMrDQBYV9cjgnunFIg==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
+      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
+      "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.15",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
-      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "version": "0.2.17",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
+      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.3"
+        "picomatch": "^4.0.4"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -11427,9 +10729,9 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.0.3.tgz",
-      "integrity": "sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
+      "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -11464,19 +10766,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/tr46": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-5.1.1.tgz",
-      "integrity": "sha512-hdF5ZgjTqgAntKkklYw0R03MG2x/bSzTtkxmIRw/sTNV8YXsCJ1tfLAX23lhxhHJlEf3CRCOCGGWw3vI3GaSPw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "punycode": "^2.3.1"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/ts-algebra": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
@@ -11486,9 +10775,9 @@
       "optional": true
     },
     "node_modules/ts-api-utils": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.4.0.tgz",
-      "integrity": "sha512-3TaVTaAv2gTiMB35i3FiGJaRfwb3Pyn/j3m/bfAvGe8FB7CF6u+LMYqYlDh7reQf7UNvoTvdfAqHGmPGOSsPmA==",
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
+      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11564,10 +10853,26 @@
         "fsevents": "~2.3.3"
       }
     },
+    "node_modules/tsx/node_modules/@esbuild/aix-ppc64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tsx/node_modules/@esbuild/android-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
-      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
       "cpu": [
         "arm"
       ],
@@ -11581,9 +10886,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/android-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
-      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
       "cpu": [
         "arm64"
       ],
@@ -11597,9 +10902,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/android-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
-      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
       "cpu": [
         "x64"
       ],
@@ -11613,9 +10918,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
-      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
       "cpu": [
         "arm64"
       ],
@@ -11629,9 +10934,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
-      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
       "cpu": [
         "x64"
       ],
@@ -11645,9 +10950,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
-      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
       "cpu": [
         "arm64"
       ],
@@ -11661,9 +10966,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
-      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
       "cpu": [
         "x64"
       ],
@@ -11677,9 +10982,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-arm": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
-      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
       "cpu": [
         "arm"
       ],
@@ -11693,9 +10998,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
-      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
       "cpu": [
         "arm64"
       ],
@@ -11709,9 +11014,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
-      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
       "cpu": [
         "ia32"
       ],
@@ -11725,9 +11030,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
-      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
       "cpu": [
         "loong64"
       ],
@@ -11741,9 +11046,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
-      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
       "cpu": [
         "mips64el"
       ],
@@ -11757,9 +11062,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
-      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
       "cpu": [
         "ppc64"
       ],
@@ -11773,9 +11078,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
-      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
       "cpu": [
         "riscv64"
       ],
@@ -11789,9 +11094,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
-      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
       "cpu": [
         "s390x"
       ],
@@ -11805,9 +11110,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.0.tgz",
-      "integrity": "sha512-us0dSb9iFxIi8srnpl931Nvs65it/Jd2a2K3qs7fz2WfGPHqzfzZTfec7oxZJRNPXPnNYZtanmRc4AL/JwVzHQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
       "cpu": [
         "x64"
       ],
@@ -11820,10 +11125,26 @@
         "node": ">=18"
       }
     },
+    "node_modules/tsx/node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tsx/node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
       "cpu": [
         "x64"
       ],
@@ -11836,10 +11157,26 @@
         "node": ">=18"
       }
     },
+    "node_modules/tsx/node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tsx/node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
-      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
       "cpu": [
         "x64"
       ],
@@ -11852,10 +11189,26 @@
         "node": ">=18"
       }
     },
+    "node_modules/tsx/node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "cpu": [
+        "arm64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tsx/node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
-      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
       "cpu": [
         "x64"
       ],
@@ -11869,9 +11222,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
-      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
       "cpu": [
         "arm64"
       ],
@@ -11885,9 +11238,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
-      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
       "cpu": [
         "ia32"
       ],
@@ -11901,9 +11254,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/win32-x64": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
-      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
       "cpu": [
         "x64"
       ],
@@ -11917,9 +11270,9 @@
       }
     },
     "node_modules/tsx/node_modules/esbuild": {
-      "version": "0.28.0",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.0.tgz",
-      "integrity": "sha512-sNR9MHpXSUV/XB4zmsFKN+QgVG82Cc7+/aaxJ8Adi8hyOac+EXptIp45QBPaVyX3N70664wRbTcLTOemCAnyqw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -11930,32 +11283,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.0",
-        "@esbuild/android-arm": "0.28.0",
-        "@esbuild/android-arm64": "0.28.0",
-        "@esbuild/android-x64": "0.28.0",
-        "@esbuild/darwin-arm64": "0.28.0",
-        "@esbuild/darwin-x64": "0.28.0",
-        "@esbuild/freebsd-arm64": "0.28.0",
-        "@esbuild/freebsd-x64": "0.28.0",
-        "@esbuild/linux-arm": "0.28.0",
-        "@esbuild/linux-arm64": "0.28.0",
-        "@esbuild/linux-ia32": "0.28.0",
-        "@esbuild/linux-loong64": "0.28.0",
-        "@esbuild/linux-mips64el": "0.28.0",
-        "@esbuild/linux-ppc64": "0.28.0",
-        "@esbuild/linux-riscv64": "0.28.0",
-        "@esbuild/linux-s390x": "0.28.0",
-        "@esbuild/linux-x64": "0.28.0",
-        "@esbuild/netbsd-arm64": "0.28.0",
-        "@esbuild/netbsd-x64": "0.28.0",
-        "@esbuild/openbsd-arm64": "0.28.0",
-        "@esbuild/openbsd-x64": "0.28.0",
-        "@esbuild/openharmony-arm64": "0.28.0",
-        "@esbuild/sunos-x64": "0.28.0",
-        "@esbuild/win32-arm64": "0.28.0",
-        "@esbuild/win32-ia32": "0.28.0",
-        "@esbuild/win32-x64": "0.28.0"
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
       }
     },
     "node_modules/tsx/node_modules/fsevents": {
@@ -12014,27 +11367,37 @@
       }
     },
     "node_modules/type-is": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.0.1.tgz",
-      "integrity": "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "content-type": "^1.0.5",
+        "content-type": "^2.0.0",
         "media-typer": "^1.1.0",
         "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/typebox": {
-      "version": "1.0.81",
-      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.0.81.tgz",
-      "integrity": "sha512-bCslZUmZESHhBn4kHDghzH2oo3qu8m2W89xDLxQHv/aPvY4i81Nd1jvijlBp9wSpsVytDSfSoosbiBAjgsNb2Q==",
+    "node_modules/type-is/node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
     },
     "node_modules/typescript": {
       "version": "5.9.3",
@@ -12051,16 +11414,16 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.56.1",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.56.1.tgz",
-      "integrity": "sha512-U4lM6pjmBX7J5wk4szltF7I1cGBHXZopnAXCMXb3+fZ3B/0Z3hq3wS/CCUB2NZBNAExK92mCU2tEohWuwVMsDQ==",
+      "version": "8.62.0",
+      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.0.tgz",
+      "integrity": "sha512-8QxXi+ZACKX0kaqO4gY8kn0RSD9gFfaHDWwjqtEN48aWCBkX4MJaufWN+c3BzlrXLOxfywDL8CaoqUwcRq4j4Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.56.1",
-        "@typescript-eslint/parser": "8.56.1",
-        "@typescript-eslint/typescript-estree": "8.56.1",
-        "@typescript-eslint/utils": "8.56.1"
+        "@typescript-eslint/eslint-plugin": "8.62.0",
+        "@typescript-eslint/parser": "8.62.0",
+        "@typescript-eslint/typescript-estree": "8.62.0",
+        "@typescript-eslint/utils": "8.62.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -12071,7 +11434,7 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.0.0"
+        "typescript": ">=4.8.4 <6.1.0"
       }
     },
     "node_modules/ufo": {
@@ -12082,18 +11445,18 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "7.24.4",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.24.4.tgz",
-      "integrity": "sha512-BM/JzwwaRXxrLdElV2Uo6cTLEjhSb3WXboncJamZ15NgUURmvlXvxa6xkwIOILIjPNo9i8ku136ZvWV0Uly8+w==",
+      "version": "7.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
+      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"
       }
     },
     "node_modules/undici-types": {
-      "version": "7.16.0",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",
-      "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==",
+      "version": "7.18.2",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
+      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
       "devOptional": true,
       "license": "MIT"
     },
@@ -12234,9 +11597,9 @@
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "13.0.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-13.0.2.tgz",
-      "integrity": "sha512-vzi9uRZ926x4XV73S/4qQaTwPXM2JBj6/6lI/byHH1jOpCzb0zDbfytgA9LcN/hzb2l7WQSQnxITOVx5un/wGw==",
+      "version": "14.0.1",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
+      "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
@@ -12248,9 +11611,10 @@
       }
     },
     "node_modules/valibot": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.2.0.tgz",
-      "integrity": "sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==",
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.4.1.tgz",
+      "integrity": "sha512-klCmFTz2jeDluy9RwX+F884TCiogtdBJ/YaxSx1EOBYXa3NXNWj8kR1jjN8rzluwojJVWWaHJ4r1U5LfICnM3g==",
+      "dev": true,
       "license": "MIT",
       "peerDependencies": {
         "typescript": ">=5"
@@ -12272,10 +11636,21 @@
         "spdx-expression-parse": "^3.0.0"
       }
     },
+    "node_modules/validate-npm-package-license/node_modules/spdx-expression-parse": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "spdx-exceptions": "^2.1.0",
+        "spdx-license-ids": "^3.0.0"
+      }
+    },
     "node_modules/validator": {
-      "version": "13.15.26",
-      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
-      "integrity": "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==",
+      "version": "13.15.35",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.35.tgz",
+      "integrity": "sha512-TQ5pAGhd5whStmqWvYF4OjQROlmv9SMFVt37qoCBdqRffuuklWYQlCNnEs2ZaIBD1kZRNnikiZOS1eqgkar0iw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -12294,9 +11669,9 @@
       }
     },
     "node_modules/vite": {
-      "version": "7.3.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.1.tgz",
-      "integrity": "sha512-w+N7Hifpc3gRjZ63vYBXA56dvvRlNWRczTdmCBBa+CotUzAPf5b7YMdMR/8CQoeYE5LX3W4wj6RYTgonm1b9DA==",
+      "version": "7.3.5",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.5.tgz",
+      "integrity": "sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -12841,9 +12216,9 @@
       }
     },
     "node_modules/vitefu": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/vitefu/-/vitefu-1.1.1.tgz",
-      "integrity": "sha512-B/Fegf3i8zh0yFbpzZ21amWzHmuNlLlmJT6n7bu5e+pCHUKQIfXSYokrqOBGEMMe9UG2sostKQF9mml/vYaWJQ==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/vitefu/-/vitefu-1.1.3.tgz",
+      "integrity": "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg==",
       "devOptional": true,
       "license": "MIT",
       "workspaces": [
@@ -12852,7 +12227,7 @@
         "tests/projects/workspace/packages/*"
       ],
       "peerDependencies": {
-        "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0-beta.0"
+        "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
         "vite": {
@@ -12861,31 +12236,31 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.0.18",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.0.18.tgz",
-      "integrity": "sha512-hOQuK7h0FGKgBAas7v0mSAsnvrIgAvWmRFjmzpJ7SwFHH3g1k2u37JtYwOwmEKhK6ZO3v9ggDBBm0La1LCK4uQ==",
+      "version": "4.1.9",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
+      "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.0.18",
-        "@vitest/mocker": "4.0.18",
-        "@vitest/pretty-format": "4.0.18",
-        "@vitest/runner": "4.0.18",
-        "@vitest/snapshot": "4.0.18",
-        "@vitest/spy": "4.0.18",
-        "@vitest/utils": "4.0.18",
-        "es-module-lexer": "^1.7.0",
-        "expect-type": "^1.2.2",
+        "@vitest/expect": "4.1.9",
+        "@vitest/mocker": "4.1.9",
+        "@vitest/pretty-format": "4.1.9",
+        "@vitest/runner": "4.1.9",
+        "@vitest/snapshot": "4.1.9",
+        "@vitest/spy": "4.1.9",
+        "@vitest/utils": "4.1.9",
+        "es-module-lexer": "^2.0.0",
+        "expect-type": "^1.3.0",
         "magic-string": "^0.30.21",
         "obug": "^2.1.1",
         "pathe": "^2.0.3",
         "picomatch": "^4.0.3",
-        "std-env": "^3.10.0",
+        "std-env": "^4.0.0-rc.1",
         "tinybench": "^2.9.0",
         "tinyexec": "^1.0.2",
         "tinyglobby": "^0.2.15",
-        "tinyrainbow": "^3.0.3",
-        "vite": "^6.0.0 || ^7.0.0",
+        "tinyrainbow": "^3.1.0",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
         "why-is-node-running": "^2.3.0"
       },
       "bin": {
@@ -12901,12 +12276,15 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.0.18",
-        "@vitest/browser-preview": "4.0.18",
-        "@vitest/browser-webdriverio": "4.0.18",
-        "@vitest/ui": "4.0.18",
+        "@vitest/browser-playwright": "4.1.9",
+        "@vitest/browser-preview": "4.1.9",
+        "@vitest/browser-webdriverio": "4.1.9",
+        "@vitest/coverage-istanbul": "4.1.9",
+        "@vitest/coverage-v8": "4.1.9",
+        "@vitest/ui": "4.1.9",
         "happy-dom": "*",
-        "jsdom": "*"
+        "jsdom": "*",
+        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
         "@edge-runtime/vm": {
@@ -12927,6 +12305,12 @@
         "@vitest/browser-webdriverio": {
           "optional": true
         },
+        "@vitest/coverage-istanbul": {
+          "optional": true
+        },
+        "@vitest/coverage-v8": {
+          "optional": true
+        },
         "@vitest/ui": {
           "optional": true
         },
@@ -12935,13 +12319,16 @@
         },
         "jsdom": {
           "optional": true
+        },
+        "vite": {
+          "optional": false
         }
       }
     },
     "node_modules/vitest-browser-svelte": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/vitest-browser-svelte/-/vitest-browser-svelte-2.0.2.tgz",
-      "integrity": "sha512-OLJVYoIYflwToFIy3s41pZ9mVp6dwXfYd8IIsWoc57g8DyN3SxsNJ5GB1xWFPxLFlKM+1MPExjPxLaqdELrfRQ==",
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/vitest-browser-svelte/-/vitest-browser-svelte-2.1.1.tgz",
+      "integrity": "sha512-qbunYRSm+N92r9bfTkdDTpBZESLmp4QFz2SluV3n/x8U7ysosfeXYJZ4vXbJ0Y0LzoqqDnV5LHprmFgn4Eo+Ug==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12955,16 +12342,6 @@
         "vitest": "^4.0.0"
       }
     },
-    "node_modules/webidl-conversions": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-7.0.0.tgz",
-      "integrity": "sha512-VwddBukDzu71offAQR975unBIGqfKZpM+8ZX6ySk8nYhVoo5CYaZyzt3YBvYtRtO+aoGlqxPg/B87NGVZ/fu6g==",
-      "license": "BSD-2-Clause",
-      "peer": true,
-      "engines": {
-        "node": ">=12"
-      }
-    },
     "node_modules/webpack-virtual-modules": {
       "version": "0.6.2",
       "resolved": "https://registry.npmjs.org/webpack-virtual-modules/-/webpack-virtual-modules-0.6.2.tgz",
@@ -12972,24 +12349,11 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/whatwg-url": {
-      "version": "14.2.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-14.2.0.tgz",
-      "integrity": "sha512-De72GdQZzNTUBBChsXueQUnPKDkg/5A5zp7pFDuQAj5UFoENpiACU0wlCvzpAGnTkj++ihpKwKyYewn/XNUbKw==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "tr46": "^5.1.0",
-        "webidl-conversions": "^7.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
@@ -13138,9 +12502,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -13159,21 +12523,6 @@
         }
       }
     },
-    "node_modules/xml-naming": {
-      "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
-      "integrity": "sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/NaturalIntelligence"
-        }
-      ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=16.0.0"
-      }
-    },
     "node_modules/xmlbuilder2": {
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/xmlbuilder2/-/xmlbuilder2-4.0.3.tgz",
@@ -13237,17 +12586,6 @@
         "type-fest": "^2.19.0"
       }
     },
-    "node_modules/zeptomatch": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/zeptomatch/-/zeptomatch-2.1.0.tgz",
-      "integrity": "sha512-KiGErG2J0G82LSpniV0CtIzjlJ10E04j02VOudJsPyPwNZgGnRKQy7I1R7GMyg/QswnE4l7ohSGrQbQbjXPPDA==",
-      "license": "MIT",
-      "peer": true,
-      "dependencies": {
-        "grammex": "^3.1.11",
-        "graphmatch": "^1.1.0"
-      }
-    },
     "node_modules/zimmerframe": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
@@ -13256,9 +12594,9 @@
       "license": "MIT"
     },
     "node_modules/zod": {
-      "version": "4.3.6",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.3.6.tgz",
-      "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
@@ -13274,31 +12612,6 @@
       "peerDependencies": {
         "zod": "^3.25 || ^4.0.14"
       }
-    },
-    "trino-js-client": {
-      "name": "trino-client",
-      "version": "0.2.9",
-      "extraneous": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "axios": "1.13.2"
-      },
-      "devDependencies": {
-        "@eslint/js": "9.25.1",
-        "@types/eslint__js": "^8.42.3",
-        "@types/jest": "^30.0.0",
-        "@types/node": "^24.2.0",
-        "eslint": "9.39.1",
-        "eslint-plugin-jest": "^29.0.1",
-        "jest": "^30.0.5",
-        "jiti": "^2.4.0",
-        "prettier": "^3.0.0",
-        "ts-jest": "^29.2.5",
-        "ts-node": "^10.9.2",
-        "typedoc": "^0.28.3",
-        "typescript": "^5.6.3",
-        "typescript-eslint": "^8.14.0"
-      }
     }
   }
 }
diff --git a/package.json b/package.json
index 1e0d153c..e843e7f1 100644
--- a/package.json
+++ b/package.json
@@ -39,8 +39,11 @@
     "@sveltejs/kit": "^2.53.0",
     "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@tailwindcss/vite": "^4.2.1",
+    "@types/adm-zip": "^0.5.8",
     "@types/node": "^24",
+    "@types/papaparse": "^5.5.2",
     "@types/pg": "^8.20.0",
+    "@types/tar-stream": "^3.1.4",
     "@vitest/browser-playwright": "^4.0.18",
     "@vitest/coverage-v8": "^4.0.18",
     "antlr-ng": "^1.0.10",
@@ -73,6 +76,7 @@
     "@aws-sdk/client-s3": "^3.1041.0",
     "@aws-sdk/lib-storage": "^3.1045.0",
     "@internationalized/date": "^3.11.0",
+    "adm-zip": "^0.5.17",
     "antlr4-c3": "^3.4.4",
     "antlr4ng": "^3.0.16",
     "better-auth": "^1.5.4",
@@ -80,10 +84,17 @@
     "hyparquet": "^1.25.8",
     "hyparquet-compressors": "^1.1.1",
     "monaco-editor": "^0.55.1",
+    "papaparse": "^5.5.3",
     "pg": "^8.21.0",
     "pino": "^10.3.1",
     "pretty-bytes": "^7.1.0",
     "prom-client": "^15.1.3",
+    "tar-stream": "^3.2.0",
     "undici": "^7.24.4"
+  },
+  "overrides": {
+    "sveltekit-superforms": {
+      "typebox": "1.2.19"
+    }
   }
 }
diff --git a/src/lib/components/Modal.svelte b/src/lib/components/Modal.svelte
index 1f648e54..111d81de 100644
--- a/src/lib/components/Modal.svelte
+++ b/src/lib/components/Modal.svelte
@@ -33,6 +33,20 @@
     }
   }
 
+  // Firefox does not reliably close <dialog> on Escape via the cancel event,
+  // so we handle Escape at the window level as a fallback.
+  $effect(() => {
+    function onKeyDown(e: KeyboardEvent) {
+      if (e.key !== 'Escape') return;
+      if (!dialogEl?.open) return;
+      e.preventDefault();
+      if (closeguard && !closeguard()) return;
+      open = false;
+    }
+    window.addEventListener('keydown', onKeyDown);
+    return () => window.removeEventListener('keydown', onKeyDown);
+  });
+
   function handleBackdropClick(e: MouseEvent) {
     // The click target is the <dialog> element itself only when the backdrop is
     // clicked; clicks inside the content bubble up to child elements instead.
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index b060bfdc..cff1fa3c 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -89,27 +89,31 @@
       key: 'pin' as ActionName,
       icon: IconPushPinOutline as Component,
       label: m.storage_action_pin(),
-      disabled: !storage.canPin,
-      hidden: !storage.canPin || storage.ctxIsPinned
+      disabled: !storage.canPin || storage.isInArchive,
+      hidden: !storage.canPin || storage.ctxIsPinned || storage.isInArchive
     },
     {
       key: 'unpin' as ActionName,
       icon: IconPushPin as Component,
       label: m.storage_action_unpin(),
-      disabled: !storage.ctxIsPinned,
-      hidden: !storage.ctxIsPinned
+      disabled: !storage.ctxIsPinned || storage.isInArchive,
+      hidden: !storage.ctxIsPinned || storage.isInArchive
     }
   ]);
 
-  const dangerActions = $derived([
-    {
-      key: 'delete' as ActionName,
-      icon: IconDelete as Component,
-      label: m.storage_action_delete(),
-      disabled: selectionCount === 0,
-      class: 'text-error'
-    }
-  ]);
+  const dangerActions = $derived(
+    storage.isInArchive
+      ? []
+      : [
+          {
+            key: 'delete' as ActionName,
+            icon: IconDelete as Component,
+            label: m.storage_action_delete(),
+            disabled: selectionCount === 0,
+            class: 'text-error'
+          }
+        ]
+  );
 </script>
 
 <svelte:window onkeydown={handleKeydown} />
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 7d84d965..a5552d4a 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -102,7 +102,7 @@
   <StorageBreadcrumb />
 
   <div bind:this={objectListEl} class="relative min-h-0 flex-1 overflow-hidden">
-    {#if storage.loading || storage.deleting || navigating.to}
+    {#if storage.loading || storage.deleting || storage.archiveLoading || navigating.to}
       <div
         class="bg-base-100/70 absolute inset-0 z-20 flex items-center justify-center"
         aria-live="polite"
diff --git a/src/lib/components/storage/explorer/FileRow.svelte b/src/lib/components/storage/explorer/FileRow.svelte
index dc3d3408..bd1e64da 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte
+++ b/src/lib/components/storage/explorer/FileRow.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
-  import { keyToName, formatFileSize } from '$lib/storage/utils.js';
+  import { keyToName, formatFileSize, isArchiveExtension } from '$lib/storage/utils.js';
   import type { StorageObject } from '$lib/storage/types.js';
   import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
   import FileIconAndName from './file-icon/FileIconAndName.svelte';
@@ -16,6 +16,7 @@
 
   const selected = $derived(storage.selectedKeys.has(file.key));
   const isCtx = $derived(storage.contextMenu?.key === file.key);
+  const isArchive = $derived(isArchiveExtension(file.key));
 </script>
 
 <tr
@@ -27,7 +28,13 @@
       ? 'bg-primary/10 hover:bg-primary/15'
       : 'hover:bg-base-200/60'}"
   onclick={(e) => storage.toggleSelect(file.key, e.ctrlKey || e.metaKey)}
-  ondblclick={() => storage.executeAction('preview')}
+  ondblclick={() => {
+    if (isArchive) {
+      void storage.enterArchive(file.key);
+    } else {
+      storage.executeAction('preview');
+    }
+  }}
   oncontextmenu={(e) => storage.openContextMenu(e, file.key)}
 >
   <td class="pr-0">
diff --git a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
index f9ddf182..a96395da 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
@@ -134,6 +134,50 @@ describe('FileRow', () => {
     expect(spy).toHaveBeenCalledWith('preview');
   });
 
+  it('should call enterArchive on double click for zip files', async () => {
+    const file = makeFile({ key: 'archive.zip', contentType: 'application/zip' });
+    const state = createState([file]);
+    const spy = vi.spyOn(state, 'enterArchive');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByRole('row').dblClick();
+    expect(spy).toHaveBeenCalledWith('archive.zip');
+  });
+
+  it('should call enterArchive on double click for tar.gz files', async () => {
+    const file = makeFile({ key: 'bundle.tar.gz', contentType: 'application/gzip' });
+    const state = createState([file]);
+    const spy = vi.spyOn(state, 'enterArchive');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByRole('row').dblClick();
+    expect(spy).toHaveBeenCalledWith('bundle.tar.gz');
+  });
+
+  it('should call enterArchive on double click for nested archive inside an archive', async () => {
+    const file = makeFile({ key: 'nested.zip', contentType: undefined });
+    const state = createState([file]);
+    state.archiveKey = 'outer.zip';
+    state.archivePrefix = '';
+    const spy = vi.spyOn(state, 'enterArchive');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByRole('row').dblClick();
+    expect(spy).toHaveBeenCalledWith('nested.zip');
+  });
+
+  it('should call executeAction preview on double click for non-archive file inside archive', async () => {
+    const file = makeFile({ key: 'readme.txt', contentType: 'text/plain' });
+    const state = createState([file]);
+    state.archiveKey = 'outer.zip';
+    state.archivePrefix = '';
+    const spy = vi.spyOn(state, 'executeAction');
+    render(FileRowWrapper, { state, file });
+
+    await page.getByRole('row').dblClick();
+    expect(spy).toHaveBeenCalledWith('preview');
+  });
+
   it('should call openContextMenu on right click', async () => {
     const file = makeFile({ key: 'ctx.txt', contentType: 'text/plain' });
     const state = createState([file]);
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte b/src/lib/components/storage/explorer/FolderRow.svelte
index f25da5c7..dd1a7821 100644
--- a/src/lib/components/storage/explorer/FolderRow.svelte
+++ b/src/lib/components/storage/explorer/FolderRow.svelte
@@ -28,13 +28,19 @@
   onclick={(e) => {
     if (storage.selectionMode || e.ctrlKey || e.metaKey) {
       storage.toggleSelect(folder.key, true);
+    } else if (storage.isInArchive) {
+      storage.navigateInArchive(folder.key);
     } else {
       storage.navigate(folder.key);
     }
   }}
   ondblclick={(e) => {
     if (e.ctrlKey || e.metaKey) {
-      storage.navigate(folder.key);
+      if (storage.isInArchive) {
+        storage.navigateInArchive(folder.key);
+      } else {
+        storage.navigate(folder.key);
+      }
     }
   }}
   oncontextmenu={(e) => storage.openContextMenu(e, folder.key)}
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 66f185b6..82bd9853 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -2,6 +2,7 @@
   import * as m from '$lib/paraglide/messages.js';
   import IconArrowBack from 'virtual:icons/material-symbols/arrow-back';
   import IconFolderOpen from 'virtual:icons/material-symbols/folder-open';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
   import SelectionToolbar from './SelectionToolbar.svelte';
   import FolderRow from './FolderRow.svelte';
   import FileRow from './FileRow.svelte';
@@ -15,6 +16,10 @@
   });
 
   function navigateUp() {
+    if (storage.isInArchive) {
+      storage.navigateUpFromArchive();
+      return;
+    }
     if (!storage.prefix) return;
     const withoutTrailing = storage.prefix.slice(0, -1);
     const lastSlash = withoutTrailing.lastIndexOf('/');
@@ -70,24 +75,34 @@
         </tr>
       {/if}
 
-      <!-- Folders -->
-      {#each storage.folders as folder (folder.key)}
-        <FolderRow {folder} />
-      {/each}
-
-      <!-- Files -->
-      {#each storage.files as file (file.key)}
-        <FileRow {file} />
-      {/each}
-
-      <!-- Empty folder -->
-      {#if storage.folders.length === 0 && storage.files.length === 0}
+      {#if storage.archiveTooLarge}
+        <!-- Archive too large fallback -->
         <tr>
-          <td colspan={5} class="text-base-content/40 py-16 text-center">
-            <IconFolderOpen class="mx-auto mb-3 size-10 opacity-30" aria-hidden="true" />
-            {m.storage_bucket_empty()}
+          <td colspan={5} class="py-16 text-center">
+            <IconWarning class="text-warning mx-auto mb-3 size-10" aria-hidden="true" />
+            <p class="text-base-content font-semibold">{m.storage_archive_too_large()}</p>
           </td>
         </tr>
+      {:else}
+        <!-- Folders -->
+        {#each storage.folders as folder (folder.key)}
+          <FolderRow {folder} />
+        {/each}
+
+        <!-- Files -->
+        {#each storage.files as file (file.key)}
+          <FileRow {file} />
+        {/each}
+
+        <!-- Empty folder -->
+        {#if storage.folders.length === 0 && storage.files.length === 0}
+          <tr>
+            <td colspan={5} class="text-base-content/40 py-16 text-center">
+              <IconFolderOpen class="mx-auto mb-3 size-10 opacity-30" aria-hidden="true" />
+              {m.storage_bucket_empty()}
+            </td>
+          </tr>
+        {/if}
       {/if}
     </tbody>
   </table>
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
index b5c7f4be..d78bad36 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -44,18 +44,20 @@
         {m.storage_action_download()}
       </button>
 
-      <button
-        class="
-          btn btn-ghost btn-xs gap-1
-          {selectedCount > 0 ? 'text-error hover:bg-error/10' : ''}
-        "
-        title="{m.storage_action_delete()} (Del)"
-        onclick={() => storage.executeAction('delete')}
-        disabled={selectedCount === 0}
-      >
-        <IconDelete class="size-3.5" aria-hidden="true" />
-        {m.storage_action_delete()}
-      </button>
+      {#if !storage.isInArchive}
+        <button
+          class="
+            btn btn-ghost btn-xs gap-1
+            {selectedCount > 0 ? 'text-error hover:bg-error/10' : ''}
+          "
+          title="{m.storage_action_delete()} (Del)"
+          onclick={() => storage.executeAction('delete')}
+          disabled={selectedCount === 0}
+        >
+          <IconDelete class="size-3.5" aria-hidden="true" />
+          {m.storage_action_delete()}
+        </button>
+      {/if}
 
       <div class="ml-auto">
         <button
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 94602e2a..6a78aa78 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -10,12 +10,14 @@
   import IconMoreVert from 'virtual:icons/material-symbols/more-vert';
   import IconPushPin from 'virtual:icons/material-symbols/push-pin';
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
+  import IconFolderZip from 'virtual:icons/material-symbols/folder-zip';
   import IconTab from 'virtual:icons/material-symbols/tab';
   import IconAdd from 'virtual:icons/material-symbols/add';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import { getTabsState } from '$lib/storage/tabs-context.js';
   import type { StorageLocation } from '$lib/storage/types.js';
+  import { keyToName } from '$lib/storage/utils.js';
   import { invalidateAll } from '$app/navigation';
   import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 
@@ -34,6 +36,28 @@
       : []
   );
 
+  const archiveParts = $derived(
+    storage.isInArchive && storage.archiveKey
+      ? [
+          ...(storage.archivePrefix
+            ? storage.archivePrefix
+                .replace(/\/$/, '')
+                .split('/')
+                .map((label, i, parts) => ({
+                  label,
+                  isArchive: false,
+                  prefix: parts.slice(0, i + 1).join('/') + '/'
+                }))
+            : [])
+        ]
+      : []
+  );
+
+  const archiveName = $derived(storage.archiveKey ? keyToName(storage.archiveKey) : '');
+  const nestedArchiveName = $derived(
+    storage.archiveNestedPath ? keyToName(storage.archiveNestedPath) : ''
+  );
+
   const MAX_TAIL = 2;
   const collapsedParts = $derived(
     breadcrumbParts.length > MAX_TAIL ? breadcrumbParts.slice(0, -MAX_TAIL) : []
@@ -129,6 +153,18 @@
   function closeBreadcrumbCtx() {
     breadcrumbCtx = null;
   }
+
+  /** Navigate to an S3 prefix, clearing archive state first. */
+  function navigateS3(prefix: string) {
+    if (storage.isInArchive) {
+      storage.archiveKey = null;
+      storage.archivePrefix = '';
+      storage.archiveNestedPath = null;
+      storage.previousS3Prefix = '';
+      storage.archiveLoading = false;
+    }
+    storage.navigate(prefix);
+  }
 </script>
 
 {#if breadcrumbCtx}
@@ -155,6 +191,7 @@
       <button
         role="menuitem"
         class="justify-start {breadcrumbIsPinned ? 'text-error' : ''}"
+        title={breadcrumbIsPinned ? m.storage_action_unpin() : m.storage_action_pin()}
         onclick={() => {
           if (storage.bookmarks.isPinned(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix)) {
             storage.bookmarks.unpin(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
@@ -184,10 +221,10 @@
   >
     <button
       class="
-          tooltip tooltip-bottom btn btn-ghost btn-xs group/pin z-60 size-5 p-0
+          btn btn-ghost btn-xs group/pin z-60 size-5 p-0
           {pinned ? 'hover:text-error' : 'hover:text-white'}
         "
-      data-tip={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
+      title={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
       aria-label={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
       onclick={() => {
         if (pinned) {
@@ -221,7 +258,7 @@
     flex min-w-0 flex-1 items-center gap-1 text-sm
   "
   >
-    {#if breadcrumbParts.length === 0}
+    {#if breadcrumbParts.length === 0 && !storage.isInArchive}
       <span class="group flex shrink-0 items-center gap-1">
         <!-- svelte-ignore a11y_no_static_element_interactions -->
         <span
@@ -247,7 +284,7 @@
             py-0.5 transition-colors hover:cursor-pointer
           "
           title={storage.bucket}
-          onclick={() => storage.navigate('')}
+          onclick={() => navigateS3('')}
           oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, '')}
         >
           <IconStorage class="size-4" aria-hidden="true" />
@@ -288,7 +325,7 @@
               <div class="group flex items-center justify-between gap-2">
                 <button
                   class="flex-1 text-left text-sm hover:cursor-pointer"
-                  onclick={() => storage.navigate(part.prefix)}
+                  onclick={() => navigateS3(part.prefix)}
                   oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
                 >
                   {part.label}
@@ -301,7 +338,7 @@
       </div>
     {/if}
     {#each visibleParts as part, i (part.prefix)}
-      {@const isCurrent = i === visibleParts.length - 1}
+      {@const isCurrent = !storage.isInArchive && i === visibleParts.length - 1}
       <IconChevronRight
         class="text-base-content/30 pointer-events-none size-4 shrink-0"
         aria-hidden="true"
@@ -327,7 +364,7 @@
               py-0.5 transition-colors hover:cursor-pointer
             "
             title={part.label}
-            onclick={() => storage.navigate(part.prefix)}
+            onclick={() => navigateS3(part.prefix)}
             oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
           >
             {part.label}
@@ -336,6 +373,74 @@
         {@render pinButton(storage.bucket, part.prefix)}
       </span>
     {/each}
+    {#if storage.isInArchive}
+      <!-- Outer archive entry -->
+      <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+      <span class="group flex shrink-0 items-center gap-1">
+        <button
+          class="
+            text-secondary flex items-center gap-1.5 rounded-sm px-1.5
+            py-0.5 font-medium transition-colors hover:cursor-pointer hover:opacity-70
+          "
+          title={archiveName}
+          onclick={() => {
+            if (storage.archiveNestedPath) {
+              storage.navigateToOuterArchiveRoot();
+            } else {
+              storage.navigateInArchive('');
+            }
+          }}
+        >
+          <IconFolderZip class="size-4" aria-hidden="true" />
+          {archiveName}
+        </button>
+      </span>
+      <!-- Nested archive entry -->
+      {#if storage.archiveNestedPath}
+        <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+        <span class="group flex shrink-0 items-center gap-1">
+          <button
+            class="
+              text-secondary flex items-center gap-1.5 rounded-sm px-1.5
+              py-0.5 font-medium transition-colors hover:cursor-pointer hover:opacity-70
+            "
+            title={nestedArchiveName}
+            onclick={() => storage.navigateInArchive('')}
+          >
+            <IconFolderZip class="size-4" aria-hidden="true" />
+            {nestedArchiveName}
+          </button>
+        </span>
+      {/if}
+      {#each archiveParts as part (part.prefix)}
+        <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+        <span class="group flex min-w-0 items-center gap-1">
+          {#if part === archiveParts[archiveParts.length - 1]}
+            <span
+              class="
+                text-base-content min-w-0 truncate rounded-sm px-1.5 py-0.5
+                font-medium
+              "
+              title={part.label}
+              aria-current="page"
+            >
+              {part.label}
+            </span>
+          {:else}
+            <button
+              class="
+                hover:bg-base-200 hover:text-base-content min-w-0 truncate rounded-sm px-1.5
+                py-0.5 transition-colors hover:cursor-pointer
+              "
+              title={part.label}
+              onclick={() => storage.navigateInArchive(part.prefix)}
+            >
+              {part.label}
+            </button>
+          {/if}
+        </span>
+      {/each}
+    {/if}
   </nav>
 
   <!-- Item count badges -->
@@ -464,16 +569,19 @@
     {/if}
   </div>
 
-  <!-- Upload button -->
-  <button
-    class="btn btn-primary btn-xs gap-1"
-    onclick={() => storage.openModal('upload', { bucket: storage.bucket, prefix: storage.prefix })}
-  >
-    <IconUpload class="size-3.5" aria-hidden="true" />
-    {m.storage_action_upload()}
-  </button>
+  <!-- Upload button (hidden inside archives) -->
+  {#if !storage.isInArchive}
+    <button
+      class="btn btn-primary btn-xs gap-1"
+      onclick={() =>
+        storage.openModal('upload', { bucket: storage.bucket, prefix: storage.prefix })}
+    >
+      <IconUpload class="size-3.5" aria-hidden="true" />
+      {m.storage_action_upload()}
+    </button>
+  {/if}
 
-  <!-- More options (pin current location) -->
+  <!-- More options (pin current location) — hidden in archive mode -->
   <div class="dropdown dropdown-end">
     <button
       tabindex="0"
@@ -505,33 +613,37 @@
           {m.storage_tab_new()}
         </button>
       </li>
-      <li role="none">
-        {#if currentIsPinned}
-          {@const PinIcon2 = IconPushPin}
-          <button
-            role="menuitem"
-            class="justify-start text-sm"
-            onclick={() => {
-              storage.bookmarks.unpin(storage.bucket, storage.prefix);
-            }}
-          >
-            <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
-            {m.storage_action_unpin()}
-          </button>
-        {:else}
-          {@const PinIcon2 = IconPushPinOutline}
-          <button
-            role="menuitem"
-            class="justify-start text-sm"
-            onclick={() => {
-              storage.bookmarks.pin(storage.bucket, storage.prefix);
-            }}
-          >
-            <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
-            {m.storage_action_pin()}
-          </button>
-        {/if}
-      </li>
+      {#if !storage.isInArchive}
+        <li role="none">
+          {#if currentIsPinned}
+            {@const PinIcon2 = IconPushPin}
+            <button
+              role="menuitem"
+              class="justify-start text-sm"
+              title={m.storage_action_unpin()}
+              onclick={() => {
+                storage.bookmarks.unpin(storage.bucket, storage.prefix);
+              }}
+            >
+              <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
+              {m.storage_action_unpin()}
+            </button>
+          {:else}
+            {@const PinIcon2 = IconPushPinOutline}
+            <button
+              role="menuitem"
+              class="justify-start text-sm"
+              title={m.storage_action_pin()}
+              onclick={() => {
+                storage.bookmarks.pin(storage.bucket, storage.prefix);
+              }}
+            >
+              <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
+              {m.storage_action_pin()}
+            </button>
+          {/if}
+        </li>
+      {/if}
     </ul>
   </div>
 </div>
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
index b2a86095..a574943a 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
@@ -458,6 +458,63 @@ describe('StorageBreadcrumb', () => {
     });
   });
 
+  describe('archive mode', () => {
+    it('should show archive name when inside an archive', async () => {
+      const state = createState();
+      state.archiveKey = 'data.zip';
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      await expect.element(nav.getByText('data.zip')).toBeInTheDocument();
+    });
+
+    it('should show internal path parts when navigating within archive', async () => {
+      const state = createState();
+      state.archiveKey = 'data.zip';
+      state.archivePrefix = 'music/videos/';
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      await expect
+        .element(nav.getByRole('button', { name: 'music', exact: true }))
+        .toBeInTheDocument();
+      await expect.element(nav.getByText('videos')).toHaveAttribute('aria-current', 'page');
+    });
+
+    it('should show nested archive entry when browsing nested archive', async () => {
+      const state = createState();
+      state.archiveKey = 'outer.zip';
+      state.archiveNestedPath = 'inner.tar';
+      state.archivePrefix = 'subdir/';
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      await expect.element(nav.getByText('outer.zip')).toBeInTheDocument();
+      await expect.element(nav.getByText('inner.tar')).toBeInTheDocument();
+      await expect.element(nav.getByText('subdir')).toBeInTheDocument();
+    });
+
+    it('should call navigateInArchive when clicking breadcrumb folder inside archive', async () => {
+      const state = createState();
+      state.archiveKey = 'data.zip';
+      state.archivePrefix = 'music/videos/';
+      const spy = vi.spyOn(state, 'navigateInArchive');
+      render(StorageBreadcrumbWrapper, { state });
+
+      const nav = page.getByRole('navigation', { name: 'breadcrumb' });
+      await nav.getByRole('button', { name: 'music', exact: true }).click();
+      expect(spy).toHaveBeenCalledWith('music/');
+    });
+
+    it('should hide upload button when in archive mode', async () => {
+      const state = createState();
+      state.archiveKey = 'data.zip';
+      render(StorageBreadcrumbWrapper, { state });
+
+      await expect.element(page.getByRole('button', { name: /upload/i })).not.toBeInTheDocument();
+    });
+  });
+
   describe('new tab', () => {
     it('should show "New Tab" option in the more options menu', async () => {
       const state = createState();
diff --git a/src/lib/components/storage/explorer/TabBar.svelte b/src/lib/components/storage/explorer/TabBar.svelte
index 391e4be3..141111c6 100644
--- a/src/lib/components/storage/explorer/TabBar.svelte
+++ b/src/lib/components/storage/explorer/TabBar.svelte
@@ -213,6 +213,7 @@
             {#if tabsState.tabs.length > 1}
               <span
                 class="text-base-content/40 hover:text-error shrink-0 rounded-full p-0.5 opacity-0 transition-opacity group-hover:opacity-100"
+                title={m.storage_tab_close()}
                 role="button"
                 tabindex="-1"
                 aria-label={m.storage_tab_close()}
diff --git a/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
new file mode 100644
index 00000000..af3c7562
--- /dev/null
+++ b/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
@@ -0,0 +1,249 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi, beforeAll, afterAll, beforeEach, afterEach } from 'vitest';
+import { render, cleanup } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import PreviewModal from './PreviewModal.svelte';
+
+vi.mock('$app/paths', () => ({
+  resolve: (path: string) => path
+}));
+
+const defaultProps = {
+  open: true,
+  bucket: faker.word.noun(),
+  objectKey: 'path/to/document.txt'
+};
+
+function mockFetchResponse(
+  body: BodyInit | null,
+  options: {
+    contentType?: string;
+    format?: string;
+    truncated?: boolean;
+    totalSize?: number;
+    previewBytes?: number;
+    totalRows?: number;
+    previewRows?: number;
+    renderable?: boolean;
+    status?: number;
+  } = {}
+) {
+  const headers: Record<string, string> = {
+    'Content-Type': options.contentType ?? 'text/plain',
+    'X-Preview-Format': options.format ?? 'text',
+    'X-Preview-Truncated': String(options.truncated ?? false),
+    'X-Preview-Total-Size': String(options.totalSize ?? 0),
+    'X-Preview-Bytes': String(options.previewBytes ?? 0)
+  };
+  if (options.totalRows !== undefined) {
+    headers['X-Preview-Total-Rows'] = String(options.totalRows);
+  }
+  if (options.renderable === false) {
+    headers['X-Preview-Renderable'] = 'false';
+  }
+  return new Response(body, { status: options.status ?? 200, headers });
+}
+
+function parquetNdjson(headers: string[], rows: unknown[][], totalRows: number): string {
+  const lines: Array<Record<string, unknown>> = [{ t: 'h', h: headers, tr: totalRows }];
+  for (let ci = 0; ci < headers.length; ci++) {
+    lines.push({ t: 'c', n: headers[ci], v: rows.map((r) => r[ci]) });
+  }
+  lines.push({ t: 'd' });
+  return lines.map((l) => JSON.stringify(l)).join('\n');
+}
+
+describe('PreviewModal complex previews', () => {
+  const fetchMock = vi.fn();
+
+  beforeAll(() => {
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterAll(() => {
+    vi.unstubAllGlobals();
+  });
+
+  beforeEach(() => {
+    fetchMock.mockResolvedValue(mockFetchResponse('Hello world'));
+  });
+
+  afterEach(() => {
+    cleanup();
+    fetchMock.mockReset();
+  });
+
+  describe('parquet preview', () => {
+    it('should render parquet preview when format header is parquet', async () => {
+      fetchMock.mockImplementation(() =>
+        Promise.resolve(
+          mockFetchResponse(parquetNdjson(['col1', 'col2'], [['val1', 'val2']], 100), {
+            contentType: 'application/json',
+            format: 'parquet',
+            truncated: false,
+            totalSize: 5000,
+            totalRows: 100
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
+      await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
+      await expect.element(page.getByText('val1')).toBeInTheDocument();
+    });
+
+    it('should show row count badge when parquet is truncated', async () => {
+      fetchMock.mockImplementation(() =>
+        Promise.resolve(
+          mockFetchResponse(parquetNdjson(['col1', 'col2'], [['val1', 'val2']], 10000), {
+            contentType: 'application/json',
+            format: 'parquet',
+            truncated: true,
+            totalSize: 50000,
+            totalRows: 10000
+          })
+        )
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
+      await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
+      await expect.element(page.getByText('val1')).toBeInTheDocument();
+      await expect.element(page.getByText(/showing first 250 of 10,000 rows/i)).toBeInTheDocument();
+    });
+
+    it('should show row count badge when parquet is truncated', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse(parquetNdjson(['col1', 'col2'], [['val1', 'val2']], 10000), {
+          contentType: 'application/json',
+          format: 'parquet',
+          truncated: true,
+          totalSize: 50000,
+          totalRows: 10000,
+          previewRows: 500
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
+      await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
+      await expect.element(page.getByText('val1')).toBeInTheDocument();
+      await expect.element(page.getByText(/showing first 250 of 10,000 rows/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('image preview', () => {
+    it('should render image preview for image content type', async () => {
+      const pngBytes = new Uint8Array([137, 80, 78, 71, 13, 10, 26, 10]);
+      const blob = new Blob([pngBytes], { type: 'image/png' });
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'image/png',
+            'X-Preview-Total-Size': '8192'
+          }
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'images/photo.png' });
+      await expect.element(page.getByText('photo.png')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+
+    it('should render image preview for image/jpeg', async () => {
+      const jpgBytes = new Uint8Array([0xff, 0xd8, 0xff, 0xe0]);
+      const blob = new Blob([jpgBytes], { type: 'image/jpeg' });
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'image/jpeg',
+            'X-Preview-Total-Size': '4096'
+          }
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'images/photo.jpg' });
+      await expect.element(page.getByText('photo.jpg')).toBeInTheDocument();
+    });
+  });
+
+  describe('PDF preview', () => {
+    it('should render PDF preview for application/pdf', async () => {
+      const pdfBytes = new Uint8Array([0x25, 0x50, 0x44, 0x46]);
+      const blob = new Blob([pdfBytes], { type: 'application/pdf' });
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'application/pdf',
+            'X-Preview-Total-Size': '16384'
+          }
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'docs/report.pdf' });
+      await expect.element(page.getByText('report.pdf')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('fallback preview', () => {
+    it('should render fallback when X-Preview-Renderable is false', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('', {
+          contentType: 'application/zip',
+          renderable: false
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'archive.zip' });
+      await expect.element(page.getByText('archive.zip')).toBeInTheDocument();
+    });
+
+    it('should render fallback for binary content that fails UTF-8 decode', async () => {
+      const binaryBytes = new Uint8Array([0x80, 0x81, 0x82, 0x83, 0xff, 0xfe, 0xfd]);
+      const blob = new Blob([binaryBytes]);
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'application/octet-stream',
+            'X-Preview-Format': 'raw',
+            'X-Preview-Truncated': 'false',
+            'X-Preview-Total-Size': '7',
+            'X-Preview-Bytes': '7'
+          }
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.bin' });
+      await expect.element(page.getByText('file.bin')).toBeInTheDocument();
+    });
+  });
+
+  describe('error state', () => {
+    it('should show error when fetch fails', async () => {
+      fetchMock.mockRejectedValue(new Error('Network error'));
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should show access denied for 403', async () => {
+      fetchMock.mockResolvedValue(new Response('{}', { status: 403 }));
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should show not found for 404', async () => {
+      fetchMock.mockResolvedValue(new Response('{}', { status: 404 }));
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should show generic error for other status codes', async () => {
+      fetchMock.mockResolvedValue(
+        new Response(JSON.stringify({ error: 'Server is down' }), { status: 500 })
+      );
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+
+    it('should handle non-JSON error response body', async () => {
+      fetchMock.mockResolvedValue(new Response('Not JSON at all', { status: 500 }));
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts
new file mode 100644
index 00000000..4987c7ed
--- /dev/null
+++ b/src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts
@@ -0,0 +1,253 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, vi, beforeAll, afterAll, beforeEach, afterEach } from 'vitest';
+import { render, cleanup } from 'vitest-browser-svelte';
+import { faker } from '@faker-js/faker';
+import PreviewModal from './PreviewModal.svelte';
+
+vi.mock('$app/paths', () => ({
+  resolve: (path: string) => path
+}));
+
+const defaultProps = {
+  open: true,
+  bucket: faker.word.noun(),
+  objectKey: 'path/to/document.txt'
+};
+
+function mockFetchResponse(
+  body: BodyInit | null,
+  options: {
+    contentType?: string;
+    format?: string;
+    truncated?: boolean;
+    totalSize?: number;
+    previewBytes?: number;
+  } = {}
+) {
+  const headers: Record<string, string> = {
+    'Content-Type': options.contentType ?? 'text/plain',
+    'X-Preview-Format': options.format ?? 'text',
+    'X-Preview-Truncated': String(options.truncated ?? false),
+    'X-Preview-Total-Size': String(options.totalSize ?? 0),
+    'X-Preview-Bytes': String(options.previewBytes ?? 0)
+  };
+  return new Response(body, { status: 200, headers });
+}
+
+describe('PreviewModal text and CSV preview', () => {
+  const fetchMock = vi.fn();
+
+  beforeAll(() => {
+    vi.stubGlobal('fetch', fetchMock);
+  });
+
+  afterAll(() => {
+    vi.unstubAllGlobals();
+  });
+
+  beforeEach(() => {
+    fetchMock.mockResolvedValue(
+      mockFetchResponse('Hello world', {
+        contentType: 'text/plain',
+        totalSize: 11,
+        previewBytes: 11
+      })
+    );
+  });
+
+  afterEach(() => {
+    cleanup();
+    fetchMock.mockReset();
+  });
+
+  describe('text preview', () => {
+    it('should render text content after fetch completes', async () => {
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByText('Hello world')).toBeInTheDocument();
+    });
+
+    it('should show file size badge', async () => {
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByText('11 B')).toBeInTheDocument();
+    });
+
+    it('should show truncated badge when content is truncated', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('Truncated content...', {
+          contentType: 'text/plain',
+          truncated: true,
+          totalSize: 50000,
+          previewBytes: 1024
+        })
+      );
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByText('Truncated content...')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+
+    it('should show download full button when truncated', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('Partial content', {
+          contentType: 'text/plain',
+          truncated: true,
+          totalSize: 50000,
+          previewBytes: 1024
+        })
+      );
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByText('Partial content')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+
+    it('should show a close button in the footer', async () => {
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByText('Hello world')).toBeInTheDocument();
+      const closeBtns = page.getByRole('button', { name: /close/i });
+      await expect.element(closeBtns.first()).toBeInTheDocument();
+    });
+  });
+
+  describe('CSV preview', () => {
+    it('should render CSV preview for text/csv content type', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('name,value\nfoo,1\nbar,2', {
+          contentType: 'text/csv',
+          totalSize: 30,
+          previewBytes: 30
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/test.csv' });
+      await expect.element(page.getByText('30 B')).toBeInTheDocument();
+    });
+
+    it('should render CSV preview for application/csv content type', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('a,b\n1,2', {
+          contentType: 'application/csv',
+          totalSize: 10,
+          previewBytes: 10
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/test.dat' });
+      await expect.element(page.getByText('10 B')).toBeInTheDocument();
+    });
+
+    it('should render CSV preview for application/vnd.ms-excel content type', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('col1,col2\nval1,val2', {
+          contentType: 'application/vnd.ms-excel',
+          totalSize: 20,
+          previewBytes: 20
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/test.xls' });
+      await expect.element(page.getByText('20 B')).toBeInTheDocument();
+    });
+
+    it('should render CSV preview based on .csv file extension', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('x,y\n1,2', {
+          contentType: 'application/octet-stream',
+          totalSize: 8,
+          previewBytes: 8
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.csv' });
+      await expect.element(page.getByText('8 B')).toBeInTheDocument();
+    });
+
+    it('should show truncated badge for truncated CSV', async () => {
+      fetchMock.mockResolvedValue(
+        mockFetchResponse('a,b\n1,2', {
+          contentType: 'text/csv',
+          truncated: true,
+          totalSize: 100000,
+          previewBytes: 2048
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/big.csv' });
+      await expect.element(page.getByText('big.csv')).toBeInTheDocument();
+      await expect.element(page.getByText(/download full/i)).toBeInTheDocument();
+    });
+  });
+
+  describe('UTF-16 BOM detection', () => {
+    it('should decode UTF-16 LE BOM content', async () => {
+      const bytes = new Uint8Array([0xff, 0xfe, 0x48, 0x00, 0x69, 0x00]);
+      const blob = new Blob([bytes]);
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'text/plain',
+            'X-Preview-Format': 'text',
+            'X-Preview-Truncated': 'false',
+            'X-Preview-Total-Size': '6',
+            'X-Preview-Bytes': '6'
+          }
+        })
+      );
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByText('Hi')).toBeInTheDocument();
+    });
+
+    it('should decode UTF-16 BE BOM content', async () => {
+      const bytes = new Uint8Array([0xfe, 0xff, 0x00, 0x4f, 0x00, 0x4b]);
+      const blob = new Blob([bytes]);
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'text/plain',
+            'X-Preview-Format': 'text',
+            'X-Preview-Truncated': 'false',
+            'X-Preview-Total-Size': '6',
+            'X-Preview-Bytes': '6'
+          }
+        })
+      );
+      render(PreviewModal, defaultProps);
+      await expect.element(page.getByText('OK')).toBeInTheDocument();
+    });
+  });
+
+  describe('Windows-1252 fallback for CSV', () => {
+    it('should decode CSV with Windows-1252 when UTF-8 fails', async () => {
+      const bytes = new Uint8Array([0x4e, 0x61, 0x6d, 0x65, 0x0a, 0xe4]);
+      const blob = new Blob([bytes]);
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'text/csv',
+            'X-Preview-Format': 'text',
+            'X-Preview-Truncated': 'false',
+            'X-Preview-Total-Size': '6',
+            'X-Preview-Bytes': '6'
+          }
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.csv' });
+      await expect.element(page.getByText('file.csv')).toBeInTheDocument();
+    });
+
+    it('should decode TSV with Windows-1252 when UTF-8 fails', async () => {
+      const bytes = new Uint8Array([0x41, 0x09, 0x42, 0x0a, 0xe4, 0x09, 0xfc]);
+      const blob = new Blob([bytes]);
+      fetchMock.mockResolvedValue(
+        new Response(blob, {
+          status: 200,
+          headers: {
+            'Content-Type': 'text/plain',
+            'X-Preview-Format': 'text',
+            'X-Preview-Truncated': 'false',
+            'X-Preview-Total-Size': '7',
+            'X-Preview-Bytes': '7'
+          }
+        })
+      );
+      render(PreviewModal, { ...defaultProps, objectKey: 'data/file.tsv' });
+      await expect.element(page.getByText('file.tsv')).toBeInTheDocument();
+    });
+  });
+});
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 4af7f89c..238d6347 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -32,6 +32,9 @@
     open?: boolean;
     bucket?: string;
     objectKey?: string | null;
+    archiveKey?: string;
+    archivePath?: string;
+    nestedArchivePath?: string;
   }
 
   interface ColumnStats {
@@ -89,7 +92,14 @@
     | { kind: 'fallback'; contentType: string; isBinary: boolean }
     | { kind: 'error'; message: string };
 
-  let { open = $bindable(false), bucket = '', objectKey = null }: Props = $props();
+  let {
+    open = $bindable(false),
+    bucket = '',
+    objectKey = null,
+    archiveKey = '',
+    archivePath = '',
+    nestedArchivePath = ''
+  }: Props = $props();
 
   let preview: PreviewKind = $state({ kind: 'idle' });
   let blobUrls: string[] = [];
@@ -172,8 +182,21 @@
       : {};
 
     try {
-      const params = new URLSearchParams({ bucket: activeBucket, key });
-      const res = await fetch(`/api/storage/preview?${params}`, { headers });
+      let res: Response;
+      if (archiveKey && archivePath) {
+        const params = new SvelteURLSearchParams({
+          bucket: activeBucket,
+          key: archiveKey,
+          path: archivePath
+        });
+        if (nestedArchivePath) {
+          params.set('nestedArchivePath', nestedArchivePath);
+        }
+        res = await fetch(`/api/storage/archive/extract?${params}`, { headers });
+      } else {
+        const params = new URLSearchParams({ bucket: activeBucket, key });
+        res = await fetch(`/api/storage/preview?${params}`, { headers });
+      }
 
       if (!res.ok) {
         const errBody = await res.json().catch(() => ({}));
@@ -190,46 +213,15 @@
       const contentType = (res.headers.get('Content-Type') ?? 'application/octet-stream')
         .split(';')[0]
         .trim();
-      const format = res.headers.get('X-Preview-Format');
+      const totalSize = parseInt(
+        res.headers.get('X-Preview-Total-Size') ?? res.headers.get('Content-Length') ?? '0',
+        10
+      );
+      const previewBytes = parseInt(
+        res.headers.get('X-Preview-Bytes') ?? res.headers.get('Content-Length') ?? '0',
+        10
+      );
       const truncated = res.headers.get('X-Preview-Truncated') === 'true';
-      const totalSize = Number(res.headers.get('X-Preview-Total-Size') ?? '0');
-      const previewBytes = Number(res.headers.get('X-Preview-Bytes') ?? '0');
-
-      // Parquet takes priority — parse header for metadata (always), load data on-demand
-      if (format === 'parquet') {
-        try {
-          const dataBlocked = res.headers.get('X-Preview-Data-Blocked') === 'true';
-          await parseParquetStream(
-            res,
-            (headers, totalRows, columnTypes, metadata) => {
-              preview = {
-                kind: 'parquet',
-                headers,
-                columnTypes,
-                metadata,
-                rows: [],
-                dataBlocked,
-                truncated,
-                totalSize,
-                totalRows
-              };
-            },
-            () => {
-              // Ignore any column data in the initial load (metadata-only request)
-            }
-          );
-        } catch {
-          preview = { kind: 'error', message: m.storage_preview_error_desc() };
-        }
-        return;
-      }
-
-      if (res.headers.get('X-Preview-Renderable') === 'false') {
-        await res.body?.cancel();
-        preview = { kind: 'fallback', contentType, isBinary: false };
-        return;
-      }
-
       if (contentType.startsWith('image/')) {
         const blob = await res.blob();
         const url = URL.createObjectURL(blob);
@@ -246,6 +238,59 @@
         return;
       }
 
+      if (res.headers.get('X-Preview-Format') === 'parquet') {
+        const dataBlocked = res.headers.get('X-Preview-Data-Blocked') === 'true';
+        let parquetHeaders: string[] = [];
+        let parquetColumnTypes: ColumnTypeInfo[] = [];
+        let parquetMeta: ParquetFileMeta = {
+          rowGroups: 0,
+          compressionCodecs: [],
+          compressionUniform: true,
+          hasOffsetIndex: false,
+          hasColumnIndex: false,
+          createdBy: null,
+          version: 0,
+          arrowSchema: null
+        };
+        const parquetRows: unknown[][] = [];
+        const columnPos: Record<string, number> = {};
+        let parquetTotalRows = 0;
+        await parseParquetStream(
+          res,
+          (headers, totalRows, columnTypes, meta) => {
+            parquetHeaders = headers;
+            parquetTotalRows = totalRows;
+            parquetColumnTypes = columnTypes;
+            parquetMeta = meta;
+          },
+          (name, values) => {
+            const colIdx = parquetHeaders.indexOf(name);
+            if (colIdx < 0) return;
+            let pos = columnPos[name] ?? 0;
+            for (let i = 0; i < values.length; i++) {
+              while (parquetRows.length <= pos) {
+                parquetRows.push(new Array(parquetHeaders.length).fill(undefined));
+              }
+              parquetRows[pos][colIdx] = values[i];
+              pos++;
+            }
+            columnPos[name] = pos;
+          }
+        );
+        preview = {
+          kind: 'parquet',
+          headers: parquetHeaders,
+          columnTypes: parquetColumnTypes,
+          metadata: parquetMeta,
+          rows: parquetRows,
+          dataBlocked,
+          truncated: parquetRows.length < parquetTotalRows,
+          totalSize,
+          totalRows: parquetTotalRows
+        };
+        return;
+      }
+
       const text = await readTextSafely(res, key);
       if (text === null) {
         preview = { kind: 'fallback', contentType, isBinary: true };
@@ -256,7 +301,9 @@
         contentType === 'text/csv' ||
         contentType === 'application/csv' ||
         contentType === 'application/vnd.ms-excel' ||
-        key.toLowerCase().endsWith('.csv')
+        contentType === 'text/tab-separated-values' ||
+        key.toLowerCase().endsWith('.csv') ||
+        key.toLowerCase().endsWith('.tsv')
       ) {
         preview = { kind: 'csv', text, truncated, totalSize, previewBytes };
         return;
@@ -353,7 +400,7 @@
   /** Read an NDJSON streaming response and progressively fill column data. */
   async function readNdjsonStream(
     res: Response,
-    onColumn?: (name: string, values: unknown[]) => void
+    onColumn: ((name: string, values: unknown[]) => void) | undefined
   ): Promise<{ headers: string[]; rows: unknown[][]; totalRows: number }> {
     const reader = res.body!.getReader();
     const decoder = new TextDecoder();
@@ -527,7 +574,7 @@
   async function fetchParquetRows(
     offset: number,
     limit: number,
-    onColumn?: (name: string, values: unknown[]) => void
+    onColumn: ((name: string, values: unknown[]) => void) | undefined
   ): Promise<unknown[][]> {
     if (!objectKey) return [];
 
@@ -798,12 +845,12 @@
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
           </button>
-        {:else if (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
+        {:else if !archiveKey && (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
           <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
           </button>
-        {:else if preview.kind === 'image' || preview.kind === 'pdf'}
+        {:else if !archiveKey && (preview.kind === 'image' || preview.kind === 'pdf')}
           <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
index 02b95c8b..3ac79230 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
@@ -1,6 +1,6 @@
 import { page } from 'vitest/browser';
-import { describe, expect, it, vi, beforeEach } from 'vitest';
-import { render } from 'vitest-browser-svelte';
+import { describe, expect, it, vi, beforeEach, afterEach } from 'vitest';
+import { render, cleanup } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import PreviewModal from './PreviewModal.svelte';
 
@@ -19,79 +19,63 @@ const defaultProps = {
   objectKey: 'path/to/document.txt'
 };
 
-/** Helper to create a mock Response with given content-type and headers */
 function mockFetchResponse(
   body: BodyInit | null,
-  options: {
+  opts?: {
     contentType?: string;
-    format?: string;
     truncated?: boolean;
     totalSize?: number;
     previewBytes?: number;
-    totalRows?: number;
-    previewRows?: number;
     renderable?: boolean;
-    status?: number;
-  } = {}
-) {
-  const headers: Record<string, string> = {
-    'Content-Type': options.contentType ?? 'text/plain',
-    'X-Preview-Format': options.format ?? 'text',
-    'X-Preview-Truncated': String(options.truncated ?? false),
-    'X-Preview-Total-Size': String(options.totalSize ?? 0),
-    'X-Preview-Bytes': String(options.previewBytes ?? 0)
-  };
-  if (options.totalRows !== undefined) {
-    headers['X-Preview-Total-Rows'] = String(options.totalRows);
   }
-  if (options.previewRows !== undefined) {
-    headers['X-Preview-Preview-Rows'] = String(options.previewRows);
-  }
-  if (options.renderable === false) {
-    headers['X-Preview-Renderable'] = 'false';
-  }
-  return new Response(body, { status: options.status ?? 200, headers });
+): Response {
+  return new Response(body, {
+    status: 200,
+    headers: {
+      'Content-Type': opts?.contentType ?? 'text/plain',
+      'X-Preview-Format': 'text',
+      'X-Preview-Truncated': String(opts?.truncated ?? false),
+      'X-Preview-Total-Size': String(opts?.totalSize ?? 11),
+      'X-Preview-Bytes': String(opts?.previewBytes ?? 11)
+    }
+  });
 }
 
-describe('PreviewModal', () => {
+describe('PreviewModal basics', () => {
+  const fetchMock = vi.fn();
+
   beforeEach(() => {
-    vi.stubGlobal(
-      'fetch',
-      vi.fn().mockResolvedValue(
-        mockFetchResponse('Hello world', {
-          contentType: 'text/plain',
-          totalSize: 11,
-          previewBytes: 11
-        })
-      )
-    );
+    vi.stubGlobal('fetch', fetchMock);
+    fetchMock.mockResolvedValue(mockFetchResponse('Hello world'));
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.unstubAllGlobals();
+    fetchMock.mockReset();
   });
 
   describe('initial render', () => {
     it('should render a dialog when open', async () => {
       render(PreviewModal, defaultProps);
-
       await expect.element(page.getByRole('dialog')).toBeInTheDocument();
     });
 
     it('should show the filename in the heading', async () => {
       render(PreviewModal, { ...defaultProps, objectKey: 'folder/report.csv' });
-
       await expect.element(page.getByText('report.csv')).toBeInTheDocument();
     });
 
     it('should show loading state initially', async () => {
-      vi.stubGlobal('fetch', vi.fn().mockReturnValue(new Promise(() => {})));
+      fetchMock.mockReturnValue(new Promise(() => {}));
       render(PreviewModal, defaultProps);
-
-      await expect.element(page.getByText('Loading preview…')).toBeInTheDocument();
+      await expect.element(page.getByText('Loading preview\u2026')).toBeInTheDocument();
     });
   });
 
   describe('when open is false', () => {
     it('should not render dialog content', async () => {
       render(PreviewModal, { ...defaultProps, open: false });
-
       const heading = page.getByRole('heading');
       await expect.element(heading).not.toBeInTheDocument();
     });
@@ -100,7 +84,6 @@ describe('PreviewModal', () => {
   describe('close button', () => {
     it('should have a close button', async () => {
       render(PreviewModal, defaultProps);
-
       const closeBtn = page.getByRole('button', { name: /close/i });
       await expect.element(closeBtn).toBeInTheDocument();
     });
@@ -109,25 +92,20 @@ describe('PreviewModal', () => {
   describe('maximize toggle', () => {
     it('should have a maximise button', async () => {
       render(PreviewModal, defaultProps);
-
       const maxBtn = page.getByRole('button', { name: /maximise/i });
       await expect.element(maxBtn).toBeInTheDocument();
     });
 
     it('should switch to restore button after clicking maximise', async () => {
       render(PreviewModal, defaultProps);
-
       await page.getByRole('button', { name: /maximise/i }).click();
-
       await expect.element(page.getByRole('button', { name: /restore/i })).toBeInTheDocument();
     });
 
     it('should toggle back to maximise after clicking restore', async () => {
       render(PreviewModal, defaultProps);
-
       await page.getByRole('button', { name: /maximise/i }).click();
       await page.getByRole('button', { name: /restore/i }).click();
-
       await expect.element(page.getByRole('button', { name: /maximise/i })).toBeInTheDocument();
     });
   });
@@ -437,7 +415,7 @@ describe('PreviewModal', () => {
       await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
       await expect.element(page.getByText('col1').first()).toBeInTheDocument();
       await expect
-        .element(page.getByText('Showing first 0 of 10,000 rows (parquet)').first())
+        .element(page.getByText('Showing first 1 of 10,000 rows (parquet)').first())
         .toBeInTheDocument();
     });
 
@@ -810,13 +788,11 @@ describe('PreviewModal', () => {
   describe('accessibility', () => {
     it('should have a dialog role', async () => {
       render(PreviewModal, defaultProps);
-
       await expect.element(page.getByRole('dialog')).toBeInTheDocument();
     });
 
     it('should have aria-label on close button', async () => {
       render(PreviewModal, defaultProps);
-
       const closeBtn = page.getByRole('button', { name: /close/i });
       await expect.element(closeBtn).toBeInTheDocument();
     });
@@ -825,7 +801,6 @@ describe('PreviewModal', () => {
   describe('edge cases', () => {
     it('should handle null objectKey', async () => {
       render(PreviewModal, { ...defaultProps, objectKey: null });
-
       await expect.element(page.getByRole('dialog')).toBeInTheDocument();
     });
 
@@ -834,7 +809,6 @@ describe('PreviewModal', () => {
         ...defaultProps,
         objectKey: 'a/b/c/d/e/f/deeply-nested-file.json'
       });
-
       await expect.element(page.getByText('deeply-nested-file.json')).toBeInTheDocument();
     });
 
@@ -843,7 +817,6 @@ describe('PreviewModal', () => {
         ...defaultProps,
         objectKey: 'data/file (copy).txt'
       });
-
       await expect.element(page.getByText('file (copy).txt')).toBeInTheDocument();
     });
   });
diff --git a/src/lib/components/storage/modals/StorageModals.svelte b/src/lib/components/storage/modals/StorageModals.svelte
index a3d8f9f0..31554a62 100644
--- a/src/lib/components/storage/modals/StorageModals.svelte
+++ b/src/lib/components/storage/modals/StorageModals.svelte
@@ -55,6 +55,9 @@
     bind:open={previewOpen}
     bucket={storage.bucket}
     objectKey={storage.activeModal.payload.key}
+    archiveKey={storage.activeModal.payload.archiveKey}
+    archivePath={storage.activeModal.payload.archivePath}
+    nestedArchivePath={storage.activeModal.payload.nestedArchivePath}
   />
 {/if}
 
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index d9c1f9f7..eeaf8078 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import Papa from 'papaparse';
   import * as m from '$lib/paraglide/messages.js';
 
   const MAX_ROWS = 250;
@@ -10,44 +11,19 @@
   let { text }: Props = $props();
 
   const { headers, rows } = $derived.by(() => {
-    // Split into lines, strip trailing newline
-    const lines = text.split('\n').filter((l) => l.trim() !== '');
-    if (lines.length === 0) return { headers: [], rows: [] };
-
-    // Simple CSV parse: handle quoted fields
-    function parseLine(line: string): string[] {
-      const result: string[] = [];
-      let current = '';
-      let inQuotes = false;
-      for (let i = 0; i < line.length; i++) {
-        const ch = line[i];
-        if (ch === '"') {
-          if (inQuotes && line[i + 1] === '"') {
-            current += '"';
-            i++;
-          } else {
-            inQuotes = !inQuotes;
-          }
-        } else if (ch === ',' && !inQuotes) {
-          result.push(current);
-          current = '';
-        } else {
-          current += ch;
-        }
-      }
-      result.push(current);
-      return result;
-    }
-
-    const [headerLine, ...dataLines] = lines;
-    const hdrs = parseLine(headerLine);
-    const rws = dataLines.slice(0, MAX_ROWS).map(parseLine);
-    return { headers: hdrs, rows: rws };
+    const result = Papa.parse(text, {
+      preview: MAX_ROWS + 1,
+      header: false,
+      skipEmptyLines: true
+    });
+    if (result.data.length === 0) return { headers: [], rows: [] };
+    const [hdrs, ...data] = result.data as string[][];
+    return { headers: hdrs, rows: data };
   });
 
   const truncated = $derived.by(() => {
-    const lines = text.split('\n').filter((l) => l.trim() !== '');
-    return lines.length > MAX_ROWS + 1;
+    const result = Papa.parse(text, { skipEmptyLines: true });
+    return result.data.length > MAX_ROWS + 1;
   });
 
   const uid = $props.id();
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
index fd72b452..aa4e59d8 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
@@ -5,25 +5,78 @@ import { faker } from '@faker-js/faker';
 import CsvPreview from './CsvPreview.svelte';
 
 describe('CsvPreview', () => {
-  it('should show empty state when text is empty', async () => {
+  it('should show empty state when input is empty', async () => {
     render(CsvPreview, { text: '' });
 
-    const table = page.getByRole('table');
-    await expect.element(table).not.toBeInTheDocument();
+    await expect.element(page.getByText('This bucket is empty')).toBeInTheDocument();
   });
 
-  it('should render a table with headers and rows', async () => {
-    const text = 'Name,Email,City\nAlice,alice@example.com,Berlin\nBob,bob@example.com,Munich';
-    render(CsvPreview, { text });
+  it('should show empty state when input is just a newline', async () => {
+    render(CsvPreview, { text: '\n' });
+
+    await expect.element(page.getByText('This bucket is empty')).toBeInTheDocument();
+  });
+
+  it('should render a table with headers and rows for basic CSV', async () => {
+    const csv = 'name,city,score\nAlice,Berlin,95\nBob,Munich,88';
+    render(CsvPreview, { text: csv });
 
     const table = page.getByRole('table', { name: 'CSV preview' });
     await expect.element(table).toBeInTheDocument();
-    await expect.element(page.getByText('Name')).toBeInTheDocument();
-    await expect.element(page.getByText('Email')).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'name' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'city' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'score' })).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'Alice' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'Berlin' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: '95' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'Bob' })).toBeInTheDocument();
+  });
+
+  it('should render TSV data correctly using tab separator', async () => {
+    const tsv = 'name\tcity\tscore\nAlice\tBerlin\t95\nBob\tMunich\t88';
+    render(CsvPreview, { text: tsv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'name' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'city' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'score' })).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'Alice' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'Berlin' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: '95' })).toBeInTheDocument();
+  });
+
+  it('should handle CSV with quoted fields containing commas', async () => {
+    const csv =
+      'name,address,country\n"Smith, John","123 Main St, Apt 4",Germany\n"Doe, Jane","456 Oak Ave",Austria';
+    render(CsvPreview, { text: csv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'Smith, John' })).toBeInTheDocument();
     await expect
-      .element(page.getByRole('cell', { name: 'Alice', exact: true }))
+      .element(page.getByRole('cell', { name: '123 Main St, Apt 4' }))
       .toBeInTheDocument();
-    await expect.element(page.getByText('bob@example.com')).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'Germany' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'Doe, Jane' })).toBeInTheDocument();
+  });
+
+  it('should handle TSV with quoted fields containing tabs', async () => {
+    const tsv = 'name\tnote\nAlice\t"likes\ttabs"\nBob\tplain';
+    render(CsvPreview, { text: tsv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'Alice' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'likes tabs' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'Bob' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'plain' })).toBeInTheDocument();
   });
 
   it('should handle quoted fields with commas', async () => {
@@ -109,4 +162,115 @@ describe('CsvPreview', () => {
     await expect.element(table).toBeInTheDocument();
     await expect.element(page.getByText('Name')).toBeInTheDocument();
   });
+
+  it('should handle headers with special characters', async () => {
+    const csv = 'first name,last.name,email-address\nJohn,Doe,john@example.com';
+    render(CsvPreview, { text: csv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    for (const header of ['first name', 'last.name', 'email-address']) {
+      await expect.element(page.getByRole('cell', { name: header })).toBeInTheDocument();
+    }
+  });
+
+  it('should handle rows with missing trailing columns', async () => {
+    const csv = 'a,b,c\n1,2\n3,4,5,6';
+    render(CsvPreview, { text: csv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    const row1 = table.getByRole('row').nth(1);
+    await expect(row1.getByRole('cell').nth(2)).toHaveTextContent('2');
+    await expect(row1.getByRole('cell').nth(3)).toHaveTextContent('');
+
+    const row2 = table.getByRole('row').nth(2);
+    await expect(row2.getByRole('cell').nth(3)).toHaveTextContent('5');
+  });
+
+  it('should handle rows with empty quoted fields', async () => {
+    const csv = 'a,b,c\n1,"",3\nx,y,z';
+    render(CsvPreview, { text: csv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    const row1 = page.getByRole('row').nth(1);
+    await expect(row1.getByRole('cell').nth(1)).toHaveTextContent('1');
+    await expect(row1.getByRole('cell').nth(3)).toHaveTextContent('3');
+  });
+
+  it('should handle CRLF line endings', async () => {
+    const csv = 'name,city\r\nAlice,Berlin\r\nBob,Munich\r\n';
+    render(CsvPreview, { text: csv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'Alice' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'Bob' })).toBeInTheDocument();
+  });
+
+  it('should render single row CSV correctly', async () => {
+    const csv = 'header\nvalue';
+    render(CsvPreview, { text: csv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    await expect.element(page.getByRole('cell', { name: 'header' })).toBeInTheDocument();
+    await expect.element(page.getByRole('cell', { name: 'value' })).toBeInTheDocument();
+  });
+
+  it('should not show truncation message when rows fit within limit', async () => {
+    const rows = ['h1,h2'];
+    for (let i = 0; i < 10; i++) {
+      rows.push(`val${i}a,val${i}b`);
+    }
+    const csv = rows.join('\n');
+    render(CsvPreview, { text: csv });
+
+    const truncationMsg = page.getByText(/Showing/i);
+    expect(await truncationMsg.all()).toHaveLength(0);
+  });
+
+  it('should show truncation message when rows exceed MAX_ROWS', async () => {
+    const rows = ['h1,h2'];
+    for (let i = 0; i < 260; i++) {
+      rows.push(`val${i}a,val${i}b`);
+    }
+    const csv = rows.join('\n');
+    render(CsvPreview, { text: csv });
+
+    await expect.element(page.getByText(/Showing/i)).toBeInTheDocument();
+  });
+
+  it('should show truncation message for TSV with many rows', async () => {
+    const rows = ['h1\th2'];
+    for (let i = 0; i < 260; i++) {
+      rows.push(`val${i}a\tval${i}b`);
+    }
+    const tsv = rows.join('\n');
+    render(CsvPreview, { text: tsv });
+
+    await expect.element(page.getByText(/Showing/i)).toBeInTheDocument();
+  });
+
+  it('should render exactly MAX_ROWS rows when truncated', async () => {
+    const rows = ['h1'];
+    for (let i = 0; i < 300; i++) {
+      rows.push(`val${i}`);
+    }
+    const csv = rows.join('\n');
+    const { container } = render(CsvPreview, { text: csv });
+
+    const table = page.getByRole('table', { name: 'CSV preview' });
+    await expect.element(table).toBeInTheDocument();
+
+    const tables = await container.getElementsByTagName('table');
+    expect(tables.length).toBe(1);
+    expect(tables[0].rows.length).toBe(251);
+  });
 });
diff --git a/src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts
index 2a98156c..848b7859 100644
--- a/src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadDropzone.svelte.spec.ts
@@ -38,13 +38,17 @@ describe('UploadDropzone', () => {
     it('should have Select files button', async () => {
       render(UploadDropzone, { onFilesSelected: vi.fn() });
 
-      await expect.element(page.getByRole('button', { name: 'Select files' })).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('button', { name: 'Select files' }).first())
+        .toBeInTheDocument();
     });
 
     it('should have Select folder button', async () => {
       render(UploadDropzone, { onFilesSelected: vi.fn() });
 
-      await expect.element(page.getByRole('button', { name: 'Select folder' })).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('button', { name: 'Select folder' }).first())
+        .toBeInTheDocument();
     });
 
     it('should have hidden file inputs', async () => {
@@ -359,7 +363,7 @@ describe('UploadDropzone', () => {
       const fileInput = page.getByLabelText('Select files').element() as HTMLInputElement;
       const clickSpy = vi.spyOn(fileInput, 'click');
 
-      const btn = page.getByRole('button', { name: 'Select files' });
+      const btn = page.getByRole('button', { name: 'Select files' }).first();
       (btn.element() as HTMLElement).click();
 
       expect(clickSpy).toHaveBeenCalled();
@@ -371,7 +375,7 @@ describe('UploadDropzone', () => {
       const dirInput = page.getByLabelText('Select folder').element() as HTMLInputElement;
       const clickSpy = vi.spyOn(dirInput, 'click');
 
-      const btn = page.getByRole('button', { name: 'Select folder' });
+      const btn = page.getByRole('button', { name: 'Select folder' }).first();
       (btn.element() as HTMLElement).click();
 
       expect(clickSpy).toHaveBeenCalled();
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 1c08201b..7a03a27c 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -46,6 +46,15 @@ export const pdfPreviewBytes =
  *  and the size of the payload sent to the browser. */
 export const filePreviewRows = parseInt(env.STACKABLE_COCKPIT_FILE_PREVIEW_ROWS ?? '', 10) || 250;
 
+/** Maximum compressed size of an archive that will be opened for in-browser
+ *  preview. Archives larger than this threshold will not be downloaded at all
+ *  and a "too large" fallback is shown instead. During listing the total
+ *  decompressed entry size is also checked against this limit.
+ *  Controlled by `STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB`. Default: 100 MB. */
+export const archivePreviewMaxBytes =
+  parseInt(env.STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB ?? '', 10) * 1024 * 1024 ||
+  100 * 1024 * 1024;
+
 // ── Parquet preview restrictions ───────────────────────────────────────────
 
 export interface ParquetDisallowedCompression {
diff --git a/src/lib/server/storage/archive.test.ts b/src/lib/server/storage/archive.test.ts
new file mode 100644
index 00000000..a2f3a983
--- /dev/null
+++ b/src/lib/server/storage/archive.test.ts
@@ -0,0 +1,430 @@
+import { describe, it, expect, vi, beforeEach, afterAll } from 'vitest';
+import { readFileSync, unlinkSync, existsSync, mkdtempSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import AdmZip from 'adm-zip';
+import * as tar from 'tar-stream';
+import { createWriteStream } from 'node:fs';
+import { createGzip } from 'node:zlib';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: { child: () => ({ info: vi.fn(), debug: vi.fn(), warn: vi.fn() }) }
+}));
+
+import {
+  getArchiveFormat,
+  listArchiveContents,
+  extractArchiveEntry,
+  clearArchiveCache,
+  type ArchiveDownloadFn
+} from './archive.js';
+
+const testDir = mkdtempSync(join(tmpdir(), 'archive-test-'));
+const cleanupPaths: string[] = [];
+
+function testPath(name: string): string {
+  const p = join(testDir, name);
+  cleanupPaths.push(p);
+  return p;
+}
+
+function makeZip(path: string, entries: Record<string, string | Buffer>): void {
+  const zip = new AdmZip();
+  for (const [name, content] of Object.entries(entries)) {
+    if (typeof content === 'string') {
+      zip.addFile(name, Buffer.from(content, 'utf-8'));
+    } else {
+      zip.addFile(name, content);
+    }
+  }
+  zip.writeZip(path);
+}
+
+function makeTar(path: string, entries: Record<string, string>): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const pack = tar.pack();
+    const ws = createWriteStream(path);
+    pack.pipe(ws);
+    for (const [name, content] of Object.entries(entries)) {
+      pack.entry({ name }, Buffer.from(content, 'utf-8'));
+    }
+    pack.finalize();
+    ws.on('finish', resolve);
+    ws.on('error', reject);
+  });
+}
+
+function makeTarGz(path: string, entries: Record<string, string>): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const pack = tar.pack();
+    const gz = createGzip();
+    const ws = createWriteStream(path);
+    pack.pipe(gz).pipe(ws);
+    for (const [name, content] of Object.entries(entries)) {
+      pack.entry({ name }, Buffer.from(content, 'utf-8'));
+    }
+    pack.finalize();
+    ws.on('finish', resolve);
+    ws.on('error', reject);
+  });
+}
+
+function makeNestedZip(): string {
+  const innerZip = new AdmZip();
+  innerZip.addFile('nested.txt', Buffer.from('nested content', 'utf-8'));
+  const innerPath = testPath('inner.zip');
+  innerZip.writeZip(innerPath);
+
+  const outerZip = new AdmZip();
+  outerZip.addFile('top.txt', Buffer.from('top content', 'utf-8'));
+  outerZip.addLocalFile(innerPath, 'archives/');
+  const outerPath = testPath('outer.zip');
+  outerZip.writeZip(outerPath);
+  return outerPath;
+}
+
+const dummyDownloadFn: ArchiveDownloadFn = (key: string) => {
+  const buf = readFileSync(key);
+  return Promise.resolve(
+    new ReadableStream({
+      start(controller) {
+        controller.enqueue(new Uint8Array(buf));
+        controller.close();
+      }
+    })
+  );
+};
+
+describe('getArchiveFormat', () => {
+  it('detects .zip', () => {
+    expect(getArchiveFormat('archive.zip')).toBe('zip');
+  });
+
+  it('detects .tar.gz', () => {
+    expect(getArchiveFormat('archive.tar.gz')).toBe('tar.gz');
+  });
+
+  it('detects .tgz', () => {
+    expect(getArchiveFormat('archive.tgz')).toBe('tgz');
+  });
+
+  it('detects .tar', () => {
+    expect(getArchiveFormat('archive.tar')).toBe('tar');
+  });
+
+  it('detects .rar', () => {
+    expect(getArchiveFormat('archive.rar')).toBe('rar');
+  });
+
+  it('detects .7z', () => {
+    expect(getArchiveFormat('archive.7z')).toBe('7z');
+  });
+
+  it('returns null for non-archive files', () => {
+    expect(getArchiveFormat('readme.txt')).toBeNull();
+    expect(getArchiveFormat('script.js')).toBeNull();
+    expect(getArchiveFormat('data.csv')).toBeNull();
+  });
+
+  it('is case-insensitive', () => {
+    expect(getArchiveFormat('ARCHIVE.ZIP')).toBe('zip');
+    expect(getArchiveFormat('Archive.Tar.Gz')).toBe('tar.gz');
+  });
+});
+
+describe('listArchiveContents', () => {
+  beforeEach(() => {
+    clearArchiveCache();
+  });
+
+  afterAll(() => {
+    clearArchiveCache();
+    for (const p of cleanupPaths) {
+      try {
+        if (existsSync(p)) unlinkSync(p);
+      } catch {
+        /* noop */
+      }
+    }
+    try {
+      if (existsSync(testDir)) unlinkSync(testDir);
+    } catch {
+      /* noop */
+    }
+  });
+
+  describe('ZIP', () => {
+    it('lists top-level files and directories', async () => {
+      const path = testPath('test.zip');
+      makeZip(path, {
+        'README.md': '# Test',
+        'src/index.js': 'console.log("hello")',
+        'src/lib/util.js': 'export const x = 1',
+        'docs/guide.md': '# Guide'
+      });
+
+      const listing = await listArchiveContents('test-bucket', path, '', dummyDownloadFn, vi.fn());
+
+      const dirs = listing.entries.filter((e) => e.isDirectory).map((e) => e.key);
+      const files = listing.entries.filter((e) => !e.isDirectory).map((e) => e.key);
+
+      expect(dirs.sort()).toEqual(['docs/', 'src/']);
+      expect(files).toEqual(['README.md']);
+    });
+
+    it('lists contents under an internal prefix', async () => {
+      const path = testPath('nested.zip');
+      makeZip(path, {
+        'a/b/c/file1.txt': 'one',
+        'a/b/c/file2.txt': 'two',
+        'a/b/other.md': 'other',
+        'a/top.txt': 'top'
+      });
+
+      const listing = await listArchiveContents(
+        'test-bucket',
+        path,
+        'a/b/',
+        dummyDownloadFn,
+        vi.fn()
+      );
+
+      const dirs = listing.entries.filter((e) => e.isDirectory).map((e) => e.key);
+      const files = listing.entries.filter((e) => !e.isDirectory).map((e) => e.key);
+
+      expect(dirs.sort()).toEqual(['c/']);
+      expect(files).toEqual(['other.md']);
+    });
+
+    it('filters out deep nested entries at prefix root', async () => {
+      const path = testPath('deep.zip');
+      makeZip(path, {
+        'top.txt': 'top',
+        'alpha/beta/gamma/deep.txt': 'deep',
+        'alpha/beta/other.txt': 'other',
+        'alpha/surface.txt': 'surface'
+      });
+
+      const listing = await listArchiveContents(
+        'test-bucket',
+        path,
+        'alpha/',
+        dummyDownloadFn,
+        vi.fn()
+      );
+
+      const dirs = listing.entries.filter((e) => e.isDirectory).map((e) => e.key);
+      const files = listing.entries.filter((e) => !e.isDirectory).map((e) => e.key);
+
+      expect(dirs).toEqual(['beta/']);
+      expect(files).toEqual(['surface.txt']);
+    });
+
+    it('handles empty archive', async () => {
+      const path = testPath('empty.zip');
+      makeZip(path, {});
+
+      const listing = await listArchiveContents('test-bucket', path, '', dummyDownloadFn, vi.fn());
+
+      expect(listing.entries).toHaveLength(0);
+    });
+
+    it('handles prefix with no matches', async () => {
+      const path = testPath('nomatch.zip');
+      makeZip(path, { 'only.txt': 'content' });
+
+      const listing = await listArchiveContents(
+        'test-bucket',
+        path,
+        'nonexistent/',
+        dummyDownloadFn,
+        vi.fn()
+      );
+
+      expect(listing.entries).toHaveLength(0);
+    });
+  });
+
+  describe('TAR', () => {
+    it('lists top-level files and directories', async () => {
+      const path = testPath('test.tar');
+      await makeTar(path, {
+        'README.md': '# Test',
+        'src/index.js': 'console.log("hello")',
+        'src/lib/util.js': 'export const x = 1',
+        'docs/guide.md': '# Guide'
+      });
+
+      const listing = await listArchiveContents('test-bucket', path, '', dummyDownloadFn, vi.fn());
+
+      const dirs = listing.entries.filter((e) => e.isDirectory).map((e) => e.key);
+      const files = listing.entries.filter((e) => !e.isDirectory).map((e) => e.key);
+
+      expect(dirs.sort()).toEqual(['docs/', 'src/']);
+      expect(files).toEqual(['README.md']);
+    });
+
+    it('lists contents under an internal prefix', async () => {
+      const path = testPath('nested.tar');
+      await makeTar(path, {
+        'x/y/z/data.txt': 'data',
+        'x/y/other.txt': 'other',
+        'x/root.txt': 'root'
+      });
+
+      const listing = await listArchiveContents(
+        'test-bucket',
+        path,
+        'x/y/',
+        dummyDownloadFn,
+        vi.fn()
+      );
+
+      const dirs = listing.entries.filter((e) => e.isDirectory).map((e) => e.key);
+      const files = listing.entries.filter((e) => !e.isDirectory).map((e) => e.key);
+
+      expect(dirs).toEqual(['z/']);
+      expect(files).toEqual(['other.txt']);
+    });
+  });
+
+  describe('TAR.GZ', () => {
+    it('lists contents of a compressed tar', async () => {
+      const path = testPath('test.tar.gz');
+      await makeTarGz(path, {
+        'data/file1.csv': 'a,b,c',
+        'data/file2.csv': 'd,e,f',
+        'summary.txt': 'summary'
+      });
+
+      const listing = await listArchiveContents('test-bucket', path, '', dummyDownloadFn, vi.fn());
+
+      const dirs = listing.entries.filter((e) => e.isDirectory).map((e) => e.key);
+      const files = listing.entries.filter((e) => !e.isDirectory).map((e) => e.key);
+
+      expect(dirs).toEqual(['data/']);
+      expect(files).toEqual(['summary.txt']);
+    });
+  });
+
+  describe('Nested archives', () => {
+    it('lists contents of a nested zip inside outer zip', async () => {
+      const outerPath = makeNestedZip();
+
+      const listing = await listArchiveContents(
+        'test-bucket',
+        outerPath,
+        '',
+        dummyDownloadFn,
+        vi.fn(),
+        'archives/inner.zip'
+      );
+
+      const files = listing.entries.filter((e) => !e.isDirectory).map((e) => e.key);
+      expect(files).toEqual(['nested.txt']);
+    });
+  });
+});
+
+describe('extractArchiveEntry', () => {
+  beforeEach(() => {
+    clearArchiveCache();
+  });
+
+  it('extracts a file from a ZIP', async () => {
+    const path = testPath('extract.zip');
+    makeZip(path, { 'hello.txt': 'Hello, World!' });
+
+    const buf = await extractArchiveEntry(
+      'test-bucket',
+      path,
+      'hello.txt',
+      dummyDownloadFn,
+      vi.fn()
+    );
+
+    expect(buf).toBeInstanceOf(Buffer);
+    expect(buf!.toString('utf-8')).toBe('Hello, World!');
+  });
+
+  it('extracts a file from a TAR', async () => {
+    const path = testPath('extract.tar');
+    await makeTar(path, { 'greeting.txt': 'Hi there' });
+
+    const buf = await extractArchiveEntry(
+      'test-bucket',
+      path,
+      'greeting.txt',
+      dummyDownloadFn,
+      vi.fn()
+    );
+
+    expect(buf!.toString('utf-8')).toBe('Hi there');
+  });
+
+  it('extracts a file from a TAR.GZ', async () => {
+    const path = testPath('extract.tar.gz');
+    await makeTarGz(path, { 'compressed.txt': 'was compressed' });
+
+    const buf = await extractArchiveEntry(
+      'test-bucket',
+      path,
+      'compressed.txt',
+      dummyDownloadFn,
+      vi.fn()
+    );
+
+    expect(buf!.toString('utf-8')).toBe('was compressed');
+  });
+
+  it('returns null for non-existent file', async () => {
+    const path = testPath('missing.zip');
+    makeZip(path, { 'exists.txt': 'content' });
+
+    const buf = await extractArchiveEntry(
+      'test-bucket',
+      path,
+      'not-found.txt',
+      dummyDownloadFn,
+      vi.fn()
+    );
+
+    expect(buf).toBeNull();
+  });
+
+  it('extracts a file from a nested archive', async () => {
+    const outerPath = makeNestedZip();
+
+    const buf = await extractArchiveEntry(
+      'test-bucket',
+      outerPath,
+      'nested.txt',
+      dummyDownloadFn,
+      vi.fn(),
+      'archives/inner.zip'
+    );
+
+    expect(buf!.toString('utf-8')).toBe('nested content');
+  });
+});
+
+describe('Caching', () => {
+  it('reuses cached archive across listing calls', async () => {
+    clearArchiveCache();
+    const path = testPath('cached.zip');
+    makeZip(path, { 'file.txt': 'content' });
+
+    const downloadSpy = vi.fn(dummyDownloadFn);
+
+    const first = await listArchiveContents('test-bucket', path, '', downloadSpy, vi.fn());
+    expect(first.entries).toHaveLength(1);
+    expect(downloadSpy).toHaveBeenCalledTimes(1);
+
+    const second = await listArchiveContents('test-bucket', path, '', downloadSpy, vi.fn());
+    expect(second.entries).toHaveLength(1);
+    // downloadFn should NOT be called again — result comes from cache
+    expect(downloadSpy).toHaveBeenCalledTimes(1);
+
+    clearArchiveCache();
+  });
+});
diff --git a/src/lib/server/storage/archive.ts b/src/lib/server/storage/archive.ts
new file mode 100644
index 00000000..5cad51f3
--- /dev/null
+++ b/src/lib/server/storage/archive.ts
@@ -0,0 +1,919 @@
+import {
+  createReadStream,
+  createWriteStream,
+  existsSync,
+  mkdtempSync,
+  writeFileSync,
+  rmSync
+} from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, extname, resolve, sep } from 'node:path';
+import { createGunzip } from 'node:zlib';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import AdmZip from 'adm-zip';
+import * as tar from 'tar-stream';
+import { Readable } from 'node:stream';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'archive-service' });
+
+const execFileAsync = promisify(execFile);
+
+export interface ArchiveEntry {
+  key: string;
+  size: number;
+  lastModified: Date;
+  isDirectory: boolean;
+}
+
+export interface ArchiveListing {
+  entries: ArchiveEntry[];
+  hasMore: boolean;
+  /** When true, the archive exceeded the previewable size limit. */
+  tooLarge?: boolean;
+}
+
+const CACHE_TTL = 30 * 60 * 1000;
+const CLEANUP_INTERVAL = 60_000;
+
+interface CacheEntry {
+  path: string;
+  expiresAt: number;
+  bucket: string;
+  key: string;
+}
+
+const archiveCache = new Map<string, CacheEntry>();
+
+const cleanupTimer = setInterval(() => {
+  const now = Date.now();
+  for (const [cacheKey, entry] of archiveCache) {
+    if (now > entry.expiresAt) {
+      try {
+        const dir = join(entry.path, '..');
+        if (existsSync(dir)) rmRecursive(dir);
+      } catch (err) {
+        log.warn({ err, cache_key: cacheKey }, 'failed to clean up archive temp file');
+      }
+      archiveCache.delete(cacheKey);
+    }
+  }
+}, CLEANUP_INTERVAL);
+
+if (cleanupTimer.unref) cleanupTimer.unref();
+
+function cacheKey(bucket: string, key: string): string {
+  return `${bucket}:${key}`;
+}
+
+function getCachedPath(bucket: string, key: string): string | null {
+  const entry = archiveCache.get(cacheKey(bucket, key));
+  if (entry && Date.now() < entry.expiresAt && existsSync(entry.path)) {
+    return entry.path;
+  }
+  if (entry) archiveCache.delete(cacheKey(bucket, key));
+  return null;
+}
+
+function cacheArchive(bucket: string, key: string, path: string): void {
+  archiveCache.set(cacheKey(bucket, key), { path, expiresAt: Date.now() + CACHE_TTL, bucket, key });
+}
+
+function streamToTempFile(stream: ReadableStream, ext: string): Promise<string> {
+  return new Promise<string>((resolve, reject) => {
+    const tmpDir = mkdtempSync(join(tmpdir(), 'archive-'));
+    const tmpPath = join(tmpDir, `archive${ext}`);
+    const writable = createWriteStream(tmpPath);
+    const nodeStream = Readable.fromWeb(stream as import('stream/web').ReadableStream);
+
+    function cleanup() {
+      try {
+        rmRecursive(tmpDir);
+      } catch {
+        /* noop */
+      }
+    }
+
+    nodeStream.pipe(writable);
+    nodeStream.on('error', (err) => {
+      writable.destroy();
+      cleanup();
+      reject(err);
+    });
+    writable.on('finish', () => resolve(tmpPath));
+    writable.on('error', (err) => {
+      cleanup();
+      reject(err);
+    });
+  });
+}
+
+const ARCHIVE_EXT_PATTERNS = [
+  { ext: '.zip', formats: ['zip'] as const },
+  { ext: '.tar.gz', formats: ['tar.gz', 'tgz'] as const },
+  { ext: '.tar', formats: ['tar'] as const },
+  { ext: '.rar', formats: ['rar'] as const },
+  { ext: '.7z', formats: ['7z'] as const }
+];
+
+function normalizePath(p: string): string {
+  return p.replace(/\\/g, '/').replace(/\/+/g, '/');
+}
+
+function ensureTrailingSlash(p: string): string {
+  return p.endsWith('/') ? p : p + '/';
+}
+
+export function getArchiveFormat(key: string): string | null {
+  const lower = key.toLowerCase();
+  for (const { formats } of ARCHIVE_EXT_PATTERNS) {
+    for (const fmt of formats) {
+      if (lower.endsWith(`.${fmt}`)) return fmt;
+    }
+  }
+  return null;
+}
+
+// ── ZIP ──────────────────────────────────────────────────────────────────────
+
+function listZip(tempPath: string, internalPrefix: string, maxBytes?: number): ArchiveListing {
+  const zip = new AdmZip(tempPath);
+  const prefix = internalPrefix ? ensureTrailingSlash(normalizePath(internalPrefix)) : '';
+  const entries = zip.getEntries();
+
+  const seenDirs = new Set<string>();
+  const result: ArchiveEntry[] = [];
+  let totalDecompressed = 0;
+
+  for (const entry of entries) {
+    const entryPath = normalizePath(entry.entryName);
+
+    if (!entryPath.startsWith(prefix)) continue;
+
+    if (!entry.isDirectory) {
+      if (maxBytes !== undefined) {
+        totalDecompressed += entry.header.size;
+        if (totalDecompressed > maxBytes) {
+          return { entries: [], hasMore: false, tooLarge: true };
+        }
+      }
+    }
+
+    const relative = entryPath.slice(prefix.length);
+    if (!relative) continue;
+
+    if (entry.isDirectory) {
+      if (!relative.includes('/') && !seenDirs.has(relative)) {
+        seenDirs.add(relative);
+        result.push({
+          key: relative,
+          size: 0,
+          lastModified: new Date(entry.header.time),
+          isDirectory: true
+        });
+      }
+    } else {
+      if (relative.includes('/')) {
+        const dirName = relative.split('/')[0] + '/';
+        if (!seenDirs.has(dirName)) {
+          seenDirs.add(dirName);
+          result.push({
+            key: dirName,
+            size: 0,
+            lastModified: new Date(entry.header.time),
+            isDirectory: true
+          });
+        }
+      } else {
+        result.push({
+          key: relative,
+          size: entry.header.size,
+          lastModified: new Date(entry.header.time),
+          isDirectory: false
+        });
+      }
+    }
+  }
+
+  return { entries: result, hasMore: false };
+}
+
+function extractZipEntry(tempPath: string, internalPath: string): Buffer | null {
+  const zip = new AdmZip(tempPath);
+  const entry = zip.getEntry(internalPath);
+  if (!entry || entry.isDirectory) return null;
+  return entry.getData();
+}
+
+// ── TAR helpers (shared by plain .tar and .tar.gz) ────────────────────────────
+
+interface TarListState {
+  entries: ArchiveEntry[];
+  seenDirs: Set<string>;
+  totalDecompressed: number;
+  tooLarge: boolean;
+}
+
+function onTarEntry(
+  header: tar.Headers,
+  stream: NodeJS.ReadableStream,
+  next: (err?: Error | null) => void,
+  prefix: string,
+  state: TarListState,
+  maxBytes?: number
+): void {
+  let entryPath = normalizePath(header.name);
+
+  if (header.type === 'directory') {
+    entryPath = ensureTrailingSlash(entryPath);
+  }
+
+  if (state.tooLarge) {
+    stream.resume();
+    stream.on('end', next);
+    return;
+  }
+
+  if (!entryPath.startsWith(prefix)) {
+    stream.resume();
+    stream.on('end', next);
+    return;
+  }
+
+  const relative = entryPath.slice(prefix.length);
+  if (!relative) {
+    stream.resume();
+    stream.on('end', next);
+    return;
+  }
+
+  if (header.type !== 'directory' && header.size && maxBytes !== undefined) {
+    state.totalDecompressed += header.size;
+    if (state.totalDecompressed > maxBytes) {
+      state.tooLarge = true;
+      stream.resume();
+      stream.on('end', next);
+      return;
+    }
+  }
+
+  if (header.type === 'directory') {
+    if (!relative.includes('/') && !state.seenDirs.has(relative)) {
+      state.seenDirs.add(relative);
+      state.entries.push({
+        key: relative,
+        size: 0,
+        lastModified: new Date(header.mtime?.getTime() ?? 0),
+        isDirectory: true
+      });
+    }
+  } else {
+    if (relative.includes('/')) {
+      const dirName = relative.split('/')[0] + '/';
+      if (!state.seenDirs.has(dirName)) {
+        state.seenDirs.add(dirName);
+        state.entries.push({
+          key: dirName,
+          size: 0,
+          lastModified: new Date(0),
+          isDirectory: true
+        });
+      }
+    } else {
+      state.entries.push({
+        key: relative,
+        size: header.size ?? 0,
+        lastModified: new Date(header.mtime?.getTime() ?? 0),
+        isDirectory: false
+      });
+    }
+  }
+
+  stream.resume();
+  stream.on('end', next);
+}
+
+// ── TAR ───────────────────────────────────────────────────────────────────────
+
+function listTar(
+  tempPath: string,
+  internalPrefix: string,
+  maxBytes?: number
+): Promise<ArchiveListing> {
+  return new Promise((resolve, reject) => {
+    const prefix = internalPrefix ? ensureTrailingSlash(normalizePath(internalPrefix)) : '';
+    const state: TarListState = {
+      entries: [],
+      seenDirs: new Set(),
+      totalDecompressed: 0,
+      tooLarge: false
+    };
+
+    const extract = tar.extract();
+
+    extract.on(
+      'entry',
+      (header: tar.Headers, stream: NodeJS.ReadableStream, next: (err?: Error | null) => void) => {
+        onTarEntry(header, stream, next, prefix, state, maxBytes);
+      }
+    );
+
+    extract.on('finish', () => {
+      if (state.tooLarge) {
+        resolve({ entries: [], hasMore: false, tooLarge: true });
+      } else {
+        resolve({ entries: state.entries, hasMore: false });
+      }
+    });
+    extract.on('error', reject);
+
+    createReadStream(tempPath).pipe(extract);
+  });
+}
+
+function extractTarEntry(tempPath: string, internalPath: string): Promise<Buffer | null> {
+  return new Promise((resolve, reject) => {
+    const normalized = normalizePath(internalPath);
+    let found: Buffer | null = null;
+
+    const extract = tar.extract();
+
+    extract.on(
+      'entry',
+      (header: tar.Headers, stream: NodeJS.ReadableStream, next: (err?: Error | null) => void) => {
+        const entryPath = normalizePath(header.name);
+        if (header.type === 'file' && entryPath === normalized && !found) {
+          const chunks: Buffer[] = [];
+          stream.on('data', (chunk: Buffer) => chunks.push(chunk));
+          stream.on('end', () => {
+            found = Buffer.concat(chunks);
+            next();
+          });
+        } else {
+          stream.resume();
+          stream.on('end', next);
+        }
+      }
+    );
+
+    extract.on('finish', () => resolve(found));
+    extract.on('error', reject);
+
+    createReadStream(tempPath).pipe(extract);
+  });
+}
+
+// ── TAR.GZ / TGZ ─────────────────────────────────────────────────────────────
+
+function listTarGz(
+  tempPath: string,
+  internalPrefix: string,
+  maxBytes?: number
+): Promise<ArchiveListing> {
+  return new Promise((resolve, reject) => {
+    const prefix = internalPrefix ? ensureTrailingSlash(normalizePath(internalPrefix)) : '';
+    const state: TarListState = {
+      entries: [],
+      seenDirs: new Set(),
+      totalDecompressed: 0,
+      tooLarge: false
+    };
+
+    const extract = tar.extract();
+    const gunzip = createGunzip();
+
+    extract.on(
+      'entry',
+      (header: tar.Headers, stream: NodeJS.ReadableStream, next: (err?: Error | null) => void) => {
+        onTarEntry(header, stream, next, prefix, state, maxBytes);
+      }
+    );
+
+    extract.on('finish', () => {
+      if (state.tooLarge) {
+        resolve({ entries: [], hasMore: false, tooLarge: true });
+      } else {
+        resolve({ entries: state.entries, hasMore: false });
+      }
+    });
+    extract.on('error', reject);
+    gunzip.on('error', reject);
+
+    createReadStream(tempPath).pipe(gunzip).pipe(extract);
+  });
+}
+
+function extractTarGzEntry(tempPath: string, internalPath: string): Promise<Buffer | null> {
+  return new Promise((resolve, reject) => {
+    const normalized = normalizePath(internalPath);
+    let found: Buffer | null = null;
+
+    const extract = tar.extract();
+    const gunzip = createGunzip();
+
+    extract.on(
+      'entry',
+      (header: tar.Headers, stream: NodeJS.ReadableStream, next: (err?: Error | null) => void) => {
+        const entryPath = normalizePath(header.name);
+        if (header.type === 'file' && entryPath === normalized && !found) {
+          const chunks: Buffer[] = [];
+          stream.on('data', (chunk: Buffer) => chunks.push(chunk));
+          stream.on('end', () => {
+            found = Buffer.concat(chunks);
+            next();
+          });
+        } else {
+          stream.resume();
+          stream.on('end', next);
+        }
+      }
+    );
+
+    extract.on('finish', () => resolve(found));
+    extract.on('error', reject);
+    gunzip.on('error', reject);
+
+    createReadStream(tempPath).pipe(gunzip).pipe(extract);
+  });
+}
+
+// ── RAR ──────────────────────────────────────────────────────────────────────
+
+async function listRar(tempPath: string, internalPrefix: string): Promise<ArchiveListing> {
+  const prefix = internalPrefix ? ensureTrailingSlash(normalizePath(internalPrefix)) : '';
+
+  try {
+    const { stdout } = await execFileAsync('unrar', ['lb', tempPath], { timeout: 30000 });
+    const allEntries = stdout
+      .split('\n')
+      .map((l) => normalizePath(l.trim()))
+      .filter(Boolean);
+
+    const seenDirs = new Set<string>();
+    const entries: ArchiveEntry[] = [];
+
+    for (const entryPath of allEntries) {
+      const isDir = entryPath.endsWith('/');
+      const path = entryPath;
+
+      if (!path.startsWith(prefix)) continue;
+      const relative = path.slice(prefix.length);
+      if (!relative) continue;
+
+      if (isDir) {
+        if (!relative.includes('/') && !seenDirs.has(relative)) {
+          seenDirs.add(relative);
+          entries.push({
+            key: relative,
+            size: 0,
+            lastModified: new Date(0),
+            isDirectory: true
+          });
+        }
+      } else {
+        if (relative.includes('/')) {
+          const dirName = relative.split('/')[0] + '/';
+          if (!seenDirs.has(dirName)) {
+            seenDirs.add(dirName);
+            entries.push({ key: dirName, size: 0, lastModified: new Date(0), isDirectory: true });
+          }
+        } else {
+          entries.push({
+            key: relative,
+            size: 0,
+            lastModified: new Date(0),
+            isDirectory: false
+          });
+        }
+      }
+    }
+
+    return { entries, hasMore: false };
+  } catch (err) {
+    throw new Error(
+      'RAR support requires the "unrar" command to be installed on the server. ' +
+        (err instanceof Error ? err.message : String(err))
+    );
+  }
+}
+
+async function extractRarEntry(tempPath: string, internalPath: string): Promise<Buffer | null> {
+  const tmpDir = mkdtempSync(join(tmpdir(), 'rar-extract-'));
+  try {
+    const { stdout } = await execFileAsync('unrar', ['p', '-inul', tempPath, internalPath], {
+      timeout: 30000,
+      maxBuffer: 100 * 1024 * 1024
+    });
+    if (!stdout) return null;
+    return Buffer.from(stdout, 'binary');
+  } catch (err) {
+    throw new Error('RAR extraction failed: ' + (err instanceof Error ? err.message : String(err)));
+  } finally {
+    try {
+      rmRecursive(tmpDir);
+    } catch {
+      /* noop */
+    }
+  }
+}
+
+// ── 7z ───────────────────────────────────────────────────────────────────────
+
+const SEVEN_ZIP_BINARIES = ['7zz', '7zr', '7z'];
+
+async function find7zBinary(): Promise<string | null> {
+  for (const bin of SEVEN_ZIP_BINARIES) {
+    try {
+      await execFileAsync('which', [bin], { timeout: 5000 });
+      return bin;
+    } catch {
+      /* noop */
+    }
+  }
+  return null;
+}
+
+async function list7z(
+  tempPath: string,
+  internalPrefix: string,
+  maxBytes?: number
+): Promise<ArchiveListing> {
+  const bin = await find7zBinary();
+  if (!bin) throw new Error('7z support requires 7-Zip to be installed on the server.');
+
+  const prefix = internalPrefix ? ensureTrailingSlash(normalizePath(internalPrefix)) : '';
+
+  try {
+    const { stdout } = await execFileAsync(bin, ['l', '-slt', '-ba', tempPath], { timeout: 30000 });
+    return parse7zListing(stdout, prefix, maxBytes);
+  } catch (err) {
+    throw new Error('7z listing failed: ' + (err instanceof Error ? err.message : String(err)));
+  }
+}
+
+function parse7zListing(stdout: string, prefix: string, maxBytes?: number): ArchiveListing {
+  const lines = stdout
+    .split('\n')
+    .map((l) => l.trim())
+    .filter(Boolean);
+  const entries: ArchiveEntry[] = [];
+  const seenDirs = new Set<string>();
+  let currentPath = '';
+  let currentSize = 0;
+  let isDir = false;
+  let totalDecompressed = 0;
+
+  for (const line of lines) {
+    if (line.startsWith('Path = ')) {
+      const path = normalizePath(line.slice(6).trim());
+      if (currentPath && currentPath.startsWith(prefix)) {
+        const relative = currentPath.slice(prefix.length);
+        if (relative) {
+          if (isDir && !relative.includes('/') && !seenDirs.has(ensureTrailingSlash(relative))) {
+            seenDirs.add(ensureTrailingSlash(relative));
+            entries.push({
+              key: ensureTrailingSlash(relative),
+              size: 0,
+              lastModified: new Date(0),
+              isDirectory: true
+            });
+          } else if (!isDir) {
+            if (maxBytes !== undefined) {
+              totalDecompressed += currentSize;
+              if (totalDecompressed > maxBytes) {
+                return { entries: [], hasMore: false, tooLarge: true };
+              }
+            }
+            if (relative.includes('/')) {
+              const dirName = relative.split('/')[0] + '/';
+              if (!seenDirs.has(dirName)) {
+                seenDirs.add(dirName);
+                entries.push({
+                  key: dirName,
+                  size: 0,
+                  lastModified: new Date(0),
+                  isDirectory: true
+                });
+              }
+            } else {
+              entries.push({
+                key: relative,
+                size: currentSize,
+                lastModified: new Date(0),
+                isDirectory: false
+              });
+            }
+          }
+        }
+      }
+      currentPath = path;
+      currentSize = 0;
+      isDir = false;
+    } else if (line.startsWith('Size = ')) {
+      currentSize = parseInt(line.slice(6).trim(), 10) || 0;
+    } else if (line.startsWith('Folder = ')) {
+      isDir = line.slice(8).trim() === '+';
+    }
+  }
+
+  if (currentPath && currentPath.startsWith(prefix)) {
+    const relative = currentPath.slice(prefix.length);
+    if (relative) {
+      if (isDir && !relative.includes('/') && !seenDirs.has(ensureTrailingSlash(relative))) {
+        entries.push({
+          key: ensureTrailingSlash(relative),
+          size: 0,
+          lastModified: new Date(0),
+          isDirectory: true
+        });
+      } else if (!isDir) {
+        entries.push({
+          key: relative,
+          size: currentSize,
+          lastModified: new Date(0),
+          isDirectory: false
+        });
+      }
+    }
+  }
+
+  return { entries, hasMore: false };
+}
+
+async function extract7zEntry(tempPath: string, internalPath: string): Promise<Buffer | null> {
+  const bin = await find7zBinary();
+  if (!bin) throw new Error('7z support requires 7-Zip to be installed on the server.');
+
+  if (internalPath.includes('..')) {
+    throw new Error('Path traversal rejected');
+  }
+
+  const tmpDir = mkdtempSync(join(tmpdir(), '7z-extract-'));
+  try {
+    await execFileAsync(bin, ['x', '-y', `-o${tmpDir}`, tempPath, internalPath], {
+      timeout: 60000
+    });
+    const resolvedPath = resolve(tmpDir, internalPath);
+    if (!resolvedPath.startsWith(tmpDir + sep)) {
+      throw new Error('Path traversal rejected');
+    }
+    if (!existsSync(resolvedPath)) return null;
+    return readFile(resolvedPath);
+  } catch (err) {
+    throw new Error('7z extraction failed: ' + (err instanceof Error ? err.message : String(err)));
+  } finally {
+    try {
+      rmRecursive(tmpDir);
+    } catch {
+      /* noop */
+    }
+  }
+}
+
+function rmRecursive(dir: string): void {
+  rmSync(dir, { recursive: true, force: true });
+}
+
+// ── Public API ───────────────────────────────────────────────────────────────
+
+export type ArchiveDownloadFn = (key: string) => Promise<ReadableStream>;
+export type ArchiveMetadataFn = (key: string) => Promise<{ size: number; contentType?: string }>;
+
+/**
+ * Resolve the archive file to a local temp path.
+ * For nested archives, first download the outer archive, then extract the nested one.
+ */
+async function resolveArchivePath(
+  bucket: string,
+  key: string,
+  nestedArchivePath: string | undefined,
+  downloadFn: ArchiveDownloadFn
+): Promise<string> {
+  let tempPath = getCachedPath(bucket, key);
+  if (!tempPath) {
+    log.info({ bucket, key }, 'downloading archive');
+    const ext = extname(key) || '.bin';
+    const stream = await downloadFn(key);
+    tempPath = await streamToTempFile(stream, ext);
+    cacheArchive(bucket, key, tempPath);
+  }
+
+  if (!nestedArchivePath) return tempPath;
+
+  // Resolve nested archive — cache it under a composite key
+  const nestedCacheKey = cacheKey(bucket, `${key}!/${nestedArchivePath}`);
+  const cachedEntry = archiveCache.get(nestedCacheKey);
+  if (cachedEntry && Date.now() < cachedEntry.expiresAt && existsSync(cachedEntry.path)) {
+    return cachedEntry.path;
+  }
+  if (cachedEntry) archiveCache.delete(nestedCacheKey);
+
+  log.info({ bucket, key, nested_archive_path: nestedArchivePath }, 'extracting nested archive');
+
+  // Extract nested archive from outer archive
+  const format = getArchiveFormat(key);
+  if (!format) throw new Error(`Unsupported archive format: ${key}`);
+
+  let nestedData: Buffer | null = null;
+  const normNestedPath = normalizePath(nestedArchivePath);
+
+  switch (format) {
+    case 'zip':
+      nestedData = extractZipEntry(tempPath, normNestedPath) ?? null;
+      break;
+    case 'tar':
+      nestedData = await extractTarEntry(tempPath, normNestedPath);
+      break;
+    case 'tar.gz':
+    case 'tgz':
+      nestedData = await extractTarGzEntry(tempPath, normNestedPath);
+      break;
+    case 'rar':
+      nestedData = await extractRarEntry(tempPath, normNestedPath);
+      break;
+    case '7z':
+      nestedData = await extract7zEntry(tempPath, normNestedPath);
+      break;
+  }
+
+  if (!nestedData) throw new Error(`Nested archive "${nestedArchivePath}" not found in ${key}`);
+
+  // Save nested archive to temp file and cache it
+  const nestedExt = extname(nestedArchivePath) || '.bin';
+  const nestedDir = mkdtempSync(join(tmpdir(), 'archive-nested-'));
+  const nestedPath = join(nestedDir, `archive${nestedExt}`);
+
+  writeFileSync(nestedPath, nestedData);
+
+  archiveCache.set(nestedCacheKey, {
+    path: nestedPath,
+    expiresAt: Date.now() + CACHE_TTL,
+    bucket,
+    key: `${key}!/${nestedArchivePath}`
+  });
+
+  return nestedPath;
+}
+
+/**
+ * List the contents of an archive at a given internal prefix.
+ * Downloads the archive from S3 once and caches it server-side for 30 minutes.
+ * Supports nested archives via the optional `nestedArchivePath` parameter.
+ */
+export async function listArchiveContents(
+  bucket: string,
+  key: string,
+  internalPrefix: string,
+  downloadFn: ArchiveDownloadFn,
+  metadataFn: ArchiveMetadataFn,
+  nestedArchivePath?: string,
+  maxBytes?: number
+): Promise<ArchiveListing> {
+  const effectiveKey = nestedArchivePath ? `${key}!/${nestedArchivePath}` : key;
+  const format = getArchiveFormat(effectiveKey);
+  if (!format) throw new Error(`Unsupported archive format: ${key}`);
+
+  // Pre-check: if compressed size exceeds the limit, bail out before downloading
+  if (maxBytes !== undefined && !nestedArchivePath) {
+    try {
+      const meta = await metadataFn(key);
+      if (meta.size > maxBytes) {
+        log.info(
+          { bucket, key, compressed_size: meta.size, max_bytes: maxBytes },
+          'archive compressed size exceeds limit'
+        );
+        return { entries: [], hasMore: false, tooLarge: true };
+      }
+    } catch {
+      // metadataFn failure is non-fatal — proceed with download
+    }
+  }
+
+  const tempPath = await resolveArchivePath(bucket, key, nestedArchivePath, downloadFn);
+
+  log.debug(
+    {
+      bucket,
+      key,
+      internal_prefix: internalPrefix,
+      nested_archive_path: nestedArchivePath,
+      format
+    },
+    'listing archive contents'
+  );
+
+  switch (format) {
+    case 'zip':
+      return listZip(tempPath, internalPrefix, maxBytes);
+    case 'tar':
+      return listTar(tempPath, internalPrefix, maxBytes);
+    case 'tar.gz':
+    case 'tgz':
+      return listTarGz(tempPath, internalPrefix, maxBytes);
+    case 'rar':
+      return listRar(tempPath, internalPrefix);
+    case '7z':
+      return list7z(tempPath, internalPrefix, maxBytes);
+    default:
+      throw new Error(`Unsupported archive format: ${format}`);
+  }
+}
+
+/**
+ * Extract a single file from an archive and return its content as a Buffer.
+ * Supports nested archives via the optional `nestedArchivePath` parameter.
+ */
+export async function extractArchiveEntry(
+  bucket: string,
+  key: string,
+  internalPath: string,
+  downloadFn: ArchiveDownloadFn,
+  metadataFn: ArchiveMetadataFn,
+  nestedArchivePath?: string,
+  maxBytes?: number
+): Promise<Buffer | null> {
+  const effectiveKey = nestedArchivePath ? `${key}!/${nestedArchivePath}` : key;
+  const format = getArchiveFormat(effectiveKey);
+  if (!format) throw new Error(`Unsupported archive format: ${key}`);
+
+  // Pre-check: if compressed size exceeds the limit, bail out before downloading
+  if (maxBytes !== undefined && !nestedArchivePath) {
+    try {
+      const meta = await metadataFn(key);
+      if (meta.size > maxBytes) {
+        log.info(
+          { bucket, key, compressed_size: meta.size, max_bytes: maxBytes },
+          'archive compressed size exceeds limit, extraction aborted'
+        );
+        return null;
+      }
+    } catch {
+      // metadataFn failure is non-fatal
+    }
+  }
+
+  const tempPath = await resolveArchivePath(bucket, key, nestedArchivePath, downloadFn);
+
+  log.debug(
+    { bucket, key, internal_path: internalPath, nested_archive_path: nestedArchivePath, format },
+    'extracting archive entry'
+  );
+
+  const normalizedPath = normalizePath(internalPath);
+
+  let data: Buffer | null = null;
+  switch (format) {
+    case 'zip':
+      data = extractZipEntry(tempPath, normalizedPath) ?? null;
+      break;
+    case 'tar':
+      data = await extractTarEntry(tempPath, normalizedPath);
+      break;
+    case 'tar.gz':
+    case 'tgz':
+      data = await extractTarGzEntry(tempPath, normalizedPath);
+      break;
+    case 'rar':
+      data = await extractRarEntry(tempPath, normalizedPath);
+      break;
+    case '7z':
+      data = await extract7zEntry(tempPath, normalizedPath);
+      break;
+    default:
+      return null;
+  }
+
+  // Post-extraction size check
+  if (data && maxBytes !== undefined && data.length > maxBytes) {
+    log.info(
+      {
+        bucket,
+        key,
+        internal_path: internalPath,
+        extracted_size: data.length,
+        max_bytes: maxBytes
+      },
+      'extracted entry size exceeds limit'
+    );
+    return null;
+  }
+
+  return data;
+}
+
+/**
+ * Clean up all cached archive temp files. Useful for testing.
+ */
+export function clearArchiveCache(): void {
+  for (const [cacheKey, entry] of archiveCache) {
+    try {
+      const dir = join(entry.path, '..');
+      if (existsSync(dir)) rmRecursive(dir);
+    } catch {
+      /* noop */
+    }
+    archiveCache.delete(cacheKey);
+  }
+}
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
index 2dcea1dd..55a131ec 100644
--- a/src/lib/server/storage/service.ts
+++ b/src/lib/server/storage/service.ts
@@ -1,8 +1,10 @@
 import { getProvider } from './utils.js';
-import type { S3ConnectionConfig } from './types.js';
+import type { ObjectDownload } from './provider.js';
+import type { StorageMetadata } from '$lib/storage/types.js';
+import type { S3ConnectionConfig, StorageConfig } from './types.js';
 
 export async function uploadObject(
-  config: S3ConnectionConfig,
+  config: StorageConfig | S3ConnectionConfig,
   bucket: string,
   key: string,
   body: Buffer,
@@ -12,3 +14,21 @@ export async function uploadObject(
   const provider = getProvider(config, bucket);
   await provider.putObject(key, body, contentType, contentLength);
 }
+
+export async function downloadObject(
+  config: StorageConfig | S3ConnectionConfig,
+  bucket: string,
+  key: string
+): Promise<ObjectDownload> {
+  const provider = getProvider(config, bucket);
+  return provider.getObject(key);
+}
+
+export async function getObjectMetadata(
+  config: StorageConfig | S3ConnectionConfig,
+  bucket: string,
+  key: string
+): Promise<StorageMetadata> {
+  const provider = getProvider(config, bucket);
+  return provider.getMetadata(key);
+}
diff --git a/src/lib/server/storage/utils.ts b/src/lib/server/storage/utils.ts
index 7efb2d95..4c3f5768 100644
--- a/src/lib/server/storage/utils.ts
+++ b/src/lib/server/storage/utils.ts
@@ -1,13 +1,16 @@
 import { error } from '@sveltejs/kit';
 import { StorageProviderFactory } from './factory.js';
 import type { StorageProvider } from './provider.js';
-import type { S3ConnectionConfig } from './types.js';
+import type { S3ConnectionConfig, StorageConfig } from './types.js';
 
 /**
  * Construct a bucket-scoped storage provider from the given connection config.
  * Throws a 400 HTTP error if the connection type is not supported.
  */
-export function getProvider(config: S3ConnectionConfig, bucket: string): StorageProvider {
+export function getProvider(
+  config: StorageConfig | S3ConnectionConfig,
+  bucket: string
+): StorageProvider {
   if (config.type !== 's3') {
     throw error(400, 'Storage backend not supported');
   }
@@ -20,7 +23,7 @@ export function getProvider(config: S3ConnectionConfig, bucket: string): Storage
  * require a specific bucket (e.g. listing all buckets).
  * Throws a 400 HTTP error if the connection type is not supported.
  */
-export function getConnectionProvider(config: S3ConnectionConfig): StorageProvider {
+export function getConnectionProvider(config: StorageConfig | S3ConnectionConfig): StorageProvider {
   if (config.type !== 's3') {
     throw error(400, 'Storage backend not supported');
   }
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index f0cb6d8a..d04e1abc 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -8,8 +8,11 @@ import type {
   ModalPayloads,
   ContextMenuState,
   NavigateFn,
-  ActionName
+  ActionName,
+  ArchiveListingResponse,
+  ArchiveEntry
 } from '$lib/storage/types.js';
+import { ARCHIVE_EXTENSIONS } from '$lib/storage/types.js';
 import { initPageSize, type PageSize } from '$lib/types/pagination.js';
 import { defaultPageSize } from '$lib/client/feature-flags.js';
 import { downloadObject, DownloadError } from '$lib/storage/download.js';
@@ -84,6 +87,15 @@ export class StorageState {
   pageSize = $state<PageSize>(initPageSize('storage_page_size'));
   currentPage = $derived(this.prevTokens.length + 1);
 
+  // ── Archive navigation ──
+  archiveKey = $state<string | null>(null);
+  archivePrefix = $state('');
+  archiveNestedPath = $state<string | null>(null);
+  previousS3Prefix = $state('');
+  archiveLoading = $state(false);
+  archiveTooLarge = $state(false);
+  isInArchive = $derived(this.archiveKey !== null);
+
   // ── Composed sub-state ──
   bookmarks = new BookmarksState();
 
@@ -116,8 +128,13 @@ export class StorageState {
     this.objects = objects;
     if (bucketChanged) this.prevTokens = [];
     this.loading = false;
-    // Clear selection on navigation
     this.selectedKeys = new SvelteSet<string>();
+    this.archiveKey = null;
+    this.archivePrefix = '';
+    this.archiveNestedPath = null;
+    this.previousS3Prefix = '';
+    this.archiveLoading = false;
+    this.archiveTooLarge = false;
   }
 
   setNavigationHandler(fn: NavigateFn): void {
@@ -195,12 +212,237 @@ export class StorageState {
     this._onNavigate(this.prefix, null, this.pageSize);
   };
 
-  refresh = (): void => {
-    this.loading = true;
-    if (this._onRefreshNavigate) {
-      this._onRefreshNavigate();
+  // ── Archive navigation ────────────────────────────────────────────────────
+
+  /** Check if a filename looks like a navigable archive. */
+  isArchiveFile = (key: string): boolean => {
+    const lower = key.toLowerCase();
+    return ARCHIVE_EXTENSIONS.some((ext) => lower.endsWith(ext));
+  };
+
+  /** Enter an archive file and show its contents as a virtual folder. */
+  enterArchive = async (archiveKey: string): Promise<void> => {
+    if (this.isInArchive) {
+      this.archiveNestedPath = archiveKey;
     } else {
+      this.archiveKey = archiveKey;
+      this.archiveNestedPath = null;
+      this.previousS3Prefix = this.prefix;
+    }
+    this.archivePrefix = '';
+    this.archiveLoading = true;
+
+    try {
+      await this._fetchArchiveListing();
+    } catch (err) {
+      if (this.archiveNestedPath) {
+        this.archiveNestedPath = null;
+      } else {
+        this.archiveKey = null;
+        this.previousS3Prefix = '';
+      }
+      this.archivePrefix = '';
+      this.archiveLoading = false;
+      addToast('error', err instanceof Error ? err.message : m.storage_archive_open_error());
+    }
+  };
+
+  /** Navigate within the current archive (virtual path). */
+  navigateInArchive = async (prefix: string): Promise<void> => {
+    if (!this.archiveKey) return;
+    this.archivePrefix = prefix;
+    this.archiveLoading = true;
+    this.prevTokens = [];
+
+    try {
+      await this._fetchArchiveListing();
+    } catch (err) {
+      this.archiveLoading = false;
+      addToast('error', err instanceof Error ? err.message : m.storage_archive_open_error());
+    }
+  };
+
+  /** Navigate to the root of the outermost archive (clears nested archive state). */
+  navigateToOuterArchiveRoot = (): void => {
+    this.archiveNestedPath = null;
+    this.archivePrefix = '';
+    this.archiveLoading = true;
+    this.prevTokens = [];
+    void this._fetchArchiveListing().catch(() => {
+      this.archiveLoading = false;
+    });
+  };
+
+  /** Navigate up within the archive. If at root, exit the archive or go to parent archive. */
+  navigateUpFromArchive = (): void => {
+    if (!this.archivePrefix) {
+      if (this.archiveNestedPath) {
+        // Go back to outer archive root
+        this.archiveNestedPath = null;
+        this.archivePrefix = '';
+        this.archiveLoading = true;
+        void this._fetchArchiveListing().catch(() => {
+          this.archiveLoading = false;
+        });
+      } else {
+        this.exitArchive();
+      }
+      return;
+    }
+    const withoutTrailing = this.archivePrefix.replace(/\/$/, '');
+    const lastSlash = withoutTrailing.lastIndexOf('/');
+    void this.navigateInArchive(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
+  };
+
+  /** Exit the archive and return to the S3 folder that contains it. */
+  exitArchive = (): void => {
+    const s3Prefix = this.previousS3Prefix;
+    this.archiveKey = null;
+    this.archivePrefix = '';
+    this.archiveNestedPath = null;
+    this.previousS3Prefix = '';
+    this.archiveLoading = false;
+    this.archiveTooLarge = false;
+    this.loading = true;
+    this.prevTokens = [];
+    void this._fetchS3Objects(s3Prefix);
+  };
+
+  /** Manually fetch S3 objects for the given prefix (used when exiting archive). */
+  private async _fetchS3Objects(prefix: string): Promise<void> {
+    try {
+      const conn = loadConnectionLocally();
+      if (!conn) {
+        this.loading = false;
+        return;
+      }
+      const connHeader = getConnectionHeader(conn);
+      const params = new SvelteURLSearchParams({
+        bucket: this.bucket,
+        prefix: prefix ?? '',
+        pageSize: String(this.pageSize)
+      });
+      const res = await fetch(`/api/storage/objects?${params}`, {
+        headers: { 'x-storage-connection': connHeader }
+      });
+      if (res.ok) {
+        const objects = (await res.json()) as StoragePage;
+        this.prefix = prefix;
+        this.objects = objects;
+      }
+    } catch {
+      // Fall back to invalidateAll if manual fetch fails
       void invalidateAll();
+    } finally {
+      this.loading = false;
+    }
+  }
+
+  /** Download a file from within the current archive. */
+  downloadFromArchive = async (internalPath: string): Promise<void> => {
+    if (!this.archiveKey) return;
+    try {
+      const conn = loadConnectionLocally();
+      if (!conn) {
+        addToast('error', m.storage_download_error_unknown());
+        return;
+      }
+      const connHeader = getConnectionHeader(conn);
+      const params = new SvelteURLSearchParams({
+        bucket: this.bucket,
+        key: this.archiveKey,
+        path: internalPath
+      });
+      if (this.archiveNestedPath) {
+        params.set('nestedArchivePath', this.archiveNestedPath);
+      }
+      const res = await fetch(`/api/storage/archive/extract?${params}`, {
+        headers: { 'x-storage-connection': connHeader }
+      });
+      if (!res.ok) {
+        const code =
+          res.status === 403 ? 'access_denied' : res.status === 404 ? 'not_found' : 'server_error';
+        throw new DownloadError(code, `Extract failed with status ${res.status}`);
+      }
+      const blob = await res.blob();
+      const blobUrl = URL.createObjectURL(blob);
+      const filename = internalPath.split('/').filter(Boolean).pop() ?? internalPath;
+      const anchor = document.createElement('a');
+      anchor.href = blobUrl;
+      anchor.download = filename;
+      anchor.style.display = 'none';
+      document.body.appendChild(anchor);
+      anchor.click();
+      document.body.removeChild(anchor);
+      setTimeout(() => URL.revokeObjectURL(blobUrl), 10_000);
+    } catch (err: unknown) {
+      if (err instanceof DownloadError) {
+        addToast('error', getActionErrorMessage(new ActionError(err.code, err.message)));
+      } else {
+        addToast('error', m.storage_download_error_unknown());
+      }
+    }
+  };
+
+  /** Fetch archive listing from the server API. */
+  private async _fetchArchiveListing(): Promise<void> {
+    const conn = loadConnectionLocally();
+    if (!conn || !this.archiveKey) {
+      this.archiveLoading = false;
+      return;
+    }
+    const connHeader = getConnectionHeader(conn);
+    const params = new SvelteURLSearchParams({
+      bucket: this.bucket,
+      key: this.archiveKey,
+      internalPrefix: this.archivePrefix
+    });
+    if (this.archiveNestedPath) {
+      params.set('nestedArchivePath', this.archiveNestedPath);
+    }
+    const res = await fetch(`/api/storage/archive/listing?${params}`, {
+      headers: { 'x-storage-connection': connHeader }
+    });
+    if (!res.ok) {
+      throw new Error(m.storage_archive_open_error());
+    }
+    const data = (await res.json()) as ArchiveListingResponse;
+    if (data.tooLarge) {
+      this.archiveTooLarge = true;
+      this.archiveLoading = false;
+      this.objects = { objects: [], hasNextPage: false, currentPage: 1, pageSize: null as never };
+      return;
+    }
+    this.archiveTooLarge = false;
+    const prefix = this.archivePrefix || '';
+    this.objects = {
+      objects: data.entries.map((e: ArchiveEntry) => ({
+        key: prefix + e.key,
+        size: e.size,
+        lastModified: e.lastModified,
+        isDirectory: e.isDirectory,
+        contentType: undefined
+      })),
+      hasNextPage: data.hasMore,
+      currentPage: 1,
+      pageSize: null as never
+    };
+    this.archiveLoading = false;
+  }
+
+  refresh = (): void => {
+    if (this.isInArchive) {
+      this.archiveLoading = true;
+      void this._fetchArchiveListing().catch(() => {
+        this.archiveLoading = false;
+      });
+    } else {
+      this.loading = true;
+      if (this._onRefreshNavigate) {
+        this._onRefreshNavigate();
+      } else {
+        void invalidateAll();
+      }
     }
   };
 
@@ -275,6 +517,19 @@ export class StorageState {
           addToast('warning', m.storage_action_preview_no_selection());
           return;
         }
+        if (this.isInArchive) {
+          this.openModal('preview', {
+            key,
+            archiveKey: this.archiveKey!,
+            archivePath: key,
+            nestedArchivePath: this.archiveNestedPath || undefined
+          });
+          return;
+        }
+        if (this.isArchiveFile(key)) {
+          void this.enterArchive(key);
+          return;
+        }
         for (const f of effectiveSelectedFiles) {
           this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
         }
@@ -286,6 +541,10 @@ export class StorageState {
           addToast('warning', m.storage_action_download_no_selection());
           return;
         }
+        if (this.isInArchive) {
+          void this.downloadFromArchive(key);
+          return;
+        }
         for (const f of effectiveSelectedFiles) {
           this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
         }
@@ -380,6 +639,7 @@ export class StorageState {
 
   handleKeydown = (e: KeyboardEvent): void => {
     if (this.activeModal?.type === 'delete') return;
+    if (this.isInArchive) return; // No destructive actions inside archives
     if (e.key === 'Delete' && this.selectedKeys.size > 0) {
       this.openModal('delete', { keys: [...this.selectedKeys] });
     } else if (e.key === 'Escape') {
diff --git a/src/lib/storage/tabs.svelte.ts b/src/lib/storage/tabs.svelte.ts
index dc237d01..585a77c6 100644
--- a/src/lib/storage/tabs.svelte.ts
+++ b/src/lib/storage/tabs.svelte.ts
@@ -3,6 +3,7 @@ import type { StoragePage } from '$lib/storage/types.js';
 import type { PageSize } from '$lib/types/pagination.js';
 import type { StorageState } from './state.svelte.js';
 import { LS_TABS } from './persistence.js';
+import { keyToName } from './utils.js';
 
 // ── Tab data ─────────────────────────────────────────────────────────────────
 
@@ -12,6 +13,15 @@ export interface TabSnapshot {
   objects: StoragePage;
   prevTokens: (string | null)[];
   pageSize: PageSize;
+  archiveKey: string | null;
+  archivePrefix: string;
+  archiveNestedPath: string | null;
+  previousS3Prefix: string;
+  archiveLoading: boolean;
+  archiveTooLarge: boolean;
+  /** Pre-computed auto-generated label for this snapshot (used by syncActiveTab
+   *  to decide whether the label was manually renamed). */
+  autoLabel: string;
 }
 
 export interface Tab {
@@ -98,16 +108,40 @@ export class TabsState {
       prefix: this.storage.prefix,
       objects: this.storage.objects,
       prevTokens: [...this.storage.prevTokens],
-      pageSize: this.storage.pageSize
+      pageSize: this.storage.pageSize,
+      archiveKey: this.storage.archiveKey,
+      archivePrefix: this.storage.archivePrefix,
+      archiveNestedPath: this.storage.archiveNestedPath,
+      previousS3Prefix: this.storage.previousS3Prefix,
+      archiveLoading: this.storage.archiveLoading,
+      archiveTooLarge: this.storage.archiveTooLarge,
+      autoLabel: this.computeAutoLabel()
     };
   }
 
+  private computeAutoLabel(): string {
+    if (this.storage.isInArchive && this.storage.archiveKey) {
+      return this.archiveLabelFrom(
+        this.storage.archiveKey,
+        this.storage.archivePrefix,
+        this.storage.archiveNestedPath
+      );
+    }
+    return this.buildLabel(this.storage.bucket, this.storage.prefix);
+  }
+
   private restoreSnapshot(snapshot: TabSnapshot): void {
     this.storage.bucket = snapshot.bucket;
     this.storage.prefix = snapshot.prefix;
     this.storage.objects = snapshot.objects;
     this.storage.prevTokens = [...snapshot.prevTokens];
     this.storage.pageSize = snapshot.pageSize;
+    this.storage.archiveKey = snapshot.archiveKey;
+    this.storage.archivePrefix = snapshot.archivePrefix;
+    this.storage.archiveNestedPath = snapshot.archiveNestedPath;
+    this.storage.previousS3Prefix = snapshot.previousS3Prefix;
+    this.storage.archiveLoading = snapshot.archiveLoading;
+    this.storage.archiveTooLarge = snapshot.archiveTooLarge;
     this.storage.loading = false;
     this.storage.clearSelection();
     this.replaceLocationUrl?.(snapshot.bucket, snapshot.prefix);
@@ -169,7 +203,14 @@ export class TabsState {
         prefix: pt.prefix,
         objects: EMPTY_PAGE,
         prevTokens: [],
-        pageSize: this.storage.pageSize
+        pageSize: this.storage.pageSize,
+        archiveKey: null,
+        archivePrefix: '',
+        archiveNestedPath: null,
+        previousS3Prefix: '',
+        archiveLoading: false,
+        archiveTooLarge: false,
+        autoLabel: pt.label
       }
     }));
 
@@ -217,7 +258,7 @@ export class TabsState {
     }
 
     const id = crypto.randomUUID();
-    const label = this.buildLabel(this.storage.bucket, this.storage.prefix);
+    const label = this.computeAutoLabel();
     this.tabs = [{ id, label, stub: false, snapshot: this.captureSnapshot() }];
     this.activeTabId = id;
     this.saveToPersistence();
@@ -247,10 +288,7 @@ export class TabsState {
       ...tab,
       stub: false,
       snapshot: this.captureSnapshot(),
-      label:
-        tab.label === this.buildLabel(tab.snapshot.bucket, tab.snapshot.prefix)
-          ? this.buildLabel(this.storage.bucket, this.storage.prefix)
-          : tab.label
+      label: tab.label === tab.snapshot.autoLabel ? this.computeAutoLabel() : tab.label
     };
     this.tabs = [...this.tabs.slice(0, idx), updatedTab, ...this.tabs.slice(idx + 1)];
     this.saveToPersistence();
@@ -260,7 +298,7 @@ export class TabsState {
   addTab(): void {
     this.syncActiveTab();
     const id = crypto.randomUUID();
-    const label = this.buildLabel(this.storage.bucket, this.storage.prefix);
+    const label = this.computeAutoLabel();
     const newTab: Tab = { id, label, stub: false, snapshot: this.captureSnapshot() };
     this.tabs = [...this.tabs, newTab];
     this.activeTabId = id;
@@ -336,4 +374,22 @@ export class TabsState {
     const parts = prefix.replace(/\/$/, '').split('/');
     return parts[parts.length - 1];
   }
+
+  private archiveLabelFrom(
+    archiveKey: string | null,
+    archivePrefix: string,
+    archiveNestedPath: string | null
+  ): string {
+    if (archivePrefix) {
+      const parts = archivePrefix.replace(/\/$/, '').split('/');
+      return parts[parts.length - 1];
+    }
+    if (archiveNestedPath) {
+      return keyToName(archiveNestedPath);
+    }
+    if (archiveKey) {
+      return keyToName(archiveKey);
+    }
+    return '';
+  }
 }
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index dd43f495..f79be27b 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -4,7 +4,12 @@ export type ModalType = 'delete' | 'preview' | 'upload';
 
 export interface ModalPayloads {
   delete: { keys: string[] };
-  preview: { key: string };
+  preview: {
+    key: string;
+    archiveKey?: string;
+    archivePath?: string;
+    nestedArchivePath?: string;
+  };
   upload: { bucket: string; prefix: string };
 }
 
@@ -100,3 +105,37 @@ export interface StoragePage {
 export interface DeleteObjectsResult {
   failed: Array<{ key: string; code?: string; message?: string }>;
 }
+
+// ── Archive navigation ───────────────────────────────────────────────────────
+
+export const ARCHIVE_EXTENSIONS = ['.zip', '.tar.gz', '.tgz', '.tar', '.rar', '.7z'] as const;
+
+export type ArchiveFormat = (typeof ARCHIVE_EXTENSIONS)[number] extends `${string}${infer F}`
+  ? F
+  : string;
+
+/** A single entry inside an archive (file or directory). */
+export interface ArchiveEntry {
+  key: string;
+  size: number;
+  lastModified: Date;
+  isDirectory: boolean;
+}
+
+/** Response from the archive listing API. */
+export interface ArchiveListingResponse {
+  entries: ArchiveEntry[];
+  hasMore: boolean;
+  /** When true, the archive was too large to open for preview. */
+  tooLarge?: boolean;
+}
+
+/** State when browsing inside an archive. */
+export interface ArchiveContext {
+  /** S3 key of the archive file being browsed. */
+  archiveKey: string;
+  /** Virtual path within the archive (empty string = archive root). */
+  archivePrefix: string;
+  /** The S3 prefix the user was at before entering the archive. */
+  previousS3Prefix: string;
+}
diff --git a/src/lib/storage/utils.ts b/src/lib/storage/utils.ts
index 5eaf4539..b7b44769 100644
--- a/src/lib/storage/utils.ts
+++ b/src/lib/storage/utils.ts
@@ -1,6 +1,7 @@
 import prettyBytes from 'pretty-bytes';
 import type { Options } from 'pretty-bytes';
 import { getLocale } from '$lib/paraglide/runtime.js';
+import { ARCHIVE_EXTENSIONS } from './types.js';
 
 export type FileIconKind = 'image' | 'pdf' | 'code' | 'archive' | 'text' | 'document';
 
@@ -13,7 +14,12 @@ const CODE_TYPES = new Set([
   'text/markdown'
 ]);
 
-const ARCHIVE_TYPES = new Set(['application/gzip', 'application/zip', 'application/x-tar']);
+const ARCHIVE_TYPES = new Set([
+  'application/gzip',
+  'application/zip',
+  'application/x-tar',
+  'application/x-gzip'
+]);
 
 export function fileIconKind(contentType: string | undefined): FileIconKind {
   if (!contentType) return 'document';
@@ -56,3 +62,9 @@ export function formatFileSize(
 ): string {
   return prettyBytes(bytes, { locale, ...options });
 }
+
+/** Check if a filename/path has a navigable archive extension. */
+export function isArchiveExtension(filename: string): boolean {
+  const lower = filename.toLowerCase();
+  return ARCHIVE_EXTENSIONS.some((ext) => lower.endsWith(ext));
+}
diff --git a/src/routes/(app)/api/storage/archive/extract/+server.ts b/src/routes/(app)/api/storage/archive/extract/+server.ts
new file mode 100644
index 00000000..835b5819
--- /dev/null
+++ b/src/routes/(app)/api/storage/archive/extract/+server.ts
@@ -0,0 +1,103 @@
+import { error } from '@sveltejs/kit';
+import { extractArchiveEntry, getArchiveFormat } from '$lib/server/storage/archive.js';
+import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
+import { archivePreviewMaxBytes } from '$lib/server/feature-flags.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /api/storage/archive/extract?bucket=<bucket>&key=<archive-key>&path=<internal-path>&nestedArchivePath=<path>
+ *
+ * Extracts a single file from an archive and returns it as a stream.
+ * Supports nested archives: when `nestedArchivePath` is set, the file is
+ * extracted from within a nested archive inside the outer one.
+ *
+ * The archive is downloaded from S3 once and cached server-side, so multiple
+ * extractions from the same archive share a single S3 transfer.
+ *
+ * Returns 404 if the internal path does not exist in the archive or if the
+ * archive exceeds the configured preview size limit.
+ * Returns 400 if the archive is not a supported format.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
+ */
+export const GET: RequestHandler = async ({ locals, url }) => {
+  const bucket = url.searchParams.get('bucket')?.trim();
+  if (!bucket) throw error(400, 'Missing required query parameter: bucket');
+
+  const key = url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
+
+  const internalPath = url.searchParams.get('path')?.trim();
+  if (!internalPath) throw error(400, 'Missing required query parameter: path');
+
+  const nestedArchivePath = url.searchParams.get('nestedArchivePath')?.trim() || undefined;
+
+  const format = getArchiveFormat(key);
+  if (!format) {
+    throw error(400, `Unsupported archive format: ${key}`);
+  }
+
+  locals.logger.debug(
+    { bucket, key, internal_path: internalPath, nested_archive_path: nestedArchivePath, format },
+    'extracting archive entry'
+  );
+
+  const downloadFn = (k: string) =>
+    downloadObject(locals.storageConfig!, bucket, k).then((d) => d.stream);
+  const metadataFn = (k: string) => getObjectMetadata(locals.storageConfig!, bucket, k);
+
+  const data = await extractArchiveEntry(
+    bucket,
+    key,
+    internalPath,
+    downloadFn,
+    metadataFn,
+    nestedArchivePath,
+    archivePreviewMaxBytes
+  );
+
+  if (!data) {
+    throw error(404, `File "${internalPath}" not found in archive`);
+  }
+
+  const contentType = guessContentType(internalPath);
+
+  return new Response(data as BodyInit, {
+    headers: {
+      'Content-Type': contentType,
+      'Content-Length': String(data.length),
+      'Cache-Control': 'private, no-store'
+    }
+  });
+};
+
+function guessContentType(path: string): string {
+  const ext = path.split('.').pop()?.toLowerCase() ?? '';
+  const mime: Record<string, string> = {
+    txt: 'text/plain',
+    csv: 'text/csv',
+    json: 'application/json',
+    xml: 'application/xml',
+    html: 'text/html',
+    css: 'text/css',
+    js: 'application/javascript',
+    md: 'text/markdown',
+    yaml: 'application/x-yaml',
+    yml: 'application/x-yaml',
+    parquet: 'application/octet-stream',
+    pdf: 'application/pdf',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    svg: 'image/svg+xml',
+    webp: 'image/webp',
+    log: 'text/plain',
+    py: 'text/plain',
+    java: 'text/plain',
+    ts: 'text/plain',
+    sql: 'text/plain'
+  };
+  return mime[ext] ?? 'application/octet-stream';
+}
diff --git a/src/routes/(app)/api/storage/archive/listing/+server.ts b/src/routes/(app)/api/storage/archive/listing/+server.ts
new file mode 100644
index 00000000..5a6fcae0
--- /dev/null
+++ b/src/routes/(app)/api/storage/archive/listing/+server.ts
@@ -0,0 +1,50 @@
+import { error } from '@sveltejs/kit';
+import { listArchiveContents } from '$lib/server/storage/archive.js';
+import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
+import { archivePreviewMaxBytes } from '$lib/server/feature-flags.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /api/storage/archive/listing?bucket=<bucket>&key=<archive-key>&internalPrefix=<path>&nestedArchivePath=<path>
+ *
+ * Lists the contents of an archive file at the given internal path.
+ * Supports nested archives via the optional `nestedArchivePath` parameter:
+ * when set, the server extracts the nested archive from the outer one first.
+ *
+ * The archive is downloaded from S3 and cached server-side for 30 minutes
+ * so that subsequent navigations within the same archive do not incur
+ * additional S3 transfer costs.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
+ */
+export const GET: RequestHandler = async ({ locals, url }) => {
+  const bucket = url.searchParams.get('bucket')?.trim();
+  if (!bucket) throw error(400, 'Missing required query parameter: bucket');
+
+  const key = url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
+
+  const internalPrefix = url.searchParams.get('internalPrefix') ?? '';
+  const nestedArchivePath = url.searchParams.get('nestedArchivePath')?.trim() || undefined;
+
+  locals.logger.debug(
+    { bucket, key, internal_prefix: internalPrefix, nested_archive_path: nestedArchivePath },
+    'listing archive contents'
+  );
+
+  const downloadFn = (k: string) =>
+    downloadObject(locals.storageConfig!, bucket, k).then((d) => d.stream);
+  const metadataFn = (k: string) => getObjectMetadata(locals.storageConfig!, bucket, k);
+
+  const listing = await listArchiveContents(
+    bucket,
+    key,
+    internalPrefix,
+    downloadFn,
+    metadataFn,
+    nestedArchivePath,
+    archivePreviewMaxBytes
+  );
+  return Response.json(listing);
+};
diff --git a/src/routes/(app)/api/storage/buckets/+server.ts b/src/routes/(app)/api/storage/buckets/+server.ts
index dadfa8e1..2739cfd5 100644
--- a/src/routes/(app)/api/storage/buckets/+server.ts
+++ b/src/routes/(app)/api/storage/buckets/+server.ts
@@ -2,7 +2,7 @@ import { getConnectionProvider } from '$lib/server/storage/utils.js';
 import type { RequestHandler } from './$types';
 
 /**
- * GET /storage/api/buckets
+ * GET /api/storage/buckets
  *
  * Returns the list of buckets accessible with the connection config supplied in
  * the `X-Storage-Connection` request header (base64-encoded JSON).
diff --git a/src/routes/(app)/api/storage/create/+server.ts b/src/routes/(app)/api/storage/create/+server.ts
index 570f5b0f..58f07f00 100644
--- a/src/routes/(app)/api/storage/create/+server.ts
+++ b/src/routes/(app)/api/storage/create/+server.ts
@@ -3,7 +3,7 @@ import type { RequestHandler } from '@sveltejs/kit';
 import { requireBucketKey } from '../params.js';
 
 /**
- * POST /storage/api/create?bucket=<bucket>&key=<object-key>
+ * POST /api/storage/create?bucket=<bucket>&key=<object-key>
  *
  * Creates an empty object (zero bytes) at the given key.
  * If the key ends with '/', it creates a directory marker.
diff --git a/src/routes/(app)/api/storage/delete/+server.ts b/src/routes/(app)/api/storage/delete/+server.ts
index 58eea526..1a1aef4c 100644
--- a/src/routes/(app)/api/storage/delete/+server.ts
+++ b/src/routes/(app)/api/storage/delete/+server.ts
@@ -4,7 +4,7 @@ import { getProvider } from '$lib/server/storage/utils.js';
 import { requireBucket } from '../params.js';
 
 /**
- * DELETE /storage/api/delete?bucket=<bucket>&keys=<key1>&keys=<key2>&...
+ * DELETE /api/storage/delete?bucket=<bucket>&keys=<key1>&keys=<key2>&...
  *
  * Deletes one or more S3 objects from the given bucket.
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
diff --git a/src/routes/(app)/api/storage/delete/server.test.ts b/src/routes/(app)/api/storage/delete/server.test.ts
index 4133230f..58bc8f46 100644
--- a/src/routes/(app)/api/storage/delete/server.test.ts
+++ b/src/routes/(app)/api/storage/delete/server.test.ts
@@ -13,7 +13,7 @@ const CONNECTION_HEADER = {
 };
 
 function mockEvent(searchParams: Record<string, string | string[]>) {
-  const url = new URL('http://localhost/storage/api/delete');
+  const url = new URL('http://localhost/api/storage/delete');
   for (const [k, v] of Object.entries(searchParams)) {
     if (Array.isArray(v)) {
       v.forEach((val) => url.searchParams.append(k, val));
@@ -32,7 +32,7 @@ function mockEvent(searchParams: Record<string, string | string[]>) {
   } as unknown as Parameters<typeof DELETE>[0];
 }
 
-describe('DELETE /storage/api/delete', () => {
+describe('DELETE /api/storage/delete', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('throws 400 when bucket is missing', async () => {
diff --git a/src/routes/(app)/api/storage/download/+server.ts b/src/routes/(app)/api/storage/download/+server.ts
index 53f28612..51fe19a0 100644
--- a/src/routes/(app)/api/storage/download/+server.ts
+++ b/src/routes/(app)/api/storage/download/+server.ts
@@ -8,7 +8,7 @@ function filenameFromKey(key: string): string {
 }
 
 /**
- * GET /storage/api/download?bucket=<bucket>&key=<object-key>
+ * GET /api/storage/download?bucket=<bucket>&key=<object-key>
  *
  * Proxies an S3 object directly to the client as a streaming download.
  * Authentication is enforced by the app-level auth guard in hooks.server.ts.
@@ -50,7 +50,7 @@ export const GET: RequestHandler = async ({ locals, url }) => {
 };
 
 /**
- * HEAD /storage/api/download?bucket=<bucket>&key=<object-key>
+ * HEAD /api/storage/download?bucket=<bucket>&key=<object-key>
  *
  * Lightweight pre-flight that validates credentials and access rights using
  * a HeadObject call (no object body transferred). The client uses this before
diff --git a/src/routes/(app)/api/storage/download/server.test.ts b/src/routes/(app)/api/storage/download/server.test.ts
index bc602d23..9f02c56c 100644
--- a/src/routes/(app)/api/storage/download/server.test.ts
+++ b/src/routes/(app)/api/storage/download/server.test.ts
@@ -12,7 +12,7 @@ const CONNECTION_HEADER = {
 };
 
 function mockEvent(params: string) {
-  const url = new URL(`http://localhost/storage/api/download?${params}`);
+  const url = new URL(`http://localhost/api/storage/download?${params}`);
   return {
     url,
     request: { headers: new Headers(CONNECTION_HEADER) },
@@ -24,7 +24,7 @@ function mockEvent(params: string) {
   } as unknown as Parameters<typeof GET>[0];
 }
 
-describe('GET /storage/api/download', () => {
+describe('GET /api/storage/download', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('streams download with correct headers', async () => {
@@ -59,7 +59,7 @@ describe('GET /storage/api/download', () => {
   });
 });
 
-describe('HEAD /storage/api/download', () => {
+describe('HEAD /api/storage/download', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('returns 200 with metadata headers', async () => {
diff --git a/src/routes/(app)/api/storage/objects/+server.ts b/src/routes/(app)/api/storage/objects/+server.ts
index 1973354e..ff5bcdab 100644
--- a/src/routes/(app)/api/storage/objects/+server.ts
+++ b/src/routes/(app)/api/storage/objects/+server.ts
@@ -3,7 +3,7 @@ import { getProvider } from '$lib/server/storage/utils.js';
 import type { RequestHandler } from './$types';
 
 /**
- * GET /storage/api/objects?bucket=<bucket>&prefix=<prefix>&pageSize=<n>&continuationToken=<token>
+ * GET /api/storage/objects?bucket=<bucket>&prefix=<prefix>&pageSize=<n>&continuationToken=<token>
  *
  * Returns a page of objects in the given bucket/prefix using the connection
  * config supplied in the `X-Storage-Connection` request header.
diff --git a/src/routes/(app)/api/storage/params.test.ts b/src/routes/(app)/api/storage/params.test.ts
index f8625d32..bb045aac 100644
--- a/src/routes/(app)/api/storage/params.test.ts
+++ b/src/routes/(app)/api/storage/params.test.ts
@@ -3,45 +3,45 @@ import { requireBucket, requireBucketKey } from './params.js';
 
 describe('requireBucket', () => {
   it('throws 400 when bucket param is missing', () => {
-    const url = new URL('http://localhost/storage/api/test');
+    const url = new URL('http://localhost/api/storage/test');
     expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('throws 400 when bucket param is empty', () => {
-    const url = new URL('http://localhost/storage/api/test?bucket=');
+    const url = new URL('http://localhost/api/storage/test?bucket=');
     expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('throws 400 when bucket param is whitespace only', () => {
-    const url = new URL('http://localhost/storage/api/test?bucket=%20%20');
+    const url = new URL('http://localhost/api/storage/test?bucket=%20%20');
     expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('returns trimmed bucket name', () => {
-    const url = new URL('http://localhost/storage/api/test?bucket=%20my-bucket%20');
+    const url = new URL('http://localhost/api/storage/test?bucket=%20my-bucket%20');
     expect(requireBucket(url)).toBe('my-bucket');
   });
 });
 
 describe('requireBucketKey', () => {
   it('throws 400 when bucket is missing', () => {
-    const url = new URL('http://localhost/storage/api/test?key=file.txt');
+    const url = new URL('http://localhost/api/storage/test?key=file.txt');
     expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('throws 400 when key is missing', () => {
-    const url = new URL('http://localhost/storage/api/test?bucket=my-bucket');
+    const url = new URL('http://localhost/api/storage/test?bucket=my-bucket');
     expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('throws 400 when key is empty', () => {
-    const url = new URL('http://localhost/storage/api/test?bucket=my-bucket&key=');
+    const url = new URL('http://localhost/api/storage/test?bucket=my-bucket&key=');
     expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
   });
 
   it('returns both bucket and key trimmed', () => {
     const url = new URL(
-      'http://localhost/storage/api/test?bucket=%20b1%20&key=%20path/file.txt%20'
+      'http://localhost/api/storage/test?bucket=%20b1%20&key=%20path/file.txt%20'
     );
     expect(requireBucketKey(url)).toEqual({ bucket: 'b1', key: 'path/file.txt' });
   });
diff --git a/src/routes/(app)/api/storage/preview/+server.ts b/src/routes/(app)/api/storage/preview/+server.ts
index 83df24aa..c42e1890 100644
--- a/src/routes/(app)/api/storage/preview/+server.ts
+++ b/src/routes/(app)/api/storage/preview/+server.ts
@@ -8,7 +8,7 @@ import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
 
 /**
- * GET /storage/api/preview?bucket=<bucket>&key=<object-key>
+ * GET /api/storage/preview?bucket=<bucket>&key=<object-key>
  *
  * The connection config is parsed and validated by the `handleStorageConnection`
  * middleware in hooks.server.ts before this handler runs.
@@ -48,12 +48,13 @@ export const GET: RequestHandler = async ({ url, locals }) => {
       return binaryPreview(rawContentType, totalSize);
     }
 
-    // Normalise the content-type for Excel-exported CSV files so the client
-    // treats them as text/csv rather than binary.
-    const contentType =
-      rawContentType === 'application/vnd.ms-excel' && lowerKey.endsWith('.csv')
-        ? 'text/csv'
-        : rawContentType;
+    // Normalise the content-type for Excel-exported CSV/TSV files so the client
+    // treats them as text/csv or text/tab-separated-values rather than binary.
+    let contentType = rawContentType;
+    if (rawContentType === 'application/vnd.ms-excel') {
+      if (lowerKey.endsWith('.csv')) contentType = 'text/csv';
+      else if (lowerKey.endsWith('.tsv')) contentType = 'text/tab-separated-values';
+    }
 
     // Pass a placeholder user identifier for logging purposes (no longer user-specific)
     return await streamPreview(provider, key, contentType, totalSize, 'client', log);
diff --git a/src/routes/(app)/api/storage/preview/server.test.ts b/src/routes/(app)/api/storage/preview/server.test.ts
index ca44fcf7..6100b52a 100644
--- a/src/routes/(app)/api/storage/preview/server.test.ts
+++ b/src/routes/(app)/api/storage/preview/server.test.ts
@@ -41,7 +41,7 @@ const CONNECTION_HEADER = {
 };
 
 function mockEvent(params: string) {
-  const url = new URL(`http://localhost/storage/api/preview?${params}`);
+  const url = new URL(`http://localhost/api/storage/preview?${params}`);
   return {
     url,
     request: { headers: new Headers(CONNECTION_HEADER) },
@@ -53,7 +53,7 @@ function mockEvent(params: string) {
   } as unknown as Parameters<typeof GET>[0];
 }
 
-describe('GET /storage/api/preview', () => {
+describe('GET /api/storage/preview', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('returns binary preview for known binary types', async () => {
@@ -79,6 +79,72 @@ describe('GET /storage/api/preview', () => {
     );
   });
 
+  it('normalises Excel TSV content type', async () => {
+    mockGetMetadata.mockResolvedValue({ contentType: 'application/vnd.ms-excel', size: 200 });
+
+    await GET(mockEvent('bucket=b1&key=data.tsv'));
+
+    expect(streamPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'data.tsv',
+      'text/tab-separated-values',
+      200,
+      'client',
+      expect.anything()
+    );
+  });
+
+  it('does not normalise Excel content type for non-CSV/TSV extensions', async () => {
+    mockGetMetadata.mockResolvedValue({ contentType: 'application/vnd.ms-excel', size: 300 });
+
+    await GET(mockEvent('bucket=b1&key=workbook.xls'));
+
+    expect(streamPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'workbook.xls',
+      'application/vnd.ms-excel',
+      300,
+      'client',
+      expect.anything()
+    );
+  });
+
+  it('passes text/tab-separated-values content type through unchanged', async () => {
+    mockGetMetadata.mockResolvedValue({
+      contentType: 'text/tab-separated-values',
+      size: 150
+    });
+
+    await GET(mockEvent('bucket=b1&key=data.tsv'));
+
+    expect(streamPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'data.tsv',
+      'text/tab-separated-values',
+      150,
+      'client',
+      expect.anything()
+    );
+  });
+
+  it('streams TSV file with .tsv extension and generic content type', async () => {
+    mockGetMetadata.mockResolvedValue({
+      contentType: 'application/octet-stream',
+      size: 75
+    });
+
+    await GET(mockEvent('bucket=b1&key=report.tsv'));
+
+    expect(streamPreview).toHaveBeenCalledWith(
+      expect.anything(),
+      'report.tsv',
+      'application/octet-stream',
+      75,
+      'client',
+      expect.anything()
+    );
+  });
+
   it('calls streamPreview for text types', async () => {
     mockGetMetadata.mockResolvedValue({ contentType: 'text/plain', size: 50 });
 
diff --git a/src/routes/(app)/api/storage/save-text/+server.ts b/src/routes/(app)/api/storage/save-text/+server.ts
index f19f40b4..abbc04e1 100644
--- a/src/routes/(app)/api/storage/save-text/+server.ts
+++ b/src/routes/(app)/api/storage/save-text/+server.ts
@@ -6,7 +6,7 @@ import { maxEditableFileSize } from '$lib/server/feature-flags.js';
 import type { RequestHandler } from '@sveltejs/kit';
 
 /**
- * POST /storage/api/save-text?bucket=<bucket>&key=<key>&contentType=<type>&originalSize=<number>&previewBytes=<number>
+ * POST /api/storage/save-text?bucket=<bucket>&key=<key>&contentType=<type>&originalSize=<number>&previewBytes=<number>
  *
  * Saves edited text content back to S3. When the original file was truncated
  * during preview (previewBytes < originalSize), the endpoint fetches the
@@ -63,6 +63,10 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     if (done) break;
     editChunks.push(value);
     totalEditBytes += value.length;
+    if (totalEditBytes > maxEditableFileSize) {
+      editReader.cancel();
+      throw error(413, 'File exceeds the maximum editable size and is read-only');
+    }
   }
 
   let mergedBuffer: Buffer;
diff --git a/src/routes/(app)/api/storage/upload/+server.ts b/src/routes/(app)/api/storage/upload/+server.ts
index 6aacf360..6e61c798 100644
--- a/src/routes/(app)/api/storage/upload/+server.ts
+++ b/src/routes/(app)/api/storage/upload/+server.ts
@@ -4,7 +4,7 @@ import { requireBucketKey } from '../params.js';
 import type { RequestHandler } from './$types';
 
 /**
- * POST /storage/api/upload?bucket=<bucket>&key=<object-key>
+ * POST /api/storage/upload?bucket=<bucket>&key=<object-key>
  *
  * Streams an uploaded file directly to S3 using multipart upload (via
  * @aws-sdk/lib-storage). The request body is piped to the S3 SDK without
diff --git a/src/routes/(app)/api/storage/upload/server.test.ts b/src/routes/(app)/api/storage/upload/server.test.ts
index ff4b42b8..316f2d78 100644
--- a/src/routes/(app)/api/storage/upload/server.test.ts
+++ b/src/routes/(app)/api/storage/upload/server.test.ts
@@ -17,7 +17,7 @@ function mockEvent(opts: {
   headers?: Record<string, string>;
 }) {
   const url = new URL(
-    `http://localhost/storage/api/upload?${opts.params ?? 'bucket=b1&key=file.txt'}`
+    `http://localhost/api/storage/upload?${opts.params ?? 'bucket=b1&key=file.txt'}`
   );
   const headers = new Headers(
     opts.headers ?? { 'Content-Type': 'text/plain', 'Content-Length': '42', ...CONNECTION_HEADER }
@@ -34,7 +34,7 @@ function mockEvent(opts: {
   } as unknown as Parameters<typeof POST>[0];
 }
 
-describe('POST /storage/api/upload', () => {
+describe('POST /api/storage/upload', () => {
   beforeEach(() => vi.clearAllMocks());
 
   it('throws 400 when bucket/key missing', async () => {
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index cbac7474..e0da52cd 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -61,6 +61,8 @@
 
   // Sync server data into state whenever SvelteKit load runs
   $effect(() => {
+    // eslint-disable-next-line @typescript-eslint/no-unused-expressions
+    page.url.href;
     storage.syncFromServer(data.bucket, data.prefix, data.objects);
   });
 </script>

From d75bf31f2ebd32304d3f831859bbfabb186b3e11 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 1 Jul 2026 13:53:14 +0200
Subject: [PATCH 085/136] #98 add possible checksum calculation to s3 client

---
 src/lib/server/storage/s3-client.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/server/storage/s3-client.ts b/src/lib/server/storage/s3-client.ts
index 50e75e89..91839770 100644
--- a/src/lib/server/storage/s3-client.ts
+++ b/src/lib/server/storage/s3-client.ts
@@ -4,6 +4,7 @@ import type { S3ConnectionConfig } from './types.js';
 export function createS3Client(config: S3ConnectionConfig): S3Client {
   return new S3Client({
     region: config.region,
+    requestChecksumCalculation: 'WHEN_REQUIRED',
     ...(config.endpoint && {
       endpoint: config.endpoint,
       forcePathStyle: config.pathStyle ?? true

From f47680281f3bf3878c057a95df361eb32b4a78bc Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 1 Jul 2026 14:18:32 +0200
Subject: [PATCH 086/136] fix unit test

---
 src/lib/server/storage/s3-client.test.ts | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/lib/server/storage/s3-client.test.ts b/src/lib/server/storage/s3-client.test.ts
index d554c86f..35bf8ba8 100644
--- a/src/lib/server/storage/s3-client.test.ts
+++ b/src/lib/server/storage/s3-client.test.ts
@@ -14,7 +14,10 @@ describe('createS3Client', () => {
   it('creates client with region only (no endpoint, no credentials)', () => {
     const config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
     createS3Client(config);
-    expect(mockS3Client).toHaveBeenCalledWith({ region: 'us-east-1' });
+    expect(mockS3Client).toHaveBeenCalledWith({
+      region: 'us-east-1',
+      requestChecksumCalculation: 'WHEN_REQUIRED'
+    });
   });
 
   it('sets endpoint and forcePathStyle when endpoint provided', () => {
@@ -22,7 +25,11 @@ describe('createS3Client', () => {
     const config: S3ConnectionConfig = { type: 's3', region: 'eu-west-1', endpoint };
     createS3Client(config);
     expect(mockS3Client).toHaveBeenCalledWith(
-      expect.objectContaining({ endpoint, forcePathStyle: true })
+      expect.objectContaining({
+        endpoint,
+        forcePathStyle: true,
+        requestChecksumCalculation: 'WHEN_REQUIRED'
+      })
     );
   });
 
@@ -36,7 +43,11 @@ describe('createS3Client', () => {
     };
     createS3Client(config);
     expect(mockS3Client).toHaveBeenCalledWith(
-      expect.objectContaining({ endpoint, forcePathStyle: false })
+      expect.objectContaining({
+        endpoint,
+        forcePathStyle: false,
+        requestChecksumCalculation: 'WHEN_REQUIRED'
+      })
     );
   });
 
@@ -50,7 +61,8 @@ describe('createS3Client', () => {
     createS3Client(config);
     expect(mockS3Client).toHaveBeenCalledWith(
       expect.objectContaining({
-        credentials: { accessKeyId: 'AKID', secretAccessKey: 'SECRET' }
+        credentials: { accessKeyId: 'AKID', secretAccessKey: 'SECRET' },
+        requestChecksumCalculation: 'WHEN_REQUIRED'
       })
     );
   });

From 5835bef95c8311a69eff825d621e112939d973ba Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 2 Jul 2026 11:37:41 +0200
Subject: [PATCH 087/136] #98 fix e2e tests

---
 e2e/storage/connection.spec.ts   | 12 ++++++++++--
 e2e/storage/context-menu.spec.ts |  8 ++++++--
 e2e/storage/helpers.ts           |  5 +++++
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index d314dde3..8f7d22c8 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -20,7 +20,11 @@ test.describe('Storage S3 — Connection', () => {
     await expect(page).toHaveURL('/storage');
     const main = page.locator('main');
     await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
-    await expect(main.getByRole('link', { name: credentials.bucket, exact: true })).toBeVisible();
+    // Both the sidebar nav and the bucket grid render a link for each bucket — use first() to
+    // avoid a strict-mode violation while still confirming the bucket is visible in the UI.
+    await expect(
+      main.getByRole('link', { name: credentials.bucket, exact: true }).first()
+    ).toBeVisible();
   });
 
   test('shows an error for invalid Garage credentials', async ({ page }) => {
@@ -45,7 +49,10 @@ test.describe('Storage S3 — Connection', () => {
     await connectToStorage(page, credentials);
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
+    // Click the sidebar Disconnect button — this opens a confirmation modal.
     await page.getByRole('button', { name: 'Disconnect' }).click();
+    // Confirm disconnection in the modal.
+    await page.locator('.modal-box').getByRole('button', { name: 'Disconnect' }).click();
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
   });
 
@@ -94,7 +101,8 @@ test.describe('Storage S3 — Connection', () => {
 
     const bucketLink = page
       .locator('main')
-      .getByRole('link', { name: credentials.bucket, exact: true });
+      .getByRole('link', { name: credentials.bucket, exact: true })
+      .first();
     await expect(bucketLink).toBeVisible();
     await bucketLink.click();
 
diff --git a/e2e/storage/context-menu.spec.ts b/e2e/storage/context-menu.spec.ts
index d68bf144..d221d9f2 100644
--- a/e2e/storage/context-menu.spec.ts
+++ b/e2e/storage/context-menu.spec.ts
@@ -111,7 +111,9 @@ test.describe('Storage S3 — Context Menu', () => {
         'copy name test'
       );
 
-      await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      // Only clipboard-read is needed — writes are permitted via user-gesture context in all
+      // browsers. Firefox does not recognise 'clipboard-write' as a grantable permission.
+      await context.grantPermissions(['clipboard-read']);
       await connectAndOpenPrefix(page, credentials, prefix);
 
       await rowByName(page, 'copy-name-test.txt').click({ button: 'right' });
@@ -143,7 +145,9 @@ test.describe('Storage S3 — Context Menu', () => {
         'copy path test'
       );
 
-      await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      // Only clipboard-read is needed — writes are permitted via user-gesture context in all
+      // browsers. Firefox does not recognise 'clipboard-write' as a grantable permission.
+      await context.grantPermissions(['clipboard-read']);
       await connectAndOpenPrefix(page, credentials, prefix);
 
       await rowByName(page, 'copy-path-test.txt').click({ button: 'right' });
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 95e26ae0..ae47e5ed 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -59,6 +59,11 @@ export async function openConnectForm(page: Page) {
     (await disconnectButton.isVisible().catch(() => false))
   ) {
     await disconnectButton.click();
+    // A confirmation modal was added — confirm the disconnection if the modal appears.
+    const confirmButton = page.locator('.modal-box').getByRole('button', { name: 'Disconnect' });
+    if (await confirmButton.isVisible({ timeout: 2_000 }).catch(() => false)) {
+      await confirmButton.click();
+    }
   }
 
   await expect(connectHeading).toBeVisible();

From afd6b7d5b43e8348f1b863b9b799cc808070510d Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 2 Jul 2026 13:03:02 +0200
Subject: [PATCH 088/136] fix e2e test, add error message for copy file path

---
 e2e/storage/context-menu.spec.ts | 38 ++++++++++++++++++++++----------
 messages/de.json                 |  2 ++
 messages/en.json                 |  2 ++
 src/lib/storage/state.svelte.ts  | 16 ++++++++++----
 4 files changed, 42 insertions(+), 16 deletions(-)

diff --git a/e2e/storage/context-menu.spec.ts b/e2e/storage/context-menu.spec.ts
index d221d9f2..eebecd0f 100644
--- a/e2e/storage/context-menu.spec.ts
+++ b/e2e/storage/context-menu.spec.ts
@@ -96,7 +96,8 @@ test.describe('Storage S3 — Context Menu', () => {
 
   test('Copy filename copies the bare file name to the clipboard', async ({
     page,
-    context
+    context,
+    browserName
   }, testInfo) => {
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
@@ -111,9 +112,13 @@ test.describe('Storage S3 — Context Menu', () => {
         'copy name test'
       );
 
-      // Only clipboard-read is needed — writes are permitted via user-gesture context in all
-      // browsers. Firefox does not recognise 'clipboard-write' as a grantable permission.
-      await context.grantPermissions(['clipboard-read']);
+      // Playwright's grantPermissions for clipboard names only works in Chromium.
+      // Firefox rejects both 'clipboard-read' and 'clipboard-write' with "Unknown permission".
+      // In Firefox the clipboard write succeeds via user-gesture context without an explicit
+      // grant, but reading back via navigator.clipboard.readText() is not possible in tests.
+      if (browserName === 'chromium') {
+        await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      }
       await connectAndOpenPrefix(page, credentials, prefix);
 
       await rowByName(page, 'copy-name-test.txt').click({ button: 'right' });
@@ -121,8 +126,12 @@ test.describe('Storage S3 — Context Menu', () => {
 
       await expect(page.getByText('Filename copied to clipboard')).toBeVisible();
 
-      const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-      expect(clipboardText).toBe('copy-name-test.txt');
+      // clipboard.readText() requires the 'clipboard-read' permission which can only be granted
+      // in Chromium via Playwright — skip the read-back check in Firefox.
+      if (browserName === 'chromium') {
+        const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+        expect(clipboardText).toBe('copy-name-test.txt');
+      }
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
@@ -130,7 +139,8 @@ test.describe('Storage S3 — Context Menu', () => {
 
   test('Copy path copies the full s3:// URI to the clipboard', async ({
     page,
-    context
+    context,
+    browserName
   }, testInfo) => {
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
@@ -145,9 +155,10 @@ test.describe('Storage S3 — Context Menu', () => {
         'copy path test'
       );
 
-      // Only clipboard-read is needed — writes are permitted via user-gesture context in all
-      // browsers. Firefox does not recognise 'clipboard-write' as a grantable permission.
-      await context.grantPermissions(['clipboard-read']);
+      // See 'Copy filename' test above for explanation of the Chromium-only permission grant.
+      if (browserName === 'chromium') {
+        await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      }
       await connectAndOpenPrefix(page, credentials, prefix);
 
       await rowByName(page, 'copy-path-test.txt').click({ button: 'right' });
@@ -155,8 +166,11 @@ test.describe('Storage S3 — Context Menu', () => {
 
       await expect(page.getByText('Path copied to clipboard')).toBeVisible();
 
-      const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-      expect(clipboardText).toBe(`s3://${credentials.bucket}/${prefix}copy-path-test.txt`);
+      // Skip clipboard read-back in Firefox — see 'Copy filename' test above.
+      if (browserName === 'chromium') {
+        const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+        expect(clipboardText).toBe(`s3://${credentials.bucket}/${prefix}copy-path-test.txt`);
+      }
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
diff --git a/messages/de.json b/messages/de.json
index f8604df8..4e4bf4ef 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -197,8 +197,10 @@
   "storage_action_unpin": "Loslösen",
   "storage_action_copy_filename": "Dateiname kopieren",
   "storage_action_copy_filename_success": "Dateiname in die Zwischenablage kopiert.",
+  "storage_action_copy_filename_error": "Dateiname konnte nicht in die Zwischenablage kopiert werden.",
   "storage_action_copy_path": "Pfad kopieren",
   "storage_action_copy_path_success": "Pfad in die Zwischenablage kopiert.",
+  "storage_action_copy_path_error": "Pfad konnte nicht in die Zwischenablage kopiert werden.",
   "storage_pinned_label": "Angeheftete Orte",
   "storage_more_options": "Weitere Optionen",
   "storage_recent_files": "Zuletzt geöffnete Dateien",
diff --git a/messages/en.json b/messages/en.json
index 1e837d27..e93e33f5 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -197,8 +197,10 @@
   "storage_action_unpin": "Unpin",
   "storage_action_copy_filename": "Copy filename",
   "storage_action_copy_filename_success": "Filename copied to clipboard.",
+  "storage_action_copy_filename_error": "Could not copy filename to clipboard.",
   "storage_action_copy_path": "Copy path",
   "storage_action_copy_path_success": "Path copied to clipboard.",
+  "storage_action_copy_path_error": "Could not copy path to clipboard.",
   "storage_pinned_label": "Pinned Access",
   "storage_more_options": "More options",
   "storage_recent_files": "Recent Files",
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 3e9d7fbc..57ff141a 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -299,8 +299,12 @@ export class StorageState {
       case 'copy-filename': {
         const nameKey = ctxKey ?? this.selectedFiles[0]?.key;
         if (!nameKey) return;
-        await navigator.clipboard.writeText(keyToName(nameKey));
-        addToast('success', m.storage_action_copy_filename_success());
+        try {
+          await navigator.clipboard.writeText(keyToName(nameKey));
+          addToast('success', m.storage_action_copy_filename_success());
+        } catch {
+          addToast('error', m.storage_action_copy_filename_error());
+        }
         return;
       }
 
@@ -309,8 +313,12 @@ export class StorageState {
         if (!pathKey) return;
         // Strip trailing slash for folders so the URI is canonical.
         const cleanKey = pathKey.endsWith('/') ? pathKey.slice(0, -1) : pathKey;
-        await navigator.clipboard.writeText(`s3://${this.bucket}/${cleanKey}`);
-        addToast('success', m.storage_action_copy_path_success());
+        try {
+          await navigator.clipboard.writeText(`s3://${this.bucket}/${cleanKey}`);
+          addToast('success', m.storage_action_copy_path_success());
+        } catch {
+          addToast('error', m.storage_action_copy_path_error());
+        }
         return;
       }
     }

From a7f9ffad05d441d7e477e2cb55d001f6d05f3ef7 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 7 Jul 2026 11:43:07 +0200
Subject: [PATCH 089/136] Feat/connection editing (#227)

* feat: add connection editing and listing

* refactor: align StorageConnection to CRD representation

* feat: connection editing and listing

* feat: add modal on dirty form preventing navigation

* fix:e2e tests

* fix:e2e tests

* fix:e2e tests

* move unit tests
---
 TECH_DEBT.md                                  |   8 +
 e2e/storage-s3.spec.ts                        |  41 +-
 e2e/storage/connection.spec.ts                |  25 +-
 e2e/storage/connections-management.spec.ts    | 217 ++++++++
 e2e/storage/context-menu.spec.ts              |   6 +
 e2e/storage/helpers.ts                        |  26 +-
 messages/de.json                              |  58 ++-
 messages/en.json                              |  58 ++-
 package-lock.json                             |  26 +-
 package.json                                  |   1 +
 .../storage/DeleteConnectionModal.svelte      | 142 ++++++
 .../storage/explorer/ObjectTable.svelte       |   2 +-
 .../storage/explorer/SelectionToolbar.svelte  |   2 +-
 .../ContextMenu.svelte.spec.ts                |   2 +-
 .../FileExplorer.svelte.spec.ts               |   2 +-
 .../{ => __tests__}/FileRow.svelte.spec.ts    |   2 +-
 .../{ => __tests__}/FolderRow.svelte.spec.ts  |   2 +-
 .../ObjectTable.svelte.spec.ts                |   2 +-
 .../SelectionToolbar.svelte.spec.ts           |   2 +-
 .../StorageBreadcrumb.svelte.spec.ts          |   2 +-
 .../landing/RecentItems.svelte.spec.ts        |  12 +-
 .../storage/landing/StorageConnectForm.svelte | 463 ++++++++----------
 .../landing/StorageConnectForm.svelte.spec.ts | 424 ++++++++--------
 .../storage/sidebar/BucketList.svelte         | 133 +----
 .../storage/sidebar/BucketList.svelte.spec.ts |  10 +-
 .../storage/sidebar/ResizeHandle.svelte       |  34 ++
 .../sidebar/StorageConnectionSidebar.svelte   | 281 +++++++++++
 .../storage/sidebar/resizable-panel.svelte.ts | 110 +++++
 src/lib/server/storage/connection.ts          |  15 +-
 src/lib/server/storage/factory.test.ts        |   8 +-
 src/lib/server/storage/s3-client.test.ts      |  75 +--
 src/lib/server/storage/s3-client.ts           |  32 +-
 src/lib/server/storage/s3-provider.test.ts    |  26 +-
 src/lib/server/storage/service.test.ts        |   4 +-
 src/lib/server/storage/types.ts               |  12 +-
 src/lib/server/storage/utils.test.ts          |   7 +-
 src/lib/storage/bookmarks.svelte.spec.ts      | 147 ++++++
 src/lib/storage/bookmarks.svelte.ts           |  82 +++-
 src/lib/storage/connection-storage.spec.ts    | 261 ++++++++++
 src/lib/storage/connection-storage.ts         |  94 +++-
 src/lib/storage/schemas.ts                    |  94 +++-
 src/lib/storage/state.svelte.ts               |   5 +-
 src/lib/storage/types.ts                      |   6 +-
 src/routes/(app)/storage/+layout.svelte       |   9 +-
 src/routes/(app)/storage/+layout.ts           |  13 +-
 src/routes/(app)/storage/+page.server.ts      |  20 +-
 src/routes/(app)/storage/+page.svelte         |   8 +-
 .../(app)/storage/connections/+page.server.ts |   8 +
 .../(app)/storage/connections/+page.svelte    | 195 ++++++++
 .../storage/connections/[id]/+layout.svelte   |  22 +
 .../connections/[id]/edit/+page.server.ts     |  64 +++
 .../connections/[id]/edit/+page.svelte        | 366 ++++++++++++++
 src/routes/(app)/storage/page.server.test.ts  |  18 +-
 53 files changed, 2883 insertions(+), 801 deletions(-)
 create mode 100644 e2e/storage/connections-management.spec.ts
 create mode 100644 src/lib/components/storage/DeleteConnectionModal.svelte
 rename src/lib/components/storage/explorer/{ => __tests__}/ContextMenu.svelte.spec.ts (99%)
 rename src/lib/components/storage/explorer/{ => __tests__}/FileExplorer.svelte.spec.ts (98%)
 rename src/lib/components/storage/explorer/{ => __tests__}/FileRow.svelte.spec.ts (99%)
 rename src/lib/components/storage/explorer/{ => __tests__}/FolderRow.svelte.spec.ts (99%)
 rename src/lib/components/storage/explorer/{ => __tests__}/ObjectTable.svelte.spec.ts (98%)
 rename src/lib/components/storage/explorer/{ => __tests__}/SelectionToolbar.svelte.spec.ts (98%)
 rename src/lib/components/storage/explorer/{ => __tests__}/StorageBreadcrumb.svelte.spec.ts (99%)
 create mode 100644 src/lib/components/storage/sidebar/ResizeHandle.svelte
 create mode 100644 src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
 create mode 100644 src/lib/components/storage/sidebar/resizable-panel.svelte.ts
 create mode 100644 src/lib/storage/bookmarks.svelte.spec.ts
 create mode 100644 src/lib/storage/connection-storage.spec.ts
 create mode 100644 src/routes/(app)/storage/connections/+page.server.ts
 create mode 100644 src/routes/(app)/storage/connections/+page.svelte
 create mode 100644 src/routes/(app)/storage/connections/[id]/+layout.svelte
 create mode 100644 src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
 create mode 100644 src/routes/(app)/storage/connections/[id]/edit/+page.svelte

diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index fac5094d..63591e87 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -22,6 +22,14 @@ Trino error messages are stored verbatim in `query.error` and surfaced through `
 
 ---
 
+### TLS certificate verification can be disabled without a custom CA
+
+**File:** `src/lib/server/storage/s3-client.ts`
+
+When `tls.verification` is set to `'None'`, the S3 client is created with `rejectUnauthorized: false`, disabling certificate validation entirely. This is a blunt instrument: it silences errors from self-signed or expired certificates but also makes the connection vulnerable to MITM attacks. The correct long-term fix is to allow users to provide their own CA bundle (a PEM file) which is then used to create a custom TLS context, so the server certificate is still validated — just against a trusted private CA instead of the public root store.
+
+---
+
 ### S3 connection credentials stored in localStorage
 
 **File:** `src/lib/storage/connection-storage.ts`, `src/lib/components/storage/StorageConnectForm.svelte`
diff --git a/e2e/storage-s3.spec.ts b/e2e/storage-s3.spec.ts
index f1d37dad..653cf5b0 100644
--- a/e2e/storage-s3.spec.ts
+++ b/e2e/storage-s3.spec.ts
@@ -25,6 +25,11 @@ test.describe('Storage S3 (Garage)', () => {
     const disconnectButton = page.getByRole('button', { name: 'Disconnect' });
     if (await disconnectButton.isVisible().catch(() => false)) {
       await disconnectButton.click();
+      // Disconnect now opens a confirmation modal — confirm it if it appears.
+      const confirmButton = page.getByRole('dialog').getByRole('button', { name: 'Disconnect' });
+      if (await confirmButton.isVisible({ timeout: 2_000 }).catch(() => false)) {
+        await confirmButton.click();
+      }
     }
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
@@ -44,14 +49,16 @@ test.describe('Storage S3 (Garage)', () => {
 
     await openConnectForm(page);
 
-    // Fill in the connection form
-    await page.getByLabel('Endpoint URL').fill(endpoint);
+    // Fill in the connection form — parse URL into host/port
+    const url = new URL(endpoint);
+    await page.getByLabel('Host').fill(url.hostname);
+    if (url.port) await page.getByLabel('Port').fill(url.port);
+    const tlsToggle = page.getByLabel('Use TLS');
+    if (url.protocol !== 'https:' && (await tlsToggle.isChecked())) await tlsToggle.uncheck();
+    await page.getByLabel('Access style').selectOption('Path');
     await page.getByLabel('Region').fill(region);
-    await page.getByLabel('Access key ID').fill(accessKeyId);
-    await page.getByLabel('Secret access key').fill(secretAccessKey);
-
-    // Path-style addressing is on by default (required for Garage) — verify it is checked
-    await expect(page.getByLabel('Use path-style addressing')).toBeChecked();
+    await page.getByLabel('Access key').fill(accessKeyId);
+    await page.getByLabel('Secret key').fill(secretAccessKey);
 
     await page.getByRole('button', { name: 'Connect' }).click();
 
@@ -60,8 +67,10 @@ test.describe('Storage S3 (Garage)', () => {
     const main = page.locator('main');
     await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
-    // The bucket created during Garage setup must appear in the list
-    await expect(main.getByRole('link', { name: bucket, exact: true })).toBeVisible();
+    // The bucket created during Garage setup must appear in the list.
+    // Both the sidebar nav and the bucket grid render a link — use first() to
+    // avoid a strict-mode violation.
+    await expect(main.getByRole('link', { name: bucket, exact: true }).first()).toBeVisible();
   });
 
   test('disconnects from Garage S3', async ({ page }) => {
@@ -77,15 +86,21 @@ test.describe('Storage S3 (Garage)', () => {
 
     // First connect
     await openConnectForm(page);
-    await page.getByLabel('Endpoint URL').fill(endpoint);
+    const url2 = new URL(endpoint);
+    await page.getByLabel('Host').fill(url2.hostname);
+    if (url2.port) await page.getByLabel('Port').fill(url2.port);
+    const tlsToggle2 = page.getByLabel('Use TLS');
+    if (url2.protocol !== 'https:' && (await tlsToggle2.isChecked())) await tlsToggle2.uncheck();
+    await page.getByLabel('Access style').selectOption('Path');
     await page.getByLabel('Region').fill(region);
-    await page.getByLabel('Access key ID').fill(accessKeyId);
-    await page.getByLabel('Secret access key').fill(secretAccessKey);
+    await page.getByLabel('Access key').fill(accessKeyId);
+    await page.getByLabel('Secret key').fill(secretAccessKey);
     await page.getByRole('button', { name: 'Connect' }).click();
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
-    // Then disconnect
+    // Then disconnect — clicking Disconnect opens a confirmation modal.
     await page.getByRole('button', { name: 'Disconnect' }).click();
+    await page.getByRole('dialog').getByRole('button', { name: 'Disconnect' }).click();
 
     // Should return to the connect form
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index 8f7d22c8..d74f1b7a 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -31,10 +31,15 @@ test.describe('Storage S3 — Connection', () => {
     const credentials = requireGarageCredentials();
 
     await openConnectForm(page);
-    await page.getByLabel('Endpoint URL').fill(credentials.endpoint);
+    const url = new URL(credentials.endpoint);
+    await page.getByLabel('Host').fill(url.hostname);
+    if (url.port) await page.getByLabel('Port').fill(url.port);
+    const tlsToggle = page.getByLabel('Use TLS');
+    if (url.protocol !== 'https:' && (await tlsToggle.isChecked())) await tlsToggle.uncheck();
+    await page.getByLabel('Access style').selectOption('Path');
     await page.getByLabel('Region').fill(credentials.region);
-    await page.getByLabel('Access key ID').fill(credentials.accessKeyId);
-    await page.getByLabel('Secret access key').fill(`${credentials.secretAccessKey}-wrong`);
+    await page.getByLabel('Access key').fill(credentials.accessKeyId);
+    await page.getByLabel('Secret key').fill(`${credentials.secretAccessKey}-wrong`);
     await page.getByRole('button', { name: 'Connect' }).click();
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
@@ -51,8 +56,9 @@ test.describe('Storage S3 — Connection', () => {
 
     // Click the sidebar Disconnect button — this opens a confirmation modal.
     await page.getByRole('button', { name: 'Disconnect' }).click();
-    // Confirm disconnection in the modal.
-    await page.locator('.modal-box').getByRole('button', { name: 'Disconnect' }).click();
+    // Clicking Disconnect opens a confirmation modal; confirm by clicking the
+    // Disconnect button inside the dialog.
+    await page.getByRole('dialog').getByRole('button', { name: 'Disconnect' }).click();
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
   });
 
@@ -84,12 +90,15 @@ test.describe('Storage S3 — Connection', () => {
     const savedList = page.getByRole('list', { name: 'Saved connections' });
     await expect(savedList).toBeVisible();
 
+    // Open the "More options" context menu for the first saved connection
     await savedList.getByRole('listitem').first().getByRole('button').last().click();
 
-    await expect(page.getByRole('button', { name: 'Forget', exact: true })).toBeVisible();
-    await page.getByRole('button', { name: 'Forget', exact: true }).click();
+    // Click Delete in the context menu (rendered as a menuitem)
+    await page.getByRole('menuitem', { name: 'Delete', exact: true }).click();
+
+    // Confirm deletion in the modal
+    await page.getByRole('button', { name: 'Delete', exact: true }).click();
 
-    await expect(savedList).not.toBeVisible();
     await expect(page.getByText('No saved connections yet')).toBeVisible();
   });
 
diff --git a/e2e/storage/connections-management.spec.ts b/e2e/storage/connections-management.spec.ts
new file mode 100644
index 00000000..5e3331bb
--- /dev/null
+++ b/e2e/storage/connections-management.spec.ts
@@ -0,0 +1,217 @@
+import { test, expect, type Page } from '@playwright/test';
+import { hasGarageCredentials, requireGarageCredentials } from '../support/garage.js';
+import { connectToStorage, openConnectForm } from './helpers.js';
+import { waitForHydration } from '../support/helpers.js';
+
+/** Open the Options context menu for the first connection row and click Edit. */
+async function openFirstConnectionEditPage(page: Page) {
+  await page
+    .getByRole('button', { name: /Options for/i })
+    .first()
+    .click({ force: true });
+  await page.getByRole('menuitem', { name: 'Edit' }).click();
+  await waitForHydration(page);
+}
+
+test.describe('Storage — Connections management', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('shows "Manage connections" link on the connect form when saved connections exist', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await openConnectForm(page);
+
+    await expect(page.getByRole('link', { name: 'Manage connections' })).toBeVisible();
+  });
+
+  test('navigates to /storage/connections from the manage link', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await openConnectForm(page);
+
+    await page.getByRole('link', { name: 'Manage connections' }).click();
+
+    await waitForHydration(page);
+    await expect(page).toHaveURL('/storage/connections');
+    await expect(page.getByRole('heading', { name: 'Manage connections' })).toBeVisible();
+  });
+
+  test('lists saved connections on the management page', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    // Connections are displayed in a table; at least one data row should be visible.
+    await expect(page.getByRole('table').getByRole('row').nth(1)).toBeVisible();
+  });
+
+  test('Edit link on management page navigates to edit page', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await expect(page.getByRole('heading', { name: 'Edit connection' })).toBeVisible();
+  });
+
+  test('edit page pre-fills with current connection values', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await expect(page.getByRole('textbox', { name: 'Host' })).toHaveValue(
+      new URL(credentials.endpoint).hostname
+    );
+    await expect(page.getByRole('textbox', { name: 'Region' })).toHaveValue(credentials.region);
+    await expect(page.getByRole('textbox', { name: 'Access key' })).toHaveValue(
+      credentials.accessKeyId
+    );
+  });
+
+  test('edit page redirects to connections list after saving valid credentials', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByRole('button', { name: 'Save changes' }).click();
+
+    await waitForHydration(page);
+    await expect(page).toHaveURL('/storage/connections');
+    await expect(page.getByRole('heading', { name: 'Manage connections' })).toBeVisible();
+  });
+
+  test('edit page shows error for invalid credentials', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByLabel('Secret key').fill('wrong-secret');
+    await page.getByRole('button', { name: 'Save changes' }).click();
+
+    await expect(
+      page.getByText('Could not connect — check the endpoint and credentials.')
+    ).toBeVisible();
+  });
+
+  test('delete button on management page removes the connection after confirmation', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    // Connections are displayed in a table; count data rows (excluding header).
+    const dataRows = page.locator('table tbody tr');
+    const initialItems = await dataRows.count();
+
+    await page
+      .getByRole('button', { name: /Options for/i })
+      .first()
+      .click({ force: true });
+    await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+    // Confirm deletion in the modal
+    await page.getByRole('dialog').getByRole('button', { name: 'Delete', exact: true }).click();
+
+    await expect(dataRows).toHaveCount(initialItems - 1);
+  });
+
+  test('redirects to /storage/connections when editing a non-existent id', async ({ page }) => {
+    await page.goto('/storage/connections/00000000-0000-0000-0000-000000000000/edit');
+    await waitForHydration(page);
+
+    await expect(page).toHaveURL('/storage/connections');
+  });
+
+  test('edit page shows active connection notice when editing current connection', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await expect(page.getByText('You are currently connected with this connection.')).toBeVisible();
+  });
+
+  test('edit page shows unsaved-changes modal when navigating away with dirty form', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    // Make a change to mark the form dirty
+    await page.getByLabel('Connection name').fill('Changed name');
+
+    // Try to navigate away via the back link
+    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+
+    // Modal should appear
+    await expect(page.getByRole('dialog')).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'Unsaved changes' })).toBeVisible();
+  });
+
+  test('unsaved-changes modal: Stay keeps user on edit page', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByLabel('Connection name').fill('Changed name');
+    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+
+    await page.getByRole('dialog').getByRole('button', { name: 'Stay on page' }).click();
+
+    await expect(page).toHaveURL(/\/edit$/);
+    await expect(page.getByRole('heading', { name: 'Edit connection' })).toBeVisible();
+  });
+
+  test('unsaved-changes modal: Leave navigates away', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByLabel('Connection name').fill('Changed name');
+    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+
+    await page.getByRole('dialog').getByRole('button', { name: 'Leave' }).click();
+
+    await waitForHydration(page);
+    await expect(page).toHaveURL('/storage/connections');
+  });
+});
diff --git a/e2e/storage/context-menu.spec.ts b/e2e/storage/context-menu.spec.ts
index eebecd0f..a9e961c0 100644
--- a/e2e/storage/context-menu.spec.ts
+++ b/e2e/storage/context-menu.spec.ts
@@ -99,6 +99,9 @@ test.describe('Storage S3 — Context Menu', () => {
     context,
     browserName
   }, testInfo) => {
+    // Firefox does not support clipboard-read in grantPermissions.
+    test.skip(browserName === 'firefox', 'Firefox does not support clipboard-read permission');
+
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
     const prefix = uniquePrefix(testInfo, 'ctx-copy-name');
@@ -142,6 +145,9 @@ test.describe('Storage S3 — Context Menu', () => {
     context,
     browserName
   }, testInfo) => {
+    // Firefox does not support clipboard-read in grantPermissions.
+    test.skip(browserName === 'firefox', 'Firefox does not support clipboard-read permission');
+
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
     const prefix = uniquePrefix(testInfo, 'ctx-copy-path');
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index ae47e5ed..104e76b6 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -71,12 +71,30 @@ export async function openConnectForm(page: Page) {
 
 export async function connectToStorage(page: Page, credentials: GarageCredentials) {
   await openConnectForm(page);
-  await page.getByLabel('Endpoint URL').fill(credentials.endpoint);
+  const url = new URL(credentials.endpoint);
+  const host = url.hostname;
+  const port = url.port;
+  const useTls = url.protocol === 'https:';
+
+  await page.getByLabel('Host').fill(host);
+  if (port) {
+    await page.getByLabel('Port').fill(port);
+  }
+  // Default TLS is on — uncheck it for plain HTTP endpoints
+  const tlsToggle = page.getByLabel('Use TLS');
+  if (!useTls && (await tlsToggle.isChecked())) {
+    await tlsToggle.uncheck();
+  }
+  // Default access style is VirtualHosted — switch to Path for Garage
+  await page.getByLabel('Access style').selectOption('Path');
   await page.getByLabel('Region').fill(credentials.region);
-  await page.getByLabel('Access key ID').fill(credentials.accessKeyId);
-  await page.getByLabel('Secret access key').fill(credentials.secretAccessKey);
-  await expect(page.getByLabel('Use path-style addressing')).toBeChecked();
+  await page.getByLabel('Access key').fill(credentials.accessKeyId);
+  await page.getByLabel('Secret key').fill(credentials.secretAccessKey);
   await page.getByRole('button', { name: 'Connect' }).click();
+  // Wait for the redirect to /storage so that saveConnectionLocally() has been called
+  // before the test navigates elsewhere. Without this, a fast page.goto() call can race
+  // with the in-flight form-submission fetch and the connection is never persisted.
+  await page.waitForURL((url) => url.pathname === '/storage', { timeout: 15_000 });
 }
 
 export async function connectAndOpenPrefix(
diff --git a/messages/de.json b/messages/de.json
index 4e4bf4ef..084e1075 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -126,23 +126,61 @@
   "storage_connect_type": "Backend-Typ",
   "storage_connect_type_s3": "S3-kompatibel",
   "storage_connect_type_hdfs": "HDFS",
-  "storage_connect_endpoint": "Endpunkt-URL",
-  "storage_connect_endpoint_placeholder": "https://minio.beispiel.de:9000",
-  "storage_connect_endpoint_hint": "Leer lassen für AWS S3",
-  "storage_connect_path_style": "Path-Style-Adressierung verwenden",
-  "storage_connect_path_style_hint": "Für MinIO und die meisten selbst gehosteten S3-Anbieter aktivieren. Für Virtual-Hosted-Style deaktivieren.",
+  "storage_connect_host": "Host",
+  "storage_connect_host_placeholder": "minio.beispiel.de",
+  "storage_connect_port": "Port",
+  "storage_connect_port_placeholder": "9000",
+  "storage_connect_port_hint": "Leer lassen, um den Standardport für das Protokoll zu verwenden.",
+  "storage_connect_tls": "TLS verwenden",
+  "storage_connect_tls_hint": "Verbindung mit TLS/HTTPS verschlüsseln.",
+  "storage_connect_tls_verification": "Zertifikat prüfen",
+  "storage_connect_tls_verification_hint": "Deaktivieren, um selbstsignierte oder nicht vertrauenswürdige Zertifikate zu akzeptieren.",
+  "storage_connect_access_style": "Zugriffsstil",
+  "storage_connect_access_style_path": "Path",
+  "storage_connect_access_style_virtual_hosted": "Virtual hosted",
   "storage_connect_region": "Region",
-  "storage_connect_access_key": "Zugriffsschlüssel-ID",
-  "storage_connect_secret_key": "Geheimer Zugriffsschlüssel",
+  "storage_connect_access_key": "Zugriffsschlüssel",
+  "storage_connect_secret_key": "Geheimer Schlüssel",
   "storage_connect_submit": "Verbinden",
   "storage_connect_reconnecting": "Verbindung zum Speicher wird wiederhergestellt…",
   "storage_connect_error": "Verbindung fehlgeschlagen — Endpunkt und Zugangsdaten prüfen.",
   "storage_connect_saved": "Gespeicherte Verbindungen",
   "storage_connect_no_saved": "Noch keine gespeicherten Verbindungen",
-  "storage_connect_forget": "Vergessen",
-  "storage_connect_forget_confirm": "{endpoint} aus den gespeicherten Verbindungen entfernen?",
+  "storage_connect_forget": "Löschen",
+  "storage_connect_forget_confirm": "{endpoint} aus den gespeicherten Verbindungen löschen?",
   "storage_connect_forget_cancel": "Abbrechen",
-  "storage_connect_forget_label": "Verbindung zu {endpoint} vergessen",
+  "storage_connect_forget_label": "Verbindung zu {endpoint} löschen",
+  "storage_connect_copy": "Kopieren",
+  "storage_connect_copied": "Kopiert",
+  "storage_connect_copy_all": "Alles kopieren",
+  "storage_connect_manage": "Verbindungen verwalten",
+  "storage_connect_edit": "Bearbeiten",
+  "storage_connections_col_name": "Verbindung",
+  "storage_connections_col_host": "Host",
+  "storage_connections_col_type": "Typ",
+  "storage_connections_back": "Zurück zum Verbinden",
+  "storage_connections_options": "Optionen für {label}",
+  "storage_connections_title": "Verbindungen verwalten",
+  "storage_connections_subtitle": "Gespeicherte Speicherverbindungen bearbeiten oder entfernen.",
+  "storage_connections_empty": "Noch keine gespeicherten Verbindungen.",
+  "storage_connections_edit": "Bearbeiten",
+  "storage_connections_delete": "Löschen",
+  "storage_connections_delete_confirm": "\u201e{label}\u201c aus den gespeicherten Verbindungen entfernen? Dies kann nicht rückgängig gemacht werden.",
+  "storage_connections_delete_cancel": "Abbrechen",
+  "storage_connections_delete_confirm_button": "Löschen",
+  "storage_connection_edit_title": "Verbindung bearbeiten",
+  "storage_connection_edit_name": "Verbindungsname",
+  "storage_connection_edit_name_placeholder": "z. B. Produktions-Garage",
+  "storage_connection_edit_name_hint": "Optional. Wird auf der Verbindungskachel anstelle des Hostnamens angezeigt.",
+  "storage_connection_edit_save": "Änderungen speichern",
+  "storage_connection_edit_credentials_hint": "Leer lassen, um die aktuellen Anmeldedaten beizubehalten.",
+  "storage_connection_edit_success": "Verbindung erfolgreich aktualisiert.",
+  "storage_connection_edit_active_notice": "Sie sind derzeit mit dieser Verbindung verbunden.",
+  "storage_connection_edit_not_found": "Verbindung nicht gefunden.",
+  "storage_connection_edit_unsaved_title": "Nicht gespeicherte Änderungen",
+  "storage_connection_edit_unsaved_body": "Sie haben nicht gespeicherte Änderungen. Wenn Sie jetzt die Seite verlassen, gehen Ihre Änderungen verloren.",
+  "storage_connection_edit_unsaved_leave": "Verlassen",
+  "storage_connection_edit_unsaved_stay": "Auf der Seite bleiben",
   "storage_disconnect": "Verbindung Trennen",
   "storage_disconnect_confirm_title": "Speicherverbindung trennen?",
   "storage_disconnect_confirm_message": "Sie werden zum Verbindungsbildschirm zurückgeleitet.",
diff --git a/messages/en.json b/messages/en.json
index e93e33f5..45bb9ba4 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -126,23 +126,61 @@
   "storage_connect_type": "Backend type",
   "storage_connect_type_s3": "S3-compatible",
   "storage_connect_type_hdfs": "HDFS",
-  "storage_connect_endpoint": "Endpoint URL",
-  "storage_connect_endpoint_placeholder": "https://minio.example.com:9000",
-  "storage_connect_endpoint_hint": "Leave blank to use AWS S3",
-  "storage_connect_path_style": "Use path-style addressing",
-  "storage_connect_path_style_hint": "Enable for MinIO and most self-hosted S3 providers. Disable for virtual-hosted-style access.",
+  "storage_connect_host": "Host",
+  "storage_connect_host_placeholder": "minio.example.com",
+  "storage_connect_port": "Port",
+  "storage_connect_port_placeholder": "9000",
+  "storage_connect_port_hint": "Leave blank to use the default port for the protocol.",
+  "storage_connect_tls": "Use TLS",
+  "storage_connect_tls_hint": "Encrypt the connection with TLS/HTTPS.",
+  "storage_connect_tls_verification": "Verify certificate",
+  "storage_connect_tls_verification_hint": "Disable to accept self-signed or untrusted certificates.",
+  "storage_connect_access_style": "Access style",
+  "storage_connect_access_style_path": "Path",
+  "storage_connect_access_style_virtual_hosted": "Virtual hosted",
   "storage_connect_region": "Region",
-  "storage_connect_access_key": "Access key ID",
-  "storage_connect_secret_key": "Secret access key",
+  "storage_connect_access_key": "Access key",
+  "storage_connect_secret_key": "Secret key",
   "storage_connect_submit": "Connect",
   "storage_connect_reconnecting": "Reconnecting to storage…",
   "storage_connect_error": "Could not connect — check the endpoint and credentials.",
   "storage_connect_saved": "Saved connections",
   "storage_connect_no_saved": "No saved connections yet",
-  "storage_connect_forget": "Forget",
-  "storage_connect_forget_confirm": "Remove {endpoint} from saved connections?",
+  "storage_connect_forget": "Delete",
+  "storage_connect_forget_confirm": "Delete {endpoint} from saved connections?",
   "storage_connect_forget_cancel": "Cancel",
-  "storage_connect_forget_label": "Forget connection to {endpoint}",
+  "storage_connect_forget_label": "Delete connection to {endpoint}",
+  "storage_connect_copy": "Copy",
+  "storage_connect_copied": "Copied",
+  "storage_connect_copy_all": "Copy all",
+  "storage_connect_manage": "Manage connections",
+  "storage_connect_edit": "Edit",
+  "storage_connections_col_name": "Connection",
+  "storage_connections_col_host": "Host",
+  "storage_connections_col_type": "Type",
+  "storage_connections_back": "Back to connect",
+  "storage_connections_options": "Options for {label}",
+  "storage_connections_title": "Manage connections",
+  "storage_connections_subtitle": "Edit or remove your saved storage connections.",
+  "storage_connections_empty": "No saved connections yet.",
+  "storage_connections_edit": "Edit",
+  "storage_connections_delete": "Delete",
+  "storage_connections_delete_confirm": "Remove \u201c{label}\u201d from saved connections? This cannot be undone.",
+  "storage_connections_delete_cancel": "Cancel",
+  "storage_connections_delete_confirm_button": "Delete",
+  "storage_connection_edit_title": "Edit connection",
+  "storage_connection_edit_name": "Connection name",
+  "storage_connection_edit_name_placeholder": "e.g. Production Garage",
+  "storage_connection_edit_name_hint": "Optional. Shown on the connection tile instead of the hostname.",
+  "storage_connection_edit_save": "Save changes",
+  "storage_connection_edit_credentials_hint": "Leave blank to keep the current credentials.",
+  "storage_connection_edit_success": "Connection updated successfully.",
+  "storage_connection_edit_active_notice": "You are currently connected with this connection.",
+  "storage_connection_edit_not_found": "Connection not found.",
+  "storage_connection_edit_unsaved_title": "Unsaved changes",
+  "storage_connection_edit_unsaved_body": "You have unsaved changes. If you leave now, your changes will be lost.",
+  "storage_connection_edit_unsaved_leave": "Leave",
+  "storage_connection_edit_unsaved_stay": "Stay on page",
   "storage_disconnect": "Disconnect",
   "storage_disconnect_confirm_title": "Disconnect from storage?",
   "storage_disconnect_confirm_message": "You will be returned to the connection screen.",
diff --git a/package-lock.json b/package-lock.json
index 8335cfef..abeb948d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,6 +12,7 @@
         "@aws-sdk/client-s3": "^3.1041.0",
         "@aws-sdk/lib-storage": "^3.1045.0",
         "@internationalized/date": "^3.11.0",
+        "@smithy/node-http-handler": "4.9.1",
         "antlr4-c3": "^3.4.4",
         "antlr4ng": "^3.0.16",
         "better-auth": "^1.5.4",
@@ -2756,13 +2757,12 @@
       "license": "MIT"
     },
     "node_modules/@smithy/core": {
-      "version": "3.24.4",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.24.4.tgz",
-      "integrity": "sha512-3UNRKEyQyAgVgM0LGlerCLm+ChZWZ1GPfde+jBEW6bm6bSBGU1p0EbblaUV3unbhwvidjLA5Zs3sOs7mnZwvAw==",
+      "version": "3.28.0",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.28.0.tgz",
+      "integrity": "sha512-N/LoLG8pZ1zv5cIWpdF6vmSjtZtXKK9G0OqT5yYCOZU+CzPq1+nYA95VoKJBGWRScs7YbMugZ7lZx8Fj1vdHoA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-crypto/crc32": "5.2.0",
-        "@smithy/types": "^4.14.2",
+        "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2810,13 +2810,13 @@
       }
     },
     "node_modules/@smithy/node-http-handler": {
-      "version": "4.7.4",
-      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.7.4.tgz",
-      "integrity": "sha512-HIeF+1vrDGzPkkv39Hj2vlHSXHY3p958jd/8ZnePIY6+ZOsQX8coyEUKO5yQu4r0bQIVsbpotVIrXXwyycMStQ==",
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.9.1.tgz",
+      "integrity": "sha512-m/f15di58P6NtLQ7eVEb5N19NdJWn+4c7zfkFHMT/i3JH7U8UtknpPoy8o2tm2R3OdliYvsvQhZHIfACQDqT+Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.24.4",
-        "@smithy/types": "^4.14.2",
+        "@smithy/core": "^3.28.0",
+        "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2838,9 +2838,9 @@
       }
     },
     "node_modules/@smithy/types": {
-      "version": "4.14.2",
-      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.14.2.tgz",
-      "integrity": "sha512-P+otAxbV4CqBybp7EkcJCrig63yE2E7PuNVOmilVMRcx/O+QDzGULTrKsq4DV13gSfak9ObPrWaHl/9bL5YcWw==",
+      "version": "4.15.0",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.15.0.tgz",
+      "integrity": "sha512-Z5TAOxygoFvybJV3igo5SloFflSokHx2hu1eFA+DxDTcn+FtKxUSui+rbTRG1pAafMA888Z3MVvCWUuvCrTXjg==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
diff --git a/package.json b/package.json
index 7affb0d4..f9393ffe 100644
--- a/package.json
+++ b/package.json
@@ -64,6 +64,7 @@
     "@aws-sdk/client-s3": "^3.1041.0",
     "@aws-sdk/lib-storage": "^3.1045.0",
     "@internationalized/date": "^3.11.0",
+    "@smithy/node-http-handler": "4.9.1",
     "antlr4-c3": "^3.4.4",
     "antlr4ng": "^3.0.16",
     "better-auth": "^1.5.4",
diff --git a/src/lib/components/storage/DeleteConnectionModal.svelte b/src/lib/components/storage/DeleteConnectionModal.svelte
new file mode 100644
index 00000000..39d33390
--- /dev/null
+++ b/src/lib/components/storage/DeleteConnectionModal.svelte
@@ -0,0 +1,142 @@
+<script lang="ts">
+  import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconCheck from 'virtual:icons/material-symbols/check';
+  import Modal from '$lib/components/Modal.svelte';
+  import * as m from '$lib/paraglide/messages.js';
+  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+
+  interface Props {
+    open: boolean;
+    connection: SavedConnection | null;
+    onconfirm: () => void;
+    oncancel: () => void;
+  }
+
+  let { open = $bindable(), connection, onconfirm, oncancel }: Props = $props();
+
+  let copiedField: string | null = $state(null);
+
+  function connectionLabel(conn: SavedConnection): string {
+    if (conn.name) return conn.name;
+    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+  }
+
+  function copyField(value: string, field: string) {
+    navigator.clipboard.writeText(value);
+    copiedField = field;
+    setTimeout(() => {
+      copiedField = null;
+    }, 1500);
+  }
+
+  function copyAll(conn: SavedConnection) {
+    const host = conn.port ? `${conn.host}:${conn.port}` : conn.host;
+    const lines = [
+      `Host:        ${host}`,
+      `Type:        ${m.storage_connect_type_s3()}`,
+      ...(conn.credentials?.accessKey ? [`Access key:  ${conn.credentials.accessKey}`] : []),
+      `Region:      ${conn.region.name}`
+    ];
+    navigator.clipboard.writeText(lines.join('\n'));
+    copiedField = 'all';
+    setTimeout(() => {
+      copiedField = null;
+    }, 1500);
+  }
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box max-w-lg">
+    {#if connection}
+      <p class="text-base-content mb-4 font-medium">
+        {m.storage_connections_delete_confirm({ label: connectionLabel(connection) })}
+      </p>
+      <div class="rounded-box border-base-content/5 bg-base-100 overflow-x-auto border">
+        <table class="table-sm table">
+          <tbody>
+            {#snippet copyBtn(value: string, field: string)}
+              <button
+                type="button"
+                class="btn btn-ghost btn-xs btn-square"
+                aria-label={copiedField === field
+                  ? m.storage_connect_copied()
+                  : m.storage_connect_copy()}
+                onclick={() => copyField(value, field)}
+              >
+                {#if copiedField === field}
+                  <IconCheck class="text-success h-4 w-4" />
+                {:else}
+                  <IconContentCopy class="h-4 w-4" />
+                {/if}
+              </button>
+            {/snippet}
+            <tr>
+              <th>{m.storage_connect_host()}</th>
+              <td class="border-base-content/10 border-l">
+                <div class="flex items-center justify-between gap-2">
+                  <span class="font-mono">
+                    {connection.port ? `${connection.host}:${connection.port}` : connection.host}
+                  </span>
+                  {@render copyBtn(
+                    connection.port ? `${connection.host}:${connection.port}` : connection.host,
+                    'host'
+                  )}
+                </div>
+              </td>
+            </tr>
+            <tr>
+              <th>{m.storage_connect_type()}</th>
+              <td class="border-base-content/10 border-l">
+                <div class="flex items-center justify-between gap-2">
+                  <span>{m.storage_connect_type_s3()}</span>
+                  {@render copyBtn(m.storage_connect_type_s3(), 'type')}
+                </div>
+              </td>
+            </tr>
+            {#if connection.credentials?.accessKey}
+              <tr>
+                <th>{m.storage_connect_access_key()}</th>
+                <td class="border-base-content/10 border-l">
+                  <div class="flex items-center justify-between gap-2">
+                    <span class="font-mono">{connection.credentials.accessKey}</span>
+                    {@render copyBtn(connection.credentials.accessKey, 'accessKey')}
+                  </div>
+                </td>
+              </tr>
+            {/if}
+            <tr>
+              <th>{m.storage_connect_region()}</th>
+              <td class="border-base-content/10 border-l">
+                <div class="flex items-center justify-between gap-2">
+                  <span class="font-mono">{connection.region.name}</span>
+                  {@render copyBtn(connection.region.name, 'region')}
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    {/if}
+    <div class="modal-action">
+      <button
+        type="button"
+        class="btn btn-ghost btn-sm mr-auto"
+        onclick={() => connection && copyAll(connection)}
+      >
+        {#if copiedField === 'all'}
+          <IconCheck class="text-success h-4 w-4" />
+          {m.storage_connect_copied()}
+        {:else}
+          <IconContentCopy class="h-4 w-4" />
+          {m.storage_connect_copy_all()}
+        {/if}
+      </button>
+      <button type="button" class="btn btn-ghost btn-sm" onclick={oncancel}>
+        {m.storage_connections_delete_cancel()}
+      </button>
+      <button type="button" class="btn btn-error btn-sm" onclick={onconfirm}>
+        {m.storage_connections_delete_confirm_button()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 66f185b6..d97cbd87 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -31,7 +31,7 @@
       <!-- Column headers -->
       <tr
         class="
-          bg-base-200 text-base-content/50 text-xs tracking-wide uppercase
+          bg-base-200 text-base-content/50 z-10 text-xs tracking-wide uppercase
         "
       >
         <th class="w-8 pr-0">
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
index b5c7f4be..91dd742f 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -17,7 +17,7 @@
   );
 </script>
 
-<tr class="border-primary/20 bg-primary/5 border-t">
+<tr class="border-primary/20 bg-primary/5 z-30 border-t">
   <th colspan={5} class="px-4 py-1.5 font-normal">
     <div class="flex items-center gap-1">
       <span class="text-base-content/50 mr-1 text-xs">
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
index 9a8fd11d..2e86509d 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import ContextMenuWrapper from './__tests__/ContextMenuWrapper.svelte';
+import ContextMenuWrapper from './ContextMenuWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FileExplorer.svelte.spec.ts
similarity index 98%
rename from src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/FileExplorer.svelte.spec.ts
index a412b677..2c31faee 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FileExplorer.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import FileExplorerWrapper from './__tests__/FileExplorerWrapper.svelte';
+import FileExplorerWrapper from './FileExplorerWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/FileRow.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
index e8acb5e5..24f0be8c 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import FileRowWrapper from './__tests__/FileRowWrapper.svelte';
+import FileRowWrapper from './FileRowWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FolderRow.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/FolderRow.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/FolderRow.svelte.spec.ts
index 1b5d4a3d..c0fc22c5 100644
--- a/src/lib/components/storage/explorer/FolderRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FolderRow.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import FolderRowWrapper from './__tests__/FolderRowWrapper.svelte';
+import FolderRowWrapper from './FolderRowWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/ObjectTable.svelte.spec.ts
similarity index 98%
rename from src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/ObjectTable.svelte.spec.ts
index e3024235..a2c31542 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/ObjectTable.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import ObjectTableWrapper from './__tests__/ObjectTableWrapper.svelte';
+import ObjectTableWrapper from './ObjectTableWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
similarity index 98%
rename from src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
index e37f7750..ecb33bd2 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
@@ -2,7 +2,7 @@ import { page } from 'vitest/browser';
 import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { SvelteSet } from 'svelte/reactivity';
-import SelectionToolbarWrapper from './__tests__/SelectionToolbarWrapper.svelte';
+import SelectionToolbarWrapper from './SelectionToolbarWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
index 44e0a6d8..3bbffaaa 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
@@ -2,7 +2,7 @@ import { page } from 'vitest/browser';
 import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
-import StorageBreadcrumbWrapper from './__tests__/StorageBreadcrumbWrapper.svelte';
+import StorageBreadcrumbWrapper from './StorageBreadcrumbWrapper.svelte';
 import { StorageState } from '$lib/storage/state.svelte.js';
 import type { StorageObject } from '$lib/storage/types.js';
 
diff --git a/src/lib/components/storage/landing/RecentItems.svelte.spec.ts b/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
index a84e92cf..bba51986 100644
--- a/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
+++ b/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
@@ -11,7 +11,8 @@ function makeRecentFile(overrides: Partial<RecentFile> = {}): RecentFile {
     key: overrides.key ?? `folder/${faker.system.fileName()}`,
     bucket: overrides.bucket ?? 'test-bucket',
     size: overrides.size ?? faker.number.int({ min: 100, max: 1_000_000 }),
-    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString()
+    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString(),
+    connectionId: overrides.connectionId ?? 'test-conn-id'
   };
 }
 
@@ -19,7 +20,8 @@ function makeRecentLocation(overrides: Partial<RecentLocation> = {}): RecentLoca
   return {
     bucket: overrides.bucket ?? 'test-bucket',
     prefix: overrides.prefix ?? `${faker.word.noun()}/`,
-    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString()
+    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString(),
+    connectionId: overrides.connectionId ?? 'test-conn-id'
   };
 }
 
@@ -29,7 +31,11 @@ function createState(
     recentLocations?: RecentLocation[];
   } = {}
 ): StorageState {
-  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  const state = new StorageState({
+    connected: true,
+    buckets: ['test-bucket'],
+    connectionId: 'test-conn-id'
+  });
   state.bucket = 'test-bucket';
   state.prefix = '';
   if (opts.recentFiles) {
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte b/src/lib/components/storage/landing/StorageConnectForm.svelte
index 7341b8ef..af28cf7f 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte
@@ -3,21 +3,17 @@
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
   import { onMount, tick, untrack } from 'svelte';
-  import IconClose from 'virtual:icons/material-symbols/close';
-  import IconStorage from 'virtual:icons/material-symbols/storage';
   import * as m from '$lib/paraglide/messages.js';
   import { StorageConnectionSchema } from '$lib/storage/schemas.js';
   import {
     saveConnectionLocally,
     loadConnectionLocally,
-    loadAllConnectionsLocally,
-    removeConnectionLocally
+    type SavedConnection
   } from '$lib/storage/connection-storage.js';
   import { storageAutoConnectEnabled } from '$lib/client/feature-flags.js';
+  import StorageConnectionSidebar from '$lib/components/storage/sidebar/StorageConnectionSidebar.svelte';
   import type { z } from 'zod';
 
-  type StoredConnection = z.infer<typeof StorageConnectionSchema>;
-
   interface Props {
     connectionForm: SuperValidated<z.infer<typeof StorageConnectionSchema>, string>;
   }
@@ -28,15 +24,11 @@
 
   let formRef: HTMLFormElement | null = $state(null);
   let autoConnecting = $state(false);
-  let allConnections: StoredConnection[] = $state([]);
-  let connectionsLoaded = $state(false);
-
-  /** Connection pending the "Forget" confirmation. */
-  let forgetCandidate: StoredConnection | null = $state(null);
 
   const { form, errors, enhance, submitting, message } = superForm(
     untrack(() => connectionForm),
     {
+      dataType: 'json',
       validators: zod(StorageConnectionSchema),
       onResult: ({ result }) => {
         if (result.type === 'redirect') {
@@ -48,281 +40,246 @@
     }
   );
 
-  /** Display label for a saved connection (hostname or "AWS S3"). */
-  function connectionLabel(conn: StoredConnection): string {
-    if (conn.endpoint) {
-      try {
-        return new URL(conn.endpoint).hostname;
-      } catch {
-        return conn.endpoint;
-      }
-    }
-    return 'AWS S3';
-  }
-
-  /** Fill the form with a saved connection and immediately submit. */
-  function selectConnection(conn: StoredConnection) {
+  function selectConnection(conn: SavedConnection) {
+    $form.id = conn.id;
+    $form.name = conn.name ?? '';
     $form.type = conn.type;
-    $form.endpoint = conn.endpoint ?? '';
-    $form.pathStyle = conn.pathStyle ?? true;
+    $form.host = conn.host;
+    $form.port = conn.port;
+    $form.tls = conn.tls;
+    $form.accessStyle = conn.accessStyle;
     $form.region = conn.region;
-    $form.accessKeyId = conn.accessKeyId ?? '';
-    $form.secretAccessKey = conn.secretAccessKey ?? '';
+    $form.credentials = conn.credentials;
     tick().then(() => formRef?.requestSubmit());
   }
 
-  /** Forget a connection from local storage and refresh the list. */
-  function forgetConnection(conn: StoredConnection) {
-    removeConnectionLocally(conn);
-    allConnections = loadAllConnectionsLocally();
-    forgetCandidate = null;
+  function parseHostInput() {
+    const v = $form.host?.trim();
+    if (!v?.includes('://')) return;
+    try {
+      const url = new URL(v);
+      $form.host = url.hostname;
+      if (url.port) $form.port = Number(url.port);
+      $form.tls = url.protocol === 'https:' ? { verification: 'Full' } : undefined;
+    } catch {
+      // Not a parseable URL — leave unchanged
+    }
   }
 
   onMount(() => {
-    allConnections = loadAllConnectionsLocally();
-    connectionsLoaded = true;
     const params = new URLSearchParams(window.location.search);
     if (!storageAutoConnectEnabled || params.has('disconnected')) return;
     const saved = loadConnectionLocally();
     if (saved) {
       autoConnecting = true;
+      $form.id = saved.id;
       $form.type = saved.type;
-      $form.endpoint = saved.endpoint ?? '';
-      $form.pathStyle = saved.pathStyle ?? true;
+      $form.host = saved.host;
+      $form.port = saved.port;
+      $form.tls = saved.tls;
+      $form.accessStyle = saved.accessStyle;
       $form.region = saved.region;
-      $form.accessKeyId = saved.accessKeyId ?? '';
-      $form.secretAccessKey = saved.secretAccessKey ?? '';
+      $form.credentials = saved.credentials;
       tick().then(() => formRef?.requestSubmit());
     }
   });
 </script>
 
-<div class="mx-auto max-w-md p-6">
-  {#if autoConnecting}
-    <div class="flex flex-col items-center gap-3 py-8">
-      <span class="loading loading-spinner loading-md"></span>
-      <p class="text-base-content/60 text-sm">{m.storage_connect_reconnecting()}</p>
-    </div>
-  {/if}
+{#if autoConnecting}
+  <div class="flex flex-col items-center gap-3 py-8">
+    <span class="loading loading-spinner loading-md"></span>
+    <p class="text-base-content/60 text-sm">{m.storage_connect_reconnecting()}</p>
+  </div>
+{:else}
+  <div class="flex flex-col gap-4 md:flex-row md:items-start">
+    <StorageConnectionSidebar onselect={selectConnection} />
 
-  <div class:hidden={autoConnecting}>
-    <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
-    <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+    <div class="min-w-0 flex-1">
+      <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
+      <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
 
-    <div
-      class="mb-6 h-24 {connectionsLoaded && allConnections.length === 0
-        ? 'bg-base-200 flex items-center justify-center rounded-xl'
-        : ''}"
-    >
-      {#if !connectionsLoaded}
-        <div class="flex h-full items-center justify-center">
-          <span class="loading loading-spinner loading-sm text-base-content/40"></span>
+      <form
+        bind:this={formRef}
+        method="POST"
+        action="?/connect"
+        use:enhance
+        class="flex flex-col gap-4"
+      >
+        <div>
+          <label for="{uid}-type" class="label mb-1 text-sm font-medium">
+            {m.storage_connect_type()}
+          </label>
+          <select
+            id="{uid}-type"
+            name="type"
+            class="select-bordered select w-full"
+            bind:value={$form.type}
+          >
+            <option value="s3">{m.storage_connect_type_s3()}</option>
+            <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
+          </select>
         </div>
-      {:else if allConnections.length > 0}
-        <p class="text-base-content/50 mb-2 text-xs font-semibold tracking-wide uppercase">
-          {m.storage_connect_saved()}
-        </p>
-        <div
-          class="flex flex-nowrap gap-2 overflow-x-auto overflow-y-visible pt-2 pb-1"
-          role="list"
-          aria-label={m.storage_connect_saved()}
-        >
-          {#each allConnections as conn (conn.type + '|' + (conn.endpoint ?? '') + '|' + (conn.accessKeyId ?? ''))}
-            <div class="relative shrink-0" role="listitem">
-              <button
-                type="button"
-                onclick={() => selectConnection(conn)}
-                class="
-                  border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5
-                  focus-visible:outline-primary flex flex-col items-center gap-1.5 rounded-xl border
-                  p-3 text-center transition-colors
-                "
-                title={connectionLabel(conn)}
-              >
-                <IconStorage class="text-primary size-8" aria-hidden="true" />
-                <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
-              </button>
-              <button
-                type="button"
-                aria-label={m.storage_connect_forget_label({ endpoint: connectionLabel(conn) })}
-                onclick={(e) => {
-                  e.stopPropagation();
-                  forgetCandidate = conn;
-                }}
-                class="
-                  border-base-300 bg-base-100 text-error hover:bg-error hover:text-error-content
-                  absolute -top-2 -right-2 flex size-5 items-center justify-center
-                  rounded-full border shadow-sm transition-colors
-                "
-              >
-                <IconClose class="size-3" aria-hidden="true" />
-              </button>
-            </div>
-          {/each}
+
+        <div>
+          <label for="{uid}-host" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_host()}</label
+          >
+          <input
+            id="{uid}-host"
+            name="host"
+            type="text"
+            class={['input-bordered input w-full', $errors?.host && 'input-error']}
+            placeholder={m.storage_connect_host_placeholder()}
+            bind:value={$form.host}
+            onblur={parseHostInput}
+          />
+          {#if $errors?.host}
+            <p class="text-error mt-1 text-xs">{$errors.host}</p>
+          {/if}
         </div>
-      {:else}
-        <p class="text-base-content/50 text-sm">{m.storage_connect_no_saved()}</p>
-      {/if}
-    </div>
-  </div>
 
-  <form
-    bind:this={formRef}
-    method="POST"
-    action="?/connect"
-    use:enhance
-    class:hidden={autoConnecting}
-    class="
-    flex flex-col gap-4
-  "
-  >
-    <!-- Backend type -->
-    <div>
-      <label for="{uid}-type" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_type()}
-      </label>
-      <select
-        id="{uid}-type"
-        name="type"
-        class="select-bordered select w-full"
-        bind:value={$form.type}
-      >
-        <option value="s3">{m.storage_connect_type_s3()}</option>
-        <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
-      </select>
-    </div>
+        <div>
+          <label for="{uid}-port" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_port()}</label
+          >
+          <input
+            id="{uid}-port"
+            name="port"
+            type="number"
+            min="1"
+            max="65535"
+            class={['input-bordered input w-full', $errors?.port && 'input-error']}
+            placeholder={m.storage_connect_port_placeholder()}
+            bind:value={$form.port}
+          />
+          <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_port_hint()}</p>
+          {#if $errors?.port}
+            <p class="text-error mt-1 text-xs">{$errors.port}</p>
+          {/if}
+        </div>
 
-    <!-- Endpoint URL -->
-    <div>
-      <label for="{uid}-endpoint" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_endpoint()}
-      </label>
-      <input
-        id="{uid}-endpoint"
-        name="endpoint"
-        type="url"
-        class="
-          input-bordered input w-full
-          {$errors?.endpoint ? 'input-error' : ''}"
-        placeholder={m.storage_connect_endpoint_placeholder()}
-        bind:value={$form.endpoint}
-      />
-      <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_endpoint_hint()}</p>
-      {#if $errors?.endpoint}
-        <p class="text-error mt-1 text-xs">{$errors?.endpoint}</p>
-      {/if}
-    </div>
+        <div class="flex items-start justify-between gap-4">
+          <div>
+            <label for="{uid}-tls" class="label text-sm font-medium"
+              >{m.storage_connect_tls()}</label
+            >
+            <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_tls_hint()}</p>
+          </div>
+          <input
+            id="{uid}-tls"
+            type="checkbox"
+            class="toggle toggle-primary mt-1 shrink-0"
+            checked={!!$form.tls}
+            onchange={(e) => {
+              $form.tls = e.currentTarget.checked ? { verification: 'Full' } : undefined;
+            }}
+          />
+        </div>
 
-    <!-- Path-style addressing -->
-    <div class="flex items-start justify-between gap-4">
-      <div>
-        <label for="{uid}-path-style" class="label text-sm font-medium">
-          {m.storage_connect_path_style()}
-        </label>
-        <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_path_style_hint()}</p>
-      </div>
-      <input
-        id="{uid}-path-style"
-        name="pathStyle"
-        type="checkbox"
-        class="toggle toggle-primary mt-1 shrink-0"
-        bind:checked={$form.pathStyle}
-      />
-    </div>
+        {#if $form.tls}
+          <div class="flex items-start justify-between gap-4 pl-4">
+            <div>
+              <label for="{uid}-tls-verification" class="label text-sm font-medium">
+                {m.storage_connect_tls_verification()}
+              </label>
+              <p class="text-base-content/50 mt-0.5 text-xs">
+                {m.storage_connect_tls_verification_hint()}
+              </p>
+            </div>
+            <input
+              id="{uid}-tls-verification"
+              type="checkbox"
+              class="toggle toggle-primary mt-1 shrink-0"
+              checked={$form.tls.verification === 'Full'}
+              onchange={(e) => {
+                $form.tls = { verification: e.currentTarget.checked ? 'Full' : 'None' };
+              }}
+            />
+          </div>
+        {/if}
 
-    <!-- Region -->
-    <div>
-      <label for="{uid}-region" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_region()}
-      </label>
-      <input
-        id="{uid}-region"
-        name="region"
-        type="text"
-        class="
-          input-bordered input w-full
-          {$errors?.region ? 'input-error' : ''}"
-        bind:value={$form.region}
-      />
-      {#if $errors?.region}
-        <p class="text-error mt-1 text-xs">{$errors?.region}</p>
-      {/if}
-    </div>
+        <div>
+          <label for="{uid}-access-style" class="label mb-1 text-sm font-medium">
+            {m.storage_connect_access_style()}
+          </label>
+          <select
+            id="{uid}-access-style"
+            name="accessStyle"
+            class="select-bordered select w-full"
+            bind:value={$form.accessStyle}
+          >
+            <option value="Path">{m.storage_connect_access_style_path()}</option>
+            <option value="VirtualHosted">{m.storage_connect_access_style_virtual_hosted()}</option>
+          </select>
+        </div>
 
-    <!-- Access key ID -->
-    <div>
-      <label for="{uid}-access-key" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_access_key()}
-      </label>
-      <input
-        id="{uid}-access-key"
-        name="accessKeyId"
-        type="text"
-        class="
-          input-bordered input w-full
-          {$errors?.accessKeyId ? 'input-error' : ''}"
-        autocomplete="username"
-        bind:value={$form.accessKeyId}
-      />
-      {#if $errors?.accessKeyId}
-        <p class="text-error mt-1 text-xs">{$errors?.accessKeyId}</p>
-      {/if}
-    </div>
+        <div>
+          <label for="{uid}-region" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_region()}</label
+          >
+          <input
+            id="{uid}-region"
+            name="region.name"
+            type="text"
+            class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
+            bind:value={$form.region.name}
+          />
+          {#if $errors?.region?.name}
+            <p class="text-error mt-1 text-xs">{$errors.region.name}</p>
+          {/if}
+        </div>
 
-    <!-- Secret access key -->
-    <div>
-      <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_secret_key()}
-      </label>
-      <input
-        id="{uid}-secret-key"
-        name="secretAccessKey"
-        type="password"
-        class="
-          input-bordered input w-full
-          {$errors?.secretAccessKey ? `input-error` : ''}"
-        autocomplete="current-password"
-        bind:value={$form.secretAccessKey}
-      />
-      {#if $errors?.secretAccessKey}
-        <p class="text-error mt-1 text-xs">{$errors?.secretAccessKey}</p>
-      {/if}
-    </div>
+        <div>
+          <label for="{uid}-access-key" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_access_key()}</label
+          >
+          <input
+            id="{uid}-access-key"
+            name="credentials.accessKey"
+            type="text"
+            class={[
+              'input-bordered input w-full',
+              $errors?.credentials?.accessKey && 'input-error'
+            ]}
+            autocomplete="username"
+            bind:value={$form.credentials.accessKey}
+          />
+          {#if $errors?.credentials?.accessKey}
+            <p class="text-error mt-1 text-xs">{$errors.credentials.accessKey}</p>
+          {/if}
+        </div>
 
-    {#if $message}
-      <p class="text-error text-sm">{$message}</p>
-    {/if}
+        <div>
+          <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_secret_key()}</label
+          >
+          <input
+            id="{uid}-secret-key"
+            name="credentials.secretKey"
+            type="password"
+            class={[
+              'input-bordered input w-full',
+              $errors?.credentials?.secretKey && 'input-error'
+            ]}
+            autocomplete="current-password"
+            bind:value={$form.credentials.secretKey}
+          />
+          {#if $errors?.credentials?.secretKey}
+            <p class="text-error mt-1 text-xs">{$errors.credentials.secretKey}</p>
+          {/if}
+        </div>
 
-    <button type="submit" class="btn btn-primary" disabled={$submitting}>
-      {#if $submitting}
-        <span class="loading loading-sm loading-spinner"></span>
-      {/if}
-      {m.storage_connect_submit()}
-    </button>
-  </form>
-</div>
+        {#if $message}
+          <p class="text-error text-sm">{$message}</p>
+        {/if}
 
-{#if forgetCandidate}
-  <dialog open class="modal modal-open">
-    <div class="modal-box">
-      <p class="text-base-content font-medium">
-        {m.storage_connect_forget_confirm({ endpoint: connectionLabel(forgetCandidate) })}
-      </p>
-      <div class="modal-action">
-        <button type="button" class="btn btn-ghost btn-sm" onclick={() => (forgetCandidate = null)}>
-          {m.storage_connect_forget_cancel()}
-        </button>
-        <button
-          type="button"
-          class="btn btn-error btn-sm"
-          onclick={() => forgetConnection(forgetCandidate!)}
-        >
-          {m.storage_connect_forget()}
+        <button type="submit" class="btn btn-primary" disabled={$submitting}>
+          {#if $submitting}
+            <span class="loading loading-sm loading-spinner"></span>
+          {/if}
+          {m.storage_connect_submit()}
         </button>
-      </div>
+      </form>
     </div>
-    <form method="dialog" class="modal-backdrop">
-      <button onclick={() => (forgetCandidate = null)}>close</button>
-    </form>
-  </dialog>
+  </div>
 {/if}
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
index 26cd521e..3655e81f 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
@@ -1,12 +1,29 @@
 import { page } from 'vitest/browser';
 import { describe, expect, it, vi, beforeEach } from 'vitest';
 import { render } from 'vitest-browser-svelte';
-import { faker } from '@faker-js/faker';
 import type { ComponentProps } from 'svelte';
 import StorageConnectForm from './StorageConnectForm.svelte';
+import type { SavedConnection } from '$lib/storage/connection-storage.js';
 
 type ConnectionFormProp = ComponentProps<typeof StorageConnectForm>['connectionForm'];
 
+/** Build a minimal StoredConnection fixture with a stable UUID. */
+function makeConn(
+  overrides: Partial<Omit<SavedConnection, 'id'>> & { id?: string } = {}
+): SavedConnection {
+  return {
+    id: overrides.id ?? '00000000-0000-0000-0000-000000000001',
+    type: 's3',
+    host: 'minio.example.com',
+    port: undefined,
+    tls: { verification: 'Full' },
+    accessStyle: 'Path',
+    region: { name: 'us-east-1' },
+    credentials: { accessKey: '', secretKey: '' },
+    ...overrides
+  } as SavedConnection;
+}
+
 // Mock feature flags to disable auto-connect
 vi.mock('$lib/client/feature-flags.js', () => ({
   storageAutoConnectEnabled: false
@@ -17,7 +34,10 @@ vi.mock('$lib/storage/connection-storage.js', () => ({
   saveConnectionLocally: vi.fn(),
   loadConnectionLocally: vi.fn(() => null),
   loadAllConnectionsLocally: vi.fn(() => []),
-  removeConnectionLocally: vi.fn()
+  removeConnectionLocally: vi.fn(),
+  updateConnectionLocally: vi.fn(),
+  removeConnectionById: vi.fn(),
+  loadConnectionById: vi.fn(() => null)
 }));
 
 // Mock paraglide messages
@@ -30,41 +50,64 @@ vi.mock('$lib/paraglide/messages.js', () => ({
   storage_connect_type: () => 'Backend type',
   storage_connect_type_s3: () => 'Amazon S3',
   storage_connect_type_hdfs: () => 'HDFS',
-  storage_connect_endpoint: () => 'Endpoint URL',
-  storage_connect_endpoint_placeholder: () => 'https://s3.example.com',
-  storage_connect_endpoint_hint: () => 'Leave empty for AWS S3',
-  storage_connect_path_style: () => 'Path-style addressing',
-  storage_connect_path_style_hint: () => 'Use path-style URLs',
+  storage_connect_host: () => 'Host',
+  storage_connect_host_placeholder: () => 'minio.example.com',
+  storage_connect_port: () => 'Port',
+  storage_connect_port_placeholder: () => '9000',
+  storage_connect_port_hint: () => 'Leave blank for default port',
+  storage_connect_tls: () => 'Use TLS',
+  storage_connect_tls_hint: () => 'Encrypt with TLS/HTTPS',
+  storage_connect_tls_verification: () => 'Verify certificate',
+  storage_connect_tls_verification_hint: () => 'Disable for self-signed certificates',
+  storage_connect_access_style: () => 'Access style',
+  storage_connect_access_style_path: () => 'Path',
+  storage_connect_access_style_virtual_hosted: () => 'Virtual hosted',
   storage_connect_region: () => 'Region',
-  storage_connect_access_key: () => 'Access key ID',
-  storage_connect_secret_key: () => 'Secret access key',
+  storage_connect_access_key: () => 'Access key',
+  storage_connect_secret_key: () => 'Secret key',
   storage_connect_submit: () => 'Connect',
   storage_connect_forget_label: ({ endpoint }: { endpoint: string }) => `Forget ${endpoint}`,
   storage_connect_forget_confirm: ({ endpoint }: { endpoint: string }) =>
     `Forget connection to ${endpoint}?`,
   storage_connect_forget_cancel: () => 'Cancel',
-  storage_connect_forget: () => 'Forget'
+  storage_connect_forget: () => 'Forget',
+  storage_connect_manage: () => 'Manage connections',
+  storage_connect_edit: () => 'Edit',
+  storage_more_options: () => 'More options',
+  storage_sidebar_resize_handle: () => 'Resize sidebar',
+  storage_connections_delete_confirm: ({ label }: { label: string }) =>
+    `Delete connection to ${label}?`,
+  storage_connections_delete_cancel: () => 'Cancel',
+  storage_connections_delete_confirm_button: () => 'Delete',
+  storage_connect_copy: () => 'Copy',
+  storage_connect_copied: () => 'Copied',
+  storage_connect_copy_all: () => 'Copy all'
 }));
 
+const defaultFormData = {
+  id: '00000000-0000-0000-0000-000000000001',
+  type: 's3' as const,
+  host: '',
+  port: undefined,
+  tls: { verification: 'Full' as const },
+  accessStyle: 'VirtualHosted' as const,
+  region: { name: 'us-east-1' },
+  credentials: { accessKey: '', secretKey: '' }
+};
+
 function createMockForm(overrides: Record<string, unknown> = {}): ConnectionFormProp {
+  const { data: dataOverride, ...restOverrides } = overrides;
   return {
     valid: true,
     posted: false,
     errors: {},
-    data: {
-      type: 's3' as const,
-      endpoint: '',
-      pathStyle: true,
-      region: 'eu-central-1',
-      accessKeyId: '',
-      secretAccessKey: ''
-    },
+    data: { ...defaultFormData, ...((dataOverride as object) ?? {}) },
     id: 'test-form',
     constraints: {},
     shape: {},
     message: undefined,
     tainted: undefined,
-    ...overrides
+    ...restOverrides
   } as unknown as ConnectionFormProp;
 }
 
@@ -84,11 +127,13 @@ describe('StorageConnectForm', () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
     await expect.element(page.getByLabelText('Backend type')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Endpoint URL')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Path-style addressing')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Host')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Port')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Use TLS')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Access style')).toBeInTheDocument();
     await expect.element(page.getByLabelText('Region')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Access key ID')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Secret access key')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Access key')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Secret key')).toBeInTheDocument();
   });
 
   it('should render backend type as a select with S3 option', async () => {
@@ -100,24 +145,47 @@ describe('StorageConnectForm', () => {
     await expect.element(page.getByText('HDFS')).toBeInTheDocument();
   });
 
-  it('should render endpoint as url input', async () => {
+  it('should render host as text input', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const input = page.getByLabelText('Host');
+    await expect.element(input).toHaveAttribute('type', 'text');
+  });
+
+  it('should render port as number input', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    const input = page.getByLabelText('Endpoint URL');
-    await expect.element(input).toHaveAttribute('type', 'url');
+    const input = page.getByLabelText('Port');
+    await expect.element(input).toHaveAttribute('type', 'number');
   });
 
-  it('should render path-style as a checkbox', async () => {
+  it('should render TLS as a checkbox toggle', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    const toggle = page.getByLabelText('Path-style addressing');
+    const toggle = page.getByLabelText('Use TLS');
     await expect.element(toggle).toHaveAttribute('type', 'checkbox');
   });
 
-  it('should render secret access key as password input', async () => {
+  it('should show verify certificate toggle when TLS is enabled', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({ data: { tls: { verification: 'Full' } } })
+    });
+
+    await expect.element(page.getByLabelText('Verify certificate')).toBeInTheDocument();
+  });
+
+  it('should hide verify certificate toggle when TLS is disabled', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({ data: { tls: undefined } })
+    });
+
+    await expect.element(page.getByLabelText('Verify certificate')).not.toBeInTheDocument();
+  });
+
+  it('should render secret key as password input', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    const input = page.getByLabelText('Secret access key');
+    const input = page.getByLabelText('Secret key');
     await expect.element(input).toHaveAttribute('type', 'password');
   });
 
@@ -136,32 +204,27 @@ describe('StorageConnectForm', () => {
   it('should show saved connections when present', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://minio.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: 'AKIA123',
-        secretAccessKey: 'secret'
-      }
+      makeConn({
+        host: 'minio.example.com',
+        port: 9000,
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'AKIA123', secretKey: 'secret' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('minio.example.com')).toBeInTheDocument();
+    await expect.element(page.getByText('minio.example.com:9000').first()).toBeInTheDocument();
   });
 
   it('should show forget button for saved connections', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.test.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000011',
+        host: 's3.test.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
@@ -174,14 +237,11 @@ describe('StorageConnectForm', () => {
   it('should open forget confirmation dialog when forget button clicked', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.remove.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000012',
+        host: 's3.remove.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
@@ -189,72 +249,66 @@ describe('StorageConnectForm', () => {
     const forgetBtn = page.getByRole('button', { name: 'Forget s3.remove.io' });
     await forgetBtn.click();
 
-    await expect.element(page.getByText('Forget connection to s3.remove.io?')).toBeInTheDocument();
+    await expect
+      .element(page.getByText('Delete connection to s3.remove.io?').first())
+      .toBeInTheDocument();
     await expect.element(page.getByRole('button', { name: 'Cancel' })).toBeInTheDocument();
     await expect
-      .element(page.getByRole('button', { name: 'Forget', exact: true }))
+      .element(page.getByRole('button', { name: 'Delete', exact: true }))
       .toBeInTheDocument();
   });
 
   it('should show multiple saved connections', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://first.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      },
-      {
-        type: 's3',
-        endpoint: 'https://second.example.com',
-        pathStyle: false,
-        region: 'eu-west-1',
-        accessKeyId: faker.string.alphanumeric(20),
-        secretAccessKey: faker.string.alphanumeric(40)
-      },
-      {
-        type: 's3',
-        endpoint: '',
-        pathStyle: false,
-        region: 'us-west-2',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000013',
+        host: 'first.example.com',
+        region: { name: 'us-east-1' }
+      }),
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000014',
+        host: 'second.example.com',
+        port: 9000,
+        accessStyle: 'VirtualHosted',
+        region: { name: 'eu-west-1' },
+        credentials: { accessKey: 'KEY', secretKey: 'SECRET' }
+      }),
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000015',
+        name: 'Production',
+        host: 'prod.example.com',
+        region: { name: 'us-west-2' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('first.example.com')).toBeInTheDocument();
-    await expect.element(page.getByText('second.example.com')).toBeInTheDocument();
-    await expect.element(page.getByText('AWS S3', { exact: true })).toBeInTheDocument();
+    await expect.element(page.getByText('first.example.com').first()).toBeInTheDocument();
+    await expect.element(page.getByText('second.example.com:9000').first()).toBeInTheDocument();
+    await expect.element(page.getByText('Production', { exact: true }).first()).toBeInTheDocument();
   });
 
   it('should render saved connections in a list role', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://listed.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000016',
+        host: 'listed.example.com',
+        region: { name: 'us-east-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByRole('list')).toBeInTheDocument();
-    await expect.element(page.getByRole('listitem')).toBeInTheDocument();
+    await expect.element(page.getByRole('list').first()).toBeInTheDocument();
+    await expect.element(page.getByRole('listitem').first()).toBeInTheDocument();
   });
 
-  it('should render endpoint hint text', async () => {
+  it('should render port hint text', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('Leave empty for AWS S3')).toBeInTheDocument();
+    await expect.element(page.getByText('Leave blank for default port')).toBeInTheDocument();
   });
 
   it('should render form with POST method', async () => {
@@ -267,38 +321,34 @@ describe('StorageConnectForm', () => {
   it('should close forget dialog when cancel is clicked', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.cancel.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000017',
+        host: 's3.cancel.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
     await page.getByRole('button', { name: 'Forget s3.cancel.io' }).click();
-    await expect.element(page.getByText('Forget connection to s3.cancel.io?')).toBeInTheDocument();
+    await expect
+      .element(page.getByText('Delete connection to s3.cancel.io?').first())
+      .toBeInTheDocument();
 
     await page.getByRole('button', { name: 'Cancel', exact: true }).click();
     await expect
-      .element(page.getByText('Forget connection to s3.cancel.io?'))
+      .element(page.getByText('Delete connection to s3.cancel.io?'))
       .not.toBeInTheDocument();
   });
 
   it('should remove connection when forget is confirmed', async () => {
     const { loadAllConnectionsLocally, removeConnectionLocally } =
       await import('$lib/storage/connection-storage.js');
-    const conn = {
-      type: 's3' as const,
-      endpoint: 'https://s3.forget.io',
-      pathStyle: true,
-      region: 'eu-west-1',
-      accessKeyId: '',
-      secretAccessKey: ''
-    };
+    const conn = makeConn({
+      id: '00000000-0000-0000-0000-000000000018',
+      host: 's3.forget.io',
+      region: { name: 'eu-west-1' }
+    });
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([conn]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
@@ -306,57 +356,21 @@ describe('StorageConnectForm', () => {
     await page.getByRole('button', { name: 'Forget s3.forget.io' }).click();
     // After clicking forget, mock returns empty list
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([]);
-    await page.getByRole('button', { name: 'Forget', exact: true }).click();
+    await page.getByRole('button', { name: 'Delete', exact: true }).click();
 
     expect(removeConnectionLocally).toHaveBeenCalledWith(conn);
     await expect.element(page.getByText('No saved connections yet')).toBeInTheDocument();
   });
 
-  it('should show connection label with invalid URL as raw endpoint', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'not-a-valid-url',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect.element(page.getByText('not-a-valid-url')).toBeInTheDocument();
-  });
-
-  it('should show AWS S3 label when endpoint is undefined', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: undefined,
-        pathStyle: false,
-        region: 'us-west-2',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect.element(page.getByText('AWS S3', { exact: true })).toBeInTheDocument();
-  });
-
-  it('should display endpoint error when form has endpoint errors', async () => {
+  it('should display host error when form has host errors', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
-        errors: { endpoint: ['Must be a valid URL'] }
+        errors: { host: ['Host is required'] }
       })
     });
 
-    await expect.element(page.getByText('Must be a valid URL')).toBeInTheDocument();
-    const input = page.getByLabelText('Endpoint URL');
+    await expect.element(page.getByText('Host is required')).toBeInTheDocument();
+    const input = page.getByLabelText('Host');
     const classes = input.element().className;
     expect(classes).toContain('input-error');
   });
@@ -364,42 +378,44 @@ describe('StorageConnectForm', () => {
   it('should display region error when form has region errors', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
-        errors: { region: ['Region is required'] }
+        errors: { region: { name: ['Region name is required'] } }
       })
     });
 
-    await expect.element(page.getByText('Region is required')).toBeInTheDocument();
+    await expect.element(page.getByText('Region name is required')).toBeInTheDocument();
     const input = page.getByLabelText('Region');
     expect(input.element().className).toContain('input-error');
   });
 
-  it('should display accessKeyId error', async () => {
+  it('should display access key error', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
-        errors: { accessKeyId: ['Access key ID is required when secret access key is provided'] }
+        errors: {
+          credentials: { accessKey: ['Access key is required when secret key is provided'] }
+        }
       })
     });
 
     await expect
-      .element(page.getByText('Access key ID is required when secret access key is provided'))
+      .element(page.getByText('Access key is required when secret key is provided'))
       .toBeInTheDocument();
-    const input = page.getByLabelText('Access key ID');
+    const input = page.getByLabelText('Access key');
     expect(input.element().className).toContain('input-error');
   });
 
-  it('should display secretAccessKey error', async () => {
+  it('should display secret key error', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
         errors: {
-          secretAccessKey: ['Secret access key is required when access key ID is provided']
+          credentials: { secretKey: ['Secret key is required when access key is provided'] }
         }
       })
     });
 
     await expect
-      .element(page.getByText('Secret access key is required when access key ID is provided'))
+      .element(page.getByText('Secret key is required when access key is provided'))
       .toBeInTheDocument();
-    const input = page.getByLabelText('Secret access key');
+    const input = page.getByLabelText('Secret key');
     expect(input.element().className).toContain('input-error');
   });
 
@@ -418,90 +434,86 @@ describe('StorageConnectForm', () => {
   it('should fill form fields when a saved connection is clicked', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.select.io',
-        pathStyle: false,
-        region: 'ap-southeast-1',
-        accessKeyId: 'AKIASELECT',
-        secretAccessKey: 'secretselect'
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000021',
+        host: 's3.select.io',
+        port: 9000,
+        accessStyle: 'VirtualHosted',
+        region: { name: 'ap-southeast-1' },
+        credentials: { accessKey: 'AKIASELECT', secretKey: 'secretselect' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    // Click the saved connection button
-    await page.getByRole('button', { name: 's3.select.io', exact: true }).click();
+    // Click the saved connection button (first match — mobile card)
+    await page.getByRole('button', { name: 's3.select.io:9000', exact: true }).first().click();
 
     // Verify form fields are filled
-    await expect.element(page.getByLabelText('Endpoint URL')).toHaveValue('https://s3.select.io');
+    await expect.element(page.getByLabelText('Host')).toHaveValue('s3.select.io');
     await expect.element(page.getByLabelText('Region')).toHaveValue('ap-southeast-1');
-    await expect.element(page.getByLabelText('Access key ID')).toHaveValue('AKIASELECT');
-    await expect.element(page.getByLabelText('Secret access key')).toHaveValue('secretselect');
+    await expect.element(page.getByLabelText('Access key')).toHaveValue('AKIASELECT');
+    await expect.element(page.getByLabelText('Secret key')).toHaveValue('secretselect');
   });
 
   it('should show saved connections heading when connections exist', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://heading.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000022',
+        host: 'heading.example.com',
+        region: { name: 'us-east-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('Saved connections')).toBeInTheDocument();
+    await expect.element(page.getByText('Saved connections').first()).toBeInTheDocument();
   });
 
   it('should display multiple field errors simultaneously', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
         errors: {
-          endpoint: ['Must be a valid URL'],
-          region: ['Region is required'],
-          accessKeyId: ['Access key required'],
-          secretAccessKey: ['Secret key required']
+          host: ['Host is required'],
+          region: { name: ['Region name is required'] },
+          credentials: {
+            accessKey: ['Access key required'],
+            secretKey: ['Secret key required']
+          }
         },
         message: 'Validation failed'
       })
     });
 
-    await expect.element(page.getByText('Must be a valid URL')).toBeInTheDocument();
-    await expect.element(page.getByText('Region is required')).toBeInTheDocument();
+    await expect.element(page.getByText('Host is required')).toBeInTheDocument();
+    await expect.element(page.getByText('Region name is required')).toBeInTheDocument();
     await expect.element(page.getByText('Access key required')).toBeInTheDocument();
     await expect.element(page.getByText('Secret key required')).toBeInTheDocument();
     await expect.element(page.getByText('Validation failed')).toBeInTheDocument();
   });
 
-  it('should close forget dialog via backdrop button', async () => {
+  it('should close forget dialog via cancel button', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.backdrop.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000023',
+        host: 's3.backdrop.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
     await page.getByRole('button', { name: 'Forget s3.backdrop.io' }).click();
     await expect
-      .element(page.getByText('Forget connection to s3.backdrop.io?'))
+      .element(page.getByText('Delete connection to s3.backdrop.io?').first())
       .toBeInTheDocument();
 
-    // Click the backdrop close button
-    await page.getByRole('button', { name: 'close' }).click();
+    // Close the dialog by clicking Cancel
+    await page.getByRole('button', { name: 'Cancel', exact: true }).click();
     await expect
-      .element(page.getByText('Forget connection to s3.backdrop.io?'))
+      .element(page.getByText('Delete connection to s3.backdrop.io?'))
       .not.toBeInTheDocument();
   });
 });
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index c6b35e9c..5a1de726 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-  import { browser } from '$app/environment';
   import { page } from '$app/state';
   import { resolve } from '$app/paths';
   import { beforeNavigate } from '$app/navigation';
@@ -15,89 +14,19 @@
   import { getStorageState } from '$lib/storage/context.js';
   import type { PinnedLocation, StorageLocation } from '$lib/storage/types.js';
   import { pinnedLabel, pinnedHref } from '$lib/storage/display-helpers.js';
+  import { createResizablePanel } from './resizable-panel.svelte.js';
+  import ResizeHandle from './ResizeHandle.svelte';
 
   const storage = getStorageState();
 
-  // ── Resizable sidebar ─────────────────────────────────────────────────────
-  const SIDEBAR_WIDTH_KEY = 'storage_sidebar_width';
-  const DEFAULT_WIDTH = 192; // matches previous w-48
-  const MIN_WIDTH = 120;
-  const MAX_WIDTH = 480;
-
-  function getInitialWidth(): number {
-    if (!browser) return DEFAULT_WIDTH;
-    try {
-      const stored = localStorage.getItem(SIDEBAR_WIDTH_KEY);
-      if (stored) {
-        const parsed = parseInt(stored, 10);
-        if (!isNaN(parsed) && parsed >= MIN_WIDTH && parsed <= MAX_WIDTH) return parsed;
-      }
-    } catch {
-      /* ignore storage errors */
-    }
-    return DEFAULT_WIDTH;
-  }
-
-  function saveWidth(width: number) {
-    try {
-      localStorage.setItem(SIDEBAR_WIDTH_KEY, String(width));
-    } catch {
-      /* ignore storage errors */
-    }
-  }
-
-  let sidebarWidth = $state(getInitialWidth());
-  let isDragging = $state(false);
-  let dragStartX = 0;
-  let dragStartWidth = 0;
-
-  function onResizeStart(e: PointerEvent) {
-    isDragging = true;
-    dragStartX = e.clientX;
-    dragStartWidth = sidebarWidth;
-    (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId);
-    e.preventDefault();
-  }
-
-  function onResizeMove(e: PointerEvent) {
-    if (!isDragging) return;
-    const delta = e.clientX - dragStartX;
-    sidebarWidth = Math.min(MAX_WIDTH, Math.max(MIN_WIDTH, dragStartWidth + delta));
-  }
-
-  function onResizeEnd() {
-    if (!isDragging) return;
-    isDragging = false;
-    saveWidth(sidebarWidth);
-  }
-
-  function onResizeKeydown(e: KeyboardEvent) {
-    const step = e.shiftKey ? 20 : 4;
-    if (e.key === 'ArrowRight') {
-      sidebarWidth = Math.min(MAX_WIDTH, sidebarWidth + step);
-      saveWidth(sidebarWidth);
-      e.preventDefault();
-    } else if (e.key === 'ArrowLeft') {
-      sidebarWidth = Math.max(MIN_WIDTH, sidebarWidth - step);
-      saveWidth(sidebarWidth);
-      e.preventDefault();
-    }
-  }
-
-  // Keep the col-resize cursor active across the whole page while dragging so
-  // it doesn't flicker when the pointer moves faster than the DOM updates.
-  $effect(() => {
-    if (!browser) return;
-    if (isDragging) {
-      document.body.style.cursor = 'col-resize';
-      document.body.style.userSelect = 'none';
-    } else {
-      document.body.style.cursor = '';
-      document.body.style.userSelect = '';
-    }
+  const resize = createResizablePanel({
+    storageKey: 'storage_sidebar_width',
+    defaultWidth: 192,
+    minWidth: 120,
+    maxWidth: 480
   });
 
-  // ── Disconnect confirmation ───────────────────────────────────────────────
+  // ── Disconnect confirmation ──────────────────────────────────────────────
   let disconnectConfirmOpen = $state(false);
   let disconnectForm = $state<HTMLFormElement | null>(null);
 
@@ -207,7 +136,7 @@
     border-base-300 bg-base-100 relative flex shrink-0 flex-col
     rounded-lg border
   "
-  style="width: {sidebarWidth}px"
+  style="width: {resize.width}px"
   aria-label={m.storage_buckets_label()}
 >
   <!-- Pinned Access section -->
@@ -222,7 +151,10 @@
         {#each storage.bookmarks.pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
           {@const active = isPinnedActive(pin)}
           <li role="none" class="group relative">
-            <div class="tooltip tooltip-right relative z-30 w-full" data-tip={pinnedLabel(pin)}>
+            <div
+              class="tooltip tooltip-right relative z-150 w-full before:z-200"
+              data-tip={pinnedLabel(pin)}
+            >
               <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <a
                 href={pinnedHref(pin)}
@@ -244,7 +176,7 @@
             </div>
             <button
               class="
-                btn btn-ghost btn-xs absolute top-1/2 right-1 z-60 -translate-y-1/2
+                btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
                 p-0 opacity-0 transition-opacity
                 group-hover:opacity-100 focus:opacity-100
               "
@@ -275,7 +207,7 @@
     <a
       href={resolve('/storage')}
       data-sveltekit-preload-data="off"
-      class="btn btn-ghost btn-xs group tooltip tooltip-right z-60"
+      class="btn btn-ghost btn-xs group tooltip tooltip-right z-150 before:z-200"
       title={m.storage_view_all_buckets()}
       data-tip={m.storage_view_all_buckets()}
     >
@@ -301,8 +233,8 @@
             })}
             data-sveltekit-preload-data="off"
             class="
-              hover:bg-base-200 tooltip tooltip-right flex items-center gap-2
-              px-3 py-1.5 text-sm
+              hover:bg-base-200 tooltip tooltip-right flex items-center gap-2 px-3
+              py-1.5 text-sm before:z-200
               {activeBucket === bucket
               ? 'bg-primary/10 text-primary font-medium'
               : 'text-base-content'}"
@@ -352,34 +284,5 @@
     </div>
   </Modal>
 
-  <!-- Drag-to-resize handle -->
-  <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-  <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
-  <div
-    role="separator"
-    aria-orientation="vertical"
-    aria-label={m.storage_sidebar_resize_handle()}
-    aria-valuenow={sidebarWidth}
-    aria-valuemin={MIN_WIDTH}
-    aria-valuemax={MAX_WIDTH}
-    tabindex="0"
-    class="
-      focus-visible:outline-primary/50 absolute inset-y-0 -right-2 z-10 w-4 cursor-col-resize
-      touch-none rounded-r-lg
-      select-none focus-visible:outline-2 focus-visible:outline-offset-0
-    "
-    onpointerdown={onResizeStart}
-    onpointermove={onResizeMove}
-    onpointerup={onResizeEnd}
-    onpointercancel={onResizeEnd}
-    onkeydown={onResizeKeydown}
-  >
-    <div
-      class="
-        absolute inset-y-2 left-1/2 w-0.5 -translate-x-1/2 rounded-full
-        transition-colors duration-100
-        {isDragging ? 'bg-primary' : 'bg-base-300 hover:bg-primary/50'}
-      "
-    ></div>
-  </div>
+  <ResizeHandle panel={resize} />
 </nav>
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
index f880a727..877a2398 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
+++ b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
@@ -6,16 +6,16 @@ import { userEvent } from 'vitest/browser';
 import BucketListWrapper from './__tests__/BucketListWrapper.svelte';
 import { setPageState, resetPageState } from './__tests__/page-helper.svelte.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
-import type { PinnedLocation } from '$lib/storage/types.js';
+import type { StorageLocation } from '$lib/storage/types.js';
 
 function createState(
   opts: {
     buckets?: string[];
-    pinned?: PinnedLocation[];
+    pinned?: StorageLocation[];
   } = {}
 ): StorageState {
   const buckets = opts.buckets ?? [];
-  const state = new StorageState({ connected: true, buckets });
+  const state = new StorageState({ connected: true, buckets, connectionId: 'test-conn-id' });
   state.bucket = buckets[0] ?? '';
   state.prefix = '';
   if (opts.pinned) {
@@ -272,8 +272,8 @@ describe('BucketList', () => {
       await moreButton.click();
       await expect.element(page.getByRole('menuitem', { name: /unpin/i })).toBeInTheDocument();
 
-      const nav = page.getByRole('navigation');
-      await nav.first().click();
+      // Click on a non-link part of the nav (the heading) to trigger the outside-click handler
+      await page.getByText('Buckets').click();
 
       await expect.element(page.getByRole('menuitem', { name: /unpin/i })).not.toBeInTheDocument();
     });
diff --git a/src/lib/components/storage/sidebar/ResizeHandle.svelte b/src/lib/components/storage/sidebar/ResizeHandle.svelte
new file mode 100644
index 00000000..325e0440
--- /dev/null
+++ b/src/lib/components/storage/sidebar/ResizeHandle.svelte
@@ -0,0 +1,34 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import type { ResizablePanel } from './resizable-panel.svelte.js';
+
+  interface Props {
+    panel: ResizablePanel;
+  }
+
+  let { panel }: Props = $props();
+</script>
+
+<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
+<!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+<div
+  role="separator"
+  aria-orientation="vertical"
+  aria-label={m.storage_sidebar_resize_handle()}
+  aria-valuenow={panel.width}
+  aria-valuemin={panel.minWidth}
+  aria-valuemax={panel.maxWidth}
+  tabindex="0"
+  class="group focus-visible:outline-primary/50 absolute inset-y-0 -right-2 z-10 w-4 cursor-col-resize touch-none rounded-r-lg select-none focus-visible:outline-2 focus-visible:outline-offset-0"
+  onpointerdown={panel.onResizeStart}
+  onpointermove={panel.onResizeMove}
+  onpointerup={panel.onResizeEnd}
+  onpointercancel={panel.onResizeEnd}
+  onkeydown={panel.onResizeKeydown}
+>
+  <div
+    class="group-hover:bg-primary/70 absolute inset-y-2 left-1/2 w-0.5 -translate-x-1/2 rounded-full transition-colors duration-100"
+    class:bg-primary={panel.isDragging}
+    class:bg-base-300={!panel.isDragging}
+  ></div>
+</div>
diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
new file mode 100644
index 00000000..10080e85
--- /dev/null
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -0,0 +1,281 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import IconEdit from 'virtual:icons/material-symbols/edit';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import DeleteConnectionModal from '$lib/components/storage/DeleteConnectionModal.svelte';
+  import { createResizablePanel } from './resizable-panel.svelte.js';
+  import ResizeHandle from './ResizeHandle.svelte';
+  import { resolve } from '$app/paths';
+  import * as m from '$lib/paraglide/messages.js';
+  import {
+    loadAllConnectionsLocally,
+    removeConnectionLocally,
+    type SavedConnection
+  } from '$lib/storage/connection-storage.js';
+
+  interface Props {
+    /** ID of the connection currently being acted on (highlighted in the list). */
+    activeId?: string;
+    /** Called when the user clicks a connection row. */
+    onselect: (conn: SavedConnection) => void;
+  }
+
+  let { activeId, onselect }: Props = $props();
+
+  let allConnections: SavedConnection[] = $state([]);
+  let connectionsLoaded = $state(false);
+  let forgetCandidate: SavedConnection | null = $state(null);
+  let forgetOpen = $state(false);
+
+  const resize = createResizablePanel({
+    storageKey: 'storage_connect_sidebar_width',
+    defaultWidth: 224,
+    minWidth: 140,
+    maxWidth: 400
+  });
+  let menuConn: SavedConnection | null = $state(null);
+  let menuEl: HTMLUListElement | null = $state(null);
+  let menuRawPos = $state({ left: 0, top: 0 });
+  const menuPos = $derived.by(() => {
+    if (!menuConn) return { left: 0, top: 0 };
+    if (!menuEl) return menuRawPos;
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left:
+        menuRawPos.left + rect.width > window.innerWidth
+          ? menuRawPos.left - rect.width
+          : menuRawPos.left,
+      top:
+        menuRawPos.top + rect.height > window.innerHeight
+          ? menuRawPos.top - rect.height
+          : menuRawPos.top
+    };
+  });
+
+  function connectionLabel(conn: SavedConnection): string {
+    if (conn.name) return conn.name;
+    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+  }
+
+  function openContextMenu(e: MouseEvent, conn: SavedConnection) {
+    e.preventDefault();
+    e.stopPropagation();
+    const btnRect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    menuRawPos = { left: btnRect.right, top: btnRect.bottom };
+    menuConn = conn;
+  }
+
+  function closeContextMenu() {
+    menuConn = null;
+  }
+
+  function handleOutsideClick(e: MouseEvent) {
+    if (menuConn && menuEl && !menuEl.contains(e.target as Node)) closeContextMenu();
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (menuConn && e.key === 'Escape') closeContextMenu();
+  }
+
+  function openForgetConfirm(conn: SavedConnection) {
+    forgetCandidate = conn;
+    forgetOpen = true;
+  }
+
+  function forgetConnection() {
+    if (!forgetCandidate) return;
+    removeConnectionLocally(forgetCandidate);
+    allConnections = loadAllConnectionsLocally();
+    forgetCandidate = null;
+    forgetOpen = false;
+  }
+
+  onMount(() => {
+    allConnections = loadAllConnectionsLocally();
+    connectionsLoaded = true;
+  });
+</script>
+
+<svelte:document onclick={handleOutsideClick} />
+<svelte:window onkeydown={handleKeydown} />
+
+<!-- Context menu (fixed, rendered outside the layout flow) -->
+{#if menuConn}
+  <ul
+    bind:this={menuEl}
+    class="
+      menu menu-sm border-base-300 bg-base-100 fixed z-150 w-48 rounded-lg
+      border p-1 shadow-lg
+    "
+    role="menu"
+    tabindex="-1"
+    style="left: {menuPos.left}px; top: {menuPos.top}px;"
+  >
+    <li role="none">
+      <a
+        href={resolve(`/storage/connections/${menuConn.id}/edit`)}
+        role="menuitem"
+        onclick={closeContextMenu}
+        class="justify-start"
+      >
+        <IconEdit class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connect_edit()}
+      </a>
+    </li>
+    <li role="none">
+      <button
+        type="button"
+        role="menuitem"
+        class="text-error justify-start"
+        onclick={() => {
+          openForgetConfirm(menuConn!);
+          closeContextMenu();
+        }}
+      >
+        <IconClose class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connect_forget()}
+      </button>
+    </li>
+  </ul>
+{/if}
+
+<!-- Mobile: horizontal scrollable connections row -->
+<div class="md:hidden">
+  {#if connectionsLoaded && allConnections.length > 0}
+    <p class="text-base-content/50 mb-2 text-xs font-semibold tracking-wide uppercase">
+      {m.storage_connect_saved()}
+    </p>
+    <div
+      class="flex flex-nowrap gap-2 overflow-x-auto overflow-y-visible pb-1"
+      role="list"
+      aria-label={m.storage_connect_saved()}
+    >
+      {#each allConnections as conn (conn.id)}
+        <div class="relative shrink-0" role="listitem">
+          <button
+            type="button"
+            onclick={() => onselect(conn)}
+            class="
+              border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 focus-visible:outline-primary
+              flex flex-col items-center gap-1.5 rounded-xl
+              border p-3 text-center transition-colors before:z-200
+              {activeId === conn.id ? 'border-primary bg-primary/5' : ''}
+            "
+            title={connectionLabel(conn)}
+            data-tip={connectionLabel(conn)}
+          >
+            <IconStorage class="text-primary size-8" aria-hidden="true" />
+            <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
+          </button>
+          <button
+            type="button"
+            aria-label={m.storage_connect_forget_label({ endpoint: connectionLabel(conn) })}
+            onclick={(e) => {
+              e.stopPropagation();
+              openForgetConfirm(conn);
+            }}
+            class="
+              border-base-300 bg-base-100 text-error hover:bg-error hover:text-error-content
+              absolute -top-2 -right-2 flex size-5 items-center justify-center
+              rounded-full border shadow-sm transition-colors
+            "
+          >
+            <IconClose class="size-3" aria-hidden="true" />
+          </button>
+        </div>
+      {/each}
+    </div>
+    <div class="mt-2 text-right">
+      <a href={resolve('/storage/connections')} class="link link-primary text-xs">
+        {m.storage_connect_manage()}
+      </a>
+    </div>
+  {/if}
+</div>
+
+<!-- Desktop: sidebar -->
+<aside
+  class="
+    border-base-300 bg-base-100 sticky top-0
+    hidden h-[calc(100dvh-7rem)] shrink-0 flex-col rounded-lg border md:flex
+  "
+  style="width: {resize.width}px"
+  aria-label={m.storage_connect_saved()}
+>
+  <div class="border-base-300 border-b px-3 py-2">
+    <span class="text-base-content/50 text-xs font-semibold tracking-wide uppercase">
+      {m.storage_connect_saved()}
+    </span>
+  </div>
+
+  <ul class="flex-1 overflow-y-auto py-1" role="list" aria-label={m.storage_connect_saved()}>
+    {#if !connectionsLoaded}
+      <li class="flex justify-center px-3 py-4">
+        <span class="loading loading-spinner loading-sm text-base-content/40"></span>
+      </li>
+    {:else if allConnections.length === 0}
+      <li class="text-base-content/40 px-3 py-4 text-center text-xs">
+        {m.storage_connect_no_saved()}
+      </li>
+    {:else}
+      {#each allConnections as conn (conn.id)}
+        <li class="group relative">
+          <div class="relative z-150 w-full">
+            <button
+              type="button"
+              onclick={() => onselect(conn)}
+              class="
+              hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                pr-7 text-sm
+              {activeId === conn.id
+                ? 'bg-primary/10 text-primary font-medium'
+                : 'text-base-content'}
+            "
+            >
+              <IconStorage
+                class="text-primary size-3.5 shrink-0 {activeId === conn.id ? '' : 'opacity-60'}"
+                aria-hidden="true"
+              />
+              <span class="truncate">{connectionLabel(conn)}</span>
+            </button>
+          </div>
+
+          <button
+            type="button"
+            onclick={(e) => openContextMenu(e, conn)}
+            class="
+              btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
+              p-0 opacity-0 transition-opacity
+              group-hover:opacity-100 focus:opacity-100
+            "
+            aria-label={m.storage_more_options()}
+            title={m.storage_more_options()}
+          >
+            <IconMoreHoriz class="size-3.5" aria-hidden="true" />
+          </button>
+        </li>
+      {/each}
+    {/if}
+  </ul>
+
+  <div class="border-base-300 border-t p-2">
+    <a
+      href={resolve('/storage/connections')}
+      class="btn btn-ghost btn-xs w-full justify-start text-xs"
+    >
+      {m.storage_connect_manage()}
+    </a>
+  </div>
+
+  <ResizeHandle panel={resize} />
+</aside>
+
+<!-- Delete confirmation modal -->
+<DeleteConnectionModal
+  bind:open={forgetOpen}
+  connection={forgetCandidate}
+  onconfirm={forgetConnection}
+  oncancel={() => (forgetOpen = false)}
+/>
diff --git a/src/lib/components/storage/sidebar/resizable-panel.svelte.ts b/src/lib/components/storage/sidebar/resizable-panel.svelte.ts
new file mode 100644
index 00000000..80af2e0e
--- /dev/null
+++ b/src/lib/components/storage/sidebar/resizable-panel.svelte.ts
@@ -0,0 +1,110 @@
+import { browser } from '$app/environment';
+
+interface Options {
+  storageKey: string;
+  defaultWidth?: number;
+  minWidth?: number;
+  maxWidth?: number;
+}
+
+/**
+ * Creates reactive state and event handlers for a drag-to-resize sidebar panel.
+ * Call from a component's `<script>` block or another `.svelte.ts` file.
+ * The returned object's `width` is reactive and can be used directly in
+ * `style="width: {resize.width}px"`.
+ */
+export function createResizablePanel({
+  storageKey,
+  defaultWidth = 192,
+  minWidth = 120,
+  maxWidth = 480
+}: Options) {
+  function getInitialWidth(): number {
+    if (!browser) return defaultWidth;
+    try {
+      const stored = localStorage.getItem(storageKey);
+      if (stored) {
+        const parsed = parseInt(stored, 10);
+        if (!isNaN(parsed) && parsed >= minWidth && parsed <= maxWidth) return parsed;
+      }
+    } catch {
+      /* ignore storage errors */
+    }
+    return defaultWidth;
+  }
+
+  function saveWidth(w: number) {
+    try {
+      localStorage.setItem(storageKey, String(w));
+    } catch {
+      /* ignore storage errors */
+    }
+  }
+
+  let width = $state(getInitialWidth());
+  let isDragging = $state(false);
+  let dragStartX = 0;
+  let dragStartWidth = 0;
+
+  function onResizeStart(e: PointerEvent) {
+    isDragging = true;
+    dragStartX = e.clientX;
+    dragStartWidth = width;
+    (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId);
+    e.preventDefault();
+  }
+
+  function onResizeMove(e: PointerEvent) {
+    if (!isDragging) return;
+    width = Math.min(maxWidth, Math.max(minWidth, dragStartWidth + (e.clientX - dragStartX)));
+  }
+
+  function onResizeEnd() {
+    if (!isDragging) return;
+    isDragging = false;
+    saveWidth(width);
+  }
+
+  function onResizeKeydown(e: KeyboardEvent) {
+    const step = e.shiftKey ? 20 : 4;
+    if (e.key === 'ArrowRight') {
+      width = Math.min(maxWidth, width + step);
+      saveWidth(width);
+      e.preventDefault();
+    } else if (e.key === 'ArrowLeft') {
+      width = Math.max(minWidth, width - step);
+      saveWidth(width);
+      e.preventDefault();
+    }
+  }
+
+  // Keep the col-resize cursor active across the whole page while dragging so
+  // it doesn't flicker when the pointer moves faster than the DOM updates.
+  $effect(() => {
+    if (!browser) return;
+    if (isDragging) {
+      document.body.style.cursor = 'col-resize';
+      document.body.style.userSelect = 'none';
+    } else {
+      document.body.style.cursor = '';
+      document.body.style.userSelect = '';
+    }
+  });
+
+  return {
+    get width() {
+      return width;
+    },
+    get isDragging() {
+      return isDragging;
+    },
+    minWidth,
+    maxWidth,
+    onResizeStart,
+    onResizeMove,
+    onResizeEnd,
+    onResizeKeydown
+  };
+}
+
+export type ResizablePanel = ReturnType<typeof createResizablePanel>;
diff --git a/src/lib/server/storage/connection.ts b/src/lib/server/storage/connection.ts
index 2f606ba5..772bfba2 100644
--- a/src/lib/server/storage/connection.ts
+++ b/src/lib/server/storage/connection.ts
@@ -29,13 +29,18 @@ function parseConnectionPayload(raw: string): S3ConnectionConfig {
     throw error(400, 'Storage backend not supported');
   }
 
+  const { host, port, tls, accessStyle, region, credentials } = parsed.data;
+  const resolvedCredentials =
+    credentials.accessKey && credentials.secretKey ? credentials : undefined;
+
   return {
     type: 's3',
-    endpoint: parsed.data.endpoint || undefined,
-    pathStyle: parsed.data.pathStyle,
-    region: parsed.data.region,
-    accessKeyId: parsed.data.accessKeyId || undefined,
-    secretAccessKey: parsed.data.secretAccessKey || undefined
+    host,
+    port,
+    tls,
+    accessStyle,
+    region,
+    credentials: resolvedCredentials
   };
 }
 
diff --git a/src/lib/server/storage/factory.test.ts b/src/lib/server/storage/factory.test.ts
index bee9877b..397cc081 100644
--- a/src/lib/server/storage/factory.test.ts
+++ b/src/lib/server/storage/factory.test.ts
@@ -18,7 +18,13 @@ import type { S3Config, HDFSConfig } from './types.js';
 
 describe('StorageProviderFactory', () => {
   it('creates S3StorageProvider for type s3', () => {
-    const config: S3Config = { type: 's3', region: 'us-east-1', bucket: 'test' };
+    const config: S3Config = {
+      type: 's3',
+      host: 'minio.example.com',
+      accessStyle: 'Path',
+      region: { name: 'us-east-1' },
+      bucket: 'test'
+    };
     const provider = StorageProviderFactory.create(config);
     expect((provider as unknown as { config: S3Config }).config).toEqual(config);
   });
diff --git a/src/lib/server/storage/s3-client.test.ts b/src/lib/server/storage/s3-client.test.ts
index d554c86f..cfb09b31 100644
--- a/src/lib/server/storage/s3-client.test.ts
+++ b/src/lib/server/storage/s3-client.test.ts
@@ -1,53 +1,67 @@
 import { describe, it, expect, vi } from 'vitest';
-import { faker } from '@faker-js/faker';
 import type { S3ConnectionConfig } from './types.js';
 
 vi.mock('@aws-sdk/client-s3', () => ({
   S3Client: vi.fn()
 }));
 
+vi.mock('@smithy/node-http-handler', () => ({
+  NodeHttpHandler: vi.fn()
+}));
+
 import { createS3Client } from './s3-client.js';
 import { S3Client } from '@aws-sdk/client-s3';
 const mockS3Client = vi.mocked(S3Client);
 
+function baseConfig(overrides: Partial<S3ConnectionConfig> = {}): S3ConnectionConfig {
+  return {
+    type: 's3',
+    host: 'minio.example.com',
+    accessStyle: 'Path',
+    region: { name: 'us-east-1' },
+    ...overrides
+  };
+}
+
 describe('createS3Client', () => {
-  it('creates client with region only (no endpoint, no credentials)', () => {
-    const config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
-    createS3Client(config);
-    expect(mockS3Client).toHaveBeenCalledWith({ region: 'us-east-1' });
+  it('builds an http endpoint when tls is absent', () => {
+    createS3Client(baseConfig({ tls: undefined }));
+    expect(mockS3Client).toHaveBeenCalledWith(
+      expect.objectContaining({ endpoint: 'http://minio.example.com' })
+    );
   });
 
-  it('sets endpoint and forcePathStyle when endpoint provided', () => {
-    const endpoint = faker.internet.url();
-    const config: S3ConnectionConfig = { type: 's3', region: 'eu-west-1', endpoint };
-    createS3Client(config);
+  it('builds an https endpoint when tls is present', () => {
+    createS3Client(baseConfig({ tls: { verification: 'Full' } }));
     expect(mockS3Client).toHaveBeenCalledWith(
-      expect.objectContaining({ endpoint, forcePathStyle: true })
+      expect.objectContaining({ endpoint: 'https://minio.example.com' })
     );
   });
 
-  it('respects pathStyle=false', () => {
-    const endpoint = faker.internet.url();
-    const config: S3ConnectionConfig = {
-      type: 's3',
-      region: 'eu-west-1',
-      endpoint,
-      pathStyle: false
-    };
-    createS3Client(config);
+  it('includes port in the endpoint URL when port is set', () => {
+    createS3Client(baseConfig({ port: 9000, tls: undefined }));
     expect(mockS3Client).toHaveBeenCalledWith(
-      expect.objectContaining({ endpoint, forcePathStyle: false })
+      expect.objectContaining({ endpoint: 'http://minio.example.com:9000' })
     );
   });
 
-  it('sets credentials when accessKeyId and secretAccessKey provided', () => {
-    const config: S3ConnectionConfig = {
-      type: 's3',
-      region: 'us-west-2',
-      accessKeyId: 'AKID',
-      secretAccessKey: 'SECRET'
-    };
-    createS3Client(config);
+  it('sets forcePathStyle=true for Path access style', () => {
+    createS3Client(baseConfig({ accessStyle: 'Path' }));
+    expect(mockS3Client).toHaveBeenCalledWith(expect.objectContaining({ forcePathStyle: true }));
+  });
+
+  it('sets forcePathStyle=false for VirtualHosted access style', () => {
+    createS3Client(baseConfig({ accessStyle: 'VirtualHosted' }));
+    expect(mockS3Client).toHaveBeenCalledWith(expect.objectContaining({ forcePathStyle: false }));
+  });
+
+  it('passes region name to the SDK', () => {
+    createS3Client(baseConfig({ region: { name: 'eu-west-1' } }));
+    expect(mockS3Client).toHaveBeenCalledWith(expect.objectContaining({ region: 'eu-west-1' }));
+  });
+
+  it('sets credentials when accessKey and secretKey are provided', () => {
+    createS3Client(baseConfig({ credentials: { accessKey: 'AKID', secretKey: 'SECRET' } }));
     expect(mockS3Client).toHaveBeenCalledWith(
       expect.objectContaining({
         credentials: { accessKeyId: 'AKID', secretAccessKey: 'SECRET' }
@@ -55,9 +69,8 @@ describe('createS3Client', () => {
     );
   });
 
-  it('does not set credentials when only accessKeyId provided', () => {
-    const config: S3ConnectionConfig = { type: 's3', region: 'us-west-2', accessKeyId: 'AKID' };
-    createS3Client(config);
+  it('does not set credentials when credentials is absent', () => {
+    createS3Client(baseConfig({ credentials: undefined }));
     const call = mockS3Client.mock.calls.at(-1)![0] as { credentials?: unknown };
     expect(call.credentials).toBeUndefined();
   });
diff --git a/src/lib/server/storage/s3-client.ts b/src/lib/server/storage/s3-client.ts
index 50e75e89..6709a633 100644
--- a/src/lib/server/storage/s3-client.ts
+++ b/src/lib/server/storage/s3-client.ts
@@ -1,19 +1,29 @@
 import { S3Client } from '@aws-sdk/client-s3';
+import { NodeHttpHandler } from '@smithy/node-http-handler';
+import { Agent } from 'https';
 import type { S3ConnectionConfig } from './types.js';
 
+function buildEndpointUrl(config: S3ConnectionConfig): string {
+  const scheme = config.tls ? 'https' : 'http';
+  const portSuffix = config.port ? `:${config.port}` : '';
+  return `${scheme}://${config.host}${portSuffix}`;
+}
+
 export function createS3Client(config: S3ConnectionConfig): S3Client {
   return new S3Client({
-    region: config.region,
-    ...(config.endpoint && {
-      endpoint: config.endpoint,
-      forcePathStyle: config.pathStyle ?? true
-    }),
-    ...(config.accessKeyId &&
-      config.secretAccessKey && {
-        credentials: {
-          accessKeyId: config.accessKeyId,
-          secretAccessKey: config.secretAccessKey
-        }
+    region: config.region.name,
+    endpoint: buildEndpointUrl(config),
+    forcePathStyle: config.accessStyle === 'Path',
+    ...(config.tls?.verification === 'None' && {
+      requestHandler: new NodeHttpHandler({
+        httpsAgent: new Agent({ rejectUnauthorized: false })
       })
+    }),
+    ...(config.credentials && {
+      credentials: {
+        accessKeyId: config.credentials.accessKey,
+        secretAccessKey: config.credentials.secretKey
+      }
+    })
   });
 }
diff --git a/src/lib/server/storage/s3-provider.test.ts b/src/lib/server/storage/s3-provider.test.ts
index d67d613a..a32bdc9d 100644
--- a/src/lib/server/storage/s3-provider.test.ts
+++ b/src/lib/server/storage/s3-provider.test.ts
@@ -44,7 +44,13 @@ function makeS3Error(name: string, httpStatusCode?: number): S3ServiceException
 function makeProvider() {
   const send = vi.fn();
   const client = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
-  const config = { type: 's3' as const, region: 'us-east-1', bucket: 'test-bucket' };
+  const config = {
+    type: 's3' as const,
+    host: 'minio.example.com',
+    accessStyle: 'Path' as const,
+    region: { name: 'us-east-1' },
+    bucket: 'test-bucket'
+  };
   const provider = new S3StorageProvider(config, client);
   return { provider, send };
 }
@@ -492,7 +498,13 @@ describe('S3StorageProvider constructor', () => {
     const send = vi.fn();
     const fakeClient = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
     const provider = new S3StorageProvider(
-      { type: 's3', region: 'us-east-1', bucket: 'b' },
+      {
+        type: 's3',
+        host: 'minio.example.com',
+        accessStyle: 'Path',
+        region: { name: 'us-east-1' },
+        bucket: 'b'
+      },
       fakeClient
     );
     expect(provider).toBeDefined();
@@ -503,9 +515,15 @@ describe('S3StorageProvider constructor', () => {
     const mockCreate = vi.mocked(createS3Client);
     mockCreate.mockClear();
 
-    new S3StorageProvider({ type: 's3', region: 'us-east-1', bucket: 'b' });
+    new S3StorageProvider({
+      type: 's3',
+      host: 'minio.example.com',
+      accessStyle: 'Path',
+      region: { name: 'us-east-1' },
+      bucket: 'b'
+    });
     expect(mockCreate).toHaveBeenCalledWith(
-      expect.objectContaining({ region: 'us-east-1', bucket: 'b' })
+      expect.objectContaining({ region: { name: 'us-east-1' }, bucket: 'b' })
     );
   });
 });
diff --git a/src/lib/server/storage/service.test.ts b/src/lib/server/storage/service.test.ts
index fa4be91f..cce7137f 100644
--- a/src/lib/server/storage/service.test.ts
+++ b/src/lib/server/storage/service.test.ts
@@ -49,7 +49,9 @@ import type { S3ConnectionConfig } from './types.js';
 
 const config: S3ConnectionConfig = {
   type: 's3',
-  region: faker.location.countryCode()
+  host: 'minio.example.com',
+  accessStyle: 'Path',
+  region: { name: faker.location.countryCode() }
 };
 
 describe('storage service', () => {
diff --git a/src/lib/server/storage/types.ts b/src/lib/server/storage/types.ts
index 46472f67..fc3f71f9 100644
--- a/src/lib/server/storage/types.ts
+++ b/src/lib/server/storage/types.ts
@@ -1,12 +1,12 @@
 /** Per-user S3 connection config — no bucket, stored server-side. */
 export interface S3ConnectionConfig {
   type: 's3';
-  endpoint?: string;
-  /** Use path-style addressing (true) or virtual-hosted style (false). Defaults to true. */
-  pathStyle?: boolean;
-  region: string;
-  accessKeyId?: string;
-  secretAccessKey?: string;
+  host: string;
+  port?: number;
+  tls?: { verification: 'Full' | 'None' };
+  accessStyle: 'Path' | 'VirtualHosted';
+  region: { name: string };
+  credentials?: { accessKey: string; secretKey: string };
 }
 
 /** Full S3 config for creating a bucket-scoped provider. */
diff --git a/src/lib/server/storage/utils.test.ts b/src/lib/server/storage/utils.test.ts
index b83bfb17..013e99e7 100644
--- a/src/lib/server/storage/utils.test.ts
+++ b/src/lib/server/storage/utils.test.ts
@@ -12,7 +12,12 @@ vi.mock('./factory.js', () => ({
 import { getProvider } from './utils.js';
 import type { S3ConnectionConfig } from './types.js';
 
-const s3Config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
+const s3Config: S3ConnectionConfig = {
+  type: 's3',
+  host: 'minio.example.com',
+  accessStyle: 'Path',
+  region: { name: 'us-east-1' }
+};
 
 describe('getProvider', () => {
   it('throws 400 for non-s3 connection type', () => {
diff --git a/src/lib/storage/bookmarks.svelte.spec.ts b/src/lib/storage/bookmarks.svelte.spec.ts
new file mode 100644
index 00000000..296e9102
--- /dev/null
+++ b/src/lib/storage/bookmarks.svelte.spec.ts
@@ -0,0 +1,147 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { BookmarksState } from '$lib/storage/bookmarks.svelte.js';
+import { LS_PINS, LS_RECENT_FILES, LS_RECENT_LOCATIONS } from '$lib/storage/persistence.js';
+
+describe('BookmarksState — connectionId scoping', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  describe('constructor filtering', () => {
+    it('loads only pins tagged with the given connectionId', () => {
+      localStorage.setItem(
+        LS_PINS,
+        JSON.stringify([
+          { bucket: 'a', prefix: 'data/', connectionId: 'conn-1' },
+          { bucket: 'b', prefix: 'other/', connectionId: 'conn-2' }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.pinnedLocations).toHaveLength(1);
+      expect(bookmarks.pinnedLocations[0].bucket).toBe('a');
+    });
+
+    it('loads only recent files tagged with the given connectionId', () => {
+      localStorage.setItem(
+        LS_RECENT_FILES,
+        JSON.stringify([
+          {
+            key: 'a.txt',
+            bucket: 'x',
+            size: 1,
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-1'
+          },
+          {
+            key: 'b.txt',
+            bucket: 'y',
+            size: 2,
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-2'
+          }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.recentFiles).toHaveLength(1);
+      expect(bookmarks.recentFiles[0].key).toBe('a.txt');
+    });
+
+    it('loads only recent locations tagged with the given connectionId', () => {
+      localStorage.setItem(
+        LS_RECENT_LOCATIONS,
+        JSON.stringify([
+          {
+            bucket: 'x',
+            prefix: 'images/',
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-1'
+          },
+          {
+            bucket: 'y',
+            prefix: 'docs/',
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-2'
+          }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.recentLocations).toHaveLength(1);
+      expect(bookmarks.recentLocations[0].prefix).toBe('images/');
+    });
+
+    it('silently drops entries without connectionId', () => {
+      localStorage.setItem(
+        LS_PINS,
+        JSON.stringify([
+          { bucket: 'legacy', prefix: '' } // no connectionId — pre-migration entry
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.pinnedLocations).toHaveLength(0);
+    });
+  });
+
+  describe('pin()', () => {
+    it('tags new pins with the connectionId', () => {
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.pin('my-bucket', 'images/');
+
+      const stored = JSON.parse(localStorage.getItem(LS_PINS) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(1);
+      expect((stored[0] as { connectionId: string }).connectionId).toBe('conn-1');
+    });
+
+    it('does not overwrite pins from other connections on persist', () => {
+      localStorage.setItem(
+        LS_PINS,
+        JSON.stringify([{ bucket: 'other', prefix: 'data/', connectionId: 'conn-2' }])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.pin('my-bucket', 'images/');
+
+      const stored = JSON.parse(localStorage.getItem(LS_PINS) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(2);
+    });
+  });
+
+  describe('recordFileVisit()', () => {
+    it('tags new entries with the connectionId', () => {
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.recordFileVisit('my-bucket', 'photo.jpg', 1024);
+
+      const stored = JSON.parse(localStorage.getItem(LS_RECENT_FILES) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(1);
+      expect((stored[0] as { connectionId: string }).connectionId).toBe('conn-1');
+    });
+
+    it('preserves recent files from other connections on persist', () => {
+      localStorage.setItem(
+        LS_RECENT_FILES,
+        JSON.stringify([
+          {
+            key: 'other.txt',
+            bucket: 'y',
+            size: 1,
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-2'
+          }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.recordFileVisit('my-bucket', 'photo.jpg', 1024);
+
+      const stored = JSON.parse(localStorage.getItem(LS_RECENT_FILES) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(2);
+    });
+  });
+});
diff --git a/src/lib/storage/bookmarks.svelte.ts b/src/lib/storage/bookmarks.svelte.ts
index c104a201..6a40e798 100644
--- a/src/lib/storage/bookmarks.svelte.ts
+++ b/src/lib/storage/bookmarks.svelte.ts
@@ -20,22 +20,34 @@ function dedupByKey<T>(items: T[], keyFn: (item: T) => string): T[] {
 }
 
 export class BookmarksState {
-  pinnedLocations = $state<PinnedLocation[]>(
-    dedupByKey(loadFromStorage<PinnedLocation>(LS_PINS), (p) => p.bucket + '\0' + p.prefix)
-  );
-  recentFiles = $state<RecentFile[]>(
-    dedupByKey(loadFromStorage<RecentFile>(LS_RECENT_FILES), (f) => f.bucket + '\0' + f.key)
-  );
-  recentLocations = $state<RecentLocation[]>(
-    dedupByKey(
-      loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter((l) => Boolean(l.bucket)),
+  private readonly connectionId: string;
+
+  pinnedLocations = $state<PinnedLocation[]>([]);
+  recentFiles = $state<RecentFile[]>([]);
+  recentLocations = $state<RecentLocation[]>([]);
+
+  constructor(connectionId: string) {
+    this.connectionId = connectionId;
+
+    this.pinnedLocations = dedupByKey(
+      loadFromStorage<PinnedLocation>(LS_PINS).filter((p) => p.connectionId === connectionId),
+      (p) => p.bucket + '\0' + p.prefix
+    );
+    this.recentFiles = dedupByKey(
+      loadFromStorage<RecentFile>(LS_RECENT_FILES).filter((f) => f.connectionId === connectionId),
+      (f) => f.bucket + '\0' + f.key
+    );
+    this.recentLocations = dedupByKey(
+      loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter(
+        (l) => Boolean(l.bucket) && l.connectionId === connectionId
+      ),
       (l) => l.bucket + '\0' + l.prefix
-    )
-  );
+    );
+  }
 
   pin(bucket: string, prefix: string): void {
     if (this.pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix)) return;
-    this.pinnedLocations.push({ bucket, prefix });
+    this.pinnedLocations.push({ bucket, prefix, connectionId: this.connectionId });
     this.persistPins();
   }
 
@@ -66,26 +78,47 @@ export class BookmarksState {
   }
 
   private persistPins(): void {
-    persistToStorage(LS_PINS, [...this.pinnedLocations]);
+    // Merge with entries from other connections so we don't wipe their pins.
+    const others = loadFromStorage<PinnedLocation>(LS_PINS).filter(
+      (p) => p.connectionId !== this.connectionId
+    );
+    persistToStorage(LS_PINS, [...others, ...this.pinnedLocations]);
   }
 
   recordFileVisit(bucket: string, key: string, size: number): void {
     const idx = this.recentFiles.findIndex((f) => f.bucket === bucket && f.key === key);
-    const entry: RecentFile = { key, bucket, size, visitedAt: new SvelteDate().toISOString() };
+    const entry: RecentFile = {
+      key,
+      bucket,
+      size,
+      visitedAt: new SvelteDate().toISOString(),
+      connectionId: this.connectionId
+    };
     if (idx !== -1) this.recentFiles.splice(idx, 1);
     this.recentFiles.unshift(entry);
     if (this.recentFiles.length > maxRecentFiles) this.recentFiles.splice(maxRecentFiles);
-    persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+    const others = loadFromStorage<RecentFile>(LS_RECENT_FILES).filter(
+      (f) => f.connectionId !== this.connectionId
+    );
+    persistToStorage(LS_RECENT_FILES, [...others, ...this.recentFiles]);
   }
 
   recordLocationVisit(bucket: string, prefix: string): void {
     if (!bucket) return;
     const idx = this.recentLocations.findIndex((l) => l.bucket === bucket && l.prefix === prefix);
-    const entry: RecentLocation = { bucket, prefix, visitedAt: new SvelteDate().toISOString() };
+    const entry: RecentLocation = {
+      bucket,
+      prefix,
+      visitedAt: new SvelteDate().toISOString(),
+      connectionId: this.connectionId
+    };
     if (idx !== -1) this.recentLocations.splice(idx, 1);
     this.recentLocations.unshift(entry);
     if (this.recentLocations.length > maxRecentFiles) this.recentLocations.splice(maxRecentFiles);
-    persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
+    const others = loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter(
+      (l) => l.connectionId !== this.connectionId
+    );
+    persistToStorage(LS_RECENT_LOCATIONS, [...others, ...this.recentLocations]);
   }
 
   removeFiles(bucket: string, fileKeys: string[]): void {
@@ -95,7 +128,10 @@ export class BookmarksState {
     const keep = this.recentFiles.filter((f) => !(f.bucket === bucket && keySet.has(f.key)));
     if (keep.length !== before) {
       this.recentFiles.splice(0, this.recentFiles.length, ...keep);
-      persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+      const others = loadFromStorage<RecentFile>(LS_RECENT_FILES).filter(
+        (f) => f.connectionId !== this.connectionId
+      );
+      persistToStorage(LS_RECENT_FILES, [...others, ...keep]);
     }
   }
 
@@ -109,7 +145,10 @@ export class BookmarksState {
     if (removedFiles > 0) {
       const keep = this.recentFiles.filter((f) => !(f.bucket === bucket && underAny(f.key)));
       this.recentFiles.splice(0, this.recentFiles.length, ...keep);
-      persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+      const others = loadFromStorage<RecentFile>(LS_RECENT_FILES).filter(
+        (f) => f.connectionId !== this.connectionId
+      );
+      persistToStorage(LS_RECENT_FILES, [...others, ...keep]);
     }
 
     const removedLocs = this.recentLocations.filter(
@@ -118,7 +157,10 @@ export class BookmarksState {
     if (removedLocs > 0) {
       const keep = this.recentLocations.filter((l) => !(l.bucket === bucket && underAny(l.prefix)));
       this.recentLocations.splice(0, this.recentLocations.length, ...keep);
-      persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
+      const others = loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter(
+        (l) => l.connectionId !== this.connectionId
+      );
+      persistToStorage(LS_RECENT_LOCATIONS, [...others, ...keep]);
     }
   }
 }
diff --git a/src/lib/storage/connection-storage.spec.ts b/src/lib/storage/connection-storage.spec.ts
new file mode 100644
index 00000000..7d662095
--- /dev/null
+++ b/src/lib/storage/connection-storage.spec.ts
@@ -0,0 +1,261 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import {
+  saveConnectionLocally,
+  updateConnectionLocally,
+  loadConnectionLocally,
+  loadAllConnectionsLocally,
+  removeConnectionLocally,
+  removeConnectionById,
+  loadConnectionById
+} from '$lib/storage/connection-storage.js';
+import type { StoredConnection, SavedConnection } from '$lib/storage/connection-storage.js';
+
+const STORAGE_KEY = 'stackable_storage_connections';
+
+// localStorage is unavailable in the Node (server) test environment — stub it.
+const store: Record<string, string> = {};
+vi.stubGlobal('localStorage', {
+  getItem: (key: string) => store[key] ?? null,
+  setItem: (key: string, value: string) => {
+    store[key] = value;
+  },
+  removeItem: (key: string) => {
+    delete store[key];
+  },
+  clear: () => {
+    for (const k of Object.keys(store)) delete store[k];
+  }
+});
+
+// crypto.randomUUID is available in Node 15+ — ensure it is present.
+if (!globalThis.crypto) {
+  const { webcrypto } = await import('crypto');
+  vi.stubGlobal('crypto', webcrypto);
+}
+
+function makeConn(
+  overrides: Partial<Omit<SavedConnection, 'id'>> & { id?: string } = {}
+): SavedConnection {
+  return {
+    id: overrides.id ?? crypto.randomUUID(),
+    type: 's3',
+    host: 'minio.example.com',
+    port: 9000,
+    tls: { verification: 'Full' },
+    accessStyle: 'Path',
+    region: { name: 'us-east-1' },
+    credentials: { accessKey: 'AKIA123', secretKey: 'secret' },
+    ...overrides
+  } as SavedConnection;
+}
+
+describe('connection-storage', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  describe('saveConnectionLocally', () => {
+    it('stores a connection and assigns the given id', () => {
+      const conn = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(conn);
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+    });
+
+    it('generates a uuid when id is not set', () => {
+      const conn = makeConn();
+      // Simulate missing id (e.g. from legacy code path) by deleting it
+      const connWithoutId = { ...conn } as Partial<StoredConnection>;
+      delete connWithoutId.id;
+      saveConnectionLocally(connWithoutId as StoredConnection);
+      const stored = loadAllConnectionsLocally();
+      expect(stored[0].id).toBeDefined();
+      expect(stored[0].id).toMatch(
+        /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+      );
+    });
+
+    it('appends to the end (most recently used)', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+      const stored = loadAllConnectionsLocally();
+      expect(stored[stored.length - 1].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+
+    it('replaces an existing connection with the same id and moves it to end', () => {
+      const conn = makeConn({
+        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+        region: { name: 'us-east-1' }
+      });
+      saveConnectionLocally(conn);
+      const updated = makeConn({
+        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+        region: { name: 'eu-west-1' }
+      });
+      saveConnectionLocally(updated);
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].region.name).toBe('eu-west-1');
+    });
+
+    it('deduplicates by host+port+accessKey when no id is supplied', () => {
+      // First save — assigns a UUID
+      const connWithoutId = {
+        type: 's3' as const,
+        host: 'minio.example.com',
+        port: 9000,
+        tls: { verification: 'Full' as const },
+        accessStyle: 'Path' as const,
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'AKIA123', secretKey: 'secret' }
+      };
+      saveConnectionLocally(connWithoutId);
+      const afterFirst = loadAllConnectionsLocally();
+      expect(afterFirst).toHaveLength(1);
+      const assignedId = afterFirst[0].id;
+
+      // Second save with same identity but no id — should reuse the existing entry
+      saveConnectionLocally({ ...connWithoutId, region: { name: 'eu-west-1' } });
+      const afterSecond = loadAllConnectionsLocally();
+      expect(afterSecond).toHaveLength(1);
+      expect(afterSecond[0].id).toBe(assignedId);
+      expect(afterSecond[0].region.name).toBe('eu-west-1');
+    });
+  });
+
+  describe('updateConnectionLocally', () => {
+    it('updates an existing connection in-place by id', () => {
+      const a = makeConn({
+        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+        region: { name: 'us-east-1' }
+      });
+      const b = makeConn({
+        id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+        region: { name: 'eu-west-1' }
+      });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+
+      updateConnectionLocally('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', {
+        region: { name: 'ap-south-1' }
+      });
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(2);
+      // Preserved position (first)
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+      expect(stored[0].region.name).toBe('ap-south-1');
+      // Second connection unchanged
+      expect(stored[1].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+      expect(stored[1].region.name).toBe('eu-west-1');
+    });
+
+    it('is a no-op when the id does not exist', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(a);
+
+      updateConnectionLocally('00000000-0000-0000-0000-000000000000', {
+        region: { name: 'us-west-2' }
+      });
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].region.name).toBe(a.region.name);
+    });
+
+    it('preserves the id even when data omits it', () => {
+      const conn = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(conn);
+      updateConnectionLocally('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', { name: 'Prod' });
+      const stored = loadAllConnectionsLocally();
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+      expect(stored[0].name).toBe('Prod');
+    });
+  });
+
+  describe('loadConnectionLocally', () => {
+    it('returns null when nothing is stored', () => {
+      expect(loadConnectionLocally()).toBeNull();
+    });
+
+    it('returns the last (most recently used) connection', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+      const loaded = loadConnectionLocally();
+      expect(loaded?.id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+  });
+
+  describe('loadAllConnectionsLocally', () => {
+    it('silently drops entries that fail schema validation (clean break)', () => {
+      // Write raw data including a legacy entry with old schema fields
+      const legacy = {
+        id: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc',
+        type: 's3',
+        endpoint: 'https://old.example.com',
+        pathStyle: true,
+        region: 'eu-central-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      };
+      const valid = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      localStorage.setItem(STORAGE_KEY, JSON.stringify([legacy, valid]));
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+    });
+
+    it('returns an empty array when localStorage is empty', () => {
+      expect(loadAllConnectionsLocally()).toEqual([]);
+    });
+  });
+
+  describe('removeConnectionLocally', () => {
+    it('removes a connection matched by id', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+
+      removeConnectionLocally(a);
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+  });
+
+  describe('removeConnectionById', () => {
+    it('removes a connection by id string', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+
+      removeConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+  });
+
+  describe('loadConnectionById', () => {
+    it('returns the connection with the given id', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(a);
+      const found = loadConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+      expect(found?.id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+    });
+
+    it('returns null when the id does not exist', () => {
+      expect(loadConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')).toBeNull();
+    });
+  });
+});
diff --git a/src/lib/storage/connection-storage.ts b/src/lib/storage/connection-storage.ts
index bf868931..dd7ee8b1 100644
--- a/src/lib/storage/connection-storage.ts
+++ b/src/lib/storage/connection-storage.ts
@@ -1,8 +1,15 @@
 import type { z } from 'zod';
-import type { StorageConnectionSchema } from './schemas.js';
+import { StorageConnectionSchema } from './schemas.js';
 
+/** Raw form data — `id` may be absent when creating a new connection. */
 export type StoredConnection = z.infer<typeof StorageConnectionSchema>;
 
+/**
+ * A connection that has been persisted to localStorage and always has an `id`.
+ * All load/update/remove functions work with this type.
+ */
+export type SavedConnection = StoredConnection & { id: string };
+
 /**
  * HTTP header name used to pass the S3 connection config from the browser to
  * the backend API endpoints. Defined here (client-safe module) so both client
@@ -12,64 +19,109 @@ export const STORAGE_CONNECTION_HEADER = 'x-storage-connection';
 
 const STORAGE_KEY = 'stackable_storage_connections';
 
-/** Unique key for deduplicating connections by type, endpoint, and access key. */
-function connectionKey(c: StoredConnection): string {
-  return `${c.type}|${c.endpoint ?? ''}|${c.accessKeyId ?? ''}`;
-}
-
 /**
- * Load all stored connections, migrating from the legacy single-connection
- * format if present. Returns connections oldest-first (most recent is last).
+ * Load all stored connections. Entries that do not satisfy the current schema
+ * (clean-break migration) are silently dropped.
+ * Returns connections oldest-first (most recent is last).
  */
-function getConnections(): StoredConnection[] {
+function getConnections(): SavedConnection[] {
   try {
     const raw = localStorage.getItem(STORAGE_KEY);
     if (!raw) return [];
-    return JSON.parse(raw) as StoredConnection[];
+    const parsed = JSON.parse(raw) as unknown[];
+    return parsed.flatMap((c) => {
+      const result = StorageConnectionSchema.safeParse(c);
+      if (!result.success || !result.data.id) return [];
+      return [result.data as SavedConnection];
+    });
   } catch {
     return [];
   }
 }
 
 /**
- * Save a connection. If a connection with the same type, endpoint, and access
- * key already exists it is replaced and moved to the end (most recently used).
+ * Save a new connection. Generates a UUID `id` if one is not already set.
+ * Connections are stored oldest-first; the new connection is appended (most recently used).
  */
 export function saveConnectionLocally(data: StoredConnection): void {
   try {
     const all = getConnections();
-    const key = connectionKey(data);
-    const filtered = all.filter((c) => connectionKey(c) !== key);
-    filtered.push(data);
+    // If a caller-supplied id is present, look up by id first (edit / reconnect
+    // with a known id). Only fall back to content-matching when no id is given,
+    // so that reconnecting with the same credentials (host+port+accessKey) after
+    // a page reload does not create a duplicate entry.
+    const existing = data.id
+      ? all.find((c) => c.id === data.id)
+      : all.find(
+          (c) =>
+            c.host === data.host &&
+            c.port === data.port &&
+            c.credentials?.accessKey === data.credentials?.accessKey
+        );
+    const id = existing?.id ?? data.id ?? crypto.randomUUID();
+    const connection: SavedConnection = { ...data, id };
+    const filtered = all.filter((c) => c.id !== id);
+    filtered.push(connection);
     localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
   } catch {
     // localStorage may be unavailable (e.g. private browsing quota exceeded)
   }
 }
 
+/**
+ * Update an existing connection in-place by its `id`, preserving its position
+ * in the list. If no connection with that `id` exists, this is a no-op.
+ */
+export function updateConnectionLocally(id: string, data: Partial<StoredConnection>): void {
+  try {
+    const all = getConnections();
+    const idx = all.findIndex((c) => c.id === id);
+    if (idx === -1) return;
+    all[idx] = { ...all[idx], ...data, id };
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(all));
+  } catch {
+    // localStorage may be unavailable
+  }
+}
+
 /** Return the most recently used connection (last in the list), or null. */
-export function loadConnectionLocally(): StoredConnection | null {
+export function loadConnectionLocally(): SavedConnection | null {
   const all = getConnections();
   return all.length > 0 ? all[all.length - 1] : null;
 }
 
 /** Return all stored connections in stored order (oldest first). */
-export function loadAllConnectionsLocally(): StoredConnection[] {
+export function loadAllConnectionsLocally(): SavedConnection[] {
   return getConnections();
 }
 
-/** Remove a specific connection from storage without clearing others. */
-export function removeConnectionLocally(data: StoredConnection): void {
+/** Remove a specific connection from storage by its `id`. */
+export function removeConnectionLocally(data: SavedConnection): void {
+  try {
+    const all = getConnections();
+    const filtered = all.filter((c) => c.id !== data.id);
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
+  } catch {
+    // localStorage may be unavailable
+  }
+}
+
+/** Remove a connection from storage by its `id` string. */
+export function removeConnectionById(id: string): void {
   try {
     const all = getConnections();
-    const key = connectionKey(data);
-    const filtered = all.filter((c) => connectionKey(c) !== key);
+    const filtered = all.filter((c) => c.id !== id);
     localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
   } catch {
     // localStorage may be unavailable
   }
 }
 
+/** Return a single connection by its `id`, or null if not found. */
+export function loadConnectionById(id: string): SavedConnection | null {
+  return getConnections().find((c) => c.id === id) ?? null;
+}
+
 /**
  * Encode a connection config as a base64 JSON string suitable for the
  * `X-Storage-Connection` request header sent to the backend.
diff --git a/src/lib/storage/schemas.ts b/src/lib/storage/schemas.ts
index 6678ccf3..5a51d14d 100644
--- a/src/lib/storage/schemas.ts
+++ b/src/lib/storage/schemas.ts
@@ -1,29 +1,69 @@
 import { z } from 'zod';
 
-export const StorageConnectionSchema = z
-  .object({
-    type: z.enum(['s3', 'hdfs']).default('s3'),
-    endpoint: z.url({ message: 'Must be a valid URL' }).or(z.literal('')).optional(),
-    pathStyle: z.boolean().default(true),
-    region: z.string().min(1).default('eu-central-1'),
-    accessKeyId: z.string().optional(),
-    secretAccessKey: z.string().optional()
-  })
-  .superRefine((data, ctx) => {
-    const hasKey = !!data.accessKeyId;
-    const hasSecret = !!data.secretAccessKey;
-    if (hasKey && !hasSecret) {
-      ctx.addIssue({
-        code: 'custom',
-        path: ['secretAccessKey'],
-        message: 'Secret access key is required when access key ID is provided'
-      });
-    }
-    if (!hasKey && hasSecret) {
-      ctx.addIssue({
-        code: 'custom',
-        path: ['accessKeyId'],
-        message: 'Access key ID is required when secret access key is provided'
-      });
-    }
-  });
+const baseStorageConnectionObject = z.object({
+  id: z.string().uuid().optional(),
+  name: z.string().optional(),
+  type: z.enum(['s3', 'hdfs']).default('s3'),
+  host: z
+    .string()
+    .min(1, 'Host is required')
+    .transform((v) => {
+      if (!v.includes('://')) return v;
+      try {
+        return new URL(v).hostname;
+      } catch {
+        // Fallback: strip scheme manually, take just the host part
+        return v.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '').split(/[/:?#]/)[0];
+      }
+    }),
+  port: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .max(65535)
+    .optional()
+    .or(z.literal('').transform(() => undefined)),
+  tls: z.object({ verification: z.enum(['Full', 'None']) }).optional(),
+  accessStyle: z.enum(['Path', 'VirtualHosted']).default('VirtualHosted'),
+  region: z.object({ name: z.string().min(1) }).default({ name: 'us-east-1' }),
+  credentials: z
+    .object({
+      accessKey: z.string(),
+      secretKey: z.string()
+    })
+    .default({ accessKey: '', secretKey: '' })
+});
+
+export const StorageConnectionSchema = baseStorageConnectionObject.superRefine((data, ctx) => {
+  const hasKey = !!data.credentials.accessKey;
+  const hasSecret = !!data.credentials.secretKey;
+  if (hasKey && !hasSecret) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['credentials', 'secretKey'],
+      message: 'Secret key is required when access key is provided'
+    });
+  }
+  if (!hasKey && hasSecret) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['credentials', 'accessKey'],
+      message: 'Access key is required when secret key is provided'
+    });
+  }
+});
+
+/**
+ * Schema variant for the edit form. Identical to StorageConnectionSchema except
+ * that a blank secretKey is allowed when accessKey is provided — leaving it blank
+ * means "keep the existing secret key".
+ */
+export const EditStorageConnectionSchema = baseStorageConnectionObject.superRefine((data, ctx) => {
+  if (!data.credentials.accessKey && !!data.credentials.secretKey) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['credentials', 'accessKey'],
+      message: 'Access key is required when secret key is provided'
+    });
+  }
+});
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 57ff141a..045156d6 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -82,7 +82,7 @@ export class StorageState {
   currentPage = $derived(this.prevTokens.length + 1);
 
   // ── Composed sub-state ──
-  bookmarks = new BookmarksState();
+  bookmarks: BookmarksState;
 
   // ── Navigation handler (injected by page component) ──
   private _onNavigate: NavigateFn = () => {};
@@ -91,9 +91,10 @@ export class StorageState {
   // Constructor
   // ────────────────────────────────────────────────────────────────────────────
 
-  constructor(options?: { connected?: boolean; buckets?: string[] }) {
+  constructor(options?: { connected?: boolean; buckets?: string[]; connectionId?: string }) {
     if (options?.connected !== undefined) this.connected = options.connected;
     if (options?.buckets) this.buckets = options.buckets;
+    this.bookmarks = new BookmarksState(options?.connectionId ?? '');
   }
 
   // ────────────────────────────────────────────────────────────────────────────
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index dd43f495..0864e988 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -47,7 +47,9 @@ export interface StorageLocation {
   prefix: string;
 }
 
-export type PinnedLocation = StorageLocation;
+export interface PinnedLocation extends StorageLocation {
+  connectionId: string;
+}
 
 // ── Recent items ─────────────────────────────────────────────────────────────
 
@@ -56,12 +58,14 @@ export interface RecentFile {
   bucket: string;
   size: number;
   visitedAt: string;
+  connectionId: string;
 }
 
 export interface RecentLocation {
   bucket: string;
   prefix: string;
   visitedAt: string;
+  connectionId: string;
 }
 
 // ── Storage objects ──────────────────────────────────────────────────────────
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 375f8d76..47be34ba 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import { untrack } from 'svelte';
+  import { page } from '$app/state';
   import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
   import { StorageState } from '$lib/storage/state.svelte.js';
   import { setStorageState } from '$lib/storage/context.js';
@@ -10,7 +11,8 @@
     () =>
       new StorageState({
         connected: data.connected,
-        buckets: data.buckets
+        buckets: data.buckets,
+        connectionId: data.connectionId
       })
   );
   setStorageState(storage);
@@ -20,9 +22,12 @@
     storage.connected = data.connected;
     storage.buckets = data.buckets;
   });
+
+  // Connections management pages have their own full-page layout — no sidebar.
+  const isConnectionsRoute = $derived(page.url.pathname.startsWith('/storage/connections'));
 </script>
 
-{#if data.connected}
+{#if data.connected && !isConnectionsRoute}
   <div class="flex h-full min-h-0 gap-4">
     <BucketList />
     <div class="flex min-w-0 flex-1 flex-col">
diff --git a/src/routes/(app)/storage/+layout.ts b/src/routes/(app)/storage/+layout.ts
index 3cacfad2..2f159430 100644
--- a/src/routes/(app)/storage/+layout.ts
+++ b/src/routes/(app)/storage/+layout.ts
@@ -2,7 +2,11 @@ import { browser } from '$app/environment';
 import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 import type { LayoutLoad } from './$types';
 
-const DISCONNECTED = { connected: false, buckets: [] as string[], connectionType: null };
+const DISCONNECTED = {
+  connected: false,
+  buckets: [] as string[],
+  connectionType: null
+};
 
 /**
  * Client-side load: reads the connection from localStorage and fetches the bucket
@@ -28,7 +32,12 @@ export const load: LayoutLoad = async ({ fetch, url }) => {
     if (!res.ok) return DISCONNECTED;
 
     const buckets = (await res.json()) as string[];
-    return { connected: true, buckets, connectionType: connection.type };
+    return {
+      connected: true,
+      buckets,
+      connectionType: connection.type,
+      connectionId: connection.id
+    };
   } catch {
     return DISCONNECTED;
   }
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index b383aec3..20fde48e 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -7,7 +7,11 @@ import { listBuckets } from '$lib/server/storage/service.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
-  const connectionForm = await superValidate(zod(StorageConnectionSchema));
+  const connectionForm = await superValidate(
+    { tls: { verification: 'Full' } },
+    zod(StorageConnectionSchema),
+    { errors: false }
+  );
   locals.logger.debug('loading storage page');
   return { connectionForm };
 };
@@ -22,19 +26,23 @@ export const actions: Actions = {
       return fail(400, { form });
     }
 
-    const { type, endpoint, pathStyle, region, accessKeyId, secretAccessKey } = form.data;
+    const { type, host, port, tls, accessStyle, region, credentials } = form.data;
 
     if (type !== 's3') {
       return message(form, 'HDFS connections are not yet supported', { status: 400 });
     }
 
+    const resolvedCredentials =
+      credentials.accessKey && credentials.secretKey ? credentials : undefined;
+
     const config: S3ConnectionConfig = {
       type: 's3',
-      endpoint: endpoint || undefined,
-      pathStyle,
+      host,
+      port,
+      tls,
+      accessStyle,
       region,
-      accessKeyId: accessKeyId || undefined,
-      secretAccessKey: secretAccessKey || undefined
+      credentials: resolvedCredentials
     };
 
     try {
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index c674b0c2..f0e99a79 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { onMount } from 'svelte';
   import { navigating } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
@@ -8,6 +9,11 @@
 
   let { data } = $props();
   const storage = getStorageState();
+
+  let mounted = $state(false);
+  onMount(() => {
+    mounted = true;
+  });
 </script>
 
 {#if data.connected}
@@ -26,6 +32,6 @@
     <BucketGrid buckets={storage.buckets} />
     <RecentItems />
   </div>
-{:else}
+{:else if mounted}
   <StorageConnectForm connectionForm={data.connectionForm} />
 {/if}
diff --git a/src/routes/(app)/storage/connections/+page.server.ts b/src/routes/(app)/storage/connections/+page.server.ts
new file mode 100644
index 00000000..cf837762
--- /dev/null
+++ b/src/routes/(app)/storage/connections/+page.server.ts
@@ -0,0 +1,8 @@
+import type { PageServerLoad } from './$types';
+
+// The connections list is managed entirely in localStorage on the client.
+// The server only provides an empty shell so the route is authenticated.
+export const load: PageServerLoad = async ({ locals }) => {
+  locals.logger.debug('loading storage connections management page');
+  return {};
+};
diff --git a/src/routes/(app)/storage/connections/+page.svelte b/src/routes/(app)/storage/connections/+page.svelte
new file mode 100644
index 00000000..7f5218b3
--- /dev/null
+++ b/src/routes/(app)/storage/connections/+page.svelte
@@ -0,0 +1,195 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { resolve } from '$app/paths';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
+  import IconEdit from 'virtual:icons/material-symbols/edit';
+  import IconDelete from 'virtual:icons/material-symbols/delete';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import IconArrowBack from 'virtual:icons/material-symbols/arrow-back';
+  import * as m from '$lib/paraglide/messages.js';
+  import {
+    loadAllConnectionsLocally,
+    removeConnectionById,
+    type SavedConnection
+  } from '$lib/storage/connection-storage.js';
+  import DeleteConnectionModal from '$lib/components/storage/DeleteConnectionModal.svelte';
+
+  let connections = $state<SavedConnection[]>([]);
+  let loaded = $state(false);
+  let deleteCandidate = $state<SavedConnection | null>(null);
+  let deleteModalOpen = $state(false);
+
+  // Context menu
+  let menuConn: SavedConnection | null = $state(null);
+  let menuEl: HTMLUListElement | null = $state(null);
+  let menuRawPos = $state({ left: 0, top: 0 });
+
+  const menuPos = $derived.by(() => {
+    if (!menuConn) return { left: 0, top: 0 };
+    if (!menuEl) return menuRawPos;
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left:
+        menuRawPos.left + rect.width > window.innerWidth
+          ? menuRawPos.left - rect.width
+          : menuRawPos.left,
+      top:
+        menuRawPos.top + rect.height > window.innerHeight
+          ? menuRawPos.top - rect.height
+          : menuRawPos.top
+    };
+  });
+
+  onMount(() => {
+    connections = loadAllConnectionsLocally();
+    loaded = true;
+  });
+
+  function connectionLabel(conn: SavedConnection): string {
+    if (conn.name) return conn.name;
+    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+  }
+
+  function openContextMenu(e: MouseEvent, conn: SavedConnection) {
+    e.preventDefault();
+    e.stopPropagation();
+    menuRawPos = { left: e.clientX, top: e.clientY };
+    menuConn = conn;
+  }
+
+  function closeContextMenu() {
+    menuConn = null;
+  }
+
+  function handleOutsideClick(e: MouseEvent) {
+    if (menuConn && menuEl && !menuEl.contains(e.target as Node)) closeContextMenu();
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (menuConn && e.key === 'Escape') closeContextMenu();
+  }
+
+  function requestDelete(conn: SavedConnection) {
+    closeContextMenu();
+    deleteCandidate = conn;
+    deleteModalOpen = true;
+  }
+
+  function confirmDelete() {
+    if (!deleteCandidate) return;
+    removeConnectionById(deleteCandidate.id);
+    connections = loadAllConnectionsLocally();
+    deleteModalOpen = false;
+    deleteCandidate = null;
+  }
+
+  function cancelDelete() {
+    deleteModalOpen = false;
+    deleteCandidate = null;
+  }
+</script>
+
+<svelte:document onclick={handleOutsideClick} />
+<svelte:window onkeydown={handleKeydown} />
+
+<div class="mx-auto max-w-4xl p-6">
+  <a href={resolve('/storage') + '?disconnected=1'} class="btn btn-ghost btn-sm mb-4 -ml-2">
+    <IconArrowBack class="size-4" aria-hidden="true" />
+    {m.storage_connections_back()}
+  </a>
+
+  <h1 class="mb-1 text-xl font-semibold">{m.storage_connections_title()}</h1>
+  <p class="text-base-content/60 mb-6 text-sm">{m.storage_connections_subtitle()}</p>
+
+  {#if !loaded}
+    <div class="flex items-center justify-center py-12">
+      <span class="loading loading-spinner loading-md text-base-content/40"></span>
+    </div>
+  {:else if connections.length === 0}
+    <p class="text-base-content/50 text-sm">{m.storage_connections_empty()}</p>
+  {:else}
+    <div class="overflow-x-auto">
+      <table class="table-sm table">
+        <thead>
+          <tr>
+            <th>{m.storage_connections_col_name()}</th>
+            <th>{m.storage_connections_col_host()}</th>
+            <th>{m.storage_connections_col_type()}</th>
+            <th class="w-10"></th>
+          </tr>
+        </thead>
+        <tbody>
+          {#each connections as conn (conn.id)}
+            <tr
+              class="group hover:bg-base-300 cursor-default select-none"
+              class:outline={menuConn?.id === conn.id}
+              class:bg-base-200={menuConn?.id === conn.id}
+              oncontextmenu={(e) => openContextMenu(e, conn)}
+            >
+              <td>
+                <div class="flex items-center gap-2">
+                  <IconStorage class="text-primary size-4 shrink-0" aria-hidden="true" />
+                  <span class="font-medium">{connectionLabel(conn)}</span>
+                </div>
+              </td>
+              <td class="text-base-content/60 font-mono text-xs">
+                {conn.port ? `${conn.host}:${conn.port}` : conn.host}
+              </td>
+              <td class="text-base-content/60 text-xs uppercase">{conn.type}</td>
+              <td>
+                <button
+                  type="button"
+                  class="btn btn-ghost btn-xs btn-square opacity-0 group-hover:opacity-100"
+                  aria-label={m.storage_connections_options({ label: connectionLabel(conn) })}
+                  onclick={(e) => openContextMenu(e, conn)}
+                >
+                  <IconMoreHoriz class="size-4" aria-hidden="true" />
+                </button>
+              </td>
+            </tr>
+          {/each}
+        </tbody>
+      </table>
+    </div>
+  {/if}
+</div>
+
+<!-- Context menu (right-click or \u22ef button) -->
+{#if menuConn}
+  <ul
+    bind:this={menuEl}
+    class="menu menu-sm border-base-300 bg-base-100 fixed z-50 w-36 rounded-lg border p-1 shadow-lg"
+    role="menu"
+    tabindex="-1"
+    style="left: {menuPos.left}px; top: {menuPos.top}px;"
+  >
+    <li role="none">
+      <a
+        href={resolve(`/storage/connections/${menuConn.id}/edit`)}
+        role="menuitem"
+        onclick={closeContextMenu}
+      >
+        <IconEdit class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connections_edit()}
+      </a>
+    </li>
+    <li role="none">
+      <button
+        type="button"
+        role="menuitem"
+        class="text-error"
+        onclick={() => requestDelete(menuConn!)}
+      >
+        <IconDelete class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connections_delete()}
+      </button>
+    </li>
+  </ul>
+{/if}
+
+<DeleteConnectionModal
+  bind:open={deleteModalOpen}
+  connection={deleteCandidate}
+  onconfirm={confirmDelete}
+  oncancel={cancelDelete}
+/>
diff --git a/src/routes/(app)/storage/connections/[id]/+layout.svelte b/src/routes/(app)/storage/connections/[id]/+layout.svelte
new file mode 100644
index 00000000..5610b09b
--- /dev/null
+++ b/src/routes/(app)/storage/connections/[id]/+layout.svelte
@@ -0,0 +1,22 @@
+<script lang="ts">
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
+  import { page } from '$app/state';
+  import StorageConnectionSidebar from '$lib/components/storage/sidebar/StorageConnectionSidebar.svelte';
+  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+
+  let { children } = $props();
+
+  const connectionId = $derived(page.params.id);
+
+  function handleSelect(conn: SavedConnection) {
+    goto(resolve(`/storage/connections/${conn.id}/edit`));
+  }
+</script>
+
+<div class="flex flex-col gap-4 md:flex-row md:items-start">
+  <StorageConnectionSidebar activeId={connectionId} onselect={handleSelect} />
+  <div class="min-w-0 flex-1">
+    {@render children()}
+  </div>
+</div>
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
new file mode 100644
index 00000000..534a4c56
--- /dev/null
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
@@ -0,0 +1,64 @@
+import { fail } from '@sveltejs/kit';
+import { superValidate, message } from 'sveltekit-superforms';
+import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import type { Actions, PageServerLoad } from './$types';
+import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
+import { listBuckets } from '$lib/server/storage/service.js';
+import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
+
+export const load: PageServerLoad = async ({ locals }) => {
+  const editForm = await superValidate(
+    { tls: { verification: 'Full' } },
+    zod(EditStorageConnectionSchema),
+    { errors: false }
+  );
+  locals.logger.debug('loading storage connection edit page');
+  return { editForm };
+};
+
+export const actions: Actions = {
+  update: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(EditStorageConnectionSchema));
+
+    if (!form.valid) {
+      log.debug({ errors: form.errors }, 'storage connection edit form validation failed');
+      return fail(400, { form });
+    }
+
+    const { type, host, port, tls, accessStyle, region, credentials } = form.data;
+
+    if (type !== 's3') {
+      return message(form, 'HDFS connections are not yet supported', { status: 400 });
+    }
+
+    const resolvedCredentials =
+      credentials.accessKey && credentials.secretKey ? credentials : undefined;
+
+    const config: S3ConnectionConfig = {
+      type: 's3',
+      host,
+      port,
+      tls,
+      accessStyle,
+      region,
+      credentials: resolvedCredentials
+    };
+
+    // If no credentials were submitted the user chose to keep the existing ones,
+    // so skip the live connection test (it was already verified when first saved).
+    if (resolvedCredentials) {
+      try {
+        await listBuckets(config);
+        log.info({ storage_type: type }, 'storage connection edit verified');
+      } catch (err) {
+        log.warn({ err }, 'storage connection edit test failed');
+        return message(form, 'Could not connect — check the endpoint and credentials.', {
+          status: 400
+        });
+      }
+    }
+
+    return message(form, 'ok');
+  }
+};
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
new file mode 100644
index 00000000..9da8b957
--- /dev/null
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
@@ -0,0 +1,366 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { goto, beforeNavigate } from '$app/navigation';
+  import { resolve } from '$app/paths';
+  import { page } from '$app/state';
+  import { superForm } from 'sveltekit-superforms';
+  import { zod4 as zod } from 'sveltekit-superforms/adapters';
+  import { untrack } from 'svelte';
+  import IconInfo from 'virtual:icons/material-symbols/info';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
+  import {
+    loadConnectionById,
+    loadConnectionLocally,
+    updateConnectionLocally,
+    type SavedConnection
+  } from '$lib/storage/connection-storage.js';
+
+  let { data } = $props();
+
+  const uid = $props.id();
+
+  // Loaded client-side from localStorage
+  let connection = $state<SavedConnection | null>(null);
+  let loaded = $state(false);
+  let isActiveConnection = $state(false);
+
+  // Unsaved-changes guard
+  let initialSnapshot = $state.raw('');
+  let confirmLeaveOpen = $state(false);
+  let pendingNavigation = $state<string | null>(null);
+  // Set to true just before a programmatic goto so beforeNavigate doesn't re-intercept it.
+  let bypassDirtyCheck = false;
+
+  // Extract the id from the URL via SvelteKit's page state
+  const connectionId = page.params.id;
+
+  const { form, errors, enhance, submitting, message } = superForm(
+    untrack(() => data.editForm),
+    {
+      dataType: 'json',
+      validators: zod(EditStorageConnectionSchema),
+      onResult: ({ result, cancel }) => {
+        if (result.type === 'success' && result.data?.form?.message === 'ok') {
+          if (connection) {
+            // If credentials were left blank, preserve the existing stored credentials.
+            const savedCredentials =
+              $form.credentials.accessKey && $form.credentials.secretKey
+                ? $form.credentials
+                : (connection.credentials ?? { accessKey: '', secretKey: '' });
+            updateConnectionLocally(connection.id, { ...$form, credentials: savedCredentials });
+          }
+          // Prevent superforms from resetting the form and calling invalidateAll(),
+          // which would race with the navigation.
+          cancel();
+          // Bypass the dirty-check guard so the post-save redirect isn't intercepted.
+          bypassDirtyCheck = true;
+          goto(resolve('/storage/connections'));
+        }
+      }
+    }
+  );
+
+  function isFormDirty(): boolean {
+    return loaded && !!initialSnapshot && JSON.stringify($form) !== initialSnapshot;
+  }
+
+  onMount(() => {
+    if (!connectionId) {
+      goto(resolve('/storage/connections'));
+      return;
+    }
+    const found = loadConnectionById(connectionId);
+    if (!found) {
+      goto(resolve('/storage/connections'));
+      return;
+    }
+    connection = found;
+
+    // Pre-fill form with current values
+    $form.id = found.id;
+    $form.name = found.name ?? '';
+    $form.type = found.type;
+    $form.host = found.host;
+    $form.port = found.port;
+    $form.tls = found.tls;
+    $form.accessStyle = found.accessStyle;
+    $form.region = found.region;
+    // Pre-fill access key but never expose the stored secret key.
+    $form.credentials = { accessKey: found.credentials?.accessKey ?? '', secretKey: '' };
+
+    // Check if this is the currently active connection
+    const active = loadConnectionLocally();
+    isActiveConnection = active?.id === found.id;
+
+    // Snapshot the pre-filled form so we can detect unsaved changes.
+    initialSnapshot = JSON.stringify($form);
+    loaded = true;
+  });
+
+  beforeNavigate(({ cancel: cancelNav, to }) => {
+    if (!bypassDirtyCheck && isFormDirty() && to?.url) {
+      cancelNav();
+      pendingNavigation = to.url.pathname + to.url.search + to.url.hash;
+      confirmLeaveOpen = true;
+    }
+  });
+
+  function confirmLeave() {
+    const dest = pendingNavigation!;
+    confirmLeaveOpen = false;
+    pendingNavigation = null;
+    bypassDirtyCheck = true;
+    goto(dest);
+  }
+
+  function cancelLeave() {
+    confirmLeaveOpen = false;
+    pendingNavigation = null;
+  }
+
+  function handleBeforeUnload(e: BeforeUnloadEvent) {
+    if (isFormDirty()) {
+      e.preventDefault();
+    }
+  }
+
+  function parseHostInput() {
+    const v = $form.host?.trim();
+    if (!v?.includes('://')) return;
+    try {
+      const url = new URL(v);
+      $form.host = url.hostname;
+      if (url.port) $form.port = Number(url.port);
+      $form.tls = url.protocol === 'https:' ? { verification: 'Full' } : undefined;
+    } catch {
+      // Not a parseable URL — leave unchanged
+    }
+  }
+</script>
+
+<svelte:window onbeforeunload={handleBeforeUnload} />
+
+<Modal bind:open={confirmLeaveOpen} class="modal">
+  <div class="modal-box">
+    <h3 class="text-lg font-semibold">{m.storage_connection_edit_unsaved_title()}</h3>
+    <p class="text-base-content/70 mt-2 text-sm">{m.storage_connection_edit_unsaved_body()}</p>
+    <div class="modal-action">
+      <button type="button" class="btn btn-ghost" onclick={cancelLeave}>
+        {m.storage_connection_edit_unsaved_stay()}
+      </button>
+      <button type="button" class="btn btn-error" onclick={confirmLeave}>
+        {m.storage_connection_edit_unsaved_leave()}
+      </button>
+    </div>
+  </div>
+</Modal>
+
+<h1 class="mb-1 text-xl font-semibold">{m.storage_connection_edit_title()}</h1>
+
+{#if !loaded}
+  <div class="flex items-center justify-center py-12">
+    <span class="loading loading-spinner loading-md text-base-content/40"></span>
+  </div>
+{:else}
+  {#if isActiveConnection}
+    <div role="note" class="alert alert-info mb-4 flex gap-2">
+      <IconInfo class="size-5 shrink-0" aria-hidden="true" />
+      <span class="text-sm">{m.storage_connection_edit_active_notice()}</span>
+    </div>
+  {/if}
+
+  <form method="POST" action="?/update" use:enhance class="flex flex-col gap-4">
+    <input type="hidden" name="id" value={$form.id} />
+
+    <!-- Connection name -->
+    <div>
+      <label for="{uid}-name" class="label mb-1 text-sm font-medium">
+        {m.storage_connection_edit_name()}
+      </label>
+      <input
+        id="{uid}-name"
+        name="name"
+        type="text"
+        class="input-bordered input w-full"
+        placeholder={m.storage_connection_edit_name_placeholder()}
+        bind:value={$form.name}
+      />
+      <p class="text-base-content/50 mt-1 text-xs">{m.storage_connection_edit_name_hint()}</p>
+    </div>
+
+    <!-- Backend type (hidden — editing type not supported) -->
+    <input type="hidden" name="type" value={$form.type} />
+
+    <!-- Host -->
+    <div>
+      <label for="{uid}-host" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_host()}
+      </label>
+      <input
+        id="{uid}-host"
+        name="host"
+        type="text"
+        class={['input-bordered input w-full', $errors?.host && 'input-error']}
+        placeholder={m.storage_connect_host_placeholder()}
+        bind:value={$form.host}
+        onblur={parseHostInput}
+      />
+      {#if $errors?.host}
+        <p class="text-error mt-1 text-xs">{$errors.host}</p>
+      {/if}
+    </div>
+
+    <!-- Port -->
+    <div>
+      <label for="{uid}-port" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_port()}
+      </label>
+      <input
+        id="{uid}-port"
+        name="port"
+        type="number"
+        min="1"
+        max="65535"
+        class={['input-bordered input w-full', $errors?.port && 'input-error']}
+        placeholder={m.storage_connect_port_placeholder()}
+        bind:value={$form.port}
+      />
+      <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_port_hint()}</p>
+      {#if $errors?.port}
+        <p class="text-error mt-1 text-xs">{$errors.port}</p>
+      {/if}
+    </div>
+
+    <!-- TLS -->
+    <div class="flex items-start justify-between gap-4">
+      <div>
+        <label for="{uid}-tls" class="label text-sm font-medium">
+          {m.storage_connect_tls()}
+        </label>
+        <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_tls_hint()}</p>
+      </div>
+      <input
+        id="{uid}-tls"
+        type="checkbox"
+        class="toggle toggle-primary mt-1 shrink-0"
+        checked={!!$form.tls}
+        onchange={(e) => {
+          $form.tls = e.currentTarget.checked ? { verification: 'Full' } : undefined;
+        }}
+      />
+    </div>
+
+    <!-- TLS verification -->
+    {#if $form.tls}
+      <div class="flex items-start justify-between gap-4 pl-4">
+        <div>
+          <label for="{uid}-tls-verification" class="label text-sm font-medium">
+            {m.storage_connect_tls_verification()}
+          </label>
+          <p class="text-base-content/50 mt-0.5 text-xs">
+            {m.storage_connect_tls_verification_hint()}
+          </p>
+        </div>
+        <input
+          id="{uid}-tls-verification"
+          type="checkbox"
+          class="toggle toggle-primary mt-1 shrink-0"
+          checked={$form.tls.verification === 'Full'}
+          onchange={(e) => {
+            $form.tls = { verification: e.currentTarget.checked ? 'Full' : 'None' };
+          }}
+        />
+      </div>
+    {/if}
+
+    <!-- Access style -->
+    <div>
+      <label for="{uid}-access-style" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_access_style()}
+      </label>
+      <select
+        id="{uid}-access-style"
+        name="accessStyle"
+        class="select-bordered select w-full"
+        bind:value={$form.accessStyle}
+      >
+        <option value="Path">{m.storage_connect_access_style_path()}</option>
+        <option value="VirtualHosted">{m.storage_connect_access_style_virtual_hosted()}</option>
+      </select>
+    </div>
+
+    <!-- Region -->
+    <div>
+      <label for="{uid}-region" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_region()}
+      </label>
+      <input
+        id="{uid}-region"
+        name="region.name"
+        type="text"
+        class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
+        bind:value={$form.region.name}
+      />
+      {#if $errors?.region?.name}
+        <p class="text-error mt-1 text-xs">{$errors.region.name}</p>
+      {/if}
+    </div>
+
+    <!-- Access key -->
+    <div>
+      <label for="{uid}-access-key" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_access_key()}
+      </label>
+      <input
+        id="{uid}-access-key"
+        name="credentials.accessKey"
+        type="text"
+        class={['input-bordered input w-full', $errors?.credentials?.accessKey && 'input-error']}
+        autocomplete="username"
+        bind:value={$form.credentials.accessKey}
+      />
+      {#if $errors?.credentials?.accessKey}
+        <p class="text-error mt-1 text-xs">{$errors.credentials.accessKey}</p>
+      {/if}
+    </div>
+
+    <!-- Secret key -->
+    <div>
+      <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_secret_key()}
+      </label>
+      <input
+        id="{uid}-secret-key"
+        name="credentials.secretKey"
+        type="password"
+        class={['input-bordered input w-full', $errors?.credentials?.secretKey && 'input-error']}
+        autocomplete="current-password"
+        bind:value={$form.credentials.secretKey}
+      />
+      <p class="text-base-content/50 mt-1 text-xs">
+        {m.storage_connection_edit_credentials_hint()}
+      </p>
+      {#if $errors?.credentials?.secretKey}
+        <p class="text-error mt-1 text-xs">{$errors.credentials.secretKey}</p>
+      {/if}
+    </div>
+
+    {#if $message && $message !== 'ok'}
+      <p class="text-error text-sm">{$message}</p>
+    {/if}
+
+    <div class="flex items-center gap-3">
+      <button type="submit" class="btn btn-primary" disabled={$submitting}>
+        {#if $submitting}
+          <span class="loading loading-sm loading-spinner"></span>
+        {/if}
+        {m.storage_connection_edit_save()}
+      </button>
+      <a href={resolve('/storage/connections')} class="btn btn-ghost">
+        ← {m.storage_connections_title()}
+      </a>
+    </div>
+  </form>
+{/if}
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
index 207b214c..f15982e7 100644
--- a/src/routes/(app)/storage/page.server.test.ts
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -80,11 +80,10 @@ describe('storage page actions', () => {
       valid: true,
       data: {
         type: 's3',
-        endpoint: 'http://s3',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: 'ak',
-        secretAccessKey: 'sk'
+        host: 's3.example.com',
+        accessStyle: 'Path',
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'ak', secretKey: 'sk' }
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
     vi.mocked(listBuckets).mockRejectedValue(new Error('connection refused'));
@@ -104,11 +103,10 @@ describe('storage page actions', () => {
       valid: true,
       data: {
         type: 's3',
-        endpoint: 'http://s3',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: 'ak',
-        secretAccessKey: 'sk'
+        host: 's3.example.com',
+        accessStyle: 'Path',
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'ak', secretKey: 'sk' }
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
     vi.mocked(listBuckets).mockResolvedValue(['b1']);

From 4c1c13ec1eaffbb79b0d71df0521a32cfb2eb4ac Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 7 Jul 2026 13:47:53 +0200
Subject: [PATCH 090/136] Merge branch 'feat/s3-file-browser' into
 feat/s3-file-browser-v1

Brings in connection editing (#227), main merge changes, and
the refactored S3 connection model (host/port/tls/accessStyle,
region as object, credentials as nested object).

Resolution notes:
- s3-client.ts: adopted new model + kept requestChecksumCalculation
- StorageConnectForm.svelte: combined sidebar UI from theirs
  with auto-connect timeout from HEAD
- BucketList.svelte: kept custom JS tooltip for overflow safety
- service.test.ts: removed (tests old service API not in v1)
- package.json: kept both adm-zip and @smithy/node-http-handler
- +page.svelte: kept tab-restore feature + SSR-safe mounted guard
---
 .github/workflows/build.yaml                  |  51 +-
 TECH_DEBT.md                                  |   8 +
 .../cockpit/values/oci.stackable.tech.yaml    |   5 +
 e2e/storage-s3.spec.ts                        |  41 +-
 e2e/storage/connection.spec.ts                |  23 +-
 e2e/storage/connections-management.spec.ts    | 217 ++++++++
 e2e/storage/context-menu.spec.ts              |  28 +-
 e2e/storage/helpers.ts                        |  31 +-
 messages/de.json                              |  60 ++-
 messages/en.json                              |  60 ++-
 package-lock.json                             |  16 +-
 package.json                                  |   1 +
 .../storage/DeleteConnectionModal.svelte      | 142 ++++++
 .../storage/explorer/ObjectTable.svelte       |   2 +-
 .../storage/explorer/SelectionToolbar.svelte  |   2 +-
 .../ContextMenu.svelte.spec.ts                |   2 +-
 .../FileExplorer.svelte.spec.ts               |   2 +-
 .../{ => __tests__}/FileRow.svelte.spec.ts    |   2 +-
 .../{ => __tests__}/FolderRow.svelte.spec.ts  |   2 +-
 .../ObjectTable.svelte.spec.ts                |   2 +-
 .../SelectionToolbar.svelte.spec.ts           |   2 +-
 .../StorageBreadcrumb.svelte.spec.ts          |   2 +-
 .../landing/RecentItems.svelte.spec.ts        |  12 +-
 .../storage/landing/StorageConnectForm.svelte | 469 ++++++++----------
 .../landing/StorageConnectForm.svelte.spec.ts | 424 ++++++++--------
 .../storage/sidebar/BucketList.svelte         | 124 +----
 .../storage/sidebar/BucketList.svelte.spec.ts |  12 +-
 .../storage/sidebar/ResizeHandle.svelte       |  34 ++
 .../sidebar/StorageConnectionSidebar.svelte   | 281 +++++++++++
 .../storage/sidebar/resizable-panel.svelte.ts | 110 ++++
 src/lib/server/storage/connection.ts          |  15 +-
 src/lib/server/storage/factory.test.ts        |   8 +-
 src/lib/server/storage/s3-client.test.ts      |  84 ++--
 src/lib/server/storage/s3-client.ts           |  32 +-
 src/lib/server/storage/s3-provider.test.ts    |  34 +-
 src/lib/server/storage/types.ts               |  12 +-
 src/lib/server/storage/utils.test.ts          |   7 +-
 src/lib/storage/bookmarks.svelte.spec.ts      | 147 ++++++
 src/lib/storage/bookmarks.svelte.ts           |  82 ++-
 src/lib/storage/connection-storage.spec.ts    | 261 ++++++++++
 src/lib/storage/connection-storage.ts         |  94 +++-
 src/lib/storage/schemas.ts                    |  94 +++-
 src/lib/storage/state.svelte.ts               |  19 +-
 src/lib/storage/types.ts                      |   6 +-
 src/routes/(app)/storage/+layout.svelte       |   9 +-
 src/routes/(app)/storage/+layout.ts           |  13 +-
 src/routes/(app)/storage/+page.server.ts      |  20 +-
 src/routes/(app)/storage/+page.svelte         |   8 +-
 .../(app)/storage/connections/+page.server.ts |   8 +
 .../(app)/storage/connections/+page.svelte    | 195 ++++++++
 .../storage/connections/[id]/+layout.svelte   |  22 +
 .../connections/[id]/edit/+page.server.ts     |  64 +++
 .../connections/[id]/edit/+page.svelte        | 366 ++++++++++++++
 src/routes/(app)/storage/page.server.test.ts  |  18 +-
 54 files changed, 2966 insertions(+), 819 deletions(-)
 create mode 100644 deploy/helm/cockpit/values/oci.stackable.tech.yaml
 create mode 100644 e2e/storage/connections-management.spec.ts
 create mode 100644 src/lib/components/storage/DeleteConnectionModal.svelte
 rename src/lib/components/storage/explorer/{ => __tests__}/ContextMenu.svelte.spec.ts (99%)
 rename src/lib/components/storage/explorer/{ => __tests__}/FileExplorer.svelte.spec.ts (98%)
 rename src/lib/components/storage/explorer/{ => __tests__}/FileRow.svelte.spec.ts (99%)
 rename src/lib/components/storage/explorer/{ => __tests__}/FolderRow.svelte.spec.ts (99%)
 rename src/lib/components/storage/explorer/{ => __tests__}/ObjectTable.svelte.spec.ts (98%)
 rename src/lib/components/storage/explorer/{ => __tests__}/SelectionToolbar.svelte.spec.ts (98%)
 rename src/lib/components/storage/explorer/{ => __tests__}/StorageBreadcrumb.svelte.spec.ts (99%)
 create mode 100644 src/lib/components/storage/sidebar/ResizeHandle.svelte
 create mode 100644 src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
 create mode 100644 src/lib/components/storage/sidebar/resizable-panel.svelte.ts
 create mode 100644 src/lib/storage/bookmarks.svelte.spec.ts
 create mode 100644 src/lib/storage/connection-storage.spec.ts
 create mode 100644 src/routes/(app)/storage/connections/+page.server.ts
 create mode 100644 src/routes/(app)/storage/connections/+page.svelte
 create mode 100644 src/routes/(app)/storage/connections/[id]/+layout.svelte
 create mode 100644 src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
 create mode 100644 src/routes/(app)/storage/connections/[id]/edit/+page.svelte

diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 31ebe7d1..4187b089 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -34,7 +34,7 @@ jobs:
 
       - name: Check for changed files
         id: check
-        uses: stackabletech/actions/detect-changes@bafed9c1dd77fb30fe6bb92b4c5f3459dac357e3 # v0.12.0
+        uses: stackabletech/actions/detect-changes@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           patterns: |
             - '.github/workflows/build.yaml'
@@ -112,7 +112,7 @@ jobs:
 
       - name: Build Container Image
         id: build
-        uses: stackabletech/actions/build-container-image@bafed9c1dd77fb30fe6bb92b4c5f3459dac357e3 # v0.12.0
+        uses: stackabletech/actions/build-container-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-index-manifest-tag: ${{ steps.version.outputs.IMAGE_VERSION }}
@@ -122,7 +122,7 @@ jobs:
           container-file: docker/Dockerfile
 
       - name: Publish Container Image
-        uses: stackabletech/actions/publish-image@bafed9c1dd77fb30fe6bb92b4c5f3459dac357e3 # v0.12.0
+        uses: stackabletech/actions/publish-image@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
@@ -141,6 +141,8 @@ jobs:
       contents: read
       id-token: write
     runs-on: ubuntu-latest
+    outputs:
+      oci-index-digest: ${{ steps.publish-oci.outputs.image-index-manifest-digest }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -148,7 +150,8 @@ jobs:
           persist-credentials: false
 
       - name: Publish and Sign Image Index
-        uses: stackabletech/actions/publish-image-index-manifest@bafed9c1dd77fb30fe6bb92b4c5f3459dac357e3 # v0.12.0
+        id: publish-oci
+        uses: stackabletech/actions/publish-image-index-manifest@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-registry-uri: oci.stackable.tech
           image-registry-username: robot$sdp+github-action-build
@@ -156,6 +159,39 @@ jobs:
           image-repository: sdp/${{ env.IMAGE_NAME }}
           image-index-manifest-tag: ${{ needs.build-container-image.outputs.image-version }}
 
+  # Generate SLSA build provenance for the multi-arch image index and attach it
+  # to the published image. The reusable workflow signs the provenance with
+  # keyless signing (GitHub Actions as the OIDC identity) and pushes the
+  # attestation next to the image.
+  provenance-oci:
+    name: Generate Provenance for ${{ needs.build-container-image.outputs.image-version }} (oci.stackable.tech)
+    # The SLSA container generator explicitly does not support the pull_request
+    # event (it fails checking out the merge ref), so provenance is only
+    # generated for images published on push, tags and the scheduled build.
+    if: (github.event_name != 'merge_group') && (github.event_name != 'pull_request') && needs.detect-changes.outputs.detected == 'true'
+    needs:
+      - detect-changes
+      - build-container-image
+      - publish-index-manifest
+    permissions:
+      actions: read # detect the build workflow that generated the image
+      id-token: write # mint the OIDC token for keyless signing
+      packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved
+    # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable
+    # workflow cannot verify its own provenance.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
+    with:
+      # The 'env' context is not available in job-level 'with' inputs of
+      # reusable workflow calls (unlike step-level 'with'), so IMAGE_NAME
+      # can't be used here and the image name is set directly.
+      image: oci.stackable.tech/sdp/cockpit
+      digest: ${{ needs.publish-index-manifest.outputs.oci-index-digest }}
+      registry-username: robot$sdp+github-action-build
+      # The following can be removed once this repository is public
+      private-repository: true
+    secrets:
+      registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
+
   publish-helm-chart:
     name: Package/Publish ${{ needs.build-container-image.outputs.image-version }} Helm Chart
     if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true'
@@ -174,7 +210,7 @@ jobs:
           persist-credentials: false
 
       - name: Package, Publish, and Sign Helm Chart
-        uses: stackabletech/actions/publish-helm-chart@bafed9c1dd77fb30fe6bb92b4c5f3459dac357e3 # v0.12.0
+        uses: stackabletech/actions/publish-helm-chart@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           chart-registry-uri: oci.stackable.tech
           chart-registry-username: robot$sdp-charts+github-action-build
@@ -200,7 +236,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Run OpenShift Preflight Check
-        uses: stackabletech/actions/run-openshift-preflight@bafed9c1dd77fb30fe6bb92b4c5f3459dac357e3 # v0.12.0
+        uses: stackabletech/actions/run-openshift-preflight@a8af17a19bdcc3b5da0065f76e73827ba0c072ce # v0.16.0
         with:
           image-index-uri: oci.stackable.tech/sdp/${{ env.IMAGE_NAME }}:${{ needs.build-container-image.outputs.image-version }}
           image-architecture: ${{ matrix.arch }}
@@ -214,12 +250,13 @@ jobs:
     needs:
       - openshift-preflight-check
       - publish-helm-chart
+      - provenance-oci
     runs-on: ubuntu-latest
     steps:
       - name: Check results
         run: |
           set -euo pipefail
-          if [[ "${{ needs.openshift-preflight-check.result }}" == "failure" || "${{ needs.publish-helm-chart.result }}" == "failure" ]]; then
+          if [[ "${{ needs.openshift-preflight-check.result }}" == "failure" || "${{ needs.publish-helm-chart.result }}" == "failure" || "${{ needs.provenance-oci.result }}" == "failure" ]]; then
             echo "One or more required jobs failed"
             exit 1
           fi
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 5fce8b90..23e76bd9 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -22,6 +22,14 @@ Trino error messages are stored verbatim in `query.error` and surfaced through `
 
 ---
 
+### TLS certificate verification can be disabled without a custom CA
+
+**File:** `src/lib/server/storage/s3-client.ts`
+
+When `tls.verification` is set to `'None'`, the S3 client is created with `rejectUnauthorized: false`, disabling certificate validation entirely. This is a blunt instrument: it silences errors from self-signed or expired certificates but also makes the connection vulnerable to MITM attacks. The correct long-term fix is to allow users to provide their own CA bundle (a PEM file) which is then used to create a custom TLS context, so the server certificate is still validated — just against a trusted private CA instead of the public root store.
+
+---
+
 ### S3 connection credentials stored in localStorage
 
 **File:** `src/lib/storage/connection-storage.ts`, `src/lib/components/storage/StorageConnectForm.svelte`
diff --git a/deploy/helm/cockpit/values/oci.stackable.tech.yaml b/deploy/helm/cockpit/values/oci.stackable.tech.yaml
new file mode 100644
index 00000000..3bb656a0
--- /dev/null
+++ b/deploy/helm/cockpit/values/oci.stackable.tech.yaml
@@ -0,0 +1,5 @@
+---
+# Values overlay for chart packages published to oci.stackable.tech.
+image:
+  registry: oci.stackable.tech
+  repository: sdp/cockpit
diff --git a/e2e/storage-s3.spec.ts b/e2e/storage-s3.spec.ts
index f1d37dad..653cf5b0 100644
--- a/e2e/storage-s3.spec.ts
+++ b/e2e/storage-s3.spec.ts
@@ -25,6 +25,11 @@ test.describe('Storage S3 (Garage)', () => {
     const disconnectButton = page.getByRole('button', { name: 'Disconnect' });
     if (await disconnectButton.isVisible().catch(() => false)) {
       await disconnectButton.click();
+      // Disconnect now opens a confirmation modal — confirm it if it appears.
+      const confirmButton = page.getByRole('dialog').getByRole('button', { name: 'Disconnect' });
+      if (await confirmButton.isVisible({ timeout: 2_000 }).catch(() => false)) {
+        await confirmButton.click();
+      }
     }
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
@@ -44,14 +49,16 @@ test.describe('Storage S3 (Garage)', () => {
 
     await openConnectForm(page);
 
-    // Fill in the connection form
-    await page.getByLabel('Endpoint URL').fill(endpoint);
+    // Fill in the connection form — parse URL into host/port
+    const url = new URL(endpoint);
+    await page.getByLabel('Host').fill(url.hostname);
+    if (url.port) await page.getByLabel('Port').fill(url.port);
+    const tlsToggle = page.getByLabel('Use TLS');
+    if (url.protocol !== 'https:' && (await tlsToggle.isChecked())) await tlsToggle.uncheck();
+    await page.getByLabel('Access style').selectOption('Path');
     await page.getByLabel('Region').fill(region);
-    await page.getByLabel('Access key ID').fill(accessKeyId);
-    await page.getByLabel('Secret access key').fill(secretAccessKey);
-
-    // Path-style addressing is on by default (required for Garage) — verify it is checked
-    await expect(page.getByLabel('Use path-style addressing')).toBeChecked();
+    await page.getByLabel('Access key').fill(accessKeyId);
+    await page.getByLabel('Secret key').fill(secretAccessKey);
 
     await page.getByRole('button', { name: 'Connect' }).click();
 
@@ -60,8 +67,10 @@ test.describe('Storage S3 (Garage)', () => {
     const main = page.locator('main');
     await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
-    // The bucket created during Garage setup must appear in the list
-    await expect(main.getByRole('link', { name: bucket, exact: true })).toBeVisible();
+    // The bucket created during Garage setup must appear in the list.
+    // Both the sidebar nav and the bucket grid render a link — use first() to
+    // avoid a strict-mode violation.
+    await expect(main.getByRole('link', { name: bucket, exact: true }).first()).toBeVisible();
   });
 
   test('disconnects from Garage S3', async ({ page }) => {
@@ -77,15 +86,21 @@ test.describe('Storage S3 (Garage)', () => {
 
     // First connect
     await openConnectForm(page);
-    await page.getByLabel('Endpoint URL').fill(endpoint);
+    const url2 = new URL(endpoint);
+    await page.getByLabel('Host').fill(url2.hostname);
+    if (url2.port) await page.getByLabel('Port').fill(url2.port);
+    const tlsToggle2 = page.getByLabel('Use TLS');
+    if (url2.protocol !== 'https:' && (await tlsToggle2.isChecked())) await tlsToggle2.uncheck();
+    await page.getByLabel('Access style').selectOption('Path');
     await page.getByLabel('Region').fill(region);
-    await page.getByLabel('Access key ID').fill(accessKeyId);
-    await page.getByLabel('Secret access key').fill(secretAccessKey);
+    await page.getByLabel('Access key').fill(accessKeyId);
+    await page.getByLabel('Secret key').fill(secretAccessKey);
     await page.getByRole('button', { name: 'Connect' }).click();
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
-    // Then disconnect
+    // Then disconnect — clicking Disconnect opens a confirmation modal.
     await page.getByRole('button', { name: 'Disconnect' }).click();
+    await page.getByRole('dialog').getByRole('button', { name: 'Disconnect' }).click();
 
     // Should return to the connect form
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index 410bb6cd..d74f1b7a 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -20,6 +20,8 @@ test.describe('Storage S3 — Connection', () => {
     await expect(page).toHaveURL('/storage');
     const main = page.locator('main');
     await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
+    // Both the sidebar nav and the bucket grid render a link for each bucket — use first() to
+    // avoid a strict-mode violation while still confirming the bucket is visible in the UI.
     await expect(
       main.getByRole('link', { name: credentials.bucket, exact: true }).first()
     ).toBeVisible();
@@ -29,10 +31,15 @@ test.describe('Storage S3 — Connection', () => {
     const credentials = requireGarageCredentials();
 
     await openConnectForm(page);
-    await page.getByLabel('Endpoint URL').fill(credentials.endpoint);
+    const url = new URL(credentials.endpoint);
+    await page.getByLabel('Host').fill(url.hostname);
+    if (url.port) await page.getByLabel('Port').fill(url.port);
+    const tlsToggle = page.getByLabel('Use TLS');
+    if (url.protocol !== 'https:' && (await tlsToggle.isChecked())) await tlsToggle.uncheck();
+    await page.getByLabel('Access style').selectOption('Path');
     await page.getByLabel('Region').fill(credentials.region);
-    await page.getByLabel('Access key ID').fill(credentials.accessKeyId);
-    await page.getByLabel('Secret access key').fill(`${credentials.secretAccessKey}-wrong`);
+    await page.getByLabel('Access key').fill(credentials.accessKeyId);
+    await page.getByLabel('Secret key').fill(`${credentials.secretAccessKey}-wrong`);
     await page.getByRole('button', { name: 'Connect' }).click();
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
@@ -47,6 +54,7 @@ test.describe('Storage S3 — Connection', () => {
     await connectToStorage(page, credentials);
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
+    // Click the sidebar Disconnect button — this opens a confirmation modal.
     await page.getByRole('button', { name: 'Disconnect' }).click();
     // Clicking Disconnect opens a confirmation modal; confirm by clicking the
     // Disconnect button inside the dialog.
@@ -82,12 +90,15 @@ test.describe('Storage S3 — Connection', () => {
     const savedList = page.getByRole('list', { name: 'Saved connections' });
     await expect(savedList).toBeVisible();
 
+    // Open the "More options" context menu for the first saved connection
     await savedList.getByRole('listitem').first().getByRole('button').last().click();
 
-    await expect(page.getByRole('button', { name: 'Forget', exact: true })).toBeVisible();
-    await page.getByRole('button', { name: 'Forget', exact: true }).click();
+    // Click Delete in the context menu (rendered as a menuitem)
+    await page.getByRole('menuitem', { name: 'Delete', exact: true }).click();
+
+    // Confirm deletion in the modal
+    await page.getByRole('button', { name: 'Delete', exact: true }).click();
 
-    await expect(savedList).not.toBeVisible();
     await expect(page.getByText('No saved connections yet')).toBeVisible();
   });
 
diff --git a/e2e/storage/connections-management.spec.ts b/e2e/storage/connections-management.spec.ts
new file mode 100644
index 00000000..5e3331bb
--- /dev/null
+++ b/e2e/storage/connections-management.spec.ts
@@ -0,0 +1,217 @@
+import { test, expect, type Page } from '@playwright/test';
+import { hasGarageCredentials, requireGarageCredentials } from '../support/garage.js';
+import { connectToStorage, openConnectForm } from './helpers.js';
+import { waitForHydration } from '../support/helpers.js';
+
+/** Open the Options context menu for the first connection row and click Edit. */
+async function openFirstConnectionEditPage(page: Page) {
+  await page
+    .getByRole('button', { name: /Options for/i })
+    .first()
+    .click({ force: true });
+  await page.getByRole('menuitem', { name: 'Edit' }).click();
+  await waitForHydration(page);
+}
+
+test.describe('Storage — Connections management', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('shows "Manage connections" link on the connect form when saved connections exist', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await openConnectForm(page);
+
+    await expect(page.getByRole('link', { name: 'Manage connections' })).toBeVisible();
+  });
+
+  test('navigates to /storage/connections from the manage link', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await openConnectForm(page);
+
+    await page.getByRole('link', { name: 'Manage connections' }).click();
+
+    await waitForHydration(page);
+    await expect(page).toHaveURL('/storage/connections');
+    await expect(page.getByRole('heading', { name: 'Manage connections' })).toBeVisible();
+  });
+
+  test('lists saved connections on the management page', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    // Connections are displayed in a table; at least one data row should be visible.
+    await expect(page.getByRole('table').getByRole('row').nth(1)).toBeVisible();
+  });
+
+  test('Edit link on management page navigates to edit page', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await expect(page.getByRole('heading', { name: 'Edit connection' })).toBeVisible();
+  });
+
+  test('edit page pre-fills with current connection values', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await expect(page.getByRole('textbox', { name: 'Host' })).toHaveValue(
+      new URL(credentials.endpoint).hostname
+    );
+    await expect(page.getByRole('textbox', { name: 'Region' })).toHaveValue(credentials.region);
+    await expect(page.getByRole('textbox', { name: 'Access key' })).toHaveValue(
+      credentials.accessKeyId
+    );
+  });
+
+  test('edit page redirects to connections list after saving valid credentials', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByRole('button', { name: 'Save changes' }).click();
+
+    await waitForHydration(page);
+    await expect(page).toHaveURL('/storage/connections');
+    await expect(page.getByRole('heading', { name: 'Manage connections' })).toBeVisible();
+  });
+
+  test('edit page shows error for invalid credentials', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByLabel('Secret key').fill('wrong-secret');
+    await page.getByRole('button', { name: 'Save changes' }).click();
+
+    await expect(
+      page.getByText('Could not connect — check the endpoint and credentials.')
+    ).toBeVisible();
+  });
+
+  test('delete button on management page removes the connection after confirmation', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    // Connections are displayed in a table; count data rows (excluding header).
+    const dataRows = page.locator('table tbody tr');
+    const initialItems = await dataRows.count();
+
+    await page
+      .getByRole('button', { name: /Options for/i })
+      .first()
+      .click({ force: true });
+    await page.getByRole('menuitem', { name: 'Delete' }).click();
+
+    // Confirm deletion in the modal
+    await page.getByRole('dialog').getByRole('button', { name: 'Delete', exact: true }).click();
+
+    await expect(dataRows).toHaveCount(initialItems - 1);
+  });
+
+  test('redirects to /storage/connections when editing a non-existent id', async ({ page }) => {
+    await page.goto('/storage/connections/00000000-0000-0000-0000-000000000000/edit');
+    await waitForHydration(page);
+
+    await expect(page).toHaveURL('/storage/connections');
+  });
+
+  test('edit page shows active connection notice when editing current connection', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await expect(page.getByText('You are currently connected with this connection.')).toBeVisible();
+  });
+
+  test('edit page shows unsaved-changes modal when navigating away with dirty form', async ({
+    page
+  }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    // Make a change to mark the form dirty
+    await page.getByLabel('Connection name').fill('Changed name');
+
+    // Try to navigate away via the back link
+    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+
+    // Modal should appear
+    await expect(page.getByRole('dialog')).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'Unsaved changes' })).toBeVisible();
+  });
+
+  test('unsaved-changes modal: Stay keeps user on edit page', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByLabel('Connection name').fill('Changed name');
+    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+
+    await page.getByRole('dialog').getByRole('button', { name: 'Stay on page' }).click();
+
+    await expect(page).toHaveURL(/\/edit$/);
+    await expect(page.getByRole('heading', { name: 'Edit connection' })).toBeVisible();
+  });
+
+  test('unsaved-changes modal: Leave navigates away', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await page.goto('/storage/connections');
+    await waitForHydration(page);
+
+    await openFirstConnectionEditPage(page);
+
+    await page.getByLabel('Connection name').fill('Changed name');
+    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+
+    await page.getByRole('dialog').getByRole('button', { name: 'Leave' }).click();
+
+    await waitForHydration(page);
+    await expect(page).toHaveURL('/storage/connections');
+  });
+});
diff --git a/e2e/storage/context-menu.spec.ts b/e2e/storage/context-menu.spec.ts
index 27858f93..a9e961c0 100644
--- a/e2e/storage/context-menu.spec.ts
+++ b/e2e/storage/context-menu.spec.ts
@@ -115,7 +115,13 @@ test.describe('Storage S3 — Context Menu', () => {
         'copy name test'
       );
 
-      await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      // Playwright's grantPermissions for clipboard names only works in Chromium.
+      // Firefox rejects both 'clipboard-read' and 'clipboard-write' with "Unknown permission".
+      // In Firefox the clipboard write succeeds via user-gesture context without an explicit
+      // grant, but reading back via navigator.clipboard.readText() is not possible in tests.
+      if (browserName === 'chromium') {
+        await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      }
       await connectAndOpenPrefix(page, credentials, prefix);
 
       await rowByName(page, 'copy-name-test.txt').click({ button: 'right' });
@@ -123,8 +129,12 @@ test.describe('Storage S3 — Context Menu', () => {
 
       await expect(page.getByText('Filename copied to clipboard')).toBeVisible();
 
-      const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-      expect(clipboardText).toBe('copy-name-test.txt');
+      // clipboard.readText() requires the 'clipboard-read' permission which can only be granted
+      // in Chromium via Playwright — skip the read-back check in Firefox.
+      if (browserName === 'chromium') {
+        const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+        expect(clipboardText).toBe('copy-name-test.txt');
+      }
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
@@ -151,7 +161,10 @@ test.describe('Storage S3 — Context Menu', () => {
         'copy path test'
       );
 
-      await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      // See 'Copy filename' test above for explanation of the Chromium-only permission grant.
+      if (browserName === 'chromium') {
+        await context.grantPermissions(['clipboard-read', 'clipboard-write']);
+      }
       await connectAndOpenPrefix(page, credentials, prefix);
 
       await rowByName(page, 'copy-path-test.txt').click({ button: 'right' });
@@ -159,8 +172,11 @@ test.describe('Storage S3 — Context Menu', () => {
 
       await expect(page.getByText('Path copied to clipboard')).toBeVisible();
 
-      const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
-      expect(clipboardText).toBe(`s3://${credentials.bucket}/${prefix}copy-path-test.txt`);
+      // Skip clipboard read-back in Firefox — see 'Copy filename' test above.
+      if (browserName === 'chromium') {
+        const clipboardText = await page.evaluate(() => navigator.clipboard.readText());
+        expect(clipboardText).toBe(`s3://${credentials.bucket}/${prefix}copy-path-test.txt`);
+      }
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index a334d957..c6773503 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -59,6 +59,11 @@ export async function openConnectForm(page: Page) {
     (await disconnectButton.isVisible().catch(() => false))
   ) {
     await disconnectButton.click();
+    // A confirmation modal was added — confirm the disconnection if the modal appears.
+    const confirmButton = page.locator('.modal-box').getByRole('button', { name: 'Disconnect' });
+    if (await confirmButton.isVisible({ timeout: 2_000 }).catch(() => false)) {
+      await confirmButton.click();
+    }
   }
 
   await expect(connectHeading).toBeVisible();
@@ -66,12 +71,30 @@ export async function openConnectForm(page: Page) {
 
 export async function connectToStorage(page: Page, credentials: GarageCredentials) {
   await openConnectForm(page);
-  await page.getByLabel('Endpoint URL').fill(credentials.endpoint);
+  const url = new URL(credentials.endpoint);
+  const host = url.hostname;
+  const port = url.port;
+  const useTls = url.protocol === 'https:';
+
+  await page.getByLabel('Host').fill(host);
+  if (port) {
+    await page.getByLabel('Port').fill(port);
+  }
+  // Default TLS is on — uncheck it for plain HTTP endpoints
+  const tlsToggle = page.getByLabel('Use TLS');
+  if (!useTls && (await tlsToggle.isChecked())) {
+    await tlsToggle.uncheck();
+  }
+  // Default access style is VirtualHosted — switch to Path for Garage
+  await page.getByLabel('Access style').selectOption('Path');
   await page.getByLabel('Region').fill(credentials.region);
-  await page.getByLabel('Access key ID').fill(credentials.accessKeyId);
-  await page.getByLabel('Secret access key').fill(credentials.secretAccessKey);
-  await expect(page.getByLabel('Use path-style addressing')).toBeChecked();
+  await page.getByLabel('Access key').fill(credentials.accessKeyId);
+  await page.getByLabel('Secret key').fill(credentials.secretAccessKey);
   await page.getByRole('button', { name: 'Connect' }).click();
+  // Wait for the redirect to /storage so that saveConnectionLocally() has been called
+  // before the test navigates elsewhere. Without this, a fast page.goto() call can race
+  // with the in-flight form-submission fetch and the connection is never persisted.
+  await page.waitForURL((url) => url.pathname === '/storage', { timeout: 15_000 });
 }
 
 export async function connectAndOpenPrefix(
diff --git a/messages/de.json b/messages/de.json
index 97fc488d..477164f2 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -126,14 +126,21 @@
   "storage_connect_type": "Backend-Typ",
   "storage_connect_type_s3": "S3-kompatibel",
   "storage_connect_type_hdfs": "HDFS",
-  "storage_connect_endpoint": "Endpunkt-URL",
-  "storage_connect_endpoint_placeholder": "https://minio.beispiel.de:9000",
-  "storage_connect_endpoint_hint": "Leer lassen für AWS S3",
-  "storage_connect_path_style": "Path-Style-Adressierung verwenden",
-  "storage_connect_path_style_hint": "Für MinIO und die meisten selbst gehosteten S3-Anbieter aktivieren. Für Virtual-Hosted-Style deaktivieren.",
+  "storage_connect_host": "Host",
+  "storage_connect_host_placeholder": "minio.beispiel.de",
+  "storage_connect_port": "Port",
+  "storage_connect_port_placeholder": "9000",
+  "storage_connect_port_hint": "Leer lassen, um den Standardport für das Protokoll zu verwenden.",
+  "storage_connect_tls": "TLS verwenden",
+  "storage_connect_tls_hint": "Verbindung mit TLS/HTTPS verschlüsseln.",
+  "storage_connect_tls_verification": "Zertifikat prüfen",
+  "storage_connect_tls_verification_hint": "Deaktivieren, um selbstsignierte oder nicht vertrauenswürdige Zertifikate zu akzeptieren.",
+  "storage_connect_access_style": "Zugriffsstil",
+  "storage_connect_access_style_path": "Path",
+  "storage_connect_access_style_virtual_hosted": "Virtual hosted",
   "storage_connect_region": "Region",
-  "storage_connect_access_key": "Zugriffsschlüssel-ID",
-  "storage_connect_secret_key": "Geheimer Zugriffsschlüssel",
+  "storage_connect_access_key": "Zugriffsschlüssel",
+  "storage_connect_secret_key": "Geheimer Schlüssel",
   "storage_connect_submit": "Verbinden",
   "storage_connect_reconnecting": "Verbindung zum Speicher wird wiederhergestellt…",
   "storage_connect_timeout": "Zeitüberschreitung der Verbindung. Das Speicher-Backend hat nicht geantwortet.",
@@ -141,10 +148,41 @@
   "storage_connect_error": "Verbindung fehlgeschlagen — Endpunkt und Zugangsdaten prüfen.",
   "storage_connect_saved": "Gespeicherte Verbindungen",
   "storage_connect_no_saved": "Noch keine gespeicherten Verbindungen",
-  "storage_connect_forget": "Vergessen",
-  "storage_connect_forget_confirm": "{endpoint} aus den gespeicherten Verbindungen entfernen?",
+  "storage_connect_forget": "Löschen",
+  "storage_connect_forget_confirm": "{endpoint} aus den gespeicherten Verbindungen löschen?",
   "storage_connect_forget_cancel": "Abbrechen",
-  "storage_connect_forget_label": "Verbindung zu {endpoint} vergessen",
+  "storage_connect_forget_label": "Verbindung zu {endpoint} löschen",
+  "storage_connect_copy": "Kopieren",
+  "storage_connect_copied": "Kopiert",
+  "storage_connect_copy_all": "Alles kopieren",
+  "storage_connect_manage": "Verbindungen verwalten",
+  "storage_connect_edit": "Bearbeiten",
+  "storage_connections_col_name": "Verbindung",
+  "storage_connections_col_host": "Host",
+  "storage_connections_col_type": "Typ",
+  "storage_connections_back": "Zurück zum Verbinden",
+  "storage_connections_options": "Optionen für {label}",
+  "storage_connections_title": "Verbindungen verwalten",
+  "storage_connections_subtitle": "Gespeicherte Speicherverbindungen bearbeiten oder entfernen.",
+  "storage_connections_empty": "Noch keine gespeicherten Verbindungen.",
+  "storage_connections_edit": "Bearbeiten",
+  "storage_connections_delete": "Löschen",
+  "storage_connections_delete_confirm": "\u201e{label}\u201c aus den gespeicherten Verbindungen entfernen? Dies kann nicht rückgängig gemacht werden.",
+  "storage_connections_delete_cancel": "Abbrechen",
+  "storage_connections_delete_confirm_button": "Löschen",
+  "storage_connection_edit_title": "Verbindung bearbeiten",
+  "storage_connection_edit_name": "Verbindungsname",
+  "storage_connection_edit_name_placeholder": "z. B. Produktions-Garage",
+  "storage_connection_edit_name_hint": "Optional. Wird auf der Verbindungskachel anstelle des Hostnamens angezeigt.",
+  "storage_connection_edit_save": "Änderungen speichern",
+  "storage_connection_edit_credentials_hint": "Leer lassen, um die aktuellen Anmeldedaten beizubehalten.",
+  "storage_connection_edit_success": "Verbindung erfolgreich aktualisiert.",
+  "storage_connection_edit_active_notice": "Sie sind derzeit mit dieser Verbindung verbunden.",
+  "storage_connection_edit_not_found": "Verbindung nicht gefunden.",
+  "storage_connection_edit_unsaved_title": "Nicht gespeicherte Änderungen",
+  "storage_connection_edit_unsaved_body": "Sie haben nicht gespeicherte Änderungen. Wenn Sie jetzt die Seite verlassen, gehen Ihre Änderungen verloren.",
+  "storage_connection_edit_unsaved_leave": "Verlassen",
+  "storage_connection_edit_unsaved_stay": "Auf der Seite bleiben",
   "storage_disconnect": "Verbindung Trennen",
   "storage_disconnect_confirm_title": "Speicherverbindung trennen?",
   "storage_disconnect_confirm_message": "Sie werden zum Verbindungsbildschirm zurückgeleitet.",
@@ -199,8 +237,10 @@
   "storage_action_unpin": "Loslösen",
   "storage_action_copy_filename": "Dateiname kopieren",
   "storage_action_copy_filename_success": "Dateiname in die Zwischenablage kopiert.",
+  "storage_action_copy_filename_error": "Dateiname konnte nicht in die Zwischenablage kopiert werden.",
   "storage_action_copy_path": "Pfad kopieren",
   "storage_action_copy_path_success": "Pfad in die Zwischenablage kopiert.",
+  "storage_action_copy_path_error": "Pfad konnte nicht in die Zwischenablage kopiert werden.",
   "storage_pinned_label": "Angeheftete Orte",
   "storage_more_options": "Weitere Optionen",
   "storage_recent_files": "Zuletzt geöffnete Dateien",
diff --git a/messages/en.json b/messages/en.json
index 254b7de2..59d79748 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -126,14 +126,21 @@
   "storage_connect_type": "Backend type",
   "storage_connect_type_s3": "S3-compatible",
   "storage_connect_type_hdfs": "HDFS",
-  "storage_connect_endpoint": "Endpoint URL",
-  "storage_connect_endpoint_placeholder": "https://minio.example.com:9000",
-  "storage_connect_endpoint_hint": "Leave blank to use AWS S3",
-  "storage_connect_path_style": "Use path-style addressing",
-  "storage_connect_path_style_hint": "Enable for MinIO and most self-hosted S3 providers. Disable for virtual-hosted-style access.",
+  "storage_connect_host": "Host",
+  "storage_connect_host_placeholder": "minio.example.com",
+  "storage_connect_port": "Port",
+  "storage_connect_port_placeholder": "9000",
+  "storage_connect_port_hint": "Leave blank to use the default port for the protocol.",
+  "storage_connect_tls": "Use TLS",
+  "storage_connect_tls_hint": "Encrypt the connection with TLS/HTTPS.",
+  "storage_connect_tls_verification": "Verify certificate",
+  "storage_connect_tls_verification_hint": "Disable to accept self-signed or untrusted certificates.",
+  "storage_connect_access_style": "Access style",
+  "storage_connect_access_style_path": "Path",
+  "storage_connect_access_style_virtual_hosted": "Virtual hosted",
   "storage_connect_region": "Region",
-  "storage_connect_access_key": "Access key ID",
-  "storage_connect_secret_key": "Secret access key",
+  "storage_connect_access_key": "Access key",
+  "storage_connect_secret_key": "Secret key",
   "storage_connect_submit": "Connect",
   "storage_connect_reconnecting": "Reconnecting to storage…",
   "storage_connect_timeout": "Connection timed out. The storage backend did not respond.",
@@ -141,10 +148,41 @@
   "storage_connect_error": "Could not connect — check the endpoint and credentials.",
   "storage_connect_saved": "Saved connections",
   "storage_connect_no_saved": "No saved connections yet",
-  "storage_connect_forget": "Forget",
-  "storage_connect_forget_confirm": "Remove {endpoint} from saved connections?",
+  "storage_connect_forget": "Delete",
+  "storage_connect_forget_confirm": "Delete {endpoint} from saved connections?",
   "storage_connect_forget_cancel": "Cancel",
-  "storage_connect_forget_label": "Forget connection to {endpoint}",
+  "storage_connect_forget_label": "Delete connection to {endpoint}",
+  "storage_connect_copy": "Copy",
+  "storage_connect_copied": "Copied",
+  "storage_connect_copy_all": "Copy all",
+  "storage_connect_manage": "Manage connections",
+  "storage_connect_edit": "Edit",
+  "storage_connections_col_name": "Connection",
+  "storage_connections_col_host": "Host",
+  "storage_connections_col_type": "Type",
+  "storage_connections_back": "Back to connect",
+  "storage_connections_options": "Options for {label}",
+  "storage_connections_title": "Manage connections",
+  "storage_connections_subtitle": "Edit or remove your saved storage connections.",
+  "storage_connections_empty": "No saved connections yet.",
+  "storage_connections_edit": "Edit",
+  "storage_connections_delete": "Delete",
+  "storage_connections_delete_confirm": "Remove \u201c{label}\u201d from saved connections? This cannot be undone.",
+  "storage_connections_delete_cancel": "Cancel",
+  "storage_connections_delete_confirm_button": "Delete",
+  "storage_connection_edit_title": "Edit connection",
+  "storage_connection_edit_name": "Connection name",
+  "storage_connection_edit_name_placeholder": "e.g. Production Garage",
+  "storage_connection_edit_name_hint": "Optional. Shown on the connection tile instead of the hostname.",
+  "storage_connection_edit_save": "Save changes",
+  "storage_connection_edit_credentials_hint": "Leave blank to keep the current credentials.",
+  "storage_connection_edit_success": "Connection updated successfully.",
+  "storage_connection_edit_active_notice": "You are currently connected with this connection.",
+  "storage_connection_edit_not_found": "Connection not found.",
+  "storage_connection_edit_unsaved_title": "Unsaved changes",
+  "storage_connection_edit_unsaved_body": "You have unsaved changes. If you leave now, your changes will be lost.",
+  "storage_connection_edit_unsaved_leave": "Leave",
+  "storage_connection_edit_unsaved_stay": "Stay on page",
   "storage_disconnect": "Disconnect",
   "storage_disconnect_confirm_title": "Disconnect from storage?",
   "storage_disconnect_confirm_message": "You will be returned to the connection screen.",
@@ -199,8 +237,10 @@
   "storage_action_unpin": "Unpin",
   "storage_action_copy_filename": "Copy filename",
   "storage_action_copy_filename_success": "Filename copied to clipboard.",
+  "storage_action_copy_filename_error": "Could not copy filename to clipboard.",
   "storage_action_copy_path": "Copy path",
   "storage_action_copy_path_success": "Path copied to clipboard.",
+  "storage_action_copy_path_error": "Could not copy path to clipboard.",
   "storage_pinned_label": "Pinned Access",
   "storage_more_options": "More options",
   "storage_recent_files": "Recent Files",
diff --git a/package-lock.json b/package-lock.json
index 47842151..9c2037c9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,6 +12,7 @@
         "@aws-sdk/client-s3": "^3.1041.0",
         "@aws-sdk/lib-storage": "^3.1045.0",
         "@internationalized/date": "^3.11.0",
+        "@smithy/node-http-handler": "4.9.1",
         "adm-zip": "^0.5.17",
         "antlr4-c3": "^3.4.4",
         "antlr4ng": "^3.0.16",
@@ -2947,12 +2948,11 @@
       "license": "MIT"
     },
     "node_modules/@smithy/core": {
-      "version": "3.26.0",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.26.0.tgz",
-      "integrity": "sha512-mLUktFAn+Pa2agl1J7VgtYNFWCX8/b4GMJSK1hCu4YCvtBfM6F8Os3EP4ry+DFFlXOf3wyvlgXhuUdFoy52D3g==",
+      "version": "3.28.0",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.28.0.tgz",
+      "integrity": "sha512-N/LoLG8pZ1zv5cIWpdF6vmSjtZtXKK9G0OqT5yYCOZU+CzPq1+nYA95VoKJBGWRScs7YbMugZ7lZx8Fj1vdHoA==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-crypto/crc32": "5.2.0",
         "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
@@ -3001,12 +3001,12 @@
       }
     },
     "node_modules/@smithy/node-http-handler": {
-      "version": "4.8.2",
-      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.8.2.tgz",
-      "integrity": "sha512-wfl1uwrAqMH9/pi4kqBo5LBcFwrJLxuDLqL7p7qNcJIFcyZDUc6pzhYk4CYv+DP7fIUpQCZumwNnkhPKS52osQ==",
+      "version": "4.9.1",
+      "resolved": "https://registry.npmjs.org/@smithy/node-http-handler/-/node-http-handler-4.9.1.tgz",
+      "integrity": "sha512-m/f15di58P6NtLQ7eVEb5N19NdJWn+4c7zfkFHMT/i3JH7U8UtknpPoy8o2tm2R3OdliYvsvQhZHIfACQDqT+Q==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.26.0",
+        "@smithy/core": "^3.28.0",
         "@smithy/types": "^4.15.0",
         "tslib": "^2.6.2"
       },
diff --git a/package.json b/package.json
index e843e7f1..00ac761f 100644
--- a/package.json
+++ b/package.json
@@ -76,6 +76,7 @@
     "@aws-sdk/client-s3": "^3.1041.0",
     "@aws-sdk/lib-storage": "^3.1045.0",
     "@internationalized/date": "^3.11.0",
+    "@smithy/node-http-handler": "4.9.1",
     "adm-zip": "^0.5.17",
     "antlr4-c3": "^3.4.4",
     "antlr4ng": "^3.0.16",
diff --git a/src/lib/components/storage/DeleteConnectionModal.svelte b/src/lib/components/storage/DeleteConnectionModal.svelte
new file mode 100644
index 00000000..39d33390
--- /dev/null
+++ b/src/lib/components/storage/DeleteConnectionModal.svelte
@@ -0,0 +1,142 @@
+<script lang="ts">
+  import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconCheck from 'virtual:icons/material-symbols/check';
+  import Modal from '$lib/components/Modal.svelte';
+  import * as m from '$lib/paraglide/messages.js';
+  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+
+  interface Props {
+    open: boolean;
+    connection: SavedConnection | null;
+    onconfirm: () => void;
+    oncancel: () => void;
+  }
+
+  let { open = $bindable(), connection, onconfirm, oncancel }: Props = $props();
+
+  let copiedField: string | null = $state(null);
+
+  function connectionLabel(conn: SavedConnection): string {
+    if (conn.name) return conn.name;
+    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+  }
+
+  function copyField(value: string, field: string) {
+    navigator.clipboard.writeText(value);
+    copiedField = field;
+    setTimeout(() => {
+      copiedField = null;
+    }, 1500);
+  }
+
+  function copyAll(conn: SavedConnection) {
+    const host = conn.port ? `${conn.host}:${conn.port}` : conn.host;
+    const lines = [
+      `Host:        ${host}`,
+      `Type:        ${m.storage_connect_type_s3()}`,
+      ...(conn.credentials?.accessKey ? [`Access key:  ${conn.credentials.accessKey}`] : []),
+      `Region:      ${conn.region.name}`
+    ];
+    navigator.clipboard.writeText(lines.join('\n'));
+    copiedField = 'all';
+    setTimeout(() => {
+      copiedField = null;
+    }, 1500);
+  }
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box max-w-lg">
+    {#if connection}
+      <p class="text-base-content mb-4 font-medium">
+        {m.storage_connections_delete_confirm({ label: connectionLabel(connection) })}
+      </p>
+      <div class="rounded-box border-base-content/5 bg-base-100 overflow-x-auto border">
+        <table class="table-sm table">
+          <tbody>
+            {#snippet copyBtn(value: string, field: string)}
+              <button
+                type="button"
+                class="btn btn-ghost btn-xs btn-square"
+                aria-label={copiedField === field
+                  ? m.storage_connect_copied()
+                  : m.storage_connect_copy()}
+                onclick={() => copyField(value, field)}
+              >
+                {#if copiedField === field}
+                  <IconCheck class="text-success h-4 w-4" />
+                {:else}
+                  <IconContentCopy class="h-4 w-4" />
+                {/if}
+              </button>
+            {/snippet}
+            <tr>
+              <th>{m.storage_connect_host()}</th>
+              <td class="border-base-content/10 border-l">
+                <div class="flex items-center justify-between gap-2">
+                  <span class="font-mono">
+                    {connection.port ? `${connection.host}:${connection.port}` : connection.host}
+                  </span>
+                  {@render copyBtn(
+                    connection.port ? `${connection.host}:${connection.port}` : connection.host,
+                    'host'
+                  )}
+                </div>
+              </td>
+            </tr>
+            <tr>
+              <th>{m.storage_connect_type()}</th>
+              <td class="border-base-content/10 border-l">
+                <div class="flex items-center justify-between gap-2">
+                  <span>{m.storage_connect_type_s3()}</span>
+                  {@render copyBtn(m.storage_connect_type_s3(), 'type')}
+                </div>
+              </td>
+            </tr>
+            {#if connection.credentials?.accessKey}
+              <tr>
+                <th>{m.storage_connect_access_key()}</th>
+                <td class="border-base-content/10 border-l">
+                  <div class="flex items-center justify-between gap-2">
+                    <span class="font-mono">{connection.credentials.accessKey}</span>
+                    {@render copyBtn(connection.credentials.accessKey, 'accessKey')}
+                  </div>
+                </td>
+              </tr>
+            {/if}
+            <tr>
+              <th>{m.storage_connect_region()}</th>
+              <td class="border-base-content/10 border-l">
+                <div class="flex items-center justify-between gap-2">
+                  <span class="font-mono">{connection.region.name}</span>
+                  {@render copyBtn(connection.region.name, 'region')}
+                </div>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    {/if}
+    <div class="modal-action">
+      <button
+        type="button"
+        class="btn btn-ghost btn-sm mr-auto"
+        onclick={() => connection && copyAll(connection)}
+      >
+        {#if copiedField === 'all'}
+          <IconCheck class="text-success h-4 w-4" />
+          {m.storage_connect_copied()}
+        {:else}
+          <IconContentCopy class="h-4 w-4" />
+          {m.storage_connect_copy_all()}
+        {/if}
+      </button>
+      <button type="button" class="btn btn-ghost btn-sm" onclick={oncancel}>
+        {m.storage_connections_delete_cancel()}
+      </button>
+      <button type="button" class="btn btn-error btn-sm" onclick={onconfirm}>
+        {m.storage_connections_delete_confirm_button()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 82bd9853..7fa912cd 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -36,7 +36,7 @@
       <!-- Column headers -->
       <tr
         class="
-          bg-base-200 text-base-content/50 text-xs tracking-wide uppercase
+          bg-base-200 text-base-content/50 z-10 text-xs tracking-wide uppercase
         "
       >
         <th class="w-8 pr-0">
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
index d78bad36..fd0254d3 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -17,7 +17,7 @@
   );
 </script>
 
-<tr class="border-primary/20 bg-primary/5 border-t">
+<tr class="border-primary/20 bg-primary/5 z-30 border-t">
   <th colspan={5} class="px-4 py-1.5 font-normal">
     <div class="flex items-center gap-1">
       <span class="text-base-content/50 mr-1 text-xs">
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
index 9a8fd11d..2e86509d 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import ContextMenuWrapper from './__tests__/ContextMenuWrapper.svelte';
+import ContextMenuWrapper from './ContextMenuWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FileExplorer.svelte.spec.ts
similarity index 98%
rename from src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/FileExplorer.svelte.spec.ts
index a412b677..2c31faee 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FileExplorer.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import FileExplorerWrapper from './__tests__/FileExplorerWrapper.svelte';
+import FileExplorerWrapper from './FileExplorerWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/FileRow.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
index a96395da..2e88b9b5 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import FileRowWrapper from './__tests__/FileRowWrapper.svelte';
+import FileRowWrapper from './FileRowWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FolderRow.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/FolderRow.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/FolderRow.svelte.spec.ts
index 1b5d4a3d..c0fc22c5 100644
--- a/src/lib/components/storage/explorer/FolderRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FolderRow.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import FolderRowWrapper from './__tests__/FolderRowWrapper.svelte';
+import FolderRowWrapper from './FolderRowWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/ObjectTable.svelte.spec.ts
similarity index 98%
rename from src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/ObjectTable.svelte.spec.ts
index e3024235..a2c31542 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/ObjectTable.svelte.spec.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import { SvelteSet } from 'svelte/reactivity';
-import ObjectTableWrapper from './__tests__/ObjectTableWrapper.svelte';
+import ObjectTableWrapper from './ObjectTableWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
similarity index 98%
rename from src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
index e37f7750..ecb33bd2 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/SelectionToolbar.svelte.spec.ts
@@ -2,7 +2,7 @@ import { page } from 'vitest/browser';
 import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { SvelteSet } from 'svelte/reactivity';
-import SelectionToolbarWrapper from './__tests__/SelectionToolbarWrapper.svelte';
+import SelectionToolbarWrapper from './SelectionToolbarWrapper.svelte';
 import type { StorageObject } from '$lib/storage/types.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
similarity index 99%
rename from src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
rename to src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
index a574943a..36a8f079 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
@@ -2,7 +2,7 @@ import { page } from 'vitest/browser';
 import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
-import StorageBreadcrumbWrapper from './__tests__/StorageBreadcrumbWrapper.svelte';
+import StorageBreadcrumbWrapper from './StorageBreadcrumbWrapper.svelte';
 import { StorageState } from '$lib/storage/state.svelte.js';
 import { TabsState } from '$lib/storage/tabs.svelte.js';
 import type { StorageObject } from '$lib/storage/types.js';
diff --git a/src/lib/components/storage/landing/RecentItems.svelte.spec.ts b/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
index a84e92cf..bba51986 100644
--- a/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
+++ b/src/lib/components/storage/landing/RecentItems.svelte.spec.ts
@@ -11,7 +11,8 @@ function makeRecentFile(overrides: Partial<RecentFile> = {}): RecentFile {
     key: overrides.key ?? `folder/${faker.system.fileName()}`,
     bucket: overrides.bucket ?? 'test-bucket',
     size: overrides.size ?? faker.number.int({ min: 100, max: 1_000_000 }),
-    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString()
+    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString(),
+    connectionId: overrides.connectionId ?? 'test-conn-id'
   };
 }
 
@@ -19,7 +20,8 @@ function makeRecentLocation(overrides: Partial<RecentLocation> = {}): RecentLoca
   return {
     bucket: overrides.bucket ?? 'test-bucket',
     prefix: overrides.prefix ?? `${faker.word.noun()}/`,
-    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString()
+    visitedAt: overrides.visitedAt ?? faker.date.recent().toISOString(),
+    connectionId: overrides.connectionId ?? 'test-conn-id'
   };
 }
 
@@ -29,7 +31,11 @@ function createState(
     recentLocations?: RecentLocation[];
   } = {}
 ): StorageState {
-  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  const state = new StorageState({
+    connected: true,
+    buckets: ['test-bucket'],
+    connectionId: 'test-conn-id'
+  });
   state.bucket = 'test-bucket';
   state.prefix = '';
   if (opts.recentFiles) {
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte b/src/lib/components/storage/landing/StorageConnectForm.svelte
index c2ed4e5a..687cfc1d 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte
@@ -3,25 +3,21 @@
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
   import { onMount, onDestroy, tick, untrack } from 'svelte';
-  import IconClose from 'virtual:icons/material-symbols/close';
-  import IconStorage from 'virtual:icons/material-symbols/storage';
   import * as m from '$lib/paraglide/messages.js';
   import { StorageConnectionSchema } from '$lib/storage/schemas.js';
   import {
     saveConnectionLocally,
     loadConnectionLocally,
-    loadAllConnectionsLocally,
-    removeConnectionLocally
+    type SavedConnection
   } from '$lib/storage/connection-storage.js';
   import {
     storageAutoConnectEnabled,
     storageAutoConnectTimeoutMs
   } from '$lib/client/feature-flags.js';
   import { addToast } from '$lib/stores/toast.svelte.js';
+  import StorageConnectionSidebar from '$lib/components/storage/sidebar/StorageConnectionSidebar.svelte';
   import type { z } from 'zod';
 
-  type StoredConnection = z.infer<typeof StorageConnectionSchema>;
-
   interface Props {
     connectionForm: SuperValidated<z.infer<typeof StorageConnectionSchema>, string>;
   }
@@ -32,17 +28,13 @@
 
   let formRef: HTMLFormElement | null = $state(null);
   let autoConnecting = $state(false);
-  let allConnections: StoredConnection[] = $state([]);
-  let connectionsLoaded = $state(false);
-
-  /** Connection pending the "Forget" confirmation. */
-  let forgetCandidate: StoredConnection | null = $state(null);
 
   let connectTimeout: ReturnType<typeof setTimeout> | null = $state(null);
 
   const { form, errors, enhance, submitting, message } = superForm(
     untrack(() => connectionForm),
     {
+      dataType: 'json',
       validators: zod(StorageConnectionSchema),
       onResult: ({ result }) => {
         if (connectTimeout) {
@@ -58,34 +50,30 @@
     }
   );
 
-  /** Display label for a saved connection (hostname or "AWS S3"). */
-  function connectionLabel(conn: StoredConnection): string {
-    if (conn.endpoint) {
-      try {
-        return new URL(conn.endpoint).hostname;
-      } catch {
-        return conn.endpoint;
-      }
-    }
-    return 'AWS S3';
-  }
-
-  /** Fill the form with a saved connection and immediately submit. */
-  function selectConnection(conn: StoredConnection) {
+  function selectConnection(conn: SavedConnection) {
+    $form.id = conn.id;
+    $form.name = conn.name ?? '';
     $form.type = conn.type;
-    $form.endpoint = conn.endpoint ?? '';
-    $form.pathStyle = conn.pathStyle ?? true;
+    $form.host = conn.host;
+    $form.port = conn.port;
+    $form.tls = conn.tls;
+    $form.accessStyle = conn.accessStyle;
     $form.region = conn.region;
-    $form.accessKeyId = conn.accessKeyId ?? '';
-    $form.secretAccessKey = conn.secretAccessKey ?? '';
+    $form.credentials = conn.credentials;
     tick().then(() => formRef?.requestSubmit());
   }
 
-  /** Forget a connection from local storage and refresh the list. */
-  function forgetConnection(conn: StoredConnection) {
-    removeConnectionLocally(conn);
-    allConnections = loadAllConnectionsLocally();
-    forgetCandidate = null;
+  function parseHostInput() {
+    const v = $form.host?.trim();
+    if (!v?.includes('://')) return;
+    try {
+      const url = new URL(v);
+      $form.host = url.hostname;
+      if (url.port) $form.port = Number(url.port);
+      $form.tls = url.protocol === 'https:' ? { verification: 'Full' } : undefined;
+    } catch {
+      // Not a parseable URL — leave unchanged
+    }
   }
 
   /** Cancel an in-progress auto-connect attempt. */
@@ -98,19 +86,19 @@
   }
 
   onMount(() => {
-    allConnections = loadAllConnectionsLocally();
-    connectionsLoaded = true;
     const params = new URLSearchParams(window.location.search);
     if (!storageAutoConnectEnabled || params.has('disconnected')) return;
     const saved = loadConnectionLocally();
     if (saved) {
       autoConnecting = true;
+      $form.id = saved.id;
       $form.type = saved.type;
-      $form.endpoint = saved.endpoint ?? '';
-      $form.pathStyle = saved.pathStyle ?? true;
+      $form.host = saved.host;
+      $form.port = saved.port;
+      $form.tls = saved.tls;
+      $form.accessStyle = saved.accessStyle;
       $form.region = saved.region;
-      $form.accessKeyId = saved.accessKeyId ?? '';
-      $form.secretAccessKey = saved.secretAccessKey ?? '';
+      $form.credentials = saved.credentials;
       tick().then(() => {
         formRef?.requestSubmit();
         connectTimeout = setTimeout(() => {
@@ -129,235 +117,204 @@
   });
 </script>
 
-<div class="mx-auto max-w-md p-6">
-  {#if autoConnecting}
-    <div class="flex flex-col items-center gap-3 py-8">
-      <span class="loading loading-spinner loading-md"></span>
-      <p class="text-base-content/60 text-sm">{m.storage_connect_reconnecting()}</p>
-      <button type="button" class="btn btn-ghost btn-sm mt-2" onclick={cancelAutoConnect}>
-        {m.storage_connect_cancel()}
-      </button>
-    </div>
-  {/if}
+{#if autoConnecting}
+  <div class="flex flex-col items-center gap-3 py-8">
+    <span class="loading loading-spinner loading-md"></span>
+    <p class="text-base-content/60 text-sm">{m.storage_connect_reconnecting()}</p>
+    <button type="button" class="btn btn-ghost btn-sm mt-2" onclick={cancelAutoConnect}>
+      {m.storage_connect_cancel()}
+    </button>
+  </div>
+{:else}
+  <div class="flex flex-col gap-4 md:flex-row md:items-start">
+    <StorageConnectionSidebar onselect={selectConnection} />
 
-  <div class:hidden={autoConnecting}>
-    <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
-    <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+    <div class="min-w-0 flex-1">
+      <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
+      <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
 
-    <div
-      class="mb-6 h-24 {connectionsLoaded && allConnections.length === 0
-        ? 'bg-base-200 flex items-center justify-center rounded-xl'
-        : ''}"
-    >
-      {#if !connectionsLoaded}
-        <div class="flex h-full items-center justify-center">
-          <span class="loading loading-spinner loading-sm text-base-content/40"></span>
+      <form
+        bind:this={formRef}
+        method="POST"
+        action="?/connect"
+        use:enhance
+        class="flex flex-col gap-4"
+      >
+        <div>
+          <label for="{uid}-type" class="label mb-1 text-sm font-medium">
+            {m.storage_connect_type()}
+          </label>
+          <select
+            id="{uid}-type"
+            name="type"
+            class="select-bordered select w-full"
+            bind:value={$form.type}
+          >
+            <option value="s3">{m.storage_connect_type_s3()}</option>
+            <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
+          </select>
         </div>
-      {:else if allConnections.length > 0}
-        <p class="text-base-content/50 mb-2 text-xs font-semibold tracking-wide uppercase">
-          {m.storage_connect_saved()}
-        </p>
-        <div
-          class="flex flex-nowrap gap-2 overflow-x-auto overflow-y-visible pt-2 pb-1"
-          role="list"
-          aria-label={m.storage_connect_saved()}
-        >
-          {#each [...allConnections].reverse() as conn (conn.type + '|' + (conn.endpoint ?? '') + '|' + (conn.accessKeyId ?? ''))}
-            <div class="relative shrink-0" role="listitem">
-              <button
-                type="button"
-                onclick={() => selectConnection(conn)}
-                class="
-                  border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5
-                  focus-visible:outline-primary flex flex-col items-center gap-1.5 rounded-xl border
-                  p-3 text-center transition-colors
-                "
-                title={connectionLabel(conn)}
-              >
-                <IconStorage class="text-primary size-8" aria-hidden="true" />
-                <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
-              </button>
-              <button
-                type="button"
-                aria-label={m.storage_connect_forget_label({ endpoint: connectionLabel(conn) })}
-                onclick={(e) => {
-                  e.stopPropagation();
-                  forgetCandidate = conn;
-                }}
-                class="
-                  border-base-300 bg-base-100 text-error hover:bg-error hover:text-error-content
-                  absolute -top-2 -right-2 flex size-5 items-center justify-center
-                  rounded-full border shadow-sm transition-colors
-                "
-              >
-                <IconClose class="size-3" aria-hidden="true" />
-              </button>
-            </div>
-          {/each}
+
+        <div>
+          <label for="{uid}-host" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_host()}</label
+          >
+          <input
+            id="{uid}-host"
+            name="host"
+            type="text"
+            class={['input-bordered input w-full', $errors?.host && 'input-error']}
+            placeholder={m.storage_connect_host_placeholder()}
+            bind:value={$form.host}
+            onblur={parseHostInput}
+          />
+          {#if $errors?.host}
+            <p class="text-error mt-1 text-xs">{$errors.host}</p>
+          {/if}
         </div>
-      {:else}
-        <p class="text-base-content/50 text-sm">{m.storage_connect_no_saved()}</p>
-      {/if}
-    </div>
-  </div>
 
-  <form
-    bind:this={formRef}
-    method="POST"
-    action="?/connect"
-    use:enhance
-    class:hidden={autoConnecting}
-    class="
-    flex flex-col gap-4
-  "
-  >
-    <!-- Backend type -->
-    <div>
-      <label for="{uid}-type" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_type()}
-      </label>
-      <select
-        id="{uid}-type"
-        name="type"
-        class="select-bordered select w-full"
-        bind:value={$form.type}
-      >
-        <option value="s3">{m.storage_connect_type_s3()}</option>
-        <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
-      </select>
-    </div>
+        <div>
+          <label for="{uid}-port" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_port()}</label
+          >
+          <input
+            id="{uid}-port"
+            name="port"
+            type="number"
+            min="1"
+            max="65535"
+            class={['input-bordered input w-full', $errors?.port && 'input-error']}
+            placeholder={m.storage_connect_port_placeholder()}
+            bind:value={$form.port}
+          />
+          <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_port_hint()}</p>
+          {#if $errors?.port}
+            <p class="text-error mt-1 text-xs">{$errors.port}</p>
+          {/if}
+        </div>
 
-    <!-- Endpoint URL -->
-    <div>
-      <label for="{uid}-endpoint" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_endpoint()}
-      </label>
-      <input
-        id="{uid}-endpoint"
-        name="endpoint"
-        type="url"
-        class="
-          input-bordered input w-full
-          {$errors?.endpoint ? 'input-error' : ''}"
-        placeholder={m.storage_connect_endpoint_placeholder()}
-        bind:value={$form.endpoint}
-      />
-      <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_endpoint_hint()}</p>
-      {#if $errors?.endpoint}
-        <p class="text-error mt-1 text-xs">{$errors?.endpoint}</p>
-      {/if}
-    </div>
+        <div class="flex items-start justify-between gap-4">
+          <div>
+            <label for="{uid}-tls" class="label text-sm font-medium"
+              >{m.storage_connect_tls()}</label
+            >
+            <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_tls_hint()}</p>
+          </div>
+          <input
+            id="{uid}-tls"
+            type="checkbox"
+            class="toggle toggle-primary mt-1 shrink-0"
+            checked={!!$form.tls}
+            onchange={(e) => {
+              $form.tls = e.currentTarget.checked ? { verification: 'Full' } : undefined;
+            }}
+          />
+        </div>
 
-    <!-- Path-style addressing -->
-    <div class="flex items-start justify-between gap-4">
-      <div>
-        <label for="{uid}-path-style" class="label text-sm font-medium">
-          {m.storage_connect_path_style()}
-        </label>
-        <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_path_style_hint()}</p>
-      </div>
-      <input
-        id="{uid}-path-style"
-        name="pathStyle"
-        type="checkbox"
-        class="toggle toggle-primary mt-1 shrink-0"
-        bind:checked={$form.pathStyle}
-      />
-    </div>
+        {#if $form.tls}
+          <div class="flex items-start justify-between gap-4 pl-4">
+            <div>
+              <label for="{uid}-tls-verification" class="label text-sm font-medium">
+                {m.storage_connect_tls_verification()}
+              </label>
+              <p class="text-base-content/50 mt-0.5 text-xs">
+                {m.storage_connect_tls_verification_hint()}
+              </p>
+            </div>
+            <input
+              id="{uid}-tls-verification"
+              type="checkbox"
+              class="toggle toggle-primary mt-1 shrink-0"
+              checked={$form.tls.verification === 'Full'}
+              onchange={(e) => {
+                $form.tls = { verification: e.currentTarget.checked ? 'Full' : 'None' };
+              }}
+            />
+          </div>
+        {/if}
 
-    <!-- Region -->
-    <div>
-      <label for="{uid}-region" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_region()}
-      </label>
-      <input
-        id="{uid}-region"
-        name="region"
-        type="text"
-        class="
-          input-bordered input w-full
-          {$errors?.region ? 'input-error' : ''}"
-        bind:value={$form.region}
-      />
-      {#if $errors?.region}
-        <p class="text-error mt-1 text-xs">{$errors?.region}</p>
-      {/if}
-    </div>
+        <div>
+          <label for="{uid}-access-style" class="label mb-1 text-sm font-medium">
+            {m.storage_connect_access_style()}
+          </label>
+          <select
+            id="{uid}-access-style"
+            name="accessStyle"
+            class="select-bordered select w-full"
+            bind:value={$form.accessStyle}
+          >
+            <option value="Path">{m.storage_connect_access_style_path()}</option>
+            <option value="VirtualHosted">{m.storage_connect_access_style_virtual_hosted()}</option>
+          </select>
+        </div>
 
-    <!-- Access key ID -->
-    <div>
-      <label for="{uid}-access-key" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_access_key()}
-      </label>
-      <input
-        id="{uid}-access-key"
-        name="accessKeyId"
-        type="text"
-        class="
-          input-bordered input w-full
-          {$errors?.accessKeyId ? 'input-error' : ''}"
-        autocomplete="username"
-        bind:value={$form.accessKeyId}
-      />
-      {#if $errors?.accessKeyId}
-        <p class="text-error mt-1 text-xs">{$errors?.accessKeyId}</p>
-      {/if}
-    </div>
+        <div>
+          <label for="{uid}-region" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_region()}</label
+          >
+          <input
+            id="{uid}-region"
+            name="region.name"
+            type="text"
+            class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
+            bind:value={$form.region.name}
+          />
+          {#if $errors?.region?.name}
+            <p class="text-error mt-1 text-xs">{$errors.region.name}</p>
+          {/if}
+        </div>
 
-    <!-- Secret access key -->
-    <div>
-      <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium">
-        {m.storage_connect_secret_key()}
-      </label>
-      <input
-        id="{uid}-secret-key"
-        name="secretAccessKey"
-        type="password"
-        class="
-          input-bordered input w-full
-          {$errors?.secretAccessKey ? `input-error` : ''}"
-        autocomplete="current-password"
-        bind:value={$form.secretAccessKey}
-      />
-      {#if $errors?.secretAccessKey}
-        <p class="text-error mt-1 text-xs">{$errors?.secretAccessKey}</p>
-      {/if}
-    </div>
+        <div>
+          <label for="{uid}-access-key" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_access_key()}</label
+          >
+          <input
+            id="{uid}-access-key"
+            name="credentials.accessKey"
+            type="text"
+            class={[
+              'input-bordered input w-full',
+              $errors?.credentials?.accessKey && 'input-error'
+            ]}
+            autocomplete="username"
+            bind:value={$form.credentials.accessKey}
+          />
+          {#if $errors?.credentials?.accessKey}
+            <p class="text-error mt-1 text-xs">{$errors.credentials.accessKey}</p>
+          {/if}
+        </div>
 
-    {#if $message}
-      <p class="text-error text-sm">{$message}</p>
-    {/if}
+        <div>
+          <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium"
+            >{m.storage_connect_secret_key()}</label
+          >
+          <input
+            id="{uid}-secret-key"
+            name="credentials.secretKey"
+            type="password"
+            class={[
+              'input-bordered input w-full',
+              $errors?.credentials?.secretKey && 'input-error'
+            ]}
+            autocomplete="current-password"
+            bind:value={$form.credentials.secretKey}
+          />
+          {#if $errors?.credentials?.secretKey}
+            <p class="text-error mt-1 text-xs">{$errors.credentials.secretKey}</p>
+          {/if}
+        </div>
 
-    <button type="submit" class="btn btn-primary" disabled={$submitting}>
-      {#if $submitting}
-        <span class="loading loading-sm loading-spinner"></span>
-      {/if}
-      {m.storage_connect_submit()}
-    </button>
-  </form>
-</div>
+        {#if $message}
+          <p class="text-error text-sm">{$message}</p>
+        {/if}
 
-{#if forgetCandidate}
-  <dialog open class="modal modal-open">
-    <div class="modal-box">
-      <p class="text-base-content font-medium">
-        {m.storage_connect_forget_confirm({ endpoint: connectionLabel(forgetCandidate) })}
-      </p>
-      <div class="modal-action">
-        <button type="button" class="btn btn-ghost btn-sm" onclick={() => (forgetCandidate = null)}>
-          {m.storage_connect_forget_cancel()}
+        <button type="submit" class="btn btn-primary" disabled={$submitting}>
+          {#if $submitting}
+            <span class="loading loading-sm loading-spinner"></span>
+          {/if}
+          {m.storage_connect_submit()}
         </button>
-        <button
-          type="button"
-          class="btn btn-error btn-sm"
-          onclick={() => forgetConnection(forgetCandidate!)}
-        >
-          {m.storage_connect_forget()}
-        </button>
-      </div>
+      </form>
     </div>
-    <form method="dialog" class="modal-backdrop">
-      <button onclick={() => (forgetCandidate = null)}>close</button>
-    </form>
-  </dialog>
+  </div>
 {/if}
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
index d291d116..37ca08e1 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
@@ -1,12 +1,29 @@
 import { page } from 'vitest/browser';
 import { describe, expect, it, vi, beforeEach } from 'vitest';
 import { render } from 'vitest-browser-svelte';
-import { faker } from '@faker-js/faker';
 import type { ComponentProps } from 'svelte';
 import StorageConnectForm from './StorageConnectForm.svelte';
+import type { SavedConnection } from '$lib/storage/connection-storage.js';
 
 type ConnectionFormProp = ComponentProps<typeof StorageConnectForm>['connectionForm'];
 
+/** Build a minimal StoredConnection fixture with a stable UUID. */
+function makeConn(
+  overrides: Partial<Omit<SavedConnection, 'id'>> & { id?: string } = {}
+): SavedConnection {
+  return {
+    id: overrides.id ?? '00000000-0000-0000-0000-000000000001',
+    type: 's3',
+    host: 'minio.example.com',
+    port: undefined,
+    tls: { verification: 'Full' },
+    accessStyle: 'Path',
+    region: { name: 'us-east-1' },
+    credentials: { accessKey: '', secretKey: '' },
+    ...overrides
+  } as SavedConnection;
+}
+
 // Mock feature flags to disable auto-connect
 vi.mock('$lib/client/feature-flags.js', () => ({
   storageAutoConnectEnabled: false,
@@ -18,7 +35,10 @@ vi.mock('$lib/storage/connection-storage.js', () => ({
   saveConnectionLocally: vi.fn(),
   loadConnectionLocally: vi.fn(() => null),
   loadAllConnectionsLocally: vi.fn(() => []),
-  removeConnectionLocally: vi.fn()
+  removeConnectionLocally: vi.fn(),
+  updateConnectionLocally: vi.fn(),
+  removeConnectionById: vi.fn(),
+  loadConnectionById: vi.fn(() => null)
 }));
 
 // Mock paraglide messages
@@ -31,41 +51,64 @@ vi.mock('$lib/paraglide/messages.js', () => ({
   storage_connect_type: () => 'Backend type',
   storage_connect_type_s3: () => 'Amazon S3',
   storage_connect_type_hdfs: () => 'HDFS',
-  storage_connect_endpoint: () => 'Endpoint URL',
-  storage_connect_endpoint_placeholder: () => 'https://s3.example.com',
-  storage_connect_endpoint_hint: () => 'Leave empty for AWS S3',
-  storage_connect_path_style: () => 'Path-style addressing',
-  storage_connect_path_style_hint: () => 'Use path-style URLs',
+  storage_connect_host: () => 'Host',
+  storage_connect_host_placeholder: () => 'minio.example.com',
+  storage_connect_port: () => 'Port',
+  storage_connect_port_placeholder: () => '9000',
+  storage_connect_port_hint: () => 'Leave blank for default port',
+  storage_connect_tls: () => 'Use TLS',
+  storage_connect_tls_hint: () => 'Encrypt with TLS/HTTPS',
+  storage_connect_tls_verification: () => 'Verify certificate',
+  storage_connect_tls_verification_hint: () => 'Disable for self-signed certificates',
+  storage_connect_access_style: () => 'Access style',
+  storage_connect_access_style_path: () => 'Path',
+  storage_connect_access_style_virtual_hosted: () => 'Virtual hosted',
   storage_connect_region: () => 'Region',
-  storage_connect_access_key: () => 'Access key ID',
-  storage_connect_secret_key: () => 'Secret access key',
+  storage_connect_access_key: () => 'Access key',
+  storage_connect_secret_key: () => 'Secret key',
   storage_connect_submit: () => 'Connect',
   storage_connect_forget_label: ({ endpoint }: { endpoint: string }) => `Forget ${endpoint}`,
   storage_connect_forget_confirm: ({ endpoint }: { endpoint: string }) =>
     `Forget connection to ${endpoint}?`,
   storage_connect_forget_cancel: () => 'Cancel',
-  storage_connect_forget: () => 'Forget'
+  storage_connect_forget: () => 'Forget',
+  storage_connect_manage: () => 'Manage connections',
+  storage_connect_edit: () => 'Edit',
+  storage_more_options: () => 'More options',
+  storage_sidebar_resize_handle: () => 'Resize sidebar',
+  storage_connections_delete_confirm: ({ label }: { label: string }) =>
+    `Delete connection to ${label}?`,
+  storage_connections_delete_cancel: () => 'Cancel',
+  storage_connections_delete_confirm_button: () => 'Delete',
+  storage_connect_copy: () => 'Copy',
+  storage_connect_copied: () => 'Copied',
+  storage_connect_copy_all: () => 'Copy all'
 }));
 
+const defaultFormData = {
+  id: '00000000-0000-0000-0000-000000000001',
+  type: 's3' as const,
+  host: '',
+  port: undefined,
+  tls: { verification: 'Full' as const },
+  accessStyle: 'VirtualHosted' as const,
+  region: { name: 'us-east-1' },
+  credentials: { accessKey: '', secretKey: '' }
+};
+
 function createMockForm(overrides: Record<string, unknown> = {}): ConnectionFormProp {
+  const { data: dataOverride, ...restOverrides } = overrides;
   return {
     valid: true,
     posted: false,
     errors: {},
-    data: {
-      type: 's3' as const,
-      endpoint: '',
-      pathStyle: true,
-      region: 'eu-central-1',
-      accessKeyId: '',
-      secretAccessKey: ''
-    },
+    data: { ...defaultFormData, ...((dataOverride as object) ?? {}) },
     id: 'test-form',
     constraints: {},
     shape: {},
     message: undefined,
     tainted: undefined,
-    ...overrides
+    ...restOverrides
   } as unknown as ConnectionFormProp;
 }
 
@@ -85,11 +128,13 @@ describe('StorageConnectForm', () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
     await expect.element(page.getByLabelText('Backend type')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Endpoint URL')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Path-style addressing')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Host')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Port')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Use TLS')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Access style')).toBeInTheDocument();
     await expect.element(page.getByLabelText('Region')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Access key ID')).toBeInTheDocument();
-    await expect.element(page.getByLabelText('Secret access key')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Access key')).toBeInTheDocument();
+    await expect.element(page.getByLabelText('Secret key')).toBeInTheDocument();
   });
 
   it('should render backend type as a select with S3 option', async () => {
@@ -101,24 +146,47 @@ describe('StorageConnectForm', () => {
     await expect.element(page.getByText('HDFS')).toBeInTheDocument();
   });
 
-  it('should render endpoint as url input', async () => {
+  it('should render host as text input', async () => {
+    render(StorageConnectForm, { connectionForm: createMockForm() });
+
+    const input = page.getByLabelText('Host');
+    await expect.element(input).toHaveAttribute('type', 'text');
+  });
+
+  it('should render port as number input', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    const input = page.getByLabelText('Endpoint URL');
-    await expect.element(input).toHaveAttribute('type', 'url');
+    const input = page.getByLabelText('Port');
+    await expect.element(input).toHaveAttribute('type', 'number');
   });
 
-  it('should render path-style as a checkbox', async () => {
+  it('should render TLS as a checkbox toggle', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    const toggle = page.getByLabelText('Path-style addressing');
+    const toggle = page.getByLabelText('Use TLS');
     await expect.element(toggle).toHaveAttribute('type', 'checkbox');
   });
 
-  it('should render secret access key as password input', async () => {
+  it('should show verify certificate toggle when TLS is enabled', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({ data: { tls: { verification: 'Full' } } })
+    });
+
+    await expect.element(page.getByLabelText('Verify certificate')).toBeInTheDocument();
+  });
+
+  it('should hide verify certificate toggle when TLS is disabled', async () => {
+    render(StorageConnectForm, {
+      connectionForm: createMockForm({ data: { tls: undefined } })
+    });
+
+    await expect.element(page.getByLabelText('Verify certificate')).not.toBeInTheDocument();
+  });
+
+  it('should render secret key as password input', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    const input = page.getByLabelText('Secret access key');
+    const input = page.getByLabelText('Secret key');
     await expect.element(input).toHaveAttribute('type', 'password');
   });
 
@@ -137,32 +205,27 @@ describe('StorageConnectForm', () => {
   it('should show saved connections when present', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://minio.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: 'AKIA123',
-        secretAccessKey: 'secret'
-      }
+      makeConn({
+        host: 'minio.example.com',
+        port: 9000,
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'AKIA123', secretKey: 'secret' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('minio.example.com')).toBeInTheDocument();
+    await expect.element(page.getByText('minio.example.com:9000').first()).toBeInTheDocument();
   });
 
   it('should show forget button for saved connections', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.test.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000011',
+        host: 's3.test.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
@@ -175,14 +238,11 @@ describe('StorageConnectForm', () => {
   it('should open forget confirmation dialog when forget button clicked', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.remove.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000012',
+        host: 's3.remove.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
@@ -190,72 +250,66 @@ describe('StorageConnectForm', () => {
     const forgetBtn = page.getByRole('button', { name: 'Forget s3.remove.io' });
     await forgetBtn.click();
 
-    await expect.element(page.getByText('Forget connection to s3.remove.io?')).toBeInTheDocument();
+    await expect
+      .element(page.getByText('Delete connection to s3.remove.io?').first())
+      .toBeInTheDocument();
     await expect.element(page.getByRole('button', { name: 'Cancel' })).toBeInTheDocument();
     await expect
-      .element(page.getByRole('button', { name: 'Forget', exact: true }))
+      .element(page.getByRole('button', { name: 'Delete', exact: true }))
       .toBeInTheDocument();
   });
 
   it('should show multiple saved connections', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://first.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      },
-      {
-        type: 's3',
-        endpoint: 'https://second.example.com',
-        pathStyle: false,
-        region: 'eu-west-1',
-        accessKeyId: faker.string.alphanumeric(20),
-        secretAccessKey: faker.string.alphanumeric(40)
-      },
-      {
-        type: 's3',
-        endpoint: '',
-        pathStyle: false,
-        region: 'us-west-2',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000013',
+        host: 'first.example.com',
+        region: { name: 'us-east-1' }
+      }),
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000014',
+        host: 'second.example.com',
+        port: 9000,
+        accessStyle: 'VirtualHosted',
+        region: { name: 'eu-west-1' },
+        credentials: { accessKey: 'KEY', secretKey: 'SECRET' }
+      }),
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000015',
+        name: 'Production',
+        host: 'prod.example.com',
+        region: { name: 'us-west-2' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('first.example.com')).toBeInTheDocument();
-    await expect.element(page.getByText('second.example.com')).toBeInTheDocument();
-    await expect.element(page.getByText('AWS S3', { exact: true })).toBeInTheDocument();
+    await expect.element(page.getByText('first.example.com').first()).toBeInTheDocument();
+    await expect.element(page.getByText('second.example.com:9000').first()).toBeInTheDocument();
+    await expect.element(page.getByText('Production', { exact: true }).first()).toBeInTheDocument();
   });
 
   it('should render saved connections in a list role', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://listed.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000016',
+        host: 'listed.example.com',
+        region: { name: 'us-east-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByRole('list')).toBeInTheDocument();
-    await expect.element(page.getByRole('listitem')).toBeInTheDocument();
+    await expect.element(page.getByRole('list').first()).toBeInTheDocument();
+    await expect.element(page.getByRole('listitem').first()).toBeInTheDocument();
   });
 
-  it('should render endpoint hint text', async () => {
+  it('should render port hint text', async () => {
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('Leave empty for AWS S3')).toBeInTheDocument();
+    await expect.element(page.getByText('Leave blank for default port')).toBeInTheDocument();
   });
 
   it('should render form with POST method', async () => {
@@ -268,38 +322,34 @@ describe('StorageConnectForm', () => {
   it('should close forget dialog when cancel is clicked', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.cancel.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000017',
+        host: 's3.cancel.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
     await page.getByRole('button', { name: 'Forget s3.cancel.io' }).click();
-    await expect.element(page.getByText('Forget connection to s3.cancel.io?')).toBeInTheDocument();
+    await expect
+      .element(page.getByText('Delete connection to s3.cancel.io?').first())
+      .toBeInTheDocument();
 
     await page.getByRole('button', { name: 'Cancel', exact: true }).click();
     await expect
-      .element(page.getByText('Forget connection to s3.cancel.io?'))
+      .element(page.getByText('Delete connection to s3.cancel.io?'))
       .not.toBeInTheDocument();
   });
 
   it('should remove connection when forget is confirmed', async () => {
     const { loadAllConnectionsLocally, removeConnectionLocally } =
       await import('$lib/storage/connection-storage.js');
-    const conn = {
-      type: 's3' as const,
-      endpoint: 'https://s3.forget.io',
-      pathStyle: true,
-      region: 'eu-west-1',
-      accessKeyId: '',
-      secretAccessKey: ''
-    };
+    const conn = makeConn({
+      id: '00000000-0000-0000-0000-000000000018',
+      host: 's3.forget.io',
+      region: { name: 'eu-west-1' }
+    });
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([conn]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
@@ -307,57 +357,21 @@ describe('StorageConnectForm', () => {
     await page.getByRole('button', { name: 'Forget s3.forget.io' }).click();
     // After clicking forget, mock returns empty list
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([]);
-    await page.getByRole('button', { name: 'Forget', exact: true }).click();
+    await page.getByRole('button', { name: 'Delete', exact: true }).click();
 
     expect(removeConnectionLocally).toHaveBeenCalledWith(conn);
     await expect.element(page.getByText('No saved connections yet')).toBeInTheDocument();
   });
 
-  it('should show connection label with invalid URL as raw endpoint', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'not-a-valid-url',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect.element(page.getByText('not-a-valid-url')).toBeInTheDocument();
-  });
-
-  it('should show AWS S3 label when endpoint is undefined', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: undefined,
-        pathStyle: false,
-        region: 'us-west-2',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect.element(page.getByText('AWS S3', { exact: true })).toBeInTheDocument();
-  });
-
-  it('should display endpoint error when form has endpoint errors', async () => {
+  it('should display host error when form has host errors', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
-        errors: { endpoint: ['Must be a valid URL'] }
+        errors: { host: ['Host is required'] }
       })
     });
 
-    await expect.element(page.getByText('Must be a valid URL')).toBeInTheDocument();
-    const input = page.getByLabelText('Endpoint URL');
+    await expect.element(page.getByText('Host is required')).toBeInTheDocument();
+    const input = page.getByLabelText('Host');
     const classes = input.element().className;
     expect(classes).toContain('input-error');
   });
@@ -365,42 +379,44 @@ describe('StorageConnectForm', () => {
   it('should display region error when form has region errors', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
-        errors: { region: ['Region is required'] }
+        errors: { region: { name: ['Region name is required'] } }
       })
     });
 
-    await expect.element(page.getByText('Region is required')).toBeInTheDocument();
+    await expect.element(page.getByText('Region name is required')).toBeInTheDocument();
     const input = page.getByLabelText('Region');
     expect(input.element().className).toContain('input-error');
   });
 
-  it('should display accessKeyId error', async () => {
+  it('should display access key error', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
-        errors: { accessKeyId: ['Access key ID is required when secret access key is provided'] }
+        errors: {
+          credentials: { accessKey: ['Access key is required when secret key is provided'] }
+        }
       })
     });
 
     await expect
-      .element(page.getByText('Access key ID is required when secret access key is provided'))
+      .element(page.getByText('Access key is required when secret key is provided'))
       .toBeInTheDocument();
-    const input = page.getByLabelText('Access key ID');
+    const input = page.getByLabelText('Access key');
     expect(input.element().className).toContain('input-error');
   });
 
-  it('should display secretAccessKey error', async () => {
+  it('should display secret key error', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
         errors: {
-          secretAccessKey: ['Secret access key is required when access key ID is provided']
+          credentials: { secretKey: ['Secret key is required when access key is provided'] }
         }
       })
     });
 
     await expect
-      .element(page.getByText('Secret access key is required when access key ID is provided'))
+      .element(page.getByText('Secret key is required when access key is provided'))
       .toBeInTheDocument();
-    const input = page.getByLabelText('Secret access key');
+    const input = page.getByLabelText('Secret key');
     expect(input.element().className).toContain('input-error');
   });
 
@@ -419,90 +435,86 @@ describe('StorageConnectForm', () => {
   it('should fill form fields when a saved connection is clicked', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.select.io',
-        pathStyle: false,
-        region: 'ap-southeast-1',
-        accessKeyId: 'AKIASELECT',
-        secretAccessKey: 'secretselect'
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000021',
+        host: 's3.select.io',
+        port: 9000,
+        accessStyle: 'VirtualHosted',
+        region: { name: 'ap-southeast-1' },
+        credentials: { accessKey: 'AKIASELECT', secretKey: 'secretselect' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    // Click the saved connection button
-    await page.getByRole('button', { name: 's3.select.io', exact: true }).click();
+    // Click the saved connection button (first match — mobile card)
+    await page.getByRole('button', { name: 's3.select.io:9000', exact: true }).first().click();
 
     // Verify form fields are filled
-    await expect.element(page.getByLabelText('Endpoint URL')).toHaveValue('https://s3.select.io');
+    await expect.element(page.getByLabelText('Host')).toHaveValue('s3.select.io');
     await expect.element(page.getByLabelText('Region')).toHaveValue('ap-southeast-1');
-    await expect.element(page.getByLabelText('Access key ID')).toHaveValue('AKIASELECT');
-    await expect.element(page.getByLabelText('Secret access key')).toHaveValue('secretselect');
+    await expect.element(page.getByLabelText('Access key')).toHaveValue('AKIASELECT');
+    await expect.element(page.getByLabelText('Secret key')).toHaveValue('secretselect');
   });
 
   it('should show saved connections heading when connections exist', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://heading.example.com',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000022',
+        host: 'heading.example.com',
+        region: { name: 'us-east-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
-    await expect.element(page.getByText('Saved connections')).toBeInTheDocument();
+    await expect.element(page.getByText('Saved connections').first()).toBeInTheDocument();
   });
 
   it('should display multiple field errors simultaneously', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
         errors: {
-          endpoint: ['Must be a valid URL'],
-          region: ['Region is required'],
-          accessKeyId: ['Access key required'],
-          secretAccessKey: ['Secret key required']
+          host: ['Host is required'],
+          region: { name: ['Region name is required'] },
+          credentials: {
+            accessKey: ['Access key required'],
+            secretKey: ['Secret key required']
+          }
         },
         message: 'Validation failed'
       })
     });
 
-    await expect.element(page.getByText('Must be a valid URL')).toBeInTheDocument();
-    await expect.element(page.getByText('Region is required')).toBeInTheDocument();
+    await expect.element(page.getByText('Host is required')).toBeInTheDocument();
+    await expect.element(page.getByText('Region name is required')).toBeInTheDocument();
     await expect.element(page.getByText('Access key required')).toBeInTheDocument();
     await expect.element(page.getByText('Secret key required')).toBeInTheDocument();
     await expect.element(page.getByText('Validation failed')).toBeInTheDocument();
   });
 
-  it('should close forget dialog via backdrop button', async () => {
+  it('should close forget dialog via cancel button', async () => {
     const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
     vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      {
-        type: 's3',
-        endpoint: 'https://s3.backdrop.io',
-        pathStyle: true,
-        region: 'eu-west-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      makeConn({
+        id: '00000000-0000-0000-0000-000000000023',
+        host: 's3.backdrop.io',
+        region: { name: 'eu-west-1' }
+      })
     ]);
 
     render(StorageConnectForm, { connectionForm: createMockForm() });
 
     await page.getByRole('button', { name: 'Forget s3.backdrop.io' }).click();
     await expect
-      .element(page.getByText('Forget connection to s3.backdrop.io?'))
+      .element(page.getByText('Delete connection to s3.backdrop.io?').first())
       .toBeInTheDocument();
 
-    // Click the backdrop close button
-    await page.getByRole('button', { name: 'close' }).click();
+    // Close the dialog by clicking Cancel
+    await page.getByRole('button', { name: 'Cancel', exact: true }).click();
     await expect
-      .element(page.getByText('Forget connection to s3.backdrop.io?'))
+      .element(page.getByText('Delete connection to s3.backdrop.io?'))
       .not.toBeInTheDocument();
   });
 });
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 58a3105d..1445d12b 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-  import { browser } from '$app/environment';
   import { page } from '$app/state';
   import { resolve } from '$app/paths';
   import { beforeNavigate } from '$app/navigation';
@@ -15,89 +14,19 @@
   import { getStorageState } from '$lib/storage/context.js';
   import type { PinnedLocation, StorageLocation } from '$lib/storage/types.js';
   import { pinnedLabel, pinnedHref } from '$lib/storage/display-helpers.js';
+  import { createResizablePanel } from './resizable-panel.svelte.js';
+  import ResizeHandle from './ResizeHandle.svelte';
 
   const storage = getStorageState();
 
-  // ── Resizable sidebar ─────────────────────────────────────────────────────
-  const SIDEBAR_WIDTH_KEY = 'storage_sidebar_width';
-  const DEFAULT_WIDTH = 192; // matches previous w-48
-  const MIN_WIDTH = 120;
-  const MAX_WIDTH = 480;
-
-  function getInitialWidth(): number {
-    if (!browser) return DEFAULT_WIDTH;
-    try {
-      const stored = localStorage.getItem(SIDEBAR_WIDTH_KEY);
-      if (stored) {
-        const parsed = parseInt(stored, 10);
-        if (!isNaN(parsed) && parsed >= MIN_WIDTH && parsed <= MAX_WIDTH) return parsed;
-      }
-    } catch {
-      /* ignore storage errors */
-    }
-    return DEFAULT_WIDTH;
-  }
-
-  function saveWidth(width: number) {
-    try {
-      localStorage.setItem(SIDEBAR_WIDTH_KEY, String(width));
-    } catch {
-      /* ignore storage errors */
-    }
-  }
-
-  let sidebarWidth = $state(getInitialWidth());
-  let isDragging = $state(false);
-  let dragStartX = 0;
-  let dragStartWidth = 0;
-
-  function onResizeStart(e: PointerEvent) {
-    isDragging = true;
-    dragStartX = e.clientX;
-    dragStartWidth = sidebarWidth;
-    (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId);
-    e.preventDefault();
-  }
-
-  function onResizeMove(e: PointerEvent) {
-    if (!isDragging) return;
-    const delta = e.clientX - dragStartX;
-    sidebarWidth = Math.min(MAX_WIDTH, Math.max(MIN_WIDTH, dragStartWidth + delta));
-  }
-
-  function onResizeEnd() {
-    if (!isDragging) return;
-    isDragging = false;
-    saveWidth(sidebarWidth);
-  }
-
-  function onResizeKeydown(e: KeyboardEvent) {
-    const step = e.shiftKey ? 20 : 4;
-    if (e.key === 'ArrowRight') {
-      sidebarWidth = Math.min(MAX_WIDTH, sidebarWidth + step);
-      saveWidth(sidebarWidth);
-      e.preventDefault();
-    } else if (e.key === 'ArrowLeft') {
-      sidebarWidth = Math.max(MIN_WIDTH, sidebarWidth - step);
-      saveWidth(sidebarWidth);
-      e.preventDefault();
-    }
-  }
-
-  // Keep the col-resize cursor active across the whole page while dragging so
-  // it doesn't flicker when the pointer moves faster than the DOM updates.
-  $effect(() => {
-    if (!browser) return;
-    if (isDragging) {
-      document.body.style.cursor = 'col-resize';
-      document.body.style.userSelect = 'none';
-    } else {
-      document.body.style.cursor = '';
-      document.body.style.userSelect = '';
-    }
+  const resize = createResizablePanel({
+    storageKey: 'storage_sidebar_width',
+    defaultWidth: 192,
+    minWidth: 120,
+    maxWidth: 480
   });
 
-  // ── Disconnect confirmation ───────────────────────────────────────────────
+  // ── Disconnect confirmation ──────────────────────────────────────────────
   let disconnectConfirmOpen = $state(false);
   let disconnectForm = $state<HTMLFormElement | null>(null);
 
@@ -225,7 +154,7 @@
     border-base-300 bg-base-100 relative flex shrink-0 flex-col
     rounded-lg border
   "
-  style="width: {sidebarWidth}px"
+  style="width: {resize.width}px"
   aria-label={m.storage_buckets_label()}
 >
   <!-- Pinned Access section -->
@@ -264,7 +193,7 @@
             </a>
             <button
               class="
-                btn btn-ghost btn-xs absolute top-1/2 right-1 z-60 -translate-y-1/2
+                btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
                 p-0 opacity-0 transition-opacity
                 group-hover:opacity-100 focus:opacity-100
               "
@@ -295,7 +224,7 @@
     <a
       href={resolve('/storage')}
       data-sveltekit-preload-data="off"
-      class="btn btn-ghost btn-xs group tooltip tooltip-right z-60"
+      class="btn btn-ghost btn-xs group tooltip tooltip-right z-150 before:z-200"
       title={m.storage_view_all_buckets()}
       data-tip={m.storage_view_all_buckets()}
     >
@@ -377,36 +306,7 @@
     </div>
   </Modal>
 
-  <!-- Drag-to-resize handle -->
-  <!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
-  <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
-  <div
-    role="separator"
-    aria-orientation="vertical"
-    aria-label={m.storage_sidebar_resize_handle()}
-    aria-valuenow={sidebarWidth}
-    aria-valuemin={MIN_WIDTH}
-    aria-valuemax={MAX_WIDTH}
-    tabindex="0"
-    class="
-      focus-visible:outline-primary/50 absolute inset-y-0 -right-2 z-10 w-4 cursor-col-resize
-      touch-none rounded-r-lg
-      select-none focus-visible:outline-2 focus-visible:outline-offset-0
-    "
-    onpointerdown={onResizeStart}
-    onpointermove={onResizeMove}
-    onpointerup={onResizeEnd}
-    onpointercancel={onResizeEnd}
-    onkeydown={onResizeKeydown}
-  >
-    <div
-      class="
-        absolute inset-y-2 left-1/2 w-0.5 -translate-x-1/2 rounded-full
-        transition-colors duration-100
-        {isDragging ? 'bg-primary' : 'bg-base-300 hover:bg-primary/50'}
-      "
-    ></div>
-  </div>
+  <ResizeHandle panel={resize} />
 </nav>
 
 {#if tooltipText}
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
index 5620a959..877a2398 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
+++ b/src/lib/components/storage/sidebar/BucketList.svelte.spec.ts
@@ -6,16 +6,16 @@ import { userEvent } from 'vitest/browser';
 import BucketListWrapper from './__tests__/BucketListWrapper.svelte';
 import { setPageState, resetPageState } from './__tests__/page-helper.svelte.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
-import type { PinnedLocation } from '$lib/storage/types.js';
+import type { StorageLocation } from '$lib/storage/types.js';
 
 function createState(
   opts: {
     buckets?: string[];
-    pinned?: PinnedLocation[];
+    pinned?: StorageLocation[];
   } = {}
 ): StorageState {
   const buckets = opts.buckets ?? [];
-  const state = new StorageState({ connected: true, buckets });
+  const state = new StorageState({ connected: true, buckets, connectionId: 'test-conn-id' });
   state.bucket = buckets[0] ?? '';
   state.prefix = '';
   if (opts.pinned) {
@@ -272,10 +272,8 @@ describe('BucketList', () => {
       await moreButton.click();
       await expect.element(page.getByRole('menuitem', { name: /unpin/i })).toBeInTheDocument();
 
-      // Click on the "Buckets" section header — a non-interactive span that is
-      // outside the context menu but does not trigger browser navigation.
-      const bucketsHeader = page.getByRole('navigation').getByText('Buckets', { exact: true });
-      await bucketsHeader.click();
+      // Click on a non-link part of the nav (the heading) to trigger the outside-click handler
+      await page.getByText('Buckets').click();
 
       await expect.element(page.getByRole('menuitem', { name: /unpin/i })).not.toBeInTheDocument();
     });
diff --git a/src/lib/components/storage/sidebar/ResizeHandle.svelte b/src/lib/components/storage/sidebar/ResizeHandle.svelte
new file mode 100644
index 00000000..325e0440
--- /dev/null
+++ b/src/lib/components/storage/sidebar/ResizeHandle.svelte
@@ -0,0 +1,34 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import type { ResizablePanel } from './resizable-panel.svelte.js';
+
+  interface Props {
+    panel: ResizablePanel;
+  }
+
+  let { panel }: Props = $props();
+</script>
+
+<!-- svelte-ignore a11y_no_noninteractive_element_interactions -->
+<!-- svelte-ignore a11y_no_noninteractive_tabindex -->
+<div
+  role="separator"
+  aria-orientation="vertical"
+  aria-label={m.storage_sidebar_resize_handle()}
+  aria-valuenow={panel.width}
+  aria-valuemin={panel.minWidth}
+  aria-valuemax={panel.maxWidth}
+  tabindex="0"
+  class="group focus-visible:outline-primary/50 absolute inset-y-0 -right-2 z-10 w-4 cursor-col-resize touch-none rounded-r-lg select-none focus-visible:outline-2 focus-visible:outline-offset-0"
+  onpointerdown={panel.onResizeStart}
+  onpointermove={panel.onResizeMove}
+  onpointerup={panel.onResizeEnd}
+  onpointercancel={panel.onResizeEnd}
+  onkeydown={panel.onResizeKeydown}
+>
+  <div
+    class="group-hover:bg-primary/70 absolute inset-y-2 left-1/2 w-0.5 -translate-x-1/2 rounded-full transition-colors duration-100"
+    class:bg-primary={panel.isDragging}
+    class:bg-base-300={!panel.isDragging}
+  ></div>
+</div>
diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
new file mode 100644
index 00000000..10080e85
--- /dev/null
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -0,0 +1,281 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import IconEdit from 'virtual:icons/material-symbols/edit';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import DeleteConnectionModal from '$lib/components/storage/DeleteConnectionModal.svelte';
+  import { createResizablePanel } from './resizable-panel.svelte.js';
+  import ResizeHandle from './ResizeHandle.svelte';
+  import { resolve } from '$app/paths';
+  import * as m from '$lib/paraglide/messages.js';
+  import {
+    loadAllConnectionsLocally,
+    removeConnectionLocally,
+    type SavedConnection
+  } from '$lib/storage/connection-storage.js';
+
+  interface Props {
+    /** ID of the connection currently being acted on (highlighted in the list). */
+    activeId?: string;
+    /** Called when the user clicks a connection row. */
+    onselect: (conn: SavedConnection) => void;
+  }
+
+  let { activeId, onselect }: Props = $props();
+
+  let allConnections: SavedConnection[] = $state([]);
+  let connectionsLoaded = $state(false);
+  let forgetCandidate: SavedConnection | null = $state(null);
+  let forgetOpen = $state(false);
+
+  const resize = createResizablePanel({
+    storageKey: 'storage_connect_sidebar_width',
+    defaultWidth: 224,
+    minWidth: 140,
+    maxWidth: 400
+  });
+  let menuConn: SavedConnection | null = $state(null);
+  let menuEl: HTMLUListElement | null = $state(null);
+  let menuRawPos = $state({ left: 0, top: 0 });
+  const menuPos = $derived.by(() => {
+    if (!menuConn) return { left: 0, top: 0 };
+    if (!menuEl) return menuRawPos;
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left:
+        menuRawPos.left + rect.width > window.innerWidth
+          ? menuRawPos.left - rect.width
+          : menuRawPos.left,
+      top:
+        menuRawPos.top + rect.height > window.innerHeight
+          ? menuRawPos.top - rect.height
+          : menuRawPos.top
+    };
+  });
+
+  function connectionLabel(conn: SavedConnection): string {
+    if (conn.name) return conn.name;
+    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+  }
+
+  function openContextMenu(e: MouseEvent, conn: SavedConnection) {
+    e.preventDefault();
+    e.stopPropagation();
+    const btnRect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    menuRawPos = { left: btnRect.right, top: btnRect.bottom };
+    menuConn = conn;
+  }
+
+  function closeContextMenu() {
+    menuConn = null;
+  }
+
+  function handleOutsideClick(e: MouseEvent) {
+    if (menuConn && menuEl && !menuEl.contains(e.target as Node)) closeContextMenu();
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (menuConn && e.key === 'Escape') closeContextMenu();
+  }
+
+  function openForgetConfirm(conn: SavedConnection) {
+    forgetCandidate = conn;
+    forgetOpen = true;
+  }
+
+  function forgetConnection() {
+    if (!forgetCandidate) return;
+    removeConnectionLocally(forgetCandidate);
+    allConnections = loadAllConnectionsLocally();
+    forgetCandidate = null;
+    forgetOpen = false;
+  }
+
+  onMount(() => {
+    allConnections = loadAllConnectionsLocally();
+    connectionsLoaded = true;
+  });
+</script>
+
+<svelte:document onclick={handleOutsideClick} />
+<svelte:window onkeydown={handleKeydown} />
+
+<!-- Context menu (fixed, rendered outside the layout flow) -->
+{#if menuConn}
+  <ul
+    bind:this={menuEl}
+    class="
+      menu menu-sm border-base-300 bg-base-100 fixed z-150 w-48 rounded-lg
+      border p-1 shadow-lg
+    "
+    role="menu"
+    tabindex="-1"
+    style="left: {menuPos.left}px; top: {menuPos.top}px;"
+  >
+    <li role="none">
+      <a
+        href={resolve(`/storage/connections/${menuConn.id}/edit`)}
+        role="menuitem"
+        onclick={closeContextMenu}
+        class="justify-start"
+      >
+        <IconEdit class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connect_edit()}
+      </a>
+    </li>
+    <li role="none">
+      <button
+        type="button"
+        role="menuitem"
+        class="text-error justify-start"
+        onclick={() => {
+          openForgetConfirm(menuConn!);
+          closeContextMenu();
+        }}
+      >
+        <IconClose class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connect_forget()}
+      </button>
+    </li>
+  </ul>
+{/if}
+
+<!-- Mobile: horizontal scrollable connections row -->
+<div class="md:hidden">
+  {#if connectionsLoaded && allConnections.length > 0}
+    <p class="text-base-content/50 mb-2 text-xs font-semibold tracking-wide uppercase">
+      {m.storage_connect_saved()}
+    </p>
+    <div
+      class="flex flex-nowrap gap-2 overflow-x-auto overflow-y-visible pb-1"
+      role="list"
+      aria-label={m.storage_connect_saved()}
+    >
+      {#each allConnections as conn (conn.id)}
+        <div class="relative shrink-0" role="listitem">
+          <button
+            type="button"
+            onclick={() => onselect(conn)}
+            class="
+              border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 focus-visible:outline-primary
+              flex flex-col items-center gap-1.5 rounded-xl
+              border p-3 text-center transition-colors before:z-200
+              {activeId === conn.id ? 'border-primary bg-primary/5' : ''}
+            "
+            title={connectionLabel(conn)}
+            data-tip={connectionLabel(conn)}
+          >
+            <IconStorage class="text-primary size-8" aria-hidden="true" />
+            <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
+          </button>
+          <button
+            type="button"
+            aria-label={m.storage_connect_forget_label({ endpoint: connectionLabel(conn) })}
+            onclick={(e) => {
+              e.stopPropagation();
+              openForgetConfirm(conn);
+            }}
+            class="
+              border-base-300 bg-base-100 text-error hover:bg-error hover:text-error-content
+              absolute -top-2 -right-2 flex size-5 items-center justify-center
+              rounded-full border shadow-sm transition-colors
+            "
+          >
+            <IconClose class="size-3" aria-hidden="true" />
+          </button>
+        </div>
+      {/each}
+    </div>
+    <div class="mt-2 text-right">
+      <a href={resolve('/storage/connections')} class="link link-primary text-xs">
+        {m.storage_connect_manage()}
+      </a>
+    </div>
+  {/if}
+</div>
+
+<!-- Desktop: sidebar -->
+<aside
+  class="
+    border-base-300 bg-base-100 sticky top-0
+    hidden h-[calc(100dvh-7rem)] shrink-0 flex-col rounded-lg border md:flex
+  "
+  style="width: {resize.width}px"
+  aria-label={m.storage_connect_saved()}
+>
+  <div class="border-base-300 border-b px-3 py-2">
+    <span class="text-base-content/50 text-xs font-semibold tracking-wide uppercase">
+      {m.storage_connect_saved()}
+    </span>
+  </div>
+
+  <ul class="flex-1 overflow-y-auto py-1" role="list" aria-label={m.storage_connect_saved()}>
+    {#if !connectionsLoaded}
+      <li class="flex justify-center px-3 py-4">
+        <span class="loading loading-spinner loading-sm text-base-content/40"></span>
+      </li>
+    {:else if allConnections.length === 0}
+      <li class="text-base-content/40 px-3 py-4 text-center text-xs">
+        {m.storage_connect_no_saved()}
+      </li>
+    {:else}
+      {#each allConnections as conn (conn.id)}
+        <li class="group relative">
+          <div class="relative z-150 w-full">
+            <button
+              type="button"
+              onclick={() => onselect(conn)}
+              class="
+              hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                pr-7 text-sm
+              {activeId === conn.id
+                ? 'bg-primary/10 text-primary font-medium'
+                : 'text-base-content'}
+            "
+            >
+              <IconStorage
+                class="text-primary size-3.5 shrink-0 {activeId === conn.id ? '' : 'opacity-60'}"
+                aria-hidden="true"
+              />
+              <span class="truncate">{connectionLabel(conn)}</span>
+            </button>
+          </div>
+
+          <button
+            type="button"
+            onclick={(e) => openContextMenu(e, conn)}
+            class="
+              btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
+              p-0 opacity-0 transition-opacity
+              group-hover:opacity-100 focus:opacity-100
+            "
+            aria-label={m.storage_more_options()}
+            title={m.storage_more_options()}
+          >
+            <IconMoreHoriz class="size-3.5" aria-hidden="true" />
+          </button>
+        </li>
+      {/each}
+    {/if}
+  </ul>
+
+  <div class="border-base-300 border-t p-2">
+    <a
+      href={resolve('/storage/connections')}
+      class="btn btn-ghost btn-xs w-full justify-start text-xs"
+    >
+      {m.storage_connect_manage()}
+    </a>
+  </div>
+
+  <ResizeHandle panel={resize} />
+</aside>
+
+<!-- Delete confirmation modal -->
+<DeleteConnectionModal
+  bind:open={forgetOpen}
+  connection={forgetCandidate}
+  onconfirm={forgetConnection}
+  oncancel={() => (forgetOpen = false)}
+/>
diff --git a/src/lib/components/storage/sidebar/resizable-panel.svelte.ts b/src/lib/components/storage/sidebar/resizable-panel.svelte.ts
new file mode 100644
index 00000000..80af2e0e
--- /dev/null
+++ b/src/lib/components/storage/sidebar/resizable-panel.svelte.ts
@@ -0,0 +1,110 @@
+import { browser } from '$app/environment';
+
+interface Options {
+  storageKey: string;
+  defaultWidth?: number;
+  minWidth?: number;
+  maxWidth?: number;
+}
+
+/**
+ * Creates reactive state and event handlers for a drag-to-resize sidebar panel.
+ * Call from a component's `<script>` block or another `.svelte.ts` file.
+ * The returned object's `width` is reactive and can be used directly in
+ * `style="width: {resize.width}px"`.
+ */
+export function createResizablePanel({
+  storageKey,
+  defaultWidth = 192,
+  minWidth = 120,
+  maxWidth = 480
+}: Options) {
+  function getInitialWidth(): number {
+    if (!browser) return defaultWidth;
+    try {
+      const stored = localStorage.getItem(storageKey);
+      if (stored) {
+        const parsed = parseInt(stored, 10);
+        if (!isNaN(parsed) && parsed >= minWidth && parsed <= maxWidth) return parsed;
+      }
+    } catch {
+      /* ignore storage errors */
+    }
+    return defaultWidth;
+  }
+
+  function saveWidth(w: number) {
+    try {
+      localStorage.setItem(storageKey, String(w));
+    } catch {
+      /* ignore storage errors */
+    }
+  }
+
+  let width = $state(getInitialWidth());
+  let isDragging = $state(false);
+  let dragStartX = 0;
+  let dragStartWidth = 0;
+
+  function onResizeStart(e: PointerEvent) {
+    isDragging = true;
+    dragStartX = e.clientX;
+    dragStartWidth = width;
+    (e.currentTarget as HTMLElement).setPointerCapture(e.pointerId);
+    e.preventDefault();
+  }
+
+  function onResizeMove(e: PointerEvent) {
+    if (!isDragging) return;
+    width = Math.min(maxWidth, Math.max(minWidth, dragStartWidth + (e.clientX - dragStartX)));
+  }
+
+  function onResizeEnd() {
+    if (!isDragging) return;
+    isDragging = false;
+    saveWidth(width);
+  }
+
+  function onResizeKeydown(e: KeyboardEvent) {
+    const step = e.shiftKey ? 20 : 4;
+    if (e.key === 'ArrowRight') {
+      width = Math.min(maxWidth, width + step);
+      saveWidth(width);
+      e.preventDefault();
+    } else if (e.key === 'ArrowLeft') {
+      width = Math.max(minWidth, width - step);
+      saveWidth(width);
+      e.preventDefault();
+    }
+  }
+
+  // Keep the col-resize cursor active across the whole page while dragging so
+  // it doesn't flicker when the pointer moves faster than the DOM updates.
+  $effect(() => {
+    if (!browser) return;
+    if (isDragging) {
+      document.body.style.cursor = 'col-resize';
+      document.body.style.userSelect = 'none';
+    } else {
+      document.body.style.cursor = '';
+      document.body.style.userSelect = '';
+    }
+  });
+
+  return {
+    get width() {
+      return width;
+    },
+    get isDragging() {
+      return isDragging;
+    },
+    minWidth,
+    maxWidth,
+    onResizeStart,
+    onResizeMove,
+    onResizeEnd,
+    onResizeKeydown
+  };
+}
+
+export type ResizablePanel = ReturnType<typeof createResizablePanel>;
diff --git a/src/lib/server/storage/connection.ts b/src/lib/server/storage/connection.ts
index 2f606ba5..772bfba2 100644
--- a/src/lib/server/storage/connection.ts
+++ b/src/lib/server/storage/connection.ts
@@ -29,13 +29,18 @@ function parseConnectionPayload(raw: string): S3ConnectionConfig {
     throw error(400, 'Storage backend not supported');
   }
 
+  const { host, port, tls, accessStyle, region, credentials } = parsed.data;
+  const resolvedCredentials =
+    credentials.accessKey && credentials.secretKey ? credentials : undefined;
+
   return {
     type: 's3',
-    endpoint: parsed.data.endpoint || undefined,
-    pathStyle: parsed.data.pathStyle,
-    region: parsed.data.region,
-    accessKeyId: parsed.data.accessKeyId || undefined,
-    secretAccessKey: parsed.data.secretAccessKey || undefined
+    host,
+    port,
+    tls,
+    accessStyle,
+    region,
+    credentials: resolvedCredentials
   };
 }
 
diff --git a/src/lib/server/storage/factory.test.ts b/src/lib/server/storage/factory.test.ts
index bee9877b..397cc081 100644
--- a/src/lib/server/storage/factory.test.ts
+++ b/src/lib/server/storage/factory.test.ts
@@ -18,7 +18,13 @@ import type { S3Config, HDFSConfig } from './types.js';
 
 describe('StorageProviderFactory', () => {
   it('creates S3StorageProvider for type s3', () => {
-    const config: S3Config = { type: 's3', region: 'us-east-1', bucket: 'test' };
+    const config: S3Config = {
+      type: 's3',
+      host: 'minio.example.com',
+      accessStyle: 'Path',
+      region: { name: 'us-east-1' },
+      bucket: 'test'
+    };
     const provider = StorageProviderFactory.create(config);
     expect((provider as unknown as { config: S3Config }).config).toEqual(config);
   });
diff --git a/src/lib/server/storage/s3-client.test.ts b/src/lib/server/storage/s3-client.test.ts
index 35bf8ba8..58f8612f 100644
--- a/src/lib/server/storage/s3-client.test.ts
+++ b/src/lib/server/storage/s3-client.test.ts
@@ -1,64 +1,73 @@
 import { describe, it, expect, vi } from 'vitest';
-import { faker } from '@faker-js/faker';
 import type { S3ConnectionConfig } from './types.js';
 
 vi.mock('@aws-sdk/client-s3', () => ({
   S3Client: vi.fn()
 }));
 
+vi.mock('@smithy/node-http-handler', () => ({
+  NodeHttpHandler: vi.fn()
+}));
+
 import { createS3Client } from './s3-client.js';
 import { S3Client } from '@aws-sdk/client-s3';
 const mockS3Client = vi.mocked(S3Client);
 
-describe('createS3Client', () => {
-  it('creates client with region only (no endpoint, no credentials)', () => {
-    const config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
-    createS3Client(config);
-    expect(mockS3Client).toHaveBeenCalledWith({
-      region: 'us-east-1',
-      requestChecksumCalculation: 'WHEN_REQUIRED'
-    });
-  });
+function baseConfig(overrides: Partial<S3ConnectionConfig> = {}): S3ConnectionConfig {
+  return {
+    type: 's3',
+    host: 'minio.example.com',
+    accessStyle: 'Path',
+    region: { name: 'us-east-1' },
+    ...overrides
+  };
+}
 
-  it('sets endpoint and forcePathStyle when endpoint provided', () => {
-    const endpoint = faker.internet.url();
-    const config: S3ConnectionConfig = { type: 's3', region: 'eu-west-1', endpoint };
-    createS3Client(config);
+describe('createS3Client', () => {
+  it('builds an http endpoint when tls is absent', () => {
+    createS3Client(baseConfig({ tls: undefined }));
     expect(mockS3Client).toHaveBeenCalledWith(
       expect.objectContaining({
-        endpoint,
-        forcePathStyle: true,
+        endpoint: 'http://minio.example.com',
         requestChecksumCalculation: 'WHEN_REQUIRED'
       })
     );
   });
 
-  it('respects pathStyle=false', () => {
-    const endpoint = faker.internet.url();
-    const config: S3ConnectionConfig = {
-      type: 's3',
-      region: 'eu-west-1',
-      endpoint,
-      pathStyle: false
-    };
-    createS3Client(config);
+  it('builds an https endpoint when tls is present', () => {
+    createS3Client(baseConfig({ tls: { verification: 'Full' } }));
     expect(mockS3Client).toHaveBeenCalledWith(
       expect.objectContaining({
-        endpoint,
-        forcePathStyle: false,
+        endpoint: 'https://minio.example.com',
         requestChecksumCalculation: 'WHEN_REQUIRED'
       })
     );
   });
 
-  it('sets credentials when accessKeyId and secretAccessKey provided', () => {
-    const config: S3ConnectionConfig = {
-      type: 's3',
-      region: 'us-west-2',
-      accessKeyId: 'AKID',
-      secretAccessKey: 'SECRET'
-    };
-    createS3Client(config);
+  it('includes port in the endpoint URL when port is set', () => {
+    createS3Client(baseConfig({ port: 9000, tls: undefined }));
+    expect(mockS3Client).toHaveBeenCalledWith(
+      expect.objectContaining({ endpoint: 'http://minio.example.com:9000' })
+    );
+  });
+
+  it('sets forcePathStyle=true for Path access style', () => {
+    createS3Client(baseConfig({ accessStyle: 'Path' }));
+    expect(mockS3Client).toHaveBeenCalledWith(expect.objectContaining({ forcePathStyle: true }));
+  });
+
+  it('sets forcePathStyle=false for VirtualHosted access style', () => {
+    createS3Client(baseConfig({ accessStyle: 'VirtualHosted' }));
+    expect(mockS3Client).toHaveBeenCalledWith(expect.objectContaining({ forcePathStyle: false }));
+  });
+
+  it('passes region name to the SDK', () => {
+    createS3Client(baseConfig({ region: { name: 'eu-west-1' } }));
+    expect(mockS3Client).toHaveBeenCalledWith(expect.objectContaining({ region: 'eu-west-1' }));
+  });
+
+  it('sets credentials when accessKey and secretKey are provided', () => {
+    createS3Client(baseConfig({ credentials: { accessKey: 'AKID', secretKey: 'SECRET' } }));
     expect(mockS3Client).toHaveBeenCalledWith(
       expect.objectContaining({
         credentials: { accessKeyId: 'AKID', secretAccessKey: 'SECRET' },
@@ -67,9 +76,8 @@ describe('createS3Client', () => {
     );
   });
 
-  it('does not set credentials when only accessKeyId provided', () => {
-    const config: S3ConnectionConfig = { type: 's3', region: 'us-west-2', accessKeyId: 'AKID' };
-    createS3Client(config);
+  it('does not set credentials when credentials is absent', () => {
+    createS3Client(baseConfig({ credentials: undefined }));
     const call = mockS3Client.mock.calls.at(-1)![0] as { credentials?: unknown };
     expect(call.credentials).toBeUndefined();
   });
diff --git a/src/lib/server/storage/s3-client.ts b/src/lib/server/storage/s3-client.ts
index 91839770..db4a85fd 100644
--- a/src/lib/server/storage/s3-client.ts
+++ b/src/lib/server/storage/s3-client.ts
@@ -1,20 +1,30 @@
 import { S3Client } from '@aws-sdk/client-s3';
+import { NodeHttpHandler } from '@smithy/node-http-handler';
+import { Agent } from 'https';
 import type { S3ConnectionConfig } from './types.js';
 
+function buildEndpointUrl(config: S3ConnectionConfig): string {
+  const scheme = config.tls ? 'https' : 'http';
+  const portSuffix = config.port ? `:${config.port}` : '';
+  return `${scheme}://${config.host}${portSuffix}`;
+}
+
 export function createS3Client(config: S3ConnectionConfig): S3Client {
   return new S3Client({
-    region: config.region,
+    region: config.region.name,
     requestChecksumCalculation: 'WHEN_REQUIRED',
-    ...(config.endpoint && {
-      endpoint: config.endpoint,
-      forcePathStyle: config.pathStyle ?? true
-    }),
-    ...(config.accessKeyId &&
-      config.secretAccessKey && {
-        credentials: {
-          accessKeyId: config.accessKeyId,
-          secretAccessKey: config.secretAccessKey
-        }
+    endpoint: buildEndpointUrl(config),
+    forcePathStyle: config.accessStyle === 'Path',
+    ...(config.tls?.verification === 'None' && {
+      requestHandler: new NodeHttpHandler({
+        httpsAgent: new Agent({ rejectUnauthorized: false })
       })
+    }),
+    ...(config.credentials && {
+      credentials: {
+        accessKeyId: config.credentials.accessKey,
+        secretAccessKey: config.credentials.secretKey
+      }
+    })
   });
 }
diff --git a/src/lib/server/storage/s3-provider.test.ts b/src/lib/server/storage/s3-provider.test.ts
index 84f19bed..04fc0e4b 100644
--- a/src/lib/server/storage/s3-provider.test.ts
+++ b/src/lib/server/storage/s3-provider.test.ts
@@ -44,7 +44,13 @@ function makeS3Error(name: string, httpStatusCode?: number): S3ServiceException
 function makeProvider() {
   const send = vi.fn();
   const client = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
-  const config = { type: 's3' as const, region: 'us-east-1', bucket: 'test-bucket' };
+  const config = {
+    type: 's3' as const,
+    host: 'minio.example.com',
+    accessStyle: 'Path' as const,
+    region: { name: 'us-east-1' },
+    bucket: 'test-bucket'
+  };
   const provider = new S3StorageProvider(config, client);
   return { provider, send };
 }
@@ -368,7 +374,13 @@ describe('S3StorageProvider.putObject', () => {
     const { send } = makeProvider();
     // Re-create provider with the send mock we can inspect
     const client = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
-    const config = { type: 's3' as const, region: 'us-east-1', bucket: 'test-bucket' };
+    const config = {
+      type: 's3' as const,
+      host: 'localhost',
+      accessStyle: 'Path' as const,
+      region: { name: 'us-east-1' },
+      bucket: 'test-bucket'
+    };
     const emptyProvider = new S3StorageProvider(config, client);
     send.mockResolvedValue({});
 
@@ -516,7 +528,13 @@ describe('S3StorageProvider constructor', () => {
     const send = vi.fn();
     const fakeClient = { send } as unknown as import('@aws-sdk/client-s3').S3Client;
     const provider = new S3StorageProvider(
-      { type: 's3', region: 'us-east-1', bucket: 'b' },
+      {
+        type: 's3',
+        host: 'minio.example.com',
+        accessStyle: 'Path',
+        region: { name: 'us-east-1' },
+        bucket: 'b'
+      },
       fakeClient
     );
     expect(provider).toBeDefined();
@@ -527,9 +545,15 @@ describe('S3StorageProvider constructor', () => {
     const mockCreate = vi.mocked(createS3Client);
     mockCreate.mockClear();
 
-    new S3StorageProvider({ type: 's3', region: 'us-east-1', bucket: 'b' });
+    new S3StorageProvider({
+      type: 's3',
+      host: 'minio.example.com',
+      accessStyle: 'Path',
+      region: { name: 'us-east-1' },
+      bucket: 'b'
+    });
     expect(mockCreate).toHaveBeenCalledWith(
-      expect.objectContaining({ region: 'us-east-1', bucket: 'b' })
+      expect.objectContaining({ region: { name: 'us-east-1' }, bucket: 'b' })
     );
   });
 });
diff --git a/src/lib/server/storage/types.ts b/src/lib/server/storage/types.ts
index 46472f67..fc3f71f9 100644
--- a/src/lib/server/storage/types.ts
+++ b/src/lib/server/storage/types.ts
@@ -1,12 +1,12 @@
 /** Per-user S3 connection config — no bucket, stored server-side. */
 export interface S3ConnectionConfig {
   type: 's3';
-  endpoint?: string;
-  /** Use path-style addressing (true) or virtual-hosted style (false). Defaults to true. */
-  pathStyle?: boolean;
-  region: string;
-  accessKeyId?: string;
-  secretAccessKey?: string;
+  host: string;
+  port?: number;
+  tls?: { verification: 'Full' | 'None' };
+  accessStyle: 'Path' | 'VirtualHosted';
+  region: { name: string };
+  credentials?: { accessKey: string; secretKey: string };
 }
 
 /** Full S3 config for creating a bucket-scoped provider. */
diff --git a/src/lib/server/storage/utils.test.ts b/src/lib/server/storage/utils.test.ts
index b83bfb17..013e99e7 100644
--- a/src/lib/server/storage/utils.test.ts
+++ b/src/lib/server/storage/utils.test.ts
@@ -12,7 +12,12 @@ vi.mock('./factory.js', () => ({
 import { getProvider } from './utils.js';
 import type { S3ConnectionConfig } from './types.js';
 
-const s3Config: S3ConnectionConfig = { type: 's3', region: 'us-east-1' };
+const s3Config: S3ConnectionConfig = {
+  type: 's3',
+  host: 'minio.example.com',
+  accessStyle: 'Path',
+  region: { name: 'us-east-1' }
+};
 
 describe('getProvider', () => {
   it('throws 400 for non-s3 connection type', () => {
diff --git a/src/lib/storage/bookmarks.svelte.spec.ts b/src/lib/storage/bookmarks.svelte.spec.ts
new file mode 100644
index 00000000..296e9102
--- /dev/null
+++ b/src/lib/storage/bookmarks.svelte.spec.ts
@@ -0,0 +1,147 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { BookmarksState } from '$lib/storage/bookmarks.svelte.js';
+import { LS_PINS, LS_RECENT_FILES, LS_RECENT_LOCATIONS } from '$lib/storage/persistence.js';
+
+describe('BookmarksState — connectionId scoping', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  describe('constructor filtering', () => {
+    it('loads only pins tagged with the given connectionId', () => {
+      localStorage.setItem(
+        LS_PINS,
+        JSON.stringify([
+          { bucket: 'a', prefix: 'data/', connectionId: 'conn-1' },
+          { bucket: 'b', prefix: 'other/', connectionId: 'conn-2' }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.pinnedLocations).toHaveLength(1);
+      expect(bookmarks.pinnedLocations[0].bucket).toBe('a');
+    });
+
+    it('loads only recent files tagged with the given connectionId', () => {
+      localStorage.setItem(
+        LS_RECENT_FILES,
+        JSON.stringify([
+          {
+            key: 'a.txt',
+            bucket: 'x',
+            size: 1,
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-1'
+          },
+          {
+            key: 'b.txt',
+            bucket: 'y',
+            size: 2,
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-2'
+          }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.recentFiles).toHaveLength(1);
+      expect(bookmarks.recentFiles[0].key).toBe('a.txt');
+    });
+
+    it('loads only recent locations tagged with the given connectionId', () => {
+      localStorage.setItem(
+        LS_RECENT_LOCATIONS,
+        JSON.stringify([
+          {
+            bucket: 'x',
+            prefix: 'images/',
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-1'
+          },
+          {
+            bucket: 'y',
+            prefix: 'docs/',
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-2'
+          }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.recentLocations).toHaveLength(1);
+      expect(bookmarks.recentLocations[0].prefix).toBe('images/');
+    });
+
+    it('silently drops entries without connectionId', () => {
+      localStorage.setItem(
+        LS_PINS,
+        JSON.stringify([
+          { bucket: 'legacy', prefix: '' } // no connectionId — pre-migration entry
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+
+      expect(bookmarks.pinnedLocations).toHaveLength(0);
+    });
+  });
+
+  describe('pin()', () => {
+    it('tags new pins with the connectionId', () => {
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.pin('my-bucket', 'images/');
+
+      const stored = JSON.parse(localStorage.getItem(LS_PINS) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(1);
+      expect((stored[0] as { connectionId: string }).connectionId).toBe('conn-1');
+    });
+
+    it('does not overwrite pins from other connections on persist', () => {
+      localStorage.setItem(
+        LS_PINS,
+        JSON.stringify([{ bucket: 'other', prefix: 'data/', connectionId: 'conn-2' }])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.pin('my-bucket', 'images/');
+
+      const stored = JSON.parse(localStorage.getItem(LS_PINS) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(2);
+    });
+  });
+
+  describe('recordFileVisit()', () => {
+    it('tags new entries with the connectionId', () => {
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.recordFileVisit('my-bucket', 'photo.jpg', 1024);
+
+      const stored = JSON.parse(localStorage.getItem(LS_RECENT_FILES) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(1);
+      expect((stored[0] as { connectionId: string }).connectionId).toBe('conn-1');
+    });
+
+    it('preserves recent files from other connections on persist', () => {
+      localStorage.setItem(
+        LS_RECENT_FILES,
+        JSON.stringify([
+          {
+            key: 'other.txt',
+            bucket: 'y',
+            size: 1,
+            visitedAt: new Date().toISOString(),
+            connectionId: 'conn-2'
+          }
+        ])
+      );
+
+      const bookmarks = new BookmarksState('conn-1');
+      bookmarks.recordFileVisit('my-bucket', 'photo.jpg', 1024);
+
+      const stored = JSON.parse(localStorage.getItem(LS_RECENT_FILES) ?? '[]') as unknown[];
+      expect(stored).toHaveLength(2);
+    });
+  });
+});
diff --git a/src/lib/storage/bookmarks.svelte.ts b/src/lib/storage/bookmarks.svelte.ts
index c104a201..6a40e798 100644
--- a/src/lib/storage/bookmarks.svelte.ts
+++ b/src/lib/storage/bookmarks.svelte.ts
@@ -20,22 +20,34 @@ function dedupByKey<T>(items: T[], keyFn: (item: T) => string): T[] {
 }
 
 export class BookmarksState {
-  pinnedLocations = $state<PinnedLocation[]>(
-    dedupByKey(loadFromStorage<PinnedLocation>(LS_PINS), (p) => p.bucket + '\0' + p.prefix)
-  );
-  recentFiles = $state<RecentFile[]>(
-    dedupByKey(loadFromStorage<RecentFile>(LS_RECENT_FILES), (f) => f.bucket + '\0' + f.key)
-  );
-  recentLocations = $state<RecentLocation[]>(
-    dedupByKey(
-      loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter((l) => Boolean(l.bucket)),
+  private readonly connectionId: string;
+
+  pinnedLocations = $state<PinnedLocation[]>([]);
+  recentFiles = $state<RecentFile[]>([]);
+  recentLocations = $state<RecentLocation[]>([]);
+
+  constructor(connectionId: string) {
+    this.connectionId = connectionId;
+
+    this.pinnedLocations = dedupByKey(
+      loadFromStorage<PinnedLocation>(LS_PINS).filter((p) => p.connectionId === connectionId),
+      (p) => p.bucket + '\0' + p.prefix
+    );
+    this.recentFiles = dedupByKey(
+      loadFromStorage<RecentFile>(LS_RECENT_FILES).filter((f) => f.connectionId === connectionId),
+      (f) => f.bucket + '\0' + f.key
+    );
+    this.recentLocations = dedupByKey(
+      loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter(
+        (l) => Boolean(l.bucket) && l.connectionId === connectionId
+      ),
       (l) => l.bucket + '\0' + l.prefix
-    )
-  );
+    );
+  }
 
   pin(bucket: string, prefix: string): void {
     if (this.pinnedLocations.some((p) => p.bucket === bucket && p.prefix === prefix)) return;
-    this.pinnedLocations.push({ bucket, prefix });
+    this.pinnedLocations.push({ bucket, prefix, connectionId: this.connectionId });
     this.persistPins();
   }
 
@@ -66,26 +78,47 @@ export class BookmarksState {
   }
 
   private persistPins(): void {
-    persistToStorage(LS_PINS, [...this.pinnedLocations]);
+    // Merge with entries from other connections so we don't wipe their pins.
+    const others = loadFromStorage<PinnedLocation>(LS_PINS).filter(
+      (p) => p.connectionId !== this.connectionId
+    );
+    persistToStorage(LS_PINS, [...others, ...this.pinnedLocations]);
   }
 
   recordFileVisit(bucket: string, key: string, size: number): void {
     const idx = this.recentFiles.findIndex((f) => f.bucket === bucket && f.key === key);
-    const entry: RecentFile = { key, bucket, size, visitedAt: new SvelteDate().toISOString() };
+    const entry: RecentFile = {
+      key,
+      bucket,
+      size,
+      visitedAt: new SvelteDate().toISOString(),
+      connectionId: this.connectionId
+    };
     if (idx !== -1) this.recentFiles.splice(idx, 1);
     this.recentFiles.unshift(entry);
     if (this.recentFiles.length > maxRecentFiles) this.recentFiles.splice(maxRecentFiles);
-    persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+    const others = loadFromStorage<RecentFile>(LS_RECENT_FILES).filter(
+      (f) => f.connectionId !== this.connectionId
+    );
+    persistToStorage(LS_RECENT_FILES, [...others, ...this.recentFiles]);
   }
 
   recordLocationVisit(bucket: string, prefix: string): void {
     if (!bucket) return;
     const idx = this.recentLocations.findIndex((l) => l.bucket === bucket && l.prefix === prefix);
-    const entry: RecentLocation = { bucket, prefix, visitedAt: new SvelteDate().toISOString() };
+    const entry: RecentLocation = {
+      bucket,
+      prefix,
+      visitedAt: new SvelteDate().toISOString(),
+      connectionId: this.connectionId
+    };
     if (idx !== -1) this.recentLocations.splice(idx, 1);
     this.recentLocations.unshift(entry);
     if (this.recentLocations.length > maxRecentFiles) this.recentLocations.splice(maxRecentFiles);
-    persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
+    const others = loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter(
+      (l) => l.connectionId !== this.connectionId
+    );
+    persistToStorage(LS_RECENT_LOCATIONS, [...others, ...this.recentLocations]);
   }
 
   removeFiles(bucket: string, fileKeys: string[]): void {
@@ -95,7 +128,10 @@ export class BookmarksState {
     const keep = this.recentFiles.filter((f) => !(f.bucket === bucket && keySet.has(f.key)));
     if (keep.length !== before) {
       this.recentFiles.splice(0, this.recentFiles.length, ...keep);
-      persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+      const others = loadFromStorage<RecentFile>(LS_RECENT_FILES).filter(
+        (f) => f.connectionId !== this.connectionId
+      );
+      persistToStorage(LS_RECENT_FILES, [...others, ...keep]);
     }
   }
 
@@ -109,7 +145,10 @@ export class BookmarksState {
     if (removedFiles > 0) {
       const keep = this.recentFiles.filter((f) => !(f.bucket === bucket && underAny(f.key)));
       this.recentFiles.splice(0, this.recentFiles.length, ...keep);
-      persistToStorage(LS_RECENT_FILES, [...this.recentFiles]);
+      const others = loadFromStorage<RecentFile>(LS_RECENT_FILES).filter(
+        (f) => f.connectionId !== this.connectionId
+      );
+      persistToStorage(LS_RECENT_FILES, [...others, ...keep]);
     }
 
     const removedLocs = this.recentLocations.filter(
@@ -118,7 +157,10 @@ export class BookmarksState {
     if (removedLocs > 0) {
       const keep = this.recentLocations.filter((l) => !(l.bucket === bucket && underAny(l.prefix)));
       this.recentLocations.splice(0, this.recentLocations.length, ...keep);
-      persistToStorage(LS_RECENT_LOCATIONS, [...this.recentLocations]);
+      const others = loadFromStorage<RecentLocation>(LS_RECENT_LOCATIONS).filter(
+        (l) => l.connectionId !== this.connectionId
+      );
+      persistToStorage(LS_RECENT_LOCATIONS, [...others, ...keep]);
     }
   }
 }
diff --git a/src/lib/storage/connection-storage.spec.ts b/src/lib/storage/connection-storage.spec.ts
new file mode 100644
index 00000000..7d662095
--- /dev/null
+++ b/src/lib/storage/connection-storage.spec.ts
@@ -0,0 +1,261 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import {
+  saveConnectionLocally,
+  updateConnectionLocally,
+  loadConnectionLocally,
+  loadAllConnectionsLocally,
+  removeConnectionLocally,
+  removeConnectionById,
+  loadConnectionById
+} from '$lib/storage/connection-storage.js';
+import type { StoredConnection, SavedConnection } from '$lib/storage/connection-storage.js';
+
+const STORAGE_KEY = 'stackable_storage_connections';
+
+// localStorage is unavailable in the Node (server) test environment — stub it.
+const store: Record<string, string> = {};
+vi.stubGlobal('localStorage', {
+  getItem: (key: string) => store[key] ?? null,
+  setItem: (key: string, value: string) => {
+    store[key] = value;
+  },
+  removeItem: (key: string) => {
+    delete store[key];
+  },
+  clear: () => {
+    for (const k of Object.keys(store)) delete store[k];
+  }
+});
+
+// crypto.randomUUID is available in Node 15+ — ensure it is present.
+if (!globalThis.crypto) {
+  const { webcrypto } = await import('crypto');
+  vi.stubGlobal('crypto', webcrypto);
+}
+
+function makeConn(
+  overrides: Partial<Omit<SavedConnection, 'id'>> & { id?: string } = {}
+): SavedConnection {
+  return {
+    id: overrides.id ?? crypto.randomUUID(),
+    type: 's3',
+    host: 'minio.example.com',
+    port: 9000,
+    tls: { verification: 'Full' },
+    accessStyle: 'Path',
+    region: { name: 'us-east-1' },
+    credentials: { accessKey: 'AKIA123', secretKey: 'secret' },
+    ...overrides
+  } as SavedConnection;
+}
+
+describe('connection-storage', () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  describe('saveConnectionLocally', () => {
+    it('stores a connection and assigns the given id', () => {
+      const conn = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(conn);
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+    });
+
+    it('generates a uuid when id is not set', () => {
+      const conn = makeConn();
+      // Simulate missing id (e.g. from legacy code path) by deleting it
+      const connWithoutId = { ...conn } as Partial<StoredConnection>;
+      delete connWithoutId.id;
+      saveConnectionLocally(connWithoutId as StoredConnection);
+      const stored = loadAllConnectionsLocally();
+      expect(stored[0].id).toBeDefined();
+      expect(stored[0].id).toMatch(
+        /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
+      );
+    });
+
+    it('appends to the end (most recently used)', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+      const stored = loadAllConnectionsLocally();
+      expect(stored[stored.length - 1].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+
+    it('replaces an existing connection with the same id and moves it to end', () => {
+      const conn = makeConn({
+        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+        region: { name: 'us-east-1' }
+      });
+      saveConnectionLocally(conn);
+      const updated = makeConn({
+        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+        region: { name: 'eu-west-1' }
+      });
+      saveConnectionLocally(updated);
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].region.name).toBe('eu-west-1');
+    });
+
+    it('deduplicates by host+port+accessKey when no id is supplied', () => {
+      // First save — assigns a UUID
+      const connWithoutId = {
+        type: 's3' as const,
+        host: 'minio.example.com',
+        port: 9000,
+        tls: { verification: 'Full' as const },
+        accessStyle: 'Path' as const,
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'AKIA123', secretKey: 'secret' }
+      };
+      saveConnectionLocally(connWithoutId);
+      const afterFirst = loadAllConnectionsLocally();
+      expect(afterFirst).toHaveLength(1);
+      const assignedId = afterFirst[0].id;
+
+      // Second save with same identity but no id — should reuse the existing entry
+      saveConnectionLocally({ ...connWithoutId, region: { name: 'eu-west-1' } });
+      const afterSecond = loadAllConnectionsLocally();
+      expect(afterSecond).toHaveLength(1);
+      expect(afterSecond[0].id).toBe(assignedId);
+      expect(afterSecond[0].region.name).toBe('eu-west-1');
+    });
+  });
+
+  describe('updateConnectionLocally', () => {
+    it('updates an existing connection in-place by id', () => {
+      const a = makeConn({
+        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
+        region: { name: 'us-east-1' }
+      });
+      const b = makeConn({
+        id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
+        region: { name: 'eu-west-1' }
+      });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+
+      updateConnectionLocally('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', {
+        region: { name: 'ap-south-1' }
+      });
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(2);
+      // Preserved position (first)
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+      expect(stored[0].region.name).toBe('ap-south-1');
+      // Second connection unchanged
+      expect(stored[1].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+      expect(stored[1].region.name).toBe('eu-west-1');
+    });
+
+    it('is a no-op when the id does not exist', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(a);
+
+      updateConnectionLocally('00000000-0000-0000-0000-000000000000', {
+        region: { name: 'us-west-2' }
+      });
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].region.name).toBe(a.region.name);
+    });
+
+    it('preserves the id even when data omits it', () => {
+      const conn = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(conn);
+      updateConnectionLocally('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', { name: 'Prod' });
+      const stored = loadAllConnectionsLocally();
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+      expect(stored[0].name).toBe('Prod');
+    });
+  });
+
+  describe('loadConnectionLocally', () => {
+    it('returns null when nothing is stored', () => {
+      expect(loadConnectionLocally()).toBeNull();
+    });
+
+    it('returns the last (most recently used) connection', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+      const loaded = loadConnectionLocally();
+      expect(loaded?.id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+  });
+
+  describe('loadAllConnectionsLocally', () => {
+    it('silently drops entries that fail schema validation (clean break)', () => {
+      // Write raw data including a legacy entry with old schema fields
+      const legacy = {
+        id: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc',
+        type: 's3',
+        endpoint: 'https://old.example.com',
+        pathStyle: true,
+        region: 'eu-central-1',
+        accessKeyId: '',
+        secretAccessKey: ''
+      };
+      const valid = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      localStorage.setItem(STORAGE_KEY, JSON.stringify([legacy, valid]));
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+    });
+
+    it('returns an empty array when localStorage is empty', () => {
+      expect(loadAllConnectionsLocally()).toEqual([]);
+    });
+  });
+
+  describe('removeConnectionLocally', () => {
+    it('removes a connection matched by id', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+
+      removeConnectionLocally(a);
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+  });
+
+  describe('removeConnectionById', () => {
+    it('removes a connection by id string', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
+      saveConnectionLocally(a);
+      saveConnectionLocally(b);
+
+      removeConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+
+      const stored = loadAllConnectionsLocally();
+      expect(stored).toHaveLength(1);
+      expect(stored[0].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
+    });
+  });
+
+  describe('loadConnectionById', () => {
+    it('returns the connection with the given id', () => {
+      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
+      saveConnectionLocally(a);
+      const found = loadConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+      expect(found?.id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
+    });
+
+    it('returns null when the id does not exist', () => {
+      expect(loadConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')).toBeNull();
+    });
+  });
+});
diff --git a/src/lib/storage/connection-storage.ts b/src/lib/storage/connection-storage.ts
index bf868931..dd7ee8b1 100644
--- a/src/lib/storage/connection-storage.ts
+++ b/src/lib/storage/connection-storage.ts
@@ -1,8 +1,15 @@
 import type { z } from 'zod';
-import type { StorageConnectionSchema } from './schemas.js';
+import { StorageConnectionSchema } from './schemas.js';
 
+/** Raw form data — `id` may be absent when creating a new connection. */
 export type StoredConnection = z.infer<typeof StorageConnectionSchema>;
 
+/**
+ * A connection that has been persisted to localStorage and always has an `id`.
+ * All load/update/remove functions work with this type.
+ */
+export type SavedConnection = StoredConnection & { id: string };
+
 /**
  * HTTP header name used to pass the S3 connection config from the browser to
  * the backend API endpoints. Defined here (client-safe module) so both client
@@ -12,64 +19,109 @@ export const STORAGE_CONNECTION_HEADER = 'x-storage-connection';
 
 const STORAGE_KEY = 'stackable_storage_connections';
 
-/** Unique key for deduplicating connections by type, endpoint, and access key. */
-function connectionKey(c: StoredConnection): string {
-  return `${c.type}|${c.endpoint ?? ''}|${c.accessKeyId ?? ''}`;
-}
-
 /**
- * Load all stored connections, migrating from the legacy single-connection
- * format if present. Returns connections oldest-first (most recent is last).
+ * Load all stored connections. Entries that do not satisfy the current schema
+ * (clean-break migration) are silently dropped.
+ * Returns connections oldest-first (most recent is last).
  */
-function getConnections(): StoredConnection[] {
+function getConnections(): SavedConnection[] {
   try {
     const raw = localStorage.getItem(STORAGE_KEY);
     if (!raw) return [];
-    return JSON.parse(raw) as StoredConnection[];
+    const parsed = JSON.parse(raw) as unknown[];
+    return parsed.flatMap((c) => {
+      const result = StorageConnectionSchema.safeParse(c);
+      if (!result.success || !result.data.id) return [];
+      return [result.data as SavedConnection];
+    });
   } catch {
     return [];
   }
 }
 
 /**
- * Save a connection. If a connection with the same type, endpoint, and access
- * key already exists it is replaced and moved to the end (most recently used).
+ * Save a new connection. Generates a UUID `id` if one is not already set.
+ * Connections are stored oldest-first; the new connection is appended (most recently used).
  */
 export function saveConnectionLocally(data: StoredConnection): void {
   try {
     const all = getConnections();
-    const key = connectionKey(data);
-    const filtered = all.filter((c) => connectionKey(c) !== key);
-    filtered.push(data);
+    // If a caller-supplied id is present, look up by id first (edit / reconnect
+    // with a known id). Only fall back to content-matching when no id is given,
+    // so that reconnecting with the same credentials (host+port+accessKey) after
+    // a page reload does not create a duplicate entry.
+    const existing = data.id
+      ? all.find((c) => c.id === data.id)
+      : all.find(
+          (c) =>
+            c.host === data.host &&
+            c.port === data.port &&
+            c.credentials?.accessKey === data.credentials?.accessKey
+        );
+    const id = existing?.id ?? data.id ?? crypto.randomUUID();
+    const connection: SavedConnection = { ...data, id };
+    const filtered = all.filter((c) => c.id !== id);
+    filtered.push(connection);
     localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
   } catch {
     // localStorage may be unavailable (e.g. private browsing quota exceeded)
   }
 }
 
+/**
+ * Update an existing connection in-place by its `id`, preserving its position
+ * in the list. If no connection with that `id` exists, this is a no-op.
+ */
+export function updateConnectionLocally(id: string, data: Partial<StoredConnection>): void {
+  try {
+    const all = getConnections();
+    const idx = all.findIndex((c) => c.id === id);
+    if (idx === -1) return;
+    all[idx] = { ...all[idx], ...data, id };
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(all));
+  } catch {
+    // localStorage may be unavailable
+  }
+}
+
 /** Return the most recently used connection (last in the list), or null. */
-export function loadConnectionLocally(): StoredConnection | null {
+export function loadConnectionLocally(): SavedConnection | null {
   const all = getConnections();
   return all.length > 0 ? all[all.length - 1] : null;
 }
 
 /** Return all stored connections in stored order (oldest first). */
-export function loadAllConnectionsLocally(): StoredConnection[] {
+export function loadAllConnectionsLocally(): SavedConnection[] {
   return getConnections();
 }
 
-/** Remove a specific connection from storage without clearing others. */
-export function removeConnectionLocally(data: StoredConnection): void {
+/** Remove a specific connection from storage by its `id`. */
+export function removeConnectionLocally(data: SavedConnection): void {
+  try {
+    const all = getConnections();
+    const filtered = all.filter((c) => c.id !== data.id);
+    localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
+  } catch {
+    // localStorage may be unavailable
+  }
+}
+
+/** Remove a connection from storage by its `id` string. */
+export function removeConnectionById(id: string): void {
   try {
     const all = getConnections();
-    const key = connectionKey(data);
-    const filtered = all.filter((c) => connectionKey(c) !== key);
+    const filtered = all.filter((c) => c.id !== id);
     localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
   } catch {
     // localStorage may be unavailable
   }
 }
 
+/** Return a single connection by its `id`, or null if not found. */
+export function loadConnectionById(id: string): SavedConnection | null {
+  return getConnections().find((c) => c.id === id) ?? null;
+}
+
 /**
  * Encode a connection config as a base64 JSON string suitable for the
  * `X-Storage-Connection` request header sent to the backend.
diff --git a/src/lib/storage/schemas.ts b/src/lib/storage/schemas.ts
index 6678ccf3..5a51d14d 100644
--- a/src/lib/storage/schemas.ts
+++ b/src/lib/storage/schemas.ts
@@ -1,29 +1,69 @@
 import { z } from 'zod';
 
-export const StorageConnectionSchema = z
-  .object({
-    type: z.enum(['s3', 'hdfs']).default('s3'),
-    endpoint: z.url({ message: 'Must be a valid URL' }).or(z.literal('')).optional(),
-    pathStyle: z.boolean().default(true),
-    region: z.string().min(1).default('eu-central-1'),
-    accessKeyId: z.string().optional(),
-    secretAccessKey: z.string().optional()
-  })
-  .superRefine((data, ctx) => {
-    const hasKey = !!data.accessKeyId;
-    const hasSecret = !!data.secretAccessKey;
-    if (hasKey && !hasSecret) {
-      ctx.addIssue({
-        code: 'custom',
-        path: ['secretAccessKey'],
-        message: 'Secret access key is required when access key ID is provided'
-      });
-    }
-    if (!hasKey && hasSecret) {
-      ctx.addIssue({
-        code: 'custom',
-        path: ['accessKeyId'],
-        message: 'Access key ID is required when secret access key is provided'
-      });
-    }
-  });
+const baseStorageConnectionObject = z.object({
+  id: z.string().uuid().optional(),
+  name: z.string().optional(),
+  type: z.enum(['s3', 'hdfs']).default('s3'),
+  host: z
+    .string()
+    .min(1, 'Host is required')
+    .transform((v) => {
+      if (!v.includes('://')) return v;
+      try {
+        return new URL(v).hostname;
+      } catch {
+        // Fallback: strip scheme manually, take just the host part
+        return v.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '').split(/[/:?#]/)[0];
+      }
+    }),
+  port: z.coerce
+    .number()
+    .int()
+    .min(1)
+    .max(65535)
+    .optional()
+    .or(z.literal('').transform(() => undefined)),
+  tls: z.object({ verification: z.enum(['Full', 'None']) }).optional(),
+  accessStyle: z.enum(['Path', 'VirtualHosted']).default('VirtualHosted'),
+  region: z.object({ name: z.string().min(1) }).default({ name: 'us-east-1' }),
+  credentials: z
+    .object({
+      accessKey: z.string(),
+      secretKey: z.string()
+    })
+    .default({ accessKey: '', secretKey: '' })
+});
+
+export const StorageConnectionSchema = baseStorageConnectionObject.superRefine((data, ctx) => {
+  const hasKey = !!data.credentials.accessKey;
+  const hasSecret = !!data.credentials.secretKey;
+  if (hasKey && !hasSecret) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['credentials', 'secretKey'],
+      message: 'Secret key is required when access key is provided'
+    });
+  }
+  if (!hasKey && hasSecret) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['credentials', 'accessKey'],
+      message: 'Access key is required when secret key is provided'
+    });
+  }
+});
+
+/**
+ * Schema variant for the edit form. Identical to StorageConnectionSchema except
+ * that a blank secretKey is allowed when accessKey is provided — leaving it blank
+ * means "keep the existing secret key".
+ */
+export const EditStorageConnectionSchema = baseStorageConnectionObject.superRefine((data, ctx) => {
+  if (!data.credentials.accessKey && !!data.credentials.secretKey) {
+    ctx.addIssue({
+      code: 'custom',
+      path: ['credentials', 'accessKey'],
+      message: 'Access key is required when secret key is provided'
+    });
+  }
+});
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index d04e1abc..fd0a7ac2 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -97,7 +97,7 @@ export class StorageState {
   isInArchive = $derived(this.archiveKey !== null);
 
   // ── Composed sub-state ──
-  bookmarks = new BookmarksState();
+  bookmarks: BookmarksState;
 
   // ── Navigation handler (injected by page component) ──
   private _onNavigate: NavigateFn = () => {};
@@ -115,6 +115,7 @@ export class StorageState {
     if (options?.connected !== undefined) this.connected = options.connected;
     if (options?.buckets) this.buckets = options.buckets;
     if (options?.connectionId !== undefined) this.connectionId = options.connectionId;
+    this.bookmarks = new BookmarksState(options?.connectionId ?? '');
   }
 
   // ────────────────────────────────────────────────────────────────────────────
@@ -575,8 +576,12 @@ export class StorageState {
       case 'copy-filename': {
         const nameKey = ctxKey ?? this.selectedFiles[0]?.key;
         if (!nameKey) return;
-        await navigator.clipboard.writeText(keyToName(nameKey));
-        addToast('success', m.storage_action_copy_filename_success());
+        try {
+          await navigator.clipboard.writeText(keyToName(nameKey));
+          addToast('success', m.storage_action_copy_filename_success());
+        } catch {
+          addToast('error', m.storage_action_copy_filename_error());
+        }
         return;
       }
 
@@ -585,8 +590,12 @@ export class StorageState {
         if (!pathKey) return;
         // Strip trailing slash for folders so the URI is canonical.
         const cleanKey = pathKey.endsWith('/') ? pathKey.slice(0, -1) : pathKey;
-        await navigator.clipboard.writeText(`s3://${this.bucket}/${cleanKey}`);
-        addToast('success', m.storage_action_copy_path_success());
+        try {
+          await navigator.clipboard.writeText(`s3://${this.bucket}/${cleanKey}`);
+          addToast('success', m.storage_action_copy_path_success());
+        } catch {
+          addToast('error', m.storage_action_copy_path_error());
+        }
         return;
       }
     }
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index f79be27b..984e05e4 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -52,7 +52,9 @@ export interface StorageLocation {
   prefix: string;
 }
 
-export type PinnedLocation = StorageLocation;
+export interface PinnedLocation extends StorageLocation {
+  connectionId: string;
+}
 
 // ── Recent items ─────────────────────────────────────────────────────────────
 
@@ -61,12 +63,14 @@ export interface RecentFile {
   bucket: string;
   size: number;
   visitedAt: string;
+  connectionId: string;
 }
 
 export interface RecentLocation {
   bucket: string;
   prefix: string;
   visitedAt: string;
+  connectionId: string;
 }
 
 // ── Storage objects ──────────────────────────────────────────────────────────
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 375f8d76..47be34ba 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import { untrack } from 'svelte';
+  import { page } from '$app/state';
   import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
   import { StorageState } from '$lib/storage/state.svelte.js';
   import { setStorageState } from '$lib/storage/context.js';
@@ -10,7 +11,8 @@
     () =>
       new StorageState({
         connected: data.connected,
-        buckets: data.buckets
+        buckets: data.buckets,
+        connectionId: data.connectionId
       })
   );
   setStorageState(storage);
@@ -20,9 +22,12 @@
     storage.connected = data.connected;
     storage.buckets = data.buckets;
   });
+
+  // Connections management pages have their own full-page layout — no sidebar.
+  const isConnectionsRoute = $derived(page.url.pathname.startsWith('/storage/connections'));
 </script>
 
-{#if data.connected}
+{#if data.connected && !isConnectionsRoute}
   <div class="flex h-full min-h-0 gap-4">
     <BucketList />
     <div class="flex min-w-0 flex-1 flex-col">
diff --git a/src/routes/(app)/storage/+layout.ts b/src/routes/(app)/storage/+layout.ts
index 3cacfad2..2f159430 100644
--- a/src/routes/(app)/storage/+layout.ts
+++ b/src/routes/(app)/storage/+layout.ts
@@ -2,7 +2,11 @@ import { browser } from '$app/environment';
 import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
 import type { LayoutLoad } from './$types';
 
-const DISCONNECTED = { connected: false, buckets: [] as string[], connectionType: null };
+const DISCONNECTED = {
+  connected: false,
+  buckets: [] as string[],
+  connectionType: null
+};
 
 /**
  * Client-side load: reads the connection from localStorage and fetches the bucket
@@ -28,7 +32,12 @@ export const load: LayoutLoad = async ({ fetch, url }) => {
     if (!res.ok) return DISCONNECTED;
 
     const buckets = (await res.json()) as string[];
-    return { connected: true, buckets, connectionType: connection.type };
+    return {
+      connected: true,
+      buckets,
+      connectionType: connection.type,
+      connectionId: connection.id
+    };
   } catch {
     return DISCONNECTED;
   }
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 55cab9d9..4ef09ef4 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -7,7 +7,11 @@ import { getConnectionProvider } from '$lib/server/storage/utils.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
-  const connectionForm = await superValidate(zod(StorageConnectionSchema));
+  const connectionForm = await superValidate(
+    { tls: { verification: 'Full' } },
+    zod(StorageConnectionSchema),
+    { errors: false }
+  );
   locals.logger.debug('loading storage page');
   return { connectionForm };
 };
@@ -22,19 +26,23 @@ export const actions: Actions = {
       return fail(400, { form });
     }
 
-    const { type, endpoint, pathStyle, region, accessKeyId, secretAccessKey } = form.data;
+    const { type, host, port, tls, accessStyle, region, credentials } = form.data;
 
     if (type !== 's3') {
       return message(form, 'HDFS connections are not yet supported', { status: 400 });
     }
 
+    const resolvedCredentials =
+      credentials.accessKey && credentials.secretKey ? credentials : undefined;
+
     const config: S3ConnectionConfig = {
       type: 's3',
-      endpoint: endpoint || undefined,
-      pathStyle,
+      host,
+      port,
+      tls,
+      accessStyle,
       region,
-      accessKeyId: accessKeyId || undefined,
-      secretAccessKey: secretAccessKey || undefined
+      credentials: resolvedCredentials
     };
 
     try {
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index c6cb3ad9..2225dd6e 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -2,6 +2,7 @@
   import { browser } from '$app/environment';
   import { goto } from '$app/navigation';
   import { resolve } from '$app/paths';
+  import { onMount } from 'svelte';
   import { navigating } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
@@ -65,6 +66,11 @@
   function handleDismiss() {
     savedTabs = null;
   }
+
+  let mounted = $state(false);
+  onMount(() => {
+    mounted = true;
+  });
 </script>
 
 {#if data.connected}
@@ -109,6 +115,6 @@
   <div class="relative flex h-full min-h-0 flex-col overflow-y-auto p-2">
     <RecentItems />
   </div>
-{:else}
+{:else if mounted}
   <StorageConnectForm connectionForm={data.connectionForm} />
 {/if}
diff --git a/src/routes/(app)/storage/connections/+page.server.ts b/src/routes/(app)/storage/connections/+page.server.ts
new file mode 100644
index 00000000..cf837762
--- /dev/null
+++ b/src/routes/(app)/storage/connections/+page.server.ts
@@ -0,0 +1,8 @@
+import type { PageServerLoad } from './$types';
+
+// The connections list is managed entirely in localStorage on the client.
+// The server only provides an empty shell so the route is authenticated.
+export const load: PageServerLoad = async ({ locals }) => {
+  locals.logger.debug('loading storage connections management page');
+  return {};
+};
diff --git a/src/routes/(app)/storage/connections/+page.svelte b/src/routes/(app)/storage/connections/+page.svelte
new file mode 100644
index 00000000..7f5218b3
--- /dev/null
+++ b/src/routes/(app)/storage/connections/+page.svelte
@@ -0,0 +1,195 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { resolve } from '$app/paths';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
+  import IconEdit from 'virtual:icons/material-symbols/edit';
+  import IconDelete from 'virtual:icons/material-symbols/delete';
+  import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
+  import IconArrowBack from 'virtual:icons/material-symbols/arrow-back';
+  import * as m from '$lib/paraglide/messages.js';
+  import {
+    loadAllConnectionsLocally,
+    removeConnectionById,
+    type SavedConnection
+  } from '$lib/storage/connection-storage.js';
+  import DeleteConnectionModal from '$lib/components/storage/DeleteConnectionModal.svelte';
+
+  let connections = $state<SavedConnection[]>([]);
+  let loaded = $state(false);
+  let deleteCandidate = $state<SavedConnection | null>(null);
+  let deleteModalOpen = $state(false);
+
+  // Context menu
+  let menuConn: SavedConnection | null = $state(null);
+  let menuEl: HTMLUListElement | null = $state(null);
+  let menuRawPos = $state({ left: 0, top: 0 });
+
+  const menuPos = $derived.by(() => {
+    if (!menuConn) return { left: 0, top: 0 };
+    if (!menuEl) return menuRawPos;
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left:
+        menuRawPos.left + rect.width > window.innerWidth
+          ? menuRawPos.left - rect.width
+          : menuRawPos.left,
+      top:
+        menuRawPos.top + rect.height > window.innerHeight
+          ? menuRawPos.top - rect.height
+          : menuRawPos.top
+    };
+  });
+
+  onMount(() => {
+    connections = loadAllConnectionsLocally();
+    loaded = true;
+  });
+
+  function connectionLabel(conn: SavedConnection): string {
+    if (conn.name) return conn.name;
+    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+  }
+
+  function openContextMenu(e: MouseEvent, conn: SavedConnection) {
+    e.preventDefault();
+    e.stopPropagation();
+    menuRawPos = { left: e.clientX, top: e.clientY };
+    menuConn = conn;
+  }
+
+  function closeContextMenu() {
+    menuConn = null;
+  }
+
+  function handleOutsideClick(e: MouseEvent) {
+    if (menuConn && menuEl && !menuEl.contains(e.target as Node)) closeContextMenu();
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (menuConn && e.key === 'Escape') closeContextMenu();
+  }
+
+  function requestDelete(conn: SavedConnection) {
+    closeContextMenu();
+    deleteCandidate = conn;
+    deleteModalOpen = true;
+  }
+
+  function confirmDelete() {
+    if (!deleteCandidate) return;
+    removeConnectionById(deleteCandidate.id);
+    connections = loadAllConnectionsLocally();
+    deleteModalOpen = false;
+    deleteCandidate = null;
+  }
+
+  function cancelDelete() {
+    deleteModalOpen = false;
+    deleteCandidate = null;
+  }
+</script>
+
+<svelte:document onclick={handleOutsideClick} />
+<svelte:window onkeydown={handleKeydown} />
+
+<div class="mx-auto max-w-4xl p-6">
+  <a href={resolve('/storage') + '?disconnected=1'} class="btn btn-ghost btn-sm mb-4 -ml-2">
+    <IconArrowBack class="size-4" aria-hidden="true" />
+    {m.storage_connections_back()}
+  </a>
+
+  <h1 class="mb-1 text-xl font-semibold">{m.storage_connections_title()}</h1>
+  <p class="text-base-content/60 mb-6 text-sm">{m.storage_connections_subtitle()}</p>
+
+  {#if !loaded}
+    <div class="flex items-center justify-center py-12">
+      <span class="loading loading-spinner loading-md text-base-content/40"></span>
+    </div>
+  {:else if connections.length === 0}
+    <p class="text-base-content/50 text-sm">{m.storage_connections_empty()}</p>
+  {:else}
+    <div class="overflow-x-auto">
+      <table class="table-sm table">
+        <thead>
+          <tr>
+            <th>{m.storage_connections_col_name()}</th>
+            <th>{m.storage_connections_col_host()}</th>
+            <th>{m.storage_connections_col_type()}</th>
+            <th class="w-10"></th>
+          </tr>
+        </thead>
+        <tbody>
+          {#each connections as conn (conn.id)}
+            <tr
+              class="group hover:bg-base-300 cursor-default select-none"
+              class:outline={menuConn?.id === conn.id}
+              class:bg-base-200={menuConn?.id === conn.id}
+              oncontextmenu={(e) => openContextMenu(e, conn)}
+            >
+              <td>
+                <div class="flex items-center gap-2">
+                  <IconStorage class="text-primary size-4 shrink-0" aria-hidden="true" />
+                  <span class="font-medium">{connectionLabel(conn)}</span>
+                </div>
+              </td>
+              <td class="text-base-content/60 font-mono text-xs">
+                {conn.port ? `${conn.host}:${conn.port}` : conn.host}
+              </td>
+              <td class="text-base-content/60 text-xs uppercase">{conn.type}</td>
+              <td>
+                <button
+                  type="button"
+                  class="btn btn-ghost btn-xs btn-square opacity-0 group-hover:opacity-100"
+                  aria-label={m.storage_connections_options({ label: connectionLabel(conn) })}
+                  onclick={(e) => openContextMenu(e, conn)}
+                >
+                  <IconMoreHoriz class="size-4" aria-hidden="true" />
+                </button>
+              </td>
+            </tr>
+          {/each}
+        </tbody>
+      </table>
+    </div>
+  {/if}
+</div>
+
+<!-- Context menu (right-click or \u22ef button) -->
+{#if menuConn}
+  <ul
+    bind:this={menuEl}
+    class="menu menu-sm border-base-300 bg-base-100 fixed z-50 w-36 rounded-lg border p-1 shadow-lg"
+    role="menu"
+    tabindex="-1"
+    style="left: {menuPos.left}px; top: {menuPos.top}px;"
+  >
+    <li role="none">
+      <a
+        href={resolve(`/storage/connections/${menuConn.id}/edit`)}
+        role="menuitem"
+        onclick={closeContextMenu}
+      >
+        <IconEdit class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connections_edit()}
+      </a>
+    </li>
+    <li role="none">
+      <button
+        type="button"
+        role="menuitem"
+        class="text-error"
+        onclick={() => requestDelete(menuConn!)}
+      >
+        <IconDelete class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_connections_delete()}
+      </button>
+    </li>
+  </ul>
+{/if}
+
+<DeleteConnectionModal
+  bind:open={deleteModalOpen}
+  connection={deleteCandidate}
+  onconfirm={confirmDelete}
+  oncancel={cancelDelete}
+/>
diff --git a/src/routes/(app)/storage/connections/[id]/+layout.svelte b/src/routes/(app)/storage/connections/[id]/+layout.svelte
new file mode 100644
index 00000000..5610b09b
--- /dev/null
+++ b/src/routes/(app)/storage/connections/[id]/+layout.svelte
@@ -0,0 +1,22 @@
+<script lang="ts">
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
+  import { page } from '$app/state';
+  import StorageConnectionSidebar from '$lib/components/storage/sidebar/StorageConnectionSidebar.svelte';
+  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+
+  let { children } = $props();
+
+  const connectionId = $derived(page.params.id);
+
+  function handleSelect(conn: SavedConnection) {
+    goto(resolve(`/storage/connections/${conn.id}/edit`));
+  }
+</script>
+
+<div class="flex flex-col gap-4 md:flex-row md:items-start">
+  <StorageConnectionSidebar activeId={connectionId} onselect={handleSelect} />
+  <div class="min-w-0 flex-1">
+    {@render children()}
+  </div>
+</div>
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
new file mode 100644
index 00000000..09811238
--- /dev/null
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
@@ -0,0 +1,64 @@
+import { fail } from '@sveltejs/kit';
+import { superValidate, message } from 'sveltekit-superforms';
+import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import type { Actions, PageServerLoad } from './$types';
+import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
+import { getConnectionProvider } from '$lib/server/storage/utils.js';
+import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
+
+export const load: PageServerLoad = async ({ locals }) => {
+  const editForm = await superValidate(
+    { tls: { verification: 'Full' } },
+    zod(EditStorageConnectionSchema),
+    { errors: false }
+  );
+  locals.logger.debug('loading storage connection edit page');
+  return { editForm };
+};
+
+export const actions: Actions = {
+  update: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(EditStorageConnectionSchema));
+
+    if (!form.valid) {
+      log.debug({ errors: form.errors }, 'storage connection edit form validation failed');
+      return fail(400, { form });
+    }
+
+    const { type, host, port, tls, accessStyle, region, credentials } = form.data;
+
+    if (type !== 's3') {
+      return message(form, 'HDFS connections are not yet supported', { status: 400 });
+    }
+
+    const resolvedCredentials =
+      credentials.accessKey && credentials.secretKey ? credentials : undefined;
+
+    const config: S3ConnectionConfig = {
+      type: 's3',
+      host,
+      port,
+      tls,
+      accessStyle,
+      region,
+      credentials: resolvedCredentials
+    };
+
+    // If no credentials were submitted the user chose to keep the existing ones,
+    // so skip the live connection test (it was already verified when first saved).
+    if (resolvedCredentials) {
+      try {
+        await getConnectionProvider(config).listContainers();
+        log.info({ storage_type: type }, 'storage connection edit verified');
+      } catch (err) {
+        log.warn({ err }, 'storage connection edit test failed');
+        return message(form, 'Could not connect — check the endpoint and credentials.', {
+          status: 400
+        });
+      }
+    }
+
+    return message(form, 'ok');
+  }
+};
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
new file mode 100644
index 00000000..9da8b957
--- /dev/null
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
@@ -0,0 +1,366 @@
+<script lang="ts">
+  import { onMount } from 'svelte';
+  import { goto, beforeNavigate } from '$app/navigation';
+  import { resolve } from '$app/paths';
+  import { page } from '$app/state';
+  import { superForm } from 'sveltekit-superforms';
+  import { zod4 as zod } from 'sveltekit-superforms/adapters';
+  import { untrack } from 'svelte';
+  import IconInfo from 'virtual:icons/material-symbols/info';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
+  import {
+    loadConnectionById,
+    loadConnectionLocally,
+    updateConnectionLocally,
+    type SavedConnection
+  } from '$lib/storage/connection-storage.js';
+
+  let { data } = $props();
+
+  const uid = $props.id();
+
+  // Loaded client-side from localStorage
+  let connection = $state<SavedConnection | null>(null);
+  let loaded = $state(false);
+  let isActiveConnection = $state(false);
+
+  // Unsaved-changes guard
+  let initialSnapshot = $state.raw('');
+  let confirmLeaveOpen = $state(false);
+  let pendingNavigation = $state<string | null>(null);
+  // Set to true just before a programmatic goto so beforeNavigate doesn't re-intercept it.
+  let bypassDirtyCheck = false;
+
+  // Extract the id from the URL via SvelteKit's page state
+  const connectionId = page.params.id;
+
+  const { form, errors, enhance, submitting, message } = superForm(
+    untrack(() => data.editForm),
+    {
+      dataType: 'json',
+      validators: zod(EditStorageConnectionSchema),
+      onResult: ({ result, cancel }) => {
+        if (result.type === 'success' && result.data?.form?.message === 'ok') {
+          if (connection) {
+            // If credentials were left blank, preserve the existing stored credentials.
+            const savedCredentials =
+              $form.credentials.accessKey && $form.credentials.secretKey
+                ? $form.credentials
+                : (connection.credentials ?? { accessKey: '', secretKey: '' });
+            updateConnectionLocally(connection.id, { ...$form, credentials: savedCredentials });
+          }
+          // Prevent superforms from resetting the form and calling invalidateAll(),
+          // which would race with the navigation.
+          cancel();
+          // Bypass the dirty-check guard so the post-save redirect isn't intercepted.
+          bypassDirtyCheck = true;
+          goto(resolve('/storage/connections'));
+        }
+      }
+    }
+  );
+
+  function isFormDirty(): boolean {
+    return loaded && !!initialSnapshot && JSON.stringify($form) !== initialSnapshot;
+  }
+
+  onMount(() => {
+    if (!connectionId) {
+      goto(resolve('/storage/connections'));
+      return;
+    }
+    const found = loadConnectionById(connectionId);
+    if (!found) {
+      goto(resolve('/storage/connections'));
+      return;
+    }
+    connection = found;
+
+    // Pre-fill form with current values
+    $form.id = found.id;
+    $form.name = found.name ?? '';
+    $form.type = found.type;
+    $form.host = found.host;
+    $form.port = found.port;
+    $form.tls = found.tls;
+    $form.accessStyle = found.accessStyle;
+    $form.region = found.region;
+    // Pre-fill access key but never expose the stored secret key.
+    $form.credentials = { accessKey: found.credentials?.accessKey ?? '', secretKey: '' };
+
+    // Check if this is the currently active connection
+    const active = loadConnectionLocally();
+    isActiveConnection = active?.id === found.id;
+
+    // Snapshot the pre-filled form so we can detect unsaved changes.
+    initialSnapshot = JSON.stringify($form);
+    loaded = true;
+  });
+
+  beforeNavigate(({ cancel: cancelNav, to }) => {
+    if (!bypassDirtyCheck && isFormDirty() && to?.url) {
+      cancelNav();
+      pendingNavigation = to.url.pathname + to.url.search + to.url.hash;
+      confirmLeaveOpen = true;
+    }
+  });
+
+  function confirmLeave() {
+    const dest = pendingNavigation!;
+    confirmLeaveOpen = false;
+    pendingNavigation = null;
+    bypassDirtyCheck = true;
+    goto(dest);
+  }
+
+  function cancelLeave() {
+    confirmLeaveOpen = false;
+    pendingNavigation = null;
+  }
+
+  function handleBeforeUnload(e: BeforeUnloadEvent) {
+    if (isFormDirty()) {
+      e.preventDefault();
+    }
+  }
+
+  function parseHostInput() {
+    const v = $form.host?.trim();
+    if (!v?.includes('://')) return;
+    try {
+      const url = new URL(v);
+      $form.host = url.hostname;
+      if (url.port) $form.port = Number(url.port);
+      $form.tls = url.protocol === 'https:' ? { verification: 'Full' } : undefined;
+    } catch {
+      // Not a parseable URL — leave unchanged
+    }
+  }
+</script>
+
+<svelte:window onbeforeunload={handleBeforeUnload} />
+
+<Modal bind:open={confirmLeaveOpen} class="modal">
+  <div class="modal-box">
+    <h3 class="text-lg font-semibold">{m.storage_connection_edit_unsaved_title()}</h3>
+    <p class="text-base-content/70 mt-2 text-sm">{m.storage_connection_edit_unsaved_body()}</p>
+    <div class="modal-action">
+      <button type="button" class="btn btn-ghost" onclick={cancelLeave}>
+        {m.storage_connection_edit_unsaved_stay()}
+      </button>
+      <button type="button" class="btn btn-error" onclick={confirmLeave}>
+        {m.storage_connection_edit_unsaved_leave()}
+      </button>
+    </div>
+  </div>
+</Modal>
+
+<h1 class="mb-1 text-xl font-semibold">{m.storage_connection_edit_title()}</h1>
+
+{#if !loaded}
+  <div class="flex items-center justify-center py-12">
+    <span class="loading loading-spinner loading-md text-base-content/40"></span>
+  </div>
+{:else}
+  {#if isActiveConnection}
+    <div role="note" class="alert alert-info mb-4 flex gap-2">
+      <IconInfo class="size-5 shrink-0" aria-hidden="true" />
+      <span class="text-sm">{m.storage_connection_edit_active_notice()}</span>
+    </div>
+  {/if}
+
+  <form method="POST" action="?/update" use:enhance class="flex flex-col gap-4">
+    <input type="hidden" name="id" value={$form.id} />
+
+    <!-- Connection name -->
+    <div>
+      <label for="{uid}-name" class="label mb-1 text-sm font-medium">
+        {m.storage_connection_edit_name()}
+      </label>
+      <input
+        id="{uid}-name"
+        name="name"
+        type="text"
+        class="input-bordered input w-full"
+        placeholder={m.storage_connection_edit_name_placeholder()}
+        bind:value={$form.name}
+      />
+      <p class="text-base-content/50 mt-1 text-xs">{m.storage_connection_edit_name_hint()}</p>
+    </div>
+
+    <!-- Backend type (hidden — editing type not supported) -->
+    <input type="hidden" name="type" value={$form.type} />
+
+    <!-- Host -->
+    <div>
+      <label for="{uid}-host" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_host()}
+      </label>
+      <input
+        id="{uid}-host"
+        name="host"
+        type="text"
+        class={['input-bordered input w-full', $errors?.host && 'input-error']}
+        placeholder={m.storage_connect_host_placeholder()}
+        bind:value={$form.host}
+        onblur={parseHostInput}
+      />
+      {#if $errors?.host}
+        <p class="text-error mt-1 text-xs">{$errors.host}</p>
+      {/if}
+    </div>
+
+    <!-- Port -->
+    <div>
+      <label for="{uid}-port" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_port()}
+      </label>
+      <input
+        id="{uid}-port"
+        name="port"
+        type="number"
+        min="1"
+        max="65535"
+        class={['input-bordered input w-full', $errors?.port && 'input-error']}
+        placeholder={m.storage_connect_port_placeholder()}
+        bind:value={$form.port}
+      />
+      <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_port_hint()}</p>
+      {#if $errors?.port}
+        <p class="text-error mt-1 text-xs">{$errors.port}</p>
+      {/if}
+    </div>
+
+    <!-- TLS -->
+    <div class="flex items-start justify-between gap-4">
+      <div>
+        <label for="{uid}-tls" class="label text-sm font-medium">
+          {m.storage_connect_tls()}
+        </label>
+        <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_tls_hint()}</p>
+      </div>
+      <input
+        id="{uid}-tls"
+        type="checkbox"
+        class="toggle toggle-primary mt-1 shrink-0"
+        checked={!!$form.tls}
+        onchange={(e) => {
+          $form.tls = e.currentTarget.checked ? { verification: 'Full' } : undefined;
+        }}
+      />
+    </div>
+
+    <!-- TLS verification -->
+    {#if $form.tls}
+      <div class="flex items-start justify-between gap-4 pl-4">
+        <div>
+          <label for="{uid}-tls-verification" class="label text-sm font-medium">
+            {m.storage_connect_tls_verification()}
+          </label>
+          <p class="text-base-content/50 mt-0.5 text-xs">
+            {m.storage_connect_tls_verification_hint()}
+          </p>
+        </div>
+        <input
+          id="{uid}-tls-verification"
+          type="checkbox"
+          class="toggle toggle-primary mt-1 shrink-0"
+          checked={$form.tls.verification === 'Full'}
+          onchange={(e) => {
+            $form.tls = { verification: e.currentTarget.checked ? 'Full' : 'None' };
+          }}
+        />
+      </div>
+    {/if}
+
+    <!-- Access style -->
+    <div>
+      <label for="{uid}-access-style" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_access_style()}
+      </label>
+      <select
+        id="{uid}-access-style"
+        name="accessStyle"
+        class="select-bordered select w-full"
+        bind:value={$form.accessStyle}
+      >
+        <option value="Path">{m.storage_connect_access_style_path()}</option>
+        <option value="VirtualHosted">{m.storage_connect_access_style_virtual_hosted()}</option>
+      </select>
+    </div>
+
+    <!-- Region -->
+    <div>
+      <label for="{uid}-region" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_region()}
+      </label>
+      <input
+        id="{uid}-region"
+        name="region.name"
+        type="text"
+        class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
+        bind:value={$form.region.name}
+      />
+      {#if $errors?.region?.name}
+        <p class="text-error mt-1 text-xs">{$errors.region.name}</p>
+      {/if}
+    </div>
+
+    <!-- Access key -->
+    <div>
+      <label for="{uid}-access-key" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_access_key()}
+      </label>
+      <input
+        id="{uid}-access-key"
+        name="credentials.accessKey"
+        type="text"
+        class={['input-bordered input w-full', $errors?.credentials?.accessKey && 'input-error']}
+        autocomplete="username"
+        bind:value={$form.credentials.accessKey}
+      />
+      {#if $errors?.credentials?.accessKey}
+        <p class="text-error mt-1 text-xs">{$errors.credentials.accessKey}</p>
+      {/if}
+    </div>
+
+    <!-- Secret key -->
+    <div>
+      <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium">
+        {m.storage_connect_secret_key()}
+      </label>
+      <input
+        id="{uid}-secret-key"
+        name="credentials.secretKey"
+        type="password"
+        class={['input-bordered input w-full', $errors?.credentials?.secretKey && 'input-error']}
+        autocomplete="current-password"
+        bind:value={$form.credentials.secretKey}
+      />
+      <p class="text-base-content/50 mt-1 text-xs">
+        {m.storage_connection_edit_credentials_hint()}
+      </p>
+      {#if $errors?.credentials?.secretKey}
+        <p class="text-error mt-1 text-xs">{$errors.credentials.secretKey}</p>
+      {/if}
+    </div>
+
+    {#if $message && $message !== 'ok'}
+      <p class="text-error text-sm">{$message}</p>
+    {/if}
+
+    <div class="flex items-center gap-3">
+      <button type="submit" class="btn btn-primary" disabled={$submitting}>
+        {#if $submitting}
+          <span class="loading loading-sm loading-spinner"></span>
+        {/if}
+        {m.storage_connection_edit_save()}
+      </button>
+      <a href={resolve('/storage/connections')} class="btn btn-ghost">
+        ← {m.storage_connections_title()}
+      </a>
+    </div>
+  </form>
+{/if}
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
index d3e4926e..5adb0ee6 100644
--- a/src/routes/(app)/storage/page.server.test.ts
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -80,11 +80,10 @@ describe('storage page actions', () => {
       valid: true,
       data: {
         type: 's3',
-        endpoint: 'http://s3',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: 'ak',
-        secretAccessKey: 'sk'
+        host: 's3.example.com',
+        accessStyle: 'Path',
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'ak', secretKey: 'sk' }
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
     mockConnectionProvider.listContainers.mockRejectedValue(new Error('connection refused'));
@@ -104,11 +103,10 @@ describe('storage page actions', () => {
       valid: true,
       data: {
         type: 's3',
-        endpoint: 'http://s3',
-        pathStyle: true,
-        region: 'us-east-1',
-        accessKeyId: 'ak',
-        secretAccessKey: 'sk'
+        host: 's3.example.com',
+        accessStyle: 'Path',
+        region: { name: 'us-east-1' },
+        credentials: { accessKey: 'ak', secretKey: 'sk' }
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
     mockConnectionProvider.listContainers.mockResolvedValue(['b1']);

From 1ad6b09afa499317af5b5c94605313381f1d7e87 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 7 Jul 2026 15:09:40 +0200
Subject: [PATCH 091/136] fix: e2e tests

---
 e2e/storage/helpers.ts | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index c6773503..1117458d 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -95,6 +95,45 @@ export async function connectToStorage(page: Page, credentials: GarageCredential
   // before the test navigates elsewhere. Without this, a fast page.goto() call can race
   // with the in-flight form-submission fetch and the connection is never persisted.
   await page.waitForURL((url) => url.pathname === '/storage', { timeout: 15_000 });
+
+  // Guard: ensure the connection was persisted to localStorage.
+  // The app's saveConnectionLocally() call in the onResult callback can race with
+  // subsequent navigations (page.goto), causing an empty connection list on the
+  // management page. As a backup, seed localStorage directly here.
+  await page.evaluate(
+    ({ host: h, port: p, region: r, accessKey, secretKey, tls }) => {
+      const KEY = 'stackable_storage_connections';
+      if (localStorage.getItem(KEY)) return;
+
+      const id = 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+        const v = (Math.random() * 16) | 0;
+        return (c === 'x' ? v : (v & 0x3) | 0x8).toString(16);
+      });
+      localStorage.setItem(
+        KEY,
+        JSON.stringify([
+          {
+            id,
+            type: 's3',
+            host: h,
+            port: p ? Number(p) : undefined,
+            tls: tls ? { verification: 'Full' } : undefined,
+            accessStyle: 'Path',
+            region: { name: r },
+            credentials: { accessKey, secretKey }
+          }
+        ])
+      );
+    },
+    {
+      host,
+      port: port || undefined,
+      region: credentials.region,
+      accessKey: credentials.accessKeyId,
+      secretKey: credentials.secretAccessKey,
+      tls: useTls
+    }
+  );
 }
 
 export async function connectAndOpenPrefix(

From f1937bf405cb99cee45012122e080da19c9966a0 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 1 Jul 2026 13:53:14 +0200
Subject: [PATCH 092/136] #98 add possible checksum calculation to s3 client

---
 src/lib/server/storage/s3-client.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/lib/server/storage/s3-client.ts b/src/lib/server/storage/s3-client.ts
index 6709a633..3b22292a 100644
--- a/src/lib/server/storage/s3-client.ts
+++ b/src/lib/server/storage/s3-client.ts
@@ -19,6 +19,7 @@ export function createS3Client(config: S3ConnectionConfig): S3Client {
         httpsAgent: new Agent({ rejectUnauthorized: false })
       })
     }),
+    requestChecksumCalculation: 'WHEN_REQUIRED',
     ...(config.credentials && {
       credentials: {
         accessKeyId: config.credentials.accessKey,

From d4d177d8e0d26667989bc5a0b334c8b99ac8c830 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 1 Jul 2026 14:18:32 +0200
Subject: [PATCH 093/136] fix unit test

---
 src/lib/server/storage/s3-client.test.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/lib/server/storage/s3-client.test.ts b/src/lib/server/storage/s3-client.test.ts
index cfb09b31..9dd465bd 100644
--- a/src/lib/server/storage/s3-client.test.ts
+++ b/src/lib/server/storage/s3-client.test.ts
@@ -64,7 +64,8 @@ describe('createS3Client', () => {
     createS3Client(baseConfig({ credentials: { accessKey: 'AKID', secretKey: 'SECRET' } }));
     expect(mockS3Client).toHaveBeenCalledWith(
       expect.objectContaining({
-        credentials: { accessKeyId: 'AKID', secretAccessKey: 'SECRET' }
+        credentials: { accessKeyId: 'AKID', secretAccessKey: 'SECRET' },
+        requestChecksumCalculation: 'WHEN_REQUIRED'
       })
     );
   });

From 5e8635e371f32bd53827f12b5eadfb8e6d0ce419 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 10 Jul 2026 08:34:47 +0200
Subject: [PATCH 094/136] #98 fix text truncation, use env for csv max rows,
 clamp page size

---
 .../storage/modals/PreviewModal.svelte          | 17 ++++++++++++-----
 .../storage/modals/preview/CsvPreview.svelte    |  9 ++++-----
 .../modals/preview/CsvPreview.svelte.spec.ts    | 15 ++++++++++++++-
 src/lib/server/storage/preview/stream.ts        |  8 +++++++-
 src/lib/server/storage/s3-provider.ts           |  1 +
 src/lib/storage/state.svelte.ts                 | 10 ++++------
 src/routes/(app)/api/storage/objects/+server.ts |  4 +++-
 7 files changed, 45 insertions(+), 19 deletions(-)

diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index c15b24ae..752b78ee 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -37,7 +37,14 @@
         totalSize: number;
         previewBytes: number;
       }
-    | { kind: 'csv'; text: string; truncated: boolean; totalSize: number; previewBytes: number }
+    | {
+        kind: 'csv';
+        text: string;
+        truncated: boolean;
+        totalSize: number;
+        previewBytes: number;
+        previewRows: number;
+      }
     | {
         kind: 'parquet';
         text: string;
@@ -168,7 +175,7 @@
         contentType === 'application/vnd.ms-excel' ||
         key.toLowerCase().endsWith('.csv')
       ) {
-        preview = { kind: 'csv', text, truncated, totalSize, previewBytes };
+        preview = { kind: 'csv', text, truncated, totalSize, previewBytes, previewRows };
         return;
       }
 
@@ -202,7 +209,7 @@
 
       // Try strict UTF-8 (handles UTF-8 with or without BOM)
       try {
-        return new TextDecoder('utf-8', { fatal: true }).decode(buf);
+        return new TextDecoder('utf-8').decode(buf);
       } catch {
         // For CSV/TSV files try Windows-1252 — the default encoding used by
         // Excel on Windows when exporting to CSV.
@@ -346,9 +353,9 @@
       {:else if preview.kind === 'text'}
         <TextPreview text={preview.text} contentType={preview.contentType} />
       {:else if preview.kind === 'csv'}
-        <CsvPreview text={preview.text} />
+        <CsvPreview text={preview.text} maxRows={preview.previewRows || 250} />
       {:else if preview.kind === 'parquet'}
-        <CsvPreview text={preview.text} />
+        <CsvPreview text={preview.text} maxRows={preview.previewRows || 250} />
       {:else if preview.kind === 'image'}
         <ImagePreview
           src={preview.blobUrl}
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index a40e3d23..cb51015a 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -1,13 +1,12 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
 
-  const MAX_ROWS = 250;
-
   interface Props {
     text: string;
+    maxRows?: number;
   }
 
-  let { text }: Props = $props();
+  let { text, maxRows = 250 }: Props = $props();
 
   const { headers, rows } = $derived.by(() => {
     // Split into lines, strip trailing newline
@@ -41,13 +40,13 @@
 
     const [headerLine, ...dataLines] = lines;
     const hdrs = parseLine(headerLine);
-    const rws = dataLines.slice(0, MAX_ROWS).map(parseLine);
+    const rws = dataLines.slice(0, maxRows).map(parseLine);
     return { headers: hdrs, rows: rws };
   });
 
   const truncated = $derived.by(() => {
     const lines = text.split('\n').filter((l) => l.trim() !== '');
-    return lines.length > MAX_ROWS + 1;
+    return lines.length > maxRows + 1;
   });
 </script>
 
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
index 96a56808..69729731 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
@@ -49,7 +49,7 @@ describe('CsvPreview', () => {
     await expect.element(page.getByText('3')).toBeInTheDocument();
   });
 
-  it('should truncate at 250 rows and show notice', async () => {
+  it('should truncate at default 250 rows and show notice', async () => {
     const header = 'Name,Email';
     const rows = Array.from(
       { length: 300 },
@@ -63,6 +63,19 @@ describe('CsvPreview', () => {
     await expect.element(notice).toBeInTheDocument();
   });
 
+  it('should respect maxRows prop', async () => {
+    const header = 'Name,Email';
+    const rows = Array.from(
+      { length: 50 },
+      () => `${faker.person.firstName()},${faker.internet.email()}`
+    );
+    const text = [header, ...rows].join('\n');
+    render(CsvPreview, { text, maxRows: 10 });
+
+    const notice = page.getByText(/10/);
+    await expect.element(notice).toBeInTheDocument();
+  });
+
   it('should not show truncation notice for <= 250 rows', async () => {
     const header = 'Name,Email';
     const rows = Array.from(
diff --git a/src/lib/server/storage/preview/stream.ts b/src/lib/server/storage/preview/stream.ts
index 1da502fc..88406cc2 100644
--- a/src/lib/server/storage/preview/stream.ts
+++ b/src/lib/server/storage/preview/stream.ts
@@ -1,6 +1,11 @@
 import type pino from 'pino';
 import type { StorageProvider } from '$lib/server/storage/provider.js';
-import { textPreviewBytes, imagePreviewBytes, pdfPreviewBytes } from '$lib/server/feature-flags.js';
+import {
+  textPreviewBytes,
+  imagePreviewBytes,
+  pdfPreviewBytes,
+  filePreviewRows
+} from '$lib/server/feature-flags.js';
 
 export async function streamPreview(
   provider: StorageProvider,
@@ -45,6 +50,7 @@ export async function streamPreview(
       'X-Preview-Truncated': String(truncated),
       'X-Preview-Total-Size': String(totalSize),
       'X-Preview-Bytes': String(previewBytes),
+      'X-Preview-Preview-Rows': String(filePreviewRows),
       'Cache-Control': 'no-store'
     }
   });
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 56dadd73..70e0c6f8 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -143,6 +143,7 @@ export class S3StorageProvider implements StorageProvider {
         Key: key,
         Body: body,
         ContentType: contentType,
+        IfNoneMatch: '*',
         ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
       }
     });
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 045156d6..a33cfd9e 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -214,11 +214,7 @@ export class StorageState {
     e.stopPropagation();
 
     if (!this.selectedKeys.has(key)) {
-      if (this.selectedKeys.size === 0) {
-        this.selectedKeys = new SvelteSet<string>([key]);
-      } else {
-        this.selectedKeys.add(key);
-      }
+      this.selectedKeys = new SvelteSet<string>([...this.selectedKeys, key]);
     }
 
     this.contextMenu = { x: e.clientX, y: e.clientY, key };
@@ -226,7 +222,9 @@ export class StorageState {
 
   closeContextMenu = (): void => {
     if (this.contextMenu) {
-      this.selectedKeys.delete(this.contextMenu.key);
+      const next = new SvelteSet<string>(this.selectedKeys);
+      next.delete(this.contextMenu.key);
+      this.selectedKeys = next;
     }
     this.contextMenu = null;
   };
diff --git a/src/routes/(app)/api/storage/objects/+server.ts b/src/routes/(app)/api/storage/objects/+server.ts
index 463a5b63..cad1ed02 100644
--- a/src/routes/(app)/api/storage/objects/+server.ts
+++ b/src/routes/(app)/api/storage/objects/+server.ts
@@ -1,5 +1,6 @@
 import { error } from '@sveltejs/kit';
 import { listObjects } from '$lib/server/storage/service.js';
+import { allowedPageSizes } from '$lib/client/feature-flags.js';
 import type { RequestHandler } from './$types';
 
 /**
@@ -17,7 +18,8 @@ export const GET: RequestHandler = async ({ url, locals }) => {
   const prefix = url.searchParams.get('prefix') ?? '';
   const continuationToken = url.searchParams.get('continuationToken');
   const pageSizeParam = url.searchParams.get('pageSize');
-  const pageSize = pageSizeParam ? parseInt(pageSizeParam, 10) : 25;
+  const parsed = pageSizeParam ? parseInt(pageSizeParam, 10) : NaN;
+  const pageSize = allowedPageSizes.includes(parsed) ? parsed : allowedPageSizes[0];
 
   locals.logger.debug(
     { bucket, prefix, continuation_token: continuationToken, page_size: pageSize },

From 902698322e735ebb36456c03b563b97c0e50f367 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 10 Jul 2026 09:10:00 +0200
Subject: [PATCH 095/136] #98 fix multi select behavior, add image preview
 limit fallback

---
 messages/de.json                                 |  2 ++
 messages/en.json                                 |  2 ++
 .../storage/modals/PreviewModal.svelte           | 10 ++++++++--
 .../modals/preview/CsvPreview.svelte.spec.ts     |  2 +-
 .../modals/preview/FallbackPreview.svelte        | 16 +++++++++++++---
 src/lib/storage/state.svelte.ts                  | 10 +++-------
 6 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 084e1075..d89ab287 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -319,6 +319,8 @@
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
+  "storage_preview_image_too_large": "Bild ist zu groß für die Anzeige.",
+  "storage_preview_image_too_large_desc": "Die Datei überschreitet die maximale Vorschaugröße. Laden Sie die vollständige Datei herunter, um sie anzuzeigen.",
   "storage_preview_maximise": "Maximieren",
   "storage_preview_restore": "Wiederherstellen",
   "storage_context_menu_actions": "Aktionen",
diff --git a/messages/en.json b/messages/en.json
index 45bb9ba4..234ba1cb 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -319,6 +319,8 @@
   "storage_preview_csv_rows": "Showing first {count} rows",
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
+  "storage_preview_image_too_large": "Image is too large to display.",
+  "storage_preview_image_too_large_desc": "The file exceeds the maximum preview size. Download the full file to view it.",
   "storage_preview_maximise": "Maximise",
   "storage_preview_restore": "Restore",
   "storage_context_menu_actions": "Actions",
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 752b78ee..e237b97c 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -55,7 +55,7 @@
       }
     | { kind: 'image'; blobUrl: string; contentType: string; totalSize: number }
     | { kind: 'pdf'; blobUrl: string; totalSize: number }
-    | { kind: 'fallback'; contentType: string; isBinary: boolean }
+    | { kind: 'fallback'; contentType: string; isBinary: boolean; imageTooLarge?: boolean }
     | { kind: 'error'; message: string };
 
   let preview: PreviewKind = $state({ kind: 'idle' });
@@ -135,8 +135,13 @@
         return;
       }
 
-      // Images — render as blob URL
+      // Images — render as blob URL, or fallback if truncated
       if (contentType.startsWith('image/')) {
+        if (truncated) {
+          await res.body?.cancel();
+          preview = { kind: 'fallback', contentType, isBinary: false, imageTooLarge: true };
+          return;
+        }
         const blob = await res.blob();
         const url = URL.createObjectURL(blob);
         blobUrls = [url];
@@ -370,6 +375,7 @@
           contentType={preview.contentType}
           onDownload={triggerDownload}
           isBinary={preview.isBinary}
+          imageTooLarge={preview.imageTooLarge}
         />
       {/if}
     </div>
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
index 69729731..4b147b8f 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
@@ -72,7 +72,7 @@ describe('CsvPreview', () => {
     const text = [header, ...rows].join('\n');
     render(CsvPreview, { text, maxRows: 10 });
 
-    const notice = page.getByText(/10/);
+    const notice = page.getByText('Showing first 10 rows');
     await expect.element(notice).toBeInTheDocument();
   });
 
diff --git a/src/lib/components/storage/modals/preview/FallbackPreview.svelte b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
index e37cce89..fc483c28 100644
--- a/src/lib/components/storage/modals/preview/FallbackPreview.svelte
+++ b/src/lib/components/storage/modals/preview/FallbackPreview.svelte
@@ -8,19 +8,29 @@
     onDownload: () => void;
     /** When true, the content was determined to be binary (non-displayable UTF-8). */
     isBinary?: boolean;
+    /** When true, the image preview was skipped because the file is too large. */
+    imageTooLarge?: boolean;
   }
 
-  let { contentType, onDownload, isBinary = false }: Props = $props();
+  let { contentType, onDownload, isBinary = false, imageTooLarge = false }: Props = $props();
 </script>
 
 <div class="flex min-h-full flex-col items-center justify-center gap-4 p-8 text-center">
   <IconFilePresent class="text-base-content/30 size-16" aria-hidden="true" />
   <div>
     <p class="text-base-content font-semibold">
-      {isBinary ? m.storage_preview_binary_title() : m.storage_preview_unsupported_title()}
+      {imageTooLarge
+        ? m.storage_preview_image_too_large()
+        : isBinary
+          ? m.storage_preview_binary_title()
+          : m.storage_preview_unsupported_title()}
     </p>
     <p class="text-base-content/60 mt-1 text-sm">
-      {isBinary ? m.storage_preview_binary_desc() : m.storage_preview_unsupported_desc()}
+      {imageTooLarge
+        ? m.storage_preview_image_too_large_desc()
+        : isBinary
+          ? m.storage_preview_binary_desc()
+          : m.storage_preview_unsupported_desc()}
     </p>
     {#if contentType}
       <p class="text-base-content/40 mt-1 font-mono text-xs">{contentType}</p>
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index a33cfd9e..d83d45c1 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -214,18 +214,13 @@ export class StorageState {
     e.stopPropagation();
 
     if (!this.selectedKeys.has(key)) {
-      this.selectedKeys = new SvelteSet<string>([...this.selectedKeys, key]);
+      this.selectedKeys = new SvelteSet<string>([key]);
     }
 
     this.contextMenu = { x: e.clientX, y: e.clientY, key };
   };
 
   closeContextMenu = (): void => {
-    if (this.contextMenu) {
-      const next = new SvelteSet<string>(this.selectedKeys);
-      next.delete(this.contextMenu.key);
-      this.selectedKeys = next;
-    }
     this.contextMenu = null;
   };
 
@@ -375,8 +370,9 @@ export class StorageState {
     } else if (e.key === 'Escape') {
       if (this.contextMenu) {
         this.closeContextMenu();
+      } else {
+        this.clearSelection();
       }
-      this.clearSelection();
     }
   };
 

From f4de4156d592a467a21c838815a776648584906f Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 10 Jul 2026 09:37:46 +0200
Subject: [PATCH 096/136] #98 limit max columns in CSV preview

---
 messages/de.json                              |  1 +
 messages/en.json                              |  1 +
 .../storage/modals/preview/CsvPreview.svelte  | 22 ++++++++++++++-----
 3 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index d89ab287..c54247fe 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -316,6 +316,7 @@
   "storage_preview_access_denied": "Sie haben keine Berechtigung, diese Datei in der Vorschau anzuzeigen.",
   "storage_preview_not_found": "Die Datei konnte nicht gefunden werden.",
   "storage_preview_image_alt": "Vorschau von {name}",
+  "storage_preview_csv_columns": "{count} weitere Spalten",
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
diff --git a/messages/en.json b/messages/en.json
index 234ba1cb..55907765 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -316,6 +316,7 @@
   "storage_preview_access_denied": "You do not have permission to preview this file.",
   "storage_preview_not_found": "The file could not be found.",
   "storage_preview_image_alt": "Preview of {name}",
+  "storage_preview_csv_columns": "{count} more columns",
   "storage_preview_csv_rows": "Showing first {count} rows",
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index cb51015a..401fbcd6 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -8,10 +8,12 @@
 
   let { text, maxRows = 250 }: Props = $props();
 
-  const { headers, rows } = $derived.by(() => {
+  const maxColumns = 50; // TODO: magic number
+
+  const { headers, rows, displayHeaders, extraColumns } = $derived.by(() => {
     // Split into lines, strip trailing newline
     const lines = text.split('\n').filter((l) => l.trim() !== '');
-    if (lines.length === 0) return { headers: [], rows: [] };
+    if (lines.length === 0) return { headers: [], rows: [], displayHeaders: [], extraColumns: 0 };
 
     // Simple CSV parse: handle quoted fields
     function parseLine(line: string): string[] {
@@ -41,7 +43,9 @@
     const [headerLine, ...dataLines] = lines;
     const hdrs = parseLine(headerLine);
     const rws = dataLines.slice(0, maxRows).map(parseLine);
-    return { headers: hdrs, rows: rws };
+    const display = hdrs.slice(0, maxColumns);
+    const extra = Math.max(0, hdrs.length - maxColumns);
+    return { headers: hdrs, rows: rws, displayHeaders: display, extraColumns: extra };
   });
 
   const truncated = $derived.by(() => {
@@ -57,18 +61,26 @@
     <table class="table-xs table min-w-max" aria-label="CSV preview">
       <thead>
         <tr class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs">
-          {#each headers as header, i (i)}
+          {#each displayHeaders as header, i (i)}
             <th class="font-semibold whitespace-nowrap">{header}</th>
           {/each}
+          {#if extraColumns > 0}
+            <th class="text-base-content/40 font-semibold whitespace-nowrap italic">
+              {m.storage_preview_csv_columns({ count: extraColumns })}
+            </th>
+          {/if}
         </tr>
       </thead>
       <tbody>
         {#each rows as row, i (i)}
           <tr class="hover:bg-base-200 transition-colors">
             <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
-            {#each headers as _h, j (j)}
+            {#each displayHeaders as _h, j (j)}
               <td class="text-base-content/80 max-w-xs truncate text-xs">{row[j] ?? ''}</td>
             {/each}
+            {#if extraColumns > 0}
+              <td class="text-base-content/30 max-w-xs truncate text-xs italic" />
+            {/if}
           </tr>
         {/each}
       </tbody>

From 7e49fa035bdb374f2c9f6322339dca317db0f798 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 10 Jul 2026 10:18:45 +0200
Subject: [PATCH 097/136] fix e2e test, fix replacement character in text
 editor due to truncation

---
 e2e/storage/connections-management.spec.ts            |  1 +
 src/lib/components/storage/modals/PreviewModal.svelte | 11 ++++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/e2e/storage/connections-management.spec.ts b/e2e/storage/connections-management.spec.ts
index 5e3331bb..126ac9ac 100644
--- a/e2e/storage/connections-management.spec.ts
+++ b/e2e/storage/connections-management.spec.ts
@@ -5,6 +5,7 @@ import { waitForHydration } from '../support/helpers.js';
 
 /** Open the Options context menu for the first connection row and click Edit. */
 async function openFirstConnectionEditPage(page: Page) {
+  await page.locator('table tbody tr').first().waitFor();
   await page
     .getByRole('button', { name: /Options for/i })
     .first()
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index e237b97c..39094bc8 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -201,6 +201,7 @@
     try {
       const buf = await res.arrayBuffer();
       const bytes = new Uint8Array(buf);
+      const truncated = res.headers.get('X-Preview-Truncated') === 'true';
 
       // Detect UTF-16 BOM (common in Excel "Save as CSV (UTF-16)")
       if (bytes.length >= 2) {
@@ -214,8 +215,16 @@
 
       // Try strict UTF-8 (handles UTF-8 with or without BOM)
       try {
-        return new TextDecoder('utf-8').decode(buf);
+        return new TextDecoder('utf-8', { fatal: true }).decode(buf);
       } catch {
+        // If the content was truncated, the invalid bytes might be at the
+        // truncation boundary (a multi-byte character cut in half). Decode
+        // without fatal and strip trailing replacement characters.
+        if (truncated) {
+          const text = new TextDecoder('utf-8').decode(buf);
+          return text.replace(/\uFFFD+$/, '');
+        }
+
         // For CSV/TSV files try Windows-1252 — the default encoding used by
         // Excel on Windows when exporting to CSV.
         const lowerKey = key.toLowerCase();

From 80ef6001ad7db1b7cda4f54904fe2ece33a6f25a Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 08:23:54 +0200
Subject: [PATCH 098/136] #98 allow overwrites again

---
 src/lib/server/storage/s3-provider.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 70e0c6f8..56dadd73 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -143,7 +143,6 @@ export class S3StorageProvider implements StorageProvider {
         Key: key,
         Body: body,
         ContentType: contentType,
-        IfNoneMatch: '*',
         ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
       }
     });

From f443c9be383caee074e307e8337254c9d79db562 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 08:35:33 +0200
Subject: [PATCH 099/136] #98 fix text preview of binary files

---
 .../storage/modals/PreviewModal.svelte        | 22 ++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 39094bc8..452af535 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -161,7 +161,7 @@
       // For everything else (text/*, application/json, application/octet-stream,
       // application/yaml, etc.) attempt UTF-8 decode. Success → text view;
       // failure → the file is genuinely binary.
-      const text = await readTextSafely(res, key);
+      const text = await readTextSafely(res, key, contentType);
       if (text === null) {
         preview = { kind: 'fallback', contentType, isBinary: true };
         return;
@@ -197,7 +197,21 @@
    * Returns null if the content cannot be decoded as any recognised encoding
    * (indicating genuinely binary content).
    */
-  async function readTextSafely(res: Response, key: string): Promise<string | null> {
+  function isTextContentType(contentType: string): boolean {
+    if (contentType.startsWith('text/')) return true;
+    if (contentType === 'application/json') return true;
+    if (contentType === 'application/yaml') return true;
+    if (contentType === 'application/xml') return true;
+    if (contentType === 'application/csv') return true;
+    if (contentType === 'application/x-ndjson') return true;
+    return false;
+  }
+
+  async function readTextSafely(
+    res: Response,
+    key: string,
+    contentType: string
+  ): Promise<string | null> {
     try {
       const buf = await res.arrayBuffer();
       const bytes = new Uint8Array(buf);
@@ -220,7 +234,9 @@
         // If the content was truncated, the invalid bytes might be at the
         // truncation boundary (a multi-byte character cut in half). Decode
         // without fatal and strip trailing replacement characters.
-        if (truncated) {
+        // Only do this for text-like content types — binary files should
+        // fall through to the FallbackPreview.
+        if (truncated && isTextContentType(contentType)) {
           const text = new TextDecoder('utf-8').decode(buf);
           return text.replace(/\uFFFD+$/, '');
         }

From e830d33addb84ed79a1ffdaf112efb985efa6fe6 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 08:52:35 +0200
Subject: [PATCH 100/136] #98 csv max columns use feature flag instead of magic
 number

---
 .env.test                                      |  1 +
 dev/setup.sh                                   |  2 ++
 .../storage/modals/PreviewModal.svelte         | 18 ++++++++++++++++--
 .../storage/modals/preview/CsvPreview.svelte   |  5 ++---
 src/lib/server/feature-flags.ts                |  7 +++++++
 src/lib/server/storage/preview/stream.ts       |  4 +++-
 6 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/.env.test b/.env.test
index 55bd5995..c1b50cfe 100644
--- a/.env.test
+++ b/.env.test
@@ -10,6 +10,7 @@ STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
diff --git a/dev/setup.sh b/dev/setup.sh
index d7d25c6a..96ac2a1f 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -277,6 +277,7 @@ STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
@@ -295,6 +296,7 @@ STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
 STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
 STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
 PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 452af535..adcfb244 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -44,6 +44,7 @@
         totalSize: number;
         previewBytes: number;
         previewRows: number;
+        previewColumns: number;
       }
     | {
         kind: 'parquet';
@@ -127,6 +128,7 @@
       const previewBytes = Number(res.headers.get('X-Preview-Bytes') ?? '0');
       const totalRows = Number(res.headers.get('X-Preview-Total-Rows') ?? '0');
       const previewRows = Number(res.headers.get('X-Preview-Preview-Rows') ?? '0');
+      const previewColumns = Number(res.headers.get('X-Preview-Preview-Columns') ?? '0');
 
       // Server flagged this as a known-binary type — skip body fetch entirely.
       if (res.headers.get('X-Preview-Renderable') === 'false') {
@@ -180,7 +182,15 @@
         contentType === 'application/vnd.ms-excel' ||
         key.toLowerCase().endsWith('.csv')
       ) {
-        preview = { kind: 'csv', text, truncated, totalSize, previewBytes, previewRows };
+        preview = {
+          kind: 'csv',
+          text,
+          truncated,
+          totalSize,
+          previewBytes,
+          previewRows,
+          previewColumns
+        };
         return;
       }
 
@@ -383,7 +393,11 @@
       {:else if preview.kind === 'text'}
         <TextPreview text={preview.text} contentType={preview.contentType} />
       {:else if preview.kind === 'csv'}
-        <CsvPreview text={preview.text} maxRows={preview.previewRows || 250} />
+        <CsvPreview
+          text={preview.text}
+          maxRows={preview.previewRows || 250}
+          maxColumns={preview.previewColumns || 50}
+        />
       {:else if preview.kind === 'parquet'}
         <CsvPreview text={preview.text} maxRows={preview.previewRows || 250} />
       {:else if preview.kind === 'image'}
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index 401fbcd6..9c0c4090 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -4,11 +4,10 @@
   interface Props {
     text: string;
     maxRows?: number;
+    maxColumns?: number;
   }
 
-  let { text, maxRows = 250 }: Props = $props();
-
-  const maxColumns = 50; // TODO: magic number
+  let { text, maxRows = 250, maxColumns = 50 }: Props = $props();
 
   const { headers, rows, displayHeaders, extraColumns } = $derived.by(() => {
     // Split into lines, strip trailing newline
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 8d2368cc..dd0d071f 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -44,3 +44,10 @@ export const pdfPreviewBytes =
  *  Higher values give more data context but increase server-side S3 reads
  *  and the size of the payload sent to the browser. */
 export const filePreviewRows = parseInt(env.STACKABLE_COCKPIT_FILE_PREVIEW_ROWS ?? '', 10) || 250;
+
+/** Maximum number of columns included in a file preview that is rendered as a
+ *  table (currently: used by CSV).
+ *  Controlled by `STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS`. Default: 50.
+ *  Values only affect client side rendering and not payload size. */
+export const filePreviewColumns =
+  parseInt(env.STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS ?? '', 10) || 50;
diff --git a/src/lib/server/storage/preview/stream.ts b/src/lib/server/storage/preview/stream.ts
index 88406cc2..e7e6df8b 100644
--- a/src/lib/server/storage/preview/stream.ts
+++ b/src/lib/server/storage/preview/stream.ts
@@ -4,7 +4,8 @@ import {
   textPreviewBytes,
   imagePreviewBytes,
   pdfPreviewBytes,
-  filePreviewRows
+  filePreviewRows,
+  filePreviewColumns
 } from '$lib/server/feature-flags.js';
 
 export async function streamPreview(
@@ -51,6 +52,7 @@ export async function streamPreview(
       'X-Preview-Total-Size': String(totalSize),
       'X-Preview-Bytes': String(previewBytes),
       'X-Preview-Preview-Rows': String(filePreviewRows),
+      'X-Preview-Preview-Columns': String(filePreviewColumns),
       'Cache-Control': 'no-store'
     }
   });

From c2ce9450ebdc6326340919e8ace650b07ad43dd0 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 09:17:27 +0200
Subject: [PATCH 101/136] move tooltips to own component, add orientation, add
 tooltips to storage connection

---
 src/lib/components/Tooltip.svelte             | 42 +++++++++++++++++++
 .../storage/sidebar/BucketList.svelte         | 13 ++----
 .../sidebar/StorageConnectionSidebar.svelte   | 24 +++++++++++
 3 files changed, 69 insertions(+), 10 deletions(-)
 create mode 100644 src/lib/components/Tooltip.svelte

diff --git a/src/lib/components/Tooltip.svelte b/src/lib/components/Tooltip.svelte
new file mode 100644
index 00000000..815826ac
--- /dev/null
+++ b/src/lib/components/Tooltip.svelte
@@ -0,0 +1,42 @@
+<script lang="ts">
+  const GAP = 6;
+
+  interface Props {
+    text: string | null;
+    x: number;
+    y: number;
+    orientation?: 'right' | 'left' | 'up' | 'down';
+  }
+  let { text, x, y, orientation = 'right' }: Props = $props();
+
+  const contentStyle = $derived(
+    orientation === 'right'
+      ? `left:${x + GAP}px;top:${y}px;transform:translateY(-50%)`
+      : orientation === 'left'
+        ? `left:${x - GAP}px;top:${y}px;transform:translate(-100%,-50%)`
+        : orientation === 'up'
+          ? `left:${x}px;top:${y - GAP}px;transform:translate(-50%,-100%)`
+          : `left:${x}px;top:${y + GAP}px;transform:translate(-50%,0)`
+  );
+
+  const arrowClasses = $derived(
+    orientation === 'right'
+      ? 'left-0 top-1/2 -translate-x-1/2 -translate-y-1/2'
+      : orientation === 'left'
+        ? 'right-0 top-1/2 translate-x-1/2 -translate-y-1/2'
+        : orientation === 'up'
+          ? 'bottom-0 left-1/2 -translate-x-1/2 translate-y-1/2'
+          : 'top-0 left-1/2 -translate-x-1/2 -translate-y-1/2'
+  );
+</script>
+
+{#if text}
+  <div class="pointer-events-none fixed z-150" role="tooltip" style={contentStyle}>
+    <div
+      class="bg-neutral text-neutral-content relative rounded-md px-2 py-1 text-sm whitespace-nowrap shadow-lg"
+    >
+      <div class="bg-neutral absolute size-2 rotate-45 {arrowClasses}" aria-hidden="true"></div>
+      {text}
+    </div>
+  </div>
+{/if}
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 1445d12b..20189aa1 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -10,6 +10,7 @@
   import IconGridView from 'virtual:icons/material-symbols/grid-view';
   import IconPowerOff from 'virtual:icons/material-symbols/power-settings-new';
   import Modal from '$lib/components/Modal.svelte';
+  import Tooltip from '$lib/components/Tooltip.svelte';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import type { PinnedLocation, StorageLocation } from '$lib/storage/types.js';
@@ -99,7 +100,7 @@
   function showTooltip(e: MouseEvent | FocusEvent, text: string) {
     const el = e.currentTarget as HTMLElement;
     const rect = el.getBoundingClientRect();
-    tooltipX = rect.right + 8;
+    tooltipX = rect.right;
     tooltipY = rect.top + rect.height / 2;
     tooltipText = text;
   }
@@ -309,12 +310,4 @@
   <ResizeHandle panel={resize} />
 </nav>
 
-{#if tooltipText}
-  <div
-    class="bg-neutral text-neutral-content pointer-events-none fixed z-150 rounded px-2 py-1 text-sm whitespace-nowrap shadow-lg"
-    style="left: {tooltipX}px; top: {tooltipY}px; transform: translateY(-50%)"
-    role="tooltip"
-  >
-    {tooltipText}
-  </div>
-{/if}
+<Tooltip text={tooltipText} x={tooltipX} y={tooltipY} orientation="right" />
diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
index 10080e85..576646fe 100644
--- a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -5,6 +5,7 @@
   import IconEdit from 'virtual:icons/material-symbols/edit';
   import IconClose from 'virtual:icons/material-symbols/close';
   import DeleteConnectionModal from '$lib/components/storage/DeleteConnectionModal.svelte';
+  import Tooltip from '$lib/components/Tooltip.svelte';
   import { createResizablePanel } from './resizable-panel.svelte.js';
   import ResizeHandle from './ResizeHandle.svelte';
   import { resolve } from '$app/paths';
@@ -54,6 +55,23 @@
     };
   });
 
+  // ── Tooltip ──────────────────────────────────────────────────────────────
+  let tooltipText = $state<string | null>(null);
+  let tooltipX = $state(0);
+  let tooltipY = $state(0);
+
+  function showTooltip(e: MouseEvent | FocusEvent, text: string) {
+    const el = e.currentTarget as HTMLElement;
+    const rect = el.getBoundingClientRect();
+    tooltipX = rect.right;
+    tooltipY = rect.top + rect.height / 2;
+    tooltipText = text;
+  }
+
+  function hideTooltip() {
+    tooltipText = null;
+  }
+
   function connectionLabel(conn: SavedConnection): string {
     if (conn.name) return conn.name;
     return conn.port ? `${conn.host}:${conn.port}` : conn.host;
@@ -233,6 +251,10 @@
                 ? 'bg-primary/10 text-primary font-medium'
                 : 'text-base-content'}
             "
+              onmouseenter={(e) => showTooltip(e, connectionLabel(conn))}
+              onmouseleave={hideTooltip}
+              onfocus={(e) => showTooltip(e, connectionLabel(conn))}
+              onblur={hideTooltip}
             >
               <IconStorage
                 class="text-primary size-3.5 shrink-0 {activeId === conn.id ? '' : 'opacity-60'}"
@@ -279,3 +301,5 @@
   onconfirm={forgetConnection}
   oncancel={() => (forgetOpen = false)}
 />
+
+<Tooltip text={tooltipText} x={tooltipX} y={tooltipY} orientation="right" />

From 38e43176a1c775ec6321b611fb0d05eabce3d5d7 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 11:34:52 +0200
Subject: [PATCH 102/136] #208 show different connection error messages

---
 messages/de.json                              |  5 +++
 messages/en.json                              |  5 +++
 src/routes/(app)/storage/+page.server.ts      | 32 ++++++++++++++++---
 .../connections/[id]/edit/+page.server.ts     | 32 ++++++++++++++++---
 4 files changed, 64 insertions(+), 10 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 477164f2..30d951ee 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -146,6 +146,11 @@
   "storage_connect_timeout": "Zeitüberschreitung der Verbindung. Das Speicher-Backend hat nicht geantwortet.",
   "storage_connect_cancel": "Abbrechen",
   "storage_connect_error": "Verbindung fehlgeschlagen — Endpunkt und Zugangsdaten prüfen.",
+  "storage_connect_error_access_denied": "Zugriff verweigert — Zugangsdaten prüfen.",
+  "storage_connect_error_not_found": "Speicher-Backend nicht gefunden — Endpunkt prüfen.",
+  "storage_connect_error_server_error": "Das Speicher-Backend hat einen Fehler gemeldet — Endpunkt und Zugangsdaten prüfen.",
+  "storage_connect_error_network": "Speicher-Backend nicht erreichbar — Host und Port prüfen.",
+  "storage_connect_error_hdfs": "HDFS-Verbindungen werden noch nicht unterstützt.",
   "storage_connect_saved": "Gespeicherte Verbindungen",
   "storage_connect_no_saved": "Noch keine gespeicherten Verbindungen",
   "storage_connect_forget": "Löschen",
diff --git a/messages/en.json b/messages/en.json
index 59d79748..31540ce2 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -146,6 +146,11 @@
   "storage_connect_timeout": "Connection timed out. The storage backend did not respond.",
   "storage_connect_cancel": "Cancel",
   "storage_connect_error": "Could not connect — check the endpoint and credentials.",
+  "storage_connect_error_access_denied": "Access denied — check your credentials.",
+  "storage_connect_error_not_found": "Could not find the storage backend — check the endpoint.",
+  "storage_connect_error_server_error": "The storage backend returned an error — check the endpoint and credentials.",
+  "storage_connect_error_network": "Could not reach the storage backend — check the host and port.",
+  "storage_connect_error_hdfs": "HDFS connections are not yet supported.",
   "storage_connect_saved": "Saved connections",
   "storage_connect_no_saved": "No saved connections yet",
   "storage_connect_forget": "Delete",
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 4ef09ef4..1df24ce7 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -1,10 +1,11 @@
-import { fail, redirect } from '@sveltejs/kit';
+import { fail, redirect, isHttpError } from '@sveltejs/kit';
 import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
 import { StorageConnectionSchema } from '$lib/storage/schemas.js';
 import { getConnectionProvider } from '$lib/server/storage/utils.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
+import * as m from '$lib/paraglide/messages.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
   const connectionForm = await superValidate(
@@ -29,7 +30,7 @@ export const actions: Actions = {
     const { type, host, port, tls, accessStyle, region, credentials } = form.data;
 
     if (type !== 's3') {
-      return message(form, 'HDFS connections are not yet supported', { status: 400 });
+      return message(form, m.storage_connect_error_hdfs(), { status: 400 });
     }
 
     const resolvedCredentials =
@@ -50,9 +51,30 @@ export const actions: Actions = {
       log.info({ storage_type: type }, 'user storage connection verified');
     } catch (err) {
       log.warn({ err }, 'storage connection test failed');
-      return message(form, 'Could not connect — check the endpoint and credentials.', {
-        status: 400
-      });
+
+      let msg: string;
+      if (isHttpError(err)) {
+        if (err.status === 403) {
+          msg = m.storage_connect_error_access_denied();
+        } else if (err.status === 404) {
+          msg = m.storage_connect_error_not_found();
+        } else if (err.status === 502) {
+          msg = m.storage_connect_error_server_error();
+        } else {
+          msg = m.storage_connect_error();
+        }
+      } else if (err instanceof Error) {
+        const e = (err.message ?? '').toLowerCase();
+        if (/econnrefused|enotfound|eai_again|etimedout|network/.test(e)) {
+          msg = m.storage_connect_error_network();
+        } else {
+          msg = m.storage_connect_error();
+        }
+      } else {
+        msg = m.storage_connect_error();
+      }
+
+      return message(form, msg, { status: 400 });
     }
 
     throw redirect(303, '/storage');
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
index 09811238..24977514 100644
--- a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
@@ -1,10 +1,11 @@
-import { fail } from '@sveltejs/kit';
+import { fail, isHttpError } from '@sveltejs/kit';
 import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
 import type { Actions, PageServerLoad } from './$types';
 import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
 import { getConnectionProvider } from '$lib/server/storage/utils.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
+import * as m from '$lib/paraglide/messages.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
   const editForm = await superValidate(
@@ -29,7 +30,7 @@ export const actions: Actions = {
     const { type, host, port, tls, accessStyle, region, credentials } = form.data;
 
     if (type !== 's3') {
-      return message(form, 'HDFS connections are not yet supported', { status: 400 });
+      return message(form, m.storage_connect_error_hdfs(), { status: 400 });
     }
 
     const resolvedCredentials =
@@ -53,9 +54,30 @@ export const actions: Actions = {
         log.info({ storage_type: type }, 'storage connection edit verified');
       } catch (err) {
         log.warn({ err }, 'storage connection edit test failed');
-        return message(form, 'Could not connect — check the endpoint and credentials.', {
-          status: 400
-        });
+
+        let msg: string;
+        if (isHttpError(err)) {
+          if (err.status === 403) {
+            msg = m.storage_connect_error_access_denied();
+          } else if (err.status === 404) {
+            msg = m.storage_connect_error_not_found();
+          } else if (err.status === 502) {
+            msg = m.storage_connect_error_server_error();
+          } else {
+            msg = m.storage_connect_error();
+          }
+        } else if (err instanceof Error) {
+          const e = (err.message ?? '').toLowerCase();
+          if (/econnrefused|enotfound|eai_again|etimedout|network/.test(e)) {
+            msg = m.storage_connect_error_network();
+          } else {
+            msg = m.storage_connect_error();
+          }
+        } else {
+          msg = m.storage_connect_error();
+        }
+
+        return message(form, msg, { status: 400 });
       }
     }
 

From 5e6c5be60abd19fbc7083576b4d31dc7a9ed50f8 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 14:17:49 +0200
Subject: [PATCH 103/136] minor spelling change

---
 messages/de.json | 2 +-
 messages/en.json | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 30d951ee..b9928649 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -150,7 +150,7 @@
   "storage_connect_error_not_found": "Speicher-Backend nicht gefunden — Endpunkt prüfen.",
   "storage_connect_error_server_error": "Das Speicher-Backend hat einen Fehler gemeldet — Endpunkt und Zugangsdaten prüfen.",
   "storage_connect_error_network": "Speicher-Backend nicht erreichbar — Host und Port prüfen.",
-  "storage_connect_error_hdfs": "HDFS-Verbindungen werden noch nicht unterstützt.",
+  "storage_connect_error_hdfs": "HDFS-Verbindungen werden noch nicht unterstützt",
   "storage_connect_saved": "Gespeicherte Verbindungen",
   "storage_connect_no_saved": "Noch keine gespeicherten Verbindungen",
   "storage_connect_forget": "Löschen",
diff --git a/messages/en.json b/messages/en.json
index 31540ce2..118bce95 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -150,7 +150,7 @@
   "storage_connect_error_not_found": "Could not find the storage backend — check the endpoint.",
   "storage_connect_error_server_error": "The storage backend returned an error — check the endpoint and credentials.",
   "storage_connect_error_network": "Could not reach the storage backend — check the host and port.",
-  "storage_connect_error_hdfs": "HDFS connections are not yet supported.",
+  "storage_connect_error_hdfs": "HDFS connections are not yet supported",
   "storage_connect_saved": "Saved connections",
   "storage_connect_no_saved": "No saved connections yet",
   "storage_connect_forget": "Delete",

From 7ba94c00f7ef4faa6db5948f0ec842124a93caad Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 14:45:56 +0200
Subject: [PATCH 104/136] fix unit tests

---
 e2e/storage/connection.spec.ts             | 2 +-
 e2e/storage/connections-management.spec.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index d74f1b7a..430d0c83 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -44,7 +44,7 @@ test.describe('Storage S3 — Connection', () => {
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
     await expect(
-      page.getByText('Could not connect — check the endpoint and credentials.')
+      page.getByText('Access denied — check your credentials.')
     ).toBeVisible();
   });
 
diff --git a/e2e/storage/connections-management.spec.ts b/e2e/storage/connections-management.spec.ts
index 5e3331bb..9f7dd07c 100644
--- a/e2e/storage/connections-management.spec.ts
+++ b/e2e/storage/connections-management.spec.ts
@@ -112,7 +112,7 @@ test.describe('Storage — Connections management', () => {
     await page.getByRole('button', { name: 'Save changes' }).click();
 
     await expect(
-      page.getByText('Could not connect — check the endpoint and credentials.')
+      page.getByText('Access denied — check your credentials.')
     ).toBeVisible();
   });
 

From eee9036f0ec7b6bebd57e9401fc3ce004ed75add Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 13 Jul 2026 14:54:55 +0200
Subject: [PATCH 105/136] fix lint

---
 e2e/storage/connection.spec.ts             | 4 +---
 e2e/storage/connections-management.spec.ts | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index 430d0c83..04db89a0 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -43,9 +43,7 @@ test.describe('Storage S3 — Connection', () => {
     await page.getByRole('button', { name: 'Connect' }).click();
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
-    await expect(
-      page.getByText('Access denied — check your credentials.')
-    ).toBeVisible();
+    await expect(page.getByText('Access denied — check your credentials.')).toBeVisible();
   });
 
   test('disconnects from Garage S3', async ({ page }) => {
diff --git a/e2e/storage/connections-management.spec.ts b/e2e/storage/connections-management.spec.ts
index 9f7dd07c..25d1e762 100644
--- a/e2e/storage/connections-management.spec.ts
+++ b/e2e/storage/connections-management.spec.ts
@@ -111,9 +111,7 @@ test.describe('Storage — Connections management', () => {
     await page.getByLabel('Secret key').fill('wrong-secret');
     await page.getByRole('button', { name: 'Save changes' }).click();
 
-    await expect(
-      page.getByText('Access denied — check your credentials.')
-    ).toBeVisible();
+    await expect(page.getByText('Access denied — check your credentials.')).toBeVisible();
   });
 
   test('delete button on management page removes the connection after confirmation', async ({

From a78e19da9e725c7b7a33769cc149eef189cbab4b Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Tue, 14 Jul 2026 09:56:17 +0200
Subject: [PATCH 106/136] Refactor/migrate to db (#221)

* feat(database): integrate Drizzle ORM with PostgreSQL 18

- Added PostgreSQL Helm chart and related Kubernetes configurations for local development and E2E testing.
- Introduced new NPM scripts for database generation, migration, and management using Drizzle ORM.
- Created database connection and migration logic in `drizzle.config.ts`, `db.ts`, and `migrate.ts`.
- Defined user storage connections schema and initial migration files.
- Updated `DATABASE.md` with setup instructions and usage guidelines for the new database system.

* remove connection testing section from DATABASE.md

* move DATABASE.md into docs folder

* feat(database): add E2E tests with PostgreSQL and health check endpoint

* fix(database): update PostgreSQL health check command to specify user

* feat(database): configure PostgreSQL settings and update tests for new connection parameters

* feat(tests): integrate PostgreSQL into E2E tests and update database connection variables

* feat(tests): update test execution to include database tests

* fix(database): update test database password for consistency in E2E tests

* refactor(tests): remove hardcoded database connection variables from test script

* refactor(tests): remove outdated comments and update database password for E2E tests

* chore: add testcontainers and postgresql dependencies to package.json

* feat(tests): integrate drizzle ORM for database migrations in global setup

* feat(tests): add PostgreSQL setup and teardown for E2E tests

* feat(tests): integrate PostgreSQL and Garage S3 setup for E2E tests

* feat(tests): configure Playwright to use a single worker in CI environment

* feat(tests): enhance E2E test workflow with environment setup and build step

* feat(tests): add Better Auth URL and secret to E2E test environment configuration

* feat(tests): update preview command in Playwright configuration for better environment handling

* feat(tests): add Docker network setup for PostgreSQL and Garage S3 in E2E tests

* debug: add debug step for postgres

* add catch block

* change path

* add more debug output

* fix: fix tests for trino tab state

* fix: simplify playwright setup

* fix: garage health endpoint

* revert setTabState changes

* add debug trace uploading

* fix sign-out test

* Fix import

* remove debug statements and modulerize container setup

* update upload-artifact action to v7

* update package-lock.json

* feat: use db instead of frontend local storage

* fix: tests

* fix unit tests

* fix: layout.svelte

* feat: implement run-e2e script to manage testcontainers for Playwright

* fix: update comment and selector for bucket visibility in S3 integration test

* fix: improve error handling and validation in storage-related endpoints

* chore(docker): update images to use OCI mirror

* fix: e2e tests

* fix: e2e tests

* fix: e2e tests

* fix: unit tests

* #221 add storage encryption key to setup

* build on e2e test

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 .env.test                                     |    4 +
 .github/workflows/pr_checks.yaml              |   48 +-
 .gitignore                                    |    1 +
 TECH_DEBT.md                                  |    6 +-
 dev/postgresql/values.yaml                    |    4 +-
 dev/setup.sh                                  |    3 +
 drizzle.config.ts                             |    2 +-
 e2e/database/db.spec.ts                       |   24 +
 e2e/run-garage-tests.sh                       |   19 -
 e2e/storage-s3.spec.ts                        |   40 +-
 e2e/storage/connection.spec.ts                |   21 +-
 e2e/storage/connections-management.spec.ts    |   12 +-
 e2e/storage/helpers.ts                        |  106 +-
 e2e/storage/recent-items.spec.ts              |    1 +
 e2e/storage/tabs.spec.ts                      |    1 +
 e2e/storage/upload.spec.ts                    |    6 +-
 e2e/support/containers/garage.setup.ts        |   69 +
 e2e/support/containers/postgres.setup.ts      |   22 +
 e2e/support/db-migrations.setup.ts            |   17 +
 e2e/support/global-setup.ts                   |   68 +-
 e2e/support/run-e2e.ts                        |   67 +
 e2e/trino/trino-tabs.spec.ts                  |    2 +
 messages/de.json                              |   13 +
 messages/en.json                              |   13 +
 package-lock.json                             | 4764 ++++++++---------
 package.json                                  |    8 +-
 playwright.config.ts                          |   18 +-
 src/app.d.ts                                  |    5 +-
 src/hooks.server.ts                           |   45 +-
 src/lib/components/editor/TextEditor.svelte   |    2 +
 .../storage/explorer/StorageBreadcrumb.svelte |    9 +-
 .../components/storage/explorer/TabBar.svelte |   11 +-
 .../explorer/__tests__/FileRow.svelte.spec.ts |    6 +-
 .../__tests__/StorageBreadcrumbWrapper.svelte |    8 +-
 .../storage/landing/StorageConnectForm.svelte |  434 +-
 .../landing/StorageConnectForm.svelte.spec.ts |  408 +-
 .../{ => modals}/DeleteConnectionModal.svelte |   24 +-
 .../storage/modals/PreviewModal.svelte        |   38 +-
 .../storage/modals/upload/UploadModal.svelte  |   11 +-
 .../modals/upload/UploadModal.svelte.spec.ts  |    6 +
 .../sidebar/StorageConnectionSidebar.svelte   |  257 +-
 src/lib/server/auth-schema.ts                 |   95 +
 src/lib/server/auth.ts                        |   20 +-
 src/lib/server/db.ts                          |    7 +-
 .../0001_add_unique_connection_name.sql       |    1 +
 .../server/migrations/0001_keen_prodigy.sql   |    1 +
 .../server/migrations/0002_dashing_nuke.sql   |   55 +
 .../server/migrations/meta/0001_snapshot.json |  106 +
 .../server/migrations/meta/0002_snapshot.json |  461 ++
 src/lib/server/migrations/meta/_journal.json  |   14 +
 src/lib/server/schema.ts                      |    7 +-
 src/lib/server/storage/connection.ts          |  107 +-
 src/lib/server/storage/connections-db.ts      |  136 +
 src/lib/server/storage/encryption-key.ts      |   37 +
 src/lib/server/storage/encryption.test.ts     |  107 +
 src/lib/server/storage/encryption.ts          |   84 +
 src/lib/server/storage/s3-provider.ts         |   89 +-
 src/lib/server/storage/types.ts               |    8 +
 src/lib/storage/connection-id-header.ts       |    8 +
 src/lib/storage/connection-storage.spec.ts    |  261 -
 src/lib/storage/connection-storage.ts         |  138 +-
 src/lib/storage/connection-store.svelte.ts    |   26 +
 src/lib/storage/download.ts                   |   12 +-
 src/lib/storage/schemas.ts                    |    4 +
 src/lib/storage/state.svelte.ts               |   33 +-
 src/lib/storage/upload.ts                     |   13 +-
 .../(app)/api/storage/buckets/+server.ts      |   18 +-
 .../(app)/api/storage/connections/+server.ts  |   57 +
 .../(app)/api/storage/save-text/+server.ts    |   10 +-
 src/routes/(app)/storage/+layout.server.ts    |   49 +-
 src/routes/(app)/storage/+layout.svelte       |    8 +-
 src/routes/(app)/storage/+layout.ts           |   53 +-
 src/routes/(app)/storage/+page.server.ts      |  118 +-
 src/routes/(app)/storage/+page.svelte         |   11 +-
 .../storage/[bucket]/[...prefix]/+page.ts     |    9 +-
 .../(app)/storage/connections/+page.server.ts |   38 +-
 .../(app)/storage/connections/+page.svelte    |  104 +-
 .../storage/connections/[id]/+layout.svelte   |   11 +-
 .../connections/[id]/edit/+page.server.ts     |  107 +-
 .../connections/[id]/edit/+page.svelte        |   91 +-
 .../(app)/storage/layout.server.test.ts       |   26 +-
 src/routes/(app)/storage/page.server.test.ts  |   76 +-
 82 files changed, 5123 insertions(+), 4116 deletions(-)
 create mode 100644 e2e/database/db.spec.ts
 delete mode 100755 e2e/run-garage-tests.sh
 create mode 100644 e2e/support/containers/garage.setup.ts
 create mode 100644 e2e/support/containers/postgres.setup.ts
 create mode 100644 e2e/support/db-migrations.setup.ts
 create mode 100644 e2e/support/run-e2e.ts
 rename src/lib/components/storage/{ => modals}/DeleteConnectionModal.svelte (89%)
 create mode 100644 src/lib/server/auth-schema.ts
 create mode 100644 src/lib/server/migrations/0001_add_unique_connection_name.sql
 create mode 100644 src/lib/server/migrations/0001_keen_prodigy.sql
 create mode 100644 src/lib/server/migrations/0002_dashing_nuke.sql
 create mode 100644 src/lib/server/migrations/meta/0001_snapshot.json
 create mode 100644 src/lib/server/migrations/meta/0002_snapshot.json
 create mode 100644 src/lib/server/storage/connections-db.ts
 create mode 100644 src/lib/server/storage/encryption-key.ts
 create mode 100644 src/lib/server/storage/encryption.test.ts
 create mode 100644 src/lib/server/storage/encryption.ts
 create mode 100644 src/lib/storage/connection-id-header.ts
 delete mode 100644 src/lib/storage/connection-storage.spec.ts
 create mode 100644 src/lib/storage/connection-store.svelte.ts
 create mode 100644 src/routes/(app)/api/storage/connections/+server.ts

diff --git a/.env.test b/.env.test
index 46722865..f9f134e8 100644
--- a/.env.test
+++ b/.env.test
@@ -19,3 +19,7 @@ PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 GARAGE_ADMIN_URL=http://localhost:30902
 GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token
+BETTER_AUTH_URL=http://localhost:4173
+BETTER_AUTH_SECRET=stackable-cockpit-e2e-better-auth-secret
+STORAGE_ENCRYPTION_KEY=a781775ee543107bfa97191691bb23c982dd9d9550542df27194ebc09d617dfd
+PORT=4173
diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index f1b7216b..bed73772 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -85,10 +85,10 @@ jobs:
       - name: Run unit tests
         run: npm run test:unit
 
-  e2e-with-garage:
-    name: E2E Tests with Garage S3
+  e2e-tests:
+    name: E2E Tests with Garage S3 and PostgreSQL
     runs-on: ubuntu-latest
-
+    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -107,35 +107,13 @@ jobs:
       - name: Install Playwright browsers
         run: npx playwright install --with-deps chromium firefox
 
-      - name: Start Garage S3 and initialize bucket
-        run: |
-          # GitHub Actions services now support entrypoint + command, but we still
-          # start Garage manually here because service containers are created before
-          # actions/checkout runs. The upstream Garage image contains only the
-          # /garage binary (no /bin/sh), so the service cannot wait for the checked-
-          # out e2e/garage.toml to appear before it starts.
-          docker run -d --name garage \
-            -p 3900:3900 \
-            -p 3902:3902 \
-            -e GARAGE_CONFIG_FILE=/workspace/dev/garage/garage.toml \
-            -v "$PWD:/workspace" \
-            --entrypoint /garage \
-            oci.stackable.tech/stackable/dxflrs/garage:v2.3.0 \
-            server --single-node
-
-          # Wait for the S3 API to become available
-          for _ in $(seq 1 30); do
-            if curl -s http://localhost:3900 >/dev/null 2>&1; then
-              break
-            fi
-            sleep 1
-          done
-
-          S3_SECRET_ACCESS_KEY="e2e-test-secret-key-for-ci" \
-            GARAGE_ADMIN_TOKEN='stackable-cockpit-e2e-admin-token' \
-            S3_ENDPOINT='http://localhost:3900' \
-            S3_CONFIG_PATH="$PWD/s3-config.json" \
-            ./e2e/init-garage-s3.sh
-
-      - name: Run E2E tests with Garage
-        run: npm run test:e2e:garage
+      - name: Run E2E tests with Garage and PostgreSQL
+        run: npm run test:e2e
+
+      - name: Upload Playwright traces
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-traces
+          path: e2e/test-results/
+          retention-days: 7
diff --git a/.gitignore b/.gitignore
index 871677f2..aa194c48 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,6 +40,7 @@ coverage/*
 # Playwright
 e2e/test-results
 e2e/.auth
+.playwright/
 # Paraglide
 src/lib/paraglide
 project.inlang/cache/
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 23e76bd9..a2073ed2 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -30,11 +30,9 @@ When `tls.verification` is set to `'None'`, the S3 client is created with `rejec
 
 ---
 
-### S3 connection credentials stored in localStorage
+### ~~S3 connection credentials stored in localStorage~~ — RESOLVED
 
-**File:** `src/lib/storage/connection-storage.ts`, `src/lib/components/storage/StorageConnectForm.svelte`
-
-S3 connection credentials (access key ID and secret access key) are persisted in plaintext `localStorage` so the browser can auto-reconnect after a page reload or server restart. `localStorage` is accessible to any JavaScript running on the page and is visible in browser DevTools, making it vulnerable to XSS. Acceptable for the current early stage where the alternative is users having to re-enter credentials after every server restart. Long-term fix: persist encrypted credentials server-side, tied to the authenticated session; send only a session token to the client.
+Previously, S3 connection credentials were persisted in plaintext `localStorage`. This has been replaced by a server-side encrypted credential store backed by PostgreSQL. Credentials are encrypted with AES-256-GCM using a per-deployment application key (`STORAGE_ENCRYPTION_KEY`). The client now sends only a connection UUID (`x-storage-connection-id` header); the server decrypts and creates the S3 client. See `src/lib/server/storage/encryption.ts` and `src/lib/server/storage/connection.ts`.
 
 ---
 
diff --git a/dev/postgresql/values.yaml b/dev/postgresql/values.yaml
index e99bd668..241ccf70 100644
--- a/dev/postgresql/values.yaml
+++ b/dev/postgresql/values.yaml
@@ -1,7 +1,7 @@
 ---
 image:
-  repository: postgres
-  tag: '18.4-alpine3.23'
+  repository: oci.stackable.tech/stackable/library/postgres
+  tag: '18.4-alpine3.24'
   pullPolicy: IfNotPresent
 
 # Database configuration
diff --git a/dev/setup.sh b/dev/setup.sh
index 76e23a7b..4f706f76 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -256,6 +256,7 @@ fi
 # ------------------------------------------------------------------
 echo ""
 SESSION_SECRET=$(openssl rand -hex 32)
+STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)
 
 if [ -f "$ENV_FILE" ]; then
   echo "Backing up existing .env.development to .env.development.bak"
@@ -303,6 +304,7 @@ STACKABLE_COCKPIT_TRINO_AUTH_TYPE=basic
 STACKABLE_COCKPIT_TRINO_AUTH_USERNAME=stackable-cockpit
 STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD=stackable-cockpit-dev
 STACKABLE_COCKPIT_TRINO_TLS_INSECURE=true
+STORAGE_ENCRYPTION_KEY=${STORAGE_ENCRYPTION_KEY}
 STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
 STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
@@ -331,6 +333,7 @@ STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
 STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=${SECRET}
 STACKABLE_COCKPIT_SESSION_SECRET=${SESSION_SECRET}
 STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
+STORAGE_ENCRYPTION_KEY=${STORAGE_ENCRYPTION_KEY}
 STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
 STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
 STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
diff --git a/drizzle.config.ts b/drizzle.config.ts
index da1adf3d..522aab1f 100644
--- a/drizzle.config.ts
+++ b/drizzle.config.ts
@@ -3,7 +3,7 @@ import { defineConfig } from 'drizzle-kit';
 const isDev = process.env.NODE_ENV !== 'production';
 
 export default defineConfig({
-  schema: './src/lib/server/schema.ts',
+  schema: ['./src/lib/server/schema.ts', './src/lib/server/auth-schema.ts'],
   out: './src/lib/server/migrations',
   dialect: 'postgresql',
   dbCredentials: {
diff --git a/e2e/database/db.spec.ts b/e2e/database/db.spec.ts
new file mode 100644
index 00000000..8b9b287a
--- /dev/null
+++ b/e2e/database/db.spec.ts
@@ -0,0 +1,24 @@
+import { test, expect } from '@playwright/test';
+import { Client } from 'pg';
+
+test.describe('Database connectivity', () => {
+  test('connects to the database and reports the database as healthy', async () => {
+    const client = new Client({
+      host: process.env.DATABASE_HOST,
+      port: parseInt(process.env.DATABASE_PORT ?? '5432', 10),
+      database: process.env.DATABASE_NAME,
+      user: process.env.DATABASE_USER,
+      password: process.env.DATABASE_PASSWORD,
+      ssl: false
+    });
+
+    await client.connect();
+    try {
+      await client.query('SELECT 1 FROM user_storage_connections LIMIT 0');
+    } finally {
+      await client.end();
+    }
+
+    expect(true).toBe(true);
+  });
+});
diff --git a/e2e/run-garage-tests.sh b/e2e/run-garage-tests.sh
deleted file mode 100755
index d5683b22..00000000
--- a/e2e/run-garage-tests.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-ROOT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
-S3_CONFIG_PATH="$ROOT_DIR/s3-config.json"
-
-if [[ ! -f "$S3_CONFIG_PATH" ]]; then
-  echo 's3-config.json was not found.' >&2
-  echo 'Run dev/setup.sh to deploy Garage to your kind cluster (it writes s3-config.json).' >&2
-  exit 1
-fi
-
-node --env-file=.env.test node_modules/.bin/vite build
-# Run non-storage tests with full parallelism.
-node_modules/.bin/playwright test e2e/auth/ e2e/trino/ e2e/smoke.spec.ts e2e/i18n.spec.ts "$@"
-# Storage tests share a server-side S3 session per user and cannot run in
-# parallel within the same browser project. Run them serially.
-node_modules/.bin/playwright test e2e/storage/ --workers=1 "$@"
diff --git a/e2e/storage-s3.spec.ts b/e2e/storage-s3.spec.ts
index 653cf5b0..896f600a 100644
--- a/e2e/storage-s3.spec.ts
+++ b/e2e/storage-s3.spec.ts
@@ -19,20 +19,38 @@ test.describe('Storage S3 (Garage)', () => {
   test.use({ locale: 'en-US' });
 
   async function openConnectForm(page: import('@playwright/test').Page) {
-    await page.goto('/storage?disconnected=1');
+    await page.goto('/storage');
     await waitForHydration(page);
 
     const disconnectButton = page.getByRole('button', { name: 'Disconnect' });
     if (await disconnectButton.isVisible().catch(() => false)) {
       await disconnectButton.click();
-      // Disconnect now opens a confirmation modal — confirm it if it appears.
-      const confirmButton = page.getByRole('dialog').getByRole('button', { name: 'Disconnect' });
-      if (await confirmButton.isVisible({ timeout: 2_000 }).catch(() => false)) {
-        await confirmButton.click();
-      }
+      await page.getByRole('dialog').getByRole('button', { name: 'Disconnect' }).click();
     }
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
+
+    // Clear all saved connections so tests start from a clean state.
+    const savedList = page.getByRole('list', { name: 'Saved connections' });
+    while (await savedList.isVisible().catch(() => false)) {
+      const items = savedList.getByRole('listitem');
+      if ((await items.count()) === 0) break;
+      if (
+        await items
+          .first()
+          .filter({ hasText: 'No saved connections yet' })
+          .isVisible()
+          .catch(() => false)
+      )
+        break;
+      await items.first().getByRole('button').last().click({ force: true });
+      const deleteMenuItem = page.getByRole('menuitem', { name: 'Delete', exact: true });
+      if (await deleteMenuItem.isVisible().catch(() => false)) {
+        await deleteMenuItem.click();
+        await page.getByRole('button', { name: 'Delete', exact: true }).click();
+      }
+      await waitForHydration(page);
+    }
   }
 
   test('connects to Garage S3 bucket and lists buckets', async ({ page }) => {
@@ -60,16 +78,15 @@ test.describe('Storage S3 (Garage)', () => {
     await page.getByLabel('Access key').fill(accessKeyId);
     await page.getByLabel('Secret key').fill(secretAccessKey);
 
-    await page.getByRole('button', { name: 'Connect' }).click();
+    await page.getByRole('button', { name: 'Connect', exact: true }).click();
 
     // After a successful connection the app redirects to /storage and shows the bucket list
     await expect(page).toHaveURL('/storage');
     const main = page.locator('main');
     await expect(main.getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
-    // The bucket created during Garage setup must appear in the list.
-    // Both the sidebar nav and the bucket grid render a link — use first() to
-    // avoid a strict-mode violation.
+    // The bucket created during Garage setup must appear in the grid
+    // (use .first() because the sidebar nav also renders a link to each bucket)
     await expect(main.getByRole('link', { name: bucket, exact: true }).first()).toBeVisible();
   });
 
@@ -95,11 +112,12 @@ test.describe('Storage S3 (Garage)', () => {
     await page.getByLabel('Region').fill(region);
     await page.getByLabel('Access key').fill(accessKeyId);
     await page.getByLabel('Secret key').fill(secretAccessKey);
-    await page.getByRole('button', { name: 'Connect' }).click();
+    await page.getByRole('button', { name: 'Connect', exact: true }).click();
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
     // Then disconnect — clicking Disconnect opens a confirmation modal.
     await page.getByRole('button', { name: 'Disconnect' }).click();
+    // Disconnect now shows a confirmation modal; confirm it
     await page.getByRole('dialog').getByRole('button', { name: 'Disconnect' }).click();
 
     // Should return to the connect form
diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index 04db89a0..52d071a6 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -40,7 +40,7 @@ test.describe('Storage S3 — Connection', () => {
     await page.getByLabel('Region').fill(credentials.region);
     await page.getByLabel('Access key').fill(credentials.accessKeyId);
     await page.getByLabel('Secret key').fill(`${credentials.secretAccessKey}-wrong`);
-    await page.getByRole('button', { name: 'Connect' }).click();
+    await page.getByRole('button', { name: 'Connect', exact: true }).click();
 
     await expect(page.getByRole('heading', { name: 'Connect to storage' })).toBeVisible();
     await expect(page.getByText('Access denied — check your credentials.')).toBeVisible();
@@ -66,7 +66,8 @@ test.describe('Storage S3 — Connection', () => {
     await connectToStorage(page, credentials);
     await expect(page).toHaveURL('/storage');
 
-    await openConnectForm(page);
+    // Do not clear saved connections — we need the one we just saved.
+    await openConnectForm(page, { clearSaved: false });
 
     const savedList = page.getByRole('list', { name: 'Saved connections' });
     await expect(savedList).toBeVisible();
@@ -83,12 +84,16 @@ test.describe('Storage S3 — Connection', () => {
     await connectToStorage(page, credentials);
     await expect(page).toHaveURL('/storage');
 
-    await openConnectForm(page);
+    // Do not clear saved connections — we need the one we just saved.
+    await openConnectForm(page, { clearSaved: false });
 
     const savedList = page.getByRole('list', { name: 'Saved connections' });
     await expect(savedList).toBeVisible();
 
-    // Open the "More options" context menu for the first saved connection
+    // Count items before — retries accumulate connections in the DB, so there
+    // may be more than one.  We only assert that forgetting ONE removes exactly
+    // one entry, not that the list becomes empty.
+    const countBefore = await savedList.getByRole('listitem').count();
     await savedList.getByRole('listitem').first().getByRole('button').last().click();
 
     // Click Delete in the context menu (rendered as a menuitem)
@@ -97,7 +102,13 @@ test.describe('Storage S3 — Connection', () => {
     // Confirm deletion in the modal
     await page.getByRole('button', { name: 'Delete', exact: true }).click();
 
-    await expect(page.getByText('No saved connections yet')).toBeVisible();
+    if (countBefore === 1) {
+      // Last connection removed — list collapses entirely
+      await expect(page.getByText('No saved connections yet')).toBeVisible();
+    } else {
+      // Other connections still exist — list shrinks by exactly one
+      await expect(savedList.getByRole('listitem')).toHaveCount(countBefore - 1);
+    }
   });
 
   test('clicking a bucket tile in the grid navigates to the bucket explorer', async ({ page }) => {
diff --git a/e2e/storage/connections-management.spec.ts b/e2e/storage/connections-management.spec.ts
index 25d1e762..f7722396 100644
--- a/e2e/storage/connections-management.spec.ts
+++ b/e2e/storage/connections-management.spec.ts
@@ -77,10 +77,8 @@ test.describe('Storage — Connections management', () => {
     await expect(page.getByRole('textbox', { name: 'Host' })).toHaveValue(
       new URL(credentials.endpoint).hostname
     );
-    await expect(page.getByRole('textbox', { name: 'Region' })).toHaveValue(credentials.region);
-    await expect(page.getByRole('textbox', { name: 'Access key' })).toHaveValue(
-      credentials.accessKeyId
-    );
+    await expect(page.getByLabel('Region')).toHaveValue(credentials.region);
+    await expect(page.getByLabel('Access key')).toHaveValue(credentials.accessKeyId);
   });
 
   test('edit page redirects to connections list after saving valid credentials', async ({
@@ -172,7 +170,7 @@ test.describe('Storage — Connections management', () => {
     await page.getByLabel('Connection name').fill('Changed name');
 
     // Try to navigate away via the back link
-    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+    await page.getByRole('link', { name: '← Manage connections' }).click();
 
     // Modal should appear
     await expect(page.getByRole('dialog')).toBeVisible();
@@ -188,7 +186,7 @@ test.describe('Storage — Connections management', () => {
     await openFirstConnectionEditPage(page);
 
     await page.getByLabel('Connection name').fill('Changed name');
-    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+    await page.getByRole('link', { name: '← Manage connections' }).click();
 
     await page.getByRole('dialog').getByRole('button', { name: 'Stay on page' }).click();
 
@@ -205,7 +203,7 @@ test.describe('Storage — Connections management', () => {
     await openFirstConnectionEditPage(page);
 
     await page.getByLabel('Connection name').fill('Changed name');
-    await page.getByRole('link', { name: '← Manage connections', exact: true }).click();
+    await page.getByRole('link', { name: '← Manage connections' }).click();
 
     await page.getByRole('dialog').getByRole('button', { name: 'Leave' }).click();
 
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 1117458d..8856219f 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -40,7 +40,38 @@ export function bucketRoute(bucket: string, prefix = ''): string {
   return `/storage/${encodeURIComponent(bucket)}/${encoded}`;
 }
 
-export async function openConnectForm(page: Page) {
+export async function clearSavedConnections(page: Page) {
+  const savedList = page.getByRole('list', { name: 'Saved connections' });
+  while (await savedList.isVisible().catch(() => false)) {
+    const items = savedList.getByRole('listitem');
+    if ((await items.count()) === 0) break;
+    if (
+      await items
+        .first()
+        .filter({ hasText: 'No saved connections yet' })
+        .isVisible()
+        .catch(() => false)
+    )
+      break;
+    // Click the last button in the first list item. On desktop this is the
+    // "more options" button (opacity-0, so use force). On mobile it's the
+    // X delete button which submits the form directly.
+    await items.first().getByRole('button').last().click({ force: true });
+    // Desktop: a context menu appears — click Delete to open the modal.
+    // Mobile: the form submitted directly (no context menu), skip to hydration.
+    const deleteMenuItem = page.getByRole('menuitem', { name: 'Delete', exact: true });
+    if (await deleteMenuItem.isVisible().catch(() => false)) {
+      await deleteMenuItem.click();
+      // Confirm in the modal
+      await page.getByRole('button', { name: 'Delete', exact: true }).click();
+    }
+    // The form action POSTs and the server redirects back to /storage;
+    // wait for the page to re-hydrate before checking the list again.
+    await waitForHydration(page);
+  }
+}
+
+export async function openConnectForm(page: Page, { clearSaved = true } = {}) {
   await page.goto('/');
   if (new URL(page.url()).pathname.startsWith('/auth/login')) {
     await waitForHydration(page);
@@ -49,7 +80,7 @@ export async function openConnectForm(page: Page) {
     await expect(page.getByRole('heading', { name: 'Dashboard' })).toBeVisible();
   }
 
-  await page.goto('/storage?disconnected=1');
+  await page.goto('/storage');
   await waitForHydration(page);
 
   const connectHeading = page.getByRole('heading', { name: 'Connect to storage' });
@@ -59,14 +90,17 @@ export async function openConnectForm(page: Page) {
     (await disconnectButton.isVisible().catch(() => false))
   ) {
     await disconnectButton.click();
-    // A confirmation modal was added — confirm the disconnection if the modal appears.
-    const confirmButton = page.locator('.modal-box').getByRole('button', { name: 'Disconnect' });
-    if (await confirmButton.isVisible({ timeout: 2_000 }).catch(() => false)) {
-      await confirmButton.click();
-    }
+    // Confirm the disconnect dialog
+    await page.getByRole('dialog').getByRole('button', { name: 'Disconnect' }).click();
   }
 
   await expect(connectHeading).toBeVisible();
+
+  // Clear all saved connections so each test starts from a clean state and
+  // cannot be disrupted by connections left over from previous tests or retries.
+  if (clearSaved) {
+    await clearSavedConnections(page);
+  }
 }
 
 export async function connectToStorage(page: Page, credentials: GarageCredentials) {
@@ -90,50 +124,12 @@ export async function connectToStorage(page: Page, credentials: GarageCredential
   await page.getByLabel('Region').fill(credentials.region);
   await page.getByLabel('Access key').fill(credentials.accessKeyId);
   await page.getByLabel('Secret key').fill(credentials.secretAccessKey);
-  await page.getByRole('button', { name: 'Connect' }).click();
-  // Wait for the redirect to /storage so that saveConnectionLocally() has been called
-  // before the test navigates elsewhere. Without this, a fast page.goto() call can race
-  // with the in-flight form-submission fetch and the connection is never persisted.
-  await page.waitForURL((url) => url.pathname === '/storage', { timeout: 15_000 });
-
-  // Guard: ensure the connection was persisted to localStorage.
-  // The app's saveConnectionLocally() call in the onResult callback can race with
-  // subsequent navigations (page.goto), causing an empty connection list on the
-  // management page. As a backup, seed localStorage directly here.
-  await page.evaluate(
-    ({ host: h, port: p, region: r, accessKey, secretKey, tls }) => {
-      const KEY = 'stackable_storage_connections';
-      if (localStorage.getItem(KEY)) return;
-
-      const id = 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
-        const v = (Math.random() * 16) | 0;
-        return (c === 'x' ? v : (v & 0x3) | 0x8).toString(16);
-      });
-      localStorage.setItem(
-        KEY,
-        JSON.stringify([
-          {
-            id,
-            type: 's3',
-            host: h,
-            port: p ? Number(p) : undefined,
-            tls: tls ? { verification: 'Full' } : undefined,
-            accessStyle: 'Path',
-            region: { name: r },
-            credentials: { accessKey, secretKey }
-          }
-        ])
-      );
-    },
-    {
-      host,
-      port: port || undefined,
-      region: credentials.region,
-      accessKey: credentials.accessKeyId,
-      secretKey: credentials.secretAccessKey,
-      tls: useTls
-    }
-  );
+  await page.getByRole('button', { name: 'Connect', exact: true }).click();
+  // Wait for the client-side connected state to be established before returning.
+  // This confirms the session's activeStorageConnectionId is set and the layout
+  // has fetched the bucket list — reducing the window for session race conditions
+  // when parallel workers share the same server-side session.
+  await waitForStorageConnected(page);
 }
 
 export async function connectAndOpenPrefix(
@@ -142,8 +138,14 @@ export async function connectAndOpenPrefix(
   prefix = ''
 ) {
   await connectToStorage(page, credentials);
-  await expect(page).toHaveURL('/storage');
   await page.goto(bucketRoute(credentials.bucket, prefix));
+  // If a parallel worker's disconnect raced with this navigation the page will
+  // have been redirected back to /storage.  Detect that and reconnect once.
+  await waitForHydration(page);
+  if (!page.url().includes(encodeURIComponent(credentials.bucket))) {
+    await connectToStorage(page, credentials);
+    await page.goto(bucketRoute(credentials.bucket, prefix));
+  }
   await waitForObjectsLoaded(page);
 }
 
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index 9a53f2b7..06915de0 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -112,6 +112,7 @@ test.describe('Storage S3 — Recent Items', () => {
   test('removes files and location from recent lists when a directory is deleted', async ({
     page
   }, testInfo) => {
+    test.slow(); // multiple navigations + directory deletion; Firefox is slow
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
     const prefix = uniquePrefix(testInfo, 'recent-delete-dir');
diff --git a/e2e/storage/tabs.spec.ts b/e2e/storage/tabs.spec.ts
index d69cf371..fa9e5881 100644
--- a/e2e/storage/tabs.spec.ts
+++ b/e2e/storage/tabs.spec.ts
@@ -357,6 +357,7 @@ test.describe('Storage — Restore tabs banner', () => {
   });
 
   test('Restore tabs navigates to the active-tab bucket and loads all tabs', async ({ page }) => {
+    test.slow(); // page.goto('/storage') in Firefox is slow
     const credentials = requireGarageCredentials();
 
     // Step 1: navigate to bucket and add a second tab via natural interaction
diff --git a/e2e/storage/upload.spec.ts b/e2e/storage/upload.spec.ts
index 079f9816..8f362ab7 100644
--- a/e2e/storage/upload.spec.ts
+++ b/e2e/storage/upload.spec.ts
@@ -82,17 +82,17 @@ test.describe('Storage S3 — Upload', () => {
       await rowByName(page, textFixture.name).dblclick();
       await expect(page.getByRole('heading', { name: textFixture.name })).toBeVisible();
       await expect(page.getByText(textFixture.expectedSnippet)).toBeVisible();
-      await page.getByRole('button', { name: 'Close' }).last().click();
+      await page.getByRole('button', { name: 'Close' }).first().click();
 
       await rowByName(page, csvFixture.name).dblclick();
       await expect(page.getByRole('heading', { name: csvFixture.name })).toBeVisible();
       await expect(page.getByText(csvFixture.expectedCell)).toBeVisible();
-      await page.getByRole('button', { name: 'Close' }).last().click();
+      await page.getByRole('button', { name: 'Close' }).first().click();
 
       await rowByName(page, imageFixture.name).dblclick();
       await expect(page.getByRole('heading', { name: imageFixture.name })).toBeVisible();
       await expect(page.getByAltText(`Preview of ${imageFixture.name}`)).toBeVisible();
-      await page.getByRole('button', { name: 'Close' }).last().click();
+      await page.keyboard.press('Escape');
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
diff --git a/e2e/support/containers/garage.setup.ts b/e2e/support/containers/garage.setup.ts
new file mode 100644
index 00000000..4cb05618
--- /dev/null
+++ b/e2e/support/containers/garage.setup.ts
@@ -0,0 +1,69 @@
+import path from 'path';
+import { GenericContainer, type StartedTestContainer, Wait } from 'testcontainers';
+import { createGarageBucketCredentials } from '../garage.js';
+
+export async function startGarage(): Promise<StartedTestContainer> {
+  const garageStart = Date.now();
+  console.log('Starting Garage S3 testcontainer...');
+  const garageContainerBuilder = new GenericContainer(
+    'oci.stackable.tech/stackable/dxflrs/garage:v2.3.0'
+  )
+    .withEntrypoint(['/garage'])
+    .withCommand(['server', '--single-node'])
+    .withEnvironment({ GARAGE_CONFIG_FILE: '/etc/garage/garage.toml' })
+    .withBindMounts([
+      {
+        source: path.resolve('dev/garage/garage.toml'),
+        target: '/etc/garage/garage.toml',
+        mode: 'ro'
+      }
+    ])
+    .withExposedPorts(3900, 3902)
+    .withStartupTimeout(120_000)
+    .withWaitStrategy(Wait.forHttp('/health', 3902).forStatusCode(200));
+  if (process.env.DOCKER_NETWORK) {
+    garageContainerBuilder.withNetworkMode(process.env.DOCKER_NETWORK);
+  }
+  const garageContainer = await garageContainerBuilder.start();
+  console.log(`Garage S3 started in ${Date.now() - garageStart}ms`);
+
+  await setupGarageBucket(garageContainer);
+
+  return garageContainer;
+}
+
+async function setupGarageBucket(garageContainer: StartedTestContainer): Promise<void> {
+  const garageHost = garageContainer.getHost();
+  const garageS3Endpoint = `http://${garageHost}:${garageContainer.getMappedPort(3900)}`;
+  const garageAdminUrl = `http://${garageHost}:${garageContainer.getMappedPort(3902)}`;
+  // Admin token is defined in dev/garage/garage.toml.
+  const garageAdminToken = 'stackable-cockpit-e2e-admin-token';
+
+  process.env.GARAGE_ADMIN_URL = garageAdminUrl;
+  process.env.GARAGE_ADMIN_TOKEN = garageAdminToken;
+
+  // Create the test bucket and access key via the Garage admin API.
+  const bucketStart = Date.now();
+  console.log('Creating Garage test bucket and credentials...');
+  const credentials = await createGarageBucketCredentials(
+    {
+      endpoint: garageS3Endpoint,
+      region: 'garage',
+      accessKeyId: '',
+      secretAccessKey: '',
+      bucket: 'test-bucket'
+    },
+    {
+      bucketName: 'test-bucket',
+      keyName: 'e2e-test-app',
+      permissions: { owner: true, read: true, write: true }
+    }
+  );
+  console.log(`Garage setup complete in ${Date.now() - bucketStart}ms`);
+
+  process.env.S3_TEST_ENDPOINT = garageS3Endpoint;
+  process.env.S3_TEST_REGION = 'garage';
+  process.env.S3_TEST_ACCESS_KEY_ID = credentials.accessKeyId;
+  process.env.S3_TEST_SECRET_ACCESS_KEY = credentials.secretAccessKey;
+  process.env.S3_TEST_BUCKET = 'test-bucket';
+}
diff --git a/e2e/support/containers/postgres.setup.ts b/e2e/support/containers/postgres.setup.ts
new file mode 100644
index 00000000..1cc781f0
--- /dev/null
+++ b/e2e/support/containers/postgres.setup.ts
@@ -0,0 +1,22 @@
+import { PostgreSqlContainer, type StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+
+export async function startPostgres(): Promise<StartedPostgreSqlContainer> {
+  const pgStart = Date.now();
+  console.log('Starting PostgreSQL testcontainer...');
+  const pgContainerBuilder = new PostgreSqlContainer(
+    'oci.stackable.tech/stackable/library/postgres:18.4-alpine3.24'
+  ).withStartupTimeout(120_000);
+  if (process.env.DOCKER_NETWORK) {
+    pgContainerBuilder.withNetworkMode(process.env.DOCKER_NETWORK);
+  }
+  const pgContainer = await pgContainerBuilder.start();
+  console.log(`PostgreSQL started in ${Date.now() - pgStart}ms`);
+
+  process.env.DATABASE_HOST = pgContainer.getHost();
+  process.env.DATABASE_PORT = pgContainer.getPort().toString();
+  process.env.DATABASE_NAME = pgContainer.getDatabase();
+  process.env.DATABASE_USER = pgContainer.getUsername();
+  process.env.DATABASE_PASSWORD = pgContainer.getPassword();
+
+  return pgContainer;
+}
diff --git a/e2e/support/db-migrations.setup.ts b/e2e/support/db-migrations.setup.ts
new file mode 100644
index 00000000..d660fda8
--- /dev/null
+++ b/e2e/support/db-migrations.setup.ts
@@ -0,0 +1,17 @@
+import { test as setup } from '@playwright/test';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { migrate } from 'drizzle-orm/node-postgres/migrator';
+import fs from 'node:fs/promises';
+import path from 'path';
+
+const stateFile = path.resolve('.playwright/postgres-state.json');
+
+setup('run database migrations', async () => {
+  const raw = await fs.readFile(stateFile, 'utf-8');
+  const { connectionUri } = JSON.parse(raw) as { connectionUri: string };
+
+  const db = drizzle(connectionUri);
+  await migrate(db, {
+    migrationsFolder: path.resolve('src/lib/server/migrations')
+  });
+});
diff --git a/e2e/support/global-setup.ts b/e2e/support/global-setup.ts
index 3754ac1b..2f48ae48 100644
--- a/e2e/support/global-setup.ts
+++ b/e2e/support/global-setup.ts
@@ -1,35 +1,47 @@
-import fs from 'node:fs';
+import fsPromises from 'node:fs/promises';
 import path from 'path';
+import type { StartedPostgreSqlContainer } from '@testcontainers/postgresql';
+import type { StartedTestContainer } from 'testcontainers';
+import { startPostgres } from './containers/postgres.setup.js';
+import { startGarage } from './containers/garage.setup.js';
+
+const stateFile = path.resolve('.playwright/postgres-state.json');
+
+let pgContainer: StartedPostgreSqlContainer;
+let garageContainer: StartedTestContainer;
 
 export default async function globalSetup() {
   process.loadEnvFile(path.join(import.meta.dirname, '../..', '.env.test'));
 
-  // Optionally load S3 credentials written by the Garage setup step in CI.
-  // When present, storage S3 tests run; when absent, they are skipped.
-  // The admin URL/token from s3-config.json override .env.test values so that
-  // the permissions tests connect to the correct Garage admin port in CI.
-  const s3ConfigPath = path.join(import.meta.dirname, '../..', 's3-config.json');
-  if (fs.existsSync(s3ConfigPath)) {
-    const raw = fs.readFileSync(s3ConfigPath, 'utf-8');
-    const cfg = JSON.parse(raw) as {
-      awsEndpoint: string;
-      awsRegion: string;
-      awsAccessKeyId: string;
-      awsSecretAccessKey: string;
-      bucket: string;
-      garageAdminUrl?: string;
-      garageAdminToken?: string;
-    };
-    process.env.S3_TEST_ENDPOINT = cfg.awsEndpoint;
-    process.env.S3_TEST_REGION = cfg.awsRegion;
-    process.env.S3_TEST_ACCESS_KEY_ID = cfg.awsAccessKeyId;
-    process.env.S3_TEST_SECRET_ACCESS_KEY = cfg.awsSecretAccessKey;
-    process.env.S3_TEST_BUCKET = cfg.bucket;
-    if (cfg.garageAdminUrl) {
-      process.env.GARAGE_ADMIN_URL = cfg.garageAdminUrl;
-    }
-    if (cfg.garageAdminToken) {
-      process.env.GARAGE_ADMIN_TOKEN = cfg.garageAdminToken;
-    }
+  // When invoked via `npm run test:e2e`, the run-e2e.ts wrapper starts
+  // containers before spawning Playwright so that the webServer subprocess
+  // inherits DATABASE_* and S3_* env vars.  Nothing to do here in that case.
+  if (process.env.TESTCONTAINERS_STARTED === 'true') {
+    return;
   }
+
+  // Fallback for direct `playwright test` invocations (e.g. from the IDE).
+  // Note: in this path the webServer process is already running before
+  // containers are ready, so connection errors are possible unless
+  // reuseExistingServer is true and an existing server is already up.
+  pgContainer = await startPostgres();
+  garageContainer = await startGarage();
+
+  await fsPromises.mkdir(path.dirname(stateFile), { recursive: true });
+  await fsPromises.writeFile(
+    stateFile,
+    JSON.stringify({
+      connectionUri: pgContainer.getConnectionUri()
+    }),
+    'utf-8'
+  );
+
+  // Return a teardown function — runs in the main process after all tests,
+  // so we can call .stop() directly instead of shelling out to Docker CLI.
+  return async () => {
+    console.log('Tearing down testcontainers...');
+    await Promise.allSettled([garageContainer.stop(), pgContainer.stop()]);
+    await fsPromises.rm(stateFile, { force: true });
+    console.log('Testcontainers stopped.');
+  };
 }
diff --git a/e2e/support/run-e2e.ts b/e2e/support/run-e2e.ts
new file mode 100644
index 00000000..3998d3fa
--- /dev/null
+++ b/e2e/support/run-e2e.ts
@@ -0,0 +1,67 @@
+/**
+ * Wrapper script that starts testcontainers BEFORE launching Playwright.
+ *
+ * Playwright's startup order is:
+ *   1. webServer plugin processes are spawned
+ *   2. globalSetup runs
+ *   3. Tests run
+ *
+ * This means env vars set in globalSetup are not inherited by the webServer
+ * subprocess.  By starting the containers here — before `playwright test` is
+ * spawned — the child process inherits DATABASE_* and S3_* env vars and the
+ * SvelteKit app server can connect to the database on first query.
+ */
+
+import { spawn } from 'node:child_process';
+import fsPromises from 'node:fs/promises';
+import path from 'node:path';
+import { startPostgres } from './containers/postgres.setup.js';
+import { startGarage } from './containers/garage.setup.js';
+
+process.loadEnvFile(path.join(import.meta.dirname, '../..', '.env.test'));
+
+const stateFile = path.resolve('.playwright/postgres-state.json');
+
+async function main() {
+  console.log('Starting test containers...');
+  const [pgContainer, garageContainer] = await Promise.all([startPostgres(), startGarage()]);
+
+  await fsPromises.mkdir(path.dirname(stateFile), { recursive: true });
+  await fsPromises.writeFile(
+    stateFile,
+    JSON.stringify({ connectionUri: pgContainer.getConnectionUri() }),
+    'utf-8'
+  );
+
+  // Signal to globalSetup that containers are already running so it skips
+  // the fallback startup path.
+  process.env.TESTCONTAINERS_STARTED = 'true';
+
+  let exitCode = 0;
+  try {
+    exitCode = await runPlaywright(process.argv.slice(2));
+  } finally {
+    console.log('Tearing down testcontainers...');
+    await Promise.allSettled([garageContainer.stop(), pgContainer.stop()]);
+    await fsPromises.rm(stateFile, { force: true });
+    console.log('Testcontainers stopped.');
+  }
+
+  process.exit(exitCode);
+}
+
+function runPlaywright(args: string[]): Promise<number> {
+  return new Promise((resolve, reject) => {
+    const pw = spawn('npx', ['playwright', 'test', ...args], {
+      stdio: 'inherit',
+      env: process.env
+    });
+    pw.on('error', reject);
+    pw.on('close', (code) => resolve(code ?? 0));
+  });
+}
+
+main().catch((err) => {
+  console.error('Failed to run E2E tests:', err);
+  process.exit(1);
+});
diff --git a/e2e/trino/trino-tabs.spec.ts b/e2e/trino/trino-tabs.spec.ts
index 1dd01b26..9e890af6 100644
--- a/e2e/trino/trino-tabs.spec.ts
+++ b/e2e/trino/trino-tabs.spec.ts
@@ -112,6 +112,8 @@ test.describe('Trino editor tabs', () => {
     await setTabState(page, [{ sql: 'SELECT id, name FROM users' }, { sql: 'SELECT 2' }]);
     await page.goto('/trino');
     await waitForHydration(page);
+    // Wait for Monaco editor to be fully initialised.
+    await page.locator('[data-ready]').first().waitFor({ timeout: 15_000 });
 
     // Focus editor and run query on first tab.
     await page.locator('.monaco-editor').first().click();
diff --git a/messages/de.json b/messages/de.json
index b9928649..658bb2c5 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -146,6 +146,7 @@
   "storage_connect_timeout": "Zeitüberschreitung der Verbindung. Das Speicher-Backend hat nicht geantwortet.",
   "storage_connect_cancel": "Abbrechen",
   "storage_connect_error": "Verbindung fehlgeschlagen — Endpunkt und Zugangsdaten prüfen.",
+  "storage_connect_error_unreachable": "Verbindung zum ausgewählten Speicher nicht möglich — der Endpunkt ist möglicherweise nicht erreichbar.",
   "storage_connect_error_access_denied": "Zugriff verweigert — Zugangsdaten prüfen.",
   "storage_connect_error_not_found": "Speicher-Backend nicht gefunden — Endpunkt prüfen.",
   "storage_connect_error_server_error": "Das Speicher-Backend hat einen Fehler gemeldet — Endpunkt und Zugangsdaten prüfen.",
@@ -157,6 +158,18 @@
   "storage_connect_forget_confirm": "{endpoint} aus den gespeicherten Verbindungen löschen?",
   "storage_connect_forget_cancel": "Abbrechen",
   "storage_connect_forget_label": "Verbindung zu {endpoint} löschen",
+  "storage_connect_name": "Verbindungsname",
+  "storage_connect_name_placeholder": "z.B. Primäres S3",
+  "storage_connect_additional_buckets": "Weitere Buckets",
+  "storage_connect_additional_buckets_hint": "Bucket-Namen, die nicht von ListBuckets zurückgegeben werden, einer pro Zeile",
+  "storage_connect_duplicate_warning": "Doppelte Zugangsdaten erkannt",
+  "storage_connect_delete_label": "Verbindung {name} löschen",
+  "storage_connect_delete_confirm_title": "\"{name}\" löschen?",
+  "storage_connect_delete_confirm_message": "Die gespeicherten Zugangsdaten werden dauerhaft entfernt.",
+  "storage_connect_delete_confirm_button": "Löschen",
+  "storage_connect_delete_cancel": "Abbrechen",
+  "storage_connect_add_new": "Neue Verbindung hinzufügen",
+  "storage_connect_testing": "Verbindung wird getestet…",
   "storage_connect_copy": "Kopieren",
   "storage_connect_copied": "Kopiert",
   "storage_connect_copy_all": "Alles kopieren",
diff --git a/messages/en.json b/messages/en.json
index 118bce95..14f8970a 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -146,6 +146,7 @@
   "storage_connect_timeout": "Connection timed out. The storage backend did not respond.",
   "storage_connect_cancel": "Cancel",
   "storage_connect_error": "Could not connect — check the endpoint and credentials.",
+  "storage_connect_error_unreachable": "Could not connect to the selected storage — the endpoint may be unreachable.",
   "storage_connect_error_access_denied": "Access denied — check your credentials.",
   "storage_connect_error_not_found": "Could not find the storage backend — check the endpoint.",
   "storage_connect_error_server_error": "The storage backend returned an error — check the endpoint and credentials.",
@@ -157,6 +158,18 @@
   "storage_connect_forget_confirm": "Delete {endpoint} from saved connections?",
   "storage_connect_forget_cancel": "Cancel",
   "storage_connect_forget_label": "Delete connection to {endpoint}",
+  "storage_connect_name": "Connection name",
+  "storage_connect_name_placeholder": "e.g. Primary S3",
+  "storage_connect_additional_buckets": "Additional buckets",
+  "storage_connect_additional_buckets_hint": "Bucket names not returned by ListBuckets, one per line",
+  "storage_connect_duplicate_warning": "Duplicate credentials detected",
+  "storage_connect_delete_label": "Delete connection {name}",
+  "storage_connect_delete_confirm_title": "Delete \"{name}\"?",
+  "storage_connect_delete_confirm_message": "The saved credentials will be permanently removed.",
+  "storage_connect_delete_confirm_button": "Delete",
+  "storage_connect_delete_cancel": "Cancel",
+  "storage_connect_add_new": "Add new connection",
+  "storage_connect_testing": "Testing connection…",
   "storage_connect_copy": "Copy",
   "storage_connect_copied": "Copied",
   "storage_connect_copy_all": "Copy all",
diff --git a/package-lock.json b/package-lock.json
index 9c2037c9..07412493 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,12 +11,13 @@
       "dependencies": {
         "@aws-sdk/client-s3": "^3.1041.0",
         "@aws-sdk/lib-storage": "^3.1045.0",
+        "@better-auth/drizzle-adapter": "^1.6.20",
         "@internationalized/date": "^3.11.0",
         "@smithy/node-http-handler": "4.9.1",
         "adm-zip": "^0.5.17",
         "antlr4-c3": "^3.4.4",
         "antlr4ng": "^3.0.16",
-        "better-auth": "^1.5.4",
+        "better-auth": "^1.6.20",
         "drizzle-orm": "^0.45.2",
         "hyparquet": "^1.25.8",
         "hyparquet-compressors": "^1.1.1",
@@ -44,6 +45,7 @@
         "@sveltejs/kit": "^2.53.0",
         "@sveltejs/vite-plugin-svelte": "^6.2.4",
         "@tailwindcss/vite": "^4.2.1",
+        "@testcontainers/postgresql": "^12.0.1",
         "@types/adm-zip": "^0.5.8",
         "@types/node": "^24",
         "@types/papaparse": "^5.5.2",
@@ -69,6 +71,7 @@
         "svelte-check": "^4.4.3",
         "sveltekit-superforms": "^2.30.0",
         "tailwindcss": "^4.2.1",
+        "testcontainers": "^12.0.1",
         "typescript": "^5.9.3",
         "typescript-eslint": "^8.56.1",
         "unplugin-icons": "^23.0.1",
@@ -80,8 +83,6 @@
     },
     "node_modules/@antfu/install-pkg": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@antfu/install-pkg/-/install-pkg-1.1.0.tgz",
-      "integrity": "sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -94,8 +95,6 @@
     },
     "node_modules/@ark/schema": {
       "version": "0.56.0",
-      "resolved": "https://registry.npmjs.org/@ark/schema/-/schema-0.56.0.tgz",
-      "integrity": "sha512-ECg3hox/6Z/nLajxXqNhgPtNdHWC9zNsDyskwO28WinoFEnWow4IsERNz9AnXRhTZJnYIlAJ4uGn3nlLk65vZA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -105,16 +104,12 @@
     },
     "node_modules/@ark/util": {
       "version": "0.56.0",
-      "resolved": "https://registry.npmjs.org/@ark/util/-/util-0.56.0.tgz",
-      "integrity": "sha512-BghfRC8b9pNs3vBoDJhcta0/c1J1rsoS1+HgVUreMFPdhz/CRAKReAu57YEllNaSy98rWAdY1gE+gFup7OXpgA==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/@aws-crypto/crc32": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@aws-crypto/crc32/-/crc32-5.2.0.tgz",
-      "integrity": "sha512-nLbCWqQNgUiwwtFsen1AdzAtvuLRsQS8rYgMuxCrdKf9kOssamGLuPwyTY9wyYblNr9+1XM8v6zoDTPPSIeANg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/util": "^5.2.0",
@@ -127,8 +122,6 @@
     },
     "node_modules/@aws-crypto/crc32c": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@aws-crypto/crc32c/-/crc32c-5.2.0.tgz",
-      "integrity": "sha512-+iWb8qaHLYKrNvGRbiYRHSdKRWhto5XlZUEBwDjYNf+ly5SVYG6zEoYIdxvf5R3zyeP16w4PLBn3rH1xc74Rag==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/util": "^5.2.0",
@@ -138,8 +131,6 @@
     },
     "node_modules/@aws-crypto/sha1-browser": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@aws-crypto/sha1-browser/-/sha1-browser-5.2.0.tgz",
-      "integrity": "sha512-OH6lveCFfcDjX4dbAvCFSYUjJZjDr/3XJ3xHtjn3Oj5b9RjojQo8npoLeA/bNwkOkrSQ0wgrHzXk4tDRxGKJeg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/supports-web-crypto": "^5.2.0",
@@ -152,8 +143,6 @@
     },
     "node_modules/@aws-crypto/sha256-browser": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-browser/-/sha256-browser-5.2.0.tgz",
-      "integrity": "sha512-AXfN/lGotSQwu6HNcEsIASo7kWXZ5HYWvfOmSNKDsEqC4OashTp8alTmaz+F7TC2L083SFv5RdB+qU3Vs1kZqw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-js": "^5.2.0",
@@ -167,8 +156,6 @@
     },
     "node_modules/@aws-crypto/sha256-js": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@aws-crypto/sha256-js/-/sha256-js-5.2.0.tgz",
-      "integrity": "sha512-FFQQyu7edu4ufvIZ+OadFpHHOt+eSTBaYaki44c+akjg7qZg9oOQeLlk77F6tSYqjDAFClrHJk9tMf0HdVyOvA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/util": "^5.2.0",
@@ -181,8 +168,6 @@
     },
     "node_modules/@aws-crypto/supports-web-crypto": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@aws-crypto/supports-web-crypto/-/supports-web-crypto-5.2.0.tgz",
-      "integrity": "sha512-iAvUotm021kM33eCdNfwIN//F77/IADDSs58i+MDaOqFrVjZo9bAal0NK7HurRuWLLpF1iLX7gbWrjHjeo+YFg==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -190,8 +175,6 @@
     },
     "node_modules/@aws-crypto/util": {
       "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/@aws-crypto/util/-/util-5.2.0.tgz",
-      "integrity": "sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-sdk/types": "^3.222.0",
@@ -199,63 +182,55 @@
         "tslib": "^2.6.2"
       }
     },
-    "node_modules/@aws-sdk/checksums": {
-      "version": "3.1000.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/checksums/-/checksums-3.1000.8.tgz",
-      "integrity": "sha512-v0U9S7gBIme3OTgt1LdbAF4RpvavCc+4GK1+1xqAcqtbrHsEhjQo6R45LKcjhs/+WrRJij1Y0Gztw7QPAIeUfA==",
+    "node_modules/@aws-sdk/client-s3": {
+      "version": "3.1053.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-crypto/crc32": "5.2.0",
-        "@aws-crypto/crc32c": "5.2.0",
-        "@aws-crypto/util": "5.2.0",
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-crypto/sha1-browser": "5.2.0",
+        "@aws-crypto/sha256-browser": "5.2.0",
+        "@aws-crypto/sha256-js": "5.2.0",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/credential-provider-node": "^3.972.44",
+        "@aws-sdk/middleware-bucket-endpoint": "^3.972.15",
+        "@aws-sdk/middleware-expect-continue": "^3.972.13",
+        "@aws-sdk/middleware-flexible-checksums": "^3.974.21",
+        "@aws-sdk/middleware-location-constraint": "^3.972.11",
+        "@aws-sdk/middleware-sdk-s3": "^3.972.42",
+        "@aws-sdk/middleware-ssec": "^3.972.11",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/fetch-http-handler": "^5.4.3",
+        "@smithy/node-http-handler": "^4.7.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/client-s3": {
-      "version": "3.1075.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/client-s3/-/client-s3-3.1075.0.tgz",
-      "integrity": "sha512-h1A6nIl1YX6Y45enGsTK7ef3ZrOnBiQJ1qF5R2K/nMWfsu6A9mc2Y5T66nxerABzyjjyyvign3MrzafnFoQKmA==",
+    "node_modules/@aws-sdk/core": {
+      "version": "3.974.13",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-crypto/sha1-browser": "5.2.0",
-        "@aws-crypto/sha256-browser": "5.2.0",
-        "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/credential-provider-node": "^3.972.58",
-        "@aws-sdk/middleware-flexible-checksums": "^3.974.33",
-        "@aws-sdk/middleware-sdk-s3": "^3.972.54",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.35",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/fetch-http-handler": "^5.4.6",
-        "@smithy/node-http-handler": "^4.7.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/types": "^3.973.9",
+        "@aws-sdk/xml-builder": "^3.972.25",
+        "@aws/lambda-invoke-store": "^0.2.2",
+        "@smithy/core": "^3.24.3",
+        "@smithy/signature-v4": "^5.4.2",
+        "@smithy/types": "^4.14.2",
+        "bowser": "^2.11.0",
         "tslib": "^2.6.2"
       },
       "engines": {
         "node": ">=20.0.0"
       }
     },
-    "node_modules/@aws-sdk/core": {
-      "version": "3.974.23",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/core/-/core-3.974.23.tgz",
-      "integrity": "sha512-MiWR/uWjxjFXGzrE0Ghc5lWxUxzHsUWFhV+OX7M4cR9SrmrnZs6TXavnCWnzzdwJeFri34xQo81rvGNzK3c4BQ==",
+    "node_modules/@aws-sdk/crc64-nvme": {
+      "version": "3.972.9",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.13",
-        "@aws-sdk/xml-builder": "^3.972.31",
-        "@aws/lambda-invoke-store": "^0.2.2",
-        "@smithy/core": "^3.24.6",
-        "@smithy/signature-v4": "^5.4.6",
-        "@smithy/types": "^4.14.3",
-        "bowser": "^2.11.0",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -263,15 +238,13 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-env": {
-      "version": "3.972.49",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-env/-/credential-provider-env-3.972.49.tgz",
-      "integrity": "sha512-liB3yQNHCM9k/gu/w36XHMKPluT7HTlnGUhRbBGSISDQkcr/Sy1zsZabiuvQj8WG5yW573u9RehrBvvnIQ9OEQ==",
+      "version": "3.972.39",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -279,17 +252,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-http": {
-      "version": "3.972.51",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-http/-/credential-provider-http-3.972.51.tgz",
-      "integrity": "sha512-XET0H2oofciJ5lMRWNIvRjAP7Q3wv2XT+JtJJEdhPWUMwe3TvQ9qcxonpu7vXmNngncvFpi4E2It+Tamas/naA==",
+      "version": "3.972.41",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/fetch-http-handler": "^5.4.6",
-        "@smithy/node-http-handler": "^4.7.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/fetch-http-handler": "^5.4.3",
+        "@smithy/node-http-handler": "^4.7.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -297,23 +268,21 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-ini": {
-      "version": "3.972.56",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.972.56.tgz",
-      "integrity": "sha512-IAmc61hbgQiHht9U3x0tnRwz0lzdwOwD/i9voRgdJrKamF+JtmrBOsW9GwB7mfFonNWOWL4qARWYrF8veEMe3w==",
+      "version": "3.972.43",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/credential-provider-env": "^3.972.49",
-        "@aws-sdk/credential-provider-http": "^3.972.51",
-        "@aws-sdk/credential-provider-login": "^3.972.55",
-        "@aws-sdk/credential-provider-process": "^3.972.49",
-        "@aws-sdk/credential-provider-sso": "^3.972.55",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.55",
-        "@aws-sdk/nested-clients": "^3.997.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/credential-provider-imds": "^4.3.7",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/credential-provider-env": "^3.972.39",
+        "@aws-sdk/credential-provider-http": "^3.972.41",
+        "@aws-sdk/credential-provider-login": "^3.972.43",
+        "@aws-sdk/credential-provider-process": "^3.972.39",
+        "@aws-sdk/credential-provider-sso": "^3.972.43",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.43",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/credential-provider-imds": "^4.3.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -321,16 +290,14 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-login": {
-      "version": "3.972.55",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-login/-/credential-provider-login-3.972.55.tgz",
-      "integrity": "sha512-hBBkANo3cDn+h2qxxzER4a+J8JCO9o9Z/YYmU7iky6AcaarX5RRdRcHNC6SLdwY0vAXQygn6soUbDqPn3GghaA==",
+      "version": "3.972.43",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/nested-clients": "^3.997.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -338,21 +305,19 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-node": {
-      "version": "3.972.58",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-node/-/credential-provider-node-3.972.58.tgz",
-      "integrity": "sha512-OyCLVmSI7pZO8hxwNVX6pXhTVlJqRBTp+ijdEfJSUj0RyjHnF602OfAarOzGq6wkGodeFkYBt8MmJ6A6ycRgWw==",
+      "version": "3.972.44",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/credential-provider-env": "^3.972.49",
-        "@aws-sdk/credential-provider-http": "^3.972.51",
-        "@aws-sdk/credential-provider-ini": "^3.972.56",
-        "@aws-sdk/credential-provider-process": "^3.972.49",
-        "@aws-sdk/credential-provider-sso": "^3.972.55",
-        "@aws-sdk/credential-provider-web-identity": "^3.972.55",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/credential-provider-imds": "^4.3.7",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/credential-provider-env": "^3.972.39",
+        "@aws-sdk/credential-provider-http": "^3.972.41",
+        "@aws-sdk/credential-provider-ini": "^3.972.43",
+        "@aws-sdk/credential-provider-process": "^3.972.39",
+        "@aws-sdk/credential-provider-sso": "^3.972.43",
+        "@aws-sdk/credential-provider-web-identity": "^3.972.43",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/credential-provider-imds": "^4.3.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -360,15 +325,13 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-process": {
-      "version": "3.972.49",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-process/-/credential-provider-process-3.972.49.tgz",
-      "integrity": "sha512-C8h36lBuC/RnBSsjlO+dn6xZm3KbAl5vpJaVPAfQnMmz2/OISmKOc8XZcqMQgO2ADwBYNRMM6Kf3vz9G/TulMQ==",
+      "version": "3.972.39",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -376,17 +339,15 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-sso": {
-      "version": "3.972.55",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.972.55.tgz",
-      "integrity": "sha512-1FkOz74Ea5QGS9jtIoXp55T/IkSS3spv+nLTT07fRY/+T5xmEOqaYBVIaEmX4zTNvbV6g2lrtlaVKWEoNyJt3w==",
+      "version": "3.972.43",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/nested-clients": "^3.997.23",
-        "@aws-sdk/token-providers": "3.1074.0",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/token-providers": "3.1052.0",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -394,16 +355,14 @@
       }
     },
     "node_modules/@aws-sdk/credential-provider-web-identity": {
-      "version": "3.972.55",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.972.55.tgz",
-      "integrity": "sha512-g2BoECD1q01kTPByi56+VLVvdWDzMkKIcr77qixpqH0okw2t0U5CoPv+6S8v/D1Y2Wa6QKKtn6XAtDzP+Kfpvg==",
+      "version": "3.972.43",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/nested-clients": "^3.997.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -411,13 +370,11 @@
       }
     },
     "node_modules/@aws-sdk/lib-storage": {
-      "version": "3.1075.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/lib-storage/-/lib-storage-3.1075.0.tgz",
-      "integrity": "sha512-Npdac3/Fv994iCdFFeqloPel+95Zv6dRiRUpfey6W/CqpB/QdnYP60U4YBhBgJj6V5020Pm3ad0HV4WzCE5hHQ==",
+      "version": "3.1053.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "buffer": "5.6.0",
         "events": "3.3.0",
         "stream-browserify": "3.0.0",
@@ -427,16 +384,60 @@
         "node": ">=20.0.0"
       },
       "peerDependencies": {
-        "@aws-sdk/client-s3": "^3.1075.0"
+        "@aws-sdk/client-s3": "^3.1053.0"
+      }
+    },
+    "node_modules/@aws-sdk/middleware-bucket-endpoint": {
+      "version": "3.972.15",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@aws-sdk/middleware-expect-continue": {
+      "version": "3.972.13",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
       }
     },
     "node_modules/@aws-sdk/middleware-flexible-checksums": {
-      "version": "3.974.33",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-flexible-checksums/-/middleware-flexible-checksums-3.974.33.tgz",
-      "integrity": "sha512-qMgQSPemQq2/eW/e/0+SpY4kYR5L7dUgBiVdEc5bd+ztHNv07ZMYiI+sTiir3TgKndFfglSw/VFi7oZJ6bZ63g==",
+      "version": "3.974.21",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-crypto/crc32": "5.2.0",
+        "@aws-crypto/crc32c": "5.2.0",
+        "@aws-crypto/util": "5.2.0",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/crc64-nvme": "^3.972.9",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@aws-sdk/middleware-location-constraint": {
+      "version": "3.972.11",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/checksums": "^3.1000.8",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -444,16 +445,27 @@
       }
     },
     "node_modules/@aws-sdk/middleware-sdk-s3": {
-      "version": "3.972.54",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/middleware-sdk-s3/-/middleware-sdk-s3-3.972.54.tgz",
-      "integrity": "sha512-GDfDQ0gwLFRKN9gWIKcmVrHJ3e7XagnY7N1LLzMVNgnOnuY7f/ALgmy3CuBjosWD95T/Z6e+gs1IeWmLPkyLKQ==",
+      "version": "3.972.42",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/signature-v4": "^5.4.2",
+        "@smithy/types": "^4.14.2",
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=20.0.0"
+      }
+    },
+    "node_modules/@aws-sdk/middleware-ssec": {
+      "version": "3.972.11",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.35",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -461,20 +473,18 @@
       }
     },
     "node_modules/@aws-sdk/nested-clients": {
-      "version": "3.997.23",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/nested-clients/-/nested-clients-3.997.23.tgz",
-      "integrity": "sha512-gO93ZPsI2bxeFZD42f1/qjDw6FAZkNZcKRO94LIiT03fzOmcJ9e/tunxjVjA1Rl69ClmVJzz8H3G9CdKef10PA==",
+      "version": "3.997.11",
       "license": "Apache-2.0",
       "dependencies": {
         "@aws-crypto/sha256-browser": "5.2.0",
         "@aws-crypto/sha256-js": "5.2.0",
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/signature-v4-multi-region": "^3.996.35",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/fetch-http-handler": "^5.4.6",
-        "@smithy/node-http-handler": "^4.7.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/signature-v4-multi-region": "^3.996.28",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/fetch-http-handler": "^5.4.3",
+        "@smithy/node-http-handler": "^4.7.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -482,14 +492,13 @@
       }
     },
     "node_modules/@aws-sdk/signature-v4-multi-region": {
-      "version": "3.996.35",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/signature-v4-multi-region/-/signature-v4-multi-region-3.996.35.tgz",
-      "integrity": "sha512-6L/VWs+Wch2stHemCGTmUNqKLMzURxQDK5boNG3Jn3kAOp71meDUuS5sbObpEvFxHDq0uWeSLFDNSYsjNt+Dlg==",
+      "version": "3.996.28",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/signature-v4": "^5.4.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/signature-v4": "^5.4.2",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -497,16 +506,14 @@
       }
     },
     "node_modules/@aws-sdk/token-providers": {
-      "version": "3.1074.0",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/token-providers/-/token-providers-3.1074.0.tgz",
-      "integrity": "sha512-pv80IzgGW4RnXWtft692chZOM9i6PhebVsLCcnaM4dBEPZva2fE6FXAHs76G7Rc7s3yGyX/68G0nZMrUy+Vmpg==",
+      "version": "3.1052.0",
       "license": "Apache-2.0",
       "dependencies": {
-        "@aws-sdk/core": "^3.974.23",
-        "@aws-sdk/nested-clients": "^3.997.23",
-        "@aws-sdk/types": "^3.973.13",
-        "@smithy/core": "^3.24.6",
-        "@smithy/types": "^4.14.3",
+        "@aws-sdk/core": "^3.974.13",
+        "@aws-sdk/nested-clients": "^3.997.11",
+        "@aws-sdk/types": "^3.973.9",
+        "@smithy/core": "^3.24.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -514,12 +521,10 @@
       }
     },
     "node_modules/@aws-sdk/types": {
-      "version": "3.973.13",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/types/-/types-3.973.13.tgz",
-      "integrity": "sha512-pEHZqRkAlHfnfAU9tK+WpKv/gBNjGJrHMgA3A0iYRGyswBS2t0pfez+lWlwktb3Bqa0ovh7w/QJTFwp3fDxLNg==",
+      "version": "3.973.9",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.3",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -527,9 +532,7 @@
       }
     },
     "node_modules/@aws-sdk/util-locate-window": {
-      "version": "3.965.8",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/util-locate-window/-/util-locate-window-3.965.8.tgz",
-      "integrity": "sha512-uUbMs1cBZPafD0ohUj6EwNf0fPZ534NvBxHox4hjX+0Rxq5paSYUem7+hi833pYrzrcnBATKIYpR02MDXT5M9g==",
+      "version": "3.965.5",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -539,12 +542,12 @@
       }
     },
     "node_modules/@aws-sdk/xml-builder": {
-      "version": "3.972.31",
-      "resolved": "https://registry.npmjs.org/@aws-sdk/xml-builder/-/xml-builder-3.972.31.tgz",
-      "integrity": "sha512-SzE4Pgyl+hDF+BuyuzxUSpwnuUu9lJuO1YGgteG89/4Qv0+2IQiVQqdbPV32IozLvXWQChPQcdkk/sKvb1QHiQ==",
+      "version": "3.972.25",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.14.3",
+        "@nodable/entities": "2.1.0",
+        "@smithy/types": "^4.14.2",
+        "fast-xml-parser": "5.7.3",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -553,8 +556,6 @@
     },
     "node_modules/@aws/lambda-invoke-store": {
       "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/@aws/lambda-invoke-store/-/lambda-invoke-store-0.2.4.tgz",
-      "integrity": "sha512-iY8yvjE0y651BixKNPgmv1WrQc+GZ142sb0z4gYnChDDY2YqI4P/jsSopBWrKfAt7LOJAkOXt7rC/hms+WclQQ==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=18.0.0"
@@ -562,9 +563,7 @@
     },
     "node_modules/@babel/helper-string-parser": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
-      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -572,9 +571,7 @@
     },
     "node_modules/@babel/helper-validator-identifier": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
-      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
@@ -582,9 +579,7 @@
     },
     "node_modules/@babel/parser": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
-      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/types": "^7.29.7"
@@ -597,9 +592,7 @@
       }
     },
     "node_modules/@babel/runtime": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.29.7.tgz",
-      "integrity": "sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==",
+      "version": "7.28.6",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -609,9 +602,7 @@
     },
     "node_modules/@babel/types": {
       "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
-      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/helper-string-parser": "^7.29.7",
@@ -621,11 +612,14 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@balena/dockerignore": {
+      "version": "1.0.2",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/@bcoe/v8-coverage": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-1.0.2.tgz",
-      "integrity": "sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -764,17 +758,40 @@
       "integrity": "sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==",
       "license": "MIT"
     },
-    "node_modules/@blazediff/core": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@blazediff/core/-/core-1.9.1.tgz",
-      "integrity": "sha512-ehg3jIkYKulZh+8om/O25vkvSsXXwC+skXmyA87FFx6A/45eqOkZsBltMw/TVteb0mloiGT8oGRTcjRAz66zaA==",
-      "devOptional": true,
-      "license": "MIT"
+    "node_modules/@cyclonedx/cyclonedx-npm": {
+      "version": "4.2.1",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
+        }
+      ],
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@cyclonedx/cyclonedx-library": "^10.0.0",
+        "commander": "^14.0.0",
+        "normalize-package-data": "^7.0.0 || ^8.0.0",
+        "packageurl-js": "^2.0.1",
+        "spdx-expression-parse": "^3.0.1 || ^4.0.0",
+        "xmlbuilder2": "^3.0.2 || ^4.0.3"
+      },
+      "bin": {
+        "cyclonedx-npm": "bin/cyclonedx-npm-cli.js"
+      },
+      "engines": {
+        "node": ">=20.18.0",
+        "npm": ">=9"
+      },
+      "optionalDependencies": {
+        "ajv": "^8.12.0",
+        "ajv-formats": "^3.0.1",
+        "ajv-formats-draft2019": "^1.6.1",
+        "libxmljs2": "^0.35||^0.37"
+      }
     },
-    "node_modules/@cyclonedx/cyclonedx-library": {
-      "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-library/-/cyclonedx-library-10.1.0.tgz",
-      "integrity": "sha512-4yq0KTQIA32UHJwFMDeY5xj2asp3Mk5lzx4JRVXLOb0YE8w1KeR61c1m/gJ4sjMXpiiEDfaITVQu8BLUuy7t3A==",
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/@cyclonedx/cyclonedx-library": {
+      "version": "10.0.0",
       "dev": true,
       "funding": [
         {
@@ -819,52 +836,43 @@
         }
       }
     },
-    "node_modules/@cyclonedx/cyclonedx-npm": {
-      "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/@cyclonedx/cyclonedx-npm/-/cyclonedx-npm-4.2.1.tgz",
-      "integrity": "sha512-SOA/96sf0wsgUYCRtFkLFm6WoFhG+q1BxdC84hPSn9J3xWlH1e7OnTPJT+WNUzTqzX1nSm5JhjRX4krozu2X+g==",
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/ajv": {
+      "version": "8.20.0",
       "dev": true,
-      "funding": [
-        {
-          "type": "individual",
-          "url": "https://owasp.org/donate/?reponame=www-project-cyclonedx&title=OWASP+CycloneDX"
-        }
-      ],
-      "license": "Apache-2.0",
+      "license": "MIT",
+      "optional": true,
       "dependencies": {
-        "@cyclonedx/cyclonedx-library": "^10.0.0",
-        "commander": "^14.0.0",
-        "normalize-package-data": "^7.0.0 || ^8.0.0",
-        "packageurl-js": "^2.0.1",
-        "spdx-expression-parse": "^3.0.1 || ^4.0.0",
-        "xmlbuilder2": "^3.0.2 || ^4.0.3"
-      },
-      "bin": {
-        "cyclonedx-npm": "bin/cyclonedx-npm-cli.js"
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
       },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/commander": {
+      "version": "14.0.3",
+      "dev": true,
+      "license": "MIT",
       "engines": {
-        "node": ">=20.18.0",
-        "npm": ">=9"
-      },
-      "optionalDependencies": {
-        "ajv": "^8.12.0",
-        "ajv-formats": "^3.0.1",
-        "ajv-formats-draft2019": "^1.6.1",
-        "libxmljs2": "^0.35||^0.37"
+        "node": ">=20"
       }
     },
+    "node_modules/@cyclonedx/cyclonedx-npm/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/@drizzle-team/brocli": {
       "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@drizzle-team/brocli/-/brocli-0.10.2.tgz",
-      "integrity": "sha512-z33Il7l5dKjUgGULTqBsQBQwckHh5AbIuxhdsIxDDiZAzBOrZO6q9ogcWC65kU382AfynTfgNumVcNIjuIua6w==",
       "devOptional": true,
       "license": "Apache-2.0"
     },
     "node_modules/@esbuild-kit/core-utils": {
       "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/@esbuild-kit/core-utils/-/core-utils-3.3.2.tgz",
-      "integrity": "sha512-sPRAnw9CdSsRmEtnsl2WXWdyquogVpB3yZ3dgwJfe8zrOzTsV7cJvmwrKVa+0ma5BoiGJ+BoqkMvawbayKUsqQ==",
-      "deprecated": "Merged into tsx: https://tsx.is",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -1114,8 +1122,6 @@
     },
     "node_modules/@esbuild-kit/core-utils/node_modules/@esbuild/linux-x64": {
       "version": "0.18.20",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.18.20.tgz",
-      "integrity": "sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==",
       "cpu": [
         "x64"
       ],
@@ -1226,8 +1232,6 @@
     },
     "node_modules/@esbuild-kit/core-utils/node_modules/esbuild": {
       "version": "0.18.20",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.18.20.tgz",
-      "integrity": "sha512-ceqxoedUrcayh7Y7ZX6NdbbDzGROiyVBgC4PriJThBKSVPWnnFHZAkfI1lJT8QFkOwH4qOS2SJkS4wvpGl8BpA==",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -1264,9 +1268,6 @@
     },
     "node_modules/@esbuild-kit/esm-loader": {
       "version": "2.6.5",
-      "resolved": "https://registry.npmjs.org/@esbuild-kit/esm-loader/-/esm-loader-2.6.5.tgz",
-      "integrity": "sha512-FxEMIkJKnodyA1OaCUoEvbYRkoZlLZ4d/eXFu9Fh8CbBBgP5EmZxrfTRyN0qpXZ4vOvqnE5YdRdcrmUUXuU+dA==",
-      "deprecated": "Merged into tsx: https://tsx.is",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -1532,8 +1533,6 @@
     },
     "node_modules/@esbuild/linux-x64": {
       "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.12.tgz",
-      "integrity": "sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==",
       "cpu": [
         "x64"
       ],
@@ -1692,8 +1691,6 @@
     },
     "node_modules/@eslint-community/eslint-utils": {
       "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
-      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1711,8 +1708,6 @@
     },
     "node_modules/@eslint-community/eslint-utils/node_modules/eslint-visitor-keys": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
-      "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -1724,8 +1719,6 @@
     },
     "node_modules/@eslint-community/regexpp": {
       "version": "4.12.2",
-      "resolved": "https://registry.npmjs.org/@eslint-community/regexpp/-/regexpp-4.12.2.tgz",
-      "integrity": "sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1733,13 +1726,11 @@
       }
     },
     "node_modules/@eslint/compat": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/@eslint/compat/-/compat-2.1.0.tgz",
-      "integrity": "sha512-LgaSCymEpw7tF53xvDw9SNsraPb1IBHxpdABIOM0hW8UAlP8znrjYtuxfR58FSJ3L9BhwD+FaPRFQpZq84Nh6g==",
+      "version": "2.0.2",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@eslint/core": "^1.2.1"
+        "@eslint/core": "^1.1.0"
       },
       "engines": {
         "node": "^20.19.0 || ^22.13.0 || >=24"
@@ -1754,15 +1745,13 @@
       }
     },
     "node_modules/@eslint/config-array": {
-      "version": "0.21.2",
-      "resolved": "https://registry.npmjs.org/@eslint/config-array/-/config-array-0.21.2.tgz",
-      "integrity": "sha512-nJl2KGTlrf9GjLimgIru+V/mzgSK0ABCDQRvxw5BjURL7WfH5uoWmizbH7QB6MmnMBd8cIC9uceWnezL1VZWWw==",
+      "version": "0.21.1",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@eslint/object-schema": "^2.1.7",
         "debug": "^4.3.1",
-        "minimatch": "^3.1.5"
+        "minimatch": "^3.1.2"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -1770,8 +1759,6 @@
     },
     "node_modules/@eslint/config-helpers": {
       "version": "0.4.2",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.4.2.tgz",
-      "integrity": "sha512-gBrxN88gOIf3R7ja5K9slwNayVcZgK6SOUORm2uBzTeIEfeVaIhOpCtTox3P6R7o2jLFwLFTLnC7kU/RGcYEgw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1783,8 +1770,6 @@
     },
     "node_modules/@eslint/config-helpers/node_modules/@eslint/core": {
       "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1796,8 +1781,6 @@
     },
     "node_modules/@eslint/core": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-1.2.1.tgz",
-      "integrity": "sha512-MwcE1P+AZ4C6DWlpin/OmOA54mmIZ/+xZuJiQd4SyB29oAJjN30UW9wkKNptW2ctp4cEsvhlLY/CsQ1uoHDloQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1808,34 +1791,30 @@
       }
     },
     "node_modules/@eslint/css-tree": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/@eslint/css-tree/-/css-tree-4.0.4.tgz",
-      "integrity": "sha512-nxMparyhqVWQvadx9x8dIfubfIPOE+X2b2waua8fzdnM9vdp9rgVtwEZlG0TmCwEUz/d/f40fzvO/eqBwdxz0A==",
+      "version": "3.6.9",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "mdn-data": "2.28.1",
-        "source-map-js": "^1.2.1"
+        "mdn-data": "2.23.0",
+        "source-map-js": "^1.0.1"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": "^10 || ^12.20.0 || ^14.13.0 || >=15.0.0"
       }
     },
     "node_modules/@eslint/eslintrc": {
-      "version": "3.3.5",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz",
-      "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==",
+      "version": "3.3.3",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "ajv": "^6.14.0",
+        "ajv": "^6.12.4",
         "debug": "^4.3.2",
         "espree": "^10.0.1",
         "globals": "^14.0.0",
         "ignore": "^5.2.0",
         "import-fresh": "^3.2.1",
         "js-yaml": "^4.1.1",
-        "minimatch": "^3.1.5",
+        "minimatch": "^3.1.2",
         "strip-json-comments": "^3.1.1"
       },
       "engines": {
@@ -1845,27 +1824,8 @@
         "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/@eslint/eslintrc/node_modules/ajv": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
     "node_modules/@eslint/eslintrc/node_modules/globals": {
       "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-14.0.0.tgz",
-      "integrity": "sha512-oahGvuMGQlPw/ivIYBjVSrWAfWLBeku5tpPE2fOPLi+WHffIWbuh2tCjhyQhTBPMf5E9jDEH4FOmTYgYwbKwtQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1875,17 +1835,8 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/@eslint/eslintrc/node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/@eslint/js": {
-      "version": "9.39.4",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-9.39.4.tgz",
-      "integrity": "sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==",
+      "version": "9.39.2",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1897,8 +1848,6 @@
     },
     "node_modules/@eslint/object-schema": {
       "version": "2.1.7",
-      "resolved": "https://registry.npmjs.org/@eslint/object-schema/-/object-schema-2.1.7.tgz",
-      "integrity": "sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -1907,8 +1856,6 @@
     },
     "node_modules/@eslint/plugin-kit": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.4.1.tgz",
-      "integrity": "sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1921,8 +1868,6 @@
     },
     "node_modules/@eslint/plugin-kit/node_modules/@eslint/core": {
       "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -1934,16 +1879,12 @@
     },
     "node_modules/@exodus/schemasafe": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/@exodus/schemasafe/-/schemasafe-1.3.0.tgz",
-      "integrity": "sha512-5Aap/GaRupgNx/feGBwLLTVv8OQFfv3pq2lPRzPg9R+IOBnDgghTGW7l7EuVXOvg5cc/xSAlRW8rBrjIC3Nvqw==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/@faker-js/faker": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/@faker-js/faker/-/faker-10.5.0.tgz",
-      "integrity": "sha512-bsxD8WLS5lIj7aaoCx1YJkktqYj5vlBUE6HWzu2Q51ksrGJ0H737ECCKlFU7Yf8Br45z9t99frBp/J7kzbMPAg==",
+      "version": "10.4.0",
       "dev": true,
       "funding": [
         {
@@ -1957,18 +1898,60 @@
         "npm": ">=10"
       }
     },
+    "node_modules/@grpc/grpc-js": {
+      "version": "1.14.4",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@grpc/proto-loader": "^0.8.0",
+        "@js-sdsl/ordered-map": "^4.4.2"
+      },
+      "engines": {
+        "node": ">=12.10.0"
+      }
+    },
+    "node_modules/@grpc/grpc-js/node_modules/@grpc/proto-loader": {
+      "version": "0.8.1",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "lodash.camelcase": "^4.3.0",
+        "long": "^5.0.0",
+        "protobufjs": "^7.5.5",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/@grpc/proto-loader": {
+      "version": "0.7.15",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "lodash.camelcase": "^4.3.0",
+        "long": "^5.0.0",
+        "protobufjs": "^7.2.5",
+        "yargs": "^17.7.2"
+      },
+      "bin": {
+        "proto-loader-gen-types": "build/bin/proto-loader-gen-types.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/@hapi/hoek": {
       "version": "9.3.0",
-      "resolved": "https://registry.npmjs.org/@hapi/hoek/-/hoek-9.3.0.tgz",
-      "integrity": "sha512-/c6rf4UJlmHlC9b5BaNvzAcFv7HZ2QHaV0D4/HNlBdvFnvQq8RI4kYdhyPCl7Xj+oWvTWQ8ujhqS53LIgAe6KQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true
     },
     "node_modules/@hapi/topo": {
       "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/@hapi/topo/-/topo-5.1.0.tgz",
-      "integrity": "sha512-foQZKJig7Ob0BMAYBfcJk8d77QtOe7Wo4ox7ff1lQYoNNAb6jwcY1ncdoy2e9wQZzvNy7ODZCYJkK8kzmcAnAg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true,
@@ -1977,47 +1960,27 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.2",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
-      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
+      "version": "0.19.1",
       "dev": true,
       "license": "Apache-2.0",
-      "dependencies": {
-        "@humanfs/types": "^0.15.0"
-      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.8",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
-      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
+      "version": "0.16.7",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.2",
-        "@humanfs/types": "^0.15.0",
+        "@humanfs/core": "^0.19.1",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
-    "node_modules/@humanfs/types": {
-      "version": "0.15.0",
-      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
-      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=18.18.0"
-      }
-    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
-      "integrity": "sha512-bxveV4V8v5Yb4ncFTT3rPSgZBOpCkjfK0y4oVVVJwIuDVBRMDXrPyXRL988i5ap9m9bnyEEjWfm5WkBmtffLfA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -2030,8 +1993,6 @@
     },
     "node_modules/@humanwhocodes/retry": {
       "version": "0.4.3",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/retry/-/retry-0.4.3.tgz",
-      "integrity": "sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -2053,9 +2014,9 @@
       }
     },
     "node_modules/@iconify-json/material-icon-theme": {
-      "version": "1.2.68",
-      "resolved": "https://registry.npmjs.org/@iconify-json/material-icon-theme/-/material-icon-theme-1.2.68.tgz",
-      "integrity": "sha512-08ZX1L3Lt1lKvcflvp57ZTpXwpMBtr1KI2CxTRQ1ryPkiDI3WacoSXVfE7/nO7CeV9RewfegjfgsPbidF1BxLA==",
+      "version": "1.2.67",
+      "resolved": "https://registry.npmjs.org/@iconify-json/material-icon-theme/-/material-icon-theme-1.2.67.tgz",
+      "integrity": "sha512-SouqLxahwVOuIVqED8Spl1wSy3DM7sYwNOPxFW7Eh4hVNqR4L4zTkEXFP4V6bQegkhl9kFWbNGlYKDFjXh92iQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2063,9 +2024,7 @@
       }
     },
     "node_modules/@iconify-json/material-symbols": {
-      "version": "1.2.79",
-      "resolved": "https://registry.npmjs.org/@iconify-json/material-symbols/-/material-symbols-1.2.79.tgz",
-      "integrity": "sha512-WRLBReaTNJAeHxsFlD7pJ/K6il2vOZ4va3XTAUdTDkn4rWzRYu6dnI1bAW/4pANlTCt5eemtP65gBBNxt8Xd7Q==",
+      "version": "1.2.74",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2073,9 +2032,9 @@
       }
     },
     "node_modules/@iconify-json/vscode-icons": {
-      "version": "1.2.59",
-      "resolved": "https://registry.npmjs.org/@iconify-json/vscode-icons/-/vscode-icons-1.2.59.tgz",
-      "integrity": "sha512-6RN+ixRubu3UKrUEqV24iuwvh2DgY541h2QWdxBeK3kJvXuDpaFNxw2dUSUqp80IU7f+QAU5sh718tXgyynnbQ==",
+      "version": "1.2.55",
+      "resolved": "https://registry.npmjs.org/@iconify-json/vscode-icons/-/vscode-icons-1.2.55.tgz",
+      "integrity": "sha512-7c6yep/OW7/xVWPedBeFbHv5wM4PnRcrZvlsaB+l5cBNWL/6thNE1yuN+PDPQZoEGdXRMUfwDAI3qF0ZVftwag==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2084,15 +2043,11 @@
     },
     "node_modules/@iconify/types": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@iconify/types/-/types-2.0.0.tgz",
-      "integrity": "sha512-+wluvCrRhXrhyOmRDJ3q8mux9JkKy5SJ/v8ol2tu4FVjyYvtEzkc/3pK15ET6RKg4b4w4BmTk1+gsCUhf21Ykg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@iconify/utils": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@iconify/utils/-/utils-3.1.3.tgz",
-      "integrity": "sha512-LPKOXPn/zV+zis1oOfGWogaXVpqUybF3ZS6SCZIsz8vg0ivVp9+fVqyYB7xq0aiST/VhUQYGO1qo6uoYSiEJqw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2102,14 +2057,12 @@
       }
     },
     "node_modules/@inlang/paraglide-js": {
-      "version": "2.20.1",
-      "resolved": "https://registry.npmjs.org/@inlang/paraglide-js/-/paraglide-js-2.20.1.tgz",
-      "integrity": "sha512-8mDhvcociFkWZDy3J+ZIIWkl0GTtJjVXS/kcBT2QG2l88y7+bFT45s8I00a7Hp1eFP9y6ScJMmNXWy87Krt7wA==",
+      "version": "2.12.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@inlang/recommend-sherlock": "^0.2.1",
-        "@inlang/sdk": "^2.10.0",
+        "@inlang/sdk": "^2.7.0",
         "commander": "11.1.0",
         "consola": "3.4.0",
         "json5": "2.2.3",
@@ -2118,30 +2071,10 @@
       },
       "bin": {
         "paraglide-js": "bin/run.js"
-      },
-      "peerDependencies": {
-        "typescript": ">=5.6"
-      },
-      "peerDependenciesMeta": {
-        "typescript": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/@inlang/paraglide-js/node_modules/commander": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-11.1.0.tgz",
-      "integrity": "sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=16"
       }
     },
     "node_modules/@inlang/recommend-sherlock": {
       "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@inlang/recommend-sherlock/-/recommend-sherlock-0.2.1.tgz",
-      "integrity": "sha512-ckv8HvHy/iTqaVAEKrr+gnl+p3XFNwe5D2+6w6wJk2ORV2XkcRkKOJ/XsTUJbPSiyi4PI+p+T3bqbmNx/rDUlg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2149,26 +2082,32 @@
       }
     },
     "node_modules/@inlang/sdk": {
-      "version": "2.10.2",
-      "resolved": "https://registry.npmjs.org/@inlang/sdk/-/sdk-2.10.2.tgz",
-      "integrity": "sha512-O1ki72SNK6LPagaGrvlioBb1mWKvump7cO7P85hfGZjdFTmDdn3icI0A6MvaBsB3P9KQHAjzyubnN1OslGufTw==",
+      "version": "2.7.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@lix-js/sdk": "0.4.10",
+        "@lix-js/sdk": "0.4.7",
         "@sinclair/typebox": "^0.31.17",
-        "kysely": "^0.28.12",
+        "kysely": "^0.27.4",
         "sqlite-wasm-kysely": "0.3.0",
-        "uuid": "^14.0.0"
+        "uuid": "^13.0.0"
       },
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@inlang/sdk/node_modules/kysely": {
+      "version": "0.27.6",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.27.6.tgz",
+      "integrity": "sha512-FIyV/64EkKhJmjgC0g2hygpBv5RNWVPyNCqSAD7eTCv6eFWNIi4PN1UvdSJGicN/o35bnevgis4Y0UDC0qi8jQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
       }
     },
     "node_modules/@internationalized/date": {
-      "version": "3.12.2",
-      "resolved": "https://registry.npmjs.org/@internationalized/date/-/date-3.12.2.tgz",
-      "integrity": "sha512-FY1Y+H64NDs+HAF6omlnWxm3mEpfgaCSWtL5l551ZZfImA+kGjPFgrnJrGjH6lfmLL0g8Z/mBu1R3kufeCp6Jw==",
+      "version": "3.11.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@swc/helpers": "^0.5.0"
@@ -2176,11 +2115,8 @@
     },
     "node_modules/@isaacs/cliui": {
       "version": "8.0.2",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
-      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
       "dev": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "string-width": "^5.1.2",
         "string-width-cjs": "npm:string-width@^4.2.0",
@@ -2195,8 +2131,6 @@
     },
     "node_modules/@isaacs/fs-minipass": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
-      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -2209,8 +2143,6 @@
     },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
-      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
-      "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -2220,8 +2152,6 @@
     },
     "node_modules/@jridgewell/remapping": {
       "version": "2.3.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz",
-      "integrity": "sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -2231,8 +2161,6 @@
     },
     "node_modules/@jridgewell/resolve-uri": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
-      "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -2241,15 +2169,11 @@
     },
     "node_modules/@jridgewell/sourcemap-codec": {
       "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@jridgewell/trace-mapping": {
       "version": "0.3.31",
-      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
-      "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -2257,10 +2181,25 @@
         "@jridgewell/sourcemap-codec": "^1.4.14"
       }
     },
+    "node_modules/@js-sdsl/ordered-map": {
+      "version": "4.4.2",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/js-sdsl"
+      }
+    },
+    "node_modules/@kwsites/file-exists": {
+      "version": "1.1.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "debug": "^4.1.1"
+      }
+    },
     "node_modules/@lix-js/sdk": {
-      "version": "0.4.10",
-      "resolved": "https://registry.npmjs.org/@lix-js/sdk/-/sdk-0.4.10.tgz",
-      "integrity": "sha512-0dMInAJK/67guTG5rRZaCEhvzC5cCXENOjaePA5AqMXrCE97kaY7SRor9e2vnoGsFIiGqXKlT0MCIoZj36G0gg==",
+      "version": "0.4.7",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -2268,37 +2207,53 @@
         "dedent": "1.5.1",
         "human-id": "^4.1.1",
         "js-sha256": "^0.11.0",
-        "kysely": "^0.28.12",
+        "kysely": "^0.27.4",
         "sqlite-wasm-kysely": "0.3.0",
-        "uuid": "^14.0.0"
+        "uuid": "^10.0.0"
       },
       "engines": {
         "node": ">=18"
       }
     },
-    "node_modules/@lix-js/server-protocol-schema": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/@lix-js/server-protocol-schema/-/server-protocol-schema-0.1.1.tgz",
-      "integrity": "sha512-jBeALB6prAbtr5q4vTuxnRZZv1M2rKe8iNqRQhFJ4Tv7150unEa0vKyz0hs8Gl3fUGsWaNJBh3J8++fpbrpRBQ==",
+    "node_modules/@lix-js/sdk/node_modules/kysely": {
+      "version": "0.27.6",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.27.6.tgz",
+      "integrity": "sha512-FIyV/64EkKhJmjgC0g2hygpBv5RNWVPyNCqSAD7eTCv6eFWNIi4PN1UvdSJGicN/o35bnevgis4Y0UDC0qi8jQ==",
       "dev": true,
-      "license": "Apache-2.0"
-    },
-    "node_modules/@noble/ciphers": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@noble/ciphers/-/ciphers-2.2.0.tgz",
-      "integrity": "sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA==",
       "license": "MIT",
       "engines": {
-        "node": ">= 20.19.0"
-      },
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/@lix-js/sdk/node_modules/uuid": {
+      "version": "10.0.0",
+      "dev": true,
+      "funding": [
+        "https://github.com/sponsors/broofa",
+        "https://github.com/sponsors/ctavan"
+      ],
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
+    "node_modules/@lix-js/server-protocol-schema": {
+      "version": "0.1.1",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
+    "node_modules/@noble/ciphers": {
+      "version": "2.1.1",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20.19.0"
+      },
       "funding": {
         "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/@noble/hashes": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.2.0.tgz",
-      "integrity": "sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==",
+      "version": "2.0.1",
       "license": "MIT",
       "engines": {
         "node": ">= 20.19.0"
@@ -2307,10 +2262,18 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/@nodable/entities": {
+      "version": "2.1.0",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodable"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/@npmcli/agent": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-3.0.0.tgz",
-      "integrity": "sha512-S79NdEgDQd/NGCay6TCoVzXSj74skRZIKJcpJjC5lOq34SZzyI6MqtiiWoiVWoVrTcGjNeC4ipbh1VIHlpfF5Q==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -2327,8 +2290,6 @@
     },
     "node_modules/@npmcli/fs": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-4.0.0.tgz",
-      "integrity": "sha512-/xGlezI6xfGO9NwuJlnwz/K14qD1kCSAGtacBHnGzeAIuJGazcp45KP5NuyARXoKb7cwulAGWVsbeSxdG/cb0Q==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -2341,8 +2302,6 @@
     },
     "node_modules/@oozcitak/dom": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@oozcitak/dom/-/dom-2.0.2.tgz",
-      "integrity": "sha512-GjpKhkSYC3Mj4+lfwEyI1dqnsKTgwGy48ytZEhm4A/xnH/8z9M3ZVXKr/YGQi3uCLs1AEBS+x5T2JPiueEDW8w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2356,8 +2315,6 @@
     },
     "node_modules/@oozcitak/infra": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@oozcitak/infra/-/infra-2.0.2.tgz",
-      "integrity": "sha512-2g+E7hoE2dgCz/APPOEK5s3rMhJvNxSMBrP+U+j1OWsIbtSpWxxlUjq1lU8RIsFJNYv7NMlnVsCuHcUzJW+8vA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2369,8 +2326,6 @@
     },
     "node_modules/@oozcitak/url": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@oozcitak/url/-/url-3.0.0.tgz",
-      "integrity": "sha512-ZKfET8Ak1wsLAiLWNfFkZc/BraDccuTJKR6svTYc7sVjbR+Iu0vtXdiDMY4o6jaFl5TW2TlS7jbLl4VovtAJWQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2383,8 +2338,6 @@
     },
     "node_modules/@oozcitak/util": {
       "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@oozcitak/util/-/util-10.0.0.tgz",
-      "integrity": "sha512-hAX0pT/73190NLqBPPWSdBVGtbY6VOhWYK3qqHqtXQ1gK7kS2yz4+ivsN07hpJ6I3aeMtKP6J6npsEKOAzuTLA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2392,9 +2345,7 @@
       }
     },
     "node_modules/@opentelemetry/api": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.1.tgz",
-      "integrity": "sha512-gLyJlPHPZYdAk1JENA9LeHejZe1Ti77/pTeFm/nMXmQH/HFZlcS/O2XJB+L8fkbrNSqhdtlvjBVjxwUYanNH5Q==",
+      "version": "1.9.0",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=8.0.0"
@@ -2411,14 +2362,10 @@
     },
     "node_modules/@pinojs/redact": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
-      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
       "license": "MIT"
     },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
-      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
-      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2427,26 +2374,22 @@
       }
     },
     "node_modules/@pkgr/core": {
-      "version": "0.3.6",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz",
-      "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==",
+      "version": "0.2.9",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": "^14.18.0 || >=16.0.0"
+        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
       },
       "funding": {
         "url": "https://opencollective.com/pkgr"
       }
     },
     "node_modules/@playwright/test": {
-      "version": "1.61.0",
-      "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.61.0.tgz",
-      "integrity": "sha512-cKA5B6lpFEMyMGjxF54QihfYpB4FkEGH+qZhtArDEG+wezQAJY8Pq6C7T1SjWz+FFzt3TbyoXBQYk/0292TdJA==",
+      "version": "1.58.2",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright": "1.61.0"
+        "playwright": "1.58.2"
       },
       "bin": {
         "playwright": "cli.js"
@@ -2457,23 +2400,70 @@
     },
     "node_modules/@polka/url": {
       "version": "1.0.0-next.29",
-      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
-      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@poppinss/macroable": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@poppinss/macroable/-/macroable-1.1.2.tgz",
-      "integrity": "sha512-FAVBRzzWhYP5mA3lCwLH1A0fKBqq5anyjGet90Z81aRK5c/+LTGUE1zJhZrErjaenBSOOI9BVUs3WVmotneFQA==",
+      "version": "1.1.0",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
+    "node_modules/@protobufjs/aspromise": {
+      "version": "1.1.2",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/base64": {
+      "version": "1.1.2",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/codegen": {
+      "version": "2.0.5",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/eventemitter": {
+      "version": "1.1.1",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/fetch": {
+      "version": "1.1.1",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.1"
+      }
+    },
+    "node_modules/@protobufjs/float": {
+      "version": "1.0.2",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/inquire": {
+      "version": "1.1.2",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/path": {
+      "version": "1.1.2",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/pool": {
+      "version": "1.1.0",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
+    "node_modules/@protobufjs/utf8": {
+      "version": "1.1.1",
+      "dev": true,
+      "license": "BSD-3-Clause"
+    },
     "node_modules/@rollup/plugin-commonjs": {
-      "version": "29.0.3",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-commonjs/-/plugin-commonjs-29.0.3.tgz",
-      "integrity": "sha512-ZaOxZceP7SOUW7Lqw5IRVweSQYWaeIPnXIGLiB690EBA3FGJTO40EEr2L5yZplJWsgTCogILRSpcAe7+U0Otdg==",
+      "version": "29.0.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2499,8 +2489,6 @@
     },
     "node_modules/@rollup/plugin-json": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-json/-/plugin-json-6.1.0.tgz",
-      "integrity": "sha512-EGI2te5ENk1coGeADSIwZ7G2Q8CJS2sF120T7jLw4xFw9n7wIOXHo+kIYRAoVpJAN+kmqZSoO3Fp4JtoNF4ReA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2520,8 +2508,6 @@
     },
     "node_modules/@rollup/plugin-node-resolve": {
       "version": "16.0.3",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-node-resolve/-/plugin-node-resolve-16.0.3.tgz",
-      "integrity": "sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2543,32 +2529,8 @@
         }
       }
     },
-    "node_modules/@rollup/plugin-replace": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/@rollup/plugin-replace/-/plugin-replace-6.0.3.tgz",
-      "integrity": "sha512-J4RZarRvQAm5IF0/LwUUg+obsm+xZhYnbMXmXROyoSE1ATJe3oXSb9L5MMppdxP2ylNSjv6zFBwKYjcKMucVfA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@rollup/pluginutils": "^5.0.1",
-        "magic-string": "^0.30.3"
-      },
-      "engines": {
-        "node": ">=14.0.0"
-      },
-      "peerDependencies": {
-        "rollup": "^1.20.0||^2.0.0||^3.0.0||^4.0.0"
-      },
-      "peerDependenciesMeta": {
-        "rollup": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/@rollup/pluginutils": {
-      "version": "5.4.0",
-      "resolved": "https://registry.npmjs.org/@rollup/pluginutils/-/pluginutils-5.4.0.tgz",
-      "integrity": "sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==",
+      "version": "5.3.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -2589,9 +2551,9 @@
       }
     },
     "node_modules/@rollup/rollup-android-arm-eabi": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.62.2.tgz",
-      "integrity": "sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.57.1.tgz",
+      "integrity": "sha512-A6ehUVSiSaaliTxai040ZpZ2zTevHYbvu/lDoeAteHI8QnaosIzm4qwtezfRg1jOYaUmnzLX1AOD6Z+UJjtifg==",
       "cpu": [
         "arm"
       ],
@@ -2602,9 +2564,9 @@
       ]
     },
     "node_modules/@rollup/rollup-android-arm64": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.62.2.tgz",
-      "integrity": "sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.57.1.tgz",
+      "integrity": "sha512-dQaAddCY9YgkFHZcFNS/606Exo8vcLHwArFZ7vxXq4rigo2bb494/xKMMwRRQW6ug7Js6yXmBZhSBRuBvCCQ3w==",
       "cpu": [
         "arm64"
       ],
@@ -2615,9 +2577,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-arm64": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.62.2.tgz",
-      "integrity": "sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.57.1.tgz",
+      "integrity": "sha512-crNPrwJOrRxagUYeMn/DZwqN88SDmwaJ8Cvi/TN1HnWBU7GwknckyosC2gd0IqYRsHDEnXf328o9/HC6OkPgOg==",
       "cpu": [
         "arm64"
       ],
@@ -2628,9 +2590,9 @@
       ]
     },
     "node_modules/@rollup/rollup-darwin-x64": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.62.2.tgz",
-      "integrity": "sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.57.1.tgz",
+      "integrity": "sha512-Ji8g8ChVbKrhFtig5QBV7iMaJrGtpHelkB3lsaKzadFBe58gmjfGXAOfI5FV0lYMH8wiqsxKQ1C9B0YTRXVy4w==",
       "cpu": [
         "x64"
       ],
@@ -2641,9 +2603,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-arm64": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.62.2.tgz",
-      "integrity": "sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.57.1.tgz",
+      "integrity": "sha512-R+/WwhsjmwodAcz65guCGFRkMb4gKWTcIeLy60JJQbXrJ97BOXHxnkPFrP+YwFlaS0m+uWJTstrUA9o+UchFug==",
       "cpu": [
         "arm64"
       ],
@@ -2654,9 +2616,9 @@
       ]
     },
     "node_modules/@rollup/rollup-freebsd-x64": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.62.2.tgz",
-      "integrity": "sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.57.1.tgz",
+      "integrity": "sha512-IEQTCHeiTOnAUC3IDQdzRAGj3jOAYNr9kBguI7MQAAZK3caezRrg0GxAb6Hchg4lxdZEI5Oq3iov/w/hnFWY9Q==",
       "cpu": [
         "x64"
       ],
@@ -2667,9 +2629,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.62.2.tgz",
-      "integrity": "sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.57.1.tgz",
+      "integrity": "sha512-F8sWbhZ7tyuEfsmOxwc2giKDQzN3+kuBLPwwZGyVkLlKGdV1nvnNwYD0fKQ8+XS6hp9nY7B+ZeK01EBUE7aHaw==",
       "cpu": [
         "arm"
       ],
@@ -2680,9 +2642,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.62.2.tgz",
-      "integrity": "sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.57.1.tgz",
+      "integrity": "sha512-rGfNUfn0GIeXtBP1wL5MnzSj98+PZe/AXaGBCRmT0ts80lU5CATYGxXukeTX39XBKsxzFpEeK+Mrp9faXOlmrw==",
       "cpu": [
         "arm"
       ],
@@ -2693,9 +2655,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-gnu": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.62.2.tgz",
-      "integrity": "sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.57.1.tgz",
+      "integrity": "sha512-MMtej3YHWeg/0klK2Qodf3yrNzz6CGjo2UntLvk2RSPlhzgLvYEB3frRvbEF2wRKh1Z2fDIg9KRPe1fawv7C+g==",
       "cpu": [
         "arm64"
       ],
@@ -2706,9 +2668,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-arm64-musl": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.62.2.tgz",
-      "integrity": "sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.57.1.tgz",
+      "integrity": "sha512-1a/qhaaOXhqXGpMFMET9VqwZakkljWHLmZOX48R0I/YLbhdxr1m4gtG1Hq7++VhVUmf+L3sTAf9op4JlhQ5u1Q==",
       "cpu": [
         "arm64"
       ],
@@ -2719,9 +2681,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-gnu": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.62.2.tgz",
-      "integrity": "sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.57.1.tgz",
+      "integrity": "sha512-QWO6RQTZ/cqYtJMtxhkRkidoNGXc7ERPbZN7dVW5SdURuLeVU7lwKMpo18XdcmpWYd0qsP1bwKPf7DNSUinhvA==",
       "cpu": [
         "loong64"
       ],
@@ -2732,9 +2694,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-loong64-musl": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.62.2.tgz",
-      "integrity": "sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-musl/-/rollup-linux-loong64-musl-4.57.1.tgz",
+      "integrity": "sha512-xpObYIf+8gprgWaPP32xiN5RVTi/s5FCR+XMXSKmhfoJjrpRAjCuuqQXyxUa/eJTdAE6eJ+KDKaoEqjZQxh3Gw==",
       "cpu": [
         "loong64"
       ],
@@ -2745,9 +2707,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-gnu": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.62.2.tgz",
-      "integrity": "sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.57.1.tgz",
+      "integrity": "sha512-4BrCgrpZo4hvzMDKRqEaW1zeecScDCR+2nZ86ATLhAoJ5FQ+lbHVD3ttKe74/c7tNT9c6F2viwB3ufwp01Oh2w==",
       "cpu": [
         "ppc64"
       ],
@@ -2758,9 +2720,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-ppc64-musl": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.62.2.tgz",
-      "integrity": "sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-musl/-/rollup-linux-ppc64-musl-4.57.1.tgz",
+      "integrity": "sha512-NOlUuzesGauESAyEYFSe3QTUguL+lvrN1HtwEEsU2rOwdUDeTMJdO5dUYl/2hKf9jWydJrO9OL/XSSf65R5+Xw==",
       "cpu": [
         "ppc64"
       ],
@@ -2771,9 +2733,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.62.2.tgz",
-      "integrity": "sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.57.1.tgz",
+      "integrity": "sha512-ptA88htVp0AwUUqhVghwDIKlvJMD/fmL/wrQj99PRHFRAG6Z5nbWoWG4o81Nt9FT+IuqUQi+L31ZKAFeJ5Is+A==",
       "cpu": [
         "riscv64"
       ],
@@ -2784,9 +2746,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-riscv64-musl": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.62.2.tgz",
-      "integrity": "sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.57.1.tgz",
+      "integrity": "sha512-S51t7aMMTNdmAMPpBg7OOsTdn4tySRQvklmL3RpDRyknk87+Sp3xaumlatU+ppQ+5raY7sSTcC2beGgvhENfuw==",
       "cpu": [
         "riscv64"
       ],
@@ -2797,9 +2759,9 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-s390x-gnu": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.62.2.tgz",
-      "integrity": "sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.57.1.tgz",
+      "integrity": "sha512-Bl00OFnVFkL82FHbEqy3k5CUCKH6OEJL54KCyx2oqsmZnFTR8IoNqBF+mjQVcRCT5sB6yOvK8A37LNm/kPJiZg==",
       "cpu": [
         "s390x"
       ],
@@ -2810,9 +2772,7 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-gnu": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.62.2.tgz",
-      "integrity": "sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==",
+      "version": "4.57.1",
       "cpu": [
         "x64"
       ],
@@ -2823,9 +2783,7 @@
       ]
     },
     "node_modules/@rollup/rollup-linux-x64-musl": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.62.2.tgz",
-      "integrity": "sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==",
+      "version": "4.57.1",
       "cpu": [
         "x64"
       ],
@@ -2836,9 +2794,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openbsd-x64": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.62.2.tgz",
-      "integrity": "sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openbsd-x64/-/rollup-openbsd-x64-4.57.1.tgz",
+      "integrity": "sha512-H+hXEv9gdVQuDTgnqD+SQffoWoc0Of59AStSzTEj/feWTBAnSfSD3+Dql1ZruJQxmykT/JVY0dE8Ka7z0DH1hw==",
       "cpu": [
         "x64"
       ],
@@ -2849,9 +2807,9 @@
       ]
     },
     "node_modules/@rollup/rollup-openharmony-arm64": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.62.2.tgz",
-      "integrity": "sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.57.1.tgz",
+      "integrity": "sha512-4wYoDpNg6o/oPximyc/NG+mYUejZrCU2q+2w6YZqrAs2UcNUChIZXjtafAiiZSUc7On8v5NyNj34Kzj/Ltk6dQ==",
       "cpu": [
         "arm64"
       ],
@@ -2862,9 +2820,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-arm64-msvc": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.62.2.tgz",
-      "integrity": "sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.57.1.tgz",
+      "integrity": "sha512-O54mtsV/6LW3P8qdTcamQmuC990HDfR71lo44oZMZlXU4tzLrbvTii87Ni9opq60ds0YzuAlEr/GNwuNluZyMQ==",
       "cpu": [
         "arm64"
       ],
@@ -2875,9 +2833,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-ia32-msvc": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.62.2.tgz",
-      "integrity": "sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.57.1.tgz",
+      "integrity": "sha512-P3dLS+IerxCT/7D2q2FYcRdWRl22dNbrbBEtxdWhXrfIMPP9lQhb5h4Du04mdl5Woq05jVCDPCMF7Ub0NAjIew==",
       "cpu": [
         "ia32"
       ],
@@ -2888,9 +2846,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-gnu": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.62.2.tgz",
-      "integrity": "sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.57.1.tgz",
+      "integrity": "sha512-VMBH2eOOaKGtIJYleXsi2B8CPVADrh+TyNxJ4mWPnKfLB/DBUmzW+5m1xUrcwWoMfSLagIRpjUFeW5CO5hyciQ==",
       "cpu": [
         "x64"
       ],
@@ -2901,9 +2859,9 @@
       ]
     },
     "node_modules/@rollup/rollup-win32-x64-msvc": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.62.2.tgz",
-      "integrity": "sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==",
+      "version": "4.57.1",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.57.1.tgz",
+      "integrity": "sha512-mxRFDdHIWRxg3UfIIAwCm6NzvxG0jDX/wBN6KsQFTvKFqqg9vTrWUE68qEjHt19A5wwx5X5aUi2zuZT7YR0jrA==",
       "cpu": [
         "x64"
       ],
@@ -2915,8 +2873,6 @@
     },
     "node_modules/@sideway/address": {
       "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
-      "integrity": "sha512-IqO/DUQHUkPeixNQ8n0JA6102hT9CmaljNTPmQ1u8MEhBo/R4Q8eKLN/vGZxuebwOroDB4cbpjheD4+/sKFK4Q==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true,
@@ -2926,34 +2882,28 @@
     },
     "node_modules/@sideway/formula": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@sideway/formula/-/formula-3.0.1.tgz",
-      "integrity": "sha512-/poHZJJVjx3L+zVD6g9KgHfYnb443oi7wLu/XKojDviHy6HOEOA6z1Trk5aR1dGcmPenJEgb2sK2I80LeS3MIg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true
     },
     "node_modules/@sideway/pinpoint": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@sideway/pinpoint/-/pinpoint-2.0.0.tgz",
-      "integrity": "sha512-RNiOoTPkptFtSVzQevY/yWtZwf/RxyVnPy/OcA9HBM3MlGDnBEYL5B41H0MTn0Uec8Hi+2qUtTfG2WWZBmMejQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true
     },
     "node_modules/@sinclair/typebox": {
       "version": "0.31.28",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.31.28.tgz",
-      "integrity": "sha512-/s55Jujywdw/Jpan+vsy6JZs1z2ZTGxTmbZTPiuSL2wz9mfzA2gN1zzaqmvfi4pq+uOt7Du85fkiwv5ymW84aQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@smithy/core": {
-      "version": "3.28.0",
-      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.28.0.tgz",
-      "integrity": "sha512-N/LoLG8pZ1zv5cIWpdF6vmSjtZtXKK9G0OqT5yYCOZU+CzPq1+nYA95VoKJBGWRScs7YbMugZ7lZx8Fj1vdHoA==",
+      "version": "3.29.2",
+      "resolved": "https://registry.npmjs.org/@smithy/core/-/core-3.29.2.tgz",
+      "integrity": "sha512-DXUk6yU0C1Q1tYvJh1VCtl8QOBcSoZpKwjTPkxT6A4MUQYHvgeKGByL8mrEdxnvhdf9nq5GyzmRb5n/vPgu3Lw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/types": "^4.15.0",
+        "@smithy/types": "^4.16.0",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2961,13 +2911,11 @@
       }
     },
     "node_modules/@smithy/credential-provider-imds": {
-      "version": "4.4.2",
-      "resolved": "https://registry.npmjs.org/@smithy/credential-provider-imds/-/credential-provider-imds-4.4.2.tgz",
-      "integrity": "sha512-18UMDMyrAbDcpmL1gLUA7ww0fRTcdCrSjSJOi2Sbld+tVjwD/pW+OAwjlScFLR7vvBnhZrIPQ7kVuTf1mnJLug==",
+      "version": "4.3.4",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.26.0",
-        "@smithy/types": "^4.15.0",
+        "@smithy/core": "^3.24.4",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2975,13 +2923,11 @@
       }
     },
     "node_modules/@smithy/fetch-http-handler": {
-      "version": "5.5.2",
-      "resolved": "https://registry.npmjs.org/@smithy/fetch-http-handler/-/fetch-http-handler-5.5.2.tgz",
-      "integrity": "sha512-Ei/UK/QMhq0rKaMqGPlOAkE2yS9DZeYmZdk1RAKc3vp3zxgleZHZyBLlZv8yLsxljX4svCRuMTD6u3LLIcU4Bg==",
+      "version": "5.4.4",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.26.0",
-        "@smithy/types": "^4.15.0",
+        "@smithy/core": "^3.24.4",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -2990,8 +2936,6 @@
     },
     "node_modules/@smithy/is-array-buffer": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/is-array-buffer/-/is-array-buffer-2.2.0.tgz",
-      "integrity": "sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -3015,13 +2959,11 @@
       }
     },
     "node_modules/@smithy/signature-v4": {
-      "version": "5.5.2",
-      "resolved": "https://registry.npmjs.org/@smithy/signature-v4/-/signature-v4-5.5.2.tgz",
-      "integrity": "sha512-7xHpmPY4rt0IOmeAA8EfjgEH8isT+587TCdy9H6a7d4OMi5CQ0oEHhWllunvPu4j4Cq0vTFwdxXN/kABWPjdyA==",
+      "version": "5.4.4",
       "license": "Apache-2.0",
       "dependencies": {
-        "@smithy/core": "^3.26.0",
-        "@smithy/types": "^4.15.0",
+        "@smithy/core": "^3.24.4",
+        "@smithy/types": "^4.14.2",
         "tslib": "^2.6.2"
       },
       "engines": {
@@ -3029,9 +2971,9 @@
       }
     },
     "node_modules/@smithy/types": {
-      "version": "4.15.0",
-      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.15.0.tgz",
-      "integrity": "sha512-Z5TAOxygoFvybJV3igo5SloFflSokHx2hu1eFA+DxDTcn+FtKxUSui+rbTRG1pAafMA888Z3MVvCWUuvCrTXjg==",
+      "version": "4.16.0",
+      "resolved": "https://registry.npmjs.org/@smithy/types/-/types-4.16.0.tgz",
+      "integrity": "sha512-aVUabzlBBmY0PfvVgLKQSOGFIL5/7R54JE3uD9a5Ay/jSED61SkuAcCYENNXJzYUvJ1NPrWO0P+rAXHCkbBUKw==",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.6.2"
@@ -3042,8 +2984,6 @@
     },
     "node_modules/@smithy/util-buffer-from": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-buffer-from/-/util-buffer-from-2.2.0.tgz",
-      "integrity": "sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@smithy/is-array-buffer": "^2.2.0",
@@ -3055,8 +2995,6 @@
     },
     "node_modules/@smithy/util-utf8": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/@smithy/util-utf8/-/util-utf8-2.3.0.tgz",
-      "integrity": "sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==",
       "license": "Apache-2.0",
       "dependencies": {
         "@smithy/util-buffer-from": "^2.2.0",
@@ -3068,8 +3006,6 @@
     },
     "node_modules/@sqlite.org/sqlite-wasm": {
       "version": "3.48.0-build4",
-      "resolved": "https://registry.npmjs.org/@sqlite.org/sqlite-wasm/-/sqlite-wasm-3.48.0-build4.tgz",
-      "integrity": "sha512-hI6twvUkzOmyGZhQMza1gpfqErZxXRw6JEsiVjUbo7tFanVD+8Oil0Ih3l2nGzHdxPI41zFmfUQG7GHqhciKZQ==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -3078,14 +3014,10 @@
     },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
-      "integrity": "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==",
       "license": "MIT"
     },
     "node_modules/@sveltejs/acorn-typescript": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/@sveltejs/acorn-typescript/-/acorn-typescript-1.0.10.tgz",
-      "integrity": "sha512-4WfKk68eTih+MiJD4fSbxN7E8kVBmTMPWHUPYjvl2N0rMs53YLTT8/YjKU5Dtnz5LqDjl7LEw4U7lXR2W3J5WA==",
+      "version": "1.0.9",
       "devOptional": true,
       "license": "MIT",
       "peerDependencies": {
@@ -3093,35 +3025,30 @@
       }
     },
     "node_modules/@sveltejs/adapter-node": {
-      "version": "5.5.6",
-      "resolved": "https://registry.npmjs.org/@sveltejs/adapter-node/-/adapter-node-5.5.6.tgz",
-      "integrity": "sha512-OSclz7clrNzpks+CHoPVmc/eZ/+Kz/0VSf4t65TIrw+FXPBXGuqtHOCMITel2ovbyKrx05MQ4HiUj4X0nhueWA==",
+      "version": "5.5.3",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@rollup/plugin-commonjs": "^29.0.0",
         "@rollup/plugin-json": "^6.1.0",
         "@rollup/plugin-node-resolve": "^16.0.0",
-        "@rollup/plugin-replace": "^6.0.3",
-        "rollup": "^4.59.0"
+        "rollup": "^4.9.5"
       },
       "peerDependencies": {
         "@sveltejs/kit": "^2.4.0"
       }
     },
     "node_modules/@sveltejs/kit": {
-      "version": "2.67.0",
-      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.67.0.tgz",
-      "integrity": "sha512-JXHbsDwRes1Wgyof3q5ApzzpbCWvinKXMQCiV67TFO6xlZPYLoK0fq3xQMqSicDMgCtFGqLkrQXkseOcASdZ8A==",
+      "version": "2.53.2",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
-        "@sveltejs/acorn-typescript": "^1.0.9",
+        "@sveltejs/acorn-typescript": "^1.0.5",
         "@types/cookie": "^0.6.0",
-        "acorn": "^8.16.0",
+        "acorn": "^8.14.1",
         "cookie": "^0.6.0",
-        "devalue": "^5.8.1",
+        "devalue": "^5.6.3",
         "esm-env": "^1.2.2",
         "kleur": "^4.1.5",
         "magic-string": "^0.30.5",
@@ -3139,7 +3066,7 @@
         "@opentelemetry/api": "^1.0.0",
         "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
         "svelte": "^4.0.0 || ^5.0.0-next.0",
-        "typescript": "^5.3.3 || ^6.0.0",
+        "typescript": "^5.3.3",
         "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
@@ -3151,20 +3078,8 @@
         }
       }
     },
-    "node_modules/@sveltejs/load-config": {
-      "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/@sveltejs/load-config/-/load-config-0.1.1.tgz",
-      "integrity": "sha512-BXXm+VOH/9X4N7Dd1iZ2MqA1h7M+9i2noI8QYuLDY8QcN2WHYn7D/VK/+IJNfcAmRw7ACNJ538UT9GXIhnBTiA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">= 18.0.0"
-      }
-    },
     "node_modules/@sveltejs/vite-plugin-svelte": {
       "version": "6.2.4",
-      "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte/-/vite-plugin-svelte-6.2.4.tgz",
-      "integrity": "sha512-ou/d51QSdTyN26D7h6dSpusAKaZkAiGM55/AKYi+9AGZw7q85hElbjK3kEyzXHhLSnRISHOYzVge6x0jRZ7DXA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3184,8 +3099,6 @@
     },
     "node_modules/@sveltejs/vite-plugin-svelte-inspector": {
       "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/@sveltejs/vite-plugin-svelte-inspector/-/vite-plugin-svelte-inspector-5.0.2.tgz",
-      "integrity": "sha512-TZzRTcEtZffICSAoZGkPSl6Etsj2torOVrx6Uw0KpXxrec9Gg6jFWQ60Q3+LmNGfZSxHRCZL7vXVZIWmuV50Ig==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3201,58 +3114,52 @@
       }
     },
     "node_modules/@swc/helpers": {
-      "version": "0.5.23",
-      "resolved": "https://registry.npmjs.org/@swc/helpers/-/helpers-0.5.23.tgz",
-      "integrity": "sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==",
+      "version": "0.5.18",
       "license": "Apache-2.0",
       "dependencies": {
         "tslib": "^2.8.0"
       }
     },
     "node_modules/@tailwindcss/node": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/node/-/node-4.3.1.tgz",
-      "integrity": "sha512-6NDaqRoAMSXD1mr/RXu0HBvNE9a2n5tHPsxu9XHLws8o4Twes5rBM2205SUUiJ9goAtadrN6xTGX0UDEwp/N4A==",
+      "version": "4.2.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/remapping": "^2.3.5",
-        "enhanced-resolve": "5.21.6",
-        "jiti": "^2.7.0",
-        "lightningcss": "1.32.0",
+        "enhanced-resolve": "^5.19.0",
+        "jiti": "^2.6.1",
+        "lightningcss": "1.31.1",
         "magic-string": "^0.30.21",
         "source-map-js": "^1.2.1",
-        "tailwindcss": "4.3.1"
+        "tailwindcss": "4.2.1"
       }
     },
     "node_modules/@tailwindcss/oxide": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide/-/oxide-4.3.1.tgz",
-      "integrity": "sha512-yVPyo8RNkabVr3O2EhHEE0Rewu7YKzc1DhIqfL46LKveFrmu9XbDazNOJY7/GRuvw1h6u3utWnR29H/p5JPlgA==",
+      "version": "4.2.1",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 20"
       },
       "optionalDependencies": {
-        "@tailwindcss/oxide-android-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-arm64": "4.3.1",
-        "@tailwindcss/oxide-darwin-x64": "4.3.1",
-        "@tailwindcss/oxide-freebsd-x64": "4.3.1",
-        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-arm64-musl": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-gnu": "4.3.1",
-        "@tailwindcss/oxide-linux-x64-musl": "4.3.1",
-        "@tailwindcss/oxide-wasm32-wasi": "4.3.1",
-        "@tailwindcss/oxide-win32-arm64-msvc": "4.3.1",
-        "@tailwindcss/oxide-win32-x64-msvc": "4.3.1"
+        "@tailwindcss/oxide-android-arm64": "4.2.1",
+        "@tailwindcss/oxide-darwin-arm64": "4.2.1",
+        "@tailwindcss/oxide-darwin-x64": "4.2.1",
+        "@tailwindcss/oxide-freebsd-x64": "4.2.1",
+        "@tailwindcss/oxide-linux-arm-gnueabihf": "4.2.1",
+        "@tailwindcss/oxide-linux-arm64-gnu": "4.2.1",
+        "@tailwindcss/oxide-linux-arm64-musl": "4.2.1",
+        "@tailwindcss/oxide-linux-x64-gnu": "4.2.1",
+        "@tailwindcss/oxide-linux-x64-musl": "4.2.1",
+        "@tailwindcss/oxide-wasm32-wasi": "4.2.1",
+        "@tailwindcss/oxide-win32-arm64-msvc": "4.2.1",
+        "@tailwindcss/oxide-win32-x64-msvc": "4.2.1"
       }
     },
     "node_modules/@tailwindcss/oxide-android-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.3.1.tgz",
-      "integrity": "sha512-SVlyf61g374l5cHyg8x9kf5xmLcOaxvOTsbsqDnSsDJaKOEFZ7GCvi84VAVGpxojYOs1+3K6M0UjXfqPU8vmOQ==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-android-arm64/-/oxide-android-arm64-4.2.1.tgz",
+      "integrity": "sha512-eZ7G1Zm5EC8OOKaesIKuw77jw++QJ2lL9N+dDpdQiAB/c/B2wDh0QPFHbkBVrXnwNugvrbJFk1gK2SsVjwWReg==",
       "cpu": [
         "arm64"
       ],
@@ -3267,9 +3174,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-arm64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.3.1.tgz",
-      "integrity": "sha512-hVnWLwv+e/l7c4WKyVtHVrIPvYdqWHjRB3MDIqARynzFtnQg85kmQEFCbV9Ja0VVx4xXTIiDWY60Y7iz/iNoDA==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-arm64/-/oxide-darwin-arm64-4.2.1.tgz",
+      "integrity": "sha512-q/LHkOstoJ7pI1J0q6djesLzRvQSIfEto148ppAd+BVQK0JYjQIFSK3JgYZJa+Yzi0DDa52ZsQx2rqytBnf8Hw==",
       "cpu": [
         "arm64"
       ],
@@ -3284,9 +3191,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-darwin-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.3.1.tgz",
-      "integrity": "sha512-Cf7abu0WVgbhU7ANgPUnSAvm7nCvMweusHb8FnaHlLfv/Caq4GYaEZg7ZImzzmjx4lIAfuS8q+eLIS7A7IzxIg==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-darwin-x64/-/oxide-darwin-x64-4.2.1.tgz",
+      "integrity": "sha512-/f/ozlaXGY6QLbpvd/kFTro2l18f7dHKpB+ieXz+Cijl4Mt9AI2rTrpq7V+t04nK+j9XBQHnSMdeQRhbGyt6fw==",
       "cpu": [
         "x64"
       ],
@@ -3301,9 +3208,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-freebsd-x64": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.3.1.tgz",
-      "integrity": "sha512-ZZqzX2Y+GXtXXfqSfpJhDm60OoZfvLHLCgm+J7NVqgHHJjG/m9ugZI77RwTsVd4fnBJuCFP6Ae6kTJb71UdS8g==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-freebsd-x64/-/oxide-freebsd-x64-4.2.1.tgz",
+      "integrity": "sha512-5e/AkgYJT/cpbkys/OU2Ei2jdETCLlifwm7ogMC7/hksI2fC3iiq6OcXwjibcIjPung0kRtR3TxEITkqgn0TcA==",
       "cpu": [
         "x64"
       ],
@@ -3318,9 +3225,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm-gnueabihf": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.3.1.tgz",
-      "integrity": "sha512-/Ah/xik0LaMYfv9DZ0S/t4pBlBNYOcqtRwusjgovHkvT8ixueWCLyJjsaF5kQIckjb4IT8Q6K6p/iPmZMixYgg==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm-gnueabihf/-/oxide-linux-arm-gnueabihf-4.2.1.tgz",
+      "integrity": "sha512-Uny1EcVTTmerCKt/1ZuKTkb0x8ZaiuYucg2/kImO5A5Y/kBz41/+j0gxUZl+hTF3xkWpDmHX+TaWhOtba2Fyuw==",
       "cpu": [
         "arm"
       ],
@@ -3335,9 +3242,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.3.1.tgz",
-      "integrity": "sha512-gqdFoVJlw444GvpnheZLHmvTzSxI/cOUUh2KSNejQjTcYkW062SVD+En0rUgD+QV91bz1XGIGtt1HJd48xUGbQ==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-gnu/-/oxide-linux-arm64-gnu-4.2.1.tgz",
+      "integrity": "sha512-CTrwomI+c7n6aSSQlsPL0roRiNMDQ/YzMD9EjcR+H4f0I1SQ8QqIuPnsVp7QgMkC1Qi8rtkekLkOFjo7OlEFRQ==",
       "cpu": [
         "arm64"
       ],
@@ -3352,9 +3259,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-arm64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.3.1.tgz",
-      "integrity": "sha512-Bwv9KwOvE0VKa86xPFif9b9c3Y1NxOV1P0gLti/IYaWEsQYZXDlxfGEtA8mdDZ7SG3wyNXAWYT5SIn3giL57oA==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-arm64-musl/-/oxide-linux-arm64-musl-4.2.1.tgz",
+      "integrity": "sha512-WZA0CHRL/SP1TRbA5mp9htsppSEkWuQ4KsSUumYQnyl8ZdT39ntwqmz4IUHGN6p4XdSlYfJwM4rRzZLShHsGAQ==",
       "cpu": [
         "arm64"
       ],
@@ -3369,9 +3276,7 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-gnu": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-gnu/-/oxide-linux-x64-gnu-4.3.1.tgz",
-      "integrity": "sha512-Ymi8O8T15HYQdOUWUtTI6ldN0neHP85FC+Qz32xTcZ7iJXtem/x8ITev0o1e9e5rkqj4lONZfTRLvkmin1+tKg==",
+      "version": "4.2.1",
       "cpu": [
         "x64"
       ],
@@ -3386,9 +3291,7 @@
       }
     },
     "node_modules/@tailwindcss/oxide-linux-x64-musl": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-linux-x64-musl/-/oxide-linux-x64-musl-4.3.1.tgz",
-      "integrity": "sha512-M+P/91qJ6uILLw4k2G93GMDRAXj61SMvFQYt39AqvUqYgExXpLL5aepfns7sj4HiAQeolirQF9E0lzRvdf4zPQ==",
+      "version": "4.2.1",
       "cpu": [
         "x64"
       ],
@@ -3403,9 +3306,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-wasm32-wasi": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.3.1.tgz",
-      "integrity": "sha512-zsM8uOeqvVGHsAXsJxsT28ttosFahLJKCLOTUBqRAtKnVgGSRitds9T432QiT8b77Yga7JIBkulIRRlJPtYhRA==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-wasm32-wasi/-/oxide-wasm32-wasi-4.2.1.tgz",
+      "integrity": "sha512-MGFB5cVPvshR85MTJkEvqDUnuNoysrsRxd6vnk1Lf2tbiqNlXpHYZqkqOQalydienEWOHHFyyuTSYRsLfxFJ2Q==",
       "bundleDependencies": [
         "@napi-rs/wasm-runtime",
         "@emnapi/core",
@@ -3421,21 +3324,85 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.10.0",
-        "@emnapi/runtime": "^1.10.0",
-        "@emnapi/wasi-threads": "^1.2.1",
-        "@napi-rs/wasm-runtime": "^1.1.4",
-        "@tybys/wasm-util": "^0.10.2",
+        "@emnapi/core": "^1.8.1",
+        "@emnapi/runtime": "^1.8.1",
+        "@emnapi/wasi-threads": "^1.1.0",
+        "@napi-rs/wasm-runtime": "^1.1.1",
+        "@tybys/wasm-util": "^0.10.1",
         "tslib": "^2.8.1"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.1.0",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.1.0",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1",
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.1.tgz",
-      "integrity": "sha512-aiNvSq9BsVk8V513lDKlrCFAgf8qBMPZTpgEhInL+NwQqs97mYmupVMrPrgBBSL8Pv/0zXu9MrMF9rMun1ZeNg==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.2.1.tgz",
+      "integrity": "sha512-YlUEHRHBGnCMh4Nj4GnqQyBtsshUPdiNroZj8VPkvTZSoHsilRCwXcVKnG9kyi0ZFAS/3u+qKHBdDc81SADTRA==",
       "cpu": [
         "arm64"
       ],
@@ -3450,9 +3417,9 @@
       }
     },
     "node_modules/@tailwindcss/oxide-win32-x64-msvc": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.3.1.tgz",
-      "integrity": "sha512-xDEyu1rg290472FEGaKHnzyDyh5QH+AlWvsU5hMoMtPpzmKlRI0jaYKCgSHDYtaQWZOYbMaduSyCwFwY4n1HmA==",
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-x64-msvc/-/oxide-win32-x64-msvc-4.2.1.tgz",
+      "integrity": "sha512-rbO34G5sMWWyrN/idLeVxAZgAKWrn5LiR3/I90Q9MkA67s6T1oB0xtTe+0heoBvHSpbU9Mk7i6uwJnpo4u21XQ==",
       "cpu": [
         "x64"
       ],
@@ -3467,24 +3434,28 @@
       }
     },
     "node_modules/@tailwindcss/vite": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/vite/-/vite-4.3.1.tgz",
-      "integrity": "sha512-hItDHuIIlEV61R+faXu66s1K36aTurO/Qw0e45Vskz57gXl9pWOT6eg3zmcEui6CZXddbN7zd41bwmvag4JGwQ==",
+      "version": "4.2.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@tailwindcss/node": "4.3.1",
-        "@tailwindcss/oxide": "4.3.1",
-        "tailwindcss": "4.3.1"
+        "@tailwindcss/node": "4.2.1",
+        "@tailwindcss/oxide": "4.2.1",
+        "tailwindcss": "4.2.1"
       },
       "peerDependencies": {
-        "vite": "^5.2.0 || ^6 || ^7 || ^8"
+        "vite": "^5.2.0 || ^6 || ^7"
+      }
+    },
+    "node_modules/@testcontainers/postgresql": {
+      "version": "12.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "testcontainers": "^12.0.1"
       }
     },
     "node_modules/@testing-library/svelte-core": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@testing-library/svelte-core/-/svelte-core-1.1.3.tgz",
-      "integrity": "sha512-KkMAvXeWorxN2Yn0kdC1lfoAItxpoj4uOWzxK5leDrNxonLvS5nwBFvztrroyTszQ0Wf/EU6iLT8JhY5qcn22g==",
+      "version": "1.0.0",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3506,8 +3477,6 @@
     },
     "node_modules/@types/chai": {
       "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.3.tgz",
-      "integrity": "sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3517,40 +3486,49 @@
     },
     "node_modules/@types/cookie": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/@types/cookie/-/cookie-0.6.0.tgz",
-      "integrity": "sha512-4Kh9a6B2bQciAhf7FSuMRRkUWecJgJu9nPnx3yzpsfXX/c50REIqpHY4C82bXP90qrLtXtkDxTZosYO3UpOwlA==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/deep-eql": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
-      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/@types/docker-modem": {
+      "version": "3.0.6",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@types/ssh2": "*"
+      }
+    },
+    "node_modules/@types/dockerode": {
+      "version": "4.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/docker-modem": "*",
+        "@types/node": "*",
+        "@types/ssh2": "*"
+      }
+    },
     "node_modules/@types/estree": {
-      "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.9.tgz",
-      "integrity": "sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==",
+      "version": "1.0.8",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/json-schema": {
       "version": "7.0.15",
-      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
-      "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "24.13.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.2.tgz",
-      "integrity": "sha512-fRa09kZTgu8o71KFcDjUFuc7F+dEbZYZmkI0mg5YBTRs0yMKjYHsq/c0urDKeDb+D5qVgXOdFcuu+DZPKOITwA==",
+      "version": "24.10.13",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "undici-types": "~7.18.0"
+        "undici-types": "~7.16.0"
       }
     },
     "node_modules/@types/papaparse": {
@@ -3565,8 +3543,6 @@
     },
     "node_modules/@types/pg": {
       "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/@types/pg/-/pg-8.20.0.tgz",
-      "integrity": "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -3577,8 +3553,35 @@
     },
     "node_modules/@types/resolve": {
       "version": "1.20.2",
-      "resolved": "https://registry.npmjs.org/@types/resolve/-/resolve-1.20.2.tgz",
-      "integrity": "sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/ssh2": {
+      "version": "1.15.5",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "^18.11.18"
+      }
+    },
+    "node_modules/@types/ssh2-streams": {
+      "version": "0.1.13",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/@types/ssh2/node_modules/@types/node": {
+      "version": "18.19.130",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~5.26.4"
+      }
+    },
+    "node_modules/@types/ssh2/node_modules/undici-types": {
+      "version": "5.26.5",
       "dev": true,
       "license": "MIT"
     },
@@ -3594,23 +3597,17 @@
     },
     "node_modules/@types/trusted-types": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
-      "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/@types/validator": {
       "version": "13.15.10",
-      "resolved": "https://registry.npmjs.org/@types/validator/-/validator-13.15.10.tgz",
-      "integrity": "sha512-T8L6i7wCuyoK8A/ZeLYt1+q0ty3Zb9+qbSSvrIVitzT3YjZqkTZ40IbRsPanlB4h1QB3JVL1SYCdR6ngtFYcuA==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/@typeschema/class-validator": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/@typeschema/class-validator/-/class-validator-0.3.0.tgz",
-      "integrity": "sha512-OJSFeZDIQ8EK1HTljKLT5CItM2wsbgczLN8tMEfz3I1Lmhc5TBfkZ0eikFzUC16tI3d1Nag7um6TfCgp2I2Bww==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3628,8 +3625,6 @@
     },
     "node_modules/@typeschema/core": {
       "version": "0.14.0",
-      "resolved": "https://registry.npmjs.org/@typeschema/core/-/core-0.14.0.tgz",
-      "integrity": "sha512-Ia6PtZHcL3KqsAWXjMi5xIyZ7XMH4aSnOQes8mfMLx+wGFGtGRNlwe6Y7cYvX+WfNK67OL0/HSe9t8QDygV0/w==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3643,20 +3638,18 @@
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.62.0.tgz",
-      "integrity": "sha512-o+mpz7EYiMzXoySXiKmzlabIvTVqUuK5yLrAedRPRDA0IpPFMUV1IXt6OqljIxX/kumN6EjUYp41Hqelh6p/Dw==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/regexpp": "^4.12.2",
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/type-utils": "8.62.0",
-        "@typescript-eslint/utils": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/scope-manager": "8.56.1",
+        "@typescript-eslint/type-utils": "8.56.1",
+        "@typescript-eslint/utils": "8.56.1",
+        "@typescript-eslint/visitor-keys": "8.56.1",
         "ignore": "^7.0.5",
         "natural-compare": "^1.4.0",
-        "ts-api-utils": "^2.5.0"
+        "ts-api-utils": "^2.4.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3666,15 +3659,13 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "@typescript-eslint/parser": "^8.62.0",
+        "@typescript-eslint/parser": "^8.56.1",
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/eslint-plugin/node_modules/ignore": {
       "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3682,16 +3673,14 @@
       }
     },
     "node_modules/@typescript-eslint/parser": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.0.tgz",
-      "integrity": "sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/scope-manager": "8.56.1",
+        "@typescript-eslint/types": "8.56.1",
+        "@typescript-eslint/typescript-estree": "8.56.1",
+        "@typescript-eslint/visitor-keys": "8.56.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3703,18 +3692,16 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/project-service": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.0.tgz",
-      "integrity": "sha512-wexnCqiTg7BOGtbLDftYpRWlmLq4xfoMd7BKFR6Y75sZS3QmRKLdN3yWLhmIYgqMmP/OXWpj3H8odkb5nGURCQ==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.62.0",
-        "@typescript-eslint/types": "^8.62.0",
+        "@typescript-eslint/tsconfig-utils": "^8.56.1",
+        "@typescript-eslint/types": "^8.56.1",
         "debug": "^4.4.3"
       },
       "engines": {
@@ -3725,18 +3712,16 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.0.tgz",
-      "integrity": "sha512-1lX38kNxXIRb8mEc3lbq5mdHq1Pf2+U0nFU65KfT18mtPxxl0fvjuEE92mHuXPuCtElJhOrddOpyMlM3Z0umEA==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0"
+        "@typescript-eslint/types": "8.56.1",
+        "@typescript-eslint/visitor-keys": "8.56.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3747,9 +3732,7 @@
       }
     },
     "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.0.tgz",
-      "integrity": "sha512-y2GAdB6ykaXUvuspbYnizQc4oDDz0Tz/Yc7iWrXf9mx8vm/L/0vLHCe0tS2boG96Zy+DivnVDQ9ZUEWoHqqx1g==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3760,21 +3743,19 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/type-utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.62.0.tgz",
-      "integrity": "sha512-+g5O3j0w2ldzC86Pv6fvbO/xhAonbJFIdf/MKQ1d30gndlsVzUOE83ldfSE15Qrl9fhFjK6AovHs5Wpp6vx86w==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0",
-        "@typescript-eslint/utils": "8.62.0",
+        "@typescript-eslint/types": "8.56.1",
+        "@typescript-eslint/typescript-estree": "8.56.1",
+        "@typescript-eslint/utils": "8.56.1",
         "debug": "^4.4.3",
-        "ts-api-utils": "^2.5.0"
+        "ts-api-utils": "^2.4.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3785,14 +3766,12 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.0.tgz",
-      "integrity": "sha512-KvAclkktORPvM54TgLgA4z9HIV1M8zOgw9ZVNXl9f/8dLYfXYX1wkMXP7qmabpijQRV5bHJLOmoyGQbLMaUYeg==",
-      "devOptional": true,
+      "version": "8.56.1",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3803,21 +3782,19 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.0.tgz",
-      "integrity": "sha512-+hVbNxtW64pIcZWDPGbyaKF7vp2IBTVY5ma1blwwksrjdsbdqqEKvJWMGbBofei4F6Dovx1M0RJgoFeNu2279A==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/project-service": "8.62.0",
-        "@typescript-eslint/tsconfig-utils": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/project-service": "8.56.1",
+        "@typescript-eslint/tsconfig-utils": "8.56.1",
+        "@typescript-eslint/types": "8.56.1",
+        "@typescript-eslint/visitor-keys": "8.56.1",
         "debug": "^4.4.3",
         "minimatch": "^10.2.2",
         "semver": "^7.7.3",
         "tinyglobby": "^0.2.15",
-        "ts-api-utils": "^2.5.0"
+        "ts-api-utils": "^2.4.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3827,13 +3804,11 @@
         "url": "https://opencollective.com/typescript-eslint"
       },
       "peerDependencies": {
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3842,8 +3817,6 @@
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
       "version": "5.0.6",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
-      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3855,8 +3828,6 @@
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
       "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
@@ -3870,16 +3841,14 @@
       }
     },
     "node_modules/@typescript-eslint/utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.0.tgz",
-      "integrity": "sha512-82r66fi9zYwZ+mTq3vKgwjbZ1PVk/DJzrXFLpG6RnBbdvH8TEGVHIs9H4d2drhkOzf0syZuD/OZvvlu6GDbP4g==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0"
+        "@typescript-eslint/scope-manager": "8.56.1",
+        "@typescript-eslint/types": "8.56.1",
+        "@typescript-eslint/typescript-estree": "8.56.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3890,17 +3859,15 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.0.tgz",
-      "integrity": "sha512-CY3uyFSRbcQv3nnSv8S0+lDftMVz6P963PoRlxrV7ew/Md564g9ut60PYzdLM5qW4jFn93GBF+Soi90ISAN+GQ==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/types": "8.56.1",
         "eslint-visitor-keys": "^5.0.0"
       },
       "engines": {
@@ -3913,8 +3880,6 @@
     },
     "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-5.0.1.tgz",
-      "integrity": "sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -3925,19 +3890,15 @@
       }
     },
     "node_modules/@valibot/to-json-schema": {
-      "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/@valibot/to-json-schema/-/to-json-schema-1.7.1.tgz",
-      "integrity": "sha512-3qkmU6KXWh8GIThEAW3kuRHPQBMjWkKy+Ppz3WkUucx53DTpOa6siMn4xDGSOhlVyMrDaJTCTMLYPZVAIk1P0A==",
+      "version": "1.5.0",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
-        "valibot": "^1.4.0"
+        "valibot": "^1.2.0"
       }
     },
     "node_modules/@vinejs/compiler": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@vinejs/compiler/-/compiler-3.0.0.tgz",
-      "integrity": "sha512-v9Lsv59nR56+bmy2p0+czjZxsLHwaibJ+SV5iK9JJfehlJMa501jUJQqqz4X/OqKXrxtE3uTQmSqjUqzF3B2mw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3947,8 +3908,6 @@
     },
     "node_modules/@vinejs/vine": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/@vinejs/vine/-/vine-3.0.1.tgz",
-      "integrity": "sha512-ZtvYkYpZOYdvbws3uaOAvTFuvFXoQGAtmzeiXu+XSMGxi5GVsODpoI9Xu9TplEMuD/5fmAtBbKb9cQHkWkLXDQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -3967,45 +3926,41 @@
       }
     },
     "node_modules/@vitest/browser": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-4.1.9.tgz",
-      "integrity": "sha512-j1BKtWmPcqpMhmx/L9EPLgAJpCb0zKfwoWLmqBbxaogCXHjOwHFSEoHCBfnGtx93xKQwilZ26m+UOsHqHMkRNg==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@blazediff/core": "1.9.1",
-        "@vitest/mocker": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/mocker": "4.0.18",
+        "@vitest/utils": "4.0.18",
         "magic-string": "^0.30.21",
+        "pixelmatch": "7.1.0",
         "pngjs": "^7.0.0",
         "sirv": "^3.0.2",
-        "tinyrainbow": "^3.1.0",
-        "ws": "^8.19.0"
+        "tinyrainbow": "^3.0.3",
+        "ws": "^8.18.3"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "vitest": "4.1.9"
+        "vitest": "4.0.18"
       }
     },
     "node_modules/@vitest/browser-playwright": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/browser-playwright/-/browser-playwright-4.1.9.tgz",
-      "integrity": "sha512-Bq1rOGf9waevzG3EOkO/dene6bvKTUsZMVg8S1i+WH3JcMjuXEjiahP9rAqZRELUqjBySOJsvvSWqK/B3wjKQw==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/browser": "4.1.9",
-        "@vitest/mocker": "4.1.9",
-        "tinyrainbow": "^3.1.0"
+        "@vitest/browser": "4.0.18",
+        "@vitest/mocker": "4.0.18",
+        "tinyrainbow": "^3.0.3"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
         "playwright": "*",
-        "vitest": "4.1.9"
+        "vitest": "4.0.18"
       },
       "peerDependenciesMeta": {
         "playwright": {
@@ -4014,29 +3969,27 @@
       }
     },
     "node_modules/@vitest/coverage-v8": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-4.1.9.tgz",
-      "integrity": "sha512-G9/lgqibheLVBDRuya45EbsEXTYcWoSG+TLg7i2axuzx0Eq62eXn+aWXyaVdV5vKvFSWd6ywcX8hA7la9Pvu8g==",
-      "devOptional": true,
+      "version": "4.0.18",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^1.0.2",
-        "@vitest/utils": "4.1.9",
-        "ast-v8-to-istanbul": "^1.0.0",
+        "@vitest/utils": "4.0.18",
+        "ast-v8-to-istanbul": "^0.3.10",
         "istanbul-lib-coverage": "^3.2.2",
         "istanbul-lib-report": "^3.0.1",
         "istanbul-reports": "^3.2.0",
-        "magicast": "^0.5.2",
+        "magicast": "^0.5.1",
         "obug": "^2.1.1",
-        "std-env": "^4.0.0-rc.1",
-        "tinyrainbow": "^3.1.0"
+        "std-env": "^3.10.0",
+        "tinyrainbow": "^3.0.3"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@vitest/browser": "4.1.9",
-        "vitest": "4.1.9"
+        "@vitest/browser": "4.0.18",
+        "vitest": "4.0.18"
       },
       "peerDependenciesMeta": {
         "@vitest/browser": {
@@ -4045,31 +3998,27 @@
       }
     },
     "node_modules/@vitest/expect": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-4.1.9.tgz",
-      "integrity": "sha512-vl/rYsUKcBr3SnQn166+XR5ZQcgMx3DQhFWdfli/cWpLnLUmbxZvyrJZotLFUryib+LtArYMSTJ5RbQ57ZqrlA==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@standard-schema/spec": "^1.1.0",
+        "@standard-schema/spec": "^1.0.0",
         "@types/chai": "^5.2.2",
-        "@vitest/spy": "4.1.9",
-        "@vitest/utils": "4.1.9",
-        "chai": "^6.2.2",
-        "tinyrainbow": "^3.1.0"
+        "@vitest/spy": "4.0.18",
+        "@vitest/utils": "4.0.18",
+        "chai": "^6.2.1",
+        "tinyrainbow": "^3.0.3"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vitest/mocker": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-4.1.9.tgz",
-      "integrity": "sha512-EVkXzBjrPGM+cK8/ANWgBrkUCfJfb38/EfTSO8h7pWvKkyPkpWxvR7BkD2MyItMF62C97zAEoqdpUixwR/e+Rw==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/spy": "4.1.9",
+        "@vitest/spy": "4.0.18",
         "estree-walker": "^3.0.3",
         "magic-string": "^0.30.21"
       },
@@ -4078,7 +4027,7 @@
       },
       "peerDependencies": {
         "msw": "^2.4.9",
-        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+        "vite": "^6.0.0 || ^7.0.0-0"
       },
       "peerDependenciesMeta": {
         "msw": {
@@ -4091,8 +4040,6 @@
     },
     "node_modules/@vitest/mocker/node_modules/estree-walker": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -4100,26 +4047,22 @@
       }
     },
     "node_modules/@vitest/pretty-format": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-4.1.9.tgz",
-      "integrity": "sha512-s0iufns3iIFitdgm+YR7g1whCAaGtXz459VS9/PqyKDEEFgYIhsHOQmXgIgDuYCt7DeQmiZT0Qe2OA2p4ZPu5A==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "tinyrainbow": "^3.1.0"
+        "tinyrainbow": "^3.0.3"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-4.1.9.tgz",
-      "integrity": "sha512-KXLMDtc7oe70+3mJfGrPUWPesswH+3sTxAMAMl8DG7I8IUQT4XW718dY5ID3vPUcmlu27CcKfY4P3h3I29SLJg==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "4.1.9",
+        "@vitest/utils": "4.0.18",
         "pathe": "^2.0.3"
       },
       "funding": {
@@ -4127,14 +4070,11 @@
       }
     },
     "node_modules/@vitest/snapshot": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-4.1.9.tgz",
-      "integrity": "sha512-Jc7RKGNBo8Z28WYIm0Niej4xdSPByRf6mU58VpHQkd6Zh05rlnA+twjbK5HyeIGHxrzsc3mJgS43uM0CZKzaIA==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.9",
-        "@vitest/utils": "4.1.9",
+        "@vitest/pretty-format": "4.0.18",
         "magic-string": "^0.30.21",
         "pathe": "^2.0.3"
       },
@@ -4143,9 +4083,7 @@
       }
     },
     "node_modules/@vitest/spy": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-4.1.9.tgz",
-      "integrity": "sha512-fHpsS6mIi+PiEW+vcRVOMkX1oSaPKne3VOclSFICPcGOmfKgXPU5iAah+wcNcj2xPrCCmfq99IDGf+EojhhvhA==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "funding": {
@@ -4153,15 +4091,12 @@
       }
     },
     "node_modules/@vitest/utils": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-4.1.9.tgz",
-      "integrity": "sha512-A51o8ymO5PpqlWNnBP9ZHPXDIpuMtTLlGSjN7la4US+LJzoUMyhwjA5QXlm39JexgwHKW4Xjs8Z2d3dLCXOeuA==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "4.1.9",
-        "convert-source-map": "^2.0.0",
-        "tinyrainbow": "^3.1.0"
+        "@vitest/pretty-format": "4.0.18",
+        "tinyrainbow": "^3.0.3"
       },
       "funding": {
         "url": "https://opencollective.com/vitest"
@@ -4169,8 +4104,6 @@
     },
     "node_modules/abbrev": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-3.0.1.tgz",
-      "integrity": "sha512-AO2ac6pjRB3SJmGJo+v5/aK6Omggp6fsLrs6wN9bd35ulu4cCwaAU9+7ZhXjeqHVkaHThLuzH0nZr0YpCDhygg==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -4178,10 +4111,19 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
     "node_modules/accepts": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-2.0.0.tgz",
-      "integrity": "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4193,9 +4135,7 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.17.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
-      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
+      "version": "8.16.0",
       "devOptional": true,
       "license": "MIT",
       "bin": {
@@ -4207,8 +4147,6 @@
     },
     "node_modules/acorn-jsx": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
-      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -4216,9 +4154,9 @@
       }
     },
     "node_modules/adm-zip": {
-      "version": "0.5.17",
-      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.17.tgz",
-      "integrity": "sha512-+Ut8d9LLqwEvHHJl1+PIHqoyDxFgVN847JTVM3Izi3xHDWPE4UtzzXysMZQs64DMcrJfBeS/uoEP4AD3HQHnQQ==",
+      "version": "0.5.18",
+      "resolved": "https://registry.npmjs.org/adm-zip/-/adm-zip-0.5.18.tgz",
+      "integrity": "sha512-ufJnssQGbxzLNS1Ho9bCtX4rQKCCvoVuDLHoJyc3F9dOGDB4BkWs2Ci0kv53lqocAEQ/Cbi+I2XCsNYGqVYqng==",
       "license": "MIT",
       "engines": {
         "node": ">=12.0"
@@ -4226,8 +4164,6 @@
     },
     "node_modules/agent-base": {
       "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
-      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -4236,17 +4172,14 @@
       }
     },
     "node_modules/ajv": {
-      "version": "8.20.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
-      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "version": "6.15.0",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
-        "fast-deep-equal": "^3.1.3",
-        "fast-uri": "^3.0.1",
-        "json-schema-traverse": "^1.0.0",
-        "require-from-string": "^2.0.2"
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
       },
       "funding": {
         "type": "github",
@@ -4255,8 +4188,6 @@
     },
     "node_modules/ajv-formats": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
-      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -4274,8 +4205,6 @@
     },
     "node_modules/ajv-formats-draft2019": {
       "version": "1.6.1",
-      "resolved": "https://registry.npmjs.org/ajv-formats-draft2019/-/ajv-formats-draft2019-1.6.1.tgz",
-      "integrity": "sha512-JQPvavpkWDvIsBp2Z33UkYCtXCSpW4HD3tAZ+oL4iEFOk9obQZffx0yANwECt6vzr6ET+7HN5czRyqXbnq/u0Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -4289,13 +4218,32 @@
         "ajv": "*"
       }
     },
+    "node_modules/ajv-formats/node_modules/ajv": {
+      "version": "8.20.0",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats/node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/ansi-regex": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
-      "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=12"
       },
@@ -4305,8 +4253,6 @@
     },
     "node_modules/ansi-styles": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4321,8 +4267,6 @@
     },
     "node_modules/antlr-ng": {
       "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/antlr-ng/-/antlr-ng-1.0.10.tgz",
-      "integrity": "sha512-fw3NdsQP3dabuZrDhKAMewrBsY5KSAcMrvhWBVDmHYegv5D51pypzCYK1PpjaRVKcVeP/5xKfqJY31TvXACOdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4340,8 +4284,6 @@
     },
     "node_modules/antlr-ng/node_modules/commander": {
       "version": "13.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-13.1.0.tgz",
-      "integrity": "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4350,8 +4292,6 @@
     },
     "node_modules/antlr4-c3": {
       "version": "3.4.4",
-      "resolved": "https://registry.npmjs.org/antlr4-c3/-/antlr4-c3-3.4.4.tgz",
-      "integrity": "sha512-ixp1i17ypbRzZnffdarIfCVEXJwPydtDt61SHMGkc+UCD7rrbfvHESTMTgx8jFhUgKAgcHyt9060kQ8nU3vlxA==",
       "license": "MIT",
       "dependencies": {
         "antlr4ng": "3.0.16"
@@ -4359,21 +4299,125 @@
     },
     "node_modules/antlr4ng": {
       "version": "3.0.16",
-      "resolved": "https://registry.npmjs.org/antlr4ng/-/antlr4ng-3.0.16.tgz",
-      "integrity": "sha512-DQuJkC7kX3xunfF4K2KsWTSvoxxslv+FQp/WHQZTJSsH2Ec3QfFmrxC3Nky2ok9yglXn6nHM4zUaVDxcN5f6kA==",
       "license": "BSD-3-Clause"
     },
+    "node_modules/archiver": {
+      "version": "7.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "archiver-utils": "^5.0.2",
+        "async": "^3.2.4",
+        "buffer-crc32": "^1.0.0",
+        "readable-stream": "^4.0.0",
+        "readdir-glob": "^1.1.2",
+        "tar-stream": "^3.0.0",
+        "zip-stream": "^6.0.1"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/archiver-utils": {
+      "version": "5.0.2",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "glob": "^10.0.0",
+        "graceful-fs": "^4.2.0",
+        "is-stream": "^2.0.1",
+        "lazystream": "^1.0.0",
+        "lodash": "^4.17.15",
+        "normalize-path": "^3.0.0",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/archiver-utils/node_modules/buffer": {
+      "version": "6.0.3",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "node_modules/archiver-utils/node_modules/readable-stream": {
+      "version": "4.7.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/archiver/node_modules/buffer": {
+      "version": "6.0.3",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "node_modules/archiver/node_modules/readable-stream": {
+      "version": "4.7.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
-      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
       "dev": true,
       "license": "Python-2.0"
     },
     "node_modules/aria-query": {
       "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.1.tgz",
-      "integrity": "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g==",
       "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
@@ -4381,9 +4425,7 @@
       }
     },
     "node_modules/arkregex": {
-      "version": "0.0.6",
-      "resolved": "https://registry.npmjs.org/arkregex/-/arkregex-0.0.6.tgz",
-      "integrity": "sha512-9mvuMKQuibfWhBrsNYhsKhNb6k9oEHoAJ/FvDiqe8h+E9Siwe0/cro1WVOGgpajXQ9ZHd24yCOf2k35Q/QqUQw==",
+      "version": "0.0.5",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -4392,29 +4434,31 @@
       }
     },
     "node_modules/arktype": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/arktype/-/arktype-2.2.1.tgz",
-      "integrity": "sha512-CWPJxNoSxrS+NYGB3ufwc/blFonESEW5vBQyYPVS0rf4STu8VWoAWfKJSl5vVVm56h4yxpwbODeYwy6XFKvojA==",
+      "version": "2.1.29",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
         "@ark/schema": "0.56.0",
         "@ark/util": "0.56.0",
-        "arkregex": "0.0.6"
+        "arkregex": "0.0.5"
       }
     },
     "node_modules/array-timsort": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/array-timsort/-/array-timsort-1.0.3.tgz",
-      "integrity": "sha512-/+3GRL7dDAGEfM6TseQk/U+mi18TU2Ms9I3UlLdUMhz2hbvGNTKdj9xniwXfUqgYhHxRx0+8UnKkvlNwVU+cWQ==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/asn1": {
+      "version": "0.2.6",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safer-buffer": "~2.1.0"
+      }
+    },
     "node_modules/assertion-error": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
-      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -4422,10 +4466,8 @@
       }
     },
     "node_modules/ast-v8-to-istanbul": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/ast-v8-to-istanbul/-/ast-v8-to-istanbul-1.0.4.tgz",
-      "integrity": "sha512-0bC0/4bTSrnwdhU3IsZDwEdojvuPrSg59OYZfKsLRtJZ0u8VBx9DebfqqG8bRdCC0I7vjgxmPi41P0lpkhJHtA==",
-      "devOptional": true,
+      "version": "0.3.12",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.31",
@@ -4435,18 +4477,24 @@
     },
     "node_modules/ast-v8-to-istanbul/node_modules/estree-walker": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
-      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.0"
       }
     },
+    "node_modules/async": {
+      "version": "3.2.6",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/async-lock": {
+      "version": "1.4.1",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/atomic-sleep": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
-      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
       "license": "MIT",
       "engines": {
         "node": ">=8.0.0"
@@ -4454,8 +4502,6 @@
     },
     "node_modules/axobject-query": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/axobject-query/-/axobject-query-4.1.0.tgz",
-      "integrity": "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==",
       "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
@@ -4464,8 +4510,6 @@
     },
     "node_modules/b4a": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.8.1.tgz",
-      "integrity": "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "react-native-b4a": "*"
@@ -4478,15 +4522,11 @@
     },
     "node_modules/balanced-match": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/bare-events": {
       "version": "2.9.1",
-      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.9.1.tgz",
-      "integrity": "sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "bare-abort-controller": "*"
@@ -4499,8 +4539,6 @@
     },
     "node_modules/bare-fs": {
       "version": "4.7.2",
-      "resolved": "https://registry.npmjs.org/bare-fs/-/bare-fs-4.7.2.tgz",
-      "integrity": "sha512-aTvMFUWkBmjzKtEQMDGGDNF8bkfpD5N1b/FCwt7A3wrU4t1o/e/85Wzkluh6JlODCjqVESYCkQCdTXqZ9G7VFg==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-events": "^2.5.4",
@@ -4523,8 +4561,6 @@
     },
     "node_modules/bare-os": {
       "version": "3.9.1",
-      "resolved": "https://registry.npmjs.org/bare-os/-/bare-os-3.9.1.tgz",
-      "integrity": "sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ==",
       "license": "Apache-2.0",
       "engines": {
         "bare": ">=1.14.0"
@@ -4532,20 +4568,15 @@
     },
     "node_modules/bare-path": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/bare-path/-/bare-path-3.0.1.tgz",
-      "integrity": "sha512-ghj2DSK/2e99a1anTVPCV4m4YIYtrbXhfM7V3D7XZLOTsybnYyaJloymGqssQc8l/or0UoDyRtNQkmkEF/ysgQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-os": "^3.0.1"
       }
     },
     "node_modules/bare-stream": {
-      "version": "2.13.3",
-      "resolved": "https://registry.npmjs.org/bare-stream/-/bare-stream-2.13.3.tgz",
-      "integrity": "sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ==",
+      "version": "2.13.1",
       "license": "Apache-2.0",
       "dependencies": {
-        "b4a": "^1.8.1",
         "streamx": "^2.25.0",
         "teex": "^1.0.1"
       },
@@ -4568,8 +4599,6 @@
     },
     "node_modules/bare-url": {
       "version": "2.4.5",
-      "resolved": "https://registry.npmjs.org/bare-url/-/bare-url-2.4.5.tgz",
-      "integrity": "sha512-K+y9xF1tN+CdPu4qWwr0QiK1Al07eFPGYK5M2pDXcmHdMdgC/tT/bpmMe1hrmRHaidKLkXrC+cRNYf3XVDUhSQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-path": "^3.0.0"
@@ -4577,8 +4606,6 @@
     },
     "node_modules/base64-js": {
       "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
       "funding": [
         {
           "type": "github",
@@ -4597,8 +4624,6 @@
     },
     "node_modules/basic-auth": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-2.0.1.tgz",
-      "integrity": "sha512-NF+epuEdnUYVlGuhaxbbq+dvJttwLnGY+YixlXlME5KpQ5W3CnXA5cVTneY3SPbPDRkcjMbifrwmFYcClgOZeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4608,6 +4633,14 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/bcrypt-pbkdf": {
+      "version": "1.0.2",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "tweetnacl": "^0.14.3"
+      }
+    },
     "node_modules/better-auth": {
       "version": "1.6.20",
       "resolved": "https://registry.npmjs.org/better-auth/-/better-auth-1.6.20.tgz",
@@ -4735,8 +4768,6 @@
     },
     "node_modules/bindings": {
       "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/bindings/-/bindings-1.5.0.tgz",
-      "integrity": "sha512-p2q/t/mhvuOj/UeLlV6566GD/guowlr0hHxClI0W9m7MWYkL1F0hLo+0Aexs9HSPCtR1SXQ0TD3MMKrXZajbiQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -4746,8 +4777,6 @@
     },
     "node_modules/bintrees": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/bintrees/-/bintrees-1.0.2.tgz",
-      "integrity": "sha512-VOMgTMwjAaUG580SXn3LacVgjurrbMme7ZZNYGSSV7mmtY6QQRh0Eg3pwIcntQ77DErK1L0NxkbetjcoXzVwKw==",
       "license": "MIT"
     },
     "node_modules/bl": {
@@ -4756,7 +4785,6 @@
       "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "buffer": "^5.5.0",
         "inherits": "^2.0.4",
@@ -4764,36 +4792,20 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.2.2",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^1.0.5",
         "debug": "^4.4.3",
-        "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "http-errors": "^2.0.0",
+        "iconv-lite": "^0.7.0",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
-        "raw-body": "^3.0.2",
-        "type-is": "^2.1.0"
-      },
-      "engines": {
-        "node": ">=18"
+        "qs": "^6.14.1",
+        "raw-body": "^3.0.1",
+        "type-is": "^2.0.1"
       },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
-    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
-      "dev": true,
-      "license": "MIT",
       "engines": {
         "node": ">=18"
       },
@@ -4802,33 +4814,12 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/body-parser/node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/bowser": {
       "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/bowser/-/bowser-2.14.1.tgz",
-      "integrity": "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg==",
       "license": "MIT"
     },
     "node_modules/brace-expansion": {
       "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
-      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4838,25 +4829,43 @@
     },
     "node_modules/buffer": {
       "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.6.0.tgz",
-      "integrity": "sha512-/gDYp/UtU0eA1ys8bOs9J6a+E/KWIY+DZ+Q2WESNUA0jFRsJOc0SNUO6xJ5SGA1xueg3NL65W6s+NY5l9cunuw==",
       "license": "MIT",
       "dependencies": {
         "base64-js": "^1.0.2",
         "ieee754": "^1.1.4"
       }
     },
+    "node_modules/buffer-crc32": {
+      "version": "1.0.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
     "node_modules/buffer-from": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/buildcheck": {
+      "version": "0.0.7",
+      "dev": true,
+      "optional": true,
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/byline": {
+      "version": "5.0.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/bytes": {
       "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
-      "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4865,8 +4874,6 @@
     },
     "node_modules/cacache": {
       "version": "19.0.1",
-      "resolved": "https://registry.npmjs.org/cacache/-/cacache-19.0.1.tgz",
-      "integrity": "sha512-hdsUxulXCi5STId78vRVYEtDAjq99ICAUktLTeTYsLoTE6Z8dS0c8pWNCxwdrk9YfJeobDZc2Y186hD/5ZQgFQ==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -4890,8 +4897,6 @@
     },
     "node_modules/call-bind-apply-helpers": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
-      "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4904,8 +4909,6 @@
     },
     "node_modules/call-bound": {
       "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
-      "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4921,8 +4924,6 @@
     },
     "node_modules/callsites": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
-      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4931,8 +4932,6 @@
     },
     "node_modules/camelcase": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-8.0.0.tgz",
-      "integrity": "sha512-8WB3Jcas3swSvjIeA2yvCJ+Miyz5l1ZmB6HFb9R1317dt9LCQoswg/BGrmAmkWVEszSrrg4RwmO46qIm2OEnSA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -4945,8 +4944,6 @@
     },
     "node_modules/chai": {
       "version": "6.2.2",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
-      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -4955,8 +4952,6 @@
     },
     "node_modules/chalk": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
-      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4972,8 +4967,6 @@
     },
     "node_modules/chokidar": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz",
-      "integrity": "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4987,20 +4980,12 @@
       }
     },
     "node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
+      "version": "1.1.4",
       "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true,
-      "engines": {
-        "node": ">=18"
-      }
+      "license": "ISC"
     },
     "node_modules/class-validator": {
       "version": "0.14.4",
-      "resolved": "https://registry.npmjs.org/class-validator/-/class-validator-0.14.4.tgz",
-      "integrity": "sha512-AwNusCCam51q703dW82x95tOqQp6oC9HNUl724KxJJOfnKscI8dOloXFgyez7LbTTKWuRBA37FScqVbJEoq8Yw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5010,10 +4995,74 @@
         "validator": "^13.15.22"
       }
     },
+    "node_modules/cliui": {
+      "version": "8.0.1",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.1",
+        "wrap-ansi": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/cliui/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/cliui/node_modules/string-width": {
+      "version": "4.2.3",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/cliui/node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
     "node_modules/clsx": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/clsx/-/clsx-2.1.1.tgz",
-      "integrity": "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -5022,8 +5071,6 @@
     },
     "node_modules/color-convert": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5035,67 +5082,105 @@
     },
     "node_modules/color-name": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/colorette": {
       "version": "2.0.20",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-2.0.20.tgz",
-      "integrity": "sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/commander": {
-      "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-14.0.3.tgz",
-      "integrity": "sha512-H+y0Jo/T1RZ9qPP4Eh1pkcQcLRglraJaSLoyOtHxu6AapkjWVCy2Sit1QQ4x3Dng8qDlSsZEet7g5Pq06MvTgw==",
+      "version": "11.1.0",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=20"
+      "engines": {
+        "node": ">=16"
+      }
+    },
+    "node_modules/comment-json": {
+      "version": "4.5.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "array-timsort": "^1.0.3",
+        "core-util-is": "^1.0.3",
+        "esprima": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/commondir": {
+      "version": "1.0.1",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/compress-commons": {
+      "version": "6.0.2",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "crc-32": "^1.2.0",
+        "crc32-stream": "^6.0.0",
+        "is-stream": "^2.0.1",
+        "normalize-path": "^3.0.0",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/compress-commons/node_modules/buffer": {
+      "version": "6.0.3",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
       }
     },
-    "node_modules/comment-json": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/comment-json/-/comment-json-4.6.2.tgz",
-      "integrity": "sha512-R2rze/hDX30uul4NZoIZ76ImSJLFxn/1/ZxtKC1L77y2X1k+yYu1joKbAtMA2Fg3hZrTOiw0I5mwVMo0cf250w==",
+    "node_modules/compress-commons/node_modules/readable-stream": {
+      "version": "4.7.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "array-timsort": "^1.0.3",
-        "esprima": "^4.0.1"
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
       },
       "engines": {
-        "node": ">= 6"
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
       }
     },
-    "node_modules/commondir": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
-      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/concat-map": {
       "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/confbox": {
       "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.2.4.tgz",
-      "integrity": "sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/consola": {
       "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/consola/-/consola-3.4.0.tgz",
-      "integrity": "sha512-EiPU8G6dQG0GFHNR8ljnZFki/8a+cQwEQ+7wpxdChl02Q8HXlwEZWD5lqAF8vC2sEC3Tehr8hy7vErz88LHyUA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5103,9 +5188,7 @@
       }
     },
     "node_modules/content-disposition": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
-      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
+      "version": "1.0.1",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5118,25 +5201,14 @@
     },
     "node_modules/content-type": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/convert-source-map": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
-      "integrity": "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==",
-      "devOptional": true,
-      "license": "MIT"
-    },
     "node_modules/cookie": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.6.0.tgz",
-      "integrity": "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -5145,18 +5217,19 @@
     },
     "node_modules/cookie-signature": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
-      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=6.6.0"
       }
     },
+    "node_modules/core-util-is": {
+      "version": "1.0.3",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/cors": {
       "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.6.tgz",
-      "integrity": "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5171,10 +5244,82 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/cpu-features": {
+      "version": "0.0.10",
+      "dev": true,
+      "hasInstallScript": true,
+      "optional": true,
+      "dependencies": {
+        "buildcheck": "~0.0.6",
+        "nan": "^2.19.0"
+      },
+      "engines": {
+        "node": ">=10.0.0"
+      }
+    },
+    "node_modules/crc-32": {
+      "version": "1.2.2",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "crc32": "bin/crc32.njs"
+      },
+      "engines": {
+        "node": ">=0.8"
+      }
+    },
+    "node_modules/crc32-stream": {
+      "version": "6.0.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "crc-32": "^1.2.0",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/crc32-stream/node_modules/buffer": {
+      "version": "6.0.3",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "node_modules/crc32-stream/node_modules/readable-stream": {
+      "version": "4.7.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
     "node_modules/cross-spawn": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5188,8 +5333,6 @@
     },
     "node_modules/cssesc": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -5200,9 +5343,7 @@
       }
     },
     "node_modules/daisyui": {
-      "version": "5.5.23",
-      "resolved": "https://registry.npmjs.org/daisyui/-/daisyui-5.5.23.tgz",
-      "integrity": "sha512-xuheNUSL4T6ZVtWXoioqcNkjoyGX85QTDz4HTw2aBPfqk4fuMjax5HDo8qCmpV6M1YN8bGvfx5BpYCoDeRlt+A==",
+      "version": "5.5.19",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -5211,8 +5352,6 @@
     },
     "node_modules/dateformat": {
       "version": "4.6.3",
-      "resolved": "https://registry.npmjs.org/dateformat/-/dateformat-4.6.3.tgz",
-      "integrity": "sha512-2P0p0pFGzHS5EMnhdxQi7aJN+iMheud0UhG4dlE1DLAlvL8JHjJJTX/CSm4JXwV0Ka5nGk3zC5mcb5bUQUxxMA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5220,17 +5359,13 @@
       }
     },
     "node_modules/dayjs": {
-      "version": "1.11.21",
-      "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.21.tgz",
-      "integrity": "sha512-98IT+HOahAisibz/yjKbzuOBwYcjJ7BCLPzARyHiyEBmRz4fatF+KPJszEHXsGYjUG234aH/cOjW1wwTbKUZlA==",
+      "version": "1.11.19",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/debug": {
       "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5247,8 +5382,6 @@
     },
     "node_modules/decompress-response": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
-      "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5264,8 +5397,6 @@
     },
     "node_modules/dedent": {
       "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/dedent/-/dedent-1.5.1.tgz",
-      "integrity": "sha512-+LxW+KLWxu3HW3M2w2ympwtqPrqYRzU8fqi6Fhd18fBALe15blJPI/I4+UHveMVG6lJqB4JNd4UG0S5cnVHwIg==",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -5279,8 +5410,6 @@
     },
     "node_modules/deep-extend": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
-      "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5290,15 +5419,11 @@
     },
     "node_modules/deep-is": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
-      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/deepmerge": {
       "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz",
-      "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -5306,15 +5431,11 @@
       }
     },
     "node_modules/defu": {
-      "version": "6.1.7",
-      "resolved": "https://registry.npmjs.org/defu/-/defu-6.1.7.tgz",
-      "integrity": "sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==",
+      "version": "6.1.4",
       "license": "MIT"
     },
     "node_modules/depd": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
-      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5323,8 +5444,6 @@
     },
     "node_modules/detect-libc": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
-      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
       "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5332,32 +5451,65 @@
       }
     },
     "node_modules/devalue": {
-      "version": "5.8.1",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.1.tgz",
-      "integrity": "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==",
+      "version": "5.6.3",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/discontinuous-range": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/discontinuous-range/-/discontinuous-range-1.0.0.tgz",
-      "integrity": "sha512-c68LpLbO+7kP/b1Hr1qs8/BJ09F5khZGTxqxZuhzxpmwJKOgRFHJWIb9/KmqnqHhLdO55aOxFH/EGBvUQbL/RQ==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/dlv": {
       "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/dlv/-/dlv-1.1.3.tgz",
-      "integrity": "sha512-+HlytyjlPKnIG8XuRG8WvmBP8xs8P71y+SKKS6ZXWoEgLuePxtDoUEiH7WkdePWrQ5JBpE6aoVqfZfJUQkjXwA==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
+    "node_modules/docker-compose": {
+      "version": "1.4.2",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "yaml": "^2.2.2"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/docker-modem": {
+      "version": "5.0.7",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "debug": "^4.1.1",
+        "readable-stream": "^3.5.0",
+        "split-ca": "^1.0.1",
+        "ssh2": "^1.15.0"
+      },
+      "engines": {
+        "node": ">= 8.0"
+      }
+    },
+    "node_modules/dockerode": {
+      "version": "5.0.0",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "@balena/dockerignore": "^1.0.2",
+        "@grpc/grpc-js": "^1.11.1",
+        "@grpc/proto-loader": "^0.7.13",
+        "docker-modem": "^5.0.7",
+        "protobufjs": "^7.3.2",
+        "tar-fs": "^2.1.4"
+      },
+      "engines": {
+        "node": ">= 14.17"
+      }
+    },
     "node_modules/dompurify": {
       "version": "3.2.7",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.7.tgz",
-      "integrity": "sha512-WhL/YuveyGXJaerVlMYGWhvQswa7myDG17P7Vu65EWC05o8vfeNbvNf4d/BOvH99+ZW+LlQsc1GDKMa1vNK6dw==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"
@@ -5365,8 +5517,6 @@
     },
     "node_modules/drizzle-kit": {
       "version": "0.31.10",
-      "resolved": "https://registry.npmjs.org/drizzle-kit/-/drizzle-kit-0.31.10.tgz",
-      "integrity": "sha512-7OZcmQUrdGI+DUNNsKBn1aW8qSoKuTH7d0mYgSP8bAzdFzKoovxEFnoGQp2dVs82EOJeYycqRtciopszwUf8bw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -5381,8 +5531,6 @@
     },
     "node_modules/drizzle-orm": {
       "version": "0.45.2",
-      "resolved": "https://registry.npmjs.org/drizzle-orm/-/drizzle-orm-0.45.2.tgz",
-      "integrity": "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q==",
       "license": "Apache-2.0",
       "peerDependencies": {
         "@aws-sdk/client-rds-data": ">=3",
@@ -5506,8 +5654,6 @@
     },
     "node_modules/dunder-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
-      "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5521,23 +5667,16 @@
     },
     "node_modules/eastasianwidth": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
-      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/ee-first": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
-      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/effect": {
-      "version": "3.21.4",
-      "resolved": "https://registry.npmjs.org/effect/-/effect-3.21.4.tgz",
-      "integrity": "sha512-B89v/xSgPbl1J2Ai2u18jxq3odpFauU1rC6/eSs4FeNHi72kwKdJp12VGigvRV2lK+kRnx+OOz41XV8guZd4gQ==",
+      "version": "3.21.3",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5548,16 +5687,11 @@
     },
     "node_modules/emoji-regex": {
       "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
-      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/encodeurl": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
-      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5566,8 +5700,6 @@
     },
     "node_modules/encoding": {
       "version": "0.1.13",
-      "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
-      "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5575,10 +5707,20 @@
         "iconv-lite": "^0.6.2"
       }
     },
+    "node_modules/encoding/node_modules/iconv-lite": {
+      "version": "0.6.3",
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/end-of-stream": {
       "version": "1.4.5",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.5.tgz",
-      "integrity": "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5586,14 +5728,12 @@
       }
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.21.6",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.21.6.tgz",
-      "integrity": "sha512-aNnGCvbJ/RIyWo1IuhNdVjnNF+EjH9wpzpNHt+ci/m9He9LJvUN8wrCcXjp9cWsGNAuvSpVFTx/vraAFQ8qGjQ==",
+      "version": "5.19.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
-        "tapable": "^2.3.3"
+        "tapable": "^2.3.0"
       },
       "engines": {
         "node": ">=10.13.0"
@@ -5601,8 +5741,6 @@
     },
     "node_modules/env-paths": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
-      "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -5612,16 +5750,12 @@
     },
     "node_modules/err-code": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
-      "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/es-define-property": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
-      "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5630,8 +5764,6 @@
     },
     "node_modules/es-errors": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
-      "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5639,16 +5771,12 @@
       }
     },
     "node_modules/es-module-lexer": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.1.0.tgz",
-      "integrity": "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ==",
+      "version": "1.7.0",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/es-object-atoms": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.2.tgz",
-      "integrity": "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==",
+      "version": "1.1.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5660,8 +5788,6 @@
     },
     "node_modules/esbuild": {
       "version": "0.25.12",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.12.tgz",
-      "integrity": "sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -5700,17 +5826,21 @@
         "@esbuild/win32-x64": "0.25.12"
       }
     },
+    "node_modules/escalade": {
+      "version": "3.2.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/escape-html": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
-      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/escape-string-regexp": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
-      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -5721,25 +5851,23 @@
       }
     },
     "node_modules/eslint": {
-      "version": "9.39.4",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-9.39.4.tgz",
-      "integrity": "sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==",
+      "version": "9.39.2",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.1",
-        "@eslint/config-array": "^0.21.2",
+        "@eslint/config-array": "^0.21.1",
         "@eslint/config-helpers": "^0.4.2",
         "@eslint/core": "^0.17.0",
-        "@eslint/eslintrc": "^3.3.5",
-        "@eslint/js": "9.39.4",
+        "@eslint/eslintrc": "^3.3.1",
+        "@eslint/js": "9.39.2",
         "@eslint/plugin-kit": "^0.4.1",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.4.2",
         "@types/estree": "^1.0.6",
-        "ajv": "^6.14.0",
+        "ajv": "^6.12.4",
         "chalk": "^4.0.0",
         "cross-spawn": "^7.0.6",
         "debug": "^4.3.2",
@@ -5758,7 +5886,7 @@
         "is-glob": "^4.0.0",
         "json-stable-stringify-without-jsonify": "^1.0.1",
         "lodash.merge": "^4.6.2",
-        "minimatch": "^3.1.5",
+        "minimatch": "^3.1.2",
         "natural-compare": "^1.4.0",
         "optionator": "^0.9.3"
       },
@@ -5782,8 +5910,6 @@
     },
     "node_modules/eslint-config-prettier": {
       "version": "10.1.8",
-      "resolved": "https://registry.npmjs.org/eslint-config-prettier/-/eslint-config-prettier-10.1.8.tgz",
-      "integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -5797,20 +5923,18 @@
       }
     },
     "node_modules/eslint-plugin-better-tailwindcss": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-better-tailwindcss/-/eslint-plugin-better-tailwindcss-4.6.0.tgz",
-      "integrity": "sha512-Xeh/6KzLeays6jXSqTKx6iCdJL1qo5ant/mAabbz7dJqADYebKUUPR2zXp1xuiqqJ3HIm+MN+Ql2m4Jp0BxkMQ==",
+      "version": "4.3.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@eslint/css-tree": "^4.0.1",
-        "@valibot/to-json-schema": "^1.6.0",
-        "enhanced-resolve": "^5.20.1",
+        "@eslint/css-tree": "^3.6.8",
+        "@valibot/to-json-schema": "^1.5.0",
+        "enhanced-resolve": "^5.19.0",
         "jiti": "^2.6.1",
         "synckit": "^0.11.12",
-        "tailwind-csstree": "^0.3.2",
+        "tailwind-csstree": "^0.1.4",
         "tsconfig-paths-webpack-plugin": "^4.2.0",
-        "valibot": "^1.3.1"
+        "valibot": "^1.2.0"
       },
       "engines": {
         "node": "^20.19.0 || ^22.12.0 || >=23.0.0"
@@ -5830,9 +5954,7 @@
       }
     },
     "node_modules/eslint-plugin-security": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-security/-/eslint-plugin-security-4.0.1.tgz",
-      "integrity": "sha512-/lZCkOxPOWaf1jXAqgICrS8St3BMBccIPvhOSUYuV6VCr1o5nFVG998FnTLt6w2Nxb8Uo0nM8fzmnhp+GY/aEg==",
+      "version": "4.0.0",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -5846,9 +5968,7 @@
       }
     },
     "node_modules/eslint-plugin-svelte": {
-      "version": "3.19.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-svelte/-/eslint-plugin-svelte-3.19.0.tgz",
-      "integrity": "sha512-t3rNaZeXz4d2gG4uJyMEYfJCFKf22+SWbSizIIXIWKu4wM+XPLiMWuSSr/C5821JmFeN9ogK+eExbG+z+twyxw==",
+      "version": "3.15.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5861,7 +5981,7 @@
         "postcss-load-config": "^3.1.4",
         "postcss-safe-parser": "^7.0.0",
         "semver": "^7.6.3",
-        "svelte-eslint-parser": "^1.7.0"
+        "svelte-eslint-parser": "^1.4.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -5881,8 +6001,6 @@
     },
     "node_modules/eslint-scope": {
       "version": "8.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-8.4.0.tgz",
-      "integrity": "sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -5898,8 +6016,6 @@
     },
     "node_modules/eslint-visitor-keys": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.1.tgz",
-      "integrity": "sha512-Uhdk5sfqcee/9H/rCOJikYz67o0a2Tw2hGRPOG2Y1R2dg7brRe1uG0yaNQDHu+TO/uQPF/5eCapvYSmHUjt7JQ==",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -5911,8 +6027,6 @@
     },
     "node_modules/eslint/node_modules/@eslint/core": {
       "version": "0.17.0",
-      "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.17.0.tgz",
-      "integrity": "sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -5922,41 +6036,13 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
-    "node_modules/eslint/node_modules/ajv": {
-      "version": "6.15.0",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.15.0.tgz",
-      "integrity": "sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^3.1.1",
-        "fast-json-stable-stringify": "^2.0.0",
-        "json-schema-traverse": "^0.4.1",
-        "uri-js": "^4.2.2"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/epoberezkin"
-      }
-    },
-    "node_modules/eslint/node_modules/json-schema-traverse": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
-      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/esm-env": {
       "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/esm-env/-/esm-env-1.2.2.tgz",
-      "integrity": "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/espree": {
       "version": "10.4.0",
-      "resolved": "https://registry.npmjs.org/espree/-/espree-10.4.0.tgz",
-      "integrity": "sha512-j6PAQ2uUr79PZhBjP5C5fhl8e39FmRnOjsD5lGnWrFU8i2G776tBK7+nP8KuQUTTyAZUwfQqXAgrVH5MbH9CYQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -5973,8 +6059,6 @@
     },
     "node_modules/esprima": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/esprima/-/esprima-4.0.1.tgz",
-      "integrity": "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A==",
       "dev": true,
       "license": "BSD-2-Clause",
       "bin": {
@@ -5987,8 +6071,6 @@
     },
     "node_modules/esquery": {
       "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.7.0.tgz",
-      "integrity": "sha512-Ap6G0WQwcU/LHsvLwON1fAQX9Zp0A2Y6Y/cJBl9r/JbW90Zyg4/zbG6zzKa2OTALELarYHmKu0GhpM5EO+7T0g==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -5999,27 +6081,15 @@
       }
     },
     "node_modules/esrap": {
-      "version": "2.2.12",
-      "resolved": "https://registry.npmjs.org/esrap/-/esrap-2.2.12.tgz",
-      "integrity": "sha512-On0QbLyaiAkVC4eXtgnXK9Kh2opit+3rcUSOc45DqJ2s/X2eXAHsGOKRSJ6IDagQEW5vPyivANfXUiqgXC67Rw==",
+      "version": "2.2.3",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/sourcemap-codec": "^1.4.15"
-      },
-      "peerDependencies": {
-        "@typescript-eslint/types": "^8.2.0"
-      },
-      "peerDependenciesMeta": {
-        "@typescript-eslint/types": {
-          "optional": true
-        }
       }
     },
     "node_modules/esrecurse": {
       "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
-      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -6031,8 +6101,6 @@
     },
     "node_modules/estraverse": {
       "version": "5.3.0",
-      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -6041,15 +6109,11 @@
     },
     "node_modules/estree-walker": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-2.0.2.tgz",
-      "integrity": "sha512-Rfkk/Mp/DL7JVje3u18FxFujQlTNR2q6QfMSMB7AvCBx91NGj/ba3kCfza0f6dVDbw7YlRf/nDrn7pQrCCyQ/w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/esutils": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
-      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
       "dev": true,
       "license": "BSD-2-Clause",
       "engines": {
@@ -6058,18 +6122,22 @@
     },
     "node_modules/etag": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
-      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/events": {
       "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
       "license": "MIT",
       "engines": {
         "node": ">=0.8.x"
@@ -6077,8 +6145,6 @@
     },
     "node_modules/events-universal": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/events-universal/-/events-universal-1.0.1.tgz",
-      "integrity": "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==",
       "license": "Apache-2.0",
       "dependencies": {
         "bare-events": "^2.7.0"
@@ -6086,8 +6152,6 @@
     },
     "node_modules/expand-template": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/expand-template/-/expand-template-2.0.3.tgz",
-      "integrity": "sha512-XYfuKMvj4O35f/pOXLObndIRvyQ+/+6AhODh+OKWj9S9498pHHn/IMszH+gt0fBCRWMNfk1ZSp5x3AifmnI2vg==",
       "dev": true,
       "license": "(MIT OR WTFPL)",
       "optional": true,
@@ -6097,8 +6161,6 @@
     },
     "node_modules/expect-type": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.3.0.tgz",
-      "integrity": "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA==",
       "devOptional": true,
       "license": "Apache-2.0",
       "engines": {
@@ -6107,16 +6169,12 @@
     },
     "node_modules/exponential-backoff": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
-      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
       "dev": true,
       "license": "Apache-2.0",
       "optional": true
     },
     "node_modules/express": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
-      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6159,8 +6217,6 @@
     },
     "node_modules/express/node_modules/cookie": {
       "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
-      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6168,24 +6224,18 @@
       }
     },
     "node_modules/exsolve": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/exsolve/-/exsolve-1.1.0.tgz",
-      "integrity": "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw==",
+      "version": "1.0.8",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/extend": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/extend/-/extend-3.0.2.tgz",
-      "integrity": "sha512-fjquC59cD7CyW6urNXK0FBufkZcoiGG80wTuPujX590cB5Ttln20E2UB4S/WARVqhXffZl2LNgS+gQdPIIim/g==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/fast-check": {
       "version": "3.23.2",
-      "resolved": "https://registry.npmjs.org/fast-check/-/fast-check-3.23.2.tgz",
-      "integrity": "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A==",
       "dev": true,
       "funding": [
         {
@@ -6207,43 +6257,31 @@
       }
     },
     "node_modules/fast-copy": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/fast-copy/-/fast-copy-4.0.3.tgz",
-      "integrity": "sha512-58apWr0GUiDFM8+3afrO6eYwJBn9ZAhDOzG3L+/9llab/haCARS2UIfffmOurYLwbgDRs8n0rfr6qAAPEAuAQw==",
+      "version": "4.0.2",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-deep-equal": {
       "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
-      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-fifo": {
       "version": "1.3.2",
-      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
-      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==",
       "license": "MIT"
     },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
-      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-levenshtein": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
-      "integrity": "sha512-DCXu6Ifhqcks7TZKY3Hxp3y6qphY5SJZmrWMDrKcERSOXWQdMhU9Ig/PYrzyw/ul9jOIyh0N4M0tbC5hodg8dw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-printf": {
       "version": "1.6.10",
-      "resolved": "https://registry.npmjs.org/fast-printf/-/fast-printf-1.6.10.tgz",
-      "integrity": "sha512-GwTgG9O4FVIdShhbVF3JxOgSBY2+ePGsu2V/UONgoCPzF9VY6ZdBMKsHKCYQHZwNk3qNouUolRDsgVxcVA5G1w==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -6252,15 +6290,11 @@
     },
     "node_modules/fast-safe-stringify": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz",
-      "integrity": "sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.0",
       "dev": true,
       "funding": [
         {
@@ -6275,10 +6309,41 @@
       "license": "BSD-3-Clause",
       "optional": true
     },
+    "node_modules/fast-xml-builder": {
+      "version": "1.2.0",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "path-expression-matcher": "^1.5.0",
+        "xml-naming": "^0.1.0"
+      }
+    },
+    "node_modules/fast-xml-parser": {
+      "version": "5.7.3",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "@nodable/entities": "^2.1.0",
+        "fast-xml-builder": "^1.1.7",
+        "path-expression-matcher": "^1.5.0",
+        "strnum": "^2.2.3"
+      },
+      "bin": {
+        "fxparser": "src/cli/cli.js"
+      }
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
-      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -6295,8 +6360,6 @@
     },
     "node_modules/file-entry-cache": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6308,16 +6371,12 @@
     },
     "node_modules/file-uri-to-path": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/file-uri-to-path/-/file-uri-to-path-1.0.0.tgz",
-      "integrity": "sha512-0Zt+s3L7Vf1biwWZ29aARiVYLx7iMGnEUl9x33fbB/j3jR81u/O2LbqK+Bm1CDSNDKVtJ/YjwY7TUd5SkeLQLw==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/finalhandler": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-2.1.1.tgz",
-      "integrity": "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6338,8 +6397,6 @@
     },
     "node_modules/find-up": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
-      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6355,8 +6412,6 @@
     },
     "node_modules/flat-cache": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6368,19 +6423,14 @@
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.2",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
-      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "version": "3.3.3",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/foreground-child": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
       "dev": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "cross-spawn": "^7.0.6",
         "signal-exit": "^4.0.1"
@@ -6394,8 +6444,6 @@
     },
     "node_modules/forwarded": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
-      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6404,8 +6452,6 @@
     },
     "node_modules/fresh": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
-      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6417,13 +6463,10 @@
       "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
       "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/fs-minipass": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
-      "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -6450,8 +6493,6 @@
     },
     "node_modules/function-bind": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
-      "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -6460,14 +6501,18 @@
     },
     "node_modules/fzstd": {
       "version": "0.1.1",
-      "resolved": "https://registry.npmjs.org/fzstd/-/fzstd-0.1.1.tgz",
-      "integrity": "sha512-dkuVSOKKwh3eas5VkJy1AW1vFpet8TA/fGmVA5krThl8YcOVE/8ZIoEA1+U1vEn5ckxxhLirSdY837azmbaNHA==",
       "license": "MIT"
     },
+    "node_modules/get-caller-file": {
+      "version": "2.0.5",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": "6.* || 8.* || >= 10.*"
+      }
+    },
     "node_modules/get-intrinsic": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
-      "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6489,10 +6534,19 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/get-port": {
+      "version": "7.2.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=16"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/get-proto": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
-      "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6505,8 +6559,6 @@
     },
     "node_modules/get-tsconfig": {
       "version": "4.14.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.0.tgz",
-      "integrity": "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -6518,20 +6570,14 @@
     },
     "node_modules/github-from-package": {
       "version": "0.0.0",
-      "resolved": "https://registry.npmjs.org/github-from-package/-/github-from-package-0.0.0.tgz",
-      "integrity": "sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/glob": {
       "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "foreground-child": "^3.1.0",
         "jackspeak": "^3.1.2",
@@ -6549,8 +6595,6 @@
     },
     "node_modules/glob-parent": {
       "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
-      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -6562,22 +6606,16 @@
     },
     "node_modules/glob/node_modules/brace-expansion": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
-      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "balanced-match": "^1.0.0"
       }
     },
     "node_modules/glob/node_modules/minimatch": {
       "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
       "dev": true,
       "license": "ISC",
-      "optional": true,
       "dependencies": {
         "brace-expansion": "^2.0.2"
       },
@@ -6590,8 +6628,6 @@
     },
     "node_modules/globals": {
       "version": "16.5.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-16.5.0.tgz",
-      "integrity": "sha512-c/c15i26VrJ4IRt5Z89DnIzCGDn9EcebibhAOjw5ibqEHsE1wLUgkPn9RDmNcUKyU87GeaL633nyJ+pplFR2ZQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6603,8 +6639,6 @@
     },
     "node_modules/gopd": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
-      "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6616,16 +6650,12 @@
     },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/has-flag": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -6633,8 +6663,6 @@
     },
     "node_modules/has-symbols": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
-      "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6645,9 +6673,7 @@
       }
     },
     "node_modules/hasown": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.4.tgz",
-      "integrity": "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==",
+      "version": "2.0.2",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6659,8 +6685,6 @@
     },
     "node_modules/he": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
-      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -6669,15 +6693,11 @@
     },
     "node_modules/help-me": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/help-me/-/help-me-5.0.0.tgz",
-      "integrity": "sha512-7xgomUX6ADmcYzFik0HzAxh/73YlKR9bmFzf51CZwR+b6YtzU2m0u49hQCqV6SvlqIqsaxovfwdvbnsw3b/zpg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/hosted-git-info": {
-      "version": "9.0.3",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-9.0.3.tgz",
-      "integrity": "sha512-Hc+ghLoSt6QaYZUv0WBiIvmMDZuZZ7oaDvdH8MbfOO4lOsxdXLEvuC6ePoGs9H1X9oCLyq6+NVN0MKqD+ydxyg==",
+      "version": "9.0.2",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -6689,8 +6709,6 @@
     },
     "node_modules/hosted-git-info/node_modules/lru-cache": {
       "version": "11.5.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
-      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "engines": {
@@ -6699,23 +6717,17 @@
     },
     "node_modules/html-escaper": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/html-escaper/-/html-escaper-2.0.2.tgz",
-      "integrity": "sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/http-cache-semantics": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "optional": true
     },
     "node_modules/http-errors": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
-      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6735,8 +6747,6 @@
     },
     "node_modules/http-proxy-agent": {
       "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
-      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -6750,8 +6760,6 @@
     },
     "node_modules/https-proxy-agent": {
       "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
-      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -6764,9 +6772,7 @@
       }
     },
     "node_modules/human-id": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/human-id/-/human-id-4.2.0.tgz",
-      "integrity": "sha512-K3GbkIWqyvvlpfhBPlbEvD97TtqBpAYA4kt+cn2lD2x2HuohzZCibcA2nOlnJT6exqvJLggoB5nv2dNf192nEA==",
+      "version": "4.1.3",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -6774,15 +6780,11 @@
       }
     },
     "node_modules/hyparquet": {
-      "version": "1.26.1",
-      "resolved": "https://registry.npmjs.org/hyparquet/-/hyparquet-1.26.1.tgz",
-      "integrity": "sha512-Me2psKksCqJGR8+TbalUYUyK4Ao+ReA6XmMSiOVPhOBswULbl3ojT06PQajyTafbNPW1vD0tCA7H6dXJAC1TPw==",
+      "version": "1.26.0",
       "license": "MIT"
     },
     "node_modules/hyparquet-compressors": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/hyparquet-compressors/-/hyparquet-compressors-1.1.1.tgz",
-      "integrity": "sha512-yx7aA3Rhj0YycbdV71+XznQSLAefa4cT0urpgNXy4aM6eSeCknaVDNne8y45Uz74Fb15yyXUzOStlceOJBan7A==",
       "license": "MIT",
       "dependencies": {
         "fzstd": "0.1.1",
@@ -6791,28 +6793,25 @@
     },
     "node_modules/hysnappy": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/hysnappy/-/hysnappy-1.0.0.tgz",
-      "integrity": "sha512-MNrC4NfwDGPb889O6gIfEtbvEZCSWUsSEhsz4Oq2FRcpGtXHfeVz3KciSPp5Pnnz1NjFMgDQNfxdJozymJEDDA==",
       "license": "MIT"
     },
     "node_modules/iconv-lite": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
-      "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+      "version": "0.7.2",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
       "engines": {
         "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/ieee754": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
       "funding": [
         {
           "type": "github",
@@ -6831,8 +6830,6 @@
     },
     "node_modules/ignore": {
       "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
-      "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6841,8 +6838,6 @@
     },
     "node_modules/import-fresh": {
       "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.1.tgz",
-      "integrity": "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6858,8 +6853,6 @@
     },
     "node_modules/import-meta-resolve": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/import-meta-resolve/-/import-meta-resolve-4.2.0.tgz",
-      "integrity": "sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -6869,8 +6862,6 @@
     },
     "node_modules/imurmurhash": {
       "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
-      "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6879,22 +6870,16 @@
     },
     "node_modules/inherits": {
       "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
       "license": "ISC"
     },
     "node_modules/ini": {
       "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
-      "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==",
       "dev": true,
       "license": "ISC",
       "optional": true
     },
     "node_modules/ip-address": {
-      "version": "10.2.0",
-      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
-      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA==",
+      "version": "10.1.0",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -6904,8 +6889,6 @@
     },
     "node_modules/ipaddr.js": {
       "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
-      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6913,13 +6896,11 @@
       }
     },
     "node_modules/is-core-module": {
-      "version": "2.16.2",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.2.tgz",
-      "integrity": "sha512-evOr8xfXKxE6qSR0hSXL2r3sd7ALj8+7jQEUvPYcm5sgZFdJ+AYzT6yNmJenvIYQBgIGwfwz08sL8zoL7yq2BA==",
+      "version": "2.16.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "hasown": "^2.0.3"
+        "hasown": "^2.0.2"
       },
       "engines": {
         "node": ">= 0.4"
@@ -6930,8 +6911,6 @@
     },
     "node_modules/is-extglob": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
-      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6940,19 +6919,14 @@
     },
     "node_modules/is-fullwidth-code-point": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
-      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=8"
       }
     },
     "node_modules/is-glob": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
-      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6964,15 +6938,11 @@
     },
     "node_modules/is-module": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/is-module/-/is-module-1.0.0.tgz",
-      "integrity": "sha512-51ypPSPCoTEIN9dy5Oy+h4pShgJmPCygKfyRCISBI+JoWT/2oJvK8QPxmwv7b/p239jXrm9M1mlQbyKJ5A152g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-plain-obj": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-4.1.0.tgz",
-      "integrity": "sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -6984,33 +6954,41 @@
     },
     "node_modules/is-promise": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
-      "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/is-reference": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-1.2.1.tgz",
-      "integrity": "sha512-U82MsXXiFIrjCK4otLT+o2NA2Cd2g5MLoOVXUZjIOhLurrRxpEXzI8O0KZHr3IjLvlAH1kTPYSuqer5T9ZVBKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/estree": "*"
       }
     },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/isarray": {
+      "version": "1.0.0",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/isexe": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/istanbul-lib-coverage": {
       "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-coverage/-/istanbul-lib-coverage-3.2.2.tgz",
-      "integrity": "sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==",
-      "devOptional": true,
+      "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">=8"
@@ -7018,9 +6996,7 @@
     },
     "node_modules/istanbul-lib-report": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/istanbul-lib-report/-/istanbul-lib-report-3.0.1.tgz",
-      "integrity": "sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==",
-      "devOptional": true,
+      "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "istanbul-lib-coverage": "^3.0.0",
@@ -7033,9 +7009,7 @@
     },
     "node_modules/istanbul-reports": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/istanbul-reports/-/istanbul-reports-3.2.0.tgz",
-      "integrity": "sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==",
-      "devOptional": true,
+      "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "html-escaper": "^2.0.0",
@@ -7047,11 +7021,8 @@
     },
     "node_modules/jackspeak": {
       "version": "3.4.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
-      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
-      "optional": true,
       "dependencies": {
         "@isaacs/cliui": "^8.0.2"
       },
@@ -7063,9 +7034,7 @@
       }
     },
     "node_modules/jiti": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
-      "integrity": "sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==",
+      "version": "2.6.1",
       "devOptional": true,
       "license": "MIT",
       "bin": {
@@ -7073,9 +7042,7 @@
       }
     },
     "node_modules/joi": {
-      "version": "17.13.4",
-      "resolved": "https://registry.npmjs.org/joi/-/joi-17.13.4.tgz",
-      "integrity": "sha512-1RuuER6kmt8K8I3nIWvPZKi5RQCb568ZPyY4Pwjlua+yo+63ZTmIwxLZH0heBmiKN4uxjvCiarDrjaeH84xicQ==",
+      "version": "17.13.3",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true,
@@ -7088,9 +7055,7 @@
       }
     },
     "node_modules/jose": {
-      "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/jose/-/jose-6.2.3.tgz",
-      "integrity": "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw==",
+      "version": "6.2.1",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/panva"
@@ -7098,8 +7063,6 @@
     },
     "node_modules/joycon": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/joycon/-/joycon-3.1.1.tgz",
-      "integrity": "sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7108,33 +7071,17 @@
     },
     "node_modules/js-sha256": {
       "version": "0.11.1",
-      "resolved": "https://registry.npmjs.org/js-sha256/-/js-sha256-0.11.1.tgz",
-      "integrity": "sha512-o6WSo/LUvY2uC4j7mO50a2ms7E/EAdbP0swigLV+nzHKTTaYnaLIWJ02VdXrsJX0vGedDESQnLsOekr94ryfjg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/js-tokens": {
       "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-10.0.0.tgz",
-      "integrity": "sha512-lM/UBzQmfJRo9ABXbPWemivdCW8V2G8FHaHdypQaIy523snUjog0W71ayWXTjiR+ixeMyVHN2XcpnTd/liPg/Q==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "version": "4.1.1",
       "dev": true,
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/puzrin"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/nodeca"
-        }
-      ],
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"
@@ -7145,15 +7092,11 @@
     },
     "node_modules/json-buffer": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json-schema-to-ts": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/json-schema-to-ts/-/json-schema-to-ts-3.1.1.tgz",
-      "integrity": "sha512-+DWg8jCJG2TEnpy7kOm/7/AxaYoaRbjVB4LFZLySZlWn8exGs3A4OLJR966cVvU26N7X9TWxl+Jsw7dzAqKT6g==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -7166,24 +7109,17 @@
       }
     },
     "node_modules/json-schema-traverse": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
-      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "version": "0.4.1",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/json-stable-stringify-without-jsonify": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
-      "integrity": "sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/json5": {
       "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
-      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -7195,8 +7131,6 @@
     },
     "node_modules/keyv": {
       "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7205,8 +7139,6 @@
     },
     "node_modules/kleur": {
       "version": "4.1.5",
-      "resolved": "https://registry.npmjs.org/kleur/-/kleur-4.1.5.tgz",
-      "integrity": "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -7215,24 +7147,53 @@
     },
     "node_modules/known-css-properties": {
       "version": "0.37.0",
-      "resolved": "https://registry.npmjs.org/known-css-properties/-/known-css-properties-0.37.0.tgz",
-      "integrity": "sha512-JCDrsP4Z1Sb9JwG0aJ8Eo2r7k4Ou5MwmThS/6lcIe1ICyb7UBJKGRIUUdqc2ASdE/42lgz6zFUnzAIhtXnBVrQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/kysely": {
-      "version": "0.28.17",
-      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.28.17.tgz",
-      "integrity": "sha512-nbD8lB9EB3wNdMhOCdx5Li8DxnLbvKByylRLcJ1h+4SkrowVeECAyZlyiKMThF7xFdRz0jSQ2MoJr+wXux2y0Q==",
+      "version": "0.29.2",
+      "resolved": "https://registry.npmjs.org/kysely/-/kysely-0.29.2.tgz",
+      "integrity": "sha512-s6WVJyEZrbm6jhBpiKHsGHyePMrVQKJ85wZCFCr9W4QHv6WTjWIrdvTmO9hDEA3bNK0xkrE2DqrHsXMLWuZpQg==",
       "license": "MIT",
       "engines": {
-        "node": ">=20.0.0"
+        "node": ">=22.0.0"
+      }
+    },
+    "node_modules/lazystream": {
+      "version": "1.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "readable-stream": "^2.0.5"
+      },
+      "engines": {
+        "node": ">= 0.6.3"
+      }
+    },
+    "node_modules/lazystream/node_modules/readable-stream": {
+      "version": "2.3.8",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/lazystream/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
       }
     },
     "node_modules/levn": {
       "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
-      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7244,17 +7205,13 @@
       }
     },
     "node_modules/libphonenumber-js": {
-      "version": "1.13.7",
-      "resolved": "https://registry.npmjs.org/libphonenumber-js/-/libphonenumber-js-1.13.7.tgz",
-      "integrity": "sha512-rvr3HIMdOgzhz1RFGjftji+wjoAFlzhqCNqJOU/MKTZQ8d9NZxAR/tI+0weDicyoucqVR0U1GCniqHJ0f8aM2A==",
+      "version": "1.12.36",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/libxmljs2": {
       "version": "0.37.0",
-      "resolved": "https://registry.npmjs.org/libxmljs2/-/libxmljs2-0.37.0.tgz",
-      "integrity": "sha512-Xb78V8GZouoZFrq8cCwx7+G3WYOcJG0xb3YUbweSyE4z2EIrQCZMr3Ye/dHn4mESs6YxUMeQeUZm5IXg+iLHog==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -7270,9 +7227,7 @@
       }
     },
     "node_modules/lightningcss": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.32.0.tgz",
-      "integrity": "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==",
+      "version": "1.31.1",
       "devOptional": true,
       "license": "MPL-2.0",
       "dependencies": {
@@ -7286,23 +7241,23 @@
         "url": "https://opencollective.com/parcel"
       },
       "optionalDependencies": {
-        "lightningcss-android-arm64": "1.32.0",
-        "lightningcss-darwin-arm64": "1.32.0",
-        "lightningcss-darwin-x64": "1.32.0",
-        "lightningcss-freebsd-x64": "1.32.0",
-        "lightningcss-linux-arm-gnueabihf": "1.32.0",
-        "lightningcss-linux-arm64-gnu": "1.32.0",
-        "lightningcss-linux-arm64-musl": "1.32.0",
-        "lightningcss-linux-x64-gnu": "1.32.0",
-        "lightningcss-linux-x64-musl": "1.32.0",
-        "lightningcss-win32-arm64-msvc": "1.32.0",
-        "lightningcss-win32-x64-msvc": "1.32.0"
+        "lightningcss-android-arm64": "1.31.1",
+        "lightningcss-darwin-arm64": "1.31.1",
+        "lightningcss-darwin-x64": "1.31.1",
+        "lightningcss-freebsd-x64": "1.31.1",
+        "lightningcss-linux-arm-gnueabihf": "1.31.1",
+        "lightningcss-linux-arm64-gnu": "1.31.1",
+        "lightningcss-linux-arm64-musl": "1.31.1",
+        "lightningcss-linux-x64-gnu": "1.31.1",
+        "lightningcss-linux-x64-musl": "1.31.1",
+        "lightningcss-win32-arm64-msvc": "1.31.1",
+        "lightningcss-win32-x64-msvc": "1.31.1"
       }
     },
     "node_modules/lightningcss-android-arm64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
-      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.31.1.tgz",
+      "integrity": "sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==",
       "cpu": [
         "arm64"
       ],
@@ -7320,9 +7275,9 @@
       }
     },
     "node_modules/lightningcss-darwin-arm64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
-      "integrity": "sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.31.1.tgz",
+      "integrity": "sha512-02uTEqf3vIfNMq3h/z2cJfcOXnQ0GRwQrkmPafhueLb2h7mqEidiCzkE4gBMEH65abHRiQvhdcQ+aP0D0g67sg==",
       "cpu": [
         "arm64"
       ],
@@ -7340,9 +7295,9 @@
       }
     },
     "node_modules/lightningcss-darwin-x64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.32.0.tgz",
-      "integrity": "sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.31.1.tgz",
+      "integrity": "sha512-1ObhyoCY+tGxtsz1lSx5NXCj3nirk0Y0kB/g8B8DT+sSx4G9djitg9ejFnjb3gJNWo7qXH4DIy2SUHvpoFwfTA==",
       "cpu": [
         "x64"
       ],
@@ -7360,9 +7315,9 @@
       }
     },
     "node_modules/lightningcss-freebsd-x64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.32.0.tgz",
-      "integrity": "sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.31.1.tgz",
+      "integrity": "sha512-1RINmQKAItO6ISxYgPwszQE1BrsVU5aB45ho6O42mu96UiZBxEXsuQ7cJW4zs4CEodPUioj/QrXW1r9pLUM74A==",
       "cpu": [
         "x64"
       ],
@@ -7380,9 +7335,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm-gnueabihf": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.32.0.tgz",
-      "integrity": "sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.31.1.tgz",
+      "integrity": "sha512-OOCm2//MZJ87CdDK62rZIu+aw9gBv4azMJuA8/KB74wmfS3lnC4yoPHm0uXZ/dvNNHmnZnB8XLAZzObeG0nS1g==",
       "cpu": [
         "arm"
       ],
@@ -7400,9 +7355,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-gnu": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.32.0.tgz",
-      "integrity": "sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.31.1.tgz",
+      "integrity": "sha512-WKyLWztD71rTnou4xAD5kQT+982wvca7E6QoLpoawZ1gP9JM0GJj4Tp5jMUh9B3AitHbRZ2/H3W5xQmdEOUlLg==",
       "cpu": [
         "arm64"
       ],
@@ -7420,9 +7375,9 @@
       }
     },
     "node_modules/lightningcss-linux-arm64-musl": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.32.0.tgz",
-      "integrity": "sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.31.1.tgz",
+      "integrity": "sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==",
       "cpu": [
         "arm64"
       ],
@@ -7440,9 +7395,7 @@
       }
     },
     "node_modules/lightningcss-linux-x64-gnu": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.32.0.tgz",
-      "integrity": "sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==",
+      "version": "1.31.1",
       "cpu": [
         "x64"
       ],
@@ -7460,9 +7413,7 @@
       }
     },
     "node_modules/lightningcss-linux-x64-musl": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.32.0.tgz",
-      "integrity": "sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==",
+      "version": "1.31.1",
       "cpu": [
         "x64"
       ],
@@ -7480,9 +7431,9 @@
       }
     },
     "node_modules/lightningcss-win32-arm64-msvc": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.32.0.tgz",
-      "integrity": "sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.31.1.tgz",
+      "integrity": "sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==",
       "cpu": [
         "arm64"
       ],
@@ -7500,9 +7451,9 @@
       }
     },
     "node_modules/lightningcss-win32-x64-msvc": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.32.0.tgz",
-      "integrity": "sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==",
+      "version": "1.31.1",
+      "resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.31.1.tgz",
+      "integrity": "sha512-I9aiFrbd7oYHwlnQDqr1Roz+fTz61oDDJX7n9tYF9FJymH1cIN1DtKw3iYt6b8WZgEjoNwVSncwF4wx/ZedMhw==",
       "cpu": [
         "x64"
       ],
@@ -7521,8 +7472,6 @@
     },
     "node_modules/lilconfig": {
       "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/lilconfig/-/lilconfig-2.1.0.tgz",
-      "integrity": "sha512-utWOt/GHzuUxnLKxB6dk81RoOeoNeHgbrXiuGk4yyF5qlRz+iIVWu56E2fqGHFrXz0QNUhLB/8nKqvRH66JKGQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7531,8 +7480,6 @@
     },
     "node_modules/local-pkg": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/local-pkg/-/local-pkg-1.2.1.tgz",
-      "integrity": "sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7549,15 +7496,11 @@
     },
     "node_modules/locate-character": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/locate-character/-/locate-character-3.0.0.tgz",
-      "integrity": "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/locate-path": {
       "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
-      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7570,25 +7513,33 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lodash": {
+      "version": "4.17.21",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/lodash.camelcase": {
+      "version": "4.3.0",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
-      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/long": {
+      "version": "5.3.2",
+      "dev": true,
+      "license": "Apache-2.0"
+    },
     "node_modules/lru-cache": {
       "version": "10.4.3",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
-      "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
       "dev": true,
-      "license": "ISC",
-      "optional": true
+      "license": "ISC"
     },
     "node_modules/luxon": {
       "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.5.0.tgz",
-      "integrity": "sha512-rh+Zjr6DNfUYR3bPwJEnuwDdqMbxZW7LOQfUN4B54+Cl+0o5zaU9RJ6bcidfDtC1cWCZXQ+nvX8bf6bAji37QQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7597,8 +7548,6 @@
     },
     "node_modules/magic-string": {
       "version": "0.30.21",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
-      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -7607,9 +7556,7 @@
     },
     "node_modules/magicast": {
       "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/magicast/-/magicast-0.5.3.tgz",
-      "integrity": "sha512-pVKE4UdSQ7DvHzivsCIFx2BJn1mHG6KsyrFcaxFx6tONdneEuThrDx0Cj3AMg58KyN4pzYT+LHOotxDQDjNvkw==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/parser": "^7.29.3",
@@ -7619,9 +7566,7 @@
     },
     "node_modules/make-dir": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-4.0.0.tgz",
-      "integrity": "sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "semver": "^7.5.3"
@@ -7635,8 +7580,6 @@
     },
     "node_modules/make-fetch-happen": {
       "version": "14.0.3",
-      "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-14.0.3.tgz",
-      "integrity": "sha512-QMjGbFTP0blj97EeidG5hk/QhKQ3T4ICckQGLgz38QF7Vgbk6e6FTARN8KhKxyBbWn8R0HU+bnw8aSoFPD4qtQ==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -7659,8 +7602,6 @@
     },
     "node_modules/marked": {
       "version": "14.0.0",
-      "resolved": "https://registry.npmjs.org/marked/-/marked-14.0.0.tgz",
-      "integrity": "sha512-uIj4+faQ+MgHgwUW1l2PsPglZLOLOT1uErt06dAPtx2kjteLAkbsd/0FiYg/MGS+i7ZKLb7w2WClxHkzOOuryQ==",
       "license": "MIT",
       "bin": {
         "marked": "bin/marked.js"
@@ -7671,8 +7612,6 @@
     },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
-      "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7680,16 +7619,12 @@
       }
     },
     "node_modules/mdn-data": {
-      "version": "2.28.1",
-      "resolved": "https://registry.npmjs.org/mdn-data/-/mdn-data-2.28.1.tgz",
-      "integrity": "sha512-U9w+PzSZ00Z5m9rZ5ARVFL5xOfuCHdKYi/1RRwDCJsboFgJDNT3zT6PIPD7mZQYaQLhsZM3GfDRgSMRHhSmVng==",
+      "version": "2.23.0",
       "dev": true,
       "license": "CC0-1.0"
     },
     "node_modules/media-typer": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.0.tgz",
-      "integrity": "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7698,15 +7633,11 @@
     },
     "node_modules/memoize-weak": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/memoize-weak/-/memoize-weak-1.0.2.tgz",
-      "integrity": "sha512-gj39xkrjEw7nCn4nJ1M5ms6+MyMlyiGmttzsqAUsAKn6bYKwuTHh/AO3cKPF8IBrTIYTxb0wWXFs3E//Y8VoWQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/merge-descriptors": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-2.0.0.tgz",
-      "integrity": "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7718,8 +7649,6 @@
     },
     "node_modules/mime-db": {
       "version": "1.54.0",
-      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
-      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7728,8 +7657,6 @@
     },
     "node_modules/mime-types": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
-      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7745,8 +7672,6 @@
     },
     "node_modules/mimic-response": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
-      "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -7759,8 +7684,6 @@
     },
     "node_modules/minimatch": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.5.tgz",
-      "integrity": "sha512-VgjWUsnnT6n+NUk6eZq77zeFdpW2LWDzP6zFGrCbHXiYNul5Dzqk2HHQ5uFH2DNW5Xbp8+jVzaeNt94ssEEl4w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -7772,8 +7695,6 @@
     },
     "node_modules/minimist": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
-      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -7782,19 +7703,14 @@
     },
     "node_modules/minipass": {
       "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
-      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
-      "optional": true,
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
     },
     "node_modules/minipass-collect": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
-      "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -7807,8 +7723,6 @@
     },
     "node_modules/minipass-fetch": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-4.0.1.tgz",
-      "integrity": "sha512-j7U11C5HXigVuutxebFadoYBbd7VSdZWggSe64NVdvWNBqGAiXPL2QVCehjmw7lY1oF9gOllYbORh+hiNgfPgQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -7825,11 +7739,9 @@
       }
     },
     "node_modules/minipass-flush": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.7.tgz",
-      "integrity": "sha512-TbqTz9cUwWyHS2Dy89P3ocAGUGxKjjLuR9z8w4WUTGAVgEj17/4nhgo2Du56i0Fm3Pm30g4iA8Lcqctc76jCzA==",
+      "version": "1.0.5",
       "dev": true,
-      "license": "BlueOak-1.0.0",
+      "license": "ISC",
       "optional": true,
       "dependencies": {
         "minipass": "^3.0.0"
@@ -7840,8 +7752,6 @@
     },
     "node_modules/minipass-flush/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -7854,16 +7764,12 @@
     },
     "node_modules/minipass-flush/node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "dev": true,
       "license": "ISC",
       "optional": true
     },
     "node_modules/minipass-pipeline": {
       "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
-      "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -7876,8 +7782,6 @@
     },
     "node_modules/minipass-pipeline/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -7890,16 +7794,12 @@
     },
     "node_modules/minipass-pipeline/node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "dev": true,
       "license": "ISC",
       "optional": true
     },
     "node_modules/minipass-sized": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
-      "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -7912,8 +7812,6 @@
     },
     "node_modules/minipass-sized/node_modules/minipass": {
       "version": "3.3.6",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
-      "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -7926,16 +7824,12 @@
     },
     "node_modules/minipass-sized/node_modules/yallist": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
-      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
       "dev": true,
       "license": "ISC",
       "optional": true
     },
     "node_modules/minizlib": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
-      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -7946,18 +7840,27 @@
         "node": ">= 18"
       }
     },
+    "node_modules/mkdirp": {
+      "version": "3.0.1",
+      "dev": true,
+      "license": "MIT",
+      "bin": {
+        "mkdirp": "dist/cjs/src/bin.js"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/mkdirp-classic": {
       "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/mkdirp-classic/-/mkdirp-classic-0.5.3.tgz",
-      "integrity": "sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/mlly": {
       "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/mlly/-/mlly-1.8.2.tgz",
-      "integrity": "sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7969,15 +7872,11 @@
     },
     "node_modules/mlly/node_modules/confbox": {
       "version": "0.1.8",
-      "resolved": "https://registry.npmjs.org/confbox/-/confbox-0.1.8.tgz",
-      "integrity": "sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/mlly/node_modules/pkg-types": {
       "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-1.3.1.tgz",
-      "integrity": "sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7988,8 +7887,6 @@
     },
     "node_modules/monaco-editor": {
       "version": "0.55.1",
-      "resolved": "https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.55.1.tgz",
-      "integrity": "sha512-jz4x+TJNFHwHtwuV9vA9rMujcZRb0CEilTEwG2rRSpe/A7Jdkuj8xPKttCgOh+v/lkHy7HsZ64oj+q3xoAFl9A==",
       "license": "MIT",
       "dependencies": {
         "dompurify": "3.2.7",
@@ -7998,16 +7895,12 @@
     },
     "node_modules/moo": {
       "version": "0.5.3",
-      "resolved": "https://registry.npmjs.org/moo/-/moo-0.5.3.tgz",
-      "integrity": "sha512-m2fmM2dDm7GZQsY7KK2cme8agi+AAljILjQnof7p1ZMDe6dQ4bdnSMx0cPppudoeNv5hEFQirN6u+O4fDE0IWA==",
       "dev": true,
       "license": "BSD-3-Clause",
       "optional": true
     },
     "node_modules/mri": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/mri/-/mri-1.2.0.tgz",
-      "integrity": "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8016,8 +7909,6 @@
     },
     "node_modules/mrmime": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
-      "integrity": "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -8026,23 +7917,17 @@
     },
     "node_modules/ms": {
       "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/nan": {
       "version": "2.22.2",
-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.22.2.tgz",
-      "integrity": "sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/nanoid": {
-      "version": "3.3.15",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.15.tgz",
-      "integrity": "sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==",
+      "version": "3.3.11",
       "devOptional": true,
       "funding": [
         {
@@ -8075,23 +7960,17 @@
     },
     "node_modules/napi-build-utils": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/napi-build-utils/-/napi-build-utils-2.0.0.tgz",
-      "integrity": "sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/natural-compare": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
-      "integrity": "sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/nearley": {
       "version": "2.20.1",
-      "resolved": "https://registry.npmjs.org/nearley/-/nearley-2.20.1.tgz",
-      "integrity": "sha512-+Mc8UaAebFzgV+KpI5n7DasuuQCHA89dmwm7JXw3TV43ukfNQ9DnBH3Mdb2g/I4Fdxc26pwimBWvjIw0UAILSQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8114,16 +7993,12 @@
     },
     "node_modules/nearley/node_modules/commander": {
       "version": "2.20.3",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/negotiator": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-1.0.0.tgz",
-      "integrity": "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8131,9 +8006,7 @@
       }
     },
     "node_modules/node-abi": {
-      "version": "3.92.0",
-      "resolved": "https://registry.npmjs.org/node-abi/-/node-abi-3.92.0.tgz",
-      "integrity": "sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==",
+      "version": "3.87.0",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8146,8 +8019,6 @@
     },
     "node_modules/node-gyp": {
       "version": "11.5.0",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-11.5.0.tgz",
-      "integrity": "sha512-ra7Kvlhxn5V9Slyus0ygMa2h+UqExPqUIkfk7Pc8QTLT956JLSy51uWFwHtIYy0vI8cB4BDhc/S03+880My/LQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8172,8 +8043,6 @@
     },
     "node_modules/node-gyp/node_modules/isexe": {
       "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
-      "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "optional": true,
@@ -8183,8 +8052,6 @@
     },
     "node_modules/node-gyp/node_modules/which": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
-      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -8200,8 +8067,6 @@
     },
     "node_modules/nopt": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/nopt/-/nopt-8.1.0.tgz",
-      "integrity": "sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -8217,8 +8082,6 @@
     },
     "node_modules/normalize-package-data": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-8.0.0.tgz",
-      "integrity": "sha512-RWk+PI433eESQ7ounYxIp67CYuVsS1uYSonX3kA6ps/3LWfjVQa/ptEg6Y3T6uAMq1mWpX9PQ+qx+QaHpsc7gQ==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -8230,10 +8093,16 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/normalize-url": {
       "version": "8.1.1",
-      "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.1.1.tgz",
-      "integrity": "sha512-JYc0DPlpGWB40kH5g07gGTrYuMqV653k3uBKY6uITPWds3M0ov3GaWGp9lbE3Bzngx8+XkfzgvASb9vk9JDFXQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8245,9 +8114,7 @@
       }
     },
     "node_modules/oauth2-mock-server": {
-      "version": "8.2.3",
-      "resolved": "https://registry.npmjs.org/oauth2-mock-server/-/oauth2-mock-server-8.2.3.tgz",
-      "integrity": "sha512-Lgem1ZjVYG6NuzJ7J6MC2OchMkJWzwb1SFvwuGunQ1VPmQIU+/ydG3LzgBu/cnFWriYD8ZTd2CQpjHtvcVZy3A==",
+      "version": "8.2.2",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8255,10 +8122,10 @@
         "cors": "^2.8.6",
         "express": "^5.2.1",
         "is-plain-obj": "^4.1.0",
-        "jose": "^6.2.3"
+        "jose": "^6.1.3"
       },
       "bin": {
-        "oauth2-mock-server": "dist/oauth2-mock-server.mjs"
+        "oauth2-mock-server": "dist/oauth2-mock-server.js"
       },
       "engines": {
         "node": "^20.19 || ^22.12 || ^24"
@@ -8266,8 +8133,6 @@
     },
     "node_modules/object-assign": {
       "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8276,8 +8141,6 @@
     },
     "node_modules/object-inspect": {
       "version": "1.13.4",
-      "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
-      "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8288,23 +8151,16 @@
       }
     },
     "node_modules/obug": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/obug/-/obug-2.1.3.tgz",
-      "integrity": "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg==",
+      "version": "2.1.1",
       "devOptional": true,
       "funding": [
         "https://github.com/sponsors/sxzz",
         "https://opencollective.com/debug"
       ],
-      "license": "MIT",
-      "engines": {
-        "node": ">=12.20.0"
-      }
+      "license": "MIT"
     },
     "node_modules/on-exit-leak-free": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
-      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
       "license": "MIT",
       "engines": {
         "node": ">=14.0.0"
@@ -8312,8 +8168,6 @@
     },
     "node_modules/on-finished": {
       "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8325,8 +8179,6 @@
     },
     "node_modules/once": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -8335,8 +8187,6 @@
     },
     "node_modules/optionator": {
       "version": "0.9.4",
-      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.4.tgz",
-      "integrity": "sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8353,8 +8203,6 @@
     },
     "node_modules/p-limit": {
       "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
-      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8369,8 +8217,6 @@
     },
     "node_modules/p-locate": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
-      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8385,8 +8231,6 @@
     },
     "node_modules/p-map": {
       "version": "7.0.4",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.4.tgz",
-      "integrity": "sha512-tkAQEw8ysMzmkhgw8k+1U/iPhWNhykKnSk4Rd5zLoPJCuJaGRPo6YposrZgaxHKzDHdDWWZvE/Sk7hsL2X/CpQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8399,30 +8243,21 @@
     },
     "node_modules/package-json-from-dist": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
       "dev": true,
-      "license": "BlueOak-1.0.0",
-      "optional": true
+      "license": "BlueOak-1.0.0"
     },
     "node_modules/package-manager-detector": {
       "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/package-manager-detector/-/package-manager-detector-1.6.0.tgz",
-      "integrity": "sha512-61A5ThoTiDG/C8s8UMZwSorAGwMJ0ERVGj2OjoW5pAalsNOg15+iQiPzrLJ4jhZ1HJzmC2PIHT2oEiH3R5fzNA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/packageurl-js": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/packageurl-js/-/packageurl-js-2.0.1.tgz",
-      "integrity": "sha512-N5ixXjzTy4QDQH0Q9YFjqIWd6zH6936Djpl2m9QNFmDv5Fum8q8BjkpAcHNMzOFE0IwQrFhJWex3AN6kS0OSwg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/pako": {
       "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/pako/-/pako-0.2.9.tgz",
-      "integrity": "sha512-NUcwaKxUxWrZLpDG+z/xZaCgQITkA/Dv4V/T6bw7VON6l1Xz/VnrBqrYjZQ12TamKHzITTfOEIYUj48y2KXImA==",
       "dev": true,
       "license": "MIT"
     },
@@ -8434,8 +8269,6 @@
     },
     "node_modules/parent-module": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
-      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8447,8 +8280,6 @@
     },
     "node_modules/parseurl": {
       "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
-      "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8457,18 +8288,27 @@
     },
     "node_modules/path-exists": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
-      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
       "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
       }
     },
+    "node_modules/path-expression-matcher": {
+      "version": "1.5.0",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/path-key": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8477,18 +8317,13 @@
     },
     "node_modules/path-parse": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
-      "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/path-scurry": {
       "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
-      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
-      "optional": true,
       "dependencies": {
         "lru-cache": "^10.2.0",
         "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
@@ -8501,9 +8336,7 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "8.4.2",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.4.2.tgz",
-      "integrity": "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA==",
+      "version": "8.3.0",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -8513,20 +8346,16 @@
     },
     "node_modules/pathe": {
       "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
-      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/pg": {
-      "version": "8.22.0",
-      "resolved": "https://registry.npmjs.org/pg/-/pg-8.22.0.tgz",
-      "integrity": "sha512-8wih1vVIBMxoUM2oB4soJsD9tDnDpLv4OXBJ+EJzFsvycD+lfyIreC2gGHq78f8jbLLt+bvlPTFdFZfJkOuzAA==",
+      "version": "8.21.0",
       "license": "MIT",
       "dependencies": {
-        "pg-connection-string": "^2.14.0",
+        "pg-connection-string": "^2.13.0",
         "pg-pool": "^3.14.0",
-        "pg-protocol": "^1.15.0",
+        "pg-protocol": "^1.14.0",
         "pg-types": "2.2.0",
         "pgpass": "1.0.5"
       },
@@ -8547,21 +8376,15 @@
     },
     "node_modules/pg-cloudflare": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/pg-cloudflare/-/pg-cloudflare-1.4.0.tgz",
-      "integrity": "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A==",
       "license": "MIT",
       "optional": true
     },
     "node_modules/pg-connection-string": {
-      "version": "2.14.0",
-      "resolved": "https://registry.npmjs.org/pg-connection-string/-/pg-connection-string-2.14.0.tgz",
-      "integrity": "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg==",
+      "version": "2.13.0",
       "license": "MIT"
     },
     "node_modules/pg-int8": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/pg-int8/-/pg-int8-1.0.1.tgz",
-      "integrity": "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw==",
       "license": "ISC",
       "engines": {
         "node": ">=4.0.0"
@@ -8569,23 +8392,17 @@
     },
     "node_modules/pg-pool": {
       "version": "3.14.0",
-      "resolved": "https://registry.npmjs.org/pg-pool/-/pg-pool-3.14.0.tgz",
-      "integrity": "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw==",
       "license": "MIT",
       "peerDependencies": {
         "pg": ">=8.0"
       }
     },
     "node_modules/pg-protocol": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/pg-protocol/-/pg-protocol-1.15.0.tgz",
-      "integrity": "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ==",
+      "version": "1.14.0",
       "license": "MIT"
     },
     "node_modules/pg-types": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/pg-types/-/pg-types-2.2.0.tgz",
-      "integrity": "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA==",
       "license": "MIT",
       "dependencies": {
         "pg-int8": "1.0.1",
@@ -8600,8 +8417,6 @@
     },
     "node_modules/pgpass": {
       "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/pgpass/-/pgpass-1.0.5.tgz",
-      "integrity": "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug==",
       "license": "MIT",
       "dependencies": {
         "split2": "^4.1.0"
@@ -8609,15 +8424,11 @@
     },
     "node_modules/picocolors": {
       "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
-      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
       "devOptional": true,
       "license": "ISC"
     },
     "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "4.0.3",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -8629,8 +8440,6 @@
     },
     "node_modules/pino": {
       "version": "10.3.1",
-      "resolved": "https://registry.npmjs.org/pino/-/pino-10.3.1.tgz",
-      "integrity": "sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==",
       "license": "MIT",
       "dependencies": {
         "@pinojs/redact": "^0.4.0",
@@ -8651,8 +8460,6 @@
     },
     "node_modules/pino-abstract-transport": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-3.0.0.tgz",
-      "integrity": "sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==",
       "license": "MIT",
       "dependencies": {
         "split2": "^4.0.0"
@@ -8660,8 +8467,6 @@
     },
     "node_modules/pino-pretty": {
       "version": "13.1.3",
-      "resolved": "https://registry.npmjs.org/pino-pretty/-/pino-pretty-13.1.3.tgz",
-      "integrity": "sha512-ttXRkkOz6WWC95KeY9+xxWL6AtImwbyMHrL1mSwqwW9u+vLp/WIElvHvCSDg0xO/Dzrggz1zv3rN5ovTRVowKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8685,8 +8490,6 @@
     },
     "node_modules/pino-pretty/node_modules/strip-json-comments": {
       "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-5.0.3.tgz",
-      "integrity": "sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8698,14 +8501,21 @@
     },
     "node_modules/pino-std-serializers": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
-      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
       "license": "MIT"
     },
+    "node_modules/pixelmatch": {
+      "version": "7.1.0",
+      "devOptional": true,
+      "license": "ISC",
+      "dependencies": {
+        "pngjs": "^7.0.0"
+      },
+      "bin": {
+        "pixelmatch": "bin/pixelmatch"
+      }
+    },
     "node_modules/pkg-types": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/pkg-types/-/pkg-types-2.3.1.tgz",
-      "integrity": "sha512-y+ichcgc2LrADuhLNAx8DFjVfgz91pRxfZdI3UDhxHvcVEZsenLO+7XaU5vOp0u/7V/wZ+plyuQxtrDlZJ+yeg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8715,13 +8525,11 @@
       }
     },
     "node_modules/playwright": {
-      "version": "1.61.0",
-      "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.61.0.tgz",
-      "integrity": "sha512-Z+7BeeqQPRRzklHsVFP4KTGIyMxKUmfeRA4WisM6G3/XW6nwGeX6fX9qYaDa+CiUqpOkb2f6X3nar05R3kSuJQ==",
+      "version": "1.58.2",
       "devOptional": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "playwright-core": "1.61.0"
+        "playwright-core": "1.58.2"
       },
       "bin": {
         "playwright": "cli.js"
@@ -8734,9 +8542,7 @@
       }
     },
     "node_modules/playwright-core": {
-      "version": "1.61.0",
-      "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.61.0.tgz",
-      "integrity": "sha512-caX7TrY3Ml6egyDX0WUcTHDxodl/b51y5wJOdCEA36QviK/s2g081hvmGs8eaE3DWb6NYZQ6BjO/QkNRPenoPA==",
+      "version": "1.58.2",
       "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
@@ -8748,8 +8554,6 @@
     },
     "node_modules/pngjs": {
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/pngjs/-/pngjs-7.0.0.tgz",
-      "integrity": "sha512-LKWqWJRhstyYo9pGvgor/ivk2w94eSjE3RGVuzLGlr3NmD8bf7RcYGze1mNdEHRP6TRP6rMuDHk5t44hnTRyow==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -8757,9 +8561,7 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.15",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
-      "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+      "version": "8.5.6",
       "devOptional": true,
       "funding": [
         {
@@ -8777,7 +8579,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.12",
+        "nanoid": "^3.3.11",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -8787,8 +8589,6 @@
     },
     "node_modules/postcss-load-config": {
       "version": "3.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-3.1.4.tgz",
-      "integrity": "sha512-6DiM4E7v4coTE4uzA8U//WhtPwyhiim3eyjEMFCnUpzbrkK9wJHgKDT2mR+HbtSrd/NubVaYTOpSpjUl8NQeRg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8816,9 +8616,7 @@
       }
     },
     "node_modules/postcss-load-config/node_modules/yaml": {
-      "version": "1.10.3",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.3.tgz",
-      "integrity": "sha512-vIYeF1u3CjlhAFekPPAk2h/Kv4T3mAkMox5OymRiJQB0spDP10LHvt+K7G9Ny6NuuMAb25/6n1qyUjAcGNf/AA==",
+      "version": "1.10.2",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -8827,8 +8625,6 @@
     },
     "node_modules/postcss-safe-parser": {
       "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/postcss-safe-parser/-/postcss-safe-parser-7.0.1.tgz",
-      "integrity": "sha512-0AioNCJZ2DPYz5ABT6bddIqlhgwhpHZ/l65YAYo0BCIn0xiDpsnTHz0gnoTGk0OXZW0JRs+cDwL8u/teRdz+8A==",
       "dev": true,
       "funding": [
         {
@@ -8854,8 +8650,6 @@
     },
     "node_modules/postcss-scss": {
       "version": "4.0.9",
-      "resolved": "https://registry.npmjs.org/postcss-scss/-/postcss-scss-4.0.9.tgz",
-      "integrity": "sha512-AjKOeiwAitL/MXxQW2DliT28EKukvvbEWx3LBmJIRN8KfBGZbRTxNYW0kSqi1COiTZ57nZ9NW06S6ux//N1c9A==",
       "dev": true,
       "funding": [
         {
@@ -8880,9 +8674,7 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "7.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.4.tgz",
-      "integrity": "sha512-HeP7D2wyhkR+XaK6v4W8oRF62Dsz4flyuczALJp61GckGm42u1saSSJ/0auvcBqxs3jMRFEcPK34At/0JBKdOg==",
+      "version": "7.1.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8895,8 +8687,6 @@
     },
     "node_modules/postgres-array": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
-      "integrity": "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA==",
       "license": "MIT",
       "engines": {
         "node": ">=4"
@@ -8904,8 +8694,6 @@
     },
     "node_modules/postgres-bytea": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/postgres-bytea/-/postgres-bytea-1.0.1.tgz",
-      "integrity": "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -8913,8 +8701,6 @@
     },
     "node_modules/postgres-date": {
       "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/postgres-date/-/postgres-date-1.0.7.tgz",
-      "integrity": "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -8922,8 +8708,6 @@
     },
     "node_modules/postgres-interval": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/postgres-interval/-/postgres-interval-1.2.0.tgz",
-      "integrity": "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ==",
       "license": "MIT",
       "dependencies": {
         "xtend": "^4.0.0"
@@ -8934,9 +8718,6 @@
     },
     "node_modules/prebuild-install": {
       "version": "7.1.3",
-      "resolved": "https://registry.npmjs.org/prebuild-install/-/prebuild-install-7.1.3.tgz",
-      "integrity": "sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==",
-      "deprecated": "No longer maintained. Please contact the author of the relevant native addon; alternatives are available.",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -8963,8 +8744,6 @@
     },
     "node_modules/prelude-ls": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
-      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -8972,9 +8751,7 @@
       }
     },
     "node_modules/prettier": {
-      "version": "3.8.4",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.4.tgz",
-      "integrity": "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==",
+      "version": "3.8.1",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -8988,9 +8765,7 @@
       }
     },
     "node_modules/prettier-plugin-svelte": {
-      "version": "3.5.2",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-svelte/-/prettier-plugin-svelte-3.5.2.tgz",
-      "integrity": "sha512-ItFouLvzSFE3ulNl4DKoWM3BGcbDCNVpIyy/Y3F2gC3aNiGLxtFUdffVqO5Z5hhYG+DFT5KULWaxmeFFpdbvaQ==",
+      "version": "3.5.0",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -8999,9 +8774,7 @@
       }
     },
     "node_modules/prettier-plugin-tailwindcss": {
-      "version": "0.7.4",
-      "resolved": "https://registry.npmjs.org/prettier-plugin-tailwindcss/-/prettier-plugin-tailwindcss-0.7.4.tgz",
-      "integrity": "sha512-UKii4RjY05SNt/WQi6/NcOn/LsT0/ILLXsxygjbRg5/YZelsSu5jTqorYHPDGq4nZy5q5hpCu+XdGZ1xaJEQgw==",
+      "version": "0.7.2",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9079,8 +8852,6 @@
     },
     "node_modules/pretty-bytes": {
       "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/pretty-bytes/-/pretty-bytes-7.1.0.tgz",
-      "integrity": "sha512-nODzvTiYVRGRqAOvE84Vk5JDPyyxsVk0/fbA/bq7RqlnhksGpset09XTxbpvLTIjoaF7K8Z8DG8yHtKGTPSYRw==",
       "license": "MIT",
       "engines": {
         "node": ">=20"
@@ -9091,8 +8862,6 @@
     },
     "node_modules/proc-log": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-5.0.0.tgz",
-      "integrity": "sha512-Azwzvl90HaF0aCz1JrDdXQykFakSSNPaPoiZ9fm5qJIMHioDZEi7OAdRwSm6rSoPtY3Qutnm3L7ogmg3dc+wbQ==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -9100,10 +8869,21 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
+    "node_modules/process": {
+      "version": "0.11.10",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.6.0"
+      }
+    },
+    "node_modules/process-nextick-args": {
+      "version": "2.0.1",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/process-warning": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.0.0.tgz",
-      "integrity": "sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==",
       "funding": [
         {
           "type": "github",
@@ -9118,8 +8898,6 @@
     },
     "node_modules/prom-client": {
       "version": "15.1.3",
-      "resolved": "https://registry.npmjs.org/prom-client/-/prom-client-15.1.3.tgz",
-      "integrity": "sha512-6ZiOBfCywsD4k1BN9IX0uZhF+tJkV8q8llP64G5Hajs4JOeVLPCwpPVcpXy3BwYiUGgyJzsJJQeOIv7+hDSq8g==",
       "license": "Apache-2.0",
       "dependencies": {
         "@opentelemetry/api": "^1.4.0",
@@ -9131,8 +8909,6 @@
     },
     "node_modules/promise-retry": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
-      "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9144,18 +8920,68 @@
         "node": ">=10"
       }
     },
+    "node_modules/proper-lockfile": {
+      "version": "4.1.2",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "graceful-fs": "^4.2.4",
+        "retry": "^0.12.0",
+        "signal-exit": "^3.0.2"
+      }
+    },
+    "node_modules/proper-lockfile/node_modules/signal-exit": {
+      "version": "3.0.7",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/properties-reader": {
+      "version": "3.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@kwsites/file-exists": "^1.1.1",
+        "mkdirp": "^3.0.1"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/steveukx/properties?sponsor=1"
+      }
+    },
     "node_modules/property-expr": {
       "version": "2.0.6",
-      "resolved": "https://registry.npmjs.org/property-expr/-/property-expr-2.0.6.tgz",
-      "integrity": "sha512-SVtmxhRE/CGkn3eZY1T6pC8Nln6Fr/lu1mKSgRud0eC73whjGfoAogbn78LkD8aFL0zz3bAFerKSnOl7NlErBA==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
+    "node_modules/protobufjs": {
+      "version": "7.6.3",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "@protobufjs/aspromise": "^1.1.2",
+        "@protobufjs/base64": "^1.1.2",
+        "@protobufjs/codegen": "^2.0.5",
+        "@protobufjs/eventemitter": "^1.1.1",
+        "@protobufjs/fetch": "^1.1.1",
+        "@protobufjs/float": "^1.0.2",
+        "@protobufjs/inquire": "^1.1.2",
+        "@protobufjs/path": "^1.1.2",
+        "@protobufjs/pool": "^1.1.0",
+        "@protobufjs/utf8": "^1.1.1",
+        "@types/node": ">=13.7.0",
+        "long": "^5.3.2"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9167,9 +8993,7 @@
       }
     },
     "node_modules/pump": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/pump/-/pump-3.0.4.tgz",
-      "integrity": "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==",
+      "version": "3.0.3",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9179,8 +9003,6 @@
     },
     "node_modules/punycode": {
       "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
-      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9189,8 +9011,6 @@
     },
     "node_modules/pure-rand": {
       "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/pure-rand/-/pure-rand-6.1.0.tgz",
-      "integrity": "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==",
       "dev": true,
       "funding": [
         {
@@ -9206,9 +9026,7 @@
       "optional": true
     },
     "node_modules/qs": {
-      "version": "6.15.2",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.2.tgz",
-      "integrity": "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==",
+      "version": "6.15.0",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -9223,8 +9041,6 @@
     },
     "node_modules/quansync": {
       "version": "0.2.11",
-      "resolved": "https://registry.npmjs.org/quansync/-/quansync-0.2.11.tgz",
-      "integrity": "sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==",
       "dev": true,
       "funding": [
         {
@@ -9240,22 +9056,16 @@
     },
     "node_modules/quick-format-unescaped": {
       "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
-      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
       "license": "MIT"
     },
     "node_modules/railroad-diagrams": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/railroad-diagrams/-/railroad-diagrams-1.0.0.tgz",
-      "integrity": "sha512-cz93DjNeLY0idrCNOH6PviZGRN9GJhsdm9hpn1YCS879fj4W+x5IFJhhkRZcwVgMmFF7R82UA/7Oh+R8lLZg6A==",
       "dev": true,
       "license": "CC0-1.0",
       "optional": true
     },
     "node_modules/randexp": {
       "version": "0.4.6",
-      "resolved": "https://registry.npmjs.org/randexp/-/randexp-0.4.6.tgz",
-      "integrity": "sha512-80WNmd9DA0tmZrw9qQa62GPPWfuXJknrmVmLcxvq4uZBdYqb1wYoKTmnlGUchvVWe0XiLupYkBoXVOxz3C8DYQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9269,8 +9079,6 @@
     },
     "node_modules/range-parser": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
-      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9279,8 +9087,6 @@
     },
     "node_modules/raw-body": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
-      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9293,27 +9099,8 @@
         "node": ">= 0.10"
       }
     },
-    "node_modules/raw-body/node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3.0.0"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/rc": {
       "version": "1.2.8",
-      "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
-      "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
       "dev": true,
       "license": "(BSD-2-Clause OR MIT OR Apache-2.0)",
       "optional": true,
@@ -9329,8 +9116,6 @@
     },
     "node_modules/rc/node_modules/strip-json-comments": {
       "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
-      "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9340,8 +9125,6 @@
     },
     "node_modules/readable-stream": {
       "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
       "license": "MIT",
       "dependencies": {
         "inherits": "^2.0.3",
@@ -9352,10 +9135,35 @@
         "node": ">= 6"
       }
     },
+    "node_modules/readdir-glob": {
+      "version": "1.1.3",
+      "dev": true,
+      "license": "Apache-2.0",
+      "dependencies": {
+        "minimatch": "^5.1.0"
+      }
+    },
+    "node_modules/readdir-glob/node_modules/brace-expansion": {
+      "version": "2.1.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/readdir-glob/node_modules/minimatch": {
+      "version": "5.1.9",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/readdirp": {
       "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-4.1.2.tgz",
-      "integrity": "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9368,8 +9176,6 @@
     },
     "node_modules/real-require": {
       "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
-      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
       "license": "MIT",
       "engines": {
         "node": ">= 12.13.0"
@@ -9377,18 +9183,22 @@
     },
     "node_modules/regexp-tree": {
       "version": "0.1.27",
-      "resolved": "https://registry.npmjs.org/regexp-tree/-/regexp-tree-0.1.27.tgz",
-      "integrity": "sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==",
       "dev": true,
       "license": "MIT",
       "bin": {
         "regexp-tree": "bin/regexp-tree"
       }
     },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/require-from-string": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
-      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9397,13 +9207,10 @@
       }
     },
     "node_modules/resolve": {
-      "version": "1.22.12",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.12.tgz",
-      "integrity": "sha512-TyeJ1zif53BPfHootBGwPRYT1RUt6oGWsaQr8UyZW/eAm9bKoijtvruSDEmZHm92CwS9nj7/fWttqPCgzep8CA==",
+      "version": "1.22.11",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "es-errors": "^1.3.0",
         "is-core-module": "^2.16.1",
         "path-parse": "^1.0.7",
         "supports-preserve-symlinks-flag": "^1.0.0"
@@ -9420,8 +9227,6 @@
     },
     "node_modules/resolve-from": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
-      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9430,8 +9235,6 @@
     },
     "node_modules/resolve-pkg-maps": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
-      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
       "devOptional": true,
       "license": "MIT",
       "funding": {
@@ -9440,8 +9243,6 @@
     },
     "node_modules/ret": {
       "version": "0.1.15",
-      "resolved": "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz",
-      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9451,23 +9252,18 @@
     },
     "node_modules/retry": {
       "version": "0.12.0",
-      "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
-      "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">= 4"
       }
     },
     "node_modules/rollup": {
-      "version": "4.62.2",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.62.2.tgz",
-      "integrity": "sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==",
+      "version": "4.57.1",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@types/estree": "1.0.9"
+        "@types/estree": "1.0.8"
       },
       "bin": {
         "rollup": "dist/bin/rollup"
@@ -9477,31 +9273,31 @@
         "npm": ">=8.0.0"
       },
       "optionalDependencies": {
-        "@rollup/rollup-android-arm-eabi": "4.62.2",
-        "@rollup/rollup-android-arm64": "4.62.2",
-        "@rollup/rollup-darwin-arm64": "4.62.2",
-        "@rollup/rollup-darwin-x64": "4.62.2",
-        "@rollup/rollup-freebsd-arm64": "4.62.2",
-        "@rollup/rollup-freebsd-x64": "4.62.2",
-        "@rollup/rollup-linux-arm-gnueabihf": "4.62.2",
-        "@rollup/rollup-linux-arm-musleabihf": "4.62.2",
-        "@rollup/rollup-linux-arm64-gnu": "4.62.2",
-        "@rollup/rollup-linux-arm64-musl": "4.62.2",
-        "@rollup/rollup-linux-loong64-gnu": "4.62.2",
-        "@rollup/rollup-linux-loong64-musl": "4.62.2",
-        "@rollup/rollup-linux-ppc64-gnu": "4.62.2",
-        "@rollup/rollup-linux-ppc64-musl": "4.62.2",
-        "@rollup/rollup-linux-riscv64-gnu": "4.62.2",
-        "@rollup/rollup-linux-riscv64-musl": "4.62.2",
-        "@rollup/rollup-linux-s390x-gnu": "4.62.2",
-        "@rollup/rollup-linux-x64-gnu": "4.62.2",
-        "@rollup/rollup-linux-x64-musl": "4.62.2",
-        "@rollup/rollup-openbsd-x64": "4.62.2",
-        "@rollup/rollup-openharmony-arm64": "4.62.2",
-        "@rollup/rollup-win32-arm64-msvc": "4.62.2",
-        "@rollup/rollup-win32-ia32-msvc": "4.62.2",
-        "@rollup/rollup-win32-x64-gnu": "4.62.2",
-        "@rollup/rollup-win32-x64-msvc": "4.62.2",
+        "@rollup/rollup-android-arm-eabi": "4.57.1",
+        "@rollup/rollup-android-arm64": "4.57.1",
+        "@rollup/rollup-darwin-arm64": "4.57.1",
+        "@rollup/rollup-darwin-x64": "4.57.1",
+        "@rollup/rollup-freebsd-arm64": "4.57.1",
+        "@rollup/rollup-freebsd-x64": "4.57.1",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.57.1",
+        "@rollup/rollup-linux-arm-musleabihf": "4.57.1",
+        "@rollup/rollup-linux-arm64-gnu": "4.57.1",
+        "@rollup/rollup-linux-arm64-musl": "4.57.1",
+        "@rollup/rollup-linux-loong64-gnu": "4.57.1",
+        "@rollup/rollup-linux-loong64-musl": "4.57.1",
+        "@rollup/rollup-linux-ppc64-gnu": "4.57.1",
+        "@rollup/rollup-linux-ppc64-musl": "4.57.1",
+        "@rollup/rollup-linux-riscv64-gnu": "4.57.1",
+        "@rollup/rollup-linux-riscv64-musl": "4.57.1",
+        "@rollup/rollup-linux-s390x-gnu": "4.57.1",
+        "@rollup/rollup-linux-x64-gnu": "4.57.1",
+        "@rollup/rollup-linux-x64-musl": "4.57.1",
+        "@rollup/rollup-openbsd-x64": "4.57.1",
+        "@rollup/rollup-openharmony-arm64": "4.57.1",
+        "@rollup/rollup-win32-arm64-msvc": "4.57.1",
+        "@rollup/rollup-win32-ia32-msvc": "4.57.1",
+        "@rollup/rollup-win32-x64-gnu": "4.57.1",
+        "@rollup/rollup-win32-x64-msvc": "4.57.1",
         "fsevents": "~2.3.2"
       }
     },
@@ -9513,8 +9309,6 @@
     },
     "node_modules/router": {
       "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
-      "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9530,8 +9324,6 @@
     },
     "node_modules/sade": {
       "version": "1.8.1",
-      "resolved": "https://registry.npmjs.org/sade/-/sade-1.8.1.tgz",
-      "integrity": "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9543,15 +9335,11 @@
     },
     "node_modules/safe-buffer": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/safe-regex": {
       "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-2.1.1.tgz",
-      "integrity": "sha512-rx+x8AMzKb5Q5lQ95Zoi6ZbJqwCLkqi3XuJXp5P3rT8OEc6sZCJG5AE5dU3lsgRr/F4Bs31jSlVN+j5KrsGu9A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9560,8 +9348,6 @@
     },
     "node_modules/safe-stable-stringify": {
       "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
-      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
       "license": "MIT",
       "engines": {
         "node": ">=10"
@@ -9569,15 +9355,11 @@
     },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
-      "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/schemes": {
       "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/schemes/-/schemes-1.4.0.tgz",
-      "integrity": "sha512-ImFy9FbCsQlVgnE3TCWmLPCFnVzx0lHL/l+umHplDqAKd0dzFpnS6lFZIpagBlYhKwzVmlV36ec0Y1XTu8JBAQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9587,8 +9369,6 @@
     },
     "node_modules/secure-json-parse": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/secure-json-parse/-/secure-json-parse-4.1.0.tgz",
-      "integrity": "sha512-l4KnYfEyqYJxDwlNVyRfO2E4NTHfMKAWdUuA8J0yve2Dz/E/PdBepY03RvyJpssIpRFwJoCD55wA+mEDs6ByWA==",
       "dev": true,
       "funding": [
         {
@@ -9603,10 +9383,8 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/semver": {
-      "version": "7.8.5",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
-      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
-      "devOptional": true,
+      "version": "7.7.4",
+      "dev": true,
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -9617,8 +9395,6 @@
     },
     "node_modules/send": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
-      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9644,8 +9420,6 @@
     },
     "node_modules/serve-static": {
       "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-2.2.1.tgz",
-      "integrity": "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9663,22 +9437,16 @@
       }
     },
     "node_modules/set-cookie-parser": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/set-cookie-parser/-/set-cookie-parser-3.1.0.tgz",
-      "integrity": "sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw==",
+      "version": "3.0.1",
       "license": "MIT"
     },
     "node_modules/setprototypeof": {
       "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
-      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/shebang-command": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9690,8 +9458,6 @@
     },
     "node_modules/shebang-regex": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -9699,15 +9465,13 @@
       }
     },
     "node_modules/side-channel": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.1.tgz",
-      "integrity": "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==",
+      "version": "1.1.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4",
-        "side-channel-list": "^1.0.1",
+        "object-inspect": "^1.13.3",
+        "side-channel-list": "^1.0.0",
         "side-channel-map": "^1.0.1",
         "side-channel-weakmap": "^1.0.2"
       },
@@ -9719,14 +9483,12 @@
       }
     },
     "node_modules/side-channel-list": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.1.tgz",
-      "integrity": "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==",
+      "version": "1.0.0",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "es-errors": "^1.3.0",
-        "object-inspect": "^1.13.4"
+        "object-inspect": "^1.13.3"
       },
       "engines": {
         "node": ">= 0.4"
@@ -9737,8 +9499,6 @@
     },
     "node_modules/side-channel-map": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
-      "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9756,8 +9516,6 @@
     },
     "node_modules/side-channel-weakmap": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
-      "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9776,18 +9534,13 @@
     },
     "node_modules/siginfo": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
-      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
       "devOptional": true,
       "license": "ISC"
     },
     "node_modules/signal-exit": {
       "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
       "dev": true,
       "license": "ISC",
-      "optional": true,
       "engines": {
         "node": ">=14"
       },
@@ -9797,8 +9550,6 @@
     },
     "node_modules/simple-concat": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
-      "integrity": "sha512-cSFtAPtRhljv69IK0hTVZQ+OfE9nePi/rtJmw5UjHeVyVroEqJXP1sFztKUy1qU+xvz3u/sfYJLa947b7nAN2Q==",
       "dev": true,
       "funding": [
         {
@@ -9819,8 +9570,6 @@
     },
     "node_modules/simple-get": {
       "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/simple-get/-/simple-get-4.0.1.tgz",
-      "integrity": "sha512-brv7p5WgH0jmQJr1ZDDfKDOSeWWg+OVypG99A/5vYGPqJ6pxiaHLy8nxtFjBA7oMa01ebA9gfh1uMCFqOuXxvA==",
       "dev": true,
       "funding": [
         {
@@ -9846,8 +9595,6 @@
     },
     "node_modules/sirv": {
       "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
-      "integrity": "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -9861,8 +9608,6 @@
     },
     "node_modules/smart-buffer": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
-      "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9873,8 +9618,6 @@
     },
     "node_modules/smtp-address-parser": {
       "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/smtp-address-parser/-/smtp-address-parser-1.1.0.tgz",
-      "integrity": "sha512-Gz11jbNU0plrReU9Sj7fmshSBxxJ9ShdD2q4ktHIHo/rpTH6lFyQoYHYKINPJtPe8aHFnsbtW46Ls0tCCBsIZg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9886,14 +9629,12 @@
       }
     },
     "node_modules/socks": {
-      "version": "2.8.9",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
-      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
+      "version": "2.8.7",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "ip-address": "^10.1.1",
+        "ip-address": "^10.0.1",
         "smart-buffer": "^4.2.0"
       },
       "engines": {
@@ -9903,8 +9644,6 @@
     },
     "node_modules/socks-proxy-agent": {
       "version": "8.0.5",
-      "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
-      "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -9919,8 +9658,6 @@
     },
     "node_modules/sonic-boom": {
       "version": "4.2.1",
-      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
-      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
       "license": "MIT",
       "dependencies": {
         "atomic-sleep": "^1.0.0"
@@ -9928,8 +9665,6 @@
     },
     "node_modules/source-map": {
       "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
       "devOptional": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -9938,8 +9673,6 @@
     },
     "node_modules/source-map-js": {
       "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
       "devOptional": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -9948,8 +9681,6 @@
     },
     "node_modules/source-map-support": {
       "version": "0.5.21",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
-      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -9959,8 +9690,6 @@
     },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
-      "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -9968,28 +9697,13 @@
         "spdx-license-ids": "^3.0.0"
       }
     },
-    "node_modules/spdx-correct/node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
     "node_modules/spdx-exceptions": {
       "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
-      "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w==",
       "dev": true,
       "license": "CC-BY-3.0"
     },
     "node_modules/spdx-expression-parse": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-4.0.0.tgz",
-      "integrity": "sha512-Clya5JIij/7C6bRR22+tnGXbc4VKlibKSVj2iHvVeX5iMW7s1SIQlqu699JkODJJIhh/pUu8L0/VLh8xflD+LQ==",
+      "version": "3.0.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -9999,15 +9713,16 @@
     },
     "node_modules/spdx-license-ids": {
       "version": "3.0.23",
-      "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.23.tgz",
-      "integrity": "sha512-CWLcCCH7VLu13TgOH+r8p1O/Znwhqv/dbb6lqWy67G+pT1kHmeD/+V36AVb/vq8QMIQwVShJ6Ssl5FPh0fuSdw==",
       "dev": true,
       "license": "CC0-1.0"
     },
+    "node_modules/split-ca": {
+      "version": "1.0.1",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/split2": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
-      "integrity": "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==",
       "license": "ISC",
       "engines": {
         "node": ">= 10.x"
@@ -10015,8 +9730,6 @@
     },
     "node_modules/sqlite-wasm-kysely": {
       "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/sqlite-wasm-kysely/-/sqlite-wasm-kysely-0.3.0.tgz",
-      "integrity": "sha512-TzjBNv7KwRw6E3pdKdlRyZiTmUIE0UttT/Sl56MVwVARl/u5gp978KepazCJZewFUnlWHz9i3NQd4kOtP/Afdg==",
       "dev": true,
       "dependencies": {
         "@sqlite.org/sqlite-wasm": "^3.48.0-build2"
@@ -10025,10 +9738,48 @@
         "kysely": "*"
       }
     },
+    "node_modules/ssh-remote-port-forward": {
+      "version": "1.0.4",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/ssh2": "^0.5.48",
+        "ssh2": "^1.4.0"
+      }
+    },
+    "node_modules/ssh-remote-port-forward/node_modules/@types/ssh2": {
+      "version": "0.5.52",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*",
+        "@types/ssh2-streams": "*"
+      }
+    },
+    "node_modules/ssh2": {
+      "version": "1.17.0",
+      "dev": true,
+      "hasInstallScript": true,
+      "dependencies": {
+        "asn1": "^0.2.6",
+        "bcrypt-pbkdf": "^1.0.2"
+      },
+      "engines": {
+        "node": ">=10.16.0"
+      },
+      "optionalDependencies": {
+        "cpu-features": "~0.0.10",
+        "nan": "^2.23.0"
+      }
+    },
+    "node_modules/ssh2/node_modules/nan": {
+      "version": "2.27.0",
+      "dev": true,
+      "license": "MIT",
+      "optional": true
+    },
     "node_modules/ssri": {
       "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/ssri/-/ssri-12.0.0.tgz",
-      "integrity": "sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -10041,15 +9792,11 @@
     },
     "node_modules/stackback": {
       "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
-      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/statuses": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
-      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10057,16 +9804,12 @@
       }
     },
     "node_modules/std-env": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/std-env/-/std-env-4.1.0.tgz",
-      "integrity": "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ==",
+      "version": "3.10.0",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/stream-browserify": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/stream-browserify/-/stream-browserify-3.0.0.tgz",
-      "integrity": "sha512-H73RAHsVBapbim0tU2JwwOiXUj+fikfiaoYAKHF3VJfA0pe2BCzkhAHBlLG6REzE+2WNZcxOXjK7lkso+9euLA==",
       "license": "MIT",
       "dependencies": {
         "inherits": "~2.0.4",
@@ -10074,9 +9817,7 @@
       }
     },
     "node_modules/streamx": {
-      "version": "2.28.0",
-      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.28.0.tgz",
-      "integrity": "sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==",
+      "version": "2.27.0",
       "license": "MIT",
       "dependencies": {
         "events-universal": "^1.0.0",
@@ -10086,8 +9827,6 @@
     },
     "node_modules/string_decoder": {
       "version": "1.3.0",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
-      "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
       "license": "MIT",
       "dependencies": {
         "safe-buffer": "~5.2.0"
@@ -10095,8 +9834,6 @@
     },
     "node_modules/string_decoder/node_modules/safe-buffer": {
       "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
       "funding": [
         {
           "type": "github",
@@ -10115,11 +9852,8 @@
     },
     "node_modules/string-width": {
       "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
-      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "eastasianwidth": "^0.2.0",
         "emoji-regex": "^9.2.2",
@@ -10135,11 +9869,8 @@
     "node_modules/string-width-cjs": {
       "name": "string-width",
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "emoji-regex": "^8.0.0",
         "is-fullwidth-code-point": "^3.0.0",
@@ -10151,30 +9882,21 @@
     },
     "node_modules/string-width-cjs/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=8"
       }
     },
     "node_modules/string-width-cjs/node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/string-width-cjs/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ansi-regex": "^5.0.1"
       },
@@ -10184,8 +9906,6 @@
     },
     "node_modules/stringtemplate4ts": {
       "version": "1.0.9",
-      "resolved": "https://registry.npmjs.org/stringtemplate4ts/-/stringtemplate4ts-1.0.9.tgz",
-      "integrity": "sha512-KYZm2bJlSjynG5Y+L46fkaKBQG6mhV6hb2RBA8dpx3/Vj6G4u7gwXNKYvaN9+QD5sj68/1srtSNDvqEso7MwsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10197,18 +9917,13 @@
     },
     "node_modules/stringtemplate4ts/node_modules/antlr4ng": {
       "version": "3.0.15",
-      "resolved": "https://registry.npmjs.org/antlr4ng/-/antlr4ng-3.0.15.tgz",
-      "integrity": "sha512-VELFqTfcpGI2bj6ScMWuxM3FI6HOsojrgmnw3cCbUtsQ1DNOq32wJsjOt7vLvfIniyyuE1DIYegGcuFmn+jgyw==",
       "dev": true,
       "license": "BSD-3-Clause"
     },
     "node_modules/strip-ansi": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
-      "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ansi-regex": "^6.2.2"
       },
@@ -10222,11 +9937,8 @@
     "node_modules/strip-ansi-cjs": {
       "name": "strip-ansi",
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ansi-regex": "^5.0.1"
       },
@@ -10236,19 +9948,14 @@
     },
     "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=8"
       }
     },
     "node_modules/strip-bom": {
       "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/strip-bom/-/strip-bom-3.0.0.tgz",
-      "integrity": "sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10257,8 +9964,6 @@
     },
     "node_modules/strip-json-comments": {
       "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
-      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10268,10 +9973,18 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/strnum": {
+      "version": "2.3.0",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/superstruct": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/superstruct/-/superstruct-2.0.2.tgz",
-      "integrity": "sha512-uV+TFRZdXsqXTL2pRvujROjdZQ4RAlBUS5BTh9IGm+jTqQntYThciG/qu57Gs69yjnVUSqdxF9YLmSnpupBW9A==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -10281,9 +9994,7 @@
     },
     "node_modules/supports-color": {
       "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "devOptional": true,
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "has-flag": "^4.0.0"
@@ -10294,8 +10005,6 @@
     },
     "node_modules/supports-preserve-symlinks-flag": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
-      "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10306,24 +10015,22 @@
       }
     },
     "node_modules/svelte": {
-      "version": "5.56.3",
-      "resolved": "https://registry.npmjs.org/svelte/-/svelte-5.56.3.tgz",
-      "integrity": "sha512-w7JvrM5IFl5cmfbY0TLik9o7mjRUJmRMhOR51tBPu708Gr/MjbGs7VnJnr/B0CaXeI4vtnOh7RKxDr0cwhMdDA==",
+      "version": "5.53.5",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/remapping": "^2.3.4",
         "@jridgewell/sourcemap-codec": "^1.5.0",
-        "@sveltejs/acorn-typescript": "^1.0.10",
+        "@sveltejs/acorn-typescript": "^1.0.5",
         "@types/estree": "^1.0.5",
         "@types/trusted-types": "^2.0.7",
         "acorn": "^8.12.1",
         "aria-query": "5.3.1",
         "axobject-query": "^4.1.0",
         "clsx": "^2.1.1",
-        "devalue": "^5.8.1",
+        "devalue": "^5.6.3",
         "esm-env": "^1.2.1",
-        "esrap": "^2.2.11",
+        "esrap": "^2.2.2",
         "is-reference": "^3.0.3",
         "locate-character": "^3.0.0",
         "magic-string": "^0.30.11",
@@ -10334,14 +10041,11 @@
       }
     },
     "node_modules/svelte-check": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/svelte-check/-/svelte-check-4.6.0.tgz",
-      "integrity": "sha512-KhVnDFDSid57mmZtHz8gfW8AAGylOZ0vPnOIzVmAL+urzwK8sBYXRss953gD8T0OdgAQ11mdWhE6uadmtOz8TQ==",
+      "version": "4.4.3",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.25",
-        "@sveltejs/load-config": "0.1.1",
         "chokidar": "^4.0.1",
         "fdir": "^6.2.0",
         "picocolors": "^1.0.0",
@@ -10359,9 +10063,7 @@
       }
     },
     "node_modules/svelte-eslint-parser": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/svelte-eslint-parser/-/svelte-eslint-parser-1.8.0.tgz",
-      "integrity": "sha512-mikR1qwIVy3t5WthUoAXkMwxkXvabZP9FJgdx35Ei7EbGWmctva1Pih16Koeor/bdNNq8NXHlwKGS6NkYTawLg==",
+      "version": "1.4.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10370,12 +10072,11 @@
         "espree": "^10.0.0",
         "postcss": "^8.4.49",
         "postcss-scss": "^4.0.9",
-        "postcss-selector-parser": "^7.0.0",
-        "semver": "^7.7.2"
+        "postcss-selector-parser": "^7.0.0"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0",
-        "pnpm": "10.34.1"
+        "pnpm": "10.24.0"
       },
       "funding": {
         "url": "https://github.com/sponsors/ota-meshi"
@@ -10391,8 +10092,6 @@
     },
     "node_modules/svelte/node_modules/is-reference": {
       "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/is-reference/-/is-reference-3.0.3.tgz",
-      "integrity": "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -10400,9 +10099,7 @@
       }
     },
     "node_modules/sveltekit-superforms": {
-      "version": "2.30.1",
-      "resolved": "https://registry.npmjs.org/sveltekit-superforms/-/sveltekit-superforms-2.30.1.tgz",
-      "integrity": "sha512-wBzyqsE0idvEJWuNJ+HCiAtdxa7Z55GZ8jmtlVHJfonrk9bRYC49MoPaloYyFoYuU3QPy6Omna/Qzn1kaIkgew==",
+      "version": "2.30.0",
       "dev": true,
       "funding": [
         {
@@ -10420,26 +10117,26 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "devalue": "^5.6.4",
+        "devalue": "^5.6.3",
         "memoize-weak": "^1.0.2",
         "ts-deepmerge": "^7.0.3"
       },
       "optionalDependencies": {
         "@exodus/schemasafe": "^1.3.0",
-        "@standard-schema/spec": "^1.1.0",
+        "@standard-schema/spec": "^1.0.0",
         "@typeschema/class-validator": "^0.3.0",
-        "@valibot/to-json-schema": "^1.6.0",
+        "@valibot/to-json-schema": "^1.5.0",
         "@vinejs/vine": "^3.0.1",
-        "arktype": "^2.2.0",
-        "class-validator": "^0.14.4",
-        "effect": "^3.21.0",
+        "arktype": "^2.1.29",
+        "class-validator": "^0.14.3",
+        "effect": "^3.19.12",
         "joi": "^17.13.3",
         "json-schema-to-ts": "^3.1.1",
         "superstruct": "^2.0.2",
-        "typebox": "^1.1.6",
-        "valibot": "^1.3.1",
+        "typebox": "^1.0.62",
+        "valibot": "^1.2.0",
         "yup": "^1.7.1",
-        "zod": "^4.3.6",
+        "zod": "^4.1.13",
         "zod-v3-to-json-schema": "^4.0.0"
       },
       "peerDependencies": {
@@ -10449,7 +10146,7 @@
         "@vinejs/vine": "^1.8.0 || ^2.0.0 || ^3.0.0",
         "arktype": ">=2.0.0-rc.23",
         "class-validator": "^0.14.1",
-        "effect": "^3.21.0",
+        "effect": "^3.13.7",
         "joi": "^17.13.1",
         "superstruct": "^2.0.2",
         "svelte": "3.x || 4.x || >=5.0.0-next.51",
@@ -10497,22 +10194,12 @@
         }
       }
     },
-    "node_modules/sveltekit-superforms/node_modules/typebox": {
-      "version": "1.2.19",
-      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.2.19.tgz",
-      "integrity": "sha512-9stLVZhos9aUXJzu0Yf717xbcv3vFsE5APzsQ7j/honIUFtern451IdTlqmVzPzuGxHkeWwWc2cerw6m2lqKOQ==",
-      "dev": true,
-      "license": "MIT",
-      "optional": true
-    },
     "node_modules/synckit": {
-      "version": "0.11.13",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz",
-      "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==",
+      "version": "0.11.12",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@pkgr/core": "^0.3.6"
+        "@pkgr/core": "^0.2.9"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -10522,9 +10209,7 @@
       }
     },
     "node_modules/tailwind-csstree": {
-      "version": "0.3.3",
-      "resolved": "https://registry.npmjs.org/tailwind-csstree/-/tailwind-csstree-0.3.3.tgz",
-      "integrity": "sha512-je9J5UYRsTJqAjYrIBMMlge8T/rreRd44pJxgG5Zx/zeo4kAC/liUKqzztRZrGlYRJLvIf2Cb1DVJMTXSzEShA==",
+      "version": "0.1.4",
       "dev": true,
       "license": "Apache-2.0",
       "engines": {
@@ -10533,27 +10218,15 @@
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/nzakas"
-      },
-      "peerDependencies": {
-        "@eslint/css": ">=1.0.0"
-      },
-      "peerDependenciesMeta": {
-        "@eslint/css": {
-          "optional": true
-        }
       }
     },
     "node_modules/tailwindcss": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.1.tgz",
-      "integrity": "sha512-hk+TB1m+K8CYNrP6rjQaq/Y+4Zylwpa87mLYBKCunwnnQ9p+fHb7kmSfGqyEJoxF/O6CDyABWVFEafNSYKll+Q==",
+      "version": "4.2.1",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/tapable": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/tapable/-/tapable-2.3.3.tgz",
-      "integrity": "sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==",
+      "version": "2.3.0",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10565,9 +10238,7 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.16",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.16.tgz",
-      "integrity": "sha512-56adEpPMouktRlBLXiaYFFzZ/3+JXa8P9n7WbR+ibIjtviN55mEaOkiysCnPnWm+7kkui1Dn8J9l+g6zV8731w==",
+      "version": "7.5.11",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "optional": true,
@@ -10584,11 +10255,8 @@
     },
     "node_modules/tar-fs": {
       "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/tar-fs/-/tar-fs-2.1.4.tgz",
-      "integrity": "sha512-mDAjwmZdh7LTT6pNleZ05Yt65HC3E+NiQzl672vQG38jIrehtJk/J3mNwIg+vShQPcLF/LV7CMnDW6vjj6sfYQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "chownr": "^1.1.1",
         "mkdirp-classic": "^0.5.2",
@@ -10596,21 +10264,12 @@
         "tar-stream": "^2.1.4"
       }
     },
-    "node_modules/tar-fs/node_modules/chownr": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-      "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
-      "dev": true,
-      "license": "ISC",
-      "optional": true
-    },
     "node_modules/tar-fs/node_modules/tar-stream": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
       "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "bl": "^4.0.3",
         "end-of-stream": "^1.4.1",
@@ -10634,10 +10293,17 @@
         "streamx": "^2.15.0"
       }
     },
+    "node_modules/tar/node_modules/chownr": {
+      "version": "3.0.0",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "optional": true,
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/tdigest": {
       "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/tdigest/-/tdigest-0.1.2.tgz",
-      "integrity": "sha512-+G0LLgjjo9BZX2MfdvPfH+MKLCrxlXSYec5DaPYP1fe6Iyhf0/fSmJ0bFiZ1F8BT6cGXl2LpltQptzjXKWEkKA==",
       "license": "MIT",
       "dependencies": {
         "bintrees": "1.0.2"
@@ -10645,66 +10311,81 @@
     },
     "node_modules/teex": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/teex/-/teex-1.0.1.tgz",
-      "integrity": "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==",
       "license": "MIT",
       "dependencies": {
         "streamx": "^2.12.5"
       }
     },
+    "node_modules/testcontainers": {
+      "version": "12.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@balena/dockerignore": "^1.0.2",
+        "@types/dockerode": "^4.0.1",
+        "archiver": "^7.0.1",
+        "async-lock": "^1.4.1",
+        "byline": "^5.0.0",
+        "debug": "^4.4.3",
+        "docker-compose": "^1.4.2",
+        "dockerode": "^5.0.0",
+        "get-port": "^7.2.0",
+        "proper-lockfile": "^4.1.2",
+        "properties-reader": "^3.0.1",
+        "ssh-remote-port-forward": "^1.0.4",
+        "tar-fs": "^3.1.2",
+        "tmp": "^0.2.6",
+        "undici": "^7.25.0"
+      }
+    },
+    "node_modules/testcontainers/node_modules/tar-fs": {
+      "version": "3.1.2",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "pump": "^3.0.0",
+        "tar-stream": "^3.1.5"
+      },
+      "optionalDependencies": {
+        "bare-fs": "^4.0.1",
+        "bare-path": "^3.0.0"
+      }
+    },
     "node_modules/text-decoder": {
       "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/text-decoder/-/text-decoder-1.2.7.tgz",
-      "integrity": "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "b4a": "^1.6.4"
       }
     },
     "node_modules/thread-stream": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-4.2.0.tgz",
-      "integrity": "sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==",
+      "version": "4.0.0",
       "license": "MIT",
       "dependencies": {
-        "real-require": "^1.0.0"
+        "real-require": "^0.2.0"
       },
       "engines": {
         "node": ">=20"
       }
     },
-    "node_modules/thread-stream/node_modules/real-require": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/real-require/-/real-require-1.0.0.tgz",
-      "integrity": "sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==",
-      "license": "MIT"
-    },
     "node_modules/tiny-case": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tiny-case/-/tiny-case-1.0.3.tgz",
-      "integrity": "sha512-Eet/eeMhkO6TX8mnUteS9zgPbUMQa4I6Kkp5ORiBD5476/m+PIRiumP5tmh5ioJpH7k51Kehawy2UDfsnxxY8Q==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/tiny-inflate": {
       "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tiny-inflate/-/tiny-inflate-1.0.3.tgz",
-      "integrity": "sha512-pkY1fj1cKHb2seWDy0B16HeWyczlJA9/WW3u3c4z/NiWDsO3DOU5D7nhTLE9CF0yXv/QZFY7sEJmj24dK+Rrqw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/tinybench": {
       "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
-      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/tinyexec": {
-      "version": "1.2.4",
-      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-1.2.4.tgz",
-      "integrity": "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg==",
+      "version": "1.0.2",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -10712,14 +10393,12 @@
       }
     },
     "node_modules/tinyglobby": {
-      "version": "0.2.17",
-      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
-      "integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
+      "version": "0.2.15",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
         "fdir": "^6.5.0",
-        "picomatch": "^4.0.4"
+        "picomatch": "^4.0.3"
       },
       "engines": {
         "node": ">=12.0.0"
@@ -10729,19 +10408,23 @@
       }
     },
     "node_modules/tinyrainbow": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-3.1.0.tgz",
-      "integrity": "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==",
+      "version": "3.0.3",
       "devOptional": true,
       "license": "MIT",
       "engines": {
         "node": ">=14.0.0"
       }
     },
+    "node_modules/tmp": {
+      "version": "0.2.7",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
     "node_modules/toidentifier": {
       "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
-      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10750,16 +10433,12 @@
     },
     "node_modules/toposort": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/toposort/-/toposort-2.0.2.tgz",
-      "integrity": "sha512-0a5EOkAUp8D4moMi2W8ZF8jcga7BgZd91O/yabJCFY8az+XSzeGyTKs0Aoo897iV1Nj6guFq8orWDS96z91oGg==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/totalist": {
       "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
-      "integrity": "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -10768,16 +10447,12 @@
     },
     "node_modules/ts-algebra": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ts-algebra/-/ts-algebra-2.0.0.tgz",
-      "integrity": "sha512-FPAhNPFMrkwz76P7cdjdmiShwMynZYN6SgOujD1urY4oNm80Ou9oMdmbR45LotcKOXoy7wSmHkRFE6Mxbrhefw==",
       "dev": true,
       "license": "MIT",
       "optional": true
     },
     "node_modules/ts-api-utils": {
-      "version": "2.5.0",
-      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.5.0.tgz",
-      "integrity": "sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==",
+      "version": "2.4.0",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10789,8 +10464,6 @@
     },
     "node_modules/ts-deepmerge": {
       "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/ts-deepmerge/-/ts-deepmerge-7.0.3.tgz",
-      "integrity": "sha512-Du/ZW2RfwV/D4cmA5rXafYjBQVuvu4qGiEEla4EmEHVHgRdx68Gftx7i66jn2bzHPwSVZY36Ae6OuDn9el4ZKA==",
       "dev": true,
       "license": "ISC",
       "engines": {
@@ -10799,8 +10472,6 @@
     },
     "node_modules/tsconfig-paths": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-4.2.0.tgz",
-      "integrity": "sha512-NoZ4roiN7LnbKn9QqE1amc9DJfzvZXxF4xDavcOWt1BPkdx+m+0gJuPM+S0vCe7zTJMYUP0R8pO2XMr+Y8oLIg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10814,8 +10485,6 @@
     },
     "node_modules/tsconfig-paths-webpack-plugin": {
       "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths-webpack-plugin/-/tsconfig-paths-webpack-plugin-4.2.0.tgz",
-      "integrity": "sha512-zbem3rfRS8BgeNK50Zz5SIQgXzLafiHjOwUAvk/38/o1jHn/V5QAgVUcz884or7WYcPaH3N2CIfUc2u0ul7UcA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -10830,14 +10499,10 @@
     },
     "node_modules/tslib": {
       "version": "2.8.1",
-      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.8.1.tgz",
-      "integrity": "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==",
       "license": "0BSD"
     },
     "node_modules/tsx": {
       "version": "4.22.4",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
-      "integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -10854,9 +10519,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.0.tgz",
+      "integrity": "sha512-lhRUCeuOyJQURhTxl4WkpFTjIsbDayJHih5kZC1giwE+MhIzAb7mEsQMqMf18rHLsrb5qI1tafG20mLxEWcWlA==",
       "cpu": [
         "ppc64"
       ],
@@ -10870,9 +10535,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/android-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.0.tgz",
+      "integrity": "sha512-wqh0ByljabXLKHeWXYLqoJ5jKC4XBaw6Hk08OfMrCRd2nP2ZQ5eleDZC41XHyCNgktBGYMbqnrJKq/K/lzPMSQ==",
       "cpu": [
         "arm"
       ],
@@ -10886,9 +10551,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/android-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.0.tgz",
+      "integrity": "sha512-+WzIXQOSaGs33tLEgYPYe/yQHf0WTU0X42Jca3y8NWMbUVhp7rUnw+vAsRC/QiDrdD31IszMrZy+qwPOPjd+rw==",
       "cpu": [
         "arm64"
       ],
@@ -10902,9 +10567,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/android-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.0.tgz",
+      "integrity": "sha512-+VJggoaKhk2VNNqVL7f6S189UzShHC/mR9EE8rDdSkdpN0KflSwWY/gWjDrNxxisg8Fp1ZCD9jLMo4m0OUfeUA==",
       "cpu": [
         "x64"
       ],
@@ -10918,9 +10583,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.0.tgz",
+      "integrity": "sha512-0T+A9WZm+bZ84nZBtk1ckYsOvyA3x7e2Acj1KdVfV4/2tdG4fzUp91YHx+GArWLtwqp77pBXVCPn2We7Letr0Q==",
       "cpu": [
         "arm64"
       ],
@@ -10934,9 +10599,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.0.tgz",
+      "integrity": "sha512-fyzLm/DLDl/84OCfp2f/XQ4flmORsjU7VKt8HLjvIXChJoFFOIL6pLJPH4Yhd1n1gGFF9mPwtlN5Wf82DZs+LQ==",
       "cpu": [
         "x64"
       ],
@@ -10950,9 +10615,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-l9GeW5UZBT9k9brBYI+0WDffcRxgHQD8ShN2Ur4xWq/NFzUKm3k5lsH4PdaRgb2w7mI9u61nr2gI2mLI27Nh3Q==",
       "cpu": [
         "arm64"
       ],
@@ -10966,9 +10631,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.0.tgz",
+      "integrity": "sha512-BXoQai/A0wPO6Es3yFJ7APCiKGc1tdAEOgeTNy3SsB491S3aHn4S4r3e976eUnPdU+NbdtmBuLncYir2tMU9Nw==",
       "cpu": [
         "x64"
       ],
@@ -10982,9 +10647,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.0.tgz",
+      "integrity": "sha512-CjaaREJagqJp7iTaNQjjidaNbCKYcd4IDkzbwwxtSvjI7NZm79qiHc8HqciMddQ6CKvJT6aBd8lO9kN/ZudLlw==",
       "cpu": [
         "arm"
       ],
@@ -10998,9 +10663,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.0.tgz",
+      "integrity": "sha512-RVyzfb3FWsGA55n6WY0MEIEPURL1FcbhFE6BffZEMEekfCzCIMtB5yyDcFnVbTnwk+CLAgTujmV/Lgvih56W+A==",
       "cpu": [
         "arm64"
       ],
@@ -11014,9 +10679,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.0.tgz",
+      "integrity": "sha512-KBnSTt1kxl9x70q+ydterVdl+Cn0H18ngRMRCEQfrbqdUuntQQ0LoMZv47uB97NljZFzY6HcfqEZ2SAyIUTQBQ==",
       "cpu": [
         "ia32"
       ],
@@ -11030,9 +10695,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.0.tgz",
+      "integrity": "sha512-zpSlUce1mnxzgBADvxKXX5sl8aYQHo2ezvMNI8I0lbblJtp8V4odlm3Yzlj7gPyt3T8ReksE6bK+pT3WD+aJRg==",
       "cpu": [
         "loong64"
       ],
@@ -11046,9 +10711,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.0.tgz",
+      "integrity": "sha512-2jIfP6mmjkdmeTlsX/9vmdmhBmKADrWqN7zcdtHIeNSCH1SqIoNI63cYsjQR8J+wGa4Y5izRcSHSm8K3QWmk3w==",
       "cpu": [
         "mips64el"
       ],
@@ -11062,9 +10727,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.0.tgz",
+      "integrity": "sha512-bc0FE9wWeC0WBm49IQMPSPILRocGTQt3j5KPCA8os6VprfuJ7KD+5PzESSrJ6GmPIPJK965ZJHTUlSA6GNYEhg==",
       "cpu": [
         "ppc64"
       ],
@@ -11078,9 +10743,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.0.tgz",
+      "integrity": "sha512-SQPZOwoTTT/HXFXQJG/vBX8sOFagGqvZyXcgLA3NhIqcBv1BJU1d46c0rGcrij2B56Z2rNiSLaZOYW5cUk7yLQ==",
       "cpu": [
         "riscv64"
       ],
@@ -11094,9 +10759,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.0.tgz",
+      "integrity": "sha512-SCfR0HN8CEEjnYnySJTd2cw0k9OHB/YFzt5zgJEwa+wL/T/raGWYMBqwDNAC6dqFKmJYZoQBRfHjgwLHGSrn3Q==",
       "cpu": [
         "s390x"
       ],
@@ -11110,9 +10775,7 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/linux-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "version": "0.28.0",
       "cpu": [
         "x64"
       ],
@@ -11126,9 +10789,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-CR/RYotgtCKwtftMwJlUU7xCVNg3lMYZ0RzTmAHSfLCXw3NtZtNpswLEj/Kkf6kEL3Gw+BpOekRX0BYCtklhUw==",
       "cpu": [
         "arm64"
       ],
@@ -11142,9 +10805,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-nU1yhmYutL+fQ71Kxnhg8uEOdC0pwEW9entHykTgEbna2pw2dkbFSMeqjjyHZoCmt8SBkOSvV+yNmm94aUrrqw==",
       "cpu": [
         "x64"
       ],
@@ -11158,9 +10821,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.0.tgz",
+      "integrity": "sha512-cXb5vApOsRsxsEl4mcZ1XY3D4DzcoMxR/nnc4IyqYs0rTI8ZKmW6kyyg+11Z8yvgMfAEldKzP7AdP64HnSC/6g==",
       "cpu": [
         "arm64"
       ],
@@ -11174,9 +10837,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.0.tgz",
+      "integrity": "sha512-8wZM2qqtv9UP3mzy7HiGYNH/zjTA355mpeuA+859TyR+e+Tc08IHYpLJuMsfpDJwoLo1ikIJI8jC3GFjnRClzA==",
       "cpu": [
         "x64"
       ],
@@ -11190,9 +10853,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.0.tgz",
+      "integrity": "sha512-FLGfyizszcef5C3YtoyQDACyg95+dndv79i2EekILBofh5wpCa1KuBqOWKrEHZg3zrL3t5ouE5jgr94vA+Wb2w==",
       "cpu": [
         "arm64"
       ],
@@ -11206,9 +10869,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.0.tgz",
+      "integrity": "sha512-1ZgjUoEdHZZl/YlV76TSCz9Hqj9h9YmMGAgAPYd+q4SicWNX3G5GCyx9uhQWSLcbvPW8Ni7lj4gDa1T40akdlw==",
       "cpu": [
         "x64"
       ],
@@ -11222,9 +10885,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.0.tgz",
+      "integrity": "sha512-Q9StnDmQ/enxnpxCCLSg0oo4+34B9TdXpuyPeTedN/6+iXBJ4J+zwfQI28u/Jl40nOYAxGoNi7mFP40RUtkmUA==",
       "cpu": [
         "arm64"
       ],
@@ -11238,9 +10901,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.0.tgz",
+      "integrity": "sha512-zF3ag/gfiCe6U2iczcRzSYJKH1DCI+ByzSENHlM2FcDbEeo5Zd2C86Aq0tKUYAJJ1obRP84ymxIAksZUcdztHA==",
       "cpu": [
         "ia32"
       ],
@@ -11254,9 +10917,9 @@
       }
     },
     "node_modules/tsx/node_modules/@esbuild/win32-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "version": "0.28.0",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.0.tgz",
+      "integrity": "sha512-pEl1bO9mfAmIC+tW5btTmrKaujg3zGtUmWNdCw/xs70FBjwAL3o9OEKNHvNmnyylD6ubxUERiEhdsL0xBQ9efw==",
       "cpu": [
         "x64"
       ],
@@ -11270,9 +10933,7 @@
       }
     },
     "node_modules/tsx/node_modules/esbuild": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "version": "0.28.0",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -11283,32 +10944,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.1",
-        "@esbuild/android-arm": "0.28.1",
-        "@esbuild/android-arm64": "0.28.1",
-        "@esbuild/android-x64": "0.28.1",
-        "@esbuild/darwin-arm64": "0.28.1",
-        "@esbuild/darwin-x64": "0.28.1",
-        "@esbuild/freebsd-arm64": "0.28.1",
-        "@esbuild/freebsd-x64": "0.28.1",
-        "@esbuild/linux-arm": "0.28.1",
-        "@esbuild/linux-arm64": "0.28.1",
-        "@esbuild/linux-ia32": "0.28.1",
-        "@esbuild/linux-loong64": "0.28.1",
-        "@esbuild/linux-mips64el": "0.28.1",
-        "@esbuild/linux-ppc64": "0.28.1",
-        "@esbuild/linux-riscv64": "0.28.1",
-        "@esbuild/linux-s390x": "0.28.1",
-        "@esbuild/linux-x64": "0.28.1",
-        "@esbuild/netbsd-arm64": "0.28.1",
-        "@esbuild/netbsd-x64": "0.28.1",
-        "@esbuild/openbsd-arm64": "0.28.1",
-        "@esbuild/openbsd-x64": "0.28.1",
-        "@esbuild/openharmony-arm64": "0.28.1",
-        "@esbuild/sunos-x64": "0.28.1",
-        "@esbuild/win32-arm64": "0.28.1",
-        "@esbuild/win32-ia32": "0.28.1",
-        "@esbuild/win32-x64": "0.28.1"
+        "@esbuild/aix-ppc64": "0.28.0",
+        "@esbuild/android-arm": "0.28.0",
+        "@esbuild/android-arm64": "0.28.0",
+        "@esbuild/android-x64": "0.28.0",
+        "@esbuild/darwin-arm64": "0.28.0",
+        "@esbuild/darwin-x64": "0.28.0",
+        "@esbuild/freebsd-arm64": "0.28.0",
+        "@esbuild/freebsd-x64": "0.28.0",
+        "@esbuild/linux-arm": "0.28.0",
+        "@esbuild/linux-arm64": "0.28.0",
+        "@esbuild/linux-ia32": "0.28.0",
+        "@esbuild/linux-loong64": "0.28.0",
+        "@esbuild/linux-mips64el": "0.28.0",
+        "@esbuild/linux-ppc64": "0.28.0",
+        "@esbuild/linux-riscv64": "0.28.0",
+        "@esbuild/linux-s390x": "0.28.0",
+        "@esbuild/linux-x64": "0.28.0",
+        "@esbuild/netbsd-arm64": "0.28.0",
+        "@esbuild/netbsd-x64": "0.28.0",
+        "@esbuild/openbsd-arm64": "0.28.0",
+        "@esbuild/openbsd-x64": "0.28.0",
+        "@esbuild/openharmony-arm64": "0.28.0",
+        "@esbuild/sunos-x64": "0.28.0",
+        "@esbuild/win32-arm64": "0.28.0",
+        "@esbuild/win32-ia32": "0.28.0",
+        "@esbuild/win32-x64": "0.28.0"
       }
     },
     "node_modules/tsx/node_modules/fsevents": {
@@ -11327,8 +10988,6 @@
     },
     "node_modules/tunnel-agent": {
       "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.6.0.tgz",
-      "integrity": "sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==",
       "dev": true,
       "license": "Apache-2.0",
       "optional": true,
@@ -11339,10 +10998,13 @@
         "node": "*"
       }
     },
+    "node_modules/tweetnacl": {
+      "version": "0.14.5",
+      "dev": true,
+      "license": "Unlicense"
+    },
     "node_modules/type-check": {
       "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
-      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11354,8 +11016,6 @@
     },
     "node_modules/type-fest": {
       "version": "2.19.0",
-      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-2.19.0.tgz",
-      "integrity": "sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==",
       "dev": true,
       "license": "(MIT OR CC0-1.0)",
       "optional": true,
@@ -11367,42 +11027,28 @@
       }
     },
     "node_modules/type-is": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
-      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
+      "version": "2.0.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "content-type": "^2.0.0",
+        "content-type": "^1.0.5",
         "media-typer": "^1.1.0",
         "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
+        "node": ">= 0.6"
       }
     },
-    "node_modules/type-is/node_modules/content-type": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+    "node_modules/typebox": {
+      "version": "1.2.19",
+      "resolved": "https://registry.npmjs.org/typebox/-/typebox-1.2.19.tgz",
+      "integrity": "sha512-9stLVZhos9aUXJzu0Yf717xbcv3vFsE5APzsQ7j/honIUFtern451IdTlqmVzPzuGxHkeWwWc2cerw6m2lqKOQ==",
       "dev": true,
       "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
+      "optional": true
     },
     "node_modules/typescript": {
       "version": "5.9.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
-      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "devOptional": true,
       "license": "Apache-2.0",
       "bin": {
@@ -11414,16 +11060,14 @@
       }
     },
     "node_modules/typescript-eslint": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.62.0.tgz",
-      "integrity": "sha512-8QxXi+ZACKX0kaqO4gY8kn0RSD9gFfaHDWwjqtEN48aWCBkX4MJaufWN+c3BzlrXLOxfywDL8CaoqUwcRq4j4Q==",
+      "version": "8.56.1",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@typescript-eslint/eslint-plugin": "8.62.0",
-        "@typescript-eslint/parser": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0",
-        "@typescript-eslint/utils": "8.62.0"
+        "@typescript-eslint/eslint-plugin": "8.56.1",
+        "@typescript-eslint/parser": "8.56.1",
+        "@typescript-eslint/typescript-estree": "8.56.1",
+        "@typescript-eslint/utils": "8.56.1"
       },
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -11434,36 +11078,28 @@
       },
       "peerDependencies": {
         "eslint": "^8.57.0 || ^9.0.0 || ^10.0.0",
-        "typescript": ">=4.8.4 <6.1.0"
+        "typescript": ">=4.8.4 <6.0.0"
       }
     },
     "node_modules/ufo": {
       "version": "1.6.4",
-      "resolved": "https://registry.npmjs.org/ufo/-/ufo-1.6.4.tgz",
-      "integrity": "sha512-JFNbkD1Svwe0KvGi8GOeLcP4kAWQ609twvCdcHxq1oSL8svv39ZuSvajcD8B+5D0eL4+s1Is2D/O6KN3qcTeRA==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
-      "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
+      "version": "7.27.2",
       "license": "MIT",
       "engines": {
         "node": ">=20.18.1"
       }
     },
     "node_modules/undici-types": {
-      "version": "7.18.2",
-      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.18.2.tgz",
-      "integrity": "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==",
+      "version": "7.16.0",
       "devOptional": true,
       "license": "MIT"
     },
     "node_modules/unicode-properties": {
       "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/unicode-properties/-/unicode-properties-1.4.1.tgz",
-      "integrity": "sha512-CLjCCLQ6UuMxWnbIylkisbRj31qxHPAurvena/0iwSVbQ2G1VY5/HjV0IRabOEbDHlzZlRdCrD4NhB0JtU40Pg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11473,8 +11109,6 @@
     },
     "node_modules/unicode-trie": {
       "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/unicode-trie/-/unicode-trie-2.0.0.tgz",
-      "integrity": "sha512-x7bc76x0bm4prf1VLg79uhAzKw8DVboClSN5VxJuQ+LKDOVEW9CdH+VY7SP+vX7xCYQqzzgQpFqz15zeLvAtZQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11484,8 +11118,6 @@
     },
     "node_modules/unique-filename": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-4.0.0.tgz",
-      "integrity": "sha512-XSnEewXmQ+veP7xX2dS5Q4yZAvO40cBN2MWkJ7D/6sW4Dg6wYBNwM1Vrnz1FhH5AdeLIlUXRI9e28z1YZi71NQ==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -11498,8 +11130,6 @@
     },
     "node_modules/unique-slug": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-5.0.0.tgz",
-      "integrity": "sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==",
       "dev": true,
       "license": "ISC",
       "optional": true,
@@ -11512,8 +11142,6 @@
     },
     "node_modules/unpipe": {
       "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
-      "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11522,8 +11150,6 @@
     },
     "node_modules/unplugin": {
       "version": "2.3.11",
-      "resolved": "https://registry.npmjs.org/unplugin/-/unplugin-2.3.11.tgz",
-      "integrity": "sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11538,8 +11164,6 @@
     },
     "node_modules/unplugin-icons": {
       "version": "23.0.1",
-      "resolved": "https://registry.npmjs.org/unplugin-icons/-/unplugin-icons-23.0.1.tgz",
-      "integrity": "sha512-rv0XEJepajKzDLvRUWASM8K+8+/CCfZn2jtogXqg6RIp7kpatRc/aFrVJn8ANQA09e++lPEEv9yX8cC9enc+QQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11575,8 +11199,6 @@
     },
     "node_modules/uri-js": {
       "version": "4.4.1",
-      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
-      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -11585,21 +11207,15 @@
     },
     "node_modules/urlpattern-polyfill": {
       "version": "10.1.0",
-      "resolved": "https://registry.npmjs.org/urlpattern-polyfill/-/urlpattern-polyfill-10.1.0.tgz",
-      "integrity": "sha512-IGjKp/o0NL3Bso1PymYURCJxMPNAf/ILOpendP9f5B6e1rTJgdgiOvgfoT8VxCAdY+Wisb9uhGaJJf3yZ2V9nw==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/util-deprecate": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
     "node_modules/uuid": {
-      "version": "14.0.1",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-14.0.1.tgz",
-      "integrity": "sha512-6ZxzVpzDXDa3bJWaHilVayA+BH/1zmxCJoVgvmqJnid/gPoKHxUrS/aC/T6LGQtNHT+XHG9fXPJB4d+IrU30Ew==",
+      "version": "13.0.2",
       "dev": true,
       "funding": [
         "https://github.com/sponsors/broofa",
@@ -11611,9 +11227,7 @@
       }
     },
     "node_modules/valibot": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/valibot/-/valibot-1.4.1.tgz",
-      "integrity": "sha512-klCmFTz2jeDluy9RwX+F884TCiogtdBJ/YaxSx1EOBYXa3NXNWj8kR1jjN8rzluwojJVWWaHJ4r1U5LfICnM3g==",
+      "version": "1.2.0",
       "dev": true,
       "license": "MIT",
       "peerDependencies": {
@@ -11627,8 +11241,6 @@
     },
     "node_modules/validate-npm-package-license": {
       "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
-      "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -11636,21 +11248,8 @@
         "spdx-expression-parse": "^3.0.0"
       }
     },
-    "node_modules/validate-npm-package-license/node_modules/spdx-expression-parse": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
-      "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "spdx-exceptions": "^2.1.0",
-        "spdx-license-ids": "^3.0.0"
-      }
-    },
     "node_modules/validator": {
-      "version": "13.15.35",
-      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.35.tgz",
-      "integrity": "sha512-TQ5pAGhd5whStmqWvYF4OjQROlmv9SMFVt37qoCBdqRffuuklWYQlCNnEs2ZaIBD1kZRNnikiZOS1eqgkar0iw==",
+      "version": "13.15.26",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -11660,8 +11259,6 @@
     },
     "node_modules/vary": {
       "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
-      "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -11669,9 +11266,7 @@
       }
     },
     "node_modules/vite": {
-      "version": "7.3.5",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.5.tgz",
-      "integrity": "sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww==",
+      "version": "7.3.1",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -12001,8 +11596,6 @@
     },
     "node_modules/vite/node_modules/@esbuild/linux-x64": {
       "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
-      "integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
       "cpu": [
         "x64"
       ],
@@ -12161,8 +11754,6 @@
     },
     "node_modules/vite/node_modules/esbuild": {
       "version": "0.27.7",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
-      "integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
       "devOptional": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -12216,9 +11807,7 @@
       }
     },
     "node_modules/vitefu": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/vitefu/-/vitefu-1.1.3.tgz",
-      "integrity": "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg==",
+      "version": "1.1.1",
       "devOptional": true,
       "license": "MIT",
       "workspaces": [
@@ -12227,7 +11816,7 @@
         "tests/projects/workspace/packages/*"
       ],
       "peerDependencies": {
-        "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0"
+        "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0-beta.0"
       },
       "peerDependenciesMeta": {
         "vite": {
@@ -12236,31 +11825,29 @@
       }
     },
     "node_modules/vitest": {
-      "version": "4.1.9",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.9.tgz",
-      "integrity": "sha512-nE3/LEyc0z87uHYLZebqCUOaJr2hdtuPp7BQ4BosVFnfltxgAvMG08NyrSGlPpOUWvR27c5flSmYFTNr78L9GQ==",
+      "version": "4.0.18",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/expect": "4.1.9",
-        "@vitest/mocker": "4.1.9",
-        "@vitest/pretty-format": "4.1.9",
-        "@vitest/runner": "4.1.9",
-        "@vitest/snapshot": "4.1.9",
-        "@vitest/spy": "4.1.9",
-        "@vitest/utils": "4.1.9",
-        "es-module-lexer": "^2.0.0",
-        "expect-type": "^1.3.0",
+        "@vitest/expect": "4.0.18",
+        "@vitest/mocker": "4.0.18",
+        "@vitest/pretty-format": "4.0.18",
+        "@vitest/runner": "4.0.18",
+        "@vitest/snapshot": "4.0.18",
+        "@vitest/spy": "4.0.18",
+        "@vitest/utils": "4.0.18",
+        "es-module-lexer": "^1.7.0",
+        "expect-type": "^1.2.2",
         "magic-string": "^0.30.21",
         "obug": "^2.1.1",
         "pathe": "^2.0.3",
         "picomatch": "^4.0.3",
-        "std-env": "^4.0.0-rc.1",
+        "std-env": "^3.10.0",
         "tinybench": "^2.9.0",
         "tinyexec": "^1.0.2",
         "tinyglobby": "^0.2.15",
-        "tinyrainbow": "^3.1.0",
-        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0",
+        "tinyrainbow": "^3.0.3",
+        "vite": "^6.0.0 || ^7.0.0",
         "why-is-node-running": "^2.3.0"
       },
       "bin": {
@@ -12276,15 +11863,12 @@
         "@edge-runtime/vm": "*",
         "@opentelemetry/api": "^1.9.0",
         "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0",
-        "@vitest/browser-playwright": "4.1.9",
-        "@vitest/browser-preview": "4.1.9",
-        "@vitest/browser-webdriverio": "4.1.9",
-        "@vitest/coverage-istanbul": "4.1.9",
-        "@vitest/coverage-v8": "4.1.9",
-        "@vitest/ui": "4.1.9",
+        "@vitest/browser-playwright": "4.0.18",
+        "@vitest/browser-preview": "4.0.18",
+        "@vitest/browser-webdriverio": "4.0.18",
+        "@vitest/ui": "4.0.18",
         "happy-dom": "*",
-        "jsdom": "*",
-        "vite": "^6.0.0 || ^7.0.0 || ^8.0.0"
+        "jsdom": "*"
       },
       "peerDependenciesMeta": {
         "@edge-runtime/vm": {
@@ -12305,12 +11889,6 @@
         "@vitest/browser-webdriverio": {
           "optional": true
         },
-        "@vitest/coverage-istanbul": {
-          "optional": true
-        },
-        "@vitest/coverage-v8": {
-          "optional": true
-        },
         "@vitest/ui": {
           "optional": true
         },
@@ -12319,16 +11897,11 @@
         },
         "jsdom": {
           "optional": true
-        },
-        "vite": {
-          "optional": false
         }
       }
     },
     "node_modules/vitest-browser-svelte": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/vitest-browser-svelte/-/vitest-browser-svelte-2.1.1.tgz",
-      "integrity": "sha512-qbunYRSm+N92r9bfTkdDTpBZESLmp4QFz2SluV3n/x8U7ysosfeXYJZ4vXbJ0Y0LzoqqDnV5LHprmFgn4Eo+Ug==",
+      "version": "2.0.2",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12344,15 +11917,11 @@
     },
     "node_modules/webpack-virtual-modules": {
       "version": "0.6.2",
-      "resolved": "https://registry.npmjs.org/webpack-virtual-modules/-/webpack-virtual-modules-0.6.2.tgz",
-      "integrity": "sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/which": {
       "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -12367,8 +11936,6 @@
     },
     "node_modules/why-is-node-running": {
       "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
-      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
       "devOptional": true,
       "license": "MIT",
       "dependencies": {
@@ -12384,8 +11951,6 @@
     },
     "node_modules/word-wrap": {
       "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.5.tgz",
-      "integrity": "sha512-BN22B5eaMMI9UMtjrGd5g5eCYPpCPDUy0FJXbYsaT5zYxjFOckS53SQDE3pWkVoWpHXVb3BrYcEN4Twa55B5cA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12394,11 +11959,8 @@
     },
     "node_modules/wrap-ansi": {
       "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
-      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ansi-styles": "^6.1.0",
         "string-width": "^5.0.1",
@@ -12414,11 +11976,8 @@
     "node_modules/wrap-ansi-cjs": {
       "name": "wrap-ansi",
       "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
-      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ansi-styles": "^4.0.0",
         "string-width": "^4.1.0",
@@ -12433,30 +11992,21 @@
     },
     "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
       "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=8"
       }
     },
     "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
       "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
       "dev": true,
-      "license": "MIT",
-      "optional": true
+      "license": "MIT"
     },
     "node_modules/wrap-ansi-cjs/node_modules/string-width": {
       "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "emoji-regex": "^8.0.0",
         "is-fullwidth-code-point": "^3.0.0",
@@ -12468,11 +12018,8 @@
     },
     "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
       "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "dependencies": {
         "ansi-regex": "^5.0.1"
       },
@@ -12482,11 +12029,8 @@
     },
     "node_modules/wrap-ansi/node_modules/ansi-styles": {
       "version": "6.2.3",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
-      "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
       "dev": true,
       "license": "MIT",
-      "optional": true,
       "engines": {
         "node": ">=12"
       },
@@ -12496,15 +12040,11 @@
     },
     "node_modules/wrappy": {
       "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
-      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "version": "8.19.0",
       "devOptional": true,
       "license": "MIT",
       "engines": {
@@ -12523,10 +12063,21 @@
         }
       }
     },
+    "node_modules/xml-naming": {
+      "version": "0.1.0",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/NaturalIntelligence"
+        }
+      ],
+      "license": "MIT",
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
     "node_modules/xmlbuilder2": {
       "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/xmlbuilder2/-/xmlbuilder2-4.0.3.tgz",
-      "integrity": "sha512-bx8Q1STctnNaaDymWnkfQLKofs0mGNN7rLLapJlGuV3VlvegD7Ls4ggMjE3aUSWItCCzU0PEv45lI87iSigiCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -12541,17 +12092,21 @@
     },
     "node_modules/xtend": {
       "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
       "license": "MIT",
       "engines": {
         "node": ">=0.4"
       }
     },
+    "node_modules/y18n": {
+      "version": "5.0.8",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/yallist": {
       "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "optional": true,
@@ -12559,10 +12114,84 @@
         "node": ">=18"
       }
     },
+    "node_modules/yaml": {
+      "version": "2.9.0",
+      "devOptional": true,
+      "license": "ISC",
+      "bin": {
+        "yaml": "bin.mjs"
+      },
+      "engines": {
+        "node": ">= 14.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/eemeli"
+      }
+    },
+    "node_modules/yargs": {
+      "version": "17.7.2",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^8.0.1",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.3",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^21.1.1"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/yargs-parser": {
+      "version": "21.1.1",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/yargs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/yargs/node_modules/string-width": {
+      "version": "4.2.3",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/yargs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/yocto-queue": {
       "version": "0.1.0",
-      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
-      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -12574,8 +12203,6 @@
     },
     "node_modules/yup": {
       "version": "1.7.1",
-      "resolved": "https://registry.npmjs.org/yup/-/yup-1.7.1.tgz",
-      "integrity": "sha512-GKHFX2nXul2/4Dtfxhozv701jLQHdf6J34YDh2cEkpqoo8le5Mg6/LrdseVLrFarmFygZTlfIhHx/QKfb/QWXw==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -12588,15 +12215,62 @@
     },
     "node_modules/zimmerframe": {
       "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/zimmerframe/-/zimmerframe-1.1.4.tgz",
-      "integrity": "sha512-B58NGBEoc8Y9MWWCQGl/gq9xBCe4IiKM0a2x7GZdQKOW5Exr8S1W24J6OgM1njK8xCRGvAJIL/MxXHf6SkmQKQ==",
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/zip-stream": {
+      "version": "6.0.1",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "archiver-utils": "^5.0.0",
+        "compress-commons": "^6.0.2",
+        "readable-stream": "^4.0.0"
+      },
+      "engines": {
+        "node": ">= 14"
+      }
+    },
+    "node_modules/zip-stream/node_modules/buffer": {
+      "version": "6.0.3",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.3.1",
+        "ieee754": "^1.2.1"
+      }
+    },
+    "node_modules/zip-stream/node_modules/readable-stream": {
+      "version": "4.7.0",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
     "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "version": "4.3.6",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
@@ -12604,8 +12278,6 @@
     },
     "node_modules/zod-v3-to-json-schema": {
       "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/zod-v3-to-json-schema/-/zod-v3-to-json-schema-4.0.0.tgz",
-      "integrity": "sha512-KixLrhX/uPmRFnDgsZrzrk4x5SSJA+PmaE5adbfID9+3KPJcdxqRobaHU397EfWBqfQircrjKqvEqZ/mW5QH6w==",
       "dev": true,
       "license": "ISC",
       "optional": true,
diff --git a/package.json b/package.json
index 00ac761f..cd818f99 100644
--- a/package.json
+++ b/package.json
@@ -15,8 +15,7 @@
     "lint": "prettier --check --ignore-path .prettierignore . && eslint . && npm run check",
     "lint:fix": "prettier --write --ignore-path .prettierignore . && eslint . --fix && npm run check",
     "test:unit": "vitest run",
-    "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && playwright test",
-    "test:e2e:garage": "./e2e/run-garage-tests.sh",
+    "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && npx tsx e2e/support/run-e2e.ts",
     "test:e2e:ui": "playwright test --ui",
     "generate:antlr": "cd src/lib/editor/grammar && antlr-ng -v -l -Dlanguage=TypeScript -o ../generated SqlBase.g4 && node patch-generated.mjs",
     "db:generate": "drizzle-kit generate",
@@ -39,6 +38,7 @@
     "@sveltejs/kit": "^2.53.0",
     "@sveltejs/vite-plugin-svelte": "^6.2.4",
     "@tailwindcss/vite": "^4.2.1",
+    "@testcontainers/postgresql": "^12.0.1",
     "@types/adm-zip": "^0.5.8",
     "@types/node": "^24",
     "@types/papaparse": "^5.5.2",
@@ -64,6 +64,7 @@
     "svelte-check": "^4.4.3",
     "sveltekit-superforms": "^2.30.0",
     "tailwindcss": "^4.2.1",
+    "testcontainers": "^12.0.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.56.1",
     "unplugin-icons": "^23.0.1",
@@ -75,12 +76,13 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1041.0",
     "@aws-sdk/lib-storage": "^3.1045.0",
+    "@better-auth/drizzle-adapter": "^1.6.20",
     "@internationalized/date": "^3.11.0",
     "@smithy/node-http-handler": "4.9.1",
     "adm-zip": "^0.5.17",
     "antlr4-c3": "^3.4.4",
     "antlr4ng": "^3.0.16",
-    "better-auth": "^1.5.4",
+    "better-auth": "^1.6.20",
     "drizzle-orm": "^0.45.2",
     "hyparquet": "^1.25.8",
     "hyparquet-compressors": "^1.1.1",
diff --git a/playwright.config.ts b/playwright.config.ts
index c81965d7..a9e61cc1 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -5,10 +5,12 @@ const baseURL = process.env.PLAYWRIGHT_BASE_URL ?? 'http://localhost:4173';
 const chromiumExecutablePath = process.env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH;
 
 export default defineConfig({
+  workers: process.env.CI ? 1 : 1,
   testDir: path.join(import.meta.dirname, 'e2e'),
   outputDir: path.join(import.meta.dirname, 'e2e/test-results'),
   globalSetup: path.join(import.meta.dirname, 'e2e/support/global-setup.ts'),
-  timeout: 60_000,
+  timeout: 20_000,
+  globalTimeout: 20 * 60_000,
   retries: 2,
   expect: {
     timeout: 10_000
@@ -16,7 +18,8 @@ export default defineConfig({
   use: {
     baseURL,
     trace: 'retain-on-failure',
-    video: 'retain-on-failure'
+    video: 'retain-on-failure',
+    screenshot: 'only-on-failure'
   },
   webServer: [
     {
@@ -30,18 +33,26 @@ export default defineConfig({
       reuseExistingServer: false
     },
     {
-      command: 'PORT=4173 node --env-file=.env.test build',
+      command: 'node --env-file=.env.test build/index.js',
       url: baseURL,
       reuseExistingServer: false
     }
   ],
   projects: [
+    // Runs database migrations against the PostgreSQL container started by globalSetup.
+    // All browser projects depend on this so tests never run on an unmigrated DB.
+    // Container teardown is handled by the function returned from globalSetup.
+    {
+      name: 'setup-db',
+      testMatch: /db-migrations\.setup\.ts/
+    },
     // Each browser project gets its own auth setup so that parallel workers
     // log in as different users. This prevents cross-worker races on shared
     // server-side state (e.g. the in-memory Trino connection store).
     {
       name: 'setup-chromium',
       testMatch: /auth\.setup\.ts/,
+      dependencies: ['setup-db'],
       use: {
         browserName: 'chromium',
         viewport: { width: 1280, height: 720 }
@@ -50,6 +61,7 @@ export default defineConfig({
     {
       name: 'setup-firefox',
       testMatch: /auth\.setup\.ts/,
+      dependencies: ['setup-db'],
       use: {
         browserName: 'firefox',
         viewport: { width: 1280, height: 720 }
diff --git a/src/app.d.ts b/src/app.d.ts
index f31b166a..0d6473c6 100644
--- a/src/app.d.ts
+++ b/src/app.d.ts
@@ -16,8 +16,9 @@ declare global {
       logger: import('pino').Logger;
       requestId: string;
       /**
-       * Parsed S3 connection config extracted from the `x-storage-connection`
-       * request header by the `handleStorageConnection` middleware.
+       * Parsed S3 connection config extracted from the `x-storage-connection-id`
+       * request header by the `handleStorageConnection` middleware. The connection is
+       * looked up from the database and decrypted using the application key.
        * Always non-null for requests to `/(app)/api/storage/*` routes
        * (the middleware throws 401 before the handler runs if the header is absent).
        * Null for all other routes.
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 0cd63943..4bb9057e 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -1,13 +1,20 @@
 import { paraglideMiddleware } from '$lib/paraglide/server';
 import { httpRequestDuration } from '$lib/server/metrics';
 import { building, dev } from '$app/environment';
-import { error, redirect, type Handle, type HandleServerError } from '@sveltejs/kit';
+import {
+  error,
+  redirect,
+  type Handle,
+  type HandleServerError,
+  type ServerInit
+} from '@sveltejs/kit';
 import { sequence } from '@sveltejs/kit/hooks';
 import { svelteKitHandler } from 'better-auth/svelte-kit';
 import { auth, oidcEnabled } from '$lib/server/auth';
 import { requestLogger, logger } from '$lib/server/logging';
 import { getConnectionFromHeader } from '$lib/server/storage/connection.js';
 import { storageBrowserEnabled } from '$lib/server/feature-flags.js';
+import { storageEncryptionKey } from '$lib/server/storage/encryption-key.js';
 
 // Allow self-signed TLS certificates in development (e.g. local Trino with self-signed certs).
 if (dev) {
@@ -61,12 +68,11 @@ const handleAuthGuard: Handle = async ({ event, resolve }) => {
 };
 
 /**
- * Parse the `x-storage-connection` header (base64 JSON) for every request and
- * store the result in `event.locals.storageConfig`. For routes under
- * `/(app)/api/storage/` the header is mandatory — the middleware throws 401
- * before the handler runs if it is absent, so handlers can rely on
- * `locals.storageConfig` being non-null. Throws 400 for a present but
- * malformed / invalid header on any route.
+ * Parse the `x-storage-connection-id` header for every request and look up the
+ * connection from the database. The decrypted config is stored in
+ * `event.locals.storageConfig`. For routes under `/(app)/api/storage/` the
+ * header is mandatory — the middleware throws 401 before the handler runs if it
+ * is absent, so handlers can rely on `locals.storageConfig` being non-null.
  */
 const handleStorageConnection: Handle = async ({ event, resolve }) => {
   if (
@@ -76,8 +82,18 @@ const handleStorageConnection: Handle = async ({ event, resolve }) => {
   ) {
     throw error(404, 'Storage browser is not enabled');
   }
-  event.locals.storageConfig = getConnectionFromHeader(event.request);
-  if (event.locals.storageConfig === null && event.route.id?.startsWith('/(app)/api/storage/')) {
+  const userId = event.locals.user?.id ?? null;
+  if (userId && event.route.id?.startsWith('/(app)/api/storage/')) {
+    event.locals.storageConfig = await getConnectionFromHeader(event.request, userId);
+  } else {
+    event.locals.storageConfig = null;
+  }
+  // The connections management endpoint itself does not require a connection header —
+  // it is used to list/create connections before one is selected.
+  const requiresConnectionHeader =
+    event.route.id?.startsWith('/(app)/api/storage/') &&
+    !event.route.id?.startsWith('/(app)/api/storage/connections');
+  if (event.locals.storageConfig === null && requiresConnectionHeader) {
     throw error(401, 'No storage connection configured');
   }
   return resolve(event);
@@ -91,6 +107,17 @@ export const handle = sequence(
   handleStorageConnection
 );
 
+/**
+ * Validate required environment variables at server startup (fail-fast).
+ * This runs once before any requests are handled, so misconfiguration is
+ * detected immediately rather than on the first request that uses the key.
+ */
+export const init: ServerInit = async () => {
+  if (storageBrowserEnabled) {
+    storageEncryptionKey(); // throws immediately if the env var is missing/invalid
+  }
+};
+
 export const handleError: HandleServerError = ({ error, event, status, message }) => {
   const requestId = event.locals.requestId;
   const log = event.locals.logger ?? logger;
diff --git a/src/lib/components/editor/TextEditor.svelte b/src/lib/components/editor/TextEditor.svelte
index 181bb4e0..bd0cefab 100644
--- a/src/lib/components/editor/TextEditor.svelte
+++ b/src/lib/components/editor/TextEditor.svelte
@@ -148,6 +148,8 @@
 
     monaco = await import('monaco-editor');
 
+    if (!container.isConnected) return;
+
     editor = monaco.editor.create(container, {
       value,
       language,
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 6a78aa78..5d2593ff 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -19,7 +19,8 @@
   import type { StorageLocation } from '$lib/storage/types.js';
   import { keyToName } from '$lib/storage/utils.js';
   import { invalidateAll } from '$app/navigation';
-  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 
   const storage = getStorageState();
   const tabsState = getTabsState();
@@ -103,8 +104,10 @@
 
   async function createObject(bucket: string, key: string): Promise<void> {
     const params = new URLSearchParams({ bucket, key });
-    const conn = loadConnectionLocally();
-    const headers: HeadersInit = conn ? { 'x-storage-connection': getConnectionHeader(conn) } : {};
+    const connectionId = connectionStore.activeConnectionId;
+    const headers: HeadersInit = connectionId
+      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+      : {};
     const res = await fetch(`/api/storage/create?${params}`, { method: 'POST', headers });
     if (!res.ok) throw new Error(`Create failed with status ${res.status}`);
   }
diff --git a/src/lib/components/storage/explorer/TabBar.svelte b/src/lib/components/storage/explorer/TabBar.svelte
index 141111c6..403139ad 100644
--- a/src/lib/components/storage/explorer/TabBar.svelte
+++ b/src/lib/components/storage/explorer/TabBar.svelte
@@ -10,6 +10,15 @@
 
   let { tabsState }: Props = $props();
 
+  let renameInput = $state<HTMLInputElement | null>(null);
+
+  $effect(() => {
+    if (renamingId && renameInput) {
+      renameInput.focus();
+      renameInput.select();
+    }
+  });
+
   // ── Overflow detection ──
   let containerEl = $state<HTMLElement | null>(null);
   let isOverflowRight = $state(false);
@@ -179,9 +188,9 @@
               type="text"
               class="border-base-300 focus:border-primary h-4 w-24 rounded border bg-transparent px-1 py-0 text-xs focus:outline-none"
               bind:value={renameValue}
+              bind:this={renameInput}
               onblur={commitRename}
               onkeydown={handleRenameKeydown}
-              autofocus
               aria-label={m.storage_tab_rename()}
             />
           </div>
diff --git a/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
index 2e88b9b5..59c3f887 100644
--- a/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
@@ -140,7 +140,7 @@ describe('FileRow', () => {
     const spy = vi.spyOn(state, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick();
+    await page.getByRole('row').dblClick({ force: true });
     expect(spy).toHaveBeenCalledWith('archive.zip');
   });
 
@@ -150,7 +150,7 @@ describe('FileRow', () => {
     const spy = vi.spyOn(state, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick();
+    await page.getByRole('row').dblClick({ force: true });
     expect(spy).toHaveBeenCalledWith('bundle.tar.gz');
   });
 
@@ -162,7 +162,7 @@ describe('FileRow', () => {
     const spy = vi.spyOn(state, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick();
+    await page.getByRole('row').dblClick({ force: true });
     expect(spy).toHaveBeenCalledWith('nested.zip');
   });
 
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
index 4fb7235f..b9da7bff 100644
--- a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
@@ -1,5 +1,4 @@
 <script lang="ts">
-  import { untrack } from 'svelte';
   import { setStorageState } from '$lib/storage/context.js';
   import { setTabsState } from '$lib/storage/tabs-context.js';
   import { TabsState } from '$lib/storage/tabs.svelte.js';
@@ -12,11 +11,8 @@
   }
 
   let { state, tabsState: tabsStateProp }: Props = $props();
-  const effectiveTabsState = tabsStateProp ?? new TabsState(state);
-  untrack(() => {
-    setStorageState(state);
-    setTabsState(effectiveTabsState);
-  });
+  setStorageState(state);
+  setTabsState(tabsStateProp ?? new TabsState(state));
 </script>
 
 <StorageBreadcrumb />
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte b/src/lib/components/storage/landing/StorageConnectForm.svelte
index 687cfc1d..764cffda 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte
@@ -1,68 +1,38 @@
 <script lang="ts">
+  import { untrack } from 'svelte';
   import type { SuperValidated } from 'sveltekit-superforms';
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
-  import { onMount, onDestroy, tick, untrack } from 'svelte';
   import * as m from '$lib/paraglide/messages.js';
   import { StorageConnectionSchema } from '$lib/storage/schemas.js';
-  import {
-    saveConnectionLocally,
-    loadConnectionLocally,
-    type SavedConnection
-  } from '$lib/storage/connection-storage.js';
-  import {
-    storageAutoConnectEnabled,
-    storageAutoConnectTimeoutMs
-  } from '$lib/client/feature-flags.js';
-  import { addToast } from '$lib/stores/toast.svelte.js';
+  import type { ConnectionMetadata } from '$lib/server/storage/types.js';
   import StorageConnectionSidebar from '$lib/components/storage/sidebar/StorageConnectionSidebar.svelte';
   import type { z } from 'zod';
 
   interface Props {
     connectionForm: SuperValidated<z.infer<typeof StorageConnectionSchema>, string>;
+    connections: ConnectionMetadata[];
+    connectError: string | null;
   }
 
-  let { connectionForm }: Props = $props();
+  let { connectionForm, connections, connectError }: Props = $props();
 
   const uid = $props.id();
 
-  let formRef: HTMLFormElement | null = $state(null);
-  let autoConnecting = $state(false);
-
-  let connectTimeout: ReturnType<typeof setTimeout> | null = $state(null);
-
   const { form, errors, enhance, submitting, message } = superForm(
     untrack(() => connectionForm),
     {
       dataType: 'json',
       validators: zod(StorageConnectionSchema),
       onResult: ({ result }) => {
-        if (connectTimeout) {
-          clearTimeout(connectTimeout);
-          connectTimeout = null;
-        }
         if (result.type === 'redirect') {
-          saveConnectionLocally($form);
-        } else {
-          autoConnecting = false;
+          // Server saved the connection; the redirect to /storage triggers
+          // the layout load to auto-connect via activeStorageConnectionId.
         }
       }
     }
   );
 
-  function selectConnection(conn: SavedConnection) {
-    $form.id = conn.id;
-    $form.name = conn.name ?? '';
-    $form.type = conn.type;
-    $form.host = conn.host;
-    $form.port = conn.port;
-    $form.tls = conn.tls;
-    $form.accessStyle = conn.accessStyle;
-    $form.region = conn.region;
-    $form.credentials = conn.credentials;
-    tick().then(() => formRef?.requestSubmit());
-  }
-
   function parseHostInput() {
     const v = $form.host?.trim();
     if (!v?.includes('://')) return;
@@ -75,246 +45,188 @@
       // Not a parseable URL — leave unchanged
     }
   }
-
-  /** Cancel an in-progress auto-connect attempt. */
-  function cancelAutoConnect() {
-    if (connectTimeout) {
-      clearTimeout(connectTimeout);
-      connectTimeout = null;
-    }
-    autoConnecting = false;
-  }
-
-  onMount(() => {
-    const params = new URLSearchParams(window.location.search);
-    if (!storageAutoConnectEnabled || params.has('disconnected')) return;
-    const saved = loadConnectionLocally();
-    if (saved) {
-      autoConnecting = true;
-      $form.id = saved.id;
-      $form.type = saved.type;
-      $form.host = saved.host;
-      $form.port = saved.port;
-      $form.tls = saved.tls;
-      $form.accessStyle = saved.accessStyle;
-      $form.region = saved.region;
-      $form.credentials = saved.credentials;
-      tick().then(() => {
-        formRef?.requestSubmit();
-        connectTimeout = setTimeout(() => {
-          autoConnecting = false;
-          connectTimeout = null;
-          addToast('error', m.storage_connect_timeout(), 8000);
-        }, storageAutoConnectTimeoutMs);
-      });
-    }
-  });
-
-  onDestroy(() => {
-    if (connectTimeout) {
-      clearTimeout(connectTimeout);
-    }
-  });
 </script>
 
-{#if autoConnecting}
-  <div class="flex flex-col items-center gap-3 py-8">
-    <span class="loading loading-spinner loading-md"></span>
-    <p class="text-base-content/60 text-sm">{m.storage_connect_reconnecting()}</p>
-    <button type="button" class="btn btn-ghost btn-sm mt-2" onclick={cancelAutoConnect}>
-      {m.storage_connect_cancel()}
-    </button>
-  </div>
-{:else}
-  <div class="flex flex-col gap-4 md:flex-row md:items-start">
-    <StorageConnectionSidebar onselect={selectConnection} />
-
-    <div class="min-w-0 flex-1">
-      <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
-      <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
-
-      <form
-        bind:this={formRef}
-        method="POST"
-        action="?/connect"
-        use:enhance
-        class="flex flex-col gap-4"
-      >
-        <div>
-          <label for="{uid}-type" class="label mb-1 text-sm font-medium">
-            {m.storage_connect_type()}
-          </label>
-          <select
-            id="{uid}-type"
-            name="type"
-            class="select-bordered select w-full"
-            bind:value={$form.type}
-          >
-            <option value="s3">{m.storage_connect_type_s3()}</option>
-            <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
-          </select>
-        </div>
+<div class="flex flex-col gap-4 md:flex-row md:items-start">
+  <StorageConnectionSidebar {connections} />
+
+  <div class="min-w-0 flex-1">
+    <h1 class="mb-1 text-xl font-semibold">{m.storage_connect_title()}</h1>
+    <p class="text-base-content/60 mb-6 text-sm">{m.storage_connect_subtitle()}</p>
+
+    {#if connectError}
+      <div role="alert" class="alert alert-error mb-6 text-sm">
+        {m.storage_connect_error_unreachable()}
+      </div>
+    {/if}
+
+    <form method="POST" action="?/connect" use:enhance class="flex flex-col gap-4">
+      <div>
+        <label for="{uid}-type" class="label mb-1 text-sm font-medium">
+          {m.storage_connect_type()}
+        </label>
+        <select
+          id="{uid}-type"
+          name="type"
+          class="select-bordered select w-full"
+          bind:value={$form.type}
+        >
+          <option value="s3">{m.storage_connect_type_s3()}</option>
+          <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
+        </select>
+      </div>
+
+      <div>
+        <label for="{uid}-host" class="label mb-1 text-sm font-medium"
+          >{m.storage_connect_host()}</label
+        >
+        <input
+          id="{uid}-host"
+          name="host"
+          type="text"
+          class={['input-bordered input w-full', $errors?.host && 'input-error']}
+          placeholder={m.storage_connect_host_placeholder()}
+          bind:value={$form.host}
+          onblur={parseHostInput}
+        />
+        {#if $errors?.host}
+          <p class="text-error mt-1 text-xs">{$errors.host}</p>
+        {/if}
+      </div>
+
+      <div>
+        <label for="{uid}-port" class="label mb-1 text-sm font-medium"
+          >{m.storage_connect_port()}</label
+        >
+        <input
+          id="{uid}-port"
+          name="port"
+          type="number"
+          min="1"
+          max="65535"
+          class={['input-bordered input w-full', $errors?.port && 'input-error']}
+          placeholder={m.storage_connect_port_placeholder()}
+          bind:value={$form.port}
+        />
+        <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_port_hint()}</p>
+        {#if $errors?.port}
+          <p class="text-error mt-1 text-xs">{$errors.port}</p>
+        {/if}
+      </div>
 
+      <div class="flex items-start justify-between gap-4">
         <div>
-          <label for="{uid}-host" class="label mb-1 text-sm font-medium"
-            >{m.storage_connect_host()}</label
-          >
-          <input
-            id="{uid}-host"
-            name="host"
-            type="text"
-            class={['input-bordered input w-full', $errors?.host && 'input-error']}
-            placeholder={m.storage_connect_host_placeholder()}
-            bind:value={$form.host}
-            onblur={parseHostInput}
-          />
-          {#if $errors?.host}
-            <p class="text-error mt-1 text-xs">{$errors.host}</p>
-          {/if}
+          <label for="{uid}-tls" class="label text-sm font-medium">{m.storage_connect_tls()}</label>
+          <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_tls_hint()}</p>
         </div>
-
-        <div>
-          <label for="{uid}-port" class="label mb-1 text-sm font-medium"
-            >{m.storage_connect_port()}</label
-          >
-          <input
-            id="{uid}-port"
-            name="port"
-            type="number"
-            min="1"
-            max="65535"
-            class={['input-bordered input w-full', $errors?.port && 'input-error']}
-            placeholder={m.storage_connect_port_placeholder()}
-            bind:value={$form.port}
-          />
-          <p class="text-base-content/50 mt-1 text-xs">{m.storage_connect_port_hint()}</p>
-          {#if $errors?.port}
-            <p class="text-error mt-1 text-xs">{$errors.port}</p>
-          {/if}
-        </div>
-
-        <div class="flex items-start justify-between gap-4">
+        <input
+          id="{uid}-tls"
+          type="checkbox"
+          class="toggle toggle-primary mt-1 shrink-0"
+          checked={!!$form.tls}
+          onchange={(e) => {
+            $form.tls = e.currentTarget.checked ? { verification: 'Full' } : undefined;
+          }}
+        />
+      </div>
+
+      {#if $form.tls}
+        <div class="flex items-start justify-between gap-4 pl-4">
           <div>
-            <label for="{uid}-tls" class="label text-sm font-medium"
-              >{m.storage_connect_tls()}</label
-            >
-            <p class="text-base-content/50 mt-0.5 text-xs">{m.storage_connect_tls_hint()}</p>
+            <label for="{uid}-tls-verification" class="label text-sm font-medium">
+              {m.storage_connect_tls_verification()}
+            </label>
+            <p class="text-base-content/50 mt-0.5 text-xs">
+              {m.storage_connect_tls_verification_hint()}
+            </p>
           </div>
           <input
-            id="{uid}-tls"
+            id="{uid}-tls-verification"
             type="checkbox"
             class="toggle toggle-primary mt-1 shrink-0"
-            checked={!!$form.tls}
+            checked={$form.tls.verification === 'Full'}
             onchange={(e) => {
-              $form.tls = e.currentTarget.checked ? { verification: 'Full' } : undefined;
+              $form.tls = { verification: e.currentTarget.checked ? 'Full' : 'None' };
             }}
           />
         </div>
-
-        {#if $form.tls}
-          <div class="flex items-start justify-between gap-4 pl-4">
-            <div>
-              <label for="{uid}-tls-verification" class="label text-sm font-medium">
-                {m.storage_connect_tls_verification()}
-              </label>
-              <p class="text-base-content/50 mt-0.5 text-xs">
-                {m.storage_connect_tls_verification_hint()}
-              </p>
-            </div>
-            <input
-              id="{uid}-tls-verification"
-              type="checkbox"
-              class="toggle toggle-primary mt-1 shrink-0"
-              checked={$form.tls.verification === 'Full'}
-              onchange={(e) => {
-                $form.tls = { verification: e.currentTarget.checked ? 'Full' : 'None' };
-              }}
-            />
-          </div>
+      {/if}
+
+      <div>
+        <label for="{uid}-access-style" class="label mb-1 text-sm font-medium">
+          {m.storage_connect_access_style()}
+        </label>
+        <select
+          id="{uid}-access-style"
+          name="accessStyle"
+          class="select-bordered select w-full"
+          bind:value={$form.accessStyle}
+        >
+          <option value="Path">{m.storage_connect_access_style_path()}</option>
+          <option value="VirtualHosted">{m.storage_connect_access_style_virtual_hosted()}</option>
+        </select>
+      </div>
+
+      <div>
+        <label for="{uid}-region" class="label mb-1 text-sm font-medium"
+          >{m.storage_connect_region()}</label
+        >
+        <input
+          id="{uid}-region"
+          name="region.name"
+          type="text"
+          class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
+          bind:value={$form.region.name}
+        />
+        {#if $errors?.region?.name}
+          <p class="text-error mt-1 text-xs">{$errors.region.name}</p>
         {/if}
+      </div>
+
+      <div>
+        <label for="{uid}-access-key" class="label mb-1 text-sm font-medium"
+          >{m.storage_connect_access_key()}</label
+        >
+        <input
+          id="{uid}-access-key"
+          name="credentials.accessKey"
+          type="text"
+          class={['input-bordered input w-full', $errors?.credentials?.accessKey && 'input-error']}
+          autocomplete="username"
+          bind:value={$form.credentials.accessKey}
+        />
+        {#if $errors?.credentials?.accessKey}
+          <p class="text-error mt-1 text-xs">{$errors.credentials.accessKey}</p>
+        {/if}
+      </div>
+
+      <div>
+        <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium"
+          >{m.storage_connect_secret_key()}</label
+        >
+        <input
+          id="{uid}-secret-key"
+          name="credentials.secretKey"
+          type="password"
+          class={['input-bordered input w-full', $errors?.credentials?.secretKey && 'input-error']}
+          autocomplete="current-password"
+          bind:value={$form.credentials.secretKey}
+        />
+        {#if $errors?.credentials?.secretKey}
+          <p class="text-error mt-1 text-xs">{$errors.credentials.secretKey}</p>
+        {/if}
+      </div>
 
-        <div>
-          <label for="{uid}-access-style" class="label mb-1 text-sm font-medium">
-            {m.storage_connect_access_style()}
-          </label>
-          <select
-            id="{uid}-access-style"
-            name="accessStyle"
-            class="select-bordered select w-full"
-            bind:value={$form.accessStyle}
-          >
-            <option value="Path">{m.storage_connect_access_style_path()}</option>
-            <option value="VirtualHosted">{m.storage_connect_access_style_virtual_hosted()}</option>
-          </select>
-        </div>
-
-        <div>
-          <label for="{uid}-region" class="label mb-1 text-sm font-medium"
-            >{m.storage_connect_region()}</label
-          >
-          <input
-            id="{uid}-region"
-            name="region.name"
-            type="text"
-            class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
-            bind:value={$form.region.name}
-          />
-          {#if $errors?.region?.name}
-            <p class="text-error mt-1 text-xs">{$errors.region.name}</p>
-          {/if}
-        </div>
-
-        <div>
-          <label for="{uid}-access-key" class="label mb-1 text-sm font-medium"
-            >{m.storage_connect_access_key()}</label
-          >
-          <input
-            id="{uid}-access-key"
-            name="credentials.accessKey"
-            type="text"
-            class={[
-              'input-bordered input w-full',
-              $errors?.credentials?.accessKey && 'input-error'
-            ]}
-            autocomplete="username"
-            bind:value={$form.credentials.accessKey}
-          />
-          {#if $errors?.credentials?.accessKey}
-            <p class="text-error mt-1 text-xs">{$errors.credentials.accessKey}</p>
-          {/if}
-        </div>
-
-        <div>
-          <label for="{uid}-secret-key" class="label mb-1 text-sm font-medium"
-            >{m.storage_connect_secret_key()}</label
-          >
-          <input
-            id="{uid}-secret-key"
-            name="credentials.secretKey"
-            type="password"
-            class={[
-              'input-bordered input w-full',
-              $errors?.credentials?.secretKey && 'input-error'
-            ]}
-            autocomplete="current-password"
-            bind:value={$form.credentials.secretKey}
-          />
-          {#if $errors?.credentials?.secretKey}
-            <p class="text-error mt-1 text-xs">{$errors.credentials.secretKey}</p>
-          {/if}
-        </div>
+      {#if $message}
+        <p class="text-error text-sm">{$message}</p>
+      {/if}
 
-        {#if $message}
-          <p class="text-error text-sm">{$message}</p>
+      <button type="submit" class="btn btn-primary" disabled={$submitting}>
+        {#if $submitting}
+          <span class="loading loading-sm loading-spinner"></span>
         {/if}
-
-        <button type="submit" class="btn btn-primary" disabled={$submitting}>
-          {#if $submitting}
-            <span class="loading loading-sm loading-spinner"></span>
-          {/if}
-          {m.storage_connect_submit()}
-        </button>
-      </form>
-    </div>
+        {m.storage_connect_submit()}
+      </button>
+    </form>
   </div>
-{/if}
+</div>
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
index 37ca08e1..c43718b4 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte.spec.ts
@@ -3,26 +3,11 @@ import { describe, expect, it, vi, beforeEach } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import type { ComponentProps } from 'svelte';
 import StorageConnectForm from './StorageConnectForm.svelte';
-import type { SavedConnection } from '$lib/storage/connection-storage.js';
+import type { ConnectionMetadata } from '$lib/server/storage/types.js';
 
 type ConnectionFormProp = ComponentProps<typeof StorageConnectForm>['connectionForm'];
 
-/** Build a minimal StoredConnection fixture with a stable UUID. */
-function makeConn(
-  overrides: Partial<Omit<SavedConnection, 'id'>> & { id?: string } = {}
-): SavedConnection {
-  return {
-    id: overrides.id ?? '00000000-0000-0000-0000-000000000001',
-    type: 's3',
-    host: 'minio.example.com',
-    port: undefined,
-    tls: { verification: 'Full' },
-    accessStyle: 'Path',
-    region: { name: 'us-east-1' },
-    credentials: { accessKey: '', secretKey: '' },
-    ...overrides
-  } as SavedConnection;
-}
+// Note: $app/navigation is not mocked; invalidateAll is a no-op in test environments.
 
 // Mock feature flags to disable auto-connect
 vi.mock('$lib/client/feature-flags.js', () => ({
@@ -30,17 +15,6 @@ vi.mock('$lib/client/feature-flags.js', () => ({
   storageAutoConnectTimeoutMs: 15_000
 }));
 
-// Mock connection-storage module
-vi.mock('$lib/storage/connection-storage.js', () => ({
-  saveConnectionLocally: vi.fn(),
-  loadConnectionLocally: vi.fn(() => null),
-  loadAllConnectionsLocally: vi.fn(() => []),
-  removeConnectionLocally: vi.fn(),
-  updateConnectionLocally: vi.fn(),
-  removeConnectionById: vi.fn(),
-  loadConnectionById: vi.fn(() => null)
-}));
-
 // Mock paraglide messages
 vi.mock('$lib/paraglide/messages.js', () => ({
   storage_connect_title: () => 'Connect to Storage',
@@ -67,11 +41,16 @@ vi.mock('$lib/paraglide/messages.js', () => ({
   storage_connect_access_key: () => 'Access key',
   storage_connect_secret_key: () => 'Secret key',
   storage_connect_submit: () => 'Connect',
-  storage_connect_forget_label: ({ endpoint }: { endpoint: string }) => `Forget ${endpoint}`,
-  storage_connect_forget_confirm: ({ endpoint }: { endpoint: string }) =>
-    `Forget connection to ${endpoint}?`,
+  storage_connect_testing: () => 'Testing connection...',
+  storage_connect_additional_buckets: () => 'Additional buckets',
+  storage_connect_additional_buckets_hint: () => 'One per line',
   storage_connect_forget_cancel: () => 'Cancel',
   storage_connect_forget: () => 'Forget',
+  storage_connect_forget_label: ({ endpoint }: { endpoint: string }) =>
+    `Forget connection to ${endpoint}`,
+  storage_connect_forget_confirm: ({ endpoint }: { endpoint: string }) =>
+    `Remove ${endpoint} from saved connections?`,
+  storage_connect_error_unreachable: () => 'Could not connect',
   storage_connect_manage: () => 'Manage connections',
   storage_connect_edit: () => 'Edit',
   storage_more_options: () => 'More options',
@@ -112,20 +91,83 @@ function createMockForm(overrides: Record<string, unknown> = {}): ConnectionForm
   } as unknown as ConnectionFormProp;
 }
 
+function makeConnection(overrides: Partial<ConnectionMetadata> = {}): ConnectionMetadata {
+  return {
+    id: 'conn-1',
+    name: 'My Connection',
+    endpoint: 'https://example.com',
+    ...overrides
+  };
+}
+
+function renderForm(
+  formOverrides: Record<string, unknown> = {},
+  connections: ConnectionMetadata[] = [],
+  connectError: string | null = null
+) {
+  return render(StorageConnectForm, {
+    connectionForm: createMockForm(formOverrides),
+    connections,
+    connectError
+  });
+}
+
 describe('StorageConnectForm', () => {
   beforeEach(() => {
     vi.clearAllMocks();
   });
 
   it('should render the form title and subtitle', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    renderForm();
 
     await expect.element(page.getByText('Connect to Storage')).toBeInTheDocument();
     await expect.element(page.getByText('Enter your connection details')).toBeInTheDocument();
   });
 
-  it('should render all form fields with labels', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+  it('should show "No saved connections" when the store is empty', async () => {
+    renderForm();
+
+    await expect.element(page.getByText('No saved connections yet')).toBeInTheDocument();
+  });
+
+  it('should show saved connections from the connection store', async () => {
+    renderForm({}, [
+      makeConnection({ id: 'conn-1', name: 'My MinIO', endpoint: 'https://minio.example.com' })
+    ]);
+
+    await expect.element(page.getByText('My MinIO').first()).toBeInTheDocument();
+  });
+
+  it('should show delete buttons for saved connections', async () => {
+    renderForm({}, [
+      makeConnection({ id: 'conn-1', name: 'Test S3', endpoint: 'https://s3.test.io' })
+    ]);
+
+    await expect
+      .element(page.getByRole('button', { name: 'Forget connection to Test S3' }))
+      .toBeInTheDocument();
+  });
+
+  it('should render multiple saved connections', async () => {
+    renderForm({}, [
+      makeConnection({ id: 'conn-1', name: 'First', endpoint: 'https://first.example.com' }),
+      makeConnection({ id: 'conn-2', name: 'Second', endpoint: 'https://second.example.com' })
+    ]);
+
+    // Use .first() to avoid strict-mode violation: the name appears in both the
+    // <span> label and the containing <button> (which inherits its text content).
+    await expect.element(page.getByText('First').first()).toBeInTheDocument();
+    await expect.element(page.getByText('Second').first()).toBeInTheDocument();
+  });
+
+  it('should show connection name for null endpoint', async () => {
+    renderForm({}, [makeConnection({ id: 'conn-1', name: 'AWS Connection', endpoint: null })]);
+
+    await expect.element(page.getByText('AWS Connection').first()).toBeInTheDocument();
+  });
+
+  it('should render the connection form fields', async () => {
+    renderForm();
 
     await expect.element(page.getByLabelText('Backend type')).toBeInTheDocument();
     await expect.element(page.getByLabelText('Host')).toBeInTheDocument();
@@ -137,31 +179,44 @@ describe('StorageConnectForm', () => {
     await expect.element(page.getByLabelText('Secret key')).toBeInTheDocument();
   });
 
-  it('should render backend type as a select with S3 option', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+  it('should render the form with POST method to ?/connect', async () => {
+    renderForm();
 
-    const select = page.getByLabelText('Backend type');
-    await expect.element(select).toBeInTheDocument();
-    await expect.element(page.getByText('Amazon S3')).toBeInTheDocument();
-    await expect.element(page.getByText('HDFS')).toBeInTheDocument();
+    const connectBtn = page.getByRole('button', { name: 'Connect' });
+    await expect.element(connectBtn).toBeInTheDocument();
+    const form = connectBtn.element().closest('form');
+    expect(form?.getAttribute('method')).toBe('POST');
+    expect(form?.getAttribute('action')).toContain('/connect');
   });
 
   it('should render host as text input', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     const input = page.getByLabelText('Host');
     await expect.element(input).toHaveAttribute('type', 'text');
   });
 
   it('should render port as number input', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     const input = page.getByLabelText('Port');
     await expect.element(input).toHaveAttribute('type', 'number');
   });
 
   it('should render TLS as a checkbox toggle', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     const toggle = page.getByLabelText('Use TLS');
     await expect.element(toggle).toHaveAttribute('type', 'checkbox');
@@ -169,7 +224,9 @@ describe('StorageConnectForm', () => {
 
   it('should show verify certificate toggle when TLS is enabled', async () => {
     render(StorageConnectForm, {
-      connectionForm: createMockForm({ data: { tls: { verification: 'Full' } } })
+      connectionForm: createMockForm({ data: { tls: { verification: 'Full' } } }),
+      connections: [],
+      connectError: null
     });
 
     await expect.element(page.getByLabelText('Verify certificate')).toBeInTheDocument();
@@ -177,197 +234,84 @@ describe('StorageConnectForm', () => {
 
   it('should hide verify certificate toggle when TLS is disabled', async () => {
     render(StorageConnectForm, {
-      connectionForm: createMockForm({ data: { tls: undefined } })
+      connectionForm: createMockForm({ data: { tls: undefined } }),
+      connections: [],
+      connectError: null
     });
 
     await expect.element(page.getByLabelText('Verify certificate')).not.toBeInTheDocument();
   });
 
   it('should render secret key as password input', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     const input = page.getByLabelText('Secret key');
     await expect.element(input).toHaveAttribute('type', 'password');
   });
 
   it('should render connect button', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     await expect.element(page.getByRole('button', { name: 'Connect' })).toBeInTheDocument();
   });
 
   it('should show no saved connections message when none exist', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     await expect.element(page.getByText('No saved connections yet')).toBeInTheDocument();
   });
 
-  it('should show saved connections when present', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        host: 'minio.example.com',
-        port: 9000,
-        region: { name: 'us-east-1' },
-        credentials: { accessKey: 'AKIA123', secretKey: 'secret' }
-      })
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect.element(page.getByText('minio.example.com:9000').first()).toBeInTheDocument();
-  });
-
-  it('should show forget button for saved connections', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000011',
-        host: 's3.test.io',
-        region: { name: 'eu-west-1' }
-      })
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect
-      .element(page.getByRole('button', { name: 'Forget s3.test.io' }))
-      .toBeInTheDocument();
-  });
-
-  it('should open forget confirmation dialog when forget button clicked', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000012',
-        host: 's3.remove.io',
-        region: { name: 'eu-west-1' }
-      })
+  it('should render connections in a list role', async () => {
+    renderForm({}, [
+      makeConnection({ id: 'conn-1', name: 'Listed', endpoint: 'https://listed.example.com' })
     ]);
 
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    const forgetBtn = page.getByRole('button', { name: 'Forget s3.remove.io' });
-    await forgetBtn.click();
-
-    await expect
-      .element(page.getByText('Delete connection to s3.remove.io?').first())
-      .toBeInTheDocument();
-    await expect.element(page.getByRole('button', { name: 'Cancel' })).toBeInTheDocument();
     await expect
-      .element(page.getByRole('button', { name: 'Delete', exact: true }))
+      .element(page.getByRole('list', { name: 'Saved connections' }).first())
       .toBeInTheDocument();
-  });
-
-  it('should show multiple saved connections', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000013',
-        host: 'first.example.com',
-        region: { name: 'us-east-1' }
-      }),
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000014',
-        host: 'second.example.com',
-        port: 9000,
-        accessStyle: 'VirtualHosted',
-        region: { name: 'eu-west-1' },
-        credentials: { accessKey: 'KEY', secretKey: 'SECRET' }
-      }),
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000015',
-        name: 'Production',
-        host: 'prod.example.com',
-        region: { name: 'us-west-2' }
-      })
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect.element(page.getByText('first.example.com').first()).toBeInTheDocument();
-    await expect.element(page.getByText('second.example.com:9000').first()).toBeInTheDocument();
-    await expect.element(page.getByText('Production', { exact: true }).first()).toBeInTheDocument();
-  });
-
-  it('should render saved connections in a list role', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000016',
-        host: 'listed.example.com',
-        region: { name: 'us-east-1' }
-      })
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await expect.element(page.getByRole('list').first()).toBeInTheDocument();
     await expect.element(page.getByRole('listitem').first()).toBeInTheDocument();
   });
 
   it('should render port hint text', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     await expect.element(page.getByText('Leave blank for default port')).toBeInTheDocument();
   });
 
   it('should render form with POST method', async () => {
-    render(StorageConnectForm, { connectionForm: createMockForm() });
+    render(StorageConnectForm, {
+      connectionForm: createMockForm(),
+      connections: [],
+      connectError: null
+    });
 
     const form = page.getByRole('button', { name: 'Connect' }).element().closest('form');
     expect(form?.getAttribute('method')).toBe('POST');
   });
 
-  it('should close forget dialog when cancel is clicked', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000017',
-        host: 's3.cancel.io',
-        region: { name: 'eu-west-1' }
-      })
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await page.getByRole('button', { name: 'Forget s3.cancel.io' }).click();
-    await expect
-      .element(page.getByText('Delete connection to s3.cancel.io?').first())
-      .toBeInTheDocument();
-
-    await page.getByRole('button', { name: 'Cancel', exact: true }).click();
-    await expect
-      .element(page.getByText('Delete connection to s3.cancel.io?'))
-      .not.toBeInTheDocument();
-  });
-
-  it('should remove connection when forget is confirmed', async () => {
-    const { loadAllConnectionsLocally, removeConnectionLocally } =
-      await import('$lib/storage/connection-storage.js');
-    const conn = makeConn({
-      id: '00000000-0000-0000-0000-000000000018',
-      host: 's3.forget.io',
-      region: { name: 'eu-west-1' }
-    });
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([conn]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await page.getByRole('button', { name: 'Forget s3.forget.io' }).click();
-    // After clicking forget, mock returns empty list
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([]);
-    await page.getByRole('button', { name: 'Delete', exact: true }).click();
-
-    expect(removeConnectionLocally).toHaveBeenCalledWith(conn);
-    await expect.element(page.getByText('No saved connections yet')).toBeInTheDocument();
-  });
-
   it('should display host error when form has host errors', async () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
         errors: { host: ['Host is required'] }
-      })
+      }),
+      connections: [],
+      connectError: null
     });
 
     await expect.element(page.getByText('Host is required')).toBeInTheDocument();
@@ -380,7 +324,9 @@ describe('StorageConnectForm', () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
         errors: { region: { name: ['Region name is required'] } }
-      })
+      }),
+      connections: [],
+      connectError: null
     });
 
     await expect.element(page.getByText('Region name is required')).toBeInTheDocument();
@@ -394,7 +340,9 @@ describe('StorageConnectForm', () => {
         errors: {
           credentials: { accessKey: ['Access key is required when secret key is provided'] }
         }
-      })
+      }),
+      connections: [],
+      connectError: null
     });
 
     await expect
@@ -410,7 +358,9 @@ describe('StorageConnectForm', () => {
         errors: {
           credentials: { secretKey: ['Secret key is required when access key is provided'] }
         }
-      })
+      }),
+      connections: [],
+      connectError: null
     });
 
     await expect
@@ -424,7 +374,9 @@ describe('StorageConnectForm', () => {
     render(StorageConnectForm, {
       connectionForm: createMockForm({
         message: 'Connection refused: unable to reach endpoint'
-      })
+      }),
+      connections: [],
+      connectError: null
     });
 
     await expect
@@ -432,43 +384,11 @@ describe('StorageConnectForm', () => {
       .toBeInTheDocument();
   });
 
-  it('should fill form fields when a saved connection is clicked', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000021',
-        host: 's3.select.io',
-        port: 9000,
-        accessStyle: 'VirtualHosted',
-        region: { name: 'ap-southeast-1' },
-        credentials: { accessKey: 'AKIASELECT', secretKey: 'secretselect' }
-      })
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    // Click the saved connection button (first match — mobile card)
-    await page.getByRole('button', { name: 's3.select.io:9000', exact: true }).first().click();
-
-    // Verify form fields are filled
-    await expect.element(page.getByLabelText('Host')).toHaveValue('s3.select.io');
-    await expect.element(page.getByLabelText('Region')).toHaveValue('ap-southeast-1');
-    await expect.element(page.getByLabelText('Access key')).toHaveValue('AKIASELECT');
-    await expect.element(page.getByLabelText('Secret key')).toHaveValue('secretselect');
-  });
-
   it('should show saved connections heading when connections exist', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000022',
-        host: 'heading.example.com',
-        region: { name: 'us-east-1' }
-      })
+    renderForm({}, [
+      makeConnection({ id: 'conn-1', name: 'Heading', endpoint: 'https://heading.example.com' })
     ]);
 
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
     await expect.element(page.getByText('Saved connections').first()).toBeInTheDocument();
   });
 
@@ -484,7 +404,9 @@ describe('StorageConnectForm', () => {
           }
         },
         message: 'Validation failed'
-      })
+      }),
+      connections: [],
+      connectError: null
     });
 
     await expect.element(page.getByText('Host is required')).toBeInTheDocument();
@@ -493,28 +415,4 @@ describe('StorageConnectForm', () => {
     await expect.element(page.getByText('Secret key required')).toBeInTheDocument();
     await expect.element(page.getByText('Validation failed')).toBeInTheDocument();
   });
-
-  it('should close forget dialog via cancel button', async () => {
-    const { loadAllConnectionsLocally } = await import('$lib/storage/connection-storage.js');
-    vi.mocked(loadAllConnectionsLocally).mockReturnValue([
-      makeConn({
-        id: '00000000-0000-0000-0000-000000000023',
-        host: 's3.backdrop.io',
-        region: { name: 'eu-west-1' }
-      })
-    ]);
-
-    render(StorageConnectForm, { connectionForm: createMockForm() });
-
-    await page.getByRole('button', { name: 'Forget s3.backdrop.io' }).click();
-    await expect
-      .element(page.getByText('Delete connection to s3.backdrop.io?').first())
-      .toBeInTheDocument();
-
-    // Close the dialog by clicking Cancel
-    await page.getByRole('button', { name: 'Cancel', exact: true }).click();
-    await expect
-      .element(page.getByText('Delete connection to s3.backdrop.io?'))
-      .not.toBeInTheDocument();
-  });
 });
diff --git a/src/lib/components/storage/DeleteConnectionModal.svelte b/src/lib/components/storage/modals/DeleteConnectionModal.svelte
similarity index 89%
rename from src/lib/components/storage/DeleteConnectionModal.svelte
rename to src/lib/components/storage/modals/DeleteConnectionModal.svelte
index 39d33390..3582d89d 100644
--- a/src/lib/components/storage/DeleteConnectionModal.svelte
+++ b/src/lib/components/storage/modals/DeleteConnectionModal.svelte
@@ -17,8 +17,7 @@
   let copiedField: string | null = $state(null);
 
   function connectionLabel(conn: SavedConnection): string {
-    if (conn.name) return conn.name;
-    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+    return conn.name || conn.host || 'S3';
   }
 
   function copyField(value: string, field: string) {
@@ -33,7 +32,6 @@
     const host = conn.port ? `${conn.host}:${conn.port}` : conn.host;
     const lines = [
       `Host:        ${host}`,
-      `Type:        ${m.storage_connect_type_s3()}`,
       ...(conn.credentials?.accessKey ? [`Access key:  ${conn.credentials.accessKey}`] : []),
       `Region:      ${conn.region.name}`
     ];
@@ -104,15 +102,17 @@
                 </td>
               </tr>
             {/if}
-            <tr>
-              <th>{m.storage_connect_region()}</th>
-              <td class="border-base-content/10 border-l">
-                <div class="flex items-center justify-between gap-2">
-                  <span class="font-mono">{connection.region.name}</span>
-                  {@render copyBtn(connection.region.name, 'region')}
-                </div>
-              </td>
-            </tr>
+            {#if connection.region?.name}
+              <tr>
+                <th>{m.storage_connect_region()}</th>
+                <td class="border-base-content/10 border-l">
+                  <div class="flex items-center justify-between gap-2">
+                    <span class="font-mono">{connection.region.name}</span>
+                    {@render copyBtn(connection.region.name, 'region')}
+                  </div>
+                </td>
+              </tr>
+            {/if}
           </tbody>
         </table>
       </div>
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 238d6347..146a6f4e 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
-  import { browser } from '$app/environment';
   import { SvelteURLSearchParams } from 'svelte/reactivity';
   import IconCloseFullscreen from 'virtual:icons/material-symbols/close-fullscreen';
   import IconOpenInFull from 'virtual:icons/material-symbols/open-in-full';
@@ -23,9 +22,9 @@
   import FallbackPreview from './preview/FallbackPreview.svelte';
   import { keyToName, formatFileSize } from '$lib/storage/utils.js';
   import { downloadObject, DownloadError } from '$lib/storage/download.js';
-  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
   import { addToast } from '$lib/stores/toast.svelte.js';
-  import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
   import { maxEditableFileSize } from '$lib/client/feature-flags.js';
 
   interface Props {
@@ -153,11 +152,6 @@
     if (open && objectKey) {
       editorReady = false;
       void loadPreview(objectKey, bucket);
-      // Start loading Monaco in parallel with data fetching
-      if (browser) {
-        import('monaco-editor/esm/vs/editor/editor.worker?worker');
-        import('monaco-editor');
-      }
     }
 
     if (!open) {
@@ -176,9 +170,9 @@
     preview = { kind: 'loading' };
     revokeBlobUrls();
 
-    const conn = loadConnectionLocally();
-    const headers: HeadersInit = conn
-      ? { [STORAGE_CONNECTION_HEADER]: getConnectionHeader(conn) }
+    const connectionId = connectionStore.activeConnectionId;
+    const headers: HeadersInit = connectionId
+      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
       : {};
 
     try {
@@ -450,15 +444,14 @@
 
   async function triggerDownload() {
     if (!objectKey) return;
-
-    const conn = loadConnectionLocally();
-    if (!conn) {
+    const connectionId = connectionStore.activeConnectionId;
+    if (!connectionId) {
       addToast('error', m.storage_download_error_unknown());
       return;
     }
 
     try {
-      await downloadObject(bucket, objectKey, getConnectionHeader(conn));
+      await downloadObject(bucket, objectKey, connectionId);
     } catch (err) {
       if (err instanceof DownloadError) {
         addToast('error', err.message);
@@ -488,11 +481,10 @@
 
     saving = true;
     try {
-      const conn = loadConnectionLocally();
-      const headers: HeadersInit = {};
-      if (conn) {
-        (headers as Record<string, string>)[STORAGE_CONNECTION_HEADER] = getConnectionHeader(conn);
-      }
+      const connectionId = connectionStore.activeConnectionId;
+      const headers: HeadersInit = connectionId
+        ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+        : {};
 
       const res = await fetch(`/api/storage/save-text?${params}`, {
         method: 'POST',
@@ -578,9 +570,9 @@
   ): Promise<unknown[][]> {
     if (!objectKey) return [];
 
-    const conn = loadConnectionLocally();
-    const fetchHeaders: HeadersInit = conn
-      ? { [STORAGE_CONNECTION_HEADER]: getConnectionHeader(conn) }
+    const connectionId = connectionStore.activeConnectionId;
+    const fetchHeaders: HeadersInit = connectionId
+      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
       : {};
 
     const params = new URLSearchParams({
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index baa67985..ec2f6253 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -8,7 +8,7 @@
   import Modal from '$lib/components/Modal.svelte';
   import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
   import { formatFileSize } from '$lib/storage/utils.js';
-  import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
   import { uploadConcurrency } from '$lib/client/feature-flags.js';
   import UploadDropzone from './UploadDropzone.svelte';
   import UploadConflictEntry from './UploadConflictEntry.svelte';
@@ -103,8 +103,7 @@
     cancelRequested = false;
     phase = 'checking';
 
-    const conn = loadConnectionLocally();
-    const connHeader = conn ? getConnectionHeader(conn) : '';
+    const connHeader = connectionStore.activeConnectionId ?? '';
 
     const results: { id: string; conflict: boolean }[] = [];
     for (let i = 0; i < entries.length; i += uploadConcurrency) {
@@ -183,8 +182,7 @@
     entries = entries.map((e) =>
       e.id === entry.id ? { ...e, status: 'uploading' as const, progress: 0 } : e
     );
-    const conn = loadConnectionLocally();
-    const connHeader = conn ? getConnectionHeader(conn) : '';
+    const connHeader = connectionStore.activeConnectionId ?? '';
     try {
       await uploadFile(
         bucket,
@@ -274,8 +272,7 @@
 
     entries = entries.map((e) => (e.id === id ? { ...e, renameState: 'checking' as const } : e));
     const newKey = resolvedKey(entry);
-    const conn = loadConnectionLocally();
-    const connHeader = conn ? getConnectionHeader(conn) : '';
+    const connHeader = connectionStore.activeConnectionId ?? '';
     try {
       const exists = await checkObjectExists(bucket, newKey, connHeader);
       const nextState: RenameState = exists ? 'conflict' : 'ok';
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index 759502bd..8753da1d 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -26,6 +26,12 @@ vi.mock('$lib/storage/upload.js', () => ({
   UploadError: MockUploadError
 }));
 
+// Provide a stable, isolated connection store so mutations from other test
+// files (e.g. StorageConnectForm.svelte.spec.ts) cannot bleed across.
+vi.mock('$lib/storage/connection-store.svelte.js', () => ({
+  connectionStore: { activeConnectionId: null, connections: [] }
+}));
+
 const defaultProps = {
   open: true,
   bucket: faker.word.noun(),
diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
index 576646fe..ece3d597 100644
--- a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -1,34 +1,32 @@
 <script lang="ts">
-  import { onMount } from 'svelte';
   import IconStorage from 'virtual:icons/material-symbols/storage';
   import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
   import IconEdit from 'virtual:icons/material-symbols/edit';
   import IconClose from 'virtual:icons/material-symbols/close';
-  import DeleteConnectionModal from '$lib/components/storage/DeleteConnectionModal.svelte';
   import Tooltip from '$lib/components/Tooltip.svelte';
   import { createResizablePanel } from './resizable-panel.svelte.js';
   import ResizeHandle from './ResizeHandle.svelte';
   import { resolve } from '$app/paths';
   import * as m from '$lib/paraglide/messages.js';
-  import {
-    loadAllConnectionsLocally,
-    removeConnectionLocally,
-    type SavedConnection
-  } from '$lib/storage/connection-storage.js';
+  import type { ConnectionMetadata } from '$lib/server/storage/types.js';
+  import DeleteConnectionModal from '$lib/components/storage/modals/DeleteConnectionModal.svelte';
+  import type { SavedConnection } from '$lib/storage/connection-storage.js';
 
   interface Props {
+    /** List of saved connections from the server. */
+    connections: ConnectionMetadata[];
     /** ID of the connection currently being acted on (highlighted in the list). */
     activeId?: string;
-    /** Called when the user clicks a connection row. */
-    onselect: (conn: SavedConnection) => void;
+    /**
+     * Callback when a connection is selected. When provided, clicking a connection
+     * calls this callback instead of submitting the `?/use` form (which activates
+     * the connection server-side). Use this on edit pages to navigate between
+     * connection edits rather than activating them.
+     */
+    onselect?: (conn: ConnectionMetadata) => void;
   }
 
-  let { activeId, onselect }: Props = $props();
-
-  let allConnections: SavedConnection[] = $state([]);
-  let connectionsLoaded = $state(false);
-  let forgetCandidate: SavedConnection | null = $state(null);
-  let forgetOpen = $state(false);
+  let { connections, activeId, onselect }: Props = $props();
 
   const resize = createResizablePanel({
     storageKey: 'storage_connect_sidebar_width',
@@ -36,7 +34,7 @@
     minWidth: 140,
     maxWidth: 400
   });
-  let menuConn: SavedConnection | null = $state(null);
+  let menuConn: ConnectionMetadata | null = $state(null);
   let menuEl: HTMLUListElement | null = $state(null);
   let menuRawPos = $state({ left: 0, top: 0 });
   const menuPos = $derived.by(() => {
@@ -72,12 +70,11 @@
     tooltipText = null;
   }
 
-  function connectionLabel(conn: SavedConnection): string {
-    if (conn.name) return conn.name;
-    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
+  function connectionLabel(conn: ConnectionMetadata): string {
+    return conn.name || conn.endpoint || 'S3';
   }
 
-  function openContextMenu(e: MouseEvent, conn: SavedConnection) {
+  function openContextMenu(e: MouseEvent, conn: ConnectionMetadata) {
     e.preventDefault();
     e.stopPropagation();
     const btnRect = (e.currentTarget as HTMLElement).getBoundingClientRect();
@@ -90,6 +87,7 @@
   }
 
   function handleOutsideClick(e: MouseEvent) {
+    if (deleteConfirmOpen) return;
     if (menuConn && menuEl && !menuEl.contains(e.target as Node)) closeContextMenu();
   }
 
@@ -97,22 +95,26 @@
     if (menuConn && e.key === 'Escape') closeContextMenu();
   }
 
-  function openForgetConfirm(conn: SavedConnection) {
-    forgetCandidate = conn;
-    forgetOpen = true;
+  // Delete confirmation
+  let deleteConfirmOpen = $state(false);
+  let deleteFormEl = $state<HTMLFormElement | null>(null);
+
+  function confirmDelete() {
+    deleteFormEl?.requestSubmit();
   }
 
-  function forgetConnection() {
-    if (!forgetCandidate) return;
-    removeConnectionLocally(forgetCandidate);
-    allConnections = loadAllConnectionsLocally();
-    forgetCandidate = null;
-    forgetOpen = false;
+  function cancelDelete() {
+    deleteConfirmOpen = false;
+    closeContextMenu();
   }
 
-  onMount(() => {
-    allConnections = loadAllConnectionsLocally();
-    connectionsLoaded = true;
+  const deleteConn = $derived.by<SavedConnection | null>(() => {
+    if (!menuConn) return null;
+    const ep = menuConn.endpoint ?? '';
+    const colonIdx = ep.lastIndexOf(':');
+    const host = colonIdx > 0 ? ep.slice(0, colonIdx) : ep;
+    const port = colonIdx > 0 ? parseInt(ep.slice(colonIdx + 1), 10) || null : null;
+    return { id: menuConn.id, name: menuConn.name, host, port, type: 's3', region: { name: '' } };
   });
 </script>
 
@@ -121,6 +123,9 @@
 
 <!-- Context menu (fixed, rendered outside the layout flow) -->
 {#if menuConn}
+  <form method="POST" action="?/deleteConnection" bind:this={deleteFormEl} class="contents">
+    <input type="hidden" name="connectionId" value={menuConn.id} />
+  </form>
   <ul
     bind:this={menuEl}
     class="
@@ -146,22 +151,26 @@
       <button
         type="button"
         role="menuitem"
-        class="text-error justify-start"
-        onclick={() => {
-          openForgetConfirm(menuConn!);
-          closeContextMenu();
-        }}
+        class="text-error w-full justify-start"
+        onclick={() => (deleteConfirmOpen = true)}
       >
         <IconClose class="size-4 shrink-0" aria-hidden="true" />
         {m.storage_connect_forget()}
       </button>
     </li>
   </ul>
+
+  <DeleteConnectionModal
+    open={deleteConfirmOpen}
+    connection={deleteConn}
+    onconfirm={confirmDelete}
+    oncancel={cancelDelete}
+  />
 {/if}
 
 <!-- Mobile: horizontal scrollable connections row -->
 <div class="md:hidden">
-  {#if connectionsLoaded && allConnections.length > 0}
+  {#if connections.length > 0}
     <p class="text-base-content/50 mb-2 text-xs font-semibold tracking-wide uppercase">
       {m.storage_connect_saved()}
     </p>
@@ -170,38 +179,64 @@
       role="list"
       aria-label={m.storage_connect_saved()}
     >
-      {#each allConnections as conn (conn.id)}
+      {#each connections as conn (conn.id)}
         <div class="relative shrink-0" role="listitem">
-          <button
-            type="button"
-            onclick={() => onselect(conn)}
-            class="
-              border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 focus-visible:outline-primary
-              flex flex-col items-center gap-1.5 rounded-xl
-              border p-3 text-center transition-colors before:z-200
-              {activeId === conn.id ? 'border-primary bg-primary/5' : ''}
-            "
-            title={connectionLabel(conn)}
-            data-tip={connectionLabel(conn)}
-          >
-            <IconStorage class="text-primary size-8" aria-hidden="true" />
-            <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
-          </button>
-          <button
-            type="button"
-            aria-label={m.storage_connect_forget_label({ endpoint: connectionLabel(conn) })}
-            onclick={(e) => {
-              e.stopPropagation();
-              openForgetConfirm(conn);
+          {#if onselect}
+            <button
+              type="button"
+              onclick={() => onselect(conn)}
+              class="
+                border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 focus-visible:outline-primary
+                flex flex-col items-center gap-1.5 rounded-xl
+                border p-3 text-center transition-colors
+                {activeId === conn.id ? 'border-primary bg-primary/5' : ''}
+              "
+              title={connectionLabel(conn)}
+              data-tip={connectionLabel(conn)}
+            >
+              <IconStorage class="text-primary size-8" aria-hidden="true" />
+              <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
+            </button>
+          {:else}
+            <form method="POST" action="?/use">
+              <input type="hidden" name="connectionId" value={conn.id} />
+              <button
+                type="submit"
+                class="
+                  border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 focus-visible:outline-primary
+                  flex flex-col items-center gap-1.5 rounded-xl
+                  border p-3 text-center transition-colors
+                  {activeId === conn.id ? 'border-primary bg-primary/5' : ''}
+                "
+                title={connectionLabel(conn)}
+                data-tip={connectionLabel(conn)}
+              >
+                <IconStorage class="text-primary size-8" aria-hidden="true" />
+                <span class="w-20 truncate text-xs font-medium">{connectionLabel(conn)}</span>
+              </button>
+            </form>
+          {/if}
+          <form
+            method="POST"
+            action="?/deleteConnection"
+            onsubmit={() => {
+              // Redirect handles the page update
             }}
-            class="
-              border-base-300 bg-base-100 text-error hover:bg-error hover:text-error-content
-              absolute -top-2 -right-2 flex size-5 items-center justify-center
-              rounded-full border shadow-sm transition-colors
-            "
+            class="absolute -top-2 -right-2"
           >
-            <IconClose class="size-3" aria-hidden="true" />
-          </button>
+            <input type="hidden" name="connectionId" value={conn.id} />
+            <button
+              type="submit"
+              aria-label={m.storage_connect_forget_label({ endpoint: connectionLabel(conn) })}
+              class="
+                border-base-300 bg-base-100 text-error hover:bg-error hover:text-error-content
+                flex size-5 items-center justify-center
+                rounded-full border shadow-sm transition-colors
+              "
+            >
+              <IconClose class="size-3" aria-hidden="true" />
+            </button>
+          </form>
         </div>
       {/each}
     </div>
@@ -219,7 +254,7 @@
     border-base-300 bg-base-100 sticky top-0
     hidden h-[calc(100dvh-7rem)] shrink-0 flex-col rounded-lg border md:flex
   "
-  style="width: {resize.width}px"
+  style="width: {resize.width}px; min-width: {resize.minWidth}px"
   aria-label={m.storage_connect_saved()}
 >
   <div class="border-base-300 border-b px-3 py-2">
@@ -229,39 +264,63 @@
   </div>
 
   <ul class="flex-1 overflow-y-auto py-1" role="list" aria-label={m.storage_connect_saved()}>
-    {#if !connectionsLoaded}
-      <li class="flex justify-center px-3 py-4">
-        <span class="loading loading-spinner loading-sm text-base-content/40"></span>
-      </li>
-    {:else if allConnections.length === 0}
+    {#if connections.length === 0}
       <li class="text-base-content/40 px-3 py-4 text-center text-xs">
         {m.storage_connect_no_saved()}
       </li>
     {:else}
-      {#each allConnections as conn (conn.id)}
+      {#each connections as conn (conn.id)}
         <li class="group relative">
           <div class="relative z-150 w-full">
-            <button
-              type="button"
-              onclick={() => onselect(conn)}
-              class="
-              hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
-                pr-7 text-sm
-              {activeId === conn.id
-                ? 'bg-primary/10 text-primary font-medium'
-                : 'text-base-content'}
-            "
-              onmouseenter={(e) => showTooltip(e, connectionLabel(conn))}
-              onmouseleave={hideTooltip}
-              onfocus={(e) => showTooltip(e, connectionLabel(conn))}
-              onblur={hideTooltip}
-            >
-              <IconStorage
-                class="text-primary size-3.5 shrink-0 {activeId === conn.id ? '' : 'opacity-60'}"
-                aria-hidden="true"
-              />
-              <span class="truncate">{connectionLabel(conn)}</span>
-            </button>
+            {#if onselect}
+              <button
+                type="button"
+                onclick={() => onselect(conn)}
+                class="
+                  hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                  pr-7 text-sm
+                  {activeId === conn.id
+                  ? 'bg-primary/10 text-primary font-medium'
+                  : 'text-base-content'}
+                "
+                onmouseenter={(e) => showTooltip(e, connectionLabel(conn))}
+                onmouseleave={hideTooltip}
+                onfocus={(e) => showTooltip(e, connectionLabel(conn))}
+                onblur={hideTooltip}
+              >
+                <IconStorage
+                  class="text-primary size-3.5 shrink-0 {activeId === conn.id ? '' : 'opacity-60'}"
+                  aria-hidden="true"
+                />
+                <span class="truncate">{connectionLabel(conn)}</span>
+              </button>
+            {:else}
+              <form method="POST" action="?/use">
+                <input type="hidden" name="connectionId" value={conn.id} />
+                <button
+                  type="submit"
+                  class="
+                    hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                    pr-7 text-sm
+                    {activeId === conn.id
+                    ? 'bg-primary/10 text-primary font-medium'
+                    : 'text-base-content'}
+                  "
+                  onmouseenter={(e) => showTooltip(e, connectionLabel(conn))}
+                  onmouseleave={hideTooltip}
+                  onfocus={(e) => showTooltip(e, connectionLabel(conn))}
+                  onblur={hideTooltip}
+                >
+                  <IconStorage
+                    class="text-primary size-3.5 shrink-0 {activeId === conn.id
+                      ? ''
+                      : 'opacity-60'}"
+                    aria-hidden="true"
+                  />
+                  <span class="truncate">{connectionLabel(conn)}</span>
+                </button>
+              </form>
+            {/if}
           </div>
 
           <button
@@ -294,12 +353,4 @@
   <ResizeHandle panel={resize} />
 </aside>
 
-<!-- Delete confirmation modal -->
-<DeleteConnectionModal
-  bind:open={forgetOpen}
-  connection={forgetCandidate}
-  onconfirm={forgetConnection}
-  oncancel={() => (forgetOpen = false)}
-/>
-
 <Tooltip text={tooltipText} x={tooltipX} y={tooltipY} orientation="right" />
diff --git a/src/lib/server/auth-schema.ts b/src/lib/server/auth-schema.ts
new file mode 100644
index 00000000..03855c16
--- /dev/null
+++ b/src/lib/server/auth-schema.ts
@@ -0,0 +1,95 @@
+import { relations } from 'drizzle-orm';
+import { pgTable, text, timestamp, boolean, index } from 'drizzle-orm/pg-core';
+
+export const user = pgTable('user', {
+  id: text('id').primaryKey(),
+  name: text('name').notNull(),
+  email: text('email').notNull().unique(),
+  emailVerified: boolean('email_verified').default(false).notNull(),
+  image: text('image'),
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  updatedAt: timestamp('updated_at')
+    .defaultNow()
+    .$onUpdate(() => /* @__PURE__ */ new Date())
+    .notNull(),
+  username: text('username')
+});
+
+export const session = pgTable(
+  'session',
+  {
+    id: text('id').primaryKey(),
+    expiresAt: timestamp('expires_at').notNull(),
+    token: text('token').notNull().unique(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    ipAddress: text('ip_address'),
+    userAgent: text('user_agent'),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    activeStorageConnectionId: text('active_storage_connection_id')
+  },
+  (table) => [index('session_userId_idx').on(table.userId)]
+);
+
+export const account = pgTable(
+  'account',
+  {
+    id: text('id').primaryKey(),
+    accountId: text('account_id').notNull(),
+    providerId: text('provider_id').notNull(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+    accessToken: text('access_token'),
+    refreshToken: text('refresh_token'),
+    idToken: text('id_token'),
+    accessTokenExpiresAt: timestamp('access_token_expires_at'),
+    refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),
+    scope: text('scope'),
+    password: text('password'),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull()
+  },
+  (table) => [index('account_userId_idx').on(table.userId)]
+);
+
+export const verification = pgTable(
+  'verification',
+  {
+    id: text('id').primaryKey(),
+    identifier: text('identifier').notNull(),
+    value: text('value').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    updatedAt: timestamp('updated_at')
+      .defaultNow()
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull()
+  },
+  (table) => [index('verification_identifier_idx').on(table.identifier)]
+);
+
+export const userRelations = relations(user, ({ many }) => ({
+  sessions: many(session),
+  accounts: many(account)
+}));
+
+export const sessionRelations = relations(session, ({ one }) => ({
+  user: one(user, {
+    fields: [session.userId],
+    references: [user.id]
+  })
+}));
+
+export const accountRelations = relations(account, ({ one }) => ({
+  user: one(user, {
+    fields: [account.userId],
+    references: [user.id]
+  })
+}));
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index ce918e7b..d2df1322 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -1,7 +1,10 @@
 import { betterAuth } from 'better-auth';
+import { drizzleAdapter } from '@better-auth/drizzle-adapter';
 import { genericOAuth, openAPI } from 'better-auth/plugins';
 import { sveltekitCookies } from 'better-auth/svelte-kit';
 import type { RequestEvent } from '@sveltejs/kit';
+import { db } from './db.js';
+import * as schema from './auth-schema.js';
 
 // Dynamic imports with fallbacks for non-SvelteKit contexts.
 const envModule = await import('$env/dynamic/private').catch(() => null);
@@ -22,8 +25,22 @@ export const oidcEnabled = !!(
 export const auth = betterAuth({
   secret: env.STACKABLE_COCKPIT_SESSION_SECRET,
   baseURL: env.STACKABLE_COCKPIT_BASE_URL,
+  database: drizzleAdapter(db, { provider: 'pg', schema }),
+  account: {
+    accountLinking: {
+      enabled: true,
+      trustedProviders: ['oidc']
+    }
+  },
   session: {
-    cookieCache: { enabled: true, maxAge: 5 * 60 }
+    cookieCache: { enabled: true, maxAge: 5 * 60 },
+    additionalFields: {
+      activeStorageConnectionId: {
+        type: 'string',
+        required: false,
+        defaultValue: null
+      }
+    }
   },
   user: {
     additionalFields: {
@@ -54,6 +71,7 @@ export const auth = betterAuth({
                   return {
                     name: profile.name || fullName || profile.preferred_username || profile.email,
                     email: profile.email || profile.preferred_username,
+                    emailVerified: profile.email_verified ?? true,
                     image: profile.picture || null,
                     username: profile[usernameClaim] || profile.preferred_username || profile.email
                   };
diff --git a/src/lib/server/db.ts b/src/lib/server/db.ts
index 8c47d75b..3b056e21 100644
--- a/src/lib/server/db.ts
+++ b/src/lib/server/db.ts
@@ -9,11 +9,10 @@ const dbHost = process.env.DATABASE_HOST || 'localhost';
 const dbPort = parseInt(process.env.DATABASE_PORT || '31432', 10);
 const dbName = process.env.DATABASE_NAME || 'cockpit';
 const dbUser = process.env.DATABASE_USER || 'cockpit';
-const dbPassword = process.env.DATABASE_PASSWORD || 'cockpit-dev-password';
-
-if (!dbPassword) {
-  log.warn('DATABASE_PASSWORD not set, connection may fail');
+if (!process.env.DATABASE_PASSWORD) {
+  log.warn('DATABASE_PASSWORD not set, using default development password');
 }
+const dbPassword = process.env.DATABASE_PASSWORD || 'cockpit-dev-password';
 
 // SSL is disabled in development (local k8s), enabled in production
 const isDev = process.env.NODE_ENV !== 'production';
diff --git a/src/lib/server/migrations/0001_add_unique_connection_name.sql b/src/lib/server/migrations/0001_add_unique_connection_name.sql
new file mode 100644
index 00000000..f85c97bf
--- /dev/null
+++ b/src/lib/server/migrations/0001_add_unique_connection_name.sql
@@ -0,0 +1 @@
+ALTER TABLE "user_storage_connections" ADD CONSTRAINT "user_storage_connections_user_id_name_unique" UNIQUE("user_id","name");
diff --git a/src/lib/server/migrations/0001_keen_prodigy.sql b/src/lib/server/migrations/0001_keen_prodigy.sql
new file mode 100644
index 00000000..f85c97bf
--- /dev/null
+++ b/src/lib/server/migrations/0001_keen_prodigy.sql
@@ -0,0 +1 @@
+ALTER TABLE "user_storage_connections" ADD CONSTRAINT "user_storage_connections_user_id_name_unique" UNIQUE("user_id","name");
diff --git a/src/lib/server/migrations/0002_dashing_nuke.sql b/src/lib/server/migrations/0002_dashing_nuke.sql
new file mode 100644
index 00000000..68fb0651
--- /dev/null
+++ b/src/lib/server/migrations/0002_dashing_nuke.sql
@@ -0,0 +1,55 @@
+CREATE TABLE "account" (
+	"id" text PRIMARY KEY NOT NULL,
+	"account_id" text NOT NULL,
+	"provider_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	"access_token" text,
+	"refresh_token" text,
+	"id_token" text,
+	"access_token_expires_at" timestamp,
+	"refresh_token_expires_at" timestamp,
+	"scope" text,
+	"password" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "session" (
+	"id" text PRIMARY KEY NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"token" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL,
+	"ip_address" text,
+	"user_agent" text,
+	"user_id" text NOT NULL,
+	"active_storage_connection_id" text,
+	CONSTRAINT "session_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "user" (
+	"id" text PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"email" text NOT NULL,
+	"email_verified" boolean DEFAULT false NOT NULL,
+	"image" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	"username" text,
+	CONSTRAINT "user_email_unique" UNIQUE("email")
+);
+--> statement-breakpoint
+CREATE TABLE "verification" (
+	"id" text PRIMARY KEY NOT NULL,
+	"identifier" text NOT NULL,
+	"value" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "account" ADD CONSTRAINT "account_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session" ADD CONSTRAINT "session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "account_userId_idx" ON "account" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "session_userId_idx" ON "session" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "verification_identifier_idx" ON "verification" USING btree ("identifier");
diff --git a/src/lib/server/migrations/meta/0001_snapshot.json b/src/lib/server/migrations/meta/0001_snapshot.json
new file mode 100644
index 00000000..11c82878
--- /dev/null
+++ b/src/lib/server/migrations/meta/0001_snapshot.json
@@ -0,0 +1,106 @@
+{
+  "id": "1b23e196-397b-4589-94f8-7fab70a5fbec",
+  "prevId": "37569bc7-4e3e-4cc3-b3db-daa37dc0cd52",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.user_storage_connections": {
+      "name": "user_storage_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_payload": {
+          "name": "encrypted_payload",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "additional_buckets": {
+          "name": "additional_buckets",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_id_idx": {
+          "name": "user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_storage_connections_user_id_name_unique": {
+          "name": "user_storage_connections_user_id_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/src/lib/server/migrations/meta/0002_snapshot.json b/src/lib/server/migrations/meta/0002_snapshot.json
new file mode 100644
index 00000000..a781b2e9
--- /dev/null
+++ b/src/lib/server/migrations/meta/0002_snapshot.json
@@ -0,0 +1,461 @@
+{
+  "id": "2f3922cc-46f7-4854-8365-19ebbcb11aec",
+  "prevId": "1b23e196-397b-4589-94f8-7fab70a5fbec",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.user_storage_connections": {
+      "name": "user_storage_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "encrypted_payload": {
+          "name": "encrypted_payload",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hash": {
+          "name": "hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "additional_buckets": {
+          "name": "additional_buckets",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_id_idx": {
+          "name": "user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_storage_connections_user_id_name_unique": {
+          "name": "user_storage_connections_user_id_name_unique",
+          "nullsNotDistinct": false,
+          "columns": ["user_id", "name"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "account_userId_idx": {
+          "name": "account_userId_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "active_storage_connection_id": {
+          "name": "active_storage_connection_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "session_userId_idx": {
+          "name": "session_userId_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": ["user_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "session_token_unique": {
+          "name": "session_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "username": {
+          "name": "username",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_email_unique": {
+          "name": "user_email_unique",
+          "nullsNotDistinct": false,
+          "columns": ["email"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "verification_identifier_idx": {
+          "name": "verification_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
diff --git a/src/lib/server/migrations/meta/_journal.json b/src/lib/server/migrations/meta/_journal.json
index 735d0f90..8ed6ef7f 100644
--- a/src/lib/server/migrations/meta/_journal.json
+++ b/src/lib/server/migrations/meta/_journal.json
@@ -8,6 +8,20 @@
       "when": 1781095861625,
       "tag": "0000_calm_jimmy_woo",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1782383259361,
+      "tag": "0001_keen_prodigy",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1782383681028,
+      "tag": "0002_dashing_nuke",
+      "breakpoints": true
     }
   ]
 }
diff --git a/src/lib/server/schema.ts b/src/lib/server/schema.ts
index 324f3169..b27777d5 100644
--- a/src/lib/server/schema.ts
+++ b/src/lib/server/schema.ts
@@ -1,4 +1,4 @@
-import { pgTable, text, timestamp, uuid, jsonb, index } from 'drizzle-orm/pg-core';
+import { pgTable, text, timestamp, uuid, jsonb, index, unique } from 'drizzle-orm/pg-core';
 
 /**
  * User storage connections table.
@@ -20,5 +20,8 @@ export const userStorageConnections = pgTable(
     createdAt: timestamp('created_at', { mode: 'date' }).defaultNow().notNull(),
     updatedAt: timestamp('updated_at', { mode: 'date' }).defaultNow().notNull()
   },
-  (table) => [index('user_id_idx').on(table.userId)]
+  (table) => [
+    index('user_id_idx').on(table.userId),
+    unique('user_storage_connections_user_id_name_unique').on(table.userId, table.name)
+  ]
 );
diff --git a/src/lib/server/storage/connection.ts b/src/lib/server/storage/connection.ts
index 772bfba2..beabe993 100644
--- a/src/lib/server/storage/connection.ts
+++ b/src/lib/server/storage/connection.ts
@@ -1,58 +1,87 @@
 import { error } from '@sveltejs/kit';
-import { StorageConnectionSchema } from '$lib/storage/schemas.js';
-import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+import { eq, and } from 'drizzle-orm';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import { decrypt } from './encryption.js';
+import { storageEncryptionKey } from './encryption-key.js';
 import type { S3ConnectionConfig } from './types.js';
 import { logger } from '$lib/server/logging';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 
 const log = logger.child({ module: 'storage-connection' });
 
+/** The shape of the JSON stored inside encrypted_payload. */
+interface StoredPayload {
+  host: string;
+  port?: number;
+  tls?: { verification: 'Full' | 'None' };
+  accessStyle: 'Path' | 'VirtualHosted';
+  region: { name: string };
+  credentials?: { accessKey: string; secretKey: string };
+}
+
 /**
- * Parse and validate a base64-encoded JSON connection payload from a request header value.
- * Throws a 400 HTTP error if the payload is malformed or fails schema validation.
- * Throws a 400 HTTP error if the connection type is not 's3'.
+ * Look up a storage connection by UUID and authenticated user ID, decrypt the
+ * payload, and return the {@link S3ConnectionConfig}.
+ *
+ * Also updates `updated_at` on the connection row (fire-and-forget) so that
+ * auto-connect picks the most-recently-used connection on the next page load.
+ *
+ * Returns `null` if the header is absent.
+ * Throws 401 if the connection is not found or does not belong to the user.
+ * Throws 500 if decryption fails.
  */
-function parseConnectionPayload(raw: string): S3ConnectionConfig {
-  let data: unknown;
-  try {
-    data = JSON.parse(atob(raw));
-  } catch {
-    throw error(400, 'Invalid storage connection header');
-  }
+export async function getConnectionFromHeader(
+  request: Request,
+  userId: string
+): Promise<S3ConnectionConfig | null> {
+  const connectionId = request.headers.get(STORAGE_CONNECTION_ID_HEADER);
+  if (!connectionId) return null;
 
-  const parsed = StorageConnectionSchema.safeParse(data);
-  if (!parsed.success) {
-    log.debug({ issues: parsed.error.issues }, 'storage connection header validation failed');
-    throw error(400, 'Invalid storage connection configuration');
+  const rows = await db
+    .select()
+    .from(userStorageConnections)
+    .where(
+      and(eq(userStorageConnections.id, connectionId), eq(userStorageConnections.userId, userId))
+    )
+    .limit(1);
+
+  if (rows.length === 0) {
+    log.warn({ connection_id: connectionId }, 'storage connection not found or unauthorised');
+    throw error(401, 'Storage connection not found');
   }
 
-  if (parsed.data.type !== 's3') {
-    throw error(400, 'Storage backend not supported');
+  const row = rows[0];
+
+  let payload: StoredPayload;
+  try {
+    payload = JSON.parse(decrypt(row.encryptedPayload, storageEncryptionKey())) as StoredPayload;
+  } catch (err) {
+    log.error({ err, connection_id: connectionId }, 'failed to decrypt storage connection payload');
+    throw error(500, 'Failed to decrypt storage connection');
   }
 
-  const { host, port, tls, accessStyle, region, credentials } = parsed.data;
+  // Update updated_at asynchronously — do not block the request on this.
+  db.update(userStorageConnections)
+    .set({ updatedAt: new Date() })
+    .where(eq(userStorageConnections.id, connectionId))
+    .catch((err) =>
+      log.warn({ err, connection_id: connectionId }, 'failed to update connection updated_at')
+    );
+
   const resolvedCredentials =
-    credentials.accessKey && credentials.secretKey ? credentials : undefined;
+    payload.credentials?.accessKey && payload.credentials?.secretKey
+      ? payload.credentials
+      : undefined;
 
   return {
     type: 's3',
-    host,
-    port,
-    tls,
-    accessStyle,
-    region,
-    credentials: resolvedCredentials
+    host: payload.host,
+    port: payload.port,
+    tls: payload.tls,
+    accessStyle: payload.accessStyle,
+    region: payload.region,
+    credentials: resolvedCredentials,
+    additionalBuckets: (row.additionalBuckets as string[]) ?? []
   };
 }
-
-/**
- * Extract the storage connection config from the `X-Storage-Connection` request header.
- * Returns `null` if the header is absent. Throws 400 on malformed or invalid payloads.
- *
- * Used by the `handleStorageConnection` middleware in `hooks.server.ts` to populate
- * `event.locals.storageConfig` before any storage API handler runs.
- */
-export function getConnectionFromHeader(request: Request): S3ConnectionConfig | null {
-  const header = request.headers.get(STORAGE_CONNECTION_HEADER);
-  if (!header) return null;
-  return parseConnectionPayload(header);
-}
diff --git a/src/lib/server/storage/connections-db.ts b/src/lib/server/storage/connections-db.ts
new file mode 100644
index 00000000..80b0b8a4
--- /dev/null
+++ b/src/lib/server/storage/connections-db.ts
@@ -0,0 +1,136 @@
+import { eq, and } from 'drizzle-orm';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import { encrypt, decrypt, fingerprint } from './encryption.js';
+import { storageEncryptionKey } from './encryption-key.js';
+import { logger } from '$lib/server/logging';
+import type { S3ConnectionConfig } from './types.js';
+
+const log = logger.child({ module: 'connections-db' });
+
+/** Stored payload shape inside encrypted_payload. */
+interface StoredPayload {
+  host: string;
+  port?: number;
+  tls?: { verification: 'Full' | 'None' };
+  accessStyle: 'Path' | 'VirtualHosted';
+  region: { name: string };
+  credentials?: { accessKey: string; secretKey: string };
+}
+
+/**
+ * Save an S3 connection for a user. If a connection with identical credentials
+ * already exists (same fingerprint), return its existing ID without inserting.
+ * The connection name is auto-generated from the hostname.
+ * Returns the connection ID.
+ */
+export async function saveConnection(userId: string, config: S3ConnectionConfig): Promise<string> {
+  const key = storageEncryptionKey();
+
+  const fp = fingerprint(
+    {
+      endpoint: config.host,
+      region: config.region.name,
+      accessKeyId: config.credentials?.accessKey || '',
+      secretAccessKey: config.credentials?.secretKey || ''
+    },
+    key
+  );
+
+  // Reuse existing connection if credentials are identical.
+  const existing = await db
+    .select({ id: userStorageConnections.id })
+    .from(userStorageConnections)
+    .where(and(eq(userStorageConnections.userId, userId), eq(userStorageConnections.hash, fp)))
+    .limit(1);
+
+  if (existing.length > 0) {
+    log.debug({ connection_id: existing[0].id }, 'reusing existing storage connection');
+    return existing[0].id;
+  }
+
+  const payload: StoredPayload = {
+    host: config.host,
+    port: config.port,
+    tls: config.tls,
+    accessStyle: config.accessStyle,
+    region: config.region,
+    credentials: config.credentials
+  };
+  const encryptedPayload = encrypt(JSON.stringify(payload), key);
+
+  // Auto-generate name from hostname.
+  let baseName = config.host;
+  if (!baseName) baseName = 'S3';
+
+  // Insert, appending a numeric suffix on name collisions.
+  let name = baseName;
+  for (let suffix = 2; suffix <= 99; suffix++) {
+    try {
+      const [inserted] = await db
+        .insert(userStorageConnections)
+        .values({ userId, name, encryptedPayload, hash: fp, additionalBuckets: [] })
+        .returning({ id: userStorageConnections.id });
+      log.info({ connection_id: inserted.id }, 'storage connection saved');
+      return inserted.id;
+    } catch (err: unknown) {
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes('user_storage_connections_user_id_name_unique')) {
+        name = `${baseName} ${suffix}`;
+        continue;
+      }
+      throw err;
+    }
+  }
+
+  throw new Error('Could not generate a unique connection name');
+}
+
+/**
+ * Retrieve and decrypt the S3 config for a specific connection belonging to a user.
+ * Returns null if the connection does not exist or does not belong to the user.
+ */
+export async function getConnectionForUser(
+  userId: string,
+  connectionId: string
+): Promise<S3ConnectionConfig | null> {
+  const rows = await db
+    .select()
+    .from(userStorageConnections)
+    .where(
+      and(eq(userStorageConnections.id, connectionId), eq(userStorageConnections.userId, userId))
+    )
+    .limit(1);
+
+  if (rows.length === 0) return null;
+
+  try {
+    const payload = JSON.parse(
+      decrypt(rows[0].encryptedPayload, storageEncryptionKey())
+    ) as StoredPayload;
+    return {
+      type: 's3',
+      host: payload.host,
+      port: payload.port,
+      tls: payload.tls,
+      accessStyle: payload.accessStyle,
+      region: payload.region,
+      credentials: payload.credentials?.accessKey ? payload.credentials : undefined
+    };
+  } catch (err) {
+    log.error({ err, connection_id: connectionId }, 'failed to decrypt storage connection');
+    return null;
+  }
+}
+
+/**
+ * Delete a storage connection belonging to a user.
+ */
+export async function deleteConnection(userId: string, connectionId: string): Promise<void> {
+  await db
+    .delete(userStorageConnections)
+    .where(
+      and(eq(userStorageConnections.id, connectionId), eq(userStorageConnections.userId, userId))
+    );
+  log.info({ connection_id: connectionId }, 'storage connection deleted');
+}
diff --git a/src/lib/server/storage/encryption-key.ts b/src/lib/server/storage/encryption-key.ts
new file mode 100644
index 00000000..480a46b7
--- /dev/null
+++ b/src/lib/server/storage/encryption-key.ts
@@ -0,0 +1,37 @@
+import { env } from '$env/dynamic/private';
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'storage-encryption-key' });
+
+let _key: Buffer | undefined;
+
+/**
+ * Returns the AES-256-GCM encryption key for storage connection credentials.
+ * Validated and cached on first call; throws a clear error if the env var is
+ * missing or invalid.  Exported as a function (not a module-level constant) so
+ * that the Vite SSR module runner can import this file without throwing during
+ * test runs where the env var is not set.
+ */
+export function storageEncryptionKey(): Buffer {
+  if (_key) return _key;
+
+  const raw = env.STORAGE_ENCRYPTION_KEY;
+
+  if (!raw) {
+    log.error('STORAGE_ENCRYPTION_KEY environment variable is not set');
+    throw new Error(
+      'STORAGE_ENCRYPTION_KEY is required. Set it to a 64-character hex string (32 bytes).'
+    );
+  }
+
+  if (raw.length !== 64 || !/^[0-9a-fA-F]+$/.test(raw)) {
+    log.error('STORAGE_ENCRYPTION_KEY is not a valid 64-character hex string');
+    throw new Error(
+      'STORAGE_ENCRYPTION_KEY must be a 64-character hex string (32 bytes). ' +
+        "Generate one with: node -e \"console.log(require('crypto').randomBytes(32).toString('hex'))\""
+    );
+  }
+
+  _key = Buffer.from(raw, 'hex');
+  return _key;
+}
diff --git a/src/lib/server/storage/encryption.test.ts b/src/lib/server/storage/encryption.test.ts
new file mode 100644
index 00000000..b9db3d5b
--- /dev/null
+++ b/src/lib/server/storage/encryption.test.ts
@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest';
+import { encrypt, decrypt, fingerprint } from './encryption.js';
+
+const TEST_KEY = Buffer.from('a'.repeat(64), 'hex'); // 32 bytes of 0xaa
+
+describe('encrypt / decrypt', () => {
+  it('round-trips a plaintext string', () => {
+    const plaintext = 'hello, world!';
+    const ciphertext = encrypt(plaintext, TEST_KEY);
+    expect(decrypt(ciphertext, TEST_KEY)).toBe(plaintext);
+  });
+
+  it('round-trips an empty string', () => {
+    const ciphertext = encrypt('', TEST_KEY);
+    expect(decrypt(ciphertext, TEST_KEY)).toBe('');
+  });
+
+  it('round-trips a JSON payload', () => {
+    const payload = JSON.stringify({
+      endpoint: 'https://minio.example.com:9000',
+      region: 'eu-central-1',
+      accessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+      secretAccessKey: 'wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'
+    });
+    const ciphertext = encrypt(payload, TEST_KEY);
+    expect(decrypt(ciphertext, TEST_KEY)).toBe(payload);
+  });
+
+  it('produces different ciphertexts for the same plaintext (random IV)', () => {
+    const plaintext = 'same input';
+    const c1 = encrypt(plaintext, TEST_KEY);
+    const c2 = encrypt(plaintext, TEST_KEY);
+    expect(c1).not.toBe(c2);
+    // Both must decrypt to the same plaintext.
+    expect(decrypt(c1, TEST_KEY)).toBe(plaintext);
+    expect(decrypt(c2, TEST_KEY)).toBe(plaintext);
+  });
+
+  it('throws when the ciphertext is tampered with', () => {
+    const ciphertext = encrypt('secret', TEST_KEY);
+    // Flip a byte in the middle of the ciphertext.
+    const buf = Buffer.from(ciphertext, 'hex');
+    buf[16] ^= 0xff;
+    const tampered = buf.toString('hex');
+    expect(() => decrypt(tampered, TEST_KEY)).toThrow();
+  });
+
+  it('throws when the wrong key is used', () => {
+    const wrongKey = Buffer.alloc(32, 0x00);
+    const ciphertext = encrypt('secret', TEST_KEY);
+    expect(() => decrypt(ciphertext, wrongKey)).toThrow();
+  });
+});
+
+describe('fingerprint', () => {
+  it('returns a 64-char hex string', () => {
+    const fp = fingerprint(
+      {
+        endpoint: 'https://s3.example.com',
+        region: 'us-east-1',
+        accessKeyId: 'key',
+        secretAccessKey: 'secret'
+      },
+      TEST_KEY
+    );
+    expect(fp).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('is deterministic for the same input', () => {
+    const creds = {
+      endpoint: 'https://s3.example.com',
+      region: 'us-east-1',
+      accessKeyId: 'key',
+      secretAccessKey: 'secret'
+    };
+    expect(fingerprint(creds, TEST_KEY)).toBe(fingerprint(creds, TEST_KEY));
+  });
+
+  it('differs when endpoint changes', () => {
+    const base = { region: 'us-east-1', accessKeyId: 'key', secretAccessKey: 'secret' };
+    const fp1 = fingerprint({ ...base, endpoint: 'https://s3.example.com' }, TEST_KEY);
+    const fp2 = fingerprint({ ...base, endpoint: 'https://other.example.com' }, TEST_KEY);
+    expect(fp1).not.toBe(fp2);
+  });
+
+  it('differs when access key changes', () => {
+    const base = {
+      endpoint: 'https://s3.example.com',
+      region: 'us-east-1',
+      secretAccessKey: 'secret'
+    };
+    const fp1 = fingerprint({ ...base, accessKeyId: 'key1' }, TEST_KEY);
+    const fp2 = fingerprint({ ...base, accessKeyId: 'key2' }, TEST_KEY);
+    expect(fp1).not.toBe(fp2);
+  });
+
+  it('differs when the HMAC key changes', () => {
+    const creds = {
+      endpoint: '',
+      region: 'us-east-1',
+      accessKeyId: 'key',
+      secretAccessKey: 'secret'
+    };
+    const otherKey = Buffer.alloc(32, 0x55);
+    expect(fingerprint(creds, TEST_KEY)).not.toBe(fingerprint(creds, otherKey));
+  });
+});
diff --git a/src/lib/server/storage/encryption.ts b/src/lib/server/storage/encryption.ts
new file mode 100644
index 00000000..41ba8173
--- /dev/null
+++ b/src/lib/server/storage/encryption.ts
@@ -0,0 +1,84 @@
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, hkdfSync } from 'node:crypto';
+
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // 96-bit IV recommended for GCM
+const AUTH_TAG_LENGTH = 16; // 128-bit authentication tag
+
+// HKDF parameters for deriving a dedicated HMAC subkey.
+// A fixed zero salt is acceptable here because the master key already has
+// sufficient entropy. The info label binds the subkey to its specific purpose,
+// ensuring AES and HMAC never share key material.
+const HMAC_SUBKEY_SALT = Buffer.alloc(32);
+const HMAC_SUBKEY_INFO = Buffer.from('storage-connection-fingerprint-v1');
+
+/** Derive a dedicated 32-byte HMAC subkey from the master key using HKDF-SHA256. */
+function deriveHmacSubkey(masterKey: Buffer): Buffer {
+  return Buffer.from(hkdfSync('sha256', masterKey, HMAC_SUBKEY_SALT, HMAC_SUBKEY_INFO, 32));
+}
+
+/**
+ * Encrypt a plaintext string using AES-256-GCM.
+ *
+ * A random 12-byte IV is generated for each call. The output is the
+ * hex-encoded concatenation of: IV (12 bytes) | ciphertext | auth tag (16 bytes).
+ *
+ * @param plaintext - The string to encrypt.
+ * @param key - A 32-byte Buffer (256-bit key).
+ * @returns Hex-encoded string: iv + ciphertext + authTag.
+ */
+export function encrypt(plaintext: string, key: Buffer): string {
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const authTag = cipher.getAuthTag();
+  return Buffer.concat([iv, encrypted, authTag]).toString('hex');
+}
+
+/**
+ * Decrypt a hex-encoded AES-256-GCM ciphertext produced by {@link encrypt}.
+ *
+ * @param ciphertext - Hex-encoded string: iv + ciphertext + authTag.
+ * @param key - The same 32-byte Buffer used during encryption.
+ * @returns The original plaintext string.
+ * @throws Error if the authentication tag verification fails (tampered data).
+ */
+export function decrypt(ciphertext: string, key: Buffer): string {
+  const buf = Buffer.from(ciphertext, 'hex');
+  const iv = buf.subarray(0, IV_LENGTH);
+  const authTag = buf.subarray(buf.length - AUTH_TAG_LENGTH);
+  const encrypted = buf.subarray(IV_LENGTH, buf.length - AUTH_TAG_LENGTH);
+
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString('utf8');
+}
+
+/**
+ * Compute an HMAC-SHA256 fingerprint of the connection credentials.
+ * Used to detect duplicate connections before inserting a new row.
+ *
+ * A dedicated HMAC subkey is derived from the master key via HKDF so that
+ * the same key material is never used for both AES-256-GCM and HMAC-SHA256.
+ *
+ * @param credentials - The connection fields to fingerprint.
+ * @param key - The 32-byte master key (same key passed to encrypt/decrypt).
+ * @returns Hex-encoded HMAC-SHA256 digest.
+ */
+export function fingerprint(
+  credentials: {
+    endpoint: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+  },
+  key: Buffer
+): string {
+  const hmacKey = deriveHmacSubkey(key);
+  const material = [
+    credentials.endpoint,
+    credentials.region,
+    credentials.accessKeyId,
+    credentials.secretAccessKey
+  ].join('|');
+  return createHmac('sha256', hmacKey).update(material, 'utf8').digest('hex');
+}
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index e136b5ea..3cb18b05 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -27,7 +27,7 @@ async function withS3Errors<T>(
   try {
     return await fn();
   } catch (err) {
-    mapS3ErrorToHttp(err, context);
+    return mapS3ErrorToHttp(err, context);
   }
 }
 
@@ -222,35 +222,35 @@ export class S3StorageProvider implements StorageProvider {
       return { failed: [] };
     }
 
-    return withS3Errors(
-      async () => {
-        // Expand directory prefixes to their contained keys
-        const resolvedKeys: string[] = [];
-        for (const key of keys) {
-          if (key.endsWith('/')) {
-            const children = await this.listAllKeys(key);
-            if (children.length > 0) {
-              resolvedKeys.push(...children);
-            } else {
-              resolvedKeys.push(key);
-            }
-          } else {
-            resolvedKeys.push(key);
-          }
+    // Expand directory prefixes to their contained keys
+    const resolvedKeys: string[] = [];
+    for (const key of keys) {
+      if (key.endsWith('/')) {
+        const children = await this.listAllKeys(key);
+        if (children.length > 0) {
+          resolvedKeys.push(...children);
+        } else {
+          resolvedKeys.push(key);
         }
+      } else {
+        resolvedKeys.push(key);
+      }
+    }
 
-        // S3 DeleteObjects has a limit of 1000 keys per request.
-        // MinIO/Ionos return MalformedXML when exceeding this limit.
-        const MAX_KEYS = 1000;
-        const allFailed: Array<{ key: string; code?: string; message?: string }> = [];
+    // S3 DeleteObjects has a limit of 1000 keys per request.
+    // MinIO/Ionos return MalformedXML when exceeding this limit.
+    const MAX_KEYS = 1000;
+    const allFailed: Array<{ key: string; code?: string; message?: string }> = [];
 
-        for (let i = 0; i < resolvedKeys.length; i += MAX_KEYS) {
-          const chunk = resolvedKeys.slice(i, i + MAX_KEYS);
-          log.trace(
-            { bucket: this.bucket, chunk_offset: i, chunk_size: chunk.length },
-            'S3 DeleteObjects chunk'
-          );
-          const output = await this.client.send(
+    for (let i = 0; i < resolvedKeys.length; i += MAX_KEYS) {
+      const chunk = resolvedKeys.slice(i, i + MAX_KEYS);
+      log.trace(
+        { bucket: this.bucket, chunk_offset: i, chunk_size: chunk.length },
+        'S3 DeleteObjects chunk'
+      );
+      const output = await withS3Errors(
+        () =>
+          this.client.send(
             new DeleteObjectsCommand({
               Bucket: this.bucket,
               Delete: {
@@ -258,25 +258,24 @@ export class S3StorageProvider implements StorageProvider {
                 Quiet: true
               }
             })
-          );
-          const failed = (output.Errors ?? []).map((e) => ({
-            key: e.Key ?? '',
-            code: e.Code,
-            message: e.Message
-          }));
-          allFailed.push(...failed);
-        }
+          ),
+        { bucket: this.bucket, operation: 'deleteObjects' }
+      );
+      const failed = (output.Errors ?? []).map((e) => ({
+        key: e.Key ?? '',
+        code: e.Code,
+        message: e.Message
+      }));
+      allFailed.push(...failed);
+    }
 
-        if (allFailed.length > 0) {
-          log.warn(
-            { bucket: this.bucket, failed_count: allFailed.length },
-            'some objects failed to delete'
-          );
-        }
-        return { failed: allFailed };
-      },
-      { bucket: this.bucket, operation: 'deleteObjects' }
-    );
+    if (allFailed.length > 0) {
+      log.warn(
+        { bucket: this.bucket, failed_count: allFailed.length },
+        'some objects failed to delete'
+      );
+    }
+    return { failed: allFailed };
   }
 
   async listAllKeys(prefix: string): Promise<string[]> {
diff --git a/src/lib/server/storage/types.ts b/src/lib/server/storage/types.ts
index fc3f71f9..bf371b64 100644
--- a/src/lib/server/storage/types.ts
+++ b/src/lib/server/storage/types.ts
@@ -7,6 +7,7 @@ export interface S3ConnectionConfig {
   accessStyle: 'Path' | 'VirtualHosted';
   region: { name: string };
   credentials?: { accessKey: string; secretKey: string };
+  additionalBuckets?: string[];
 }
 
 /** Full S3 config for creating a bucket-scoped provider. */
@@ -26,3 +27,10 @@ export type StorageConfig = S3Config | HDFSConfig;
 
 /** Per-user connection config stored in memory (no bucket). */
 export type StorageConnectionConfig = S3ConnectionConfig | HDFSConfig;
+
+/** Minimal connection metadata returned to the client. */
+export interface ConnectionMetadata {
+  id: string;
+  name: string;
+  endpoint: string | null;
+}
diff --git a/src/lib/storage/connection-id-header.ts b/src/lib/storage/connection-id-header.ts
new file mode 100644
index 00000000..c8c76f55
--- /dev/null
+++ b/src/lib/storage/connection-id-header.ts
@@ -0,0 +1,8 @@
+/**
+ * HTTP header name used to pass the S3 connection UUID from the browser to
+ * the backend API endpoints. Client-safe — no server-only code imported here.
+ *
+ * The server middleware looks up the connection by this ID and the
+ * authenticated user ID, then decrypts the stored credentials.
+ */
+export const STORAGE_CONNECTION_ID_HEADER = 'x-storage-connection-id';
diff --git a/src/lib/storage/connection-storage.spec.ts b/src/lib/storage/connection-storage.spec.ts
deleted file mode 100644
index 7d662095..00000000
--- a/src/lib/storage/connection-storage.spec.ts
+++ /dev/null
@@ -1,261 +0,0 @@
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import {
-  saveConnectionLocally,
-  updateConnectionLocally,
-  loadConnectionLocally,
-  loadAllConnectionsLocally,
-  removeConnectionLocally,
-  removeConnectionById,
-  loadConnectionById
-} from '$lib/storage/connection-storage.js';
-import type { StoredConnection, SavedConnection } from '$lib/storage/connection-storage.js';
-
-const STORAGE_KEY = 'stackable_storage_connections';
-
-// localStorage is unavailable in the Node (server) test environment — stub it.
-const store: Record<string, string> = {};
-vi.stubGlobal('localStorage', {
-  getItem: (key: string) => store[key] ?? null,
-  setItem: (key: string, value: string) => {
-    store[key] = value;
-  },
-  removeItem: (key: string) => {
-    delete store[key];
-  },
-  clear: () => {
-    for (const k of Object.keys(store)) delete store[k];
-  }
-});
-
-// crypto.randomUUID is available in Node 15+ — ensure it is present.
-if (!globalThis.crypto) {
-  const { webcrypto } = await import('crypto');
-  vi.stubGlobal('crypto', webcrypto);
-}
-
-function makeConn(
-  overrides: Partial<Omit<SavedConnection, 'id'>> & { id?: string } = {}
-): SavedConnection {
-  return {
-    id: overrides.id ?? crypto.randomUUID(),
-    type: 's3',
-    host: 'minio.example.com',
-    port: 9000,
-    tls: { verification: 'Full' },
-    accessStyle: 'Path',
-    region: { name: 'us-east-1' },
-    credentials: { accessKey: 'AKIA123', secretKey: 'secret' },
-    ...overrides
-  } as SavedConnection;
-}
-
-describe('connection-storage', () => {
-  beforeEach(() => {
-    localStorage.clear();
-  });
-
-  describe('saveConnectionLocally', () => {
-    it('stores a connection and assigns the given id', () => {
-      const conn = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      saveConnectionLocally(conn);
-      const stored = loadAllConnectionsLocally();
-      expect(stored).toHaveLength(1);
-      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
-    });
-
-    it('generates a uuid when id is not set', () => {
-      const conn = makeConn();
-      // Simulate missing id (e.g. from legacy code path) by deleting it
-      const connWithoutId = { ...conn } as Partial<StoredConnection>;
-      delete connWithoutId.id;
-      saveConnectionLocally(connWithoutId as StoredConnection);
-      const stored = loadAllConnectionsLocally();
-      expect(stored[0].id).toBeDefined();
-      expect(stored[0].id).toMatch(
-        /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
-      );
-    });
-
-    it('appends to the end (most recently used)', () => {
-      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
-      saveConnectionLocally(a);
-      saveConnectionLocally(b);
-      const stored = loadAllConnectionsLocally();
-      expect(stored[stored.length - 1].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
-    });
-
-    it('replaces an existing connection with the same id and moves it to end', () => {
-      const conn = makeConn({
-        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
-        region: { name: 'us-east-1' }
-      });
-      saveConnectionLocally(conn);
-      const updated = makeConn({
-        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
-        region: { name: 'eu-west-1' }
-      });
-      saveConnectionLocally(updated);
-      const stored = loadAllConnectionsLocally();
-      expect(stored).toHaveLength(1);
-      expect(stored[0].region.name).toBe('eu-west-1');
-    });
-
-    it('deduplicates by host+port+accessKey when no id is supplied', () => {
-      // First save — assigns a UUID
-      const connWithoutId = {
-        type: 's3' as const,
-        host: 'minio.example.com',
-        port: 9000,
-        tls: { verification: 'Full' as const },
-        accessStyle: 'Path' as const,
-        region: { name: 'us-east-1' },
-        credentials: { accessKey: 'AKIA123', secretKey: 'secret' }
-      };
-      saveConnectionLocally(connWithoutId);
-      const afterFirst = loadAllConnectionsLocally();
-      expect(afterFirst).toHaveLength(1);
-      const assignedId = afterFirst[0].id;
-
-      // Second save with same identity but no id — should reuse the existing entry
-      saveConnectionLocally({ ...connWithoutId, region: { name: 'eu-west-1' } });
-      const afterSecond = loadAllConnectionsLocally();
-      expect(afterSecond).toHaveLength(1);
-      expect(afterSecond[0].id).toBe(assignedId);
-      expect(afterSecond[0].region.name).toBe('eu-west-1');
-    });
-  });
-
-  describe('updateConnectionLocally', () => {
-    it('updates an existing connection in-place by id', () => {
-      const a = makeConn({
-        id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa',
-        region: { name: 'us-east-1' }
-      });
-      const b = makeConn({
-        id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb',
-        region: { name: 'eu-west-1' }
-      });
-      saveConnectionLocally(a);
-      saveConnectionLocally(b);
-
-      updateConnectionLocally('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', {
-        region: { name: 'ap-south-1' }
-      });
-
-      const stored = loadAllConnectionsLocally();
-      expect(stored).toHaveLength(2);
-      // Preserved position (first)
-      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
-      expect(stored[0].region.name).toBe('ap-south-1');
-      // Second connection unchanged
-      expect(stored[1].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
-      expect(stored[1].region.name).toBe('eu-west-1');
-    });
-
-    it('is a no-op when the id does not exist', () => {
-      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      saveConnectionLocally(a);
-
-      updateConnectionLocally('00000000-0000-0000-0000-000000000000', {
-        region: { name: 'us-west-2' }
-      });
-
-      const stored = loadAllConnectionsLocally();
-      expect(stored).toHaveLength(1);
-      expect(stored[0].region.name).toBe(a.region.name);
-    });
-
-    it('preserves the id even when data omits it', () => {
-      const conn = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      saveConnectionLocally(conn);
-      updateConnectionLocally('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa', { name: 'Prod' });
-      const stored = loadAllConnectionsLocally();
-      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
-      expect(stored[0].name).toBe('Prod');
-    });
-  });
-
-  describe('loadConnectionLocally', () => {
-    it('returns null when nothing is stored', () => {
-      expect(loadConnectionLocally()).toBeNull();
-    });
-
-    it('returns the last (most recently used) connection', () => {
-      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
-      saveConnectionLocally(a);
-      saveConnectionLocally(b);
-      const loaded = loadConnectionLocally();
-      expect(loaded?.id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
-    });
-  });
-
-  describe('loadAllConnectionsLocally', () => {
-    it('silently drops entries that fail schema validation (clean break)', () => {
-      // Write raw data including a legacy entry with old schema fields
-      const legacy = {
-        id: 'cccccccc-cccc-4ccc-8ccc-cccccccccccc',
-        type: 's3',
-        endpoint: 'https://old.example.com',
-        pathStyle: true,
-        region: 'eu-central-1',
-        accessKeyId: '',
-        secretAccessKey: ''
-      };
-      const valid = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      localStorage.setItem(STORAGE_KEY, JSON.stringify([legacy, valid]));
-
-      const stored = loadAllConnectionsLocally();
-      expect(stored).toHaveLength(1);
-      expect(stored[0].id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
-    });
-
-    it('returns an empty array when localStorage is empty', () => {
-      expect(loadAllConnectionsLocally()).toEqual([]);
-    });
-  });
-
-  describe('removeConnectionLocally', () => {
-    it('removes a connection matched by id', () => {
-      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
-      saveConnectionLocally(a);
-      saveConnectionLocally(b);
-
-      removeConnectionLocally(a);
-
-      const stored = loadAllConnectionsLocally();
-      expect(stored).toHaveLength(1);
-      expect(stored[0].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
-    });
-  });
-
-  describe('removeConnectionById', () => {
-    it('removes a connection by id string', () => {
-      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      const b = makeConn({ id: 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb' });
-      saveConnectionLocally(a);
-      saveConnectionLocally(b);
-
-      removeConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
-
-      const stored = loadAllConnectionsLocally();
-      expect(stored).toHaveLength(1);
-      expect(stored[0].id).toBe('bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb');
-    });
-  });
-
-  describe('loadConnectionById', () => {
-    it('returns the connection with the given id', () => {
-      const a = makeConn({ id: 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa' });
-      saveConnectionLocally(a);
-      const found = loadConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
-      expect(found?.id).toBe('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa');
-    });
-
-    it('returns null when the id does not exist', () => {
-      expect(loadConnectionById('aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa')).toBeNull();
-    });
-  });
-});
diff --git a/src/lib/storage/connection-storage.ts b/src/lib/storage/connection-storage.ts
index dd7ee8b1..e789643c 100644
--- a/src/lib/storage/connection-storage.ts
+++ b/src/lib/storage/connection-storage.ts
@@ -1,131 +1,9 @@
-import type { z } from 'zod';
-import { StorageConnectionSchema } from './schemas.js';
-
-/** Raw form data — `id` may be absent when creating a new connection. */
-export type StoredConnection = z.infer<typeof StorageConnectionSchema>;
-
-/**
- * A connection that has been persisted to localStorage and always has an `id`.
- * All load/update/remove functions work with this type.
- */
-export type SavedConnection = StoredConnection & { id: string };
-
-/**
- * HTTP header name used to pass the S3 connection config from the browser to
- * the backend API endpoints. Defined here (client-safe module) so both client
- * and server code can import it without leaking server-only code to the browser.
- */
-export const STORAGE_CONNECTION_HEADER = 'x-storage-connection';
-
-const STORAGE_KEY = 'stackable_storage_connections';
-
-/**
- * Load all stored connections. Entries that do not satisfy the current schema
- * (clean-break migration) are silently dropped.
- * Returns connections oldest-first (most recent is last).
- */
-function getConnections(): SavedConnection[] {
-  try {
-    const raw = localStorage.getItem(STORAGE_KEY);
-    if (!raw) return [];
-    const parsed = JSON.parse(raw) as unknown[];
-    return parsed.flatMap((c) => {
-      const result = StorageConnectionSchema.safeParse(c);
-      if (!result.success || !result.data.id) return [];
-      return [result.data as SavedConnection];
-    });
-  } catch {
-    return [];
-  }
-}
-
-/**
- * Save a new connection. Generates a UUID `id` if one is not already set.
- * Connections are stored oldest-first; the new connection is appended (most recently used).
- */
-export function saveConnectionLocally(data: StoredConnection): void {
-  try {
-    const all = getConnections();
-    // If a caller-supplied id is present, look up by id first (edit / reconnect
-    // with a known id). Only fall back to content-matching when no id is given,
-    // so that reconnecting with the same credentials (host+port+accessKey) after
-    // a page reload does not create a duplicate entry.
-    const existing = data.id
-      ? all.find((c) => c.id === data.id)
-      : all.find(
-          (c) =>
-            c.host === data.host &&
-            c.port === data.port &&
-            c.credentials?.accessKey === data.credentials?.accessKey
-        );
-    const id = existing?.id ?? data.id ?? crypto.randomUUID();
-    const connection: SavedConnection = { ...data, id };
-    const filtered = all.filter((c) => c.id !== id);
-    filtered.push(connection);
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
-  } catch {
-    // localStorage may be unavailable (e.g. private browsing quota exceeded)
-  }
-}
-
-/**
- * Update an existing connection in-place by its `id`, preserving its position
- * in the list. If no connection with that `id` exists, this is a no-op.
- */
-export function updateConnectionLocally(id: string, data: Partial<StoredConnection>): void {
-  try {
-    const all = getConnections();
-    const idx = all.findIndex((c) => c.id === id);
-    if (idx === -1) return;
-    all[idx] = { ...all[idx], ...data, id };
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(all));
-  } catch {
-    // localStorage may be unavailable
-  }
-}
-
-/** Return the most recently used connection (last in the list), or null. */
-export function loadConnectionLocally(): SavedConnection | null {
-  const all = getConnections();
-  return all.length > 0 ? all[all.length - 1] : null;
-}
-
-/** Return all stored connections in stored order (oldest first). */
-export function loadAllConnectionsLocally(): SavedConnection[] {
-  return getConnections();
-}
-
-/** Remove a specific connection from storage by its `id`. */
-export function removeConnectionLocally(data: SavedConnection): void {
-  try {
-    const all = getConnections();
-    const filtered = all.filter((c) => c.id !== data.id);
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
-  } catch {
-    // localStorage may be unavailable
-  }
-}
-
-/** Remove a connection from storage by its `id` string. */
-export function removeConnectionById(id: string): void {
-  try {
-    const all = getConnections();
-    const filtered = all.filter((c) => c.id !== id);
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(filtered));
-  } catch {
-    // localStorage may be unavailable
-  }
-}
-
-/** Return a single connection by its `id`, or null if not found. */
-export function loadConnectionById(id: string): SavedConnection | null {
-  return getConnections().find((c) => c.id === id) ?? null;
-}
-
-/**
- * Encode a connection config as a base64 JSON string suitable for the
- * `X-Storage-Connection` request header sent to the backend.
- */
-export function getConnectionHeader(connection: StoredConnection): string {
-  return btoa(JSON.stringify(connection));
+export interface SavedConnection {
+  id: string;
+  name: string;
+  host: string;
+  port: number | null;
+  type: 's3';
+  region: { name: string };
+  credentials?: { accessKey: string; secretKey: string };
 }
diff --git a/src/lib/storage/connection-store.svelte.ts b/src/lib/storage/connection-store.svelte.ts
new file mode 100644
index 00000000..2a1f3bef
--- /dev/null
+++ b/src/lib/storage/connection-store.svelte.ts
@@ -0,0 +1,26 @@
+/**
+ * Client-side store for the active storage connection ID and the list of
+ * saved connections returned by the server.
+ *
+ * This module is client-safe. It never imports server-only code.
+ */
+
+export interface ConnectionListItem {
+  id: string;
+  name: string;
+  endpoint: string | null;
+  additionalBuckets: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+class ConnectionStore {
+  activeConnectionId = $state<string | null>(null);
+  connections = $state<ConnectionListItem[]>([]);
+
+  get activeConnection(): ConnectionListItem | null {
+    return this.connections.find((c) => c.id === this.activeConnectionId) ?? null;
+  }
+}
+
+export const connectionStore = new ConnectionStore();
diff --git a/src/lib/storage/download.ts b/src/lib/storage/download.ts
index 8ba9dcc8..b1f608f2 100644
--- a/src/lib/storage/download.ts
+++ b/src/lib/storage/download.ts
@@ -2,8 +2,8 @@
  * Client-side utility for downloading a single S3 object via the server proxy.
  *
  * Strategy:
- *  1. Fetch the object with the `X-Storage-Connection` header carrying the
- *     connection config from localStorage.
+ *  1. Fetch the object with the `x-storage-connection-id` header carrying the
+ *     active connection UUID from the connection store.
  *  2. On error: throw a `DownloadError` with a typed `code` so the caller can
  *     display a localised message.
  *  3. On success: create a Blob URL and trigger a native browser download via a
@@ -15,7 +15,7 @@
  * proportional browser memory — see TECH_DEBT.md for the long-term fix.
  */
 
-import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 
 export type DownloadErrorCode =
   | 'not_connected'
@@ -49,7 +49,7 @@ function mapStatusToCode(status: number): DownloadErrorCode {
 /**
  * Download a single S3 object.
  *
- * Fetches the object with the connection config header, buffers it as a Blob,
+ * Fetches the object with the connection ID header, buffers it as a Blob,
  * then triggers a native browser download via a programmatic anchor click.
  *
  * @throws {DownloadError} when the server returns a non-2xx response.
@@ -57,12 +57,12 @@ function mapStatusToCode(status: number): DownloadErrorCode {
 export async function downloadObject(
   bucket: string,
   key: string,
-  connectionHeader: string
+  connectionId: string
 ): Promise<void> {
   const url = buildDownloadUrl(bucket, key);
 
   const response = await fetch(url, {
-    headers: { [STORAGE_CONNECTION_HEADER]: connectionHeader }
+    headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
   });
 
   if (!response.ok) {
diff --git a/src/lib/storage/schemas.ts b/src/lib/storage/schemas.ts
index 5a51d14d..4c9deddd 100644
--- a/src/lib/storage/schemas.ts
+++ b/src/lib/storage/schemas.ts
@@ -67,3 +67,7 @@ export const EditStorageConnectionSchema = baseStorageConnectionObject.superRefi
     });
   }
 });
+
+export const ConnectionIdSchema = z.object({
+  connectionId: z.string().uuid()
+});
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index fd0a7ac2..7d46c1f1 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -19,7 +19,7 @@ import { downloadObject, DownloadError } from '$lib/storage/download.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { ActionError, getActionErrorMessage } from './errors.js';
 import { BookmarksState } from './bookmarks.svelte.js';
-import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 import { keyToName } from '$lib/storage/utils.js';
 
 export class StorageState {
@@ -312,19 +312,18 @@ export class StorageState {
   /** Manually fetch S3 objects for the given prefix (used when exiting archive). */
   private async _fetchS3Objects(prefix: string): Promise<void> {
     try {
-      const conn = loadConnectionLocally();
-      if (!conn) {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) {
         this.loading = false;
         return;
       }
-      const connHeader = getConnectionHeader(conn);
       const params = new SvelteURLSearchParams({
         bucket: this.bucket,
         prefix: prefix ?? '',
         pageSize: String(this.pageSize)
       });
       const res = await fetch(`/api/storage/objects?${params}`, {
-        headers: { 'x-storage-connection': connHeader }
+        headers: { 'x-storage-connection-id': connectionId }
       });
       if (res.ok) {
         const objects = (await res.json()) as StoragePage;
@@ -343,12 +342,11 @@ export class StorageState {
   downloadFromArchive = async (internalPath: string): Promise<void> => {
     if (!this.archiveKey) return;
     try {
-      const conn = loadConnectionLocally();
-      if (!conn) {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) {
         addToast('error', m.storage_download_error_unknown());
         return;
       }
-      const connHeader = getConnectionHeader(conn);
       const params = new SvelteURLSearchParams({
         bucket: this.bucket,
         key: this.archiveKey,
@@ -358,7 +356,7 @@ export class StorageState {
         params.set('nestedArchivePath', this.archiveNestedPath);
       }
       const res = await fetch(`/api/storage/archive/extract?${params}`, {
-        headers: { 'x-storage-connection': connHeader }
+        headers: { 'x-storage-connection-id': connectionId }
       });
       if (!res.ok) {
         const code =
@@ -387,12 +385,11 @@ export class StorageState {
 
   /** Fetch archive listing from the server API. */
   private async _fetchArchiveListing(): Promise<void> {
-    const conn = loadConnectionLocally();
-    if (!conn || !this.archiveKey) {
+    const connectionId = connectionStore.activeConnectionId;
+    if (!connectionId || !this.archiveKey) {
       this.archiveLoading = false;
       return;
     }
-    const connHeader = getConnectionHeader(conn);
     const params = new SvelteURLSearchParams({
       bucket: this.bucket,
       key: this.archiveKey,
@@ -402,7 +399,7 @@ export class StorageState {
       params.set('nestedArchivePath', this.archiveNestedPath);
     }
     const res = await fetch(`/api/storage/archive/listing?${params}`, {
-      headers: { 'x-storage-connection': connHeader }
+      headers: { 'x-storage-connection-id': connectionId }
     });
     if (!res.ok) {
       throw new Error(m.storage_archive_open_error());
@@ -550,12 +547,12 @@ export class StorageState {
           this.bookmarks.recordFileVisit(this.bucket, f.key, f.size);
         }
         try {
-          const conn = loadConnectionLocally();
-          if (!conn) {
+          const connectionId = connectionStore.activeConnectionId;
+          if (!connectionId) {
             addToast('error', m.storage_download_error_unknown());
             return;
           }
-          await downloadObject(this.bucket, key, getConnectionHeader(conn));
+          await downloadObject(this.bucket, key, connectionId);
         } catch (err: unknown) {
           if (err instanceof DownloadError) {
             addToast('error', getActionErrorMessage(new ActionError(err.code, err.message)));
@@ -670,8 +667,8 @@ export class StorageState {
     const params = new SvelteURLSearchParams({ bucket });
     for (const key of keys) params.append('keys', key);
 
-    const conn = loadConnectionLocally();
-    const headers: HeadersInit = conn ? { 'x-storage-connection': getConnectionHeader(conn) } : {};
+    const connectionId = connectionStore.activeConnectionId;
+    const headers: HeadersInit = connectionId ? { 'x-storage-connection-id': connectionId } : {};
 
     const res = await fetch(`/api/storage/delete?${params}`, { method: 'DELETE', headers });
     if (!res.ok) {
diff --git a/src/lib/storage/upload.ts b/src/lib/storage/upload.ts
index f64199af..719da4e5 100644
--- a/src/lib/storage/upload.ts
+++ b/src/lib/storage/upload.ts
@@ -9,11 +9,10 @@
  *   supported in Firefox.
  * - The file is sent as the raw request body — no base64 or multipart encoding.
  *   The server streams it directly to S3, preserving binary integrity.
- * - The connection config is passed via the `X-Storage-Connection` header
- *   (base64-encoded JSON), read by the server from the client's localStorage.
+ * - The active connection UUID is passed via the `x-storage-connection-id` header.
  */
 
-import { STORAGE_CONNECTION_HEADER } from '$lib/storage/connection-storage.js';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 
 export type UploadErrorCode =
   | 'not_connected'
@@ -60,12 +59,12 @@ function mapStatusToUploadCode(status: number): UploadErrorCode {
 export async function checkObjectExists(
   bucket: string,
   key: string,
-  connectionHeader: string
+  connectionId: string
 ): Promise<boolean> {
   const url = buildDownloadUrl(bucket, key);
   const res = await fetch(url, {
     method: 'HEAD',
-    headers: { [STORAGE_CONNECTION_HEADER]: connectionHeader }
+    headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
   });
   if (res.status === 200) return true;
   if (res.status === 404) return false;
@@ -89,7 +88,7 @@ export function uploadFile(
   key: string,
   file: File,
   onProgress: (pct: number) => void,
-  connectionHeader: string
+  connectionId: string
 ): Promise<void> {
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest();
@@ -121,7 +120,7 @@ export function uploadFile(
 
     xhr.open('POST', url);
     xhr.setRequestHeader('Content-Type', file.type || 'application/octet-stream');
-    xhr.setRequestHeader(STORAGE_CONNECTION_HEADER, connectionHeader);
+    xhr.setRequestHeader(STORAGE_CONNECTION_ID_HEADER, connectionId);
     xhr.send(file);
   });
 }
diff --git a/src/routes/(app)/api/storage/buckets/+server.ts b/src/routes/(app)/api/storage/buckets/+server.ts
index 2739cfd5..5e81a6e5 100644
--- a/src/routes/(app)/api/storage/buckets/+server.ts
+++ b/src/routes/(app)/api/storage/buckets/+server.ts
@@ -5,12 +5,18 @@ import type { RequestHandler } from './$types';
  * GET /api/storage/buckets
  *
  * Returns the list of buckets accessible with the connection config supplied in
- * the `X-Storage-Connection` request header (base64-encoded JSON).
- * The config is parsed and validated by the `handleStorageConnection` middleware
- * in hooks.server.ts before this handler runs.
+ * the `x-storage-connection-id` request header. The config is resolved and
+ * decrypted by the `handleStorageConnection` middleware in hooks.server.ts
+ * before this handler runs.
+ *
+ * Additional buckets stored with the connection (not returned by ListBuckets)
+ * are merged into the response.
  */
 export const GET: RequestHandler = async ({ locals }) => {
-  const buckets = await getConnectionProvider(locals.storageConfig!).listContainers();
-  locals.logger.debug({ bucket_count: buckets.length }, 'bucket list returned');
-  return Response.json(buckets);
+  const config = locals.storageConfig!;
+  const listedBuckets = await getConnectionProvider(config).listContainers();
+  const additional = config.additionalBuckets ?? [];
+  const allBuckets = [...new Set([...listedBuckets, ...additional])];
+  locals.logger.debug({ bucket_count: allBuckets.length }, 'bucket list returned');
+  return Response.json(allBuckets);
 };
diff --git a/src/routes/(app)/api/storage/connections/+server.ts b/src/routes/(app)/api/storage/connections/+server.ts
new file mode 100644
index 00000000..08b150e7
--- /dev/null
+++ b/src/routes/(app)/api/storage/connections/+server.ts
@@ -0,0 +1,57 @@
+import { desc, eq } from 'drizzle-orm';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /api/storage/connections
+ *
+ * Returns the authenticated user's saved storage connections, sorted by
+ * most recently used first. Credentials are never included in the response.
+ */
+export const GET: RequestHandler = async ({ locals }) => {
+  const userId = locals.user!.id;
+
+  const rows = await db
+    .select({
+      id: userStorageConnections.id,
+      name: userStorageConnections.name,
+      encryptedPayload: userStorageConnections.encryptedPayload,
+      additionalBuckets: userStorageConnections.additionalBuckets,
+      createdAt: userStorageConnections.createdAt,
+      updatedAt: userStorageConnections.updatedAt
+    })
+    .from(userStorageConnections)
+    .where(eq(userStorageConnections.userId, userId))
+    .orderBy(desc(userStorageConnections.updatedAt));
+
+  // Decrypt the endpoint for display purposes — we include it in the response
+  // so the UI can show a label, but never include the access keys or secret.
+  const { decrypt } = await import('$lib/server/storage/encryption.js');
+  const { storageEncryptionKey: getKey } = await import('$lib/server/storage/encryption-key.js');
+
+  const connections = rows.map((row) => {
+    let endpoint: string | null = null;
+    try {
+      const payload = JSON.parse(decrypt(row.encryptedPayload, getKey())) as {
+        host?: string;
+        port?: number;
+      };
+      endpoint =
+        payload.host && payload.port ? `${payload.host}:${payload.port}` : (payload.host ?? null);
+    } catch {
+      // If decryption fails for a row, we still return the entry without the endpoint.
+    }
+    return {
+      id: row.id,
+      name: row.name,
+      endpoint,
+      additionalBuckets: (row.additionalBuckets as string[]) ?? [],
+      createdAt: row.createdAt.toISOString(),
+      updatedAt: row.updatedAt.toISOString()
+    };
+  });
+
+  locals.logger.debug({ connection_count: connections.length }, 'connections list returned');
+  return Response.json(connections);
+};
diff --git a/src/routes/(app)/api/storage/save-text/+server.ts b/src/routes/(app)/api/storage/save-text/+server.ts
index abbc04e1..c92cbb3a 100644
--- a/src/routes/(app)/api/storage/save-text/+server.ts
+++ b/src/routes/(app)/api/storage/save-text/+server.ts
@@ -25,8 +25,14 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
   const rawOriginalSize = url.searchParams.get('originalSize');
   const rawPreviewBytes = url.searchParams.get('previewBytes');
 
-  const originalSize = rawOriginalSize ? parseInt(rawOriginalSize, 10) : 0;
-  const previewBytes = rawPreviewBytes ? parseInt(rawPreviewBytes, 10) : originalSize;
+  const originalSize = parseInt(rawOriginalSize ?? '0', 10);
+  if (!Number.isFinite(originalSize) || originalSize < 0) {
+    throw error(400, 'Invalid originalSize: must be a non-negative integer');
+  }
+  const previewBytes = parseInt(rawPreviewBytes ?? String(originalSize), 10);
+  if (!Number.isFinite(previewBytes) || previewBytes < 0) {
+    throw error(400, 'Invalid previewBytes: must be a non-negative integer');
+  }
 
   if (!request.body) {
     throw error(400, 'Missing request body');
diff --git a/src/routes/(app)/storage/+layout.server.ts b/src/routes/(app)/storage/+layout.server.ts
index 34422970..0fa275bf 100644
--- a/src/routes/(app)/storage/+layout.server.ts
+++ b/src/routes/(app)/storage/+layout.server.ts
@@ -1,6 +1,12 @@
 import type { LayoutServerLoad } from './$types';
 import { error } from '@sveltejs/kit';
+import { desc, eq } from 'drizzle-orm';
 import { storageBrowserEnabled } from '$lib/server/feature-flags.js';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import { decrypt } from '$lib/server/storage/encryption.js';
+import { storageEncryptionKey } from '$lib/server/storage/encryption-key.js';
+import type { ConnectionListItem } from '$lib/storage/connection-store.svelte.js';
 
 export const load: LayoutServerLoad = async ({ locals }) => {
   if (!storageBrowserEnabled) {
@@ -9,7 +15,44 @@ export const load: LayoutServerLoad = async ({ locals }) => {
 
   locals.logger.debug('loading storage layout');
 
-  // Connected state and bucket list are determined client-side from localStorage
-  // and populated by the universal +layout.ts load after hydration.
-  return { connected: false, buckets: [] as string[], connectionType: null, connectionId: null };
+  const userId = locals.user?.id;
+  if (!userId) {
+    return { connected: false, buckets: [] as string[], connectionType: null, connections: [] };
+  }
+
+  const rows = await db
+    .select()
+    .from(userStorageConnections)
+    .where(eq(userStorageConnections.userId, userId))
+    .orderBy(desc(userStorageConnections.updatedAt));
+
+  const connections: ConnectionListItem[] = rows.map((row) => {
+    let endpoint: string | null = null;
+    try {
+      const payload = JSON.parse(decrypt(row.encryptedPayload, storageEncryptionKey())) as {
+        host?: string;
+        port?: number;
+      };
+      endpoint =
+        payload.host && payload.port ? `${payload.host}:${payload.port}` : (payload.host ?? null);
+    } catch {
+      // Return entry without endpoint if decryption fails.
+    }
+    return {
+      id: row.id,
+      name: row.name,
+      endpoint,
+      additionalBuckets: (row.additionalBuckets as string[]) ?? [],
+      createdAt: row.createdAt.toISOString(),
+      updatedAt: row.updatedAt.toISOString()
+    };
+  });
+
+  return {
+    connected: false,
+    buckets: [] as string[],
+    connectionType: null,
+    connections,
+    activeConnectionId: locals.session?.activeStorageConnectionId ?? null
+  };
 };
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 47be34ba..33791170 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -4,6 +4,7 @@
   import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
   import { StorageState } from '$lib/storage/state.svelte.js';
   import { setStorageState } from '$lib/storage/context.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 
   let { children, data } = $props();
 
@@ -12,7 +13,7 @@
       new StorageState({
         connected: data.connected,
         buckets: data.buckets,
-        connectionId: data.connectionId
+        connectionId: connectionStore.activeConnectionId
       })
   );
   setStorageState(storage);
@@ -21,6 +22,11 @@
   $effect(() => {
     storage.connected = data.connected;
     storage.buckets = data.buckets;
+    connectionStore.connections = data.connections;
+  });
+
+  $effect(() => {
+    storage.connectionId = connectionStore.activeConnectionId;
   });
 
   // Connections management pages have their own full-page layout — no sidebar.
diff --git a/src/routes/(app)/storage/+layout.ts b/src/routes/(app)/storage/+layout.ts
index 2f159430..a8593f9a 100644
--- a/src/routes/(app)/storage/+layout.ts
+++ b/src/routes/(app)/storage/+layout.ts
@@ -1,5 +1,6 @@
 import { browser } from '$app/environment';
-import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 import type { LayoutLoad } from './$types';
 
 const DISCONNECTED = {
@@ -9,36 +10,48 @@ const DISCONNECTED = {
 };
 
 /**
- * Client-side load: reads the connection from localStorage and fetches the bucket
- * list from the server. During SSR this returns the disconnected default — the
- * layout re-runs on the client after hydration to populate the real state.
+ * Universal load: on the client, auto-connects to the session's active storage
+ * connection. The session's `activeStorageConnectionId` (set by the connect/use
+ * actions and cleared by disconnect/deleteConnection) is the source of truth —
+ * no URL-param tricks needed.
+ *
+ * During SSR returns the disconnected default; the layout re-runs after hydration.
  */
-export const load: LayoutLoad = async ({ fetch, url }) => {
-  if (!browser) return DISCONNECTED;
+export const load: LayoutLoad = async ({ fetch, data }) => {
+  if (!browser) {
+    return { ...DISCONNECTED, connections: data.connections ?? [] };
+  }
+
+  const connections = data.connections ?? [];
+  connectionStore.connections = connections;
 
-  // When the user has just explicitly disconnected, skip the auto-reconnect.
-  if (url.searchParams.has('disconnected')) return DISCONNECTED;
+  // Session's active connection ID is the authoritative signal. null means the
+  // user explicitly disconnected (or never connected) — show the connect form.
+  const targetId = data.activeConnectionId ?? null;
+  if (!targetId) {
+    connectionStore.activeConnectionId = null;
+    return { ...DISCONNECTED, connections };
+  }
 
-  const connection = loadConnectionLocally();
-  if (!connection) return DISCONNECTED;
+  const target = connections.find((c) => c.id === targetId);
+  if (!target) {
+    // Session refers to a connection that has since been deleted.
+    connectionStore.activeConnectionId = null;
+    return { ...DISCONNECTED, connections };
+  }
 
-  const header = getConnectionHeader(connection);
+  connectionStore.activeConnectionId = target.id;
 
   try {
     const res = await fetch('/api/storage/buckets', {
-      headers: { 'x-storage-connection': header }
+      headers: { [STORAGE_CONNECTION_ID_HEADER]: target.id }
     });
 
-    if (!res.ok) return DISCONNECTED;
+    if (!res.ok) return { ...DISCONNECTED, connections };
 
     const buckets = (await res.json()) as string[];
-    return {
-      connected: true,
-      buckets,
-      connectionType: connection.type,
-      connectionId: connection.id
-    };
+    return { connected: true, buckets, connectionType: 's3', connections };
   } catch {
-    return DISCONNECTED;
+    return { ...DISCONNECTED, connections };
   }
 };
diff --git a/src/routes/(app)/storage/+page.server.ts b/src/routes/(app)/storage/+page.server.ts
index 1df24ce7..ecabbe11 100644
--- a/src/routes/(app)/storage/+page.server.ts
+++ b/src/routes/(app)/storage/+page.server.ts
@@ -1,20 +1,59 @@
 import { fail, redirect, isHttpError } from '@sveltejs/kit';
 import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import { desc, eq } from 'drizzle-orm';
 import type { Actions, PageServerLoad } from './$types';
-import { StorageConnectionSchema } from '$lib/storage/schemas.js';
+import { StorageConnectionSchema, ConnectionIdSchema } from '$lib/storage/schemas.js';
 import { getConnectionProvider } from '$lib/server/storage/utils.js';
-import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
+import {
+  saveConnection,
+  getConnectionForUser,
+  deleteConnection
+} from '$lib/server/storage/connections-db.js';
+import { auth } from '$lib/server/auth.js';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import { decrypt } from '$lib/server/storage/encryption.js';
+import { storageEncryptionKey } from '$lib/server/storage/encryption-key.js';
+import type { ConnectionMetadata, S3ConnectionConfig } from '$lib/server/storage/types.js';
 import * as m from '$lib/paraglide/messages.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
+  const log = locals.logger;
   const connectionForm = await superValidate(
     { tls: { verification: 'Full' } },
     zod(StorageConnectionSchema),
     { errors: false }
   );
-  locals.logger.debug('loading storage page');
-  return { connectionForm };
+  log.debug('loading storage page');
+
+  const userId = locals.user?.id;
+  let connections: ConnectionMetadata[] = [];
+
+  if (userId) {
+    const rows = await db
+      .select()
+      .from(userStorageConnections)
+      .where(eq(userStorageConnections.userId, userId))
+      .orderBy(desc(userStorageConnections.updatedAt));
+
+    connections = rows.map((row) => {
+      let endpoint: string | null = null;
+      try {
+        const payload = JSON.parse(decrypt(row.encryptedPayload, storageEncryptionKey())) as {
+          host?: string;
+          port?: number;
+        };
+        endpoint =
+          payload.host && payload.port ? `${payload.host}:${payload.port}` : (payload.host ?? null);
+      } catch {
+        // Return entry without endpoint if decryption fails.
+      }
+      return { id: row.id, name: row.name, endpoint };
+    });
+  }
+
+  return { connectionForm, connections };
 };
 
 export const actions: Actions = {
@@ -77,11 +116,78 @@ export const actions: Actions = {
       return message(form, msg, { status: 400 });
     }
 
+    const id = await saveConnection(locals.user!.id, config);
+    await auth.api.updateSession({
+      headers: request.headers,
+      body: { activeStorageConnectionId: id }
+    });
+
     throw redirect(303, '/storage');
   },
 
-  disconnect: async ({ locals }) => {
+  disconnect: async ({ request, locals }) => {
     locals.logger.info('user storage connection cleared');
-    throw redirect(303, '/storage?disconnected=1');
+    await auth.api.updateSession({
+      headers: request.headers,
+      body: { activeStorageConnectionId: null }
+    });
+    throw redirect(303, '/storage');
+  },
+
+  use: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(ConnectionIdSchema));
+
+    if (!form.valid) {
+      return fail(400, { error: 'Invalid connection ID' });
+    }
+
+    const { connectionId } = form.data;
+    const userId = locals.user!.id;
+
+    const config = await getConnectionForUser(userId, connectionId);
+    if (!config) {
+      return fail(400, { error: 'Connection not found' });
+    }
+
+    try {
+      await getConnectionProvider(config).listContainers();
+      log.info({ connectionId }, 'user switched storage connection');
+    } catch (err) {
+      log.warn({ err, connectionId }, 'storage connection test failed on use');
+      return fail(400, { error: 'Could not connect — check the endpoint and credentials.' });
+    }
+
+    await auth.api.updateSession({
+      headers: request.headers,
+      body: { activeStorageConnectionId: connectionId }
+    });
+
+    throw redirect(303, '/storage');
+  },
+
+  deleteConnection: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(ConnectionIdSchema));
+
+    if (!form.valid) {
+      return fail(400, { error: 'Invalid connection ID' });
+    }
+
+    const { connectionId } = form.data;
+    const userId = locals.user!.id;
+    const activeId = locals.session?.activeStorageConnectionId ?? null;
+
+    if (connectionId === activeId) {
+      await auth.api.updateSession({
+        headers: request.headers,
+        body: { activeStorageConnectionId: null }
+      });
+      log.info({ connectionId }, 'active storage connection deleted, session cleared');
+    }
+
+    await deleteConnection(userId, connectionId);
+
+    throw redirect(303, '/storage');
   }
 };
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 2225dd6e..0ff9f5e4 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -2,6 +2,7 @@
   import { browser } from '$app/environment';
   import { goto } from '$app/navigation';
   import { resolve } from '$app/paths';
+  import { page } from '$app/state';
   import { onMount } from 'svelte';
   import { navigating } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
@@ -18,6 +19,10 @@
   let { data } = $props();
   const storage = getStorageState();
 
+  const connectError = $derived<string | null>(
+    (page.form as { error?: string } | null)?.error ?? null
+  );
+
   // ── Restore-tabs banner ───────────────────────────────────────────────────
 
   let savedTabs = $state<PersistedTabsState | null>(null);
@@ -116,5 +121,9 @@
     <RecentItems />
   </div>
 {:else if mounted}
-  <StorageConnectForm connectionForm={data.connectionForm} />
+  <StorageConnectForm
+    connectionForm={data.connectionForm}
+    connections={data.connections ?? []}
+    {connectError}
+  />
 {/if}
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
index dcc0df33..8de2148e 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -1,6 +1,7 @@
 import { browser } from '$app/environment';
 import { error, redirect } from '@sveltejs/kit';
-import { loadConnectionLocally, getConnectionHeader } from '$lib/storage/connection-storage.js';
+import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 import type { PageLoad } from './$types';
 import type { StoragePage } from '$lib/storage/types.js';
 
@@ -22,8 +23,8 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
 
   if (!browser) return { bucket, prefix, objects: EMPTY_PAGE };
 
-  const connection = loadConnectionLocally();
-  if (!connection) throw redirect(303, '/storage');
+  const connectionId = connectionStore.activeConnectionId;
+  if (!connectionId) throw redirect(303, '/storage');
 
   const continuationToken = url.searchParams.get('continuationToken');
   const pageSizeParam = url.searchParams.get('pageSize');
@@ -33,7 +34,7 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
   if (pageSizeParam) query.set('pageSize', pageSizeParam);
 
   const res = await fetch(`/api/storage/objects?${query}`, {
-    headers: { 'x-storage-connection': getConnectionHeader(connection) }
+    headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
   });
 
   if (!res.ok) {
diff --git a/src/routes/(app)/storage/connections/+page.server.ts b/src/routes/(app)/storage/connections/+page.server.ts
index cf837762..383dd0b1 100644
--- a/src/routes/(app)/storage/connections/+page.server.ts
+++ b/src/routes/(app)/storage/connections/+page.server.ts
@@ -1,8 +1,40 @@
-import type { PageServerLoad } from './$types';
+import { fail, redirect } from '@sveltejs/kit';
+import type { Actions, PageServerLoad } from './$types';
+import { superValidate } from 'sveltekit-superforms';
+import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import { ConnectionIdSchema } from '$lib/storage/schemas.js';
+import { deleteConnection } from '$lib/server/storage/connections-db.js';
+import { auth } from '$lib/server/auth.js';
 
-// The connections list is managed entirely in localStorage on the client.
-// The server only provides an empty shell so the route is authenticated.
 export const load: PageServerLoad = async ({ locals }) => {
   locals.logger.debug('loading storage connections management page');
   return {};
 };
+
+export const actions: Actions = {
+  deleteConnection: async ({ request, locals }) => {
+    const log = locals.logger;
+    const form = await superValidate(request, zod(ConnectionIdSchema));
+
+    if (!form.valid) {
+      return fail(400, { error: 'Invalid connection ID' });
+    }
+
+    const { connectionId } = form.data;
+    const userId = locals.user!.id;
+    const activeId = locals.session?.activeStorageConnectionId ?? null;
+
+    if (connectionId === activeId) {
+      await auth.api.updateSession({
+        headers: request.headers,
+        body: { activeStorageConnectionId: null }
+      });
+      log.info({ connectionId }, 'active storage connection deleted, session cleared');
+    }
+
+    await deleteConnection(userId, connectionId);
+    log.info({ connectionId }, 'storage connection deleted from management page');
+
+    throw redirect(303, '/storage/connections');
+  }
+};
diff --git a/src/routes/(app)/storage/connections/+page.svelte b/src/routes/(app)/storage/connections/+page.svelte
index 7f5218b3..c7bd6ded 100644
--- a/src/routes/(app)/storage/connections/+page.svelte
+++ b/src/routes/(app)/storage/connections/+page.svelte
@@ -1,5 +1,5 @@
 <script lang="ts">
-  import { onMount } from 'svelte';
+  import { page } from '$app/state';
   import { resolve } from '$app/paths';
   import IconStorage from 'virtual:icons/material-symbols/storage';
   import IconEdit from 'virtual:icons/material-symbols/edit';
@@ -7,20 +7,18 @@
   import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
   import IconArrowBack from 'virtual:icons/material-symbols/arrow-back';
   import * as m from '$lib/paraglide/messages.js';
-  import {
-    loadAllConnectionsLocally,
-    removeConnectionById,
-    type SavedConnection
-  } from '$lib/storage/connection-storage.js';
-  import DeleteConnectionModal from '$lib/components/storage/DeleteConnectionModal.svelte';
-
-  let connections = $state<SavedConnection[]>([]);
-  let loaded = $state(false);
-  let deleteCandidate = $state<SavedConnection | null>(null);
-  let deleteModalOpen = $state(false);
-
-  // Context menu
-  let menuConn: SavedConnection | null = $state(null);
+  import type { ConnectionListItem } from '$lib/storage/connection-store.svelte.js';
+  import DeleteConnectionModal from '$lib/components/storage/modals/DeleteConnectionModal.svelte';
+  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+
+  const connections = $derived<ConnectionListItem[]>(page.data.connections ?? []);
+
+  function connectionLabel(conn: ConnectionListItem): string {
+    return conn.name || conn.endpoint || 'S3';
+  }
+
+  // Context menu state
+  let menuConn: ConnectionListItem | null = $state(null);
   let menuEl: HTMLUListElement | null = $state(null);
   let menuRawPos = $state({ left: 0, top: 0 });
 
@@ -40,17 +38,7 @@
     };
   });
 
-  onMount(() => {
-    connections = loadAllConnectionsLocally();
-    loaded = true;
-  });
-
-  function connectionLabel(conn: SavedConnection): string {
-    if (conn.name) return conn.name;
-    return conn.port ? `${conn.host}:${conn.port}` : conn.host;
-  }
-
-  function openContextMenu(e: MouseEvent, conn: SavedConnection) {
+  function openContextMenu(e: MouseEvent, conn: ConnectionListItem) {
     e.preventDefault();
     e.stopPropagation();
     menuRawPos = { left: e.clientX, top: e.clientY };
@@ -62,6 +50,7 @@
   }
 
   function handleOutsideClick(e: MouseEvent) {
+    if (deleteConfirmOpen) return;
     if (menuConn && menuEl && !menuEl.contains(e.target as Node)) closeContextMenu();
   }
 
@@ -69,23 +58,26 @@
     if (menuConn && e.key === 'Escape') closeContextMenu();
   }
 
-  function requestDelete(conn: SavedConnection) {
-    closeContextMenu();
-    deleteCandidate = conn;
-    deleteModalOpen = true;
-  }
+  // Delete confirmation
+  let deleteConfirmOpen = $state(false);
+  let deleteFormEl = $state<HTMLFormElement | null>(null);
+
+  const deleteConn = $derived.by<SavedConnection | null>(() => {
+    if (!menuConn) return null;
+    const ep = menuConn.endpoint ?? '';
+    const colonIdx = ep.lastIndexOf(':');
+    const host = colonIdx > 0 ? ep.slice(0, colonIdx) : ep;
+    const port = colonIdx > 0 ? parseInt(ep.slice(colonIdx + 1), 10) || null : null;
+    return { id: menuConn.id, name: menuConn.name, host, port, type: 's3', region: { name: '' } };
+  });
 
   function confirmDelete() {
-    if (!deleteCandidate) return;
-    removeConnectionById(deleteCandidate.id);
-    connections = loadAllConnectionsLocally();
-    deleteModalOpen = false;
-    deleteCandidate = null;
+    deleteFormEl?.requestSubmit();
   }
 
   function cancelDelete() {
-    deleteModalOpen = false;
-    deleteCandidate = null;
+    deleteConfirmOpen = false;
+    closeContextMenu();
   }
 </script>
 
@@ -93,7 +85,7 @@
 <svelte:window onkeydown={handleKeydown} />
 
 <div class="mx-auto max-w-4xl p-6">
-  <a href={resolve('/storage') + '?disconnected=1'} class="btn btn-ghost btn-sm mb-4 -ml-2">
+  <a href={resolve('/storage')} class="btn btn-ghost btn-sm mb-4 -ml-2">
     <IconArrowBack class="size-4" aria-hidden="true" />
     {m.storage_connections_back()}
   </a>
@@ -101,11 +93,7 @@
   <h1 class="mb-1 text-xl font-semibold">{m.storage_connections_title()}</h1>
   <p class="text-base-content/60 mb-6 text-sm">{m.storage_connections_subtitle()}</p>
 
-  {#if !loaded}
-    <div class="flex items-center justify-center py-12">
-      <span class="loading loading-spinner loading-md text-base-content/40"></span>
-    </div>
-  {:else if connections.length === 0}
+  {#if connections.length === 0}
     <p class="text-base-content/50 text-sm">{m.storage_connections_empty()}</p>
   {:else}
     <div class="overflow-x-auto">
@@ -122,7 +110,6 @@
           {#each connections as conn (conn.id)}
             <tr
               class="group hover:bg-base-300 cursor-default select-none"
-              class:outline={menuConn?.id === conn.id}
               class:bg-base-200={menuConn?.id === conn.id}
               oncontextmenu={(e) => openContextMenu(e, conn)}
             >
@@ -133,9 +120,9 @@
                 </div>
               </td>
               <td class="text-base-content/60 font-mono text-xs">
-                {conn.port ? `${conn.host}:${conn.port}` : conn.host}
+                {conn.endpoint ?? '-'}
               </td>
-              <td class="text-base-content/60 text-xs uppercase">{conn.type}</td>
+              <td class="text-base-content/60 text-xs uppercase">s3</td>
               <td>
                 <button
                   type="button"
@@ -154,8 +141,11 @@
   {/if}
 </div>
 
-<!-- Context menu (right-click or \u22ef button) -->
+<!-- Context menu (right-click or button) -->
 {#if menuConn}
+  <form method="POST" action="?/deleteConnection" bind:this={deleteFormEl} class="contents">
+    <input type="hidden" name="connectionId" value={menuConn.id} />
+  </form>
   <ul
     bind:this={menuEl}
     class="menu menu-sm border-base-300 bg-base-100 fixed z-50 w-36 rounded-lg border p-1 shadow-lg"
@@ -177,19 +167,19 @@
       <button
         type="button"
         role="menuitem"
-        class="text-error"
-        onclick={() => requestDelete(menuConn!)}
+        class="text-error w-full justify-start"
+        onclick={() => (deleteConfirmOpen = true)}
       >
         <IconDelete class="size-4 shrink-0" aria-hidden="true" />
         {m.storage_connections_delete()}
       </button>
     </li>
   </ul>
-{/if}
 
-<DeleteConnectionModal
-  bind:open={deleteModalOpen}
-  connection={deleteCandidate}
-  onconfirm={confirmDelete}
-  oncancel={cancelDelete}
-/>
+  <DeleteConnectionModal
+    open={deleteConfirmOpen}
+    connection={deleteConn}
+    onconfirm={confirmDelete}
+    oncancel={cancelDelete}
+  />
+{/if}
diff --git a/src/routes/(app)/storage/connections/[id]/+layout.svelte b/src/routes/(app)/storage/connections/[id]/+layout.svelte
index 5610b09b..6c22eadf 100644
--- a/src/routes/(app)/storage/connections/[id]/+layout.svelte
+++ b/src/routes/(app)/storage/connections/[id]/+layout.svelte
@@ -3,19 +3,24 @@
   import { resolve } from '$app/paths';
   import { page } from '$app/state';
   import StorageConnectionSidebar from '$lib/components/storage/sidebar/StorageConnectionSidebar.svelte';
-  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+  import type { ConnectionMetadata } from '$lib/server/storage/types.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 
   let { children } = $props();
 
   const connectionId = $derived(page.params.id);
 
-  function handleSelect(conn: SavedConnection) {
+  function handleSelect(conn: ConnectionMetadata) {
     goto(resolve(`/storage/connections/${conn.id}/edit`));
   }
 </script>
 
 <div class="flex flex-col gap-4 md:flex-row md:items-start">
-  <StorageConnectionSidebar activeId={connectionId} onselect={handleSelect} />
+  <StorageConnectionSidebar
+    connections={connectionStore.connections}
+    activeId={connectionId}
+    onselect={handleSelect}
+  />
   <div class="min-w-0 flex-1">
     {@render children()}
   </div>
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
index 24977514..307ef566 100644
--- a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
@@ -1,25 +1,70 @@
-import { fail, isHttpError } from '@sveltejs/kit';
+import { error, fail, redirect, isHttpError } from '@sveltejs/kit';
 import { superValidate, message } from 'sveltekit-superforms';
 import { zod4 as zod } from 'sveltekit-superforms/adapters';
+import { eq, and } from 'drizzle-orm';
 import type { Actions, PageServerLoad } from './$types';
 import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
+import { z } from 'zod';
 import { getConnectionProvider } from '$lib/server/storage/utils.js';
 import type { S3ConnectionConfig } from '$lib/server/storage/types.js';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import { decrypt, encrypt } from '$lib/server/storage/encryption.js';
+import { storageEncryptionKey } from '$lib/server/storage/encryption-key.js';
+import { logger } from '$lib/server/logging';
 import * as m from '$lib/paraglide/messages.js';
 
-export const load: PageServerLoad = async ({ locals }) => {
+const log = logger.child({ module: 'connection-edit' });
+
+export const load: PageServerLoad = async ({ locals, params }) => {
+  const userId = locals.user!.id;
+
+  const rows = await db
+    .select()
+    .from(userStorageConnections)
+    .where(and(eq(userStorageConnections.id, params.id), eq(userStorageConnections.userId, userId)))
+    .limit(1);
+
+  if (rows.length === 0) {
+    locals.logger.debug({ connection_id: params.id }, 'connection not found, redirecting');
+    throw redirect(303, '/storage/connections');
+  }
+
+  const row = rows[0];
+  let payload: z.infer<typeof EditStorageConnectionSchema>;
+
+  try {
+    payload = JSON.parse(decrypt(row.encryptedPayload, storageEncryptionKey()));
+  } catch {
+    locals.logger.error({ connection_id: params.id }, 'failed to decrypt connection payload');
+    throw error(500, 'Failed to load connection');
+  }
+
   const editForm = await superValidate(
-    { tls: { verification: 'Full' } },
+    {
+      id: params.id,
+      name: row.name ?? '',
+      type: 's3',
+      host: payload.host,
+      port: payload.port,
+      tls: payload.tls,
+      accessStyle: payload.accessStyle,
+      region: payload.region,
+      credentials: {
+        accessKey: payload.credentials?.accessKey ?? '',
+        secretKey: ''
+      }
+    },
     zod(EditStorageConnectionSchema),
     { errors: false }
   );
-  locals.logger.debug('loading storage connection edit page');
-  return { editForm };
+
+  locals.logger.debug({ connection_id: params.id }, 'loading storage connection edit page');
+  return { editForm, connectionId: params.id };
 };
 
 export const actions: Actions = {
-  update: async ({ request, locals }) => {
-    const log = locals.logger;
+  update: async ({ request, locals, params }) => {
     const form = await superValidate(request, zod(EditStorageConnectionSchema));
 
     if (!form.valid) {
@@ -28,6 +73,8 @@ export const actions: Actions = {
     }
 
     const { type, host, port, tls, accessStyle, region, credentials } = form.data;
+    const connectionId = params.id;
+    const userId = locals.user!.id;
 
     if (type !== 's3') {
       return message(form, m.storage_connect_error_hdfs(), { status: 400 });
@@ -46,8 +93,6 @@ export const actions: Actions = {
       credentials: resolvedCredentials
     };
 
-    // If no credentials were submitted the user chose to keep the existing ones,
-    // so skip the live connection test (it was already verified when first saved).
     if (resolvedCredentials) {
       try {
         await getConnectionProvider(config).listContainers();
@@ -81,6 +126,50 @@ export const actions: Actions = {
       }
     }
 
+    // If no new credentials were provided, preserve the existing encrypted ones.
+    let payload: object;
+    if (resolvedCredentials) {
+      payload = { host, port, tls, accessStyle, region, credentials: resolvedCredentials };
+    } else {
+      try {
+        const rows = await db
+          .select({ encryptedPayload: userStorageConnections.encryptedPayload })
+          .from(userStorageConnections)
+          .where(
+            and(
+              eq(userStorageConnections.id, connectionId),
+              eq(userStorageConnections.userId, userId)
+            )
+          )
+          .limit(1);
+        if (rows.length === 0) {
+          return message(form, 'Connection not found', { status: 404 });
+        }
+        const existing = JSON.parse(decrypt(rows[0].encryptedPayload, storageEncryptionKey())) as {
+          host: string;
+          port?: number;
+          tls?: object;
+          accessStyle: string;
+          region: object;
+          credentials?: { accessKey: string; secretKey: string };
+        };
+        payload = { host, port, tls, accessStyle, region, credentials: existing.credentials };
+      } catch {
+        return message(form, 'Failed to read existing credentials', { status: 500 });
+      }
+    }
+
+    const encryptedPayload = encrypt(JSON.stringify(payload), storageEncryptionKey());
+
+    await db
+      .update(userStorageConnections)
+      .set({ encryptedPayload, name: form.data.name ?? undefined })
+      .where(
+        and(eq(userStorageConnections.id, connectionId), eq(userStorageConnections.userId, userId))
+      );
+
+    log.info({ connection_id: connectionId }, 'storage connection updated');
+
     return message(form, 'ok');
   }
 };
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
index 9da8b957..3a0fd521 100644
--- a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
@@ -2,7 +2,6 @@
   import { onMount } from 'svelte';
   import { goto, beforeNavigate } from '$app/navigation';
   import { resolve } from '$app/paths';
-  import { page } from '$app/state';
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
   import { untrack } from 'svelte';
@@ -10,32 +9,21 @@
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
   import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
-  import {
-    loadConnectionById,
-    loadConnectionLocally,
-    updateConnectionLocally,
-    type SavedConnection
-  } from '$lib/storage/connection-storage.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 
   let { data } = $props();
 
   const uid = $props.id();
 
-  // Loaded client-side from localStorage
-  let connection = $state<SavedConnection | null>(null);
   let loaded = $state(false);
-  let isActiveConnection = $state(false);
+  let isActiveConnection = $derived(connectionStore.activeConnectionId === data.connectionId);
 
   // Unsaved-changes guard
   let initialSnapshot = $state.raw('');
   let confirmLeaveOpen = $state(false);
   let pendingNavigation = $state<string | null>(null);
-  // Set to true just before a programmatic goto so beforeNavigate doesn't re-intercept it.
   let bypassDirtyCheck = false;
 
-  // Extract the id from the URL via SvelteKit's page state
-  const connectionId = page.params.id;
-
   const { form, errors, enhance, submitting, message } = superForm(
     untrack(() => data.editForm),
     {
@@ -43,18 +31,7 @@
       validators: zod(EditStorageConnectionSchema),
       onResult: ({ result, cancel }) => {
         if (result.type === 'success' && result.data?.form?.message === 'ok') {
-          if (connection) {
-            // If credentials were left blank, preserve the existing stored credentials.
-            const savedCredentials =
-              $form.credentials.accessKey && $form.credentials.secretKey
-                ? $form.credentials
-                : (connection.credentials ?? { accessKey: '', secretKey: '' });
-            updateConnectionLocally(connection.id, { ...$form, credentials: savedCredentials });
-          }
-          // Prevent superforms from resetting the form and calling invalidateAll(),
-          // which would race with the navigation.
           cancel();
-          // Bypass the dirty-check guard so the post-save redirect isn't intercepted.
           bypassDirtyCheck = true;
           goto(resolve('/storage/connections'));
         }
@@ -67,34 +44,19 @@
   }
 
   onMount(() => {
-    if (!connectionId) {
-      goto(resolve('/storage/connections'));
-      return;
-    }
-    const found = loadConnectionById(connectionId);
-    if (!found) {
-      goto(resolve('/storage/connections'));
-      return;
-    }
-    connection = found;
-
-    // Pre-fill form with current values
-    $form.id = found.id;
-    $form.name = found.name ?? '';
-    $form.type = found.type;
-    $form.host = found.host;
-    $form.port = found.port;
-    $form.tls = found.tls;
-    $form.accessStyle = found.accessStyle;
-    $form.region = found.region;
-    // Pre-fill access key but never expose the stored secret key.
-    $form.credentials = { accessKey: found.credentials?.accessKey ?? '', secretKey: '' };
-
-    // Check if this is the currently active connection
-    const active = loadConnectionLocally();
-    isActiveConnection = active?.id === found.id;
+    // Pre-fill form explicitly (mirroring the server data) to ensure the $state
+    // proxy is fully settled before snapshotting for dirty detection.
+    const d = data.editForm.data;
+    $form.id = d.id;
+    $form.name = d.name ?? '';
+    $form.type = d.type;
+    $form.host = d.host;
+    $form.port = d.port;
+    $form.tls = d.tls;
+    $form.accessStyle = d.accessStyle;
+    $form.region = d.region;
+    $form.credentials = { accessKey: d.credentials?.accessKey ?? '', secretKey: '' };
 
-    // Snapshot the pre-filled form so we can detect unsaved changes.
     initialSnapshot = JSON.stringify($form);
     loaded = true;
   });
@@ -190,7 +152,6 @@
       <p class="text-base-content/50 mt-1 text-xs">{m.storage_connection_edit_name_hint()}</p>
     </div>
 
-    <!-- Backend type (hidden — editing type not supported) -->
     <input type="hidden" name="type" value={$form.type} />
 
     <!-- Host -->
@@ -252,7 +213,6 @@
       />
     </div>
 
-    <!-- TLS verification -->
     {#if $form.tls}
       <div class="flex items-start justify-between gap-4 pl-4">
         <div>
@@ -351,16 +311,17 @@
       <p class="text-error text-sm">{$message}</p>
     {/if}
 
-    <div class="flex items-center gap-3">
-      <button type="submit" class="btn btn-primary" disabled={$submitting}>
-        {#if $submitting}
-          <span class="loading loading-sm loading-spinner"></span>
-        {/if}
-        {m.storage_connection_edit_save()}
-      </button>
-      <a href={resolve('/storage/connections')} class="btn btn-ghost">
-        ← {m.storage_connections_title()}
-      </a>
-    </div>
+    <button type="submit" class="btn btn-primary self-start" disabled={$submitting}>
+      {#if $submitting}
+        <span class="loading loading-sm loading-spinner"></span>
+      {/if}
+      {m.storage_connection_edit_save()}
+    </button>
   </form>
+
+  <div class="mt-3 flex items-center gap-3">
+    <a href={resolve('/storage/connections')} class="btn btn-ghost">
+      ← {m.storage_connections_title()}
+    </a>
+  </div>
 {/if}
diff --git a/src/routes/(app)/storage/layout.server.test.ts b/src/routes/(app)/storage/layout.server.test.ts
index ac2bef5f..984aa2ea 100644
--- a/src/routes/(app)/storage/layout.server.test.ts
+++ b/src/routes/(app)/storage/layout.server.test.ts
@@ -7,6 +7,24 @@ vi.mock('$lib/server/feature-flags.js', () => ({
   }
 }));
 
+vi.mock('$lib/server/db.js', () => ({
+  db: {
+    select: () => ({ from: () => ({ where: () => ({ orderBy: () => Promise.resolve([]) }) }) })
+  }
+}));
+
+vi.mock('$lib/server/storage/encryption.js', () => ({
+  decrypt: vi.fn(() => JSON.stringify({ endpoint: 'https://s3.example.com' }))
+}));
+
+vi.mock('$lib/server/storage/encryption-key.js', () => ({
+  storageEncryptionKey: () => Buffer.alloc(32)
+}));
+
+vi.mock('$lib/server/schema.js', () => ({
+  userStorageConnections: {}
+}));
+
 import { load } from './+layout.server.js';
 
 function mockEvent() {
@@ -23,14 +41,14 @@ describe('storage layout server load', () => {
     await expect(load(mockEvent())).rejects.toThrow(expect.objectContaining({ status: 404 }));
   });
 
-  it('returns disconnected default state', async () => {
+  it('returns disconnected default state with empty connections list', async () => {
     mockStorageBrowserEnabled.mockReturnValue(true);
     const result = await load(mockEvent());
-    expect(result).toEqual({
+    expect(result).toMatchObject({
       connected: false,
       buckets: [],
-      connectionType: null,
-      connectionId: null
+      connections: [],
+      activeConnectionId: null
     });
   });
 });
diff --git a/src/routes/(app)/storage/page.server.test.ts b/src/routes/(app)/storage/page.server.test.ts
index 5adb0ee6..8f02a109 100644
--- a/src/routes/(app)/storage/page.server.test.ts
+++ b/src/routes/(app)/storage/page.server.test.ts
@@ -6,7 +6,24 @@ vi.mock('$lib/server/storage/utils.js', () => ({
 }));
 
 vi.mock('$lib/storage/schemas.js', () => ({
-  StorageConnectionSchema: {} // superValidate is also mocked
+  StorageConnectionSchema: {},
+  ConnectionIdSchema: {}
+}));
+
+const { mockUpdateSession } = vi.hoisted(() => ({
+  mockUpdateSession: vi.fn().mockResolvedValue({})
+}));
+vi.mock('$lib/server/auth.js', () => ({
+  auth: { api: { updateSession: mockUpdateSession } }
+}));
+
+const mockSaveConnection = vi.fn().mockResolvedValue('new-conn-id');
+const mockGetConnectionForUser = vi.fn();
+const mockDeleteConnection = vi.fn().mockResolvedValue(undefined);
+vi.mock('$lib/server/storage/connections-db.js', () => ({
+  saveConnection: (...args: unknown[]) => mockSaveConnection(...args),
+  getConnectionForUser: (...args: unknown[]) => mockGetConnectionForUser(...args),
+  deleteConnection: (...args: unknown[]) => mockDeleteConnection(...args)
 }));
 
 vi.mock('sveltekit-superforms', () => ({
@@ -18,6 +35,30 @@ vi.mock('sveltekit-superforms/adapters', () => ({
   zod4: vi.fn((schema) => schema)
 }));
 
+const mockDbInsert = vi.fn();
+const mockDbSelect = vi.fn().mockResolvedValue([]);
+vi.mock('$lib/server/db.js', () => ({
+  db: {
+    insert: () => ({ values: () => ({ returning: mockDbInsert }) }),
+    select: () => ({
+      from: () => ({ where: () => ({ orderBy: mockDbSelect, limit: mockDbSelect }) })
+    })
+  }
+}));
+
+vi.mock('$lib/server/storage/encryption.js', () => ({
+  encrypt: vi.fn(() => 'encrypted-payload'),
+  fingerprint: vi.fn(() => 'fp-hash')
+}));
+
+vi.mock('$lib/server/storage/encryption-key.js', () => ({
+  storageEncryptionKey: () => Buffer.alloc(32)
+}));
+
+vi.mock('$lib/server/schema.js', () => ({
+  userStorageConnections: {}
+}));
+
 import { load, actions } from './+page.server.js';
 import { superValidate } from 'sveltekit-superforms';
 
@@ -25,6 +66,15 @@ function mockLocals() {
   return { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } };
 }
 
+const validFormData = {
+  type: 's3' as const,
+  endpoint: 'http://s3',
+  pathStyle: true,
+  region: 'us-east-1',
+  accessKeyId: 'ak',
+  secretAccessKey: 'sk'
+};
+
 describe('storage page load', () => {
   beforeEach(() => vi.clearAllMocks());
 
@@ -58,14 +108,7 @@ describe('storage page actions', () => {
   it('connect: returns message for non-s3 type', async () => {
     vi.mocked(superValidate).mockResolvedValue({
       valid: true,
-      data: {
-        type: 'hdfs',
-        endpoint: '',
-        pathStyle: false,
-        region: '',
-        accessKeyId: '',
-        secretAccessKey: ''
-      }
+      data: { ...validFormData, type: 'hdfs' as const }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
 
     const result = await actions.connect({
@@ -110,6 +153,7 @@ describe('storage page actions', () => {
       }
     } as unknown as Awaited<ReturnType<typeof superValidate>>);
     mockConnectionProvider.listContainers.mockResolvedValue(['b1']);
+    mockSaveConnection.mockResolvedValue('new-conn-id');
 
     await expect(
       actions.connect({
@@ -119,13 +163,15 @@ describe('storage page actions', () => {
     ).rejects.toThrow(expect.objectContaining({ status: 303, location: '/storage' }));
   });
 
-  it('disconnect: redirects', async () => {
+  it('disconnect: redirects to /storage', async () => {
     await expect(
-      actions.disconnect({ locals: mockLocals() } as unknown as Parameters<
-        typeof actions.disconnect
-      >[0])
-    ).rejects.toThrow(
-      expect.objectContaining({ status: 303, location: '/storage?disconnected=1' })
+      actions.disconnect({
+        request: new Request('http://localhost', { method: 'POST' }),
+        locals: mockLocals()
+      } as unknown as Parameters<typeof actions.disconnect>[0])
+    ).rejects.toThrow(expect.objectContaining({ status: 303, location: '/storage' }));
+    expect(mockUpdateSession).toHaveBeenCalledWith(
+      expect.objectContaining({ body: { activeStorageConnectionId: null } })
     );
   });
 });

From 1f35d8b5ecc68c8426d61c1ce58b7f4b2e660a87 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 14 Jul 2026 15:44:08 +0200
Subject: [PATCH 107/136] #233 Add JSON Preview via Prettify Processing (#241)

* #233 add JSON preview via prettify processing

* #208 show different connection error messages

* minor spelling change

* fix unit tests

* fix lint

* feat: Add JSON formatting and repair functions with tests

* chore: increase global test timeout

---------

Co-authored-by: dklOrdix <dkl@ordix.de>
---
 playwright.config.ts                        |   2 +-
 src/lib/components/editor/TextEditor.svelte |  25 +-
 src/lib/editor/format-json.test.ts          | 240 ++++++++++++++++++++
 src/lib/editor/format-json.ts               | 126 ++++++++++
 4 files changed, 388 insertions(+), 5 deletions(-)
 create mode 100644 src/lib/editor/format-json.test.ts
 create mode 100644 src/lib/editor/format-json.ts

diff --git a/playwright.config.ts b/playwright.config.ts
index a9e61cc1..f952e93a 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -10,7 +10,7 @@ export default defineConfig({
   outputDir: path.join(import.meta.dirname, 'e2e/test-results'),
   globalSetup: path.join(import.meta.dirname, 'e2e/support/global-setup.ts'),
   timeout: 20_000,
-  globalTimeout: 20 * 60_000,
+  globalTimeout: 40 * 60_000,
   retries: 2,
   expect: {
     timeout: 10_000
diff --git a/src/lib/components/editor/TextEditor.svelte b/src/lib/components/editor/TextEditor.svelte
index bd0cefab..8645301f 100644
--- a/src/lib/components/editor/TextEditor.svelte
+++ b/src/lib/components/editor/TextEditor.svelte
@@ -3,6 +3,7 @@
   import { browser } from '$app/environment';
   import { theme } from '$lib/theme.svelte';
   import { getLocale } from '$lib/paraglide/runtime.js';
+  import { prettifyJson } from '$lib/editor/format-json';
 
   let {
     value = $bindable(),
@@ -26,6 +27,22 @@
 
   const extension = $derived(filename.split('.').pop()?.toLowerCase() ?? '');
 
+  const isJson = $derived(
+    contentType === 'application/json' ||
+      contentType === 'text/json' ||
+      contentType.includes('+json') ||
+      extension === 'json' ||
+      extension === 'jsonc'
+  );
+
+  const displayValue = $derived.by(() => {
+    if (!isJson) return value;
+    const raw = value ?? '';
+    return prettifyJson(raw);
+  });
+
+  const isReadonly = $derived(readonly || isJson);
+
   const extLanguageMap: Record<string, string> = {
     ts: 'typescript',
     tsx: 'typescript',
@@ -151,9 +168,9 @@
     if (!container.isConnected) return;
 
     editor = monaco.editor.create(container, {
-      value,
+      value: displayValue,
       language,
-      readOnly: readonly,
+      readOnly: isReadonly,
       theme: toMonacoTheme(theme.current),
       minimap: { enabled: false },
       fontSize: 13,
@@ -204,7 +221,7 @@
   {#if !browser || !ready}
     <pre
       class="text-base-content/90 bg-base-200/50 h-full overflow-auto p-4 font-mono text-xs whitespace-pre-wrap"
-      class:opacity-60={readonly}
-      aria-readonly={readonly || undefined}>{value}</pre>
+      class:opacity-60={isReadonly}
+      aria-readonly={isReadonly || undefined}>{displayValue}</pre>
   {/if}
 </div>
diff --git a/src/lib/editor/format-json.test.ts b/src/lib/editor/format-json.test.ts
new file mode 100644
index 00000000..59b2c853
--- /dev/null
+++ b/src/lib/editor/format-json.test.ts
@@ -0,0 +1,240 @@
+import { describe, it, expect } from 'vitest';
+import { prettifyJson, repairTruncatedJson, stripIncompleteTail } from './format-json';
+
+describe('prettifyJson', () => {
+  it('returns empty string for empty input', () => {
+    expect(prettifyJson('')).toBe('');
+  });
+
+  it('formats valid JSON object with indentation', () => {
+    const result = prettifyJson('{"a":1,"b":2}');
+    expect(result).toBe('{\n  "a": 1,\n  "b": 2\n}');
+  });
+
+  it('formats valid JSON array with indentation', () => {
+    const result = prettifyJson('[1,2,3]');
+    expect(result).toBe('[\n  1,\n  2,\n  3\n]');
+  });
+
+  it('formats nested JSON with proper indentation', () => {
+    const result = prettifyJson('{"a":{"b":[1,2]}}');
+    expect(result).toBe('{\n  "a": {\n    "b": [\n      1,\n      2\n    ]\n  }\n}');
+  });
+
+  it('is idempotent—already formatted JSON returns unchanged', () => {
+    const formatted = '{\n  "a": 1\n}';
+    expect(prettifyJson(formatted)).toBe(formatted);
+  });
+
+  it('handles primitive JSON values', () => {
+    expect(prettifyJson('true')).toBe('true');
+    expect(prettifyJson('null')).toBe('null');
+    expect(prettifyJson('42')).toBe('42');
+    expect(prettifyJson('"hello"')).toBe('"hello"');
+  });
+
+  it('repairs truncated JSON with unclosed object', () => {
+    const result = prettifyJson('{"a":1,');
+    expect(result).toBe('{\n  "a": 1\n}');
+  });
+
+  it('repairs truncated JSON with unclosed nested object', () => {
+    const result = prettifyJson('{"a":{"b":1');
+    expect(result).toBe('{\n  "a": {\n    "b": 1\n  }\n}');
+  });
+
+  it('repairs truncated JSON with unclosed string', () => {
+    const result = prettifyJson('{"a":"hello');
+    expect(result).toBe('{\n  "a": "hello"\n}');
+  });
+
+  it('returns raw text for completely invalid JSON', () => {
+    const invalid = '{not valid json: }}}';
+    expect(prettifyJson(invalid)).toBe(invalid);
+  });
+
+  it('strips incomplete trailing element and formats', () => {
+    const result = prettifyJson('{"a":1,"b":');
+    expect(result).toBe('{\n  "a": 1\n}');
+  });
+
+  it('strips incomplete trailing array element and formats', () => {
+    const result = prettifyJson('[1,2,');
+    expect(result).toBe('[\n  1,\n  2\n]');
+  });
+});
+
+describe('repairTruncatedJson', () => {
+  it('passes already-valid JSON through unchanged', () => {
+    expect(repairTruncatedJson('{"a":1}')).toBe('{"a":1}');
+  });
+
+  it('passes already-valid JSON array through unchanged', () => {
+    expect(repairTruncatedJson('[1,2,3]')).toBe('[1,2,3]');
+  });
+
+  it('closes an unclosed object', () => {
+    expect(repairTruncatedJson('{"a":1')).toBe('{"a":1}');
+  });
+
+  it('closes an unclosed array', () => {
+    expect(repairTruncatedJson('[1,2,3')).toBe('[1,2,3]');
+  });
+
+  it('closes nested unclosed structures', () => {
+    expect(repairTruncatedJson('{"a":{"b":[1,2')).toBe('{"a":{"b":[1,2]}}');
+  });
+
+  it('closes an unclosed string', () => {
+    expect(repairTruncatedJson('{"a":"hello')).toBe('{"a":"hello"}');
+  });
+
+  it('handles unclosed string after an escape character', () => {
+    expect(repairTruncatedJson('{"a":"hello\\')).toBe('{"a":"hello"}');
+  });
+
+  it('removes trailing comma before closing brackets', () => {
+    expect(repairTruncatedJson('{"a":1,')).toBe('{"a":1}');
+  });
+
+  it('handles empty input', () => {
+    expect(repairTruncatedJson('')).toBe('');
+  });
+
+  it('handles unclosed object in empty object', () => {
+    expect(repairTruncatedJson('{')).toBe('{}');
+  });
+
+  it('handles unclosed array in empty array', () => {
+    expect(repairTruncatedJson('[')).toBe('[]');
+  });
+
+  it('does not close brackets inside strings', () => {
+    expect(repairTruncatedJson('{"a":"{b}"')).toBe('{"a":"{b}"}');
+  });
+
+  it('ignores escaped quotes inside strings', () => {
+    expect(repairTruncatedJson('{"a":"he\\"llo')).toBe('{"a":"he\\"llo"}');
+  });
+});
+
+describe('stripIncompleteTail', () => {
+  it('passes valid JSON through unchanged', () => {
+    const valid = '{"a":1,"b":2}';
+    expect(stripIncompleteTail(valid)).toBe(valid);
+  });
+
+  it('strips trailing comma with incomplete value', () => {
+    const result = stripIncompleteTail('{"a":1,"b":');
+    expect(result).toBe('{"a":1}');
+  });
+
+  it('strips incomplete array element', () => {
+    const result = stripIncompleteTail('[1,2,');
+    expect(result).toBe('[1,2]');
+  });
+
+  it('strips deeply nested incomplete value', () => {
+    const result = stripIncompleteTail('{"a":{"b":[1,2,');
+    // stripIncompleteTail removes the trailing comma+value, repairTruncatedJson closes the brackets
+    expect(result).toBe('{"a":{"b":[1,2]}}');
+  });
+
+  it('returns input unchanged for an unbalanced opening bracket at the end', () => {
+    const result = stripIncompleteTail('{"a":1,{');
+    // The function cannot cleanly strip the incomplete `{` — this falls through to the raw-text fallback in prettifyJson
+    expect(result).toBe('{"a":1,{');
+  });
+
+  it('returns input unchanged when no strip is possible', () => {
+    const input = 'completely broken{';
+    expect(stripIncompleteTail(input)).toBe(input);
+  });
+
+  it('recursively strips when re-closing does not produce valid JSON', () => {
+    // stripIncompleteTail will strip the last comma part, then the recursive
+    // call on the result may need to strip more
+    const result = stripIncompleteTail('{"a":1,"b":2,');
+    // First pass strips the trailing comma → {"a":1,"b":2}, re-closes → {"a":1,"b":2}
+    expect(result).toBe('{"a":1,"b":2}');
+  });
+
+  it('strips incomplete value inside a string context correctly', () => {
+    const result = stripIncompleteTail('{"a":"hello","b":');
+    expect(result).toBe('{"a":"hello"}');
+  });
+});
+
+describe('prettifyJson — complex incomplete JSON', () => {
+  it('formats deeply nested truncated JSON: nested objects and arrays', () => {
+    const result = prettifyJson('{"level1":{"level2":{"level3":[1,2,3],"level3b":{');
+    expect(result).toBe(
+      '{\n  "level1": {\n    "level2": {\n      "level3": [\n        1,\n        2,\n        3\n      ],\n      "level3b": {}\n    }\n  }\n}'
+    );
+  });
+
+  it('repairs JSON truncated in the middle of a string value', () => {
+    const result = prettifyJson('{"message":"hello world');
+    expect(result).toBe('{\n  "message": "hello world"\n}');
+  });
+
+  it('repairs JSON with escaped quotes in truncated string', () => {
+    const result = prettifyJson('{"text":"he said \\"hello');
+    expect(result).toBe('{\n  "text": "he said \\"hello"\n}');
+  });
+
+  it('returns raw text when truncation leaves a key without a value', () => {
+    // repairTruncatedJson closes the string → `{"c"}` which isn't valid JSON
+    const result = prettifyJson('[{"a":1},{"b":2},{"c');
+    expect(result).toBe('[{"a":1},{"b":2},{"c');
+  });
+
+  it('repairs truncated JSON with trailing comma at end of object', () => {
+    const result = prettifyJson('{"a":1,"b":2,');
+    expect(result).toBe('{\n  "a": 1,\n  "b": 2\n}');
+  });
+
+  it('repairs truncated JSON with trailing comma at end of array', () => {
+    const result = prettifyJson('[1,2,3,');
+    expect(result).toBe('[\n  1,\n  2,\n  3\n]');
+  });
+
+  it('repairs single-element truncated array', () => {
+    const result = prettifyJson('[1,');
+    expect(result).toBe('[\n  1\n]');
+  });
+
+  it('returns an empty object for JSON truncated to just an opening brace', () => {
+    // repairTruncatedJson closes the brace → `{}` which is valid JSON
+    expect(prettifyJson('{')).toBe('{}');
+  });
+
+  it('returns raw text for JSON that is completely malformed', () => {
+    expect(prettifyJson('{broken json!!!}')).toBe('{broken json!!!}');
+  });
+
+  it('returns raw text when nested truncation produces key without value', () => {
+    const result = prettifyJson('{"items":[1,2,3,{"nested');
+    expect(result).toBe('{"items":[1,2,3,{"nested');
+  });
+
+  it('handles JSON truncated at a comma after a closing bracket', () => {
+    const result = prettifyJson('[{"a":1},');
+    expect(result).toBe('[\n  {\n    "a": 1\n  }\n]');
+  });
+
+  it('formats valid JSON with all value types', () => {
+    const result = prettifyJson(
+      '{"str":"hello","num":42,"bool":true,"null":null,"arr":[1,2],"obj":{"k":"v"}}'
+    );
+    expect(result).toBe(
+      '{\n  "str": "hello",\n  "num": 42,\n  "bool": true,\n  "null": null,\n  "arr": [\n    1,\n    2\n  ],\n  "obj": {\n    "k": "v"\n  }\n}'
+    );
+  });
+
+  it('returns raw text when JSON is truncated mid-key', () => {
+    // repairTruncatedJson closes the string → `{"onlykey"}` which isn't valid JSON
+    const result = prettifyJson('{"onlykey');
+    expect(result).toBe('{"onlykey');
+  });
+});
diff --git a/src/lib/editor/format-json.ts b/src/lib/editor/format-json.ts
new file mode 100644
index 00000000..3ff4ea22
--- /dev/null
+++ b/src/lib/editor/format-json.ts
@@ -0,0 +1,126 @@
+export function repairTruncatedJson(text: string): string {
+  let result = text;
+  let inString = false;
+  let escape = false;
+  const openBrackets: string[] = [];
+
+  for (let i = 0; i < result.length; i++) {
+    // eslint-disable-next-line security/detect-object-injection
+    const ch = result[i];
+    if (escape) {
+      escape = false;
+      continue;
+    }
+    if (inString) {
+      if (ch === '\\') {
+        escape = true;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+    } else if (ch === '{' || ch === '[') {
+      openBrackets.push(ch);
+    } else if (ch === '}') {
+      if (openBrackets.at(-1) === '{') openBrackets.pop();
+    } else if (ch === ']') {
+      if (openBrackets.at(-1) === '[') openBrackets.pop();
+    }
+  }
+
+  if (inString) {
+    if (escape) result = result.slice(0, -1);
+    result += '"';
+  }
+
+  result = result.trimEnd();
+  if (result.endsWith(',')) {
+    result = result.slice(0, -1).trimEnd();
+  }
+
+  for (let i = openBrackets.length - 1; i >= 0; i--) {
+    // eslint-disable-next-line security/detect-object-injection
+    result += openBrackets[i] === '{' ? '}' : ']';
+  }
+
+  return result;
+}
+
+export function stripIncompleteTail(json: string): string {
+  let depth = 0;
+  let inStr = false;
+  let esc = false;
+  let lastComma = -1;
+
+  for (let i = json.length - 1; i >= 0; i--) {
+    // eslint-disable-next-line security/detect-object-injection
+    const ch = json[i];
+    if (esc) {
+      esc = false;
+      continue;
+    }
+    if (inStr) {
+      if (ch === '\\') {
+        esc = true;
+      } else if (ch === '"') {
+        inStr = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inStr = true;
+    } else if (ch === '}' || ch === ']') {
+      depth++;
+    } else if (ch === '{' || ch === '[') {
+      depth--;
+      if (depth < 0) return json.substring(0, i + 1);
+    } else if (ch === ',' && depth === 0) {
+      lastComma = i;
+      break;
+    }
+  }
+
+  if (lastComma >= 0) {
+    const before = json.substring(0, lastComma).trimEnd();
+    const reClosed = repairTruncatedJson(before);
+    try {
+      JSON.parse(reClosed);
+      return reClosed;
+    } catch {
+      const simpler = stripIncompleteTail(before);
+      if (simpler !== before) return simpler;
+    }
+  }
+
+  return json;
+}
+
+export function prettifyJson(text: string): string {
+  if (!text) return text;
+
+  try {
+    return JSON.stringify(JSON.parse(text), null, 2);
+  } catch {
+    // not valid — try to repair truncated JSON
+  }
+
+  const basic = repairTruncatedJson(text);
+  try {
+    return JSON.stringify(JSON.parse(basic), null, 2);
+  } catch {
+    // still invalid — strip trailing incomplete elements and retry
+  }
+
+  const stripped = stripIncompleteTail(text);
+  if (stripped !== text) {
+    try {
+      return JSON.stringify(JSON.parse(stripped), null, 2);
+    } catch {
+      // give up
+    }
+  }
+
+  return text;
+}

From 40f36987775789587374e5762656c8870f151e83 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 14 Jul 2026 15:44:36 +0200
Subject: [PATCH 108/136] #222 add infinite scrolling to CSV, add feature flag
 for infinite scrolling (#226)

* #222 add infinite scrolling to CSV, add feature flag for infinite scrolling

* move tooltips to own component, add orientation, add tooltips to storage connection

* #208 show different connection error messages

* minor spelling change

* fix unit tests

* fix lint

* fix: update fetchCsvRows to use connectionStore (DB migration API)

* fix flaky e2e test

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 .env.example                                  |   1 +
 .env.test                                     |   1 +
 dev/setup.sh                                  |   2 +
 e2e/storage/recent-items.spec.ts              |   2 +
 e2e/storage/upload.spec.ts                    |   2 +
 messages/de.json                              |   1 +
 messages/en.json                              |   1 +
 src/lib/client/feature-flags.ts               |  10 +
 .../storage/modals/PreviewModal.svelte        | 194 +++++++++-
 .../storage/modals/preview/CsvPreview.svelte  | 361 ++++++++++++++++--
 .../modals/preview/ParquetPreview.svelte      | 252 +++++++-----
 src/lib/server/feature-flags.ts               |  10 +
 src/lib/server/storage/preview/csv.ts         | 307 +++++++++++++++
 .../server/storage/preview/parquet.test.ts    |   3 +-
 src/lib/server/storage/preview/parquet.ts     |   5 +
 .../(app)/api/storage/preview/+server.ts      |  35 +-
 .../(app)/api/storage/preview/server.test.ts  |  60 ++-
 src/test/setup-client.ts                      |   1 +
 18 files changed, 1083 insertions(+), 165 deletions(-)
 create mode 100644 src/lib/server/storage/preview/csv.ts

diff --git a/.env.example b/.env.example
index 99a6b7af..b08b46d7 100644
--- a/.env.example
+++ b/.env.example
@@ -40,3 +40,4 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true  # File browser: continue where you left off — restore open tabs from the last session (default: false)
 # PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=1048576  # Max file size (in bytes) of editable text files in the storage browser (default: 5 MiB)
 # PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
+# PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true  # Enable infinite scroll in the storage browser (default: true)
diff --git a/.env.test b/.env.test
index f9f134e8..1ad86088 100644
--- a/.env.test
+++ b/.env.test
@@ -17,6 +17,7 @@ PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
 PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
+PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
 GARAGE_ADMIN_URL=http://localhost:30902
 GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token
 BETTER_AUTH_URL=http://localhost:4173
diff --git a/dev/setup.sh b/dev/setup.sh
index 4f706f76..3e6a4f31 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -320,6 +320,7 @@ PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
 PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
+PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
 DATABASE_HOST=localhost
 DATABASE_PORT=31432
 DATABASE_NAME=cockpit
@@ -348,6 +349,7 @@ PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
 PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
+PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
 DATABASE_HOST=localhost
 DATABASE_PORT=31432
 DATABASE_NAME=cockpit
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index 06915de0..0b721d4b 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -20,6 +20,7 @@ async function previewFile(page: Page, name: string) {
   await rowByName(page, name).dblclick();
   await expect(page.getByRole('heading', { name })).toBeVisible();
   await page.getByRole('button', { name: 'Close' }).last().click();
+  await expect(page.getByRole('heading', { name })).not.toBeVisible();
 }
 
 test.describe('Storage S3 — Recent Items', () => {
@@ -74,6 +75,7 @@ test.describe('Storage S3 — Recent Items', () => {
   });
 
   test('removes a deleted file from Recent Files', async ({ page }, testInfo) => {
+    test.slow(); // multiple navigations + deletion; Firefox is slow in CI
     const credentials = requireGarageCredentials();
     const client = createS3Client(credentials);
     const prefix = uniquePrefix(testInfo, 'recent-delete-file');
diff --git a/e2e/storage/upload.spec.ts b/e2e/storage/upload.spec.ts
index 8f362ab7..bc91eabc 100644
--- a/e2e/storage/upload.spec.ts
+++ b/e2e/storage/upload.spec.ts
@@ -83,11 +83,13 @@ test.describe('Storage S3 — Upload', () => {
       await expect(page.getByRole('heading', { name: textFixture.name })).toBeVisible();
       await expect(page.getByText(textFixture.expectedSnippet)).toBeVisible();
       await page.getByRole('button', { name: 'Close' }).first().click();
+      await expect(page.getByRole('heading', { name: textFixture.name })).not.toBeVisible();
 
       await rowByName(page, csvFixture.name).dblclick();
       await expect(page.getByRole('heading', { name: csvFixture.name })).toBeVisible();
       await expect(page.getByText(csvFixture.expectedCell)).toBeVisible();
       await page.getByRole('button', { name: 'Close' }).first().click();
+      await expect(page.getByRole('heading', { name: csvFixture.name })).not.toBeVisible();
 
       await rowByName(page, imageFixture.name).dblclick();
       await expect(page.getByRole('heading', { name: imageFixture.name })).toBeVisible();
diff --git a/messages/de.json b/messages/de.json
index 658bb2c5..3dbff7b3 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -338,6 +338,7 @@
   "storage_preview_image_alt": "Vorschau von {name}",
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
+  "storage_preview_infinite_scroll_disabled": "Dies ist das Ende der Vorschau. Laden Sie die vollständige Datei herunter oder bitten Sie den Administrator, das unendliche Scrollen zu aktivieren, um weitere Zeilen in dieser Vorschau zu laden.",
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
   "storage_preview_maximise": "Maximieren",
   "storage_preview_restore": "Wiederherstellen",
diff --git a/messages/en.json b/messages/en.json
index 14f8970a..0c700c7c 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -338,6 +338,7 @@
   "storage_preview_image_alt": "Preview of {name}",
   "storage_preview_csv_rows": "Showing first {count} rows",
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
+  "storage_preview_infinite_scroll_disabled": "This is the end of the preview. Download the full file or ask the administrator to enable infinite scrolling to load more rows in this preview.",
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
   "storage_preview_maximise": "Maximise",
   "storage_preview_restore": "Restore",
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index 56ae5cc4..77b8495c 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -27,6 +27,16 @@ export const storageAutoConnectTimeoutMs: number = (() => {
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 15_000;
 })();
 
+// ── Infinite scroll preview ───────────────────────────────────────────────────
+
+/** When `PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=false`, the CSV and
+ *  Parquet file previews load a fixed number of rows without virtual scrolling /
+ *  infinite loading. Enabled by default — the previews fetch row chunks lazily
+ *  as the user scrolls, reducing S3 costs and browser memory for large files.
+ *  Controlled by `PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED`. Default: `true`. */
+export const infiniteScrollEnabled =
+  (env.PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED ?? 'true') === 'true';
+
 // ── Pagination ───────────────────────────────────────────────────────────────
 
 /** Parse a comma-separated page-sizes string into a deduplicated, sorted list
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 146a6f4e..608c0ba0 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -25,7 +25,7 @@
   import { connectionStore } from '$lib/storage/connection-store.svelte.js';
   import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
   import { addToast } from '$lib/stores/toast.svelte.js';
-  import { maxEditableFileSize } from '$lib/client/feature-flags.js';
+  import { maxEditableFileSize, infiniteScrollEnabled } from '$lib/client/feature-flags.js';
 
   interface Props {
     open?: boolean;
@@ -75,6 +75,14 @@
         previewBytes: number;
       }
     | { kind: 'csv'; text: string; truncated: boolean; totalSize: number; previewBytes: number }
+    | {
+        kind: 'csv_scroll';
+        headers: string[];
+        rows: unknown[][];
+        truncated: boolean;
+        totalSize: number;
+        totalRows: number;
+      }
     | {
         kind: 'parquet';
         headers: string[];
@@ -106,7 +114,10 @@
   let imageNaturalWidth = $state(0);
   let imageNaturalHeight = $state(0);
   let parquetShowingRowsCount = $state(0);
+  let csvShowingRowsCount = $state(0);
+  let csvTotalRows = $state(0);
   let parquetTab: 'metadata' | 'data' = $state('metadata');
+  let parquetDataLoading = $state(false);
 
   // ── Text editor state ──
   let editorText = $state('');
@@ -160,6 +171,10 @@
       imageNaturalWidth = 0;
       imageNaturalHeight = 0;
       parquetTab = 'metadata';
+      parquetDataLoading = false;
+      parquetShowingRowsCount = 0;
+      csvShowingRowsCount = 0;
+      csvTotalRows = 0;
       editorReady = false;
       editorText = '';
       originalText = '';
@@ -188,7 +203,7 @@
         }
         res = await fetch(`/api/storage/archive/extract?${params}`, { headers });
       } else {
-        const params = new URLSearchParams({ bucket: activeBucket, key });
+        const params = new SvelteURLSearchParams({ bucket: activeBucket, key });
         res = await fetch(`/api/storage/preview?${params}`, { headers });
       }
 
@@ -285,6 +300,37 @@
         return;
       }
 
+      if (res.headers.get('X-Preview-Format') === 'csv') {
+        const {
+          headers: csvHeaders,
+          rows: csvRows,
+          totalRows: initialTotal
+        } = await readCsvNdjsonStream(res);
+        csvTotalRows = initialTotal;
+
+        if (csvRows.length > 0 || infiniteScrollEnabled || !objectKey) {
+          preview = {
+            kind: 'csv_scroll',
+            headers: csvHeaders,
+            rows: csvRows,
+            totalRows: initialTotal,
+            truncated: initialTotal > csvRows.length,
+            totalSize
+          };
+        } else {
+          const data = await fetchCsvRows(0, 250).catch(() => []);
+          preview = {
+            kind: 'csv_scroll',
+            headers: csvHeaders,
+            rows: data,
+            totalRows: csvTotalRows,
+            truncated: csvTotalRows > data.length,
+            totalSize
+          };
+        }
+        return;
+      }
+
       const text = await readTextSafely(res, key);
       if (text === null) {
         preview = { kind: 'fallback', contentType, isBinary: true };
@@ -442,6 +488,43 @@
     return { headers: resultHeaders, rows, totalRows: resultTotalRows };
   }
 
+  /** Read an NDJSON streaming response for CSV row data. */
+  async function readCsvNdjsonStream(
+    res: Response
+  ): Promise<{ headers: string[]; rows: unknown[][]; totalRows: number }> {
+    const reader = res.body!.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let resultHeaders: string[] = [];
+    let rows: unknown[][] = [];
+    let resultTotalRows = 0;
+
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split('\n');
+      buffer = lines.pop() || '';
+
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        const msg = JSON.parse(line);
+
+        if (msg.t === 'h') {
+          resultHeaders = msg.h;
+          resultTotalRows = msg.tr ?? 0;
+        } else if (msg.t === 'r') {
+          rows = msg.v as unknown[][];
+        } else if (msg.t === 'e') {
+          throw new Error('Server error reading CSV data');
+        }
+      }
+    }
+
+    return { headers: resultHeaders, rows, totalRows: resultTotalRows };
+  }
+
   async function triggerDownload() {
     if (!objectKey) return;
     const connectionId = connectionStore.activeConnectionId;
@@ -558,6 +641,57 @@
     }
   });
 
+  // When infinite scroll is disabled and user clicks the data tab,
+  // fetch the first page of parquet data on demand.
+  $effect(() => {
+    if (
+      preview.kind === 'parquet' &&
+      parquetTab === 'data' &&
+      preview.rows.length === 0 &&
+      !infiniteScrollEnabled &&
+      !parquetDataLoading &&
+      objectKey
+    ) {
+      parquetDataLoading = true;
+      const hdrs = preview.headers;
+      const rowCount = Math.min(250, preview.totalRows);
+      const rows: unknown[][] = Array.from({ length: rowCount }, () =>
+        new Array(hdrs.length).fill(undefined)
+      );
+      preview = { ...preview, rows: rows.map((r) => [...r]) };
+      const colPos: Record<string, number> = {};
+      fetchParquetRows(0, rowCount, (name, values) => {
+        const colIdx = hdrs.indexOf(name);
+        if (colIdx < 0) return;
+        let pos = colPos[name] ?? 0;
+        for (let i = 0; i < values.length; i++) {
+          while (rows.length <= pos) {
+            rows.push(new Array(hdrs.length).fill(undefined));
+          }
+          rows[pos][colIdx] = values[i];
+          pos++;
+        }
+        colPos[name] = pos;
+        if (preview.kind === 'parquet') {
+          preview = { ...preview, rows: rows.map((r) => [...r]) };
+        }
+      })
+        .then((finalRows) => {
+          parquetDataLoading = false;
+          if (preview.kind === 'parquet') {
+            preview = {
+              ...preview,
+              rows: finalRows,
+              truncated: finalRows.length < preview.totalRows
+            };
+          }
+        })
+        .catch(() => {
+          parquetDataLoading = false;
+        });
+    }
+  });
+
   function toggleMaximized() {
     maximized = !maximized;
   }
@@ -592,6 +726,34 @@
     const { rows } = await readNdjsonStream(res, onColumn);
     return rows;
   }
+
+  // Function to fetch additional CSV chunks during infinite scroll
+  async function fetchCsvRows(offset: number, limit: number): Promise<unknown[][]> {
+    if (!objectKey) return [];
+
+    const connectionId = connectionStore.activeConnectionId;
+    const fetchHeaders: HeadersInit = connectionId
+      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+      : {};
+
+    const params = new URLSearchParams({
+      bucket,
+      key: objectKey,
+      offset: String(offset),
+      limit: String(limit),
+      data: 'true'
+    });
+
+    const res = await fetch(`/api/storage/preview?${params}`, { headers: fetchHeaders });
+
+    if (!res.ok) {
+      throw new Error('Failed to fetch CSV chunk');
+    }
+
+    const { rows, totalRows } = await readCsvNdjsonStream(res);
+    csvTotalRows = totalRows;
+    return rows;
+  }
 </script>
 
 <Modal bind:open {closeguard} class="modal">
@@ -617,6 +779,20 @@
               </span>
             {/if}
           </div>
+        {:else if preview.kind === 'csv_scroll'}
+          <div class="mt-1 flex flex-wrap items-center gap-1">
+            <span class="badge badge-neutral badge-sm font-mono"
+              >{formatFileSize(preview.totalSize)}</span
+            >
+            {#if preview.truncated}
+              <span class="badge badge-soft badge-warning badge-sm">
+                {m.storage_preview_parquet_rows({
+                  count: csvShowingRowsCount.toLocaleString(getLocale()),
+                  total: preview.totalRows.toLocaleString(getLocale())
+                })}
+              </span>
+            {/if}
+          </div>
         {:else if preview.kind === 'parquet'}
           <div class="mt-1 flex flex-wrap items-center gap-1">
             <span class="badge badge-neutral badge-sm font-mono"
@@ -764,7 +940,7 @@
               headers={preview.headers}
               initialRows={preview.rows}
               totalRows={preview.totalRows}
-              fetchRows={fetchParquetRows}
+              fetchRows={infiniteScrollEnabled ? fetchParquetRows : undefined}
               bind:showingRowsCount={parquetShowingRowsCount}
               hidden={parquetTab !== 'data'}
             />
@@ -806,6 +982,14 @@
         </div>
       {:else if preview.kind === 'csv'}
         <CsvPreview text={preview.text} />
+      {:else if preview.kind === 'csv_scroll'}
+        <CsvPreview
+          headers={preview.headers}
+          initialRows={preview.rows}
+          totalRows={csvTotalRows}
+          fetchRows={infiniteScrollEnabled ? fetchCsvRows : undefined}
+          bind:showingRowsCount={csvShowingRowsCount}
+        />
       {:else if preview.kind === 'image'}
         <div class="preview-scroll h-full overflow-scroll">
           <ImagePreview
@@ -830,14 +1014,14 @@
       {/if}
     </div>
 
-    {#if preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'parquet' || preview.kind === 'image' || preview.kind === 'pdf'}
+    {#if preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'csv_scroll' || preview.kind === 'parquet' || preview.kind === 'image' || preview.kind === 'pdf'}
       <div class="border-base-300 flex shrink-0 items-center justify-end gap-2 border-t px-5 py-2">
         {#if preview.kind === 'parquet' && preview.dataBlocked}
           <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
           </button>
-        {:else if !archiveKey && (preview.kind === 'text' || preview.kind === 'csv') && preview.truncated}
+        {:else if !archiveKey && (preview.kind === 'text' || preview.kind === 'csv' || preview.kind === 'csv_scroll') && preview.truncated}
           <button type="button" class="btn btn-ghost btn-sm gap-1.5" onclick={triggerDownload}>
             <IconDownload class="size-4" aria-hidden="true" />
             {m.storage_preview_download_full()}
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index eeaf8078..fdb1a939 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -1,65 +1,348 @@
 <script lang="ts">
   import Papa from 'papaparse';
+  import { untrack, onMount } from 'svelte';
   import * as m from '$lib/paraglide/messages.js';
+  import { getLocale } from '$lib/paraglide/runtime.js';
 
   const MAX_ROWS = 250;
 
   interface Props {
-    text: string;
+    text?: string;
+    headers?: string[];
+    initialRows?: unknown[][];
+    totalRows?: number;
+    fetchRows?: (offset: number, limit: number) => Promise<unknown[][]>;
+    showingRowsCount?: number;
+    hidden?: boolean;
   }
 
-  let { text }: Props = $props();
+  let {
+    text = '',
+    headers = [],
+    initialRows = [],
+    totalRows = 0,
+    fetchRows,
+    showingRowsCount = $bindable(0),
+    hidden = false
+  }: Props = $props();
 
-  const { headers, rows } = $derived.by(() => {
+  const isLegacyMode = $derived(text !== '' && headers.length === 0);
+  const isSimpleMode = $derived(!isLegacyMode && !fetchRows && headers.length > 0);
+
+  // ── Legacy mode: text-based CSV rendered via PapaParse ──
+
+  const {
+    headers: textHeaders,
+    rows: textRows,
+    truncated: textTruncated
+  } = $derived.by(() => {
+    if (!isLegacyMode) return { headers: [] as string[], rows: [] as string[][], truncated: false };
     const result = Papa.parse(text, {
       preview: MAX_ROWS + 1,
       header: false,
       skipEmptyLines: true
     });
-    if (result.data.length === 0) return { headers: [], rows: [] };
+    if (result.data.length === 0) return { headers: [], rows: [], truncated: false };
     const [hdrs, ...data] = result.data as string[][];
-    return { headers: hdrs, rows: data };
+    const truncatedCheck = Papa.parse(text, { skipEmptyLines: true }).data.length > MAX_ROWS + 1;
+    return { headers: hdrs, rows: data, truncated: truncatedCheck };
+  });
+
+  // ── Virtual scroll mode: chunked data loading ──
+
+  const CHUNK_SIZE = 250;
+  const ROW_HEIGHT = 32;
+
+  let containerHeight = $state(400);
+  let scrollTop = $state(0);
+
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  let loadedChunks = $state<Record<number, any[][]>>({});
+  let loadingChunks = $state<Set<number>>(new Set());
+
+  let columnWidths = $state<number[]>([]);
+
+  function textWidth(text: string): number {
+    if (typeof document === 'undefined') return text.length * 7;
+    const ctx = document.createElement('canvas').getContext('2d');
+    if (!ctx) return text.length * 7;
+    ctx.font =
+      '600 12px system-ui, -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif';
+    return ctx.measureText(text).width;
+  }
+
+  function populateChunk0() {
+    if (initialRows && initialRows.length > 0) {
+      loadedChunks = { 0: initialRows };
+      loadingChunks.clear();
+      scrollTop = 0;
+      const CELL_PADDING = 16;
+      const widths = headers.map((h) => textWidth(h));
+      for (const row of initialRows) {
+        if (!row) continue;
+        for (let i = 0; i < headers.length; i++) {
+          const val = row[i];
+          const str = val !== null && val !== undefined ? String(val) : '';
+          const w = textWidth(str);
+          if (w > widths[i]) widths[i] = w;
+        }
+      }
+      columnWidths = widths.map((w) => Math.max(w + CELL_PADDING, 80));
+    }
+  }
+
+  onMount(() => {
+    if (!isLegacyMode && !isSimpleMode) populateChunk0();
+  });
+
+  $effect(() => {
+    if (isLegacyMode || isSimpleMode) return;
+    if (initialRows && initialRows.length > 0 && !hidden) {
+      untrack(() => {
+        populateChunk0();
+      });
+    }
+  });
+
+  let highestLoadedChunk = $derived.by(() => {
+    if (isLegacyMode || isSimpleMode) return 0;
+    const keys = Object.keys(loadedChunks).map(Number);
+    if (keys.length === 0) return 0;
+    return Math.max(...keys);
+  });
+  let virtualTotalRows = $derived(
+    isLegacyMode || isSimpleMode
+      ? 0
+      : Math.min(totalRows, (highestLoadedChunk + 1) * CHUNK_SIZE + 10)
+  );
+
+  let startIndex = $derived(
+    isLegacyMode || isSimpleMode ? 0 : Math.max(0, Math.floor(scrollTop / ROW_HEIGHT) - 5)
+  );
+  let endIndex = $derived(
+    isLegacyMode || isSimpleMode
+      ? 0
+      : Math.min(virtualTotalRows, Math.floor((scrollTop + containerHeight) / ROW_HEIGHT) + 15)
+  );
+
+  let visibleRows = $derived.by(() => {
+    if (isLegacyMode || isSimpleMode) return [];
+    const rowsToRender: { index: number; data: unknown[] | null }[] = [];
+    for (let i = startIndex; i < endIndex; i++) {
+      const chunkIdx = Math.floor(i / CHUNK_SIZE);
+      const chunkOffset = i % CHUNK_SIZE;
+      const chunk = loadedChunks[chunkIdx];
+      if (chunk && chunk[chunkOffset] !== undefined) {
+        rowsToRender.push({ index: i, data: chunk[chunkOffset] });
+      } else {
+        rowsToRender.push({ index: i, data: null });
+      }
+    }
+    return rowsToRender;
+  });
+
+  $effect(() => {
+    if (isLegacyMode || isSimpleMode || !fetchRows || hidden) return;
+
+    const startChunk = Math.floor(startIndex / CHUNK_SIZE);
+    const endChunk = Math.floor(endIndex / CHUNK_SIZE);
+
+    untrack(() => {
+      for (let c = startChunk; c <= endChunk; c++) {
+        if (!loadedChunks[c] && !loadingChunks.has(c)) {
+          loadingChunks.add(c);
+          const placeholder = Array.from({ length: CHUNK_SIZE }, () =>
+            new Array(headers.length).fill(undefined)
+          );
+          loadedChunks[c] = placeholder;
+          fetchRows(c * CHUNK_SIZE, CHUNK_SIZE)
+            .then((data) => {
+              loadingChunks.delete(c);
+              loadedChunks = { ...loadedChunks, [c]: data };
+            })
+            .catch(() => {
+              loadingChunks.delete(c);
+              const next = { ...loadedChunks };
+              delete next[c];
+              loadedChunks = next;
+            });
+        }
+      }
+    });
   });
 
-  const truncated = $derived.by(() => {
-    const result = Papa.parse(text, { skipEmptyLines: true });
-    return result.data.length > MAX_ROWS + 1;
+  const loadedRowsCount = $derived(
+    isLegacyMode || isSimpleMode ? 0 : Object.keys(loadedChunks).length * CHUNK_SIZE
+  );
+  const isTruncated = $derived(
+    isLegacyMode
+      ? textTruncated
+      : isSimpleMode
+        ? totalRows > initialRows.length
+        : totalRows > loadedRowsCount
+  );
+  const formattedLoadedRowsCount = $derived(loadedRowsCount.toLocaleString(getLocale()));
+  const formattedTotalRows = $derived(totalRows.toLocaleString(getLocale()));
+
+  $effect(() => {
+    if (!isLegacyMode && !isSimpleMode) {
+      showingRowsCount = loadedRowsCount;
+    }
   });
 
   const uid = $props.id();
 </script>
 
-<div>
-  {#if headers.length === 0}
-    <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
-  {:else}
-    <table class="table-xs table min-w-max" aria-label="CSV preview">
-      <thead>
-        <tr class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs">
-          <th class="text-base-content/30 w-10 text-right font-normal" id="{uid}-line-hdr"></th>
-          {#each headers as header, i (i)}
-            <th class="font-semibold whitespace-nowrap">{header}</th>
-          {/each}
-        </tr>
-      </thead>
-      <tbody>
-        {#each rows as row, i (i)}
-          <tr class="hover:bg-base-200 transition-colors">
-            <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
-              >{(i + 1).toLocaleString()}</td
-            >
-            <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
-            {#each headers as _h, j (j)}
-              <td class="text-base-content/80 max-w-xs truncate text-xs">{row[j] ?? ''}</td>
+{#if isLegacyMode}
+  <div>
+    {#if textHeaders.length === 0}
+      <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
+    {:else}
+      <table class="table-xs table min-w-max" aria-label="CSV preview">
+        <thead>
+          <tr class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs">
+            <th class="text-base-content/30 w-10 text-right font-normal" id="{uid}-line-hdr"></th>
+            {#each textHeaders as header, i (i)}
+              <th class="font-semibold whitespace-nowrap">{header}</th>
             {/each}
           </tr>
-        {/each}
-      </tbody>
-    </table>
-    {#if truncated}
-      <p class="text-base-content/50 px-4 py-2 text-xs italic">
-        {m.storage_preview_csv_rows({ count: rows.length })}
-      </p>
+        </thead>
+        <tbody>
+          {#each textRows as row, i (i)}
+            <tr class="hover:bg-base-200 transition-colors">
+              <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
+                >{(i + 1).toLocaleString()}</td
+              >
+              <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
+              {#each textHeaders as _h, j (j)}
+                <td class="text-base-content/80 max-w-xs truncate text-xs">{row[j] ?? ''}</td>
+              {/each}
+            </tr>
+          {/each}
+        </tbody>
+      </table>
+      {#if textTruncated}
+        <p class="text-base-content/50 px-4 py-2 text-xs italic">
+          {m.storage_preview_csv_rows({ count: textRows.length })}
+        </p>
+      {/if}
+    {/if}
+  </div>
+{:else if isSimpleMode}
+  <div class="relative flex h-full flex-col">
+    {#if headers.length === 0}
+      <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
+    {:else}
+      <div class="min-h-0 w-full flex-1 overflow-auto">
+        <table class="table-xs table min-w-max" aria-label="CSV preview">
+          <thead class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs shadow-sm">
+            <tr>
+              <th class="text-base-content/30 w-10 text-right font-normal"></th>
+              {#each headers as header (header)}
+                <th class="truncate font-semibold whitespace-nowrap">{header}</th>
+              {/each}
+            </tr>
+          </thead>
+          <tbody>
+            {#each initialRows as row, i (i)}
+              <tr class="hover:bg-base-200 h-8 transition-colors">
+                <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
+                  >{(i + 1).toLocaleString(getLocale())}</td
+                >
+                <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
+                {#each headers as _h, j (j)}
+                  <td class="text-base-content/80 max-w-xs truncate text-xs"
+                    >{row[j] !== null && row[j] !== undefined ? String(row[j]) : ''}</td
+                  >
+                {/each}
+              </tr>
+            {/each}
+          </tbody>
+        </table>
+      </div>
+      {#if isTruncated}
+        <p class="text-base-content/50 px-4 py-2 text-xs italic">
+          {m.storage_preview_infinite_scroll_disabled
+            ? m.storage_preview_infinite_scroll_disabled()
+            : `This is the end of the preview. Download the full file or ask the administrator to enable infinite scrolling to load more rows in this preview.`}
+        </p>
+      {/if}
+    {/if}
+  </div>
+{:else}
+  <div class="relative flex h-full flex-col">
+    {#if headers.length === 0}
+      <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
+    {:else}
+      <div
+        class="min-h-0 w-full flex-1 overflow-auto"
+        bind:clientHeight={containerHeight}
+        onscroll={(e) => (scrollTop = e.currentTarget.scrollTop)}
+      >
+        <table class="table-xs table table-fixed" aria-label="CSV preview">
+          <thead class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs shadow-sm">
+            <tr>
+              <th class="text-base-content/30 w-10 text-right font-normal"></th>
+              {#each headers as header, j (header)}
+                <th
+                  class="truncate font-semibold"
+                  style={columnWidths.length > 0 ? `width: ${columnWidths[j]}px` : ''}>{header}</th
+                >
+              {/each}
+            </tr>
+          </thead>
+          <tbody>
+            {#if startIndex > 0}
+              <tr style="height: {startIndex * ROW_HEIGHT}px;">
+                <td colspan={headers.length + 1} class="border-0 p-0"></td>
+              </tr>
+            {/if}
+            {#each visibleRows as row (row.index)}
+              <tr class="hover:bg-base-200 h-8 transition-colors">
+                <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
+                  >{(row.index + 1).toLocaleString(getLocale())}</td
+                >
+                {#if row.data !== null && row.data !== undefined}
+                  <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
+                  {#each headers as _h, j (j)}
+                    {#if row.data[j] !== undefined}
+                      <td class="text-base-content/80 truncate text-xs">
+                        {row.data[j] !== null ? String(row.data[j]) : ''}
+                      </td>
+                    {:else}
+                      <td class="p-1">
+                        <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
+                      </td>
+                    {/if}
+                  {/each}
+                {:else}
+                  <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
+                  {#each headers as _h, j (j)}
+                    <td class="p-1">
+                      <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
+                    </td>
+                  {/each}
+                {/if}
+              </tr>
+            {/each}
+            {#if endIndex < virtualTotalRows}
+              <tr style="height: {(virtualTotalRows - endIndex) * ROW_HEIGHT}px;">
+                <td colspan={headers.length + 1} class="border-0 p-0"></td>
+              </tr>
+            {/if}
+          </tbody>
+        </table>
+      </div>
+      {#if isTruncated}
+        <p class="text-base-content/50 px-4 py-2 text-xs italic">
+          {m.storage_preview_parquet_rows
+            ? m.storage_preview_parquet_rows({
+                count: formattedLoadedRowsCount,
+                total: formattedTotalRows
+              })
+            : `Showing ${formattedLoadedRowsCount} of ${formattedTotalRows} rows. Scroll to load more.`}
+        </p>
+      {/if}
     {/if}
-  {/if}
-</div>
+  </div>
+{/if}
diff --git a/src/lib/components/storage/modals/preview/ParquetPreview.svelte b/src/lib/components/storage/modals/preview/ParquetPreview.svelte
index aedf4e67..3948c3bd 100644
--- a/src/lib/components/storage/modals/preview/ParquetPreview.svelte
+++ b/src/lib/components/storage/modals/preview/ParquetPreview.svelte
@@ -14,7 +14,6 @@
       onColumn?: (name: string, values: unknown[]) => void
     ) => Promise<unknown[][]>;
     showingRowsCount?: number;
-    /** When true, skip scroll-based chunk loading (e.g. tab is visually hidden). */
     hidden?: boolean;
   }
 
@@ -27,8 +26,12 @@
     hidden = false
   }: Props = $props();
 
-  const CHUNK_SIZE = 250; // magic number: rows to display
-  const ROW_HEIGHT = 32; // Exact height of table-xs (h-8)
+  const isSimpleMode = $derived(!fetchRows);
+
+  // ── Virtual scroll mode: chunked data loading ──
+
+  const CHUNK_SIZE = 250;
+  const ROW_HEIGHT = 32;
 
   let containerHeight = $state(400);
   let scrollTop = $state(0);
@@ -37,10 +40,8 @@
   let loadedChunks = $state<Record<number, any[][]>>({});
   let loadingChunks = $state<Set<number>>(new Set());
 
-  // Calculate column widths once on load to prevent width shifts during scrolling
   let columnWidths = $state<number[]>([]);
 
-  // Measure actual rendered text width using canvas for cross-browser consistency
   function textWidth(text: string): number {
     if (typeof document === 'undefined') return text.length * 7;
     const ctx = document.createElement('canvas').getContext('2d');
@@ -50,14 +51,11 @@
     return ctx.measureText(text).width;
   }
 
-  // Sync initial data from parent into the virtual-scroll chunk system.
-  // When initialRows changes (e.g. streaming NDJSON data arrived), replace chunk 0.
   function populateChunk0() {
     if (initialRows && initialRows.length > 0) {
       loadedChunks = { 0: initialRows };
       loadingChunks.clear();
       scrollTop = 0;
-      // Scan initial data to determine max content width per column
       const CELL_PADDING = 16;
       const widths = headers.map((h) => textWidth(h));
       for (const row of initialRows) {
@@ -73,9 +71,12 @@
     }
   }
 
-  onMount(populateChunk0);
+  onMount(() => {
+    if (!isSimpleMode) populateChunk0();
+  });
 
   $effect(() => {
+    if (isSimpleMode) return;
     if (initialRows && initialRows.length > 0 && !hidden) {
       untrack(() => {
         populateChunk0();
@@ -83,46 +84,49 @@
     }
   });
 
-  // Limit the scroll canvas to the highest loaded chunk PLUS a 10-row buffer.
   let highestLoadedChunk = $derived.by(() => {
+    if (isSimpleMode) return 0;
     const keys = Object.keys(loadedChunks).map(Number);
     if (keys.length === 0) return 0;
     return Math.max(...keys);
   });
-  let virtualTotalRows = $derived(Math.min(totalRows, (highestLoadedChunk + 1) * CHUNK_SIZE + 10));
+  let virtualTotalRows = $derived(
+    isSimpleMode ? 0 : Math.min(totalRows, (highestLoadedChunk + 1) * CHUNK_SIZE + 10)
+  );
 
-  let startIndex = $derived(Math.max(0, Math.floor(scrollTop / ROW_HEIGHT) - 5));
+  let startIndex = $derived(isSimpleMode ? 0 : Math.max(0, Math.floor(scrollTop / ROW_HEIGHT) - 5));
   let endIndex = $derived(
-    Math.min(virtualTotalRows, Math.floor((scrollTop + containerHeight) / ROW_HEIGHT) + 15)
+    isSimpleMode
+      ? 0
+      : Math.min(virtualTotalRows, Math.floor((scrollTop + containerHeight) / ROW_HEIGHT) + 15)
   );
 
-  let paddingTop = $derived(startIndex * ROW_HEIGHT);
-  let paddingBottom = $derived(Math.max(0, (virtualTotalRows - endIndex) * ROW_HEIGHT));
+  let paddingTop = $derived(isSimpleMode ? 0 : startIndex * ROW_HEIGHT);
+  let paddingBottom = $derived(
+    isSimpleMode ? 0 : Math.max(0, (virtualTotalRows - endIndex) * ROW_HEIGHT)
+  );
 
-  // purely computes visual logic, no side-effects here
   let visibleRows = $derived.by(() => {
-    const rowsToRender = [];
+    if (isSimpleMode) return [];
+    const rowsToRender: { index: number; data: unknown[] | null }[] = [];
     for (let i = startIndex; i < endIndex; i++) {
       const chunkIdx = Math.floor(i / CHUNK_SIZE);
       const chunkOffset = i % CHUNK_SIZE;
       const chunk = loadedChunks[chunkIdx];
-
       if (chunk && chunk[chunkOffset] !== undefined) {
         rowsToRender.push({ index: i, data: chunk[chunkOffset] });
       } else {
-        rowsToRender.push({ index: i, data: null }); // Render Skeleton
+        rowsToRender.push({ index: i, data: null });
       }
     }
     return rowsToRender;
   });
 
-  // Monitor scroll boundaries to safely trigger background chunk fetching
   $effect(() => {
-    if (!fetchRows || hidden) return;
+    if (isSimpleMode || !fetchRows || hidden) return;
 
     const currentStart = startIndex;
     const currentEnd = endIndex;
-
     const startChunk = Math.floor(currentStart / CHUNK_SIZE);
     const endChunk = Math.floor(currentEnd / CHUNK_SIZE);
 
@@ -130,19 +134,14 @@
       for (let c = startChunk; c <= endChunk; c++) {
         if (!loadedChunks[c] && !loadingChunks.has(c)) {
           loadingChunks.add(c);
-
-          // Initialize chunk with empty placeholder rows (undefined = not loaded yet)
           const placeholder = Array.from({ length: CHUNK_SIZE }, () =>
             new Array(headers.length).fill(undefined)
           );
           loadedChunks[c] = placeholder;
-
           fetchRows(
             c * CHUNK_SIZE,
             CHUNK_SIZE,
             (() => {
-              // Track per-column position within this chunk because hyparquet
-              // may split column data across multiple messages.
               const colPos: Record<string, number> = {};
               return (name: string, values: unknown[]) => {
                 const colIdx = headers.indexOf(name);
@@ -155,14 +154,12 @@
                   pos++;
                 }
                 colPos[name] = pos;
-                // Create new reference so Svelte detects the update immediately
                 loadedChunks = { ...loadedChunks };
               };
             })()
           )
             .then((data) => {
               loadingChunks.delete(c);
-              // Replace placeholder with fully populated data
               loadedChunks = { ...loadedChunks, [c]: data };
             })
             .catch(() => {
@@ -176,58 +173,48 @@
     });
   });
 
-  const loadedRowsCount = $derived(Object.keys(loadedChunks).length * CHUNK_SIZE);
-  const isTruncated = $derived(totalRows > loadedRowsCount);
+  const loadedRowsCount = $derived(
+    isSimpleMode ? 0 : Object.keys(loadedChunks).length * CHUNK_SIZE
+  );
+  const isTruncated = $derived(
+    isSimpleMode ? totalRows > initialRows.length : totalRows > loadedRowsCount
+  );
   const formattedLoadedRowsCount = $derived(loadedRowsCount.toLocaleString(getLocale()));
   const formattedTotalRows = $derived(totalRows.toLocaleString(getLocale()));
 
   $effect(() => {
-    showingRowsCount = loadedRowsCount;
+    if (!isSimpleMode) {
+      showingRowsCount = loadedRowsCount;
+    }
   });
 </script>
 
-<div class="relative flex h-full flex-col">
-  {#if headers.length === 0}
-    <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
-  {:else}
-    <!-- eslint-disable-next-line svelte/valid-compile -->
-    <div
-      class="min-h-0 w-full flex-1 overflow-auto"
-      bind:clientHeight={containerHeight}
-      onscroll={(e) => (scrollTop = e.currentTarget.scrollTop)}
-    >
-      <table class="table-xs table table-fixed" aria-label="Parquet preview">
-        <thead class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs shadow-sm">
-          <tr>
-            <th class="text-base-content/30 w-10 text-right font-normal"></th>
-            {#each headers as header, j (header)}
-              <th
-                class="truncate font-semibold"
-                style={columnWidths.length > 0 ? `width: ${columnWidths[j]}px` : ''}>{header}</th
-              >
-            {/each}
-          </tr>
-        </thead>
-        <tbody>
-          <!-- Top Spacer -->
-          {#if paddingTop > 0}
-            <tr style="height: {paddingTop}px;">
-              <td colspan={headers.length + 1} class="border-0 p-0"></td>
+{#if isSimpleMode}
+  <div class="relative flex h-full flex-col">
+    {#if headers.length === 0}
+      <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
+    {:else}
+      <div class="min-h-0 w-full flex-1 overflow-auto">
+        <table class="table-xs table min-w-max" aria-label="Parquet preview">
+          <thead class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs shadow-sm">
+            <tr>
+              <th class="text-base-content/30 w-10 text-right font-normal"></th>
+              {#each headers as header (header)}
+                <th class="truncate font-semibold whitespace-nowrap">{header}</th>
+              {/each}
             </tr>
-          {/if}
-
-          <!-- Visible Rows & Skeletons -->
-          {#each visibleRows as row (row.index)}
-            <tr class="hover:bg-base-200 h-8 transition-colors">
-              <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
-                >{(row.index + 1).toLocaleString(getLocale())}</td
-              >
-              {#if row.data !== null && row.data !== undefined}
-                <!-- eslint-disable-next-line @typescript-eslint/no-unused-vars -->
+          </thead>
+          <tbody>
+            {#each initialRows as row, i (i)}
+              <tr class="hover:bg-base-200 h-8 transition-colors">
+                <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
+                  >{(i + 1).toLocaleString(getLocale())}</td
+                >
+                <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
                 {#each headers as _h, j (j)}
-                  {#if row.data[j] !== undefined}
-                    <td class="text-base-content/80 truncate text-xs">
-                      {row.data[j] !== null ? String(row.data[j]) : ''}
+                  {#if row[j] !== undefined}
+                    <td class="text-base-content/80 max-w-xs truncate text-xs">
+                      {row[j] !== null ? String(row[j]) : ''}
                     </td>
                   {:else}
                     <td class="p-1">
@@ -235,37 +222,94 @@
                     </td>
                   {/if}
                 {/each}
-              {:else}
-                <!-- Skeleton State (full row not yet initialized) -->
-                <!-- eslint-disable-next-line @typescript-eslint/no-unused-vars -->
-                {#each headers as _h, j (j)}
-                  <td class="p-1">
-                    <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
-                  </td>
-                {/each}
-              {/if}
-            </tr>
-          {/each}
-
-          <!-- Bottom Spacer -->
-          {#if paddingBottom > 0}
-            <tr style="height: {paddingBottom}px;">
-              <td colspan={headers.length + 1} class="border-0 p-0"></td>
+              </tr>
+            {/each}
+          </tbody>
+        </table>
+      </div>
+      {#if isTruncated}
+        <p class="text-base-content/50 px-4 py-2 text-xs italic">
+          {m.storage_preview_infinite_scroll_disabled
+            ? m.storage_preview_infinite_scroll_disabled()
+            : `This is the end of the preview. Download the full file or ask the administrator to enable infinite scrolling to load more rows in this preview.`}
+        </p>
+      {/if}
+    {/if}
+  </div>
+{:else}
+  <div class="relative flex h-full flex-col">
+    {#if headers.length === 0}
+      <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
+    {:else}
+      <div
+        class="min-h-0 w-full flex-1 overflow-auto"
+        bind:clientHeight={containerHeight}
+        onscroll={(e) => (scrollTop = e.currentTarget.scrollTop)}
+      >
+        <table class="table-xs table table-fixed" aria-label="Parquet preview">
+          <thead class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs shadow-sm">
+            <tr>
+              <th class="text-base-content/30 w-10 text-right font-normal"></th>
+              {#each headers as header, j (header)}
+                <th
+                  class="truncate font-semibold"
+                  style={columnWidths.length > 0 ? `width: ${columnWidths[j]}px` : ''}>{header}</th
+                >
+              {/each}
             </tr>
-          {/if}
-        </tbody>
-      </table>
-    </div>
-
-    {#if isTruncated}
-      <p class="text-base-content/50 px-4 py-2 text-xs italic">
-        {m.storage_preview_parquet_rows
-          ? m.storage_preview_parquet_rows({
-              count: formattedLoadedRowsCount,
-              total: formattedTotalRows
-            })
-          : `Showing ${formattedLoadedRowsCount} of ${formattedTotalRows} rows. Scroll to load more.`}
-      </p>
+          </thead>
+          <tbody>
+            {#if paddingTop > 0}
+              <tr style="height: {paddingTop}px;">
+                <td colspan={headers.length + 1} class="border-0 p-0"></td>
+              </tr>
+            {/if}
+            {#each visibleRows as row (row.index)}
+              <tr class="hover:bg-base-200 h-8 transition-colors">
+                <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
+                  >{(row.index + 1).toLocaleString(getLocale())}</td
+                >
+                {#if row.data !== null && row.data !== undefined}
+                  <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
+                  {#each headers as _h, j (j)}
+                    {#if row.data[j] !== undefined}
+                      <td class="text-base-content/80 truncate text-xs">
+                        {row.data[j] !== null ? String(row.data[j]) : ''}
+                      </td>
+                    {:else}
+                      <td class="p-1">
+                        <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
+                      </td>
+                    {/if}
+                  {/each}
+                {:else}
+                  <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
+                  {#each headers as _h, j (j)}
+                    <td class="p-1">
+                      <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
+                    </td>
+                  {/each}
+                {/if}
+              </tr>
+            {/each}
+            {#if paddingBottom > 0}
+              <tr style="height: {paddingBottom}px;">
+                <td colspan={headers.length + 1} class="border-0 p-0"></td>
+              </tr>
+            {/if}
+          </tbody>
+        </table>
+      </div>
+      {#if isTruncated}
+        <p class="text-base-content/50 px-4 py-2 text-xs italic">
+          {m.storage_preview_parquet_rows
+            ? m.storage_preview_parquet_rows({
+                count: formattedLoadedRowsCount,
+                total: formattedTotalRows
+              })
+            : `Showing ${formattedLoadedRowsCount} of ${formattedTotalRows} rows. Scroll to load more.`}
+        </p>
+      {/if}
     {/if}
-  {/if}
-</div>
+  </div>
+{/if}
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index 7a03a27c..d9f32945 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -16,6 +16,16 @@ export const completionEnabled = env.STACKABLE_COCKPIT_COMPLETION_ENABLED !== 'f
  *  credentials and the file-browser UI. */
 export const storageBrowserEnabled = env.STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED === 'true';
 
+// ── Infinite scroll preview ───────────────────────────────────────────────────
+
+/** When `STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=false`, the CSV and Parquet
+ *  file previews load a fixed number of rows without virtual scrolling / infinite
+ *  loading. Enabled by default — the previews fetch row chunks lazily as the
+ *  user scrolls, reducing S3 costs and browser memory for large files.
+ *  Controlled by `STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED`. Default: `true`. */
+export const infiniteScrollEnabled =
+  env.PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED !== 'false';
+
 // ── Storage preview limits ───────────────────────────────────────────────────
 
 /** Maximum bytes fetched when streaming a text, CSV, or JSON file preview.
diff --git a/src/lib/server/storage/preview/csv.ts b/src/lib/server/storage/preview/csv.ts
new file mode 100644
index 00000000..518676f5
--- /dev/null
+++ b/src/lib/server/storage/preview/csv.ts
@@ -0,0 +1,307 @@
+import type pino from 'pino';
+import type { StorageProvider } from '$lib/server/storage/provider.js';
+import { textPreviewBytes, infiniteScrollEnabled } from '$lib/server/feature-flags.js';
+import { logger } from '$lib/server/logging';
+
+const fallbackLog = logger.child({ module: 'csv-preview' });
+
+// ── In-memory line-offset cache for S3 cost optimisation ──
+
+interface CsvCacheEntry {
+  headers: string[];
+  /** Byte offset of each data line's first byte (0-based relative to file start, after the header line) */
+  lineOffsets: number[];
+  /** Total bytes consumed from S3 so far */
+  bytesRead: number;
+  /** Total file size */
+  totalSize: number;
+  lastAccessed: number;
+}
+
+const CSV_CACHE_TTL = 5 * 60 * 1000;
+const csvPreviewCache = new Map<string, CsvCacheEntry>();
+
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, entry] of csvPreviewCache.entries()) {
+    if (now - entry.lastAccessed > CSV_CACHE_TTL) {
+      csvPreviewCache.delete(key);
+    }
+  }
+}, 60 * 1000).unref();
+
+// ── Helpers ──
+
+async function streamToArrayBuffer(stream: ReadableStream): Promise<ArrayBuffer> {
+  const chunks: Uint8Array[] = [];
+  const reader = stream.getReader();
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    chunks.push(value);
+  }
+  const totalLength = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+  const result = new Uint8Array(totalLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.length;
+  }
+  return result.buffer;
+}
+
+/** Parse a single CSV row into fields, handling quoted values. */
+function parseCsvRow(line: string): string[] {
+  const result: string[] = [];
+  let current = '';
+  let inQuotes = false;
+  for (let i = 0; i < line.length; i++) {
+    const char = line[i];
+    if (inQuotes) {
+      if (char === '"') {
+        if (i + 1 < line.length && line[i + 1] === '"') {
+          current += '"';
+          i++;
+        } else {
+          inQuotes = false;
+        }
+      } else {
+        current += char;
+      }
+    } else {
+      if (char === '"') {
+        inQuotes = true;
+      } else if (char === ',') {
+        result.push(current);
+        current = '';
+      } else if (char === '\r') {
+        // skip carriage return
+      } else {
+        current += char;
+      }
+    }
+  }
+  result.push(current);
+  return result;
+}
+
+/**
+ * Read a portion of the file from S3 and parse lines, extending the cache entry.
+ * Returns the updated entry.
+ */
+async function extendCache(
+  provider: StorageProvider,
+  key: string,
+  entry: CsvCacheEntry,
+  targetRow: number
+): Promise<CsvCacheEntry> {
+  // Already have enough data
+  if (entry.lineOffsets.length >= targetRow) return entry;
+
+  // Determine how many more bytes to read
+  const bytesToRead = Math.min(entry.totalSize - entry.bytesRead, textPreviewBytes);
+  if (bytesToRead <= 0) return entry;
+
+  const rangeEnd = entry.bytesRead + bytesToRead - 1;
+  const stream = await provider.getObjectRange(key, entry.bytesRead, rangeEnd);
+  const buffer = await streamToArrayBuffer(stream);
+  const text = new TextDecoder('utf-8', { fatal: false }).decode(buffer);
+
+  const lines = text.split('\n');
+
+  if (entry.headers.length === 0) {
+    if (lines.length > 0) {
+      entry.headers = parseCsvRow(lines[0].replace(/\r$/, ''));
+    }
+    let bytePos = entry.bytesRead;
+    for (let i = 0; i < lines[0].length + 1; i++) {
+      bytePos++;
+    }
+    for (let i = 1; i < lines.length; i++) {
+      entry.lineOffsets.push(bytePos);
+      bytePos += lines[i].length + 1;
+    }
+  } else {
+    let bytePos = entry.bytesRead;
+    for (let i = 0; i < lines.length; i++) {
+      if (lines[i].length > 0 || i < lines.length - 1) {
+        entry.lineOffsets.push(bytePos);
+      }
+      bytePos += lines[i].length + 1;
+    }
+  }
+
+  entry.bytesRead = entry.bytesRead + bytesToRead;
+  return entry;
+}
+
+/** Read exact byte range for a set of rows and return parsed values. */
+async function readRows(
+  provider: StorageProvider,
+  key: string,
+  entry: CsvCacheEntry,
+  startOffset: number,
+  endOffset: number
+): Promise<string[][]> {
+  const startByte = entry.lineOffsets[startOffset];
+  const endByte =
+    endOffset < entry.lineOffsets.length ? entry.lineOffsets[endOffset] - 1 : entry.bytesRead - 1;
+
+  if (startByte === undefined || startByte < 0) return [];
+
+  const stream = await provider.getObjectRange(key, startByte, Math.max(startByte, endByte));
+  const buffer = await streamToArrayBuffer(stream);
+  const text = new TextDecoder('utf-8', { fatal: false }).decode(buffer);
+
+  const lines = text.split('\n');
+  const rows: string[][] = [];
+  for (const line of lines) {
+    const trimmed = line.replace(/\r$/, '');
+    if (trimmed.length > 0 || rows.length < lines.length - 1) {
+      rows.push(parseCsvRow(trimmed));
+    }
+  }
+  return rows;
+}
+
+// ── Main entry point ──
+
+/**
+ * Get a CSV preview with optional row-based data pagination.
+ *
+ * When `includeData` is true, returns an NDJSON stream with:
+ *   `{t:'h', h:[headers]}` header message
+ *   `{t:'r', v:[[row1], [row2], ...]}` row data
+ *   `{t:'d'}` done
+ *
+ * When `includeData` is false, returns only the header message.
+ *
+ * Uses an in-memory line-offset cache so subsequent range requests read
+ * only the exact bytes needed (no redundant S3 reads).
+ */
+export async function getCsvPreview(
+  provider: StorageProvider,
+  key: string,
+  offset = 0,
+  limit = 250,
+  contentType: string,
+  totalSize: number,
+  requestLog: pino.Logger = fallbackLog,
+  includeData = false
+): Promise<Response> {
+  const log = requestLog.child({ module: 'csv-preview' });
+
+  if (totalSize === 0) {
+    return new Response(
+      JSON.stringify({ t: 'h', h: [], tr: 0 }) + '\n' + JSON.stringify({ t: 'd' }) + '\n',
+      {
+        headers: {
+          'Content-Type': 'application/x-ndjson',
+          'X-Preview-Format': 'csv',
+          'X-Preview-Renderable': 'true',
+          'X-Preview-Infinite-Scroll': String(infiniteScrollEnabled),
+          'X-Preview-Total-Size': '0',
+          'X-Preview-Total-Rows': '0',
+          'X-Preview-Offset': String(offset),
+          'Cache-Control': 'no-store'
+        }
+      }
+    );
+  }
+
+  let entry = csvPreviewCache.get(key);
+  const now = Date.now();
+
+  if (!entry || now - entry.lastAccessed > CSV_CACHE_TTL) {
+    entry = {
+      headers: [],
+      lineOffsets: [],
+      bytesRead: 0,
+      totalSize,
+      lastAccessed: now
+    };
+    csvPreviewCache.set(key, entry);
+  }
+
+  entry.lastAccessed = now;
+
+  const dataEndRow = offset + limit;
+
+  // Extend cache if needed
+  await extendCache(provider, key, entry, dataEndRow);
+
+  if (!includeData) {
+    return new Response(
+      JSON.stringify({ t: 'h', h: entry.headers, tr: entry.lineOffsets.length }) +
+        '\n' +
+        JSON.stringify({ t: 'd' }) +
+        '\n',
+      {
+        headers: {
+          'Content-Type': 'application/x-ndjson',
+          'X-Preview-Format': 'csv',
+          'X-Preview-Renderable': 'true',
+          'X-Preview-Infinite-Scroll': String(infiniteScrollEnabled),
+          'X-Preview-Total-Size': String(totalSize),
+          'X-Preview-Total-Rows': String(entry.lineOffsets.length),
+          'X-Preview-Offset': String(offset),
+          'Cache-Control': 'no-store'
+        }
+      }
+    );
+  }
+
+  const truncated = entry.lineOffsets.length < totalSize || dataEndRow < entry.lineOffsets.length;
+  const actualEndRow = Math.min(dataEndRow, entry.lineOffsets.length);
+
+  let rows: string[][];
+  if (offset < entry.lineOffsets.length) {
+    rows = await readRows(provider, key, entry, offset, actualEndRow);
+  } else {
+    rows = [];
+  }
+
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(
+        encoder.encode(
+          JSON.stringify({
+            t: 'h',
+            h: entry.headers,
+            tr: entry.lineOffsets.length
+          }) + '\n'
+        )
+      );
+
+      if (rows.length > 0) {
+        controller.enqueue(encoder.encode(JSON.stringify({ t: 'r', v: rows }) + '\n'));
+      }
+
+      controller.enqueue(encoder.encode(JSON.stringify({ t: 'd' }) + '\n'));
+      controller.close();
+    },
+    cancel() {
+      // client disconnected
+    }
+  });
+
+  log.info(
+    { key, offset, limit, rows_returned: rows.length, total_file_size: totalSize, truncated },
+    'csv preview chunk'
+  );
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'application/x-ndjson',
+      'X-Preview-Format': 'csv',
+      'X-Preview-Renderable': 'true',
+      'X-Preview-Infinite-Scroll': String(infiniteScrollEnabled),
+      'X-Preview-Truncated': String(truncated),
+      'X-Preview-Total-Size': String(totalSize),
+      'X-Preview-Total-Rows': String(entry.lineOffsets.length),
+      'X-Preview-Offset': String(offset),
+      'Cache-Control': 'no-store'
+    }
+  });
+}
diff --git a/src/lib/server/storage/preview/parquet.test.ts b/src/lib/server/storage/preview/parquet.test.ts
index 69215b2f..cdd0e361 100644
--- a/src/lib/server/storage/preview/parquet.test.ts
+++ b/src/lib/server/storage/preview/parquet.test.ts
@@ -36,7 +36,8 @@ vi.mock('$lib/server/feature-flags', () => ({
   filePreviewRows: 250,
   textPreviewBytes: 256 * 1024,
   imagePreviewBytes: 5 * 1024 * 1024,
-  pdfPreviewBytes: 25 * 1024 * 1024
+  pdfPreviewBytes: 25 * 1024 * 1024,
+  infiniteScrollEnabled: true
 }));
 
 import { getParquetPreview } from './parquet.js';
diff --git a/src/lib/server/storage/preview/parquet.ts b/src/lib/server/storage/preview/parquet.ts
index a6cc4328..6bd9fa23 100644
--- a/src/lib/server/storage/preview/parquet.ts
+++ b/src/lib/server/storage/preview/parquet.ts
@@ -13,6 +13,7 @@ import { logger } from '$lib/server/logging';
 import type { StorageProvider } from '$lib/server/storage/provider.js';
 import {
   parquetDisallowedCompression,
+  infiniteScrollEnabled,
   type ParquetDisallowedCompression
 } from '$lib/server/feature-flags';
 
@@ -448,6 +449,7 @@ export async function getParquetPreview(
         'Content-Type': 'application/x-ndjson',
         'X-Preview-Format': 'parquet',
         'X-Preview-Renderable': 'true',
+        'X-Preview-Infinite-Scroll': String(infiniteScrollEnabled),
         'X-Preview-Data-Blocked': 'false',
         'X-Preview-Total-Size': '0',
         'X-Preview-Total-Rows': '0',
@@ -526,6 +528,7 @@ export async function getParquetPreview(
           'Content-Type': 'application/x-ndjson',
           'X-Preview-Format': 'parquet',
           'X-Preview-Renderable': 'true',
+          'X-Preview-Infinite-Scroll': String(infiniteScrollEnabled),
           ...extraHeaders,
           'X-Preview-Total-Size': String(byteLength),
           'X-Preview-Total-Rows': String(totalRows),
@@ -546,6 +549,7 @@ export async function getParquetPreview(
           'Content-Type': 'application/x-ndjson',
           'X-Preview-Format': 'parquet',
           'X-Preview-Renderable': 'true',
+          'X-Preview-Infinite-Scroll': String(infiniteScrollEnabled),
           'X-Preview-Truncated': 'false',
           'X-Preview-Total-Size': String(byteLength),
           'X-Preview-Total-Rows': String(totalRows),
@@ -714,6 +718,7 @@ export async function getParquetPreview(
       'Content-Type': 'application/x-ndjson',
       'X-Preview-Format': 'parquet',
       'X-Preview-Renderable': 'true',
+      'X-Preview-Infinite-Scroll': String(infiniteScrollEnabled),
       'X-Preview-Truncated': String(truncated),
       'X-Preview-Total-Size': String(byteLength),
       'X-Preview-Total-Rows': String(totalRows),
diff --git a/src/routes/(app)/api/storage/preview/+server.ts b/src/routes/(app)/api/storage/preview/+server.ts
index c42e1890..6d5b0084 100644
--- a/src/routes/(app)/api/storage/preview/+server.ts
+++ b/src/routes/(app)/api/storage/preview/+server.ts
@@ -2,9 +2,11 @@ import { S3ServiceException } from '@aws-sdk/client-s3';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 import { getProvider } from '$lib/server/storage/utils.js';
 import { getParquetPreview } from '$lib/server/storage/preview/parquet';
+import { getCsvPreview } from '$lib/server/storage/preview/csv';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { requireBucketKey } from '../params.js';
+import { infiniteScrollEnabled, filePreviewRows } from '$lib/server/feature-flags';
 import type { RequestHandler } from './$types';
 
 /**
@@ -31,10 +33,16 @@ export const GET: RequestHandler = async ({ url, locals }) => {
       rawContentType === 'application/x-parquet' ||
       lowerKey.endsWith('.parquet');
 
-    const offset = parseInt(url.searchParams.get('offset') ?? '0', 10);
-    const limit = parseInt(url.searchParams.get('limit') ?? '250', 10);
+    let offset = parseInt(url.searchParams.get('offset') ?? '0', 10);
+    let limit = parseInt(url.searchParams.get('limit') ?? '250', 10);
     const includeData = url.searchParams.get('data') === 'true';
 
+    // When infinite scroll is disabled, restrict to the first page only (no chunked loading)
+    if (!infiniteScrollEnabled) {
+      offset = 0;
+      limit = Math.min(limit, filePreviewRows);
+    }
+
     if (isParquet) {
       return await getParquetPreview(provider, key, offset, limit, log, totalSize, includeData);
     }
@@ -56,6 +64,29 @@ export const GET: RequestHandler = async ({ url, locals }) => {
       else if (lowerKey.endsWith('.tsv')) contentType = 'text/tab-separated-values';
     }
 
+    // CSV files — use row-based NDJSON streaming (regardless of flag, so the
+    // client always receives structured data). The offset/limit cap above
+    // restricts chunked loading when the feature is disabled.
+    const isCsv =
+      contentType === 'text/csv' ||
+      contentType === 'application/csv' ||
+      contentType === 'text/tab-separated-values' ||
+      lowerKey.endsWith('.csv') ||
+      lowerKey.endsWith('.tsv');
+
+    if (isCsv) {
+      return await getCsvPreview(
+        provider,
+        key,
+        offset,
+        limit,
+        contentType,
+        totalSize,
+        log,
+        includeData
+      );
+    }
+
     // Pass a placeholder user identifier for logging purposes (no longer user-specific)
     return await streamPreview(provider, key, contentType, totalSize, 'client', log);
   } catch (err) {
diff --git a/src/routes/(app)/api/storage/preview/server.test.ts b/src/routes/(app)/api/storage/preview/server.test.ts
index 6100b52a..4a785ef9 100644
--- a/src/routes/(app)/api/storage/preview/server.test.ts
+++ b/src/routes/(app)/api/storage/preview/server.test.ts
@@ -15,6 +15,29 @@ vi.mock('$lib/server/storage/preview/stream.js', () => ({
   streamPreview: vi.fn(async () => new Response('preview content'))
 }));
 
+vi.mock('$lib/server/feature-flags', () => ({
+  infiniteScrollEnabled: false,
+  filePreviewRows: 250,
+  textPreviewBytes: 262144,
+  imagePreviewBytes: 5242880,
+  pdfPreviewBytes: 26214400,
+  archivePreviewMaxBytes: 104857600,
+  maxEditableFileSize: 5242880,
+  parquetDisallowedCompression: [],
+  completionEnabled: true,
+  storageBrowserEnabled: true
+}));
+
+vi.mock('$lib/server/storage/preview/csv.js', () => ({
+  getCsvPreview: vi.fn(async () => {
+    const body =
+      JSON.stringify({ t: 'h', h: ['a', 'b'] }) + '\n' + JSON.stringify({ t: 'd' }) + '\n';
+    return new Response(body, {
+      headers: { 'X-Preview-Format': 'csv', 'X-Preview-Renderable': 'true' }
+    });
+  })
+}));
+
 vi.mock('$lib/server/storage/preview/parquet.js', () => ({
   getParquetPreview: vi.fn(async () => {
     const body = JSON.stringify({ headers: ['a'], rows: [['1']], totalRows: 1 });
@@ -34,6 +57,7 @@ import { GET } from './+server.js';
 import { binaryPreview } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
 import { getParquetPreview } from '$lib/server/storage/preview/parquet.js';
+import { getCsvPreview } from '$lib/server/storage/preview/csv.js';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
 
 const CONNECTION_HEADER = {
@@ -69,13 +93,15 @@ describe('GET /api/storage/preview', () => {
 
     await GET(mockEvent('bucket=b1&key=data.csv'));
 
-    expect(streamPreview).toHaveBeenCalledWith(
+    expect(getCsvPreview).toHaveBeenCalledWith(
       expect.anything(),
       'data.csv',
+      0,
+      250,
       'text/csv',
       100,
-      'client',
-      expect.anything()
+      expect.anything(),
+      false
     );
   });
 
@@ -84,13 +110,15 @@ describe('GET /api/storage/preview', () => {
 
     await GET(mockEvent('bucket=b1&key=data.tsv'));
 
-    expect(streamPreview).toHaveBeenCalledWith(
+    expect(getCsvPreview).toHaveBeenCalledWith(
       expect.anything(),
       'data.tsv',
+      0,
+      250,
       'text/tab-separated-values',
       200,
-      'client',
-      expect.anything()
+      expect.anything(),
+      false
     );
   });
 
@@ -117,13 +145,15 @@ describe('GET /api/storage/preview', () => {
 
     await GET(mockEvent('bucket=b1&key=data.tsv'));
 
-    expect(streamPreview).toHaveBeenCalledWith(
+    expect(getCsvPreview).toHaveBeenCalledWith(
       expect.anything(),
       'data.tsv',
+      0,
+      250,
       'text/tab-separated-values',
       150,
-      'client',
-      expect.anything()
+      expect.anything(),
+      false
     );
   });
 
@@ -135,13 +165,15 @@ describe('GET /api/storage/preview', () => {
 
     await GET(mockEvent('bucket=b1&key=report.tsv'));
 
-    expect(streamPreview).toHaveBeenCalledWith(
+    expect(getCsvPreview).toHaveBeenCalledWith(
       expect.anything(),
       'report.tsv',
+      0,
+      250,
       'application/octet-stream',
       75,
-      'client',
-      expect.anything()
+      expect.anything(),
+      false
     );
   });
 
@@ -200,7 +232,7 @@ describe('GET /api/storage/preview', () => {
     expect(res.headers.get('X-Preview-Format')).toBe('parquet');
   });
 
-  it('passes offset and limit query params to getParquetPreview', async () => {
+  it('resets offset and caps limit when infinite scroll is disabled', async () => {
     mockGetMetadata.mockResolvedValue({
       contentType: 'application/x-parquet',
       size: 50000
@@ -211,7 +243,7 @@ describe('GET /api/storage/preview', () => {
     expect(getParquetPreview).toHaveBeenCalledWith(
       expect.anything(),
       'large.parquet',
-      500,
+      0,
       100,
       expect.anything(),
       50000,
diff --git a/src/test/setup-client.ts b/src/test/setup-client.ts
index d029071b..abde46ae 100644
--- a/src/test/setup-client.ts
+++ b/src/test/setup-client.ts
@@ -7,6 +7,7 @@ import { vi, beforeEach } from 'vitest';
 vi.mock('$lib/client/feature-flags.js', () => ({
   storageAutoConnectEnabled: false,
   storageRestoreTabsEnabled: false,
+  infiniteScrollEnabled: true,
   allowedPageSizes: [25, 50, 100],
   defaultPageSize: 25,
   maxRecentFiles: 15,

From 52d3a607841c2c749c131494929623156be8dc7c Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 15 Jul 2026 10:42:33 +0200
Subject: [PATCH 109/136] Feat/s3 file browser copy move rename (#228)

* #182 #183 #184 add rename, move, cut, copy, paste actions

* #182 #183 #184 fix rename, do conflict resolution, add paste on empty select, select on drag

* #182 #183 #184 fix rename conflict, recent files, paste multiple times

* #182 #183 #184 add error messages for new actions

* fix svelte check

* add unit test, add e2e test, fix lint

* add feature flag env entry for rename, paste, move actions

* #182 #183 #184 add move feature flag, add actions between tabs

* fix e2e test

* #182 #183 #184 improve progress tracker

* #182 #183 #184 improve progress tracker UX, save actions to localStorage

* add comment

* fix: resolve merge conflicts from feat/s3-file-browser-v1

* #182 #183 #184 add name conflict modal for move and paste actions, generalize conflict modal

* #184 fix rename folders

* #182 fix move folders

* allow the user to right click in empty folders, add create new items to right click

* #183 paste files into folder if that is the selected destination

* fix unit test

* fix paste broken by closed user connection, re-aquire ongoing actions

* various improvements to the progress display

* various improvements to the progress display

* stream download to frontend instead of saving in backend

* fix unit test

* fix e2e test

* #182 scroll table while dragging items

* #228 address code review, fix cancelling ongoing actions

* fix unit tests

* fix lint

* fix: resolve merge conflicts with DB migration from feat/s3-file-browser-v1

- connection.ts: use incoming async DB-based getConnectionFromHeader (replaces parseConnectionPayload)
- download.ts: use incoming blob-based download with connection ID (drop token-based streaming)
- hooks.server.ts: use incoming DB-aware middleware, preserve copy/job polling exclusion
- StorageBreadcrumb.svelte: use connectionStore/STORAGE_CONNECTION_ID_HEADER, keep move/drop imports
- TabBar.svelte: keep drag-to-tab storage state, use incoming bind:this renameInput approach
- state.svelte.ts: replace all loadConnectionLocally/getConnectionHeader with connectionStore
- StorageModals.svelte: replace old connection API with connectionStore
- Remove obsolete download/token endpoint (superseded by blob approach)

* fix lint

* fix flaky e2e test

* fix flaky e2e test 2

* fix: increase global timeout in Playwright configuration

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: dklOrdix <dkl@ordix.de>
---
 .env.example                                  |    4 +
 .env.test                                     |    4 +
 TECH_DEBT.md                                  |    8 +-
 dev/setup.sh                                  |    8 +
 e2e/storage/file-operations.spec.ts           |  477 +++++
 messages/de.json                              |   45 +
 messages/en.json                              |   45 +
 src/app.css                                   |    8 +
 src/hooks.server.ts                           |    5 +-
 src/lib/client/feature-flags.ts               |   29 +
 .../storage/explorer/ContextMenu.svelte       |  179 +-
 .../storage/explorer/FileExplorer.svelte      |   21 +-
 .../storage/explorer/FileRow.svelte           |   10 +
 .../storage/explorer/FolderRow.svelte         |   47 +
 .../storage/explorer/ObjectTable.svelte       |  183 +-
 .../storage/explorer/OperationsButton.svelte  |  502 +++++
 .../storage/explorer/StorageBreadcrumb.svelte |   92 +-
 .../components/storage/explorer/TabBar.svelte |   97 +-
 .../storage/explorer/TabBar.svelte.spec.ts    |   36 +-
 .../explorer/__tests__/TabBarWrapper.svelte   |   21 +
 .../storage/modals/CreateModal.svelte         |  113 ++
 .../storage/modals/MoveConfirmModal.svelte    |   95 +
 .../storage/modals/RenameModal.svelte         |   96 +
 .../storage/modals/StorageModals.svelte       |  105 ++
 .../ConflictEntry.svelte}                     |   11 +-
 .../shared/ConflictResolutionDialog.svelte    |  194 ++
 .../storage/modals/shared/conflict-types.ts   |   14 +
 .../upload/UploadConflictEntry.svelte.spec.ts |  308 ++--
 .../storage/modals/upload/UploadModal.svelte  |   15 +-
 .../components/storage/modals/upload/types.ts |   13 +-
 .../storage/sidebar/BucketList.svelte         |   47 +-
 src/lib/server/feature-flags.ts               |   24 +
 src/lib/server/storage/download-tokens.ts     |   38 +
 src/lib/server/storage/hdfs-provider.ts       |    4 +
 src/lib/server/storage/job-store.ts           |   96 +
 src/lib/server/storage/operations.ts          |   68 +
 .../server/storage/preview/parquet.test.ts    |    1 +
 src/lib/server/storage/preview/stream.test.ts |    1 +
 src/lib/server/storage/provider.ts            |   16 +
 src/lib/server/storage/s3-provider.test.ts    |  129 +-
 src/lib/server/storage/s3-provider.ts         |  116 +-
 src/lib/server/storage/streaming.ts           |   90 +
 src/lib/storage/drag-handlers.ts              |   43 +
 src/lib/storage/errors.ts                     |    4 +
 src/lib/storage/state.svelte.spec.ts          |  820 +++++++++
 src/lib/storage/state.svelte.ts               | 1634 ++++++++++++++++-
 src/lib/storage/tabs.svelte.ts                |   20 +
 src/lib/storage/types.ts                      |   90 +-
 src/routes/(app)/api/storage/copy/+server.ts  |  145 ++
 .../api/storage/copy/job/[jobId]/+server.ts   |   12 +
 .../(app)/api/storage/download/+server.ts     |   35 +-
 .../(app)/api/storage/download/server.test.ts |    2 +-
 src/routes/(app)/api/storage/move/+server.ts  |  158 ++
 .../(app)/api/storage/rename/+server.ts       |   78 +
 src/test/setup-client.ts                      |    7 +-
 55 files changed, 6143 insertions(+), 320 deletions(-)
 create mode 100644 e2e/storage/file-operations.spec.ts
 create mode 100644 src/lib/components/storage/explorer/OperationsButton.svelte
 create mode 100644 src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte
 create mode 100644 src/lib/components/storage/modals/CreateModal.svelte
 create mode 100644 src/lib/components/storage/modals/MoveConfirmModal.svelte
 create mode 100644 src/lib/components/storage/modals/RenameModal.svelte
 rename src/lib/components/storage/modals/{upload/UploadConflictEntry.svelte => shared/ConflictEntry.svelte} (93%)
 create mode 100644 src/lib/components/storage/modals/shared/ConflictResolutionDialog.svelte
 create mode 100644 src/lib/components/storage/modals/shared/conflict-types.ts
 create mode 100644 src/lib/server/storage/download-tokens.ts
 create mode 100644 src/lib/server/storage/job-store.ts
 create mode 100644 src/lib/server/storage/operations.ts
 create mode 100644 src/lib/server/storage/streaming.ts
 create mode 100644 src/lib/storage/drag-handlers.ts
 create mode 100644 src/lib/storage/state.svelte.spec.ts
 create mode 100644 src/routes/(app)/api/storage/copy/+server.ts
 create mode 100644 src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts
 create mode 100644 src/routes/(app)/api/storage/move/+server.ts
 create mode 100644 src/routes/(app)/api/storage/rename/+server.ts

diff --git a/.env.example b/.env.example
index b08b46d7..2fb82cac 100644
--- a/.env.example
+++ b/.env.example
@@ -41,3 +41,7 @@ STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=your-client-secret
 # PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=1048576  # Max file size (in bytes) of editable text files in the storage browser (default: 5 MiB)
 # PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3  # Maximum number of concurrent file uploads (default: 3)
 # PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true  # Enable infinite scroll in the storage browser (default: true)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true  # Enables cut/copy/paste functionality in the storage browser (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true  # Enables paste functionality in the storage browser (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true  # Enables rename functionality in the storage browser (default: false)
+# PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true  # Enables move functionality in the storage browser (default: false)
diff --git a/.env.test b/.env.test
index 1ad86088..925b4132 100644
--- a/.env.test
+++ b/.env.test
@@ -18,6 +18,10 @@ PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
 PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
 GARAGE_ADMIN_URL=http://localhost:30902
 GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token
 BETTER_AUTH_URL=http://localhost:4173
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index a2073ed2..2077fbe2 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -36,11 +36,13 @@ Previously, S3 connection credentials were persisted in plaintext `localStorage`
 
 ---
 
-### Download endpoint buffers entire object in browser memory
+### Download token store is in-memory only
 
-**File:** `src/lib/storage/download.ts`
+**File:** `src/lib/server/storage/download-tokens.ts`
 
-`downloadObject` fetches the full S3 object body via the `/api/storage/download` endpoint, buffers it as a `Blob` in browser memory, then triggers a programmatic anchor click. This is simpler than streaming directly to disk but means the entire object must fit in browser memory before the save dialog appears. Acceptable for the current object sizes; for very large files (multiple GiB) this will cause memory pressure. Long-term fix: use the [File System Access API](https://developer.mozilla.org/en-US/docs/Web/API/File_System_Access_API) `createWritable()` to stream bytes directly to disk without buffering, with a fallback to the current Blob approach for Firefox (which does not support `showSaveFilePicker`).
+The `downloadObject` function no longer buffers objects in browser memory. It now uses a token exchange flow: a HEAD pre-flight validates access, the client exchanges the connection header for a short-lived token via `POST /api/storage/download/token`, then navigates to the download URL with that token. The browser streams the object directly to disk — no JavaScript-side buffering.
+
+The token store is an in-memory `Map<string, TokenEntry>`. Tokens expire after 60 seconds and are single-use. In a multi-process or serverless deployment, the in-memory store would not be shared across instances. The long-term fix is to use a shared store (Redis or signed JWTs that need no server-side state).
 
 ---
 
diff --git a/dev/setup.sh b/dev/setup.sh
index 3e6a4f31..a4160374 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -321,6 +321,10 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
 PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
 DATABASE_HOST=localhost
 DATABASE_PORT=31432
 DATABASE_NAME=cockpit
@@ -350,6 +354,10 @@ PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
 PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
 PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
 PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
 DATABASE_HOST=localhost
 DATABASE_PORT=31432
 DATABASE_NAME=cockpit
diff --git a/e2e/storage/file-operations.spec.ts b/e2e/storage/file-operations.spec.ts
new file mode 100644
index 00000000..4223595a
--- /dev/null
+++ b/e2e/storage/file-operations.spec.ts
@@ -0,0 +1,477 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  objectExists,
+  putDirectoryMarker,
+  putTextObject,
+  rowByName,
+  uniquePrefix,
+  getObjectText
+} from './helpers.js';
+
+test.describe('Storage S3 — File Operations', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  // ──────────────────────────────────────────────────────────────────────────
+  // Cut + Paste
+  // ──────────────────────────────────────────────────────────────────────────
+
+  test('cut via context menu and paste moves file (original deleted)', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'cut-paste');
+    const srcKey = `${prefix}source/`;
+    const srcFile = `${srcKey}cut-me.txt`;
+    const cleanupKeys = [srcFile, `${prefix}cut-me.txt`];
+
+    try {
+      await putDirectoryMarker(client, credentials.bucket, srcKey);
+      await putTextObject(client, credentials.bucket, srcFile, 'cut paste test');
+
+      await connectAndOpenPrefix(page, credentials, srcKey);
+
+      // Right-click the file and choose Cut
+      await rowByName(page, 'cut-me.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Cut' }).click();
+
+      // Navigate to parent prefix in-app (preserves clipboard)
+      await page.locator('tbody tr').first().click();
+      await page.waitForTimeout(500);
+
+      // Click on table to focus it, then Ctrl+V to paste
+      await page.locator('table').click();
+      await page.keyboard.press('Control+v');
+
+      // Wait for paste to complete
+      await page.waitForTimeout(1000);
+
+      // File should exist at dest (moved)
+      expect(await objectExists(client, credentials.bucket, `${prefix}cut-me.txt`)).toBe(true);
+      // Original should be deleted (cut = move)
+      expect(await objectExists(client, credentials.bucket, srcFile)).toBe(false);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('pastes to a nested folder via context menu', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'cut-paste-nested');
+    const srcFile = `${prefix}nested-src.txt`;
+    const destDir = `${prefix}target/`;
+    const cleanupKeys = [srcFile, destDir];
+
+    try {
+      await putTextObject(client, credentials.bucket, srcFile, 'nested paste');
+      await putDirectoryMarker(client, credentials.bucket, destDir);
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Copy file
+      await rowByName(page, 'nested-src.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Copy', exact: true }).click();
+
+      // Navigate into dest folder
+      await rowByName(page, 'target').dblclick();
+      await page.waitForTimeout(500);
+
+      // Paste (use keyboard shortcut — right-click in an empty folder
+      // lands on the ".." row which has no context menu handler)
+      await page.locator('table').click();
+      await page.keyboard.press('Control+v');
+
+      await page.waitForTimeout(1000);
+
+      expect(await objectExists(client, credentials.bucket, `${destDir}nested-src.txt`)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('paste with deleted source shows error toast', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'paste-deleted');
+    const srcFile = `${prefix}gone.txt`;
+    const cleanupKeys = [srcFile];
+
+    try {
+      await putTextObject(client, credentials.bucket, srcFile, 'will be deleted');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Copy the file
+      await rowByName(page, 'gone.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Copy', exact: true }).click();
+
+      // Delete the file via S3 directly (simulate race condition / out-of-band delete)
+      await deleteKnownKeys(client, credentials.bucket, [srcFile]);
+
+      // Navigate to bucket root via ".." row (preserves clipboard)
+      await page.locator('tbody tr').first().click();
+      await page.waitForTimeout(500);
+
+      await page.locator('tbody').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Paste' }).click();
+
+      await page.waitForTimeout(1000);
+
+      // Should show error toast about source not found
+      await expect(page.getByText(/could not paste|source.*deleted/i)).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  // ──────────────────────────────────────────────────────────────────────────
+  // Copy + Paste (multiple destinations)
+  // ──────────────────────────────────────────────────────────────────────────
+
+  test('copy and paste to multiple destinations', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'multi-paste');
+    const srcFile = `${prefix}multi.txt`;
+    const dest1 = `${prefix}d1/`;
+    const dest2 = `${prefix}d2/`;
+    const cleanupKeys = [srcFile, dest1, dest2];
+
+    try {
+      await putTextObject(client, credentials.bucket, srcFile, 'multi paste');
+      await putDirectoryMarker(client, credentials.bucket, dest1);
+      await putDirectoryMarker(client, credentials.bucket, dest2);
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Copy file
+      await rowByName(page, 'multi.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Copy', exact: true }).click();
+
+      // Navigate into first destination and paste
+      await rowByName(page, 'd1').dblclick();
+      await page.waitForTimeout(500);
+      await page.locator('table').click();
+      await page.keyboard.press('Control+v');
+      await page.waitForTimeout(1000);
+
+      expect(await objectExists(client, credentials.bucket, `${dest1}multi.txt`)).toBe(true);
+
+      // Navigate back to prefix then into second destination
+      await page.locator('tbody tr').first().click();
+      await page.waitForTimeout(500);
+      await rowByName(page, 'd2').dblclick();
+      await page.waitForTimeout(500);
+      await page.locator('table').click();
+      await page.keyboard.press('Control+v');
+      await page.waitForTimeout(1000);
+
+      expect(await objectExists(client, credentials.bucket, `${dest2}multi.txt`)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  // ──────────────────────────────────────────────────────────────────────────
+  // Rename
+  // ──────────────────────────────────────────────────────────────────────────
+
+  test('renames a file via context menu', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'rename');
+    const oldKey = `${prefix}old-name.txt`;
+    const newKey = `${prefix}new-name.txt`;
+    const cleanupKeys = [oldKey, newKey];
+
+    try {
+      await putTextObject(client, credentials.bucket, oldKey, 'rename test');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await rowByName(page, 'old-name.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Rename' }).click();
+
+      // Modal should be open with the name pre-filled and selected
+      const input = page.locator('.modal-box input');
+      await expect(input).toBeVisible();
+
+      // Clear and type new name
+      await input.fill('new-name.txt');
+      await page.getByRole('button', { name: 'Rename' }).click();
+
+      await page.waitForTimeout(1000);
+
+      // Old name should be gone, new name should exist
+      expect(await objectExists(client, credentials.bucket, oldKey)).toBe(false);
+      expect(await objectExists(client, credentials.bucket, newKey)).toBe(true);
+
+      // Content should be preserved
+      const content = await getObjectText(client, credentials.bucket, newKey);
+      expect(content).toBe('rename test');
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('rename conflict shows error inside modal', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'rename-conflict');
+    const fileA = `${prefix}a.txt`;
+    const fileB = `${prefix}b.txt`;
+    const cleanupKeys = [fileA, fileB];
+
+    try {
+      await putTextObject(client, credentials.bucket, fileA, 'file a');
+      await putTextObject(client, credentials.bucket, fileB, 'file b');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Right-click file A and choose rename
+      await rowByName(page, 'a.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Rename' }).click();
+
+      // Try to rename to b.txt (which exists)
+      const input = page.locator('.modal-box input');
+      await input.fill('b.txt');
+      await page.getByRole('button', { name: 'Rename' }).click();
+
+      // Modal should stay open and show conflict error
+      await expect(page.locator('.modal-box')).toBeVisible();
+      await expect(page.getByText(/already exists/i)).toBeVisible();
+
+      // Cancel the modal
+      await page.getByRole('button', { name: 'Cancel' }).click();
+      await expect(page.locator('.modal-box')).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  // ──────────────────────────────────────────────────────────────────────────
+  // Keyboard shortcuts
+  // ──────────────────────────────────────────────────────────────────────────
+
+  test('Ctrl+C copies and Ctrl+V pastes a file', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'kb-copy-paste');
+    const srcKey = `${prefix}src/`;
+    const srcFile = `${srcKey}kb-test.txt`;
+    const cleanupKeys = [srcFile];
+
+    try {
+      await putDirectoryMarker(client, credentials.bucket, srcKey);
+      await putTextObject(client, credentials.bucket, srcFile, 'kb test');
+
+      await connectAndOpenPrefix(page, credentials, srcKey);
+
+      // Select the file
+      await rowByName(page, 'kb-test.txt').click();
+
+      // Press Ctrl+C to copy
+      await page.keyboard.press('Control+c');
+      await page.waitForTimeout(300);
+
+      // Navigate to parent prefix in-app (preserves clipboard)
+      await page.locator('tbody tr').first().click();
+      await page.waitForTimeout(500);
+
+      // Select somewhere to focus the page, then Ctrl+V
+      await page.locator('table').click();
+      await page.keyboard.press('Control+v');
+
+      await page.waitForTimeout(1000);
+
+      expect(await objectExists(client, credentials.bucket, `${prefix}kb-test.txt`)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('F2 renames a selected file', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'kb-rename');
+    const oldKey = `${prefix}f2-old.txt`;
+    const newKey = `${prefix}f2-new.txt`;
+    const cleanupKeys = [oldKey, newKey];
+
+    try {
+      await putTextObject(client, credentials.bucket, oldKey, 'f2 rename');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Select the file
+      await rowByName(page, 'f2-old.txt').click();
+
+      // Press F2 to open rename modal
+      await page.keyboard.press('F2');
+      await expect(page.locator('.modal-box')).toBeVisible();
+
+      // Fill new name
+      const input = page.locator('.modal-box input');
+      await input.fill('f2-new.txt');
+      await page.keyboard.press('Enter');
+
+      await page.waitForTimeout(1000);
+
+      expect(await objectExists(client, credentials.bucket, oldKey)).toBe(false);
+      expect(await objectExists(client, credentials.bucket, newKey)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('Ctrl+X cuts and Ctrl+V pastes a file', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'kb-cut-paste');
+    const srcKey = `${prefix}cutsrc/`;
+    const srcFile = `${srcKey}cut-kb.txt`;
+    const cleanupKeys = [srcFile];
+
+    try {
+      await putDirectoryMarker(client, credentials.bucket, srcKey);
+      await putTextObject(client, credentials.bucket, srcFile, 'cut kb test');
+
+      await connectAndOpenPrefix(page, credentials, srcKey);
+
+      // Select the file
+      await rowByName(page, 'cut-kb.txt').click();
+
+      // Ctrl+X to cut
+      await page.keyboard.press('Control+x');
+      await page.waitForTimeout(300);
+
+      // Navigate to parent prefix in-app (preserves clipboard)
+      await page.locator('tbody tr').first().click();
+      await page.waitForTimeout(500);
+
+      // Paste
+      await page.locator('table').click();
+      await page.keyboard.press('Control+v');
+
+      await page.waitForTimeout(1000);
+
+      // File should exist at destination
+      expect(await objectExists(client, credentials.bucket, `${prefix}cut-kb.txt`)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  // ──────────────────────────────────────────────────────────────────────────
+  // Drag-and-drop (move)
+  // ──────────────────────────────────────────────────────────────────────────
+
+  test('drags a file onto a folder to move it', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'drag-move');
+    const destFolder = `${prefix}dest-folder/`;
+    const srcFile = `${prefix}drag-me.txt`;
+    const destFile = `${destFolder}drag-me.txt`;
+    const cleanupKeys = [srcFile, destFolder];
+
+    try {
+      await putTextObject(client, credentials.bucket, srcFile, 'drag move test');
+      await putDirectoryMarker(client, credentials.bucket, destFolder);
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Get source row and destination folder row positions
+      const sourceRow = rowByName(page, 'drag-me.txt');
+      const destRow = rowByName(page, 'dest-folder');
+
+      await sourceRow.dragTo(destRow);
+
+      // Confirm the move in the dialog
+      await page.getByRole('button', { name: 'Move' }).click();
+
+      await page.waitForTimeout(2000);
+
+      // File should be moved to destination folder
+      expect(await objectExists(client, credentials.bucket, srcFile)).toBe(false);
+      expect(await objectExists(client, credentials.bucket, destFile)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('drags a file onto parent directory row to move it up', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'drag-up');
+    const subDir = `${prefix}sub/`;
+    const srcFile = `${subDir}up.txt`;
+    const cleanupKeys = [srcFile];
+
+    try {
+      await putDirectoryMarker(client, credentials.bucket, subDir);
+      await putTextObject(client, credentials.bucket, srcFile, 'move up');
+
+      await connectAndOpenPrefix(page, credentials, subDir);
+
+      // Drag file onto parent directory ".." row
+      const sourceRow = rowByName(page, 'up.txt');
+      const parentRow = page.locator('tbody tr').first(); // ".." parent row
+
+      await sourceRow.dragTo(parentRow);
+
+      // Confirm the move in the dialog
+      await page.getByRole('button', { name: 'Move' }).click();
+
+      await page.waitForTimeout(2000);
+
+      // File should be at parent prefix
+      expect(await objectExists(client, credentials.bucket, `${prefix}up.txt`)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('cancels drag-and-drop move via confirmation dialog', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'drag-cancel');
+    const destFolder = `${prefix}dest/`;
+    const srcFile = `${prefix}stay-here.txt`;
+    const cleanupKeys = [srcFile, destFolder];
+
+    try {
+      await putTextObject(client, credentials.bucket, srcFile, 'should not move');
+      await putDirectoryMarker(client, credentials.bucket, destFolder);
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      const sourceRow = rowByName(page, 'stay-here.txt');
+      const destRow = rowByName(page, 'dest');
+      await sourceRow.dragTo(destRow);
+
+      // Cancel the move
+      await page.getByRole('button', { name: 'Cancel' }).click();
+
+      // File should still be at original location
+      expect(await objectExists(client, credentials.bucket, srcFile)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/messages/de.json b/messages/de.json
index 3dbff7b3..ec83cf85 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -451,6 +451,51 @@
   "storage_archive_open_error": "Archiv konnte nicht geöffnet werden. Das Format wird möglicherweise nicht unterstützt oder das Archiv ist beschädigt.",
   "storage_archive_too_large": "Archiv ist zu groß für die Vorschau.",
   "storage_archive_exit": "Archiv verlassen",
+  "storage_action_cut_success": "{count} Element(e) ausgeschnitten",
+  "storage_action_copy_success": "{count} Element(e) kopiert",
+  "storage_action_paste_success": "{count} Element(e) eingefügt",
+  "storage_action_paste_error": "Elemente konnten nicht eingefügt werden. Bitte versuchen Sie es erneut.",
+  "storage_action_paste_partial": "{count} Element(e) konnten nicht eingefügt werden.",
+  "storage_action_paste_error_source_not_found": "Einfügen fehlgeschlagen — die Quell-Elemente wurden möglicherweise gelöscht oder verschoben.",
+  "storage_action_paste_archive_error": "Einfügen innerhalb eines Archivs nicht möglich.",
+  "storage_action_move_success": "{count} Element(e) verschoben",
+  "storage_action_move_partial": "{count} Element(e) konnten nicht verschoben werden.",
+  "storage_action_move_error": "Elemente konnten nicht verschoben werden. Bitte versuchen Sie es erneut.",
+  "storage_action_move_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
+  "storage_action_move_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung zum Verschieben.",
+  "storage_move_confirm_title": "Elemente verschieben",
+  "storage_move_confirm_body": "{count} Element(e) nach \"{destination}\" verschieben?",
+  "storage_move_confirm_label": "Verschieben",
+  "storage_move_confirm_cancel": "Abbrechen",
+  "storage_move_confirm_more": "+{count} mehr",
+  "storage_move_confirm_total_size": "Gesamt: {size}",
+  "storage_operation_move_one": "{count} Datei verschieben",
+  "storage_operation_move_other": "{count} Dateien verschieben",
+  "storage_operation_paste_one": "{count} Datei einfügen",
+  "storage_operation_paste_other": "{count} Dateien einfügen",
+  "storage_operation_rename": "Umbenennen",
+  "storage_operation_done": "Fertig",
+  "storage_operation_failed": "Fehlgeschlagen",
+  "storage_operation_cancelled": "Abgebrochen",
+  "storage_operation_interrupted": "Unterbrochen",
+  "storage_operations_label": "Vorgänge",
+  "storage_operations_cancel": "Vorgang abbrechen",
+  "storage_operations_progress": "{completed} von {total} fertig",
+  "storage_operations_error_generic": "Ein Fehler ist aufgetreten",
+  "storage_operations_active": "Aktiv",
+  "storage_operations_history": "Verlauf",
+  "storage_operations_clear_history": "Verlauf löschen",
+  "storage_operations_interrupted_tooltip": "Dieser Vorgang wurde durch ein Neuladen der Seite unterbrochen",
+  "storage_operations_speed": "Geschwindigkeit",
+  "storage_operations_remaining": "verbleibend",
+  "storage_action_rename_inline_label": "Neuer Name",
+  "storage_action_rename_inline_cancel": "Abbrechen",
+  "storage_rename_success": "In „{name}“ umbenannt.",
+  "storage_rename_error": "„{name}“ konnte nicht umbenannt werden. Bitte versuchen Sie es erneut.",
+  "storage_rename_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
+  "storage_rename_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung zum Umbenennen.",
+  "storage_rename_error_not_found": "Das Element wurde nicht gefunden. Es wurde möglicherweise verschoben oder gelöscht.",
+  "storage_rename_error_conflict": "Eine Datei oder ein Ordner namens „{name}“ ist an diesem Ort bereits vorhanden.",
   "timestamp_just_now": "gerade eben",
   "timestamp_minutes_ago": [
     {
diff --git a/messages/en.json b/messages/en.json
index 0c700c7c..acd8753d 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -451,6 +451,51 @@
   "storage_archive_open_error": "Could not open archive. The format may be unsupported or the archive is corrupt.",
   "storage_archive_too_large": "Archive is too large to preview.",
   "storage_archive_exit": "Exit archive",
+  "storage_action_cut_success": "{count} item(s) cut",
+  "storage_action_copy_success": "{count} item(s) copied",
+  "storage_action_paste_success": "{count} item(s) pasted",
+  "storage_action_paste_error": "Could not paste items. Please try again.",
+  "storage_action_paste_partial": "{count} item(s) could not be pasted.",
+  "storage_action_paste_error_source_not_found": "Could not paste — the source items may have been deleted or moved.",
+  "storage_action_paste_archive_error": "Cannot paste inside an archive.",
+  "storage_action_move_success": "{count} item(s) moved",
+  "storage_action_move_partial": "{count} item(s) could not be moved.",
+  "storage_action_move_error": "Could not move items. Please try again.",
+  "storage_action_move_error_not_connected": "No storage connection configured. Please connect first.",
+  "storage_action_move_error_access_denied": "Access denied. You do not have permission to move items.",
+  "storage_move_confirm_title": "Move items",
+  "storage_move_confirm_body": "Move {count} item(s) to \"{destination}\"?",
+  "storage_move_confirm_label": "Move",
+  "storage_move_confirm_cancel": "Cancel",
+  "storage_move_confirm_more": "+{count} more",
+  "storage_move_confirm_total_size": "Total: {size}",
+  "storage_operation_move_one": "Move {count} file",
+  "storage_operation_move_other": "Move {count} files",
+  "storage_operation_paste_one": "Paste {count} file",
+  "storage_operation_paste_other": "Paste {count} files",
+  "storage_operation_rename": "Rename",
+  "storage_operation_done": "Done",
+  "storage_operation_failed": "Failed",
+  "storage_operation_cancelled": "Cancelled",
+  "storage_operation_interrupted": "Interrupted",
+  "storage_operations_label": "Operations",
+  "storage_operations_cancel": "Cancel operation",
+  "storage_operations_progress": "{completed} of {total} done",
+  "storage_operations_error_generic": "An error occurred",
+  "storage_operations_active": "Active",
+  "storage_operations_history": "History",
+  "storage_operations_clear_history": "Clear history",
+  "storage_operations_interrupted_tooltip": "This operation was interrupted by a page reload",
+  "storage_operations_speed": "Speed",
+  "storage_operations_remaining": "remaining",
+  "storage_action_rename_inline_label": "New name",
+  "storage_action_rename_inline_cancel": "Cancel",
+  "storage_rename_success": "Renamed to \"{name}\".",
+  "storage_rename_error": "Could not rename \"{name}\". Please try again.",
+  "storage_rename_error_not_connected": "No storage connection configured. Please connect first.",
+  "storage_rename_error_access_denied": "Access denied. You do not have permission to rename.",
+  "storage_rename_error_not_found": "The item could not be found. It may have been moved or deleted.",
+  "storage_rename_error_conflict": "A file or folder named \"{name}\" already exists in this location.",
   "timestamp_just_now": "just now",
   "timestamp_minutes_ago": [
     {
diff --git a/src/app.css b/src/app.css
index 30b34902..f95457a3 100644
--- a/src/app.css
+++ b/src/app.css
@@ -24,6 +24,14 @@ progress.progress::-moz-progress-bar {
   transition: none;
 }
 
+/* Smooth transition for operation progress bars where discrete chunk updates benefit from animation */
+progress.progress.progress-smooth::-webkit-progress-value {
+  transition: width 0.4s ease;
+}
+progress.progress.progress-smooth::-moz-progress-bar {
+  transition: width 0.4s ease;
+}
+
 /*
  * Visible scrollbars for preview panels. Uses DaisyUI semantic color variables
  * so the thumb adapts to both light and dark themes automatically.
diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index 4bb9057e..731f4d06 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -90,9 +90,12 @@ const handleStorageConnection: Handle = async ({ event, resolve }) => {
   }
   // The connections management endpoint itself does not require a connection header —
   // it is used to list/create connections before one is selected.
+  // The copy/job polling endpoint also does not require a connection header —
+  // it reads job status from the server-side job store.
   const requiresConnectionHeader =
     event.route.id?.startsWith('/(app)/api/storage/') &&
-    !event.route.id?.startsWith('/(app)/api/storage/connections');
+    !event.route.id?.startsWith('/(app)/api/storage/connections') &&
+    !event.route.id?.startsWith('/(app)/api/storage/copy/job/');
   if (event.locals.storageConfig === null && requiresConnectionHeader) {
     throw error(401, 'No storage connection configured');
   }
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index 77b8495c..43e34c03 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -107,3 +107,32 @@ export const uploadConcurrency: number = (() => {
   const parsed = parseInt(env.PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY ?? '', 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 3;
 })();
+
+// ── Storage browser: Context actions (cut, copy, paste, rename) ────────────
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true`, the context
+ *  menu shows "Cut" and "Copy" actions and Ctrl+X / Ctrl+C keyboard shortcuts
+ *  are active. These are costly S3 operations (list + copy) on most backends.
+ *  Disabled by default. */
+export const storageCutCopyEnabled =
+  (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED ?? 'false') === 'true';
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true`, the context
+ *  menu shows "Paste" (when clipboard is non-empty) and Ctrl+V is active
+ *  to paste cut/copied items into the current prefix. Disabled by default. */
+export const storagePasteEnabled =
+  (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED ?? 'false') === 'true';
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true`, the context
+ *  menu shows "Rename" and F2 is active to rename the selected item.
+ *  Disabled by default. */
+export const storageRenameEnabled =
+  (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED ?? 'false') === 'true';
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true`, drag-and-drop
+ *  move is active (folder-row, breadcrumb, sidebar, and tab drop targets).
+ *  This is a separate flag from paste because move is a costly S3 operation
+ *  (list + copy + delete per directory level) and may be undesirable in
+ *  high-egress-cost environments. Disabled by default. */
+export const storageMoveEnabled =
+  (env.PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED ?? 'false') === 'true';
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index cff1fa3c..7839a8b8 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -9,9 +9,20 @@
   import IconDelete from 'virtual:icons/material-symbols/delete';
   import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
   import IconFileCopy from 'virtual:icons/material-symbols/file-copy-outline';
+  import IconCut from 'virtual:icons/material-symbols/content-cut';
+  import IconCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconPaste from 'virtual:icons/material-symbols/content-paste';
+  import IconDriveFileRenameOutline from 'virtual:icons/material-symbols/drive-file-rename-outline';
+  import IconDescriptionOutline from 'virtual:icons/material-symbols/description-outline';
+  import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import type { ActionName } from '$lib/storage/types.js';
+  import {
+    storageCutCopyEnabled,
+    storagePasteEnabled,
+    storageRenameEnabled
+  } from '$lib/client/feature-flags.js';
 
   const storage = getStorageState();
 
@@ -19,6 +30,7 @@
   const x = $derived(storage.contextMenu?.x ?? 0);
   const y = $derived(storage.contextMenu?.y ?? 0);
   const selectionCount = $derived(storage.selectedKeys.size);
+  const hasCtxKey = $derived(!!storage.contextMenu?.key);
   const canPreview = $derived(
     (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0) ||
       (storage.contextMenu !== null && storage.ctxIsFile)
@@ -56,53 +68,132 @@
     return () => document.removeEventListener('click', handleOutsideClick, true);
   });
 
-  const actions = $derived([
-    {
-      key: 'preview' as ActionName,
-      icon: IconVisibility as Component,
-      label: m.storage_action_preview(),
-      disabled: !canPreview,
-      hidden: false
-    },
-    {
-      key: 'download' as ActionName,
-      icon: IconDownload as Component,
-      label: m.storage_action_download(),
-      disabled: !canDownload,
-      hidden: false
-    },
-    {
-      key: 'copy-filename' as ActionName,
-      icon: IconFileCopy as Component,
-      label: m.storage_action_copy_filename(),
-      disabled: storage.contextMenu === null,
-      hidden: false
-    },
-    {
-      key: 'copy-path' as ActionName,
-      icon: IconContentCopy as Component,
-      label: m.storage_action_copy_path(),
-      disabled: storage.contextMenu === null,
-      hidden: false
-    },
-    {
-      key: 'pin' as ActionName,
-      icon: IconPushPinOutline as Component,
-      label: m.storage_action_pin(),
-      disabled: !storage.canPin || storage.isInArchive,
-      hidden: !storage.canPin || storage.ctxIsPinned || storage.isInArchive
-    },
-    {
-      key: 'unpin' as ActionName,
-      icon: IconPushPin as Component,
-      label: m.storage_action_unpin(),
-      disabled: !storage.ctxIsPinned || storage.isInArchive,
-      hidden: !storage.ctxIsPinned || storage.isInArchive
+  const actions = $derived.by<
+    Array<{
+      key: ActionName;
+      icon: Component;
+      label: string;
+      disabled: boolean;
+      hidden: boolean;
+      class?: string;
+    }>
+  >(() => {
+    const items: Array<{
+      key: ActionName;
+      icon: Component;
+      label: string;
+      disabled: boolean;
+      hidden: boolean;
+      class?: string;
+    }> = [];
+
+    // Empty-space: show create options and paste
+    if (!hasCtxKey) {
+      items.push(
+        {
+          key: 'create-file' as ActionName,
+          icon: IconDescriptionOutline as Component,
+          label: m.storage_create_file(),
+          disabled: false,
+          hidden: storage.isInArchive
+        },
+        {
+          key: 'create-folder' as ActionName,
+          icon: IconFolderOutline as Component,
+          label: m.storage_create_folder(),
+          disabled: false,
+          hidden: storage.isInArchive
+        },
+        {
+          key: 'paste' as ActionName,
+          icon: IconPaste as Component,
+          label: m.storage_action_paste(),
+          disabled: storage.clipboard === null || storage.isInArchive,
+          hidden: !storagePasteEnabled || storage.isInArchive
+        }
+      );
+      return items;
     }
-  ]);
+
+    // Item-specific actions
+    items.push(
+      {
+        key: 'preview' as ActionName,
+        icon: IconVisibility as Component,
+        label: m.storage_action_preview(),
+        disabled: !canPreview,
+        hidden: false
+      },
+      {
+        key: 'download' as ActionName,
+        icon: IconDownload as Component,
+        label: m.storage_action_download(),
+        disabled: !canDownload,
+        hidden: false
+      },
+      {
+        key: 'cut' as ActionName,
+        icon: IconCut as Component,
+        label: m.storage_action_cut(),
+        disabled: selectionCount === 0 || storage.isInArchive,
+        hidden: !storageCutCopyEnabled || storage.isInArchive
+      },
+      {
+        key: 'copy' as ActionName,
+        icon: IconCopy as Component,
+        label: m.storage_action_copy(),
+        disabled: selectionCount === 0 || storage.isInArchive,
+        hidden: !storageCutCopyEnabled || storage.isInArchive
+      },
+      {
+        key: 'paste' as ActionName,
+        icon: IconPaste as Component,
+        label: m.storage_action_paste(),
+        disabled: storage.clipboard === null || storage.isInArchive,
+        hidden: !storagePasteEnabled || storage.isInArchive
+      },
+      {
+        key: 'rename' as ActionName,
+        icon: IconDriveFileRenameOutline as Component,
+        label: m.storage_action_rename(),
+        disabled: selectionCount !== 1 || storage.isInArchive,
+        hidden: !storageRenameEnabled || storage.isInArchive
+      },
+      {
+        key: 'copy-filename' as ActionName,
+        icon: IconFileCopy as Component,
+        label: m.storage_action_copy_filename(),
+        disabled: !hasCtxKey,
+        hidden: false
+      },
+      {
+        key: 'copy-path' as ActionName,
+        icon: IconContentCopy as Component,
+        label: m.storage_action_copy_path(),
+        disabled: !hasCtxKey,
+        hidden: false
+      },
+      {
+        key: 'pin' as ActionName,
+        icon: IconPushPinOutline as Component,
+        label: m.storage_action_pin(),
+        disabled: !storage.canPin || storage.isInArchive,
+        hidden: !storage.canPin || storage.ctxIsPinned || storage.isInArchive
+      },
+      {
+        key: 'unpin' as ActionName,
+        icon: IconPushPin as Component,
+        label: m.storage_action_unpin(),
+        disabled: !storage.ctxIsPinned || storage.isInArchive,
+        hidden: !storage.ctxIsPinned || storage.isInArchive
+      }
+    );
+
+    return items;
+  });
 
   const dangerActions = $derived(
-    storage.isInArchive
+    storage.isInArchive || !hasCtxKey
       ? []
       : [
           {
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index a5552d4a..0b059bdf 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -53,6 +53,11 @@
   });
   setTabsState(tabsState);
 
+  // Wire up source-tab invalidation so that after a move, source tabs refetch.
+  storage.setTabsInvalidationHandler((prefix: string) => {
+    tabsState.setStalePrefix(prefix);
+  });
+
   // Initialise tabs once storage has bucket data.
   $effect(() => {
     if (storage.bucket) {
@@ -80,8 +85,9 @@
   });
 
   // Clicking anywhere inside the object-list container that is not a table row
-  // clears the current selection. Keyboard users already have Escape via the
-  // svelte:window handler below, so no key handler is needed here.
+  // clears the current selection (left-click) or opens the empty-space context
+  // menu (right-click). Keyboard users already have Escape via the svelte:window
+  // handler below, so no key handler is needed here.
   let objectListEl: HTMLDivElement;
   $effect(() => {
     function handleClick(e: MouseEvent) {
@@ -89,8 +95,17 @@
         storage.clearSelection();
       }
     }
+    function handleContextMenu(e: MouseEvent) {
+      if (objectListEl.contains(e.target as Node) && !(e.target as HTMLElement).closest('tr')) {
+        storage.openEmptyContextMenu(e);
+      }
+    }
     document.addEventListener('click', handleClick);
-    return () => document.removeEventListener('click', handleClick);
+    document.addEventListener('contextmenu', handleContextMenu);
+    return () => {
+      document.removeEventListener('click', handleClick);
+      document.removeEventListener('contextmenu', handleContextMenu);
+    };
   });
 </script>
 
diff --git a/src/lib/components/storage/explorer/FileRow.svelte b/src/lib/components/storage/explorer/FileRow.svelte
index bd1e64da..d5ea64f7 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte
+++ b/src/lib/components/storage/explorer/FileRow.svelte
@@ -5,6 +5,8 @@
   import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
   import FileIconAndName from './file-icon/FileIconAndName.svelte';
   import { getStorageState } from '$lib/storage/context.js';
+  import { storageCutCopyEnabled } from '$lib/client/feature-flags.js';
+  import { handleRowDragStart } from '$lib/storage/drag-handlers.js';
 
   interface Props {
     file: StorageObject;
@@ -17,16 +19,24 @@
   const selected = $derived(storage.selectedKeys.has(file.key));
   const isCtx = $derived(storage.contextMenu?.key === file.key);
   const isArchive = $derived(isArchiveExtension(file.key));
+  const isCut = $derived(storage.isCutKey(file.key));
+
+  function handleDragStart(e: DragEvent) {
+    handleRowDragStart(e, file.key, storage);
+  }
 </script>
 
 <tr
   class="
     group cursor-pointer select-none
+    {isCut ? 'opacity-40' : ''}
     {isCtx
     ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
     : selected
       ? 'bg-primary/10 hover:bg-primary/15'
       : 'hover:bg-base-200/60'}"
+  draggable={storageCutCopyEnabled && !storage.isInArchive}
+  ondragstart={handleDragStart}
   onclick={(e) => storage.toggleSelect(file.key, e.ctrlKey || e.metaKey)}
   ondblclick={() => {
     if (isArchive) {
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte b/src/lib/components/storage/explorer/FolderRow.svelte
index dd1a7821..e69c352b 100644
--- a/src/lib/components/storage/explorer/FolderRow.svelte
+++ b/src/lib/components/storage/explorer/FolderRow.svelte
@@ -4,6 +4,12 @@
   import { keyToName } from '$lib/storage/utils.js';
   import type { StorageObject } from '$lib/storage/types.js';
   import { getStorageState } from '$lib/storage/context.js';
+  import { storageCutCopyEnabled } from '$lib/client/feature-flags.js';
+  import {
+    handleRowDragStart,
+    parseStorageDropKeys,
+    canStorageDrop
+  } from '$lib/storage/drag-handlers.js';
 
   interface Props {
     folder: StorageObject;
@@ -15,16 +21,57 @@
 
   const selected = $derived(storage.selectedKeys.has(folder.key));
   const isCtx = $derived(storage.contextMenu?.key === folder.key);
+  const isCut = $derived(storage.isCutKey(folder.key));
+
+  let dragOver = $state(false);
+
+  function handleDragStart(e: DragEvent) {
+    handleRowDragStart(e, folder.key, storage);
+  }
+
+  function handleDragOver(e: DragEvent) {
+    if (!canStorageDrop(storage)) return;
+    // Don't allow dropping onto a selected folder (moving into itself)
+    if (storage.selectedKeys.has(folder.key)) return;
+    e.preventDefault();
+    e.stopPropagation();
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    dragOver = true;
+  }
+
+  function handleDragLeave() {
+    dragOver = false;
+  }
+
+  function handleDrop(e: DragEvent) {
+    dragOver = false;
+    if (!canStorageDrop(storage)) return;
+    e.preventDefault();
+    e.stopPropagation();
+    const keys = parseStorageDropKeys(e);
+    if (!keys) return;
+    // Don't drop onto a selected folder
+    if (keys.includes(folder.key)) return;
+    // Move items into this folder
+    void storage.performMove(folder.key, keys);
+  }
 </script>
 
 <tr
   class="
     group cursor-pointer select-none
+    {isCut ? 'opacity-40' : ''}
+    {dragOver ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2' : ''}
     {isCtx
     ? 'bg-base-300 outline-base-content/30 outline -outline-offset-2'
     : selected
       ? 'bg-primary/10 hover:bg-primary/15'
       : 'hover:bg-base-200/60'}"
+  draggable={storageCutCopyEnabled && !storage.isInArchive}
+  ondragstart={handleDragStart}
+  ondragover={handleDragOver}
+  ondragleave={handleDragLeave}
+  ondrop={handleDrop}
   onclick={(e) => {
     if (storage.selectionMode || e.ctrlKey || e.metaKey) {
       storage.toggleSelect(folder.key, true);
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 7fa912cd..4ca84b1a 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -15,6 +15,8 @@
     if (selectAllEl) selectAllEl.indeterminate = storage.someSelected;
   });
 
+  import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
+
   function navigateUp() {
     if (storage.isInArchive) {
       storage.navigateUpFromArchive();
@@ -25,11 +27,168 @@
     const lastSlash = withoutTrailing.lastIndexOf('/');
     storage.navigate(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
   }
+
+  function parentPrefix(): string {
+    if (!storage.prefix) return '';
+    const withoutTrailing = storage.prefix.slice(0, -1);
+    const lastSlash = withoutTrailing.lastIndexOf('/');
+    return lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1);
+  }
+
+  let tableDragOver = $state(false);
+  let parentDragOver = $state(false);
+  let emptyDragOver = $state(false);
+
+  let scrollContainer = $state<HTMLElement | null>(null);
+  let autoScrollAnimFrame = $state<number | null>(null);
+
+  const EDGE_THICKNESS = 40;
+  const BASE_SCROLL_SPEED = 3;
+  const MAX_SCROLL_SPEED = 8;
+
+  let headerEl = $state<HTMLElement | null>(null);
+
+  function stopAutoScroll() {
+    if (autoScrollAnimFrame !== null) {
+      cancelAnimationFrame(autoScrollAnimFrame);
+      autoScrollAnimFrame = null;
+    }
+  }
+
+  function contentEdgeY(clientY: number): number | null {
+    const container = scrollContainer;
+    if (!container) return null;
+    const bodyTop = headerEl
+      ? headerEl.getBoundingClientRect().bottom
+      : container.getBoundingClientRect().top;
+    return clientY - bodyTop;
+  }
+
+  function handleTableDragOver(e: DragEvent) {
+    if (!canStorageDrop(storage)) return;
+    if (!e.dataTransfer?.types.includes('application/x-storage-keys')) return;
+    e.preventDefault();
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    tableDragOver = true;
+
+    const container = scrollContainer;
+    if (!container) return;
+    const edgeY = contentEdgeY(e.clientY);
+    if (edgeY === null) return;
+    const el = container as HTMLElement;
+    if (edgeY < EDGE_THICKNESS && el.scrollTop > 0) {
+      const factor = 1 - edgeY / EDGE_THICKNESS;
+      const speed = BASE_SCROLL_SPEED + (MAX_SCROLL_SPEED - BASE_SCROLL_SPEED) * factor;
+      stopAutoScroll();
+      function tick() {
+        const newTop = el.scrollTop - speed;
+        if (newTop <= 0) {
+          el.scrollTop = 0;
+          stopAutoScroll();
+          return;
+        }
+        el.scrollTop = newTop;
+        autoScrollAnimFrame = requestAnimationFrame(tick);
+      }
+      autoScrollAnimFrame = requestAnimationFrame(tick);
+    } else {
+      const rect = el.getBoundingClientRect();
+      const y = e.clientY - rect.top;
+      if (y > rect.height - EDGE_THICKNESS && el.scrollTop < el.scrollHeight - el.clientHeight) {
+        const factor = (y - (rect.height - EDGE_THICKNESS)) / EDGE_THICKNESS;
+        const speed = BASE_SCROLL_SPEED + (MAX_SCROLL_SPEED - BASE_SCROLL_SPEED) * factor;
+        stopAutoScroll();
+        function tick() {
+          const newTop = el.scrollTop + speed;
+          const maxScroll = el.scrollHeight - el.clientHeight;
+          if (newTop >= maxScroll) {
+            el.scrollTop = maxScroll;
+            stopAutoScroll();
+            return;
+          }
+          el.scrollTop = newTop;
+          autoScrollAnimFrame = requestAnimationFrame(tick);
+        }
+        autoScrollAnimFrame = requestAnimationFrame(tick);
+      } else {
+        stopAutoScroll();
+      }
+    }
+  }
+
+  function handleTableDragLeave(e: DragEvent) {
+    // Only clear if we're leaving the table container entirely
+    const related = e.relatedTarget as Node | null;
+    if (related && (e.currentTarget as HTMLElement).contains(related)) return;
+    stopAutoScroll();
+    tableDragOver = false;
+  }
+
+  function handleTableDrop(e: DragEvent) {
+    stopAutoScroll();
+    tableDragOver = false;
+    if (!canStorageDrop(storage)) return;
+    e.preventDefault();
+    const keys = parseStorageDropKeys(e);
+    if (!keys) return;
+    void storage.performMove(storage.prefix, keys);
+  }
+
+  function handleParentDragOver(e: DragEvent) {
+    if (!canStorageDrop(storage) || !storage.prefix) return;
+    e.preventDefault();
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    parentDragOver = true;
+  }
+
+  function handleParentDragLeave() {
+    parentDragOver = false;
+  }
+
+  function handleParentDrop(e: DragEvent) {
+    parentDragOver = false;
+    if (!canStorageDrop(storage) || !storage.prefix) return;
+    e.preventDefault();
+    const keys = parseStorageDropKeys(e);
+    if (!keys) return;
+    void storage.performMove(parentPrefix(), keys);
+  }
+
+  function handleEmptyDragOver(e: DragEvent) {
+    if (!canStorageDrop(storage)) return;
+    if (!e.dataTransfer?.types.includes('application/x-storage-keys')) return;
+    e.preventDefault();
+    e.stopPropagation();
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    emptyDragOver = true;
+  }
+
+  function handleEmptyDragLeave() {
+    emptyDragOver = false;
+  }
+
+  function handleEmptyDrop(e: DragEvent) {
+    emptyDragOver = false;
+    if (!canStorageDrop(storage)) return;
+    e.preventDefault();
+    e.stopPropagation();
+    const keys = parseStorageDropKeys(e);
+    if (!keys) return;
+    void storage.performMove(storage.prefix, keys);
+  }
 </script>
 
-<div class="preview-scroll h-full overflow-x-auto overflow-y-auto">
+<div
+  bind:this={scrollContainer}
+  class="preview-scroll h-full overflow-x-auto overflow-y-auto {tableDragOver
+    ? 'outline-primary/40 outline -outline-offset-2 outline-dashed'
+    : ''}"
+  ondragover={handleTableDragOver}
+  ondragleave={handleTableDragLeave}
+  ondrop={handleTableDrop}
+>
   <table class="table-sm table">
-    <thead class="bg-base-100 sticky top-0 z-10">
+    <thead bind:this={headerEl} class="bg-base-100 sticky top-0 z-10">
       <!-- Selection action toolbar -->
       <SelectionToolbar />
 
@@ -63,7 +222,15 @@
     <tbody>
       <!-- Parent directory row -->
       {#if storage.prefix}
-        <tr class="hover cursor-pointer" onclick={navigateUp}>
+        <tr
+          class="hover cursor-pointer {parentDragOver
+            ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
+            : ''}"
+          onclick={navigateUp}
+          ondragover={handleParentDragOver}
+          ondragleave={handleParentDragLeave}
+          ondrop={handleParentDrop}
+        >
           <td class="pr-0"></td>
           <td colspan={3}>
             <div class="text-base-content/50 flex items-center gap-2">
@@ -96,7 +263,15 @@
 
         <!-- Empty folder -->
         {#if storage.folders.length === 0 && storage.files.length === 0}
-          <tr>
+          <tr
+            class={emptyDragOver
+              ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
+              : ''}
+            ondragover={handleEmptyDragOver}
+            ondragleave={handleEmptyDragLeave}
+            ondrop={handleEmptyDrop}
+            oncontextmenu={(e) => storage.openEmptyContextMenu(e)}
+          >
             <td colspan={5} class="text-base-content/40 py-16 text-center">
               <IconFolderOpen class="mx-auto mb-3 size-10 opacity-30" aria-hidden="true" />
               {m.storage_bucket_empty()}
diff --git a/src/lib/components/storage/explorer/OperationsButton.svelte b/src/lib/components/storage/explorer/OperationsButton.svelte
new file mode 100644
index 00000000..522eda89
--- /dev/null
+++ b/src/lib/components/storage/explorer/OperationsButton.svelte
@@ -0,0 +1,502 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import type { StorageOperation, OperationType } from '$lib/storage/types.js';
+  import IconContentPaste from 'virtual:icons/material-symbols/content-paste';
+  import IconDriveFileMove from 'virtual:icons/material-symbols/drive-file-move-outline';
+  import IconEdit from 'virtual:icons/material-symbols/edit-outline';
+  import IconDelete from 'virtual:icons/material-symbols/delete-outline';
+  import IconCheckCircle from 'virtual:icons/material-symbols/check-circle-outline';
+  import IconError from 'virtual:icons/material-symbols/error-outline';
+  import IconCancel from 'virtual:icons/material-symbols/cancel-outline';
+  import IconPowerOff from 'virtual:icons/material-symbols/power-off';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconDeleteSweep from 'virtual:icons/material-symbols/delete-sweep-outline';
+  import IconHistory from 'virtual:icons/material-symbols/history';
+  import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
+
+  const storage = getStorageState();
+
+  const typeIconMap: Record<OperationType, typeof IconDelete> = {
+    paste: IconContentPaste,
+    move: IconDriveFileMove,
+    rename: IconEdit,
+    delete: IconDelete
+  };
+
+  let dropdownOpen = $state(false);
+  let tick = $state(0);
+  let expandedOps: Record<string, boolean> = $state({});
+  let dropdownEl: HTMLDivElement | undefined = $state();
+
+  interface ChunkTrack {
+    prevBytes: number;
+    chunkStart: number;
+    chunkBytes: number;
+  }
+  let chunkTracks: Record<string, ChunkTrack> = {};
+
+  $effect(() => {
+    if (!storage.hasRunningOps) return;
+    const hasByteProgress = storage.operations.some(
+      (op) => op.status === 'running' && op.totalBytes > 0
+    );
+    const intervalMs = hasByteProgress ? 100 : 1000;
+    const id = setInterval(() => {
+      tick++;
+      for (const op of storage.operations) {
+        if (op.status !== 'running' || op.totalBytes <= 0) continue;
+        const track = chunkTracks[op.id];
+        if (!track) {
+          chunkTracks[op.id] = {
+            prevBytes: op.completedBytes,
+            chunkStart: Date.now(),
+            chunkBytes: 0
+          };
+        } else if (op.completedBytes !== track.prevBytes) {
+          const diff = op.completedBytes - track.prevBytes;
+          track.prevBytes = op.completedBytes;
+          track.chunkBytes = diff;
+          track.chunkStart = Date.now();
+        }
+      }
+    }, intervalMs);
+    return () => clearInterval(id);
+  });
+
+  function toggleDropdown() {
+    dropdownOpen = !dropdownOpen;
+  }
+
+  function toggleExpand(opId: string) {
+    expandedOps = { ...expandedOps, [opId]: !expandedOps[opId] };
+  }
+
+  const activeOps = $derived(storage.operations.filter((op) => op.status === 'running'));
+  const historyOps = $derived(
+    storage.operations
+      .filter((op) => op.status !== 'running')
+      .slice()
+      .reverse()
+  );
+  const hasHistory = $derived(historyOps.length > 0);
+  const hasError = $derived(storage.operations.some((o) => o.status === 'error'));
+
+  function statusColor(op: StorageOperation): string {
+    switch (op.status) {
+      case 'running':
+        return 'text-primary';
+      case 'done':
+        return 'text-success';
+      case 'cancelled':
+        return 'text-base-content/40';
+      case 'interrupted':
+        return 'text-warning';
+      default:
+        return 'text-error';
+    }
+  }
+
+  function statusBgColor(op: StorageOperation): string {
+    switch (op.status) {
+      case 'running':
+        return 'bg-primary/10';
+      case 'done':
+        return 'bg-success/10';
+      case 'cancelled':
+        return 'bg-base-content/5';
+      case 'interrupted':
+        return 'bg-warning/10';
+      default:
+        return 'bg-error/10';
+    }
+  }
+
+  function statusLabel(op: StorageOperation): string {
+    switch (op.status) {
+      case 'done':
+        return m.storage_operation_done();
+      case 'cancelled':
+        return m.storage_operation_cancelled();
+      case 'interrupted':
+        return m.storage_operation_interrupted();
+      default:
+        return op.errorMessage ?? m.storage_operation_failed();
+    }
+  }
+
+  function formatElapsed(startedAt: number, completedAt: number | undefined): string {
+    void tick;
+    const end = completedAt ?? Date.now();
+    const seconds = Math.floor((end - startedAt) / 1000);
+    if (seconds < 60) return `${seconds}s`;
+    const minutes = Math.floor(seconds / 60);
+    const secs = seconds % 60;
+    return `${minutes}m ${secs}s`;
+  }
+
+  function formatBytes(bytes: number): string {
+    if (bytes === 0) return '0 B';
+    if (bytes < 1024) return `${bytes} B`;
+    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+  }
+
+  /**
+   * Return an interpolated completedBytes that smooths over chunk boundaries.
+   * When a new chunk completes (a jump in completedBytes), this converges
+   * smoothly from the previous value to the new one over ~1.5s instead of
+   * snapping, giving a smoother visual for multipart S3 copy operations
+   * where each part is 256 MB.
+   */
+  function displayBytes(op: StorageOperation): number {
+    if (op.status !== 'running' || op.totalBytes <= 0) return op.completedBytes;
+    void tick;
+    const track = chunkTracks[op.id];
+    if (!track || track.chunkBytes <= 0) return op.completedBytes;
+    const elapsed = (Date.now() - track.chunkStart) / 1000;
+    const expectedDuration = 1.5;
+    const progress = Math.min(1, elapsed / expectedDuration);
+    const chunkProgress = track.chunkBytes * progress;
+    return Math.min(track.prevBytes, track.prevBytes - track.chunkBytes + chunkProgress);
+  }
+
+  function percent(op: StorageOperation): number {
+    if (op.totalBytes <= 0) return 0;
+    const bytes = displayBytes(op);
+    return Math.min(100, Math.round((bytes / op.totalBytes) * 100));
+  }
+
+  function progressLabel(op: StorageOperation): string {
+    if (op.totalBytes > 0) {
+      return `${formatBytes(displayBytes(op))} / ${formatBytes(op.totalBytes)}`;
+    }
+    if (op.itemCount > 1) {
+      return `${op.completedCount} / ${op.itemCount}`;
+    }
+    return '';
+  }
+
+  function speedLabel(op: StorageOperation): string {
+    void tick;
+    const elapsed = (Date.now() - op.startedAt) / 1000;
+    if (elapsed <= 0 || op.completedBytes <= 0) return '';
+    const bytesPerSec = op.completedBytes / elapsed;
+    return `${formatBytes(Math.round(bytesPerSec))}/s`;
+  }
+
+  function etaLabel(op: StorageOperation): string {
+    void tick;
+    const elapsed = (Date.now() - op.startedAt) / 1000;
+    if (elapsed <= 0 || op.completedBytes <= 0 || op.totalBytes <= 0) return '';
+    const bytesPerSec = op.completedBytes / elapsed;
+    const remaining = op.totalBytes - op.completedBytes;
+    if (remaining <= 0) return '';
+    const secs = remaining / bytesPerSec;
+    if (secs < 60) return `${Math.round(secs)}s`;
+    return `${Math.floor(secs / 60)}m ${Math.round(secs % 60)}s`;
+  }
+
+  function speedEtaLabel(op: StorageOperation): string {
+    const s = speedLabel(op);
+    const e = etaLabel(op);
+    if (!s && !e) return '';
+    if (s && e)
+      return `${m.storage_operations_speed()}: ${s} | ${e} ${m.storage_operations_remaining()}`;
+    if (s) return `${m.storage_operations_speed()}: ${s}`;
+    return `${e} ${m.storage_operations_remaining()}`;
+  }
+</script>
+
+<svelte:window onkeydown={(e) => e.key === 'Escape' && (dropdownOpen = false)} />
+
+{#if storage.operations.length > 0}
+  {#if dropdownOpen}
+    <div
+      class="fixed inset-0 z-40"
+      onclick={() => (dropdownOpen = false)}
+      role="presentation"
+      aria-hidden="true"
+    ></div>
+  {/if}
+  <div bind:this={dropdownEl} class="relative z-50 inline-flex">
+    <!-- Trigger button -->
+    <button
+      class="
+        btn btn-ghost btn-xs relative size-7 rounded-full p-0
+        {storage.hasRunningOps ? 'text-primary' : hasError ? 'text-error' : 'text-success'}
+      "
+      title={m.storage_operations_label()}
+      aria-label={m.storage_operations_label()}
+      aria-expanded={dropdownOpen}
+      aria-haspopup="menu"
+      onclick={toggleDropdown}
+    >
+      {#if storage.hasRunningOps}
+        <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+        {#if activeOps.length > 1}
+          <span
+            class="badge badge-primary badge-xs absolute -top-1 -right-1 min-w-4 px-0.5 text-[9px]"
+            aria-hidden="true"
+          >
+            {activeOps.length}
+          </span>
+        {/if}
+      {:else if hasError}
+        <IconError class="size-4" aria-hidden="true" />
+      {:else}
+        <IconCheckCircle class="size-4" aria-hidden="true" />
+      {/if}
+    </button>
+
+    <!-- Dropdown panel -->
+    {#if dropdownOpen}
+      <div
+        role="menu"
+        aria-label={m.storage_operations_label()}
+        class="rounded-box border-base-300 bg-base-100 absolute right-0 z-60 mt-2 w-96 origin-top-right border shadow-xl"
+      >
+        <!-- Active operations section -->
+        {#if activeOps.length > 0}
+          <div class="border-base-300 border-b px-3 pt-3 pb-2">
+            <p
+              class="text-base-content/50 mb-2 text-[10px] font-semibold tracking-widest uppercase"
+            >
+              {m.storage_operations_active()}
+            </p>
+            <ul class="flex flex-col gap-2">
+              {#each activeOps as op (op.id)}
+                {@const TypeIcon = typeIconMap[op.type]}
+                <li role="none" class="bg-base-200 rounded-lg px-3 py-2.5">
+                  <!-- Collapsible header row -->
+                  <div class="flex items-center gap-2">
+                    <div
+                      class="flex min-w-0 flex-1 cursor-pointer items-center gap-2"
+                      role="button"
+                      tabindex="0"
+                      onclick={() => toggleExpand(op.id)}
+                      onkeydown={(e) => e.key === 'Enter' && toggleExpand(op.id)}
+                      aria-expanded={expandedOps[op.id]}
+                    >
+                      <!-- Chevron -->
+                      <span
+                        class="text-base-content/30 shrink-0 transition-transform duration-200"
+                        class:rotate-90={expandedOps[op.id]}
+                        aria-hidden="true"
+                      >
+                        <IconChevronRight class="size-3" />
+                      </span>
+
+                      <!-- Type icon -->
+                      <span class="text-primary shrink-0" aria-hidden="true">
+                        <TypeIcon class="size-3.5" />
+                      </span>
+
+                      <!-- Label -->
+                      <span
+                        class="text-base-content min-w-0 flex-1 truncate text-xs leading-tight font-medium"
+                      >
+                        {op.label}
+                      </span>
+
+                      <!-- Speed + ETA (collapsed, right-aligned) -->
+                      {#if op.totalBytes > 0}
+                        <span class="text-base-content/40 shrink-0 text-[9px] tabular-nums">
+                          {speedEtaLabel(op)}
+                        </span>
+                      {/if}
+                    </div>
+
+                    <!-- Cancel -->
+                    <button
+                      class="btn btn-ghost btn-xs text-error/70 hover:text-error size-5 shrink-0 p-0"
+                      title={m.storage_operations_cancel()}
+                      aria-label={m.storage_operations_cancel()}
+                      onclick={() => storage.cancelOp(op.id)}
+                    >
+                      <IconClose class="size-3" aria-hidden="true" />
+                    </button>
+                  </div>
+
+                  <!-- Expanded detail -->
+                  {#if expandedOps[op.id]}
+                    <div class="mt-2 space-y-1.5">
+                      <!-- Current file -->
+                      {#if op.currentFileName}
+                        <div class="text-base-content/50 truncate pl-5 text-[11px]">
+                          {op.currentFileName}
+                        </div>
+                      {/if}
+
+                      <!-- Progress bar -->
+                      {#if op.totalBytes > 0 || op.itemCount > 1}
+                        <div
+                          class="pl-5"
+                          role="progressbar"
+                          aria-valuenow={displayBytes(op)}
+                          aria-valuemin={0}
+                          aria-valuemax={op.totalBytes}
+                          aria-label={op.label}
+                        >
+                          <div class="mb-1 flex items-center justify-between">
+                            <span class="text-base-content/50 text-[10px] tabular-nums">
+                              {progressLabel(op)}
+                            </span>
+                            <span class="text-primary text-[10px] font-semibold tabular-nums">
+                              {#if op.totalBytes > 0}
+                                {percent(op)}%
+                              {:else}
+                                {op.completedCount}/{op.itemCount}
+                              {/if}
+                            </span>
+                          </div>
+                          <div class="bg-base-300 h-1.5 w-full overflow-hidden rounded-full">
+                            <div
+                              class="bg-primary h-full rounded-full"
+                              style="width: {percent(op)}%"
+                            ></div>
+                          </div>
+                        </div>
+                      {/if}
+
+                      <!-- File list -->
+                      {#if op.sourceNames && op.sourceNames.length > 0}
+                        <div class="mt-1.5 space-y-0.5 pl-5">
+                          {#each op.sourceNames as name, i (i)}
+                            <div class="flex items-center gap-1.5 text-[10px] tabular-nums">
+                              {#if name === op.currentFileName}
+                                <span
+                                  class="loading loading-spinner loading-xs text-primary"
+                                  aria-hidden="true"
+                                ></span>
+                              {:else if i < op.completedCount}
+                                <span
+                                  class="text-success inline-block size-2 rounded-full bg-current"
+                                  aria-hidden="true"
+                                ></span>
+                              {:else}
+                                <span
+                                  class="text-base-content/20 inline-block size-2 rounded-full border border-current"
+                                  aria-hidden="true"
+                                ></span>
+                              {/if}
+                              <span class="text-base-content/70 truncate">{name}</span>
+                            </div>
+                          {/each}
+                        </div>
+                      {/if}
+
+                      <!-- Elapsed time -->
+                      <div class="text-base-content/35 mt-1.5 pl-5 text-[10px] tabular-nums">
+                        {formatElapsed(op.startedAt, op.completedAt)}
+                      </div>
+                    </div>
+                  {:else}
+                    <!-- Collapsed: current file name on single line -->
+                    {#if op.currentFileName}
+                      <div class="text-base-content/40 mt-1 truncate pl-5 text-[10px]">
+                        {op.currentFileName}
+                      </div>
+                    {/if}
+                  {/if}
+                </li>
+              {/each}
+            </ul>
+          </div>
+        {/if}
+
+        <!-- History section -->
+        {#if hasHistory}
+          <div class="px-3 pt-2.5 pb-2">
+            <div class="mb-2 flex items-center justify-between">
+              <p class="text-base-content/50 text-[10px] font-semibold tracking-widest uppercase">
+                {m.storage_operations_history()}
+              </p>
+              <button
+                class="btn btn-ghost btn-xs text-base-content/40 hover:text-base-content flex h-5 items-center gap-1 px-1 py-0 text-[10px]"
+                onclick={() => storage.clearOperationHistory()}
+                aria-label={m.storage_operations_clear_history()}
+              >
+                <IconDeleteSweep class="size-3" aria-hidden="true" />
+                {m.storage_operations_clear_history()}
+              </button>
+            </div>
+            <ul class="flex flex-col gap-1">
+              {#each historyOps as op (op.id)}
+                {@const TypeIcon = typeIconMap[op.type]}
+                <li role="none" class="rounded-md px-2.5 py-2 {statusBgColor(op)}">
+                  <div class="flex items-center gap-2">
+                    <!-- Status icon -->
+                    <span class="shrink-0 {statusColor(op)}" aria-hidden="true">
+                      {#if op.status === 'done'}
+                        <IconCheckCircle class="size-3.5" />
+                      {:else if op.status === 'error'}
+                        <IconError class="size-3.5" />
+                      {:else if op.status === 'cancelled'}
+                        <IconCancel class="size-3.5" />
+                      {:else}
+                        <IconPowerOff class="size-3.5" />
+                      {/if}
+                    </span>
+                    <!-- Operation type icon -->
+                    <span class="text-base-content/50 shrink-0" aria-hidden="true">
+                      <TypeIcon class="size-3" />
+                    </span>
+                    <span class="text-base-content/80 min-w-0 flex-1 truncate text-[11px]">
+                      {op.label}
+                    </span>
+                    <div class="flex shrink-0 flex-col items-end gap-0.5">
+                      <span class="text-[10px] font-medium {statusColor(op)}">
+                        {statusLabel(op)}
+                      </span>
+                      <span class="text-base-content/35 text-[9px] tabular-nums">
+                        {formatElapsed(op.startedAt, op.completedAt)}
+                      </span>
+                    </div>
+                  </div>
+
+                  <!-- Error detail -->
+                  {#if op.status === 'error' && op.errorMessage}
+                    <div
+                      class="text-error/70 mt-1 truncate pl-5 text-[10px]"
+                      title={op.errorMessage}
+                    >
+                      {op.errorMessage}
+                    </div>
+                  {:else if op.status === 'interrupted'}
+                    <div class="text-warning/60 mt-1 pl-5 text-[10px]">
+                      {m.storage_operations_interrupted_tooltip()}
+                    </div>
+                  {/if}
+
+                  <!-- Partial progress for interrupted / error -->
+                  {#if (op.status === 'interrupted' || op.status === 'error') && op.totalBytes > 0}
+                    <div class="mt-1.5 pl-5">
+                      <div class="bg-base-300 h-1 w-full overflow-hidden rounded-full">
+                        <div
+                          class="h-full rounded-full {op.status === 'interrupted'
+                            ? 'bg-warning'
+                            : 'bg-error'}"
+                          style="width: {percent(op)}%"
+                        ></div>
+                      </div>
+                      <span class="text-base-content/35 text-[9px] tabular-nums">
+                        {formatBytes(op.completedBytes)} / {formatBytes(op.totalBytes)}
+                      </span>
+                    </div>
+                  {/if}
+                </li>
+              {/each}
+            </ul>
+          </div>
+        {:else if activeOps.length === 0}
+          <div class="text-base-content/40 flex items-center gap-2 px-4 py-3">
+            <IconHistory class="size-4" aria-hidden="true" />
+            <span class="text-xs">{m.storage_operations_history()}</span>
+          </div>
+        {/if}
+      </div>
+    {/if}
+  </div>
+{/if}
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 5d2593ff..5f792f1a 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -21,6 +21,9 @@
   import { invalidateAll } from '$app/navigation';
   import { connectionStore } from '$lib/storage/connection-store.svelte.js';
   import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import { storageMoveEnabled } from '$lib/client/feature-flags.js';
+  import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
+  import OperationsButton from './OperationsButton.svelte';
 
   const storage = getStorageState();
   const tabsState = getTabsState();
@@ -168,6 +171,38 @@
     }
     storage.navigate(prefix);
   }
+
+  // ── Drag-drop targets for breadcrumb parts ─────────────────────────────
+
+  let dropTargetPrefix = $state<string | null>(null);
+
+  // ── Collapsed "..." dropdown drag-over to open ──────────────────────────
+  // Track whether the cursor is inside the collapsed-parts dropdown container
+  // (the button + the dropdown list).  Use a single boolean instead of a
+  // counter so that child-to-child moves (button → ul) don't cause flicker.
+  let collapsedDropdownOpen = $state(false);
+
+  function handleBreadcrumbDragOver(e: DragEvent, prefix: string) {
+    if (!canStorageDrop(storage)) return;
+    e.preventDefault();
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    dropTargetPrefix = prefix;
+  }
+
+  function handleBreadcrumbDragLeave() {
+    dropTargetPrefix = null;
+  }
+
+  function handleBreadcrumbDrop(e: DragEvent, prefix: string) {
+    dropTargetPrefix = null;
+    collapsedDropdownOpen = false;
+    if (!canStorageDrop(storage)) return;
+    e.preventDefault();
+    e.stopPropagation();
+    const keys = parseStorageDropKeys(e);
+    if (!keys) return;
+    void storage.performMove(prefix, keys);
+  }
 </script>
 
 {#if breadcrumbCtx}
@@ -268,10 +303,16 @@
           class="
             text-base-content flex shrink-0 items-center gap-1.5 rounded-sm px-1.5
             py-0.5 font-medium
+            {dropTargetPrefix === ''
+            ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
+            : ''}
           "
           title={storage.bucket}
           aria-current="page"
           oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, '')}
+          ondragover={(e) => handleBreadcrumbDragOver(e, '')}
+          ondragleave={handleBreadcrumbDragLeave}
+          ondrop={(e) => handleBreadcrumbDrop(e, '')}
         >
           <IconStorage class="pointer-events-none size-4" aria-hidden="true" />
           {storage.bucket}
@@ -285,10 +326,16 @@
             text-base-content/70 hover:bg-base-200 hover:text-base-content flex shrink-0 items-center gap-1.5
             rounded-sm px-1.5
             py-0.5 transition-colors hover:cursor-pointer
+            {dropTargetPrefix === ''
+            ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
+            : ''}
           "
           title={storage.bucket}
           onclick={() => navigateS3('')}
           oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, '')}
+          ondragover={(e) => handleBreadcrumbDragOver(e, '')}
+          ondragleave={handleBreadcrumbDragLeave}
+          ondrop={(e) => handleBreadcrumbDrop(e, '')}
         >
           <IconStorage class="size-4" aria-hidden="true" />
           {storage.bucket}
@@ -301,7 +348,26 @@
         class="text-base-content/30 pointer-events-none size-4 shrink-0"
         aria-hidden="true"
       />
-      <div class="dropdown">
+      <!-- svelte-ignore a11y_no_static_element_interactions -->
+      <div
+        class="dropdown"
+        class:dropdown-open={collapsedDropdownOpen}
+        ondragover={(e) => {
+          if (!storageMoveEnabled) return;
+          e.preventDefault();
+        }}
+        ondragenter={() => {
+          collapsedDropdownOpen = true;
+        }}
+        ondragleave={(e) => {
+          const related = e.relatedTarget as HTMLElement | null;
+          if (related && e.currentTarget.contains(related)) return;
+          collapsedDropdownOpen = false;
+        }}
+        ondrop={() => {
+          collapsedDropdownOpen = false;
+        }}
+      >
         <button
           tabindex="0"
           class="
@@ -327,9 +393,15 @@
             <li>
               <div class="group flex items-center justify-between gap-2">
                 <button
-                  class="flex-1 text-left text-sm hover:cursor-pointer"
+                  class="flex-1 text-left text-sm hover:cursor-pointer {dropTargetPrefix ===
+                  part.prefix
+                    ? 'text-primary'
+                    : ''}"
                   onclick={() => navigateS3(part.prefix)}
                   oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
+                  ondragover={(e) => handleBreadcrumbDragOver(e, part.prefix)}
+                  ondragleave={handleBreadcrumbDragLeave}
+                  ondrop={(e) => handleBreadcrumbDrop(e, part.prefix)}
                 >
                   {part.label}
                 </button>
@@ -353,10 +425,16 @@
             class="
               text-base-content min-w-0 truncate rounded-sm px-1.5 py-0.5
               font-medium
+              {dropTargetPrefix === part.prefix
+              ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
+              : ''}
             "
             title={part.label}
             aria-current="page"
             oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
+            ondragover={(e) => handleBreadcrumbDragOver(e, part.prefix)}
+            ondragleave={handleBreadcrumbDragLeave}
+            ondrop={(e) => handleBreadcrumbDrop(e, part.prefix)}
           >
             {part.label}
           </span>
@@ -365,10 +443,16 @@
             class="
               hover:bg-base-200 hover:text-base-content min-w-0 truncate rounded-sm px-1.5
               py-0.5 transition-colors hover:cursor-pointer
+              {dropTargetPrefix === part.prefix
+              ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
+              : ''}
             "
             title={part.label}
             onclick={() => navigateS3(part.prefix)}
             oncontextmenu={(e) => openBreadcrumbCtx(e, storage.bucket, part.prefix)}
+            ondragover={(e) => handleBreadcrumbDragOver(e, part.prefix)}
+            ondragleave={handleBreadcrumbDragLeave}
+            ondrop={(e) => handleBreadcrumbDrop(e, part.prefix)}
           >
             {part.label}
           </button>
@@ -542,6 +626,7 @@
           <input
             id="create-name-input"
             class="input input-bordered input-sm w-full"
+            autofocus
             value={createName}
             placeholder={m.storage_create_placeholder()}
             oninput={(e) => {
@@ -584,6 +669,9 @@
     </button>
   {/if}
 
+  <!-- Operations progress indicator -->
+  <OperationsButton />
+
   <!-- More options (pin current location) — hidden in archive mode -->
   <div class="dropdown dropdown-end">
     <button
diff --git a/src/lib/components/storage/explorer/TabBar.svelte b/src/lib/components/storage/explorer/TabBar.svelte
index 403139ad..40fcaf85 100644
--- a/src/lib/components/storage/explorer/TabBar.svelte
+++ b/src/lib/components/storage/explorer/TabBar.svelte
@@ -3,6 +3,8 @@
   import IconClose from 'virtual:icons/material-symbols/close';
   import * as m from '$lib/paraglide/messages.js';
   import type { TabsState } from '$lib/storage/tabs.svelte.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import { storageMoveEnabled } from '$lib/client/feature-flags.js';
 
   interface Props {
     tabsState: TabsState;
@@ -10,6 +12,8 @@
 
   let { tabsState }: Props = $props();
 
+  const storage = getStorageState();
+
   let renameInput = $state<HTMLInputElement | null>(null);
 
   $effect(() => {
@@ -41,6 +45,29 @@
   let dragIdx = $state<number | null>(null);
   let dragOverIdx = $state<number | null>(null);
 
+  // ── File-drag hover state (for drop-to-move) ──
+  // When the user drags file(s) over a tab, we auto-switch to that tab after
+  // TAB_HOVER_MS ms so they can navigate while dragging.
+  const TAB_HOVER_MS = 600;
+  let fileDragHoverIdx = $state<number | null>(null);
+  let fileDragHoverTimer: ReturnType<typeof setTimeout> | null = null;
+
+  function clearHoverTimer() {
+    if (fileDragHoverTimer !== null) {
+      clearTimeout(fileDragHoverTimer);
+      fileDragHoverTimer = null;
+    }
+    fileDragHoverIdx = null;
+  }
+
+  /** Returns true when the drag event is carrying storage keys (file drag),
+   *  not a tab-reorder drag (which uses text/plain). */
+  function isFileDrag(e: DragEvent): boolean {
+    return (
+      storageMoveEnabled && (e.dataTransfer?.types.includes('application/x-storage-keys') ?? false)
+    );
+  }
+
   // ── Context menu ──
   let ctxMenu = $state<{ x: number; y: number; tabId: string } | null>(null);
 
@@ -113,16 +140,65 @@
   }
 
   function handleDragOver(e: DragEvent, idx: number) {
-    e.preventDefault();
-    dragOverIdx = idx;
-    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    if (isFileDrag(e)) {
+      // File drag: allow drop, start hover-switch timer
+      e.preventDefault();
+      if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+      if (fileDragHoverIdx !== idx) {
+        clearHoverTimer();
+        fileDragHoverIdx = idx;
+        fileDragHoverTimer = setTimeout(() => {
+          const tab = tabsState.tabs[idx];
+          if (tab && tab.id !== tabsState.activeTabId) {
+            tabsState.switchTo(tab.id);
+          }
+          fileDragHoverTimer = null;
+        }, TAB_HOVER_MS);
+      }
+    } else {
+      // Tab reorder drag
+      e.preventDefault();
+      dragOverIdx = idx;
+      if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    }
+  }
+
+  function handleDragLeave(e: DragEvent, idx: number) {
+    if (isFileDrag(e)) {
+      if (fileDragHoverIdx === idx) {
+        clearHoverTimer();
+      }
+    } else {
+      if (dragOverIdx === idx) dragOverIdx = null;
+    }
   }
 
   function handleDrop(e: DragEvent, toIdx: number) {
     e.preventDefault();
-    if (dragIdx !== null && dragIdx !== toIdx) {
-      tabsState.reorderTabs(dragIdx, toIdx);
+    clearHoverTimer();
+
+    if (isFileDrag(e)) {
+      // Drop files onto tab → move to that tab's prefix
+      const raw = e.dataTransfer?.getData('application/x-storage-keys');
+      if (raw) {
+        try {
+          const keys: string[] = JSON.parse(raw);
+          const tab = tabsState.tabs[toIdx];
+          if (tab) {
+            const destPrefix = tab.snapshot.prefix;
+            storage.performMove(destPrefix, keys);
+          }
+        } catch {
+          // invalid JSON - ignore
+        }
+      }
+    } else {
+      // Tab reorder
+      if (dragIdx !== null && dragIdx !== toIdx) {
+        tabsState.reorderTabs(dragIdx, toIdx);
+      }
     }
+
     dragIdx = null;
     dragOverIdx = null;
   }
@@ -130,6 +206,7 @@
   function handleDragEnd() {
     dragIdx = null;
     dragOverIdx = null;
+    clearHoverTimer();
   }
 </script>
 
@@ -202,11 +279,14 @@
               transition-all select-none
               {isActive
               ? 'bg-base-100 border-base-300 text-base-content z-20 font-medium shadow-sm'
-              : 'text-base-content/60 hover:text-base-content/80 hover:bg-base-100/50 z-10 border-transparent'}"
+              : 'text-base-content/60 hover:text-base-content/80 hover:bg-base-100/50 z-10 border-transparent'}
+              {dragIdx === idx ? 'opacity-50' : ''}
+              {(dragOverIdx === idx && dragIdx !== idx) || fileDragHoverIdx === idx
+              ? '!border-primary'
+              : ''}
+              {fileDragHoverIdx === idx ? 'bg-primary/10' : ''}"
             style="margin-right: -8px;"
             draggable="true"
-            class:opacity-50={dragIdx === idx}
-            class:!border-primary={dragOverIdx === idx && dragIdx !== idx}
             onclick={() => tabsState.switchTo(tab.id)}
             ondblclick={() => startRename(tab.id)}
             onmousedown={(e) => handleMiddleClick(e, tab.id)}
@@ -214,6 +294,7 @@
             oncontextmenu={(e) => openCtxMenu(e, tab.id)}
             ondragstart={(e) => handleDragStart(e, idx)}
             ondragover={(e) => handleDragOver(e, idx)}
+            ondragleave={(e) => handleDragLeave(e, idx)}
             ondrop={(e) => handleDrop(e, idx)}
             ondragend={handleDragEnd}
             title={tab.label}
diff --git a/src/lib/components/storage/explorer/TabBar.svelte.spec.ts b/src/lib/components/storage/explorer/TabBar.svelte.spec.ts
index 9df5896c..7324aad1 100644
--- a/src/lib/components/storage/explorer/TabBar.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/TabBar.svelte.spec.ts
@@ -1,7 +1,7 @@
 import { page, userEvent } from 'vitest/browser';
 import { describe, expect, it, vi, beforeEach } from 'vitest';
 import { render } from 'vitest-browser-svelte';
-import TabBar from './TabBar.svelte';
+import TabBarWrapper from './__tests__/TabBarWrapper.svelte';
 import { TabsState } from '$lib/storage/tabs.svelte.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 
@@ -24,6 +24,10 @@ function makeTabsState(storage: StorageState, tabCount = 2): TabsState {
   return ts;
 }
 
+function renderTabBar(storage: StorageState, tabsState: TabsState) {
+  return render(TabBarWrapper, { storage, tabsState });
+}
+
 // ── Tests ─────────────────────────────────────────────────────────────────────
 
 describe('TabBar', () => {
@@ -34,7 +38,7 @@ describe('TabBar', () => {
   it('renders a tab for each entry in tabsState.tabs', async () => {
     const storage = makeStorage('bucket-a');
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     const tabs = page.getByRole('tab');
     // 2 tabs rendered
@@ -45,7 +49,7 @@ describe('TabBar', () => {
   it('marks the active tab with aria-selected="true"', async () => {
     const storage = makeStorage('bucket-a');
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     const activeTab = page.getByRole('tab', { selected: true });
     await expect.element(activeTab).toBeInTheDocument();
@@ -54,7 +58,7 @@ describe('TabBar', () => {
   it('has a tablist with an accessible label', async () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await expect.element(page.getByRole('tablist')).toBeInTheDocument();
   });
@@ -62,7 +66,7 @@ describe('TabBar', () => {
   it('renders a "New Tab" plus button', async () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await expect.element(page.getByRole('button', { name: 'New Tab' })).toBeInTheDocument();
   });
@@ -71,7 +75,7 @@ describe('TabBar', () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
     const spy = vi.spyOn(tabsState, 'addTab');
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await page.getByRole('button', { name: 'New Tab' }).click();
 
@@ -83,7 +87,7 @@ describe('TabBar', () => {
     const tabsState = makeTabsState(storage, 2);
     // After makeTabsState(2): tabs[0] is the initial tab (not active), tabs[1] is active
     const spy = vi.spyOn(tabsState, 'switchTo');
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     // Click the first tab (not the active one)
     await page.getByRole('tab').nth(0).click();
@@ -94,7 +98,7 @@ describe('TabBar', () => {
   it('shows close buttons when multiple tabs exist', async () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     // Close tab buttons have aria-label="Close tab"
     const closeButtons = page.getByRole('button', { name: 'Close tab' });
@@ -105,7 +109,7 @@ describe('TabBar', () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
     const spy = vi.spyOn(tabsState, 'closeTab');
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await page.getByRole('button', { name: 'Close tab' }).first().click();
 
@@ -115,7 +119,7 @@ describe('TabBar', () => {
   it('opens a context menu on right-click of a tab', async () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await page.getByRole('tab').first().click({ button: 'right' });
 
@@ -125,7 +129,7 @@ describe('TabBar', () => {
   it('context menu contains Rename tab and Close tab options', async () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await page.getByRole('tab').first().click({ button: 'right' });
 
@@ -137,7 +141,7 @@ describe('TabBar', () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
     const spy = vi.spyOn(tabsState, 'renameTab');
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     const firstTabId = tabsState.tabs[0].id;
     await page.getByRole('tab').first().click({ button: 'right' });
@@ -155,7 +159,7 @@ describe('TabBar', () => {
   it('shows rename input on double-click of a tab', async () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await page.getByRole('tab').first().dblClick();
 
@@ -166,7 +170,7 @@ describe('TabBar', () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
     const spy = vi.spyOn(tabsState, 'renameTab');
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     const firstTabId = tabsState.tabs[0].id;
     await page.getByRole('tab').first().dblClick();
@@ -181,7 +185,7 @@ describe('TabBar', () => {
     const storage = makeStorage();
     const tabsState = makeTabsState(storage, 2);
     const spy = vi.spyOn(tabsState, 'renameTab');
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await page.getByRole('tab').first().dblClick();
 
@@ -197,7 +201,7 @@ describe('TabBar', () => {
     const tabsState = makeTabsState(storage, 2);
     const spy = vi.spyOn(tabsState, 'closeTab');
     const firstTabId = tabsState.tabs[0].id;
-    render(TabBar, { tabsState });
+    renderTabBar(storage, tabsState);
 
     await page.getByRole('tab').first().click({ button: 'right' });
     await page.getByRole('menuitem', { name: 'Close tab' }).click();
diff --git a/src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte b/src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte
new file mode 100644
index 00000000..7ca38328
--- /dev/null
+++ b/src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte
@@ -0,0 +1,21 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import { setTabsState } from '$lib/storage/tabs-context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import type { TabsState } from '$lib/storage/tabs.svelte.js';
+  import TabBar from '../TabBar.svelte';
+
+  interface Props {
+    storage: StorageState;
+    tabsState: TabsState;
+  }
+
+  let { storage, tabsState }: Props = $props();
+  untrack(() => {
+    setStorageState(storage);
+    setTabsState(tabsState);
+  });
+</script>
+
+<TabBar {tabsState} />
diff --git a/src/lib/components/storage/modals/CreateModal.svelte b/src/lib/components/storage/modals/CreateModal.svelte
new file mode 100644
index 00000000..196dfb14
--- /dev/null
+++ b/src/lib/components/storage/modals/CreateModal.svelte
@@ -0,0 +1,113 @@
+<script lang="ts">
+  import IconDescriptionOutline from 'virtual:icons/material-symbols/description-outline';
+  import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+
+  interface Props {
+    open?: boolean;
+    type: 'file' | 'folder';
+    onConfirm: (name: string) => void;
+    onCancel: () => void;
+    loading?: boolean;
+    error?: string | null;
+  }
+
+  let {
+    open = $bindable(false),
+    type,
+    onConfirm,
+    onCancel,
+    loading = false,
+    error = null
+  }: Props = $props();
+
+  const uid = $props.id();
+  let name = $state(type === 'file' ? 'untitled.txt' : 'new-folder');
+  let inputEl = $state<HTMLInputElement | null>(null);
+
+  const NAME_INVALID_CHARS = /[^\w\s./()\-+@,:;!$*'=]/g;
+
+  function sanitize(raw: string): string {
+    return raw.replace(NAME_INVALID_CHARS, '');
+  }
+
+  function handleConfirm() {
+    const sanitized = sanitize(name.trim());
+    if (sanitized && sanitized !== '.' && sanitized !== '..') {
+      onConfirm(sanitized);
+    }
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (e.key === 'Enter') handleConfirm();
+    if (e.key === 'Escape') onCancel();
+  }
+
+  $effect(() => {
+    if (open) {
+      requestAnimationFrame(() => {
+        inputEl?.focus();
+        if (inputEl) {
+          if (type === 'file') {
+            const dotIdx = name.lastIndexOf('.');
+            const selEnd = dotIdx > 0 ? dotIdx : name.length;
+            inputEl.setSelectionRange(0, selEnd);
+          } else {
+            inputEl.select();
+          }
+        }
+      });
+    }
+  });
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box max-w-sm">
+    <h3 class="mb-1 flex items-center gap-2 text-lg font-bold">
+      {#if type === 'file'}
+        <IconDescriptionOutline class="size-5 shrink-0" aria-hidden="true" />
+        {m.storage_create_file()}
+      {:else}
+        <IconFolderOutline class="size-5 shrink-0" aria-hidden="true" />
+        {m.storage_create_folder()}
+      {/if}
+    </h3>
+
+    <label for={uid + '-create-input'} class="label label-text mt-3 mb-1 p-0">
+      {m.storage_create_name()}
+    </label>
+    <input
+      bind:this={inputEl}
+      id={uid + '-create-input'}
+      class="input input-bordered input-sm w-full"
+      placeholder={m.storage_create_placeholder()}
+      value={name}
+      oninput={(e) => {
+        name = sanitize(e.currentTarget.value);
+      }}
+      onkeydown={handleKeydown}
+      disabled={loading}
+    />
+
+    {#if error}
+      <p class="text-error mt-2 text-sm">{error}</p>
+    {/if}
+
+    <div class="modal-action mt-6">
+      <button class="btn btn-ghost btn-sm" disabled={loading} onclick={onCancel}>
+        {m.storage_create_cancel()}
+      </button>
+      <button
+        class="btn btn-primary btn-sm"
+        disabled={!name.trim() || loading}
+        onclick={handleConfirm}
+      >
+        {#if loading}
+          <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+        {/if}
+        {m.storage_create_confirm()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/modals/MoveConfirmModal.svelte b/src/lib/components/storage/modals/MoveConfirmModal.svelte
new file mode 100644
index 00000000..d028b073
--- /dev/null
+++ b/src/lib/components/storage/modals/MoveConfirmModal.svelte
@@ -0,0 +1,95 @@
+<script lang="ts">
+  import IconDriveFileMove from 'virtual:icons/material-symbols/drive-file-move-outline';
+  import IconFolder from 'virtual:icons/material-symbols/folder-outline';
+  import IconDescription from 'virtual:icons/material-symbols/description-outline';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import { formatFileSize } from '$lib/storage/utils.js';
+
+  interface MoveItem {
+    key: string;
+    name: string;
+    isDirectory: boolean;
+    size?: number;
+  }
+
+  interface Props {
+    open?: boolean;
+    keys: string[];
+    destPrefix: string;
+    items: MoveItem[];
+    onConfirm: () => void;
+    onCancel: () => void;
+  }
+
+  let { open = $bindable(false), keys, destPrefix, items, onConfirm, onCancel }: Props = $props();
+
+  const destination = $derived(destPrefix || '/');
+
+  const totalSize = $derived(
+    items
+      .filter((i) => !i.isDirectory && i.size !== undefined)
+      .reduce((acc, i) => acc + (i.size ?? 0), 0)
+  );
+
+  const hasSizes = $derived(items.some((i) => !i.isDirectory && i.size !== undefined));
+
+  // Limit item list to 8 items to keep dialog compact
+  const MAX_VISIBLE = 8;
+  const visibleItems = $derived(items.slice(0, MAX_VISIBLE));
+  const hiddenCount = $derived(Math.max(0, items.length - MAX_VISIBLE));
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box max-w-md">
+    <h3 class="mb-1 flex items-center gap-2 text-lg font-bold">
+      <IconDriveFileMove class="size-5 shrink-0" aria-hidden="true" />
+      {m.storage_move_confirm_title()}
+    </h3>
+
+    <p class="text-base-content/70 mt-2 text-sm">
+      {m.storage_move_confirm_body({ count: keys.length, destination })}
+    </p>
+
+    <ul
+      class="bg-base-200/50 mt-3 max-h-40 overflow-y-auto rounded-lg p-2 text-sm"
+      aria-label={m.storage_move_confirm_title()}
+    >
+      {#each visibleItems as item (item.key)}
+        <li class="flex items-center gap-2 py-0.5">
+          {#if item.isDirectory}
+            <IconFolder class="text-warning size-4 shrink-0" aria-hidden="true" />
+          {:else}
+            <IconDescription class="text-base-content/50 size-4 shrink-0" aria-hidden="true" />
+          {/if}
+          <span class="min-w-0 flex-1 truncate">{item.name}</span>
+          {#if !item.isDirectory && item.size !== undefined}
+            <span class="text-base-content/40 shrink-0 font-mono text-xs"
+              >{formatFileSize(item.size)}</span
+            >
+          {/if}
+        </li>
+      {/each}
+      {#if hiddenCount > 0}
+        <li class="text-base-content/40 py-0.5 pl-6 text-xs">
+          {m.storage_move_confirm_more({ count: hiddenCount })}
+        </li>
+      {/if}
+    </ul>
+
+    {#if hasSizes && totalSize > 0}
+      <p class="text-base-content/50 mt-2 text-xs">
+        {m.storage_move_confirm_total_size({ size: formatFileSize(totalSize) })}
+      </p>
+    {/if}
+
+    <div class="modal-action mt-6">
+      <button class="btn btn-ghost btn-sm" onclick={onCancel}>
+        {m.storage_move_confirm_cancel()}
+      </button>
+      <button class="btn btn-primary btn-sm" onclick={onConfirm} autofocus>
+        {m.storage_move_confirm_label()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/modals/RenameModal.svelte b/src/lib/components/storage/modals/RenameModal.svelte
new file mode 100644
index 00000000..a05b8f0c
--- /dev/null
+++ b/src/lib/components/storage/modals/RenameModal.svelte
@@ -0,0 +1,96 @@
+<script lang="ts">
+  import IconDriveFileRenameOutline from 'virtual:icons/material-symbols/drive-file-rename-outline';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+
+  interface Props {
+    open?: boolean;
+    currentName: string;
+    onConfirm: (newName: string) => void;
+    onCancel: () => void;
+    loading?: boolean;
+    error?: string | null;
+  }
+
+  let {
+    open = $bindable(false),
+    currentName,
+    onConfirm,
+    onCancel,
+    loading = false,
+    error = null
+  }: Props = $props();
+
+  const uid = $props.id();
+  let newName = $state(currentName);
+  let inputEl = $state<HTMLInputElement | null>(null);
+
+  function handleConfirm() {
+    if (newName.trim() && newName.trim() !== currentName) {
+      onConfirm(newName.trim());
+    } else {
+      onCancel();
+    }
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (e.key === 'Enter') handleConfirm();
+    if (e.key === 'Escape') onCancel();
+  }
+
+  $effect(() => {
+    if (open) {
+      newName = currentName;
+      // Focus and select the name (without extension) on open
+      requestAnimationFrame(() => {
+        inputEl?.focus();
+        if (inputEl) {
+          const dotIdx = currentName.lastIndexOf('.');
+          const selEnd = dotIdx > 0 ? dotIdx : currentName.length;
+          inputEl.setSelectionRange(0, selEnd);
+        }
+      });
+    }
+  });
+</script>
+
+<Modal bind:open class="modal" closeguard={() => !loading}>
+  <div class="modal-box max-w-sm">
+    <h3 class="mb-1 flex items-center gap-2 text-lg font-bold">
+      <IconDriveFileRenameOutline class="size-5 shrink-0" aria-hidden="true" />
+      {m.storage_action_rename()}
+    </h3>
+
+    <label for={uid + '-rename-input'} class="label label-text mt-3 mb-1 p-0">
+      {m.storage_action_rename_inline_label()}
+    </label>
+    <input
+      bind:this={inputEl}
+      id={uid + '-rename-input'}
+      class="input input-bordered input-sm w-full"
+      bind:value={newName}
+      onkeydown={handleKeydown}
+      disabled={loading}
+    />
+
+    {#if error}
+      <p class="text-error mt-2 text-sm">{error}</p>
+    {/if}
+
+    <div class="modal-action mt-6">
+      <button class="btn btn-ghost btn-sm" disabled={loading} onclick={onCancel}>
+        {m.storage_action_rename_inline_cancel()}
+      </button>
+      <button
+        class="btn btn-primary btn-sm"
+        disabled={!newName.trim() || newName.trim() === currentName || loading}
+        onclick={handleConfirm}
+      >
+        {#if loading}
+          <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+        {/if}
+        {m.storage_action_rename()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/modals/StorageModals.svelte b/src/lib/components/storage/modals/StorageModals.svelte
index 31554a62..b4339fb5 100644
--- a/src/lib/components/storage/modals/StorageModals.svelte
+++ b/src/lib/components/storage/modals/StorageModals.svelte
@@ -1,8 +1,15 @@
 <script lang="ts">
   import { getStorageState } from '$lib/storage/context.js';
+  import { keyToName } from '$lib/storage/utils.js';
   import DeleteConfirmModal from './DeleteConfirmModal.svelte';
   import PreviewModal from './PreviewModal.svelte';
   import UploadModal from './upload/UploadModal.svelte';
+  import RenameModal from './RenameModal.svelte';
+  import CreateModal from './CreateModal.svelte';
+  import MoveConfirmModal from './MoveConfirmModal.svelte';
+  import ConflictResolutionDialog from './shared/ConflictResolutionDialog.svelte';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { checkObjectExists } from '$lib/storage/upload.js';
 
   const storage = getStorageState();
 
@@ -11,6 +18,10 @@
   let previewOpen = $state(true);
   let uploadOpen = $state(true);
   let deleteOpen = $state(true);
+  let renameOpen = $state(true);
+  let moveConfirmOpen = $state(true);
+  let createOpen = $state(true);
+  let resolveConflictsOpen = $state(true);
 
   // Reset local state when modal type changes
   $effect(() => {
@@ -18,6 +29,9 @@
       previewOpen = true;
       uploadOpen = true;
       deleteOpen = true;
+      renameOpen = true;
+      moveConfirmOpen = true;
+      createOpen = true;
     }
   });
 
@@ -39,6 +53,38 @@
       storage.closeModal();
     }
   });
+
+  $effect(() => {
+    if (!renameOpen && storage.activeModal?.type === 'rename' && !storage.renameLoading) {
+      storage.closeModal();
+    }
+  });
+
+  $effect(() => {
+    if (!moveConfirmOpen && storage.activeModal?.type === 'confirm-move') {
+      storage.closeModal();
+    }
+  });
+
+  $effect(() => {
+    if (!resolveConflictsOpen && storage.activeModal?.type === 'resolve-conflicts') {
+      storage.closeModal();
+    }
+  });
+
+  $effect(() => {
+    if (!createOpen && storage.activeModal?.type === 'create') {
+      storage.closeModal();
+    }
+  });
+
+  // Clear inline errors when the rename modal is dismissed via closeModal
+  $effect(() => {
+    if (!renameOpen) {
+      storage.renameError = null;
+      storage.renameLoading = false;
+    }
+  });
 </script>
 
 {#if storage.activeModal?.type === 'delete'}
@@ -69,3 +115,62 @@
     onSuccess={storage.handleUploadSuccess}
   />
 {/if}
+
+{#if storage.activeModal?.type === 'rename'}
+  {@const modalPayload = storage.activeModal.payload}
+  <RenameModal
+    bind:open={renameOpen}
+    currentName={keyToName(modalPayload.key)}
+    onConfirm={(newName: string) => storage.confirmRename(modalPayload.key, newName)}
+    onCancel={() => {
+      storage.renameError = null;
+      storage.renameLoading = false;
+      storage.closeModal();
+    }}
+    loading={storage.renameLoading}
+    error={storage.renameError}
+  />
+{/if}
+
+{#if storage.activeModal?.type === 'confirm-move'}
+  {@const modalPayload = storage.activeModal.payload}
+  <MoveConfirmModal
+    bind:open={moveConfirmOpen}
+    keys={modalPayload.keys}
+    destPrefix={modalPayload.destPrefix}
+    items={modalPayload.items}
+    onConfirm={storage.confirmMove}
+    onCancel={storage.cancelMove}
+  />
+{/if}
+
+{#if storage.activeModal?.type === 'create'}
+  {@const modalPayload = storage.activeModal.payload}
+  <CreateModal
+    bind:open={createOpen}
+    type={modalPayload.type}
+    onConfirm={(name: string) => storage.confirmCreate(name, modalPayload.type)}
+    onCancel={storage.cancelCreate}
+  />
+{/if}
+
+{#if storage.activeModal?.type === 'resolve-conflicts'}
+  {@const modalPayload = storage.activeModal.payload}
+  <ConflictResolutionDialog
+    bind:open={resolveConflictsOpen}
+    entries={modalPayload.entries}
+    confirmLabel={modalPayload.confirmLabel}
+    onCheckRename={async (entry) => {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) return true;
+      try {
+        const fullKey = modalPayload.destPrefix + entry.customName.trim();
+        return !(await checkObjectExists(modalPayload.bucket, fullKey, connectionId));
+      } catch {
+        return true;
+      }
+    }}
+    onConfirm={(entries) => storage.confirmConflictResolution(entries)}
+    onCancel={() => storage.cancelConflictResolution()}
+  />
+{/if}
diff --git a/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte b/src/lib/components/storage/modals/shared/ConflictEntry.svelte
similarity index 93%
rename from src/lib/components/storage/modals/upload/UploadConflictEntry.svelte
rename to src/lib/components/storage/modals/shared/ConflictEntry.svelte
index 68fc270a..41cbcc9c 100644
--- a/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte
+++ b/src/lib/components/storage/modals/shared/ConflictEntry.svelte
@@ -2,10 +2,10 @@
   import IconCheck from 'virtual:icons/material-symbols/check';
   import IconCheckCircle from 'virtual:icons/material-symbols/check-circle';
   import * as m from '$lib/paraglide/messages.js';
-  import type { FileEntry, Resolution } from './types.js';
+  import type { ConflictEntry, Resolution } from './conflict-types.js';
 
   interface Props {
-    entry: FileEntry;
+    entry: ConflictEntry;
     onSetResolution: (resolution: Resolution) => void;
     onSetCustomName: (name: string) => void;
     onRenameButtonClick: () => void;
@@ -17,22 +17,21 @@
 
   const uid = $props.id();
 
-  let nameOnly = $derived(entry.targetKey.split('/').at(-1) ?? entry.file.name);
   let badRename = $derived(
     entry.resolution === 'rename' &&
-      (entry.customName.trim() === '' || entry.customName.trim() === entry.file.name)
+      (entry.customName.trim() === '' || entry.customName.trim() === entry.originalName)
   );
 </script>
 
 <li class="px-4 py-3">
   <p class="text-base-content mb-2 truncate text-sm font-medium">
-    &ldquo;{nameOnly}&rdquo;
+    &ldquo;{entry.originalName}&rdquo;
   </p>
   <!-- Resolution toggle buttons -->
   <div
     class="flex flex-wrap gap-1.5"
     role="group"
-    aria-label="{m.storage_upload_conflicts_title()} — {nameOnly}"
+    aria-label="{m.storage_upload_conflicts_title()} — {entry.originalName}"
   >
     <button
       type="button"
diff --git a/src/lib/components/storage/modals/shared/ConflictResolutionDialog.svelte b/src/lib/components/storage/modals/shared/ConflictResolutionDialog.svelte
new file mode 100644
index 00000000..74ab95bc
--- /dev/null
+++ b/src/lib/components/storage/modals/shared/ConflictResolutionDialog.svelte
@@ -0,0 +1,194 @@
+<script lang="ts">
+  import IconWarning from 'virtual:icons/material-symbols/warning';
+  import IconCheckCircle from 'virtual:icons/material-symbols/check-circle';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import ConflictEntry from './ConflictEntry.svelte';
+  import type {
+    ConflictEntry as ConflictEntryType,
+    Resolution,
+    RenameState
+  } from './conflict-types.js';
+
+  interface Props {
+    open?: boolean;
+    /** Only the conflicting entries (each must have conflict=true). */
+    entries: ConflictEntryType[];
+    /** Optional: custom title shown at the top. Defaults to "Files already exist". */
+    title?: string;
+    /** Optional: description text. Defaults to "Choose what to do for each conflicting file." */
+    description?: string;
+    /** Optional: label for the confirm button. Defaults to "Confirm". */
+    confirmLabel?: string;
+    /**
+     * Optional: custom rename-conflict checker.
+     * Called with the entry's local state (including current customName).
+     * Return true if the new name is available, false if it conflicts.
+     * When not provided, rename is always accepted as available.
+     */
+    onCheckRename?: (entry: ConflictEntryType) => Promise<boolean>;
+    onConfirm: (entries: ConflictEntryType[]) => void;
+    onCancel: () => void;
+  }
+
+  let {
+    open = $bindable(false),
+    entries: initialEntries,
+    title,
+    description,
+    confirmLabel,
+    onCheckRename,
+    onConfirm,
+    onCancel
+  }: Props = $props();
+
+  // Local copy of entries for reactive state management
+  let localEntries = $state<ConflictEntryType[]>([]);
+
+  // Sync from initialEntries when the dialog opens
+  $effect(() => {
+    if (open) {
+      localEntries = initialEntries.map((e) => ({ ...e }));
+    }
+  });
+
+  const conflictEntries = $derived(localEntries.filter((e) => e.conflict));
+  const hasUnresolved = $derived(conflictEntries.some((e) => e.resolution === null));
+  const hasUnconfirmedRename = $derived(
+    localEntries.some((e) => e.resolution === 'rename' && e.renameState !== 'ok')
+  );
+  const canProceed = $derived(!hasUnresolved && !hasUnconfirmedRename);
+
+  // ── Bulk resolution ────────────────────────────────────────────────────────
+
+  function skipAll() {
+    localEntries = localEntries.map((e) =>
+      e.conflict
+        ? { ...e, resolution: 'skip' as Resolution, renameState: 'idle' as RenameState }
+        : e
+    );
+  }
+
+  function replaceAll() {
+    localEntries = localEntries.map((e) =>
+      e.conflict
+        ? { ...e, resolution: 'replace' as Resolution, renameState: 'idle' as RenameState }
+        : e
+    );
+  }
+
+  // ── Resolution handlers ────────────────────────────────────────────────────
+
+  function setResolution(id: string, res: Resolution) {
+    localEntries = localEntries.map((e) =>
+      e.id === id
+        ? {
+            ...e,
+            resolution: res,
+            renameState: (res === 'rename' ? 'editing' : 'idle') as RenameState
+          }
+        : e
+    );
+  }
+
+  function setCustomName(id: string, name: string) {
+    localEntries = localEntries.map((e) =>
+      e.id === id ? { ...e, customName: name, renameState: 'editing' as const } : e
+    );
+  }
+
+  async function handleRenameButtonClick(id: string) {
+    const entry = localEntries.find((e) => e.id === id);
+    if (!entry) return;
+    if (entry.resolution !== 'rename') {
+      setResolution(id, 'rename');
+    } else if (entry.renameState === 'ok') {
+      localEntries = localEntries.map((e) =>
+        e.id === id ? { ...e, renameState: 'editing' as const } : e
+      );
+    } else if (entry.renameState === 'editing' || entry.renameState === 'conflict') {
+      await doCheckRename(id);
+    }
+  }
+
+  async function doCheckRename(id: string) {
+    const entry = localEntries.find((e) => e.id === id);
+    if (!entry || entry.resolution !== 'rename') return;
+    const newName = entry.customName.trim();
+    if (newName === '' || newName === entry.originalName) return;
+
+    localEntries = localEntries.map((e) =>
+      e.id === id ? { ...e, renameState: 'checking' as const } : e
+    );
+
+    try {
+      const available = onCheckRename ? await onCheckRename(entry) : true;
+      const nextState: RenameState = available ? 'ok' : 'conflict';
+      localEntries = localEntries.map((e) => (e.id === id ? { ...e, renameState: nextState } : e));
+    } catch {
+      localEntries = localEntries.map((e) =>
+        e.id === id ? { ...e, renameState: 'editing' as const } : e
+      );
+    }
+  }
+
+  function handleConfirm() {
+    if (!canProceed) return;
+    onConfirm(localEntries);
+  }
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box w-full max-w-lg">
+    <div class="mb-3 flex items-start gap-2">
+      <IconWarning class="text-warning mt-0.5 size-5 shrink-0" aria-hidden="true" />
+      <div>
+        <p class="text-base-content font-semibold">
+          {title ?? m.storage_upload_conflicts_title()}
+        </p>
+        <p class="text-base-content/60 mt-0.5 text-sm">
+          {description ?? m.storage_upload_conflicts_desc()}
+        </p>
+      </div>
+    </div>
+
+    <div class="mb-2 flex justify-end gap-2">
+      <button class="btn btn-ghost btn-xs" onclick={skipAll}>
+        {m.storage_upload_skip_all()}
+      </button>
+      <button class="btn btn-ghost btn-xs" onclick={replaceAll}>
+        {m.storage_upload_replace_all()}
+      </button>
+    </div>
+
+    <ul
+      class="border-base-300 mb-4 max-h-72 divide-y overflow-y-auto rounded-lg border"
+      aria-label={title ?? m.storage_upload_conflicts_title()}
+    >
+      {#each conflictEntries as entry (entry.id)}
+        <ConflictEntry
+          {entry}
+          onSetResolution={(res) => setResolution(entry.id, res)}
+          onSetCustomName={(name) => setCustomName(entry.id, name)}
+          onRenameButtonClick={() => handleRenameButtonClick(entry.id)}
+          onCheckRename={() => doCheckRename(entry.id)}
+        />
+      {/each}
+    </ul>
+
+    <div class="flex justify-end gap-2">
+      <button class="btn btn-ghost btn-sm" onclick={onCancel}>
+        {m.storage_upload_overwrite_cancel()}
+      </button>
+      <button
+        class="btn btn-primary btn-sm gap-1"
+        onclick={handleConfirm}
+        disabled={!canProceed}
+        aria-disabled={!canProceed}
+      >
+        <IconCheckCircle class="size-4" aria-hidden="true" />
+        {confirmLabel ?? m.storage_upload_start()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/modals/shared/conflict-types.ts b/src/lib/components/storage/modals/shared/conflict-types.ts
new file mode 100644
index 00000000..e487a083
--- /dev/null
+++ b/src/lib/components/storage/modals/shared/conflict-types.ts
@@ -0,0 +1,14 @@
+export type Resolution = 'replace' | 'skip' | 'rename';
+
+export type RenameState = 'idle' | 'editing' | 'checking' | 'ok' | 'conflict';
+
+export interface ConflictEntry {
+  id: string;
+  originalName: string;
+  conflict: boolean;
+  resolution: Resolution | null;
+  customName: string;
+  renameState: RenameState;
+  /** Source S3 key (set for paste/move operations, undefined for uploads). */
+  sourceKey?: string;
+}
diff --git a/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts
index e6f8aebd..5843c0cc 100644
--- a/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadConflictEntry.svelte.spec.ts
@@ -1,23 +1,18 @@
-import { page } from 'vitest/browser';
 import { describe, expect, it, vi } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
-import UploadConflictEntry from './UploadConflictEntry.svelte';
-import type { FileEntry } from './types.js';
+import ConflictEntry from '../shared/ConflictEntry.svelte';
+import type { ConflictEntry as ConflictEntryType } from '../shared/conflict-types.js';
 
-function makeEntry(overrides: Partial<FileEntry> = {}): FileEntry {
-  const name = overrides.file?.name ?? faker.system.fileName();
+function makeEntry(overrides: Partial<ConflictEntryType> = {}): ConflictEntryType {
+  const name = overrides.originalName ?? faker.system.fileName();
   return {
     id: faker.string.uuid(),
-    file: new File(['content'], name),
-    displayPath: name,
-    targetKey: `path/to/${name}`,
+    originalName: name,
     conflict: true,
     resolution: null,
     customName: name,
     renameState: 'idle',
-    status: 'pending',
-    progress: 0,
     ...overrides
   };
 }
@@ -29,256 +24,193 @@ const defaultCallbacks = {
   onCheckRename: vi.fn()
 };
 
-describe('UploadConflictEntry', () => {
+describe('ConflictEntry', () => {
   describe('rendering', () => {
     it('should show the file name in quotes', async () => {
-      const entry = makeEntry({ targetKey: 'folder/report.csv' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect.element(page.getByText(/\u201Creport.csv\u201D/)).toBeInTheDocument();
+      const entry = makeEntry({ originalName: 'report.csv' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const listItem = screen.getByRole('group');
+      await expect.element(listItem).toBeInTheDocument();
     });
 
-    it('should show a button group with Replace, Skip, Rename', async () => {
+    it('should default to Replace and Skip buttons in ghost variant', async () => {
       const entry = makeEntry();
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect.element(page.getByRole('group')).toBeInTheDocument();
-      await expect.element(page.getByRole('button', { name: 'Replace' })).toBeInTheDocument();
-      await expect.element(page.getByRole('button', { name: 'Skip' })).toBeInTheDocument();
-      await expect.element(page.getByRole('button', { name: 'Rename' })).toBeInTheDocument();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const replaceBtn = screen.getByRole('button', { name: /Replace/ });
+      const skipBtn = screen.getByRole('button', { name: /Skip/ });
+      await expect.element(replaceBtn).toBeInTheDocument();
+      await expect.element(skipBtn).toBeInTheDocument();
     });
 
-    it('should handle long filenames', async () => {
-      const longName = faker.string.alpha(200) + '.txt';
-      const entry = makeEntry({ targetKey: `deep/nested/${longName}` });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+    it('should highlight Replace button with warning style when selected', async () => {
+      const entry = makeEntry({ resolution: 'replace' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const replaceBtn = screen.getByRole('button', { name: /Replace/ });
+      await expect.element(replaceBtn).toHaveClass('btn-warning');
+    });
 
-      await expect.element(page.getByText(new RegExp(longName.slice(0, 20)))).toBeInTheDocument();
+    it('should highlight Skip button with neutral style when selected', async () => {
+      const entry = makeEntry({ resolution: 'skip' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const skipBtn = screen.getByRole('button', { name: /Skip/ });
+      await expect.element(skipBtn).toHaveClass('btn-neutral');
     });
-  });
 
-  describe('resolution buttons', () => {
-    it('should mark Replace as pressed when resolution is replace', async () => {
+    it('should apply aria-pressed on active button', async () => {
       const entry = makeEntry({ resolution: 'replace' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      const btn = page.getByRole('button', { name: 'Replace' });
-      await expect.element(btn).toHaveAttribute('aria-pressed', 'true');
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const replaceBtn = screen.getByRole('button', { name: /Replace/ });
+      await expect.element(replaceBtn).toHaveAttribute('aria-pressed', 'true');
     });
 
-    it('should mark Skip as pressed when resolution is skip', async () => {
-      const entry = makeEntry({ resolution: 'skip' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      const btn = page.getByRole('button', { name: 'Skip' });
-      await expect.element(btn).toHaveAttribute('aria-pressed', 'true');
+    it('should not set aria-pressed on inactive buttons', async () => {
+      const entry = makeEntry({ resolution: 'replace' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const skipBtn = screen.getByRole('button', { name: /Skip/ });
+      await expect.element(skipBtn).toHaveAttribute('aria-pressed', 'false');
     });
+  });
 
-    it('should call onSetResolution with replace when Replace is clicked', async () => {
+  describe('callbacks', () => {
+    it('should call onSetResolution when Replace button is clicked', async () => {
       const onSetResolution = vi.fn();
       const entry = makeEntry();
-      render(UploadConflictEntry, { entry, ...defaultCallbacks, onSetResolution });
-
-      await page.getByRole('button', { name: 'Replace' }).click();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks, onSetResolution });
+      await screen.getByRole('button', { name: /Replace/ }).click();
       expect(onSetResolution).toHaveBeenCalledWith('replace');
     });
 
-    it('should call onSetResolution with skip when Skip is clicked', async () => {
+    it('should call onSetResolution when Skip button is clicked', async () => {
       const onSetResolution = vi.fn();
-      const entry = makeEntry();
-      render(UploadConflictEntry, { entry, ...defaultCallbacks, onSetResolution });
-
-      await page.getByRole('button', { name: 'Skip' }).click();
+      const entry = makeEntry({ resolution: 'replace' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks, onSetResolution });
+      await screen.getByRole('button', { name: /Skip/ }).click();
       expect(onSetResolution).toHaveBeenCalledWith('skip');
     });
 
-    it('should call onRenameButtonClick when Rename is clicked', async () => {
+    it('should call onRenameButtonClick when Rename button is clicked', async () => {
       const onRenameButtonClick = vi.fn();
       const entry = makeEntry();
-      render(UploadConflictEntry, { entry, ...defaultCallbacks, onRenameButtonClick });
-
-      await page.getByRole('button', { name: 'Rename' }).click();
-      expect(onRenameButtonClick).toHaveBeenCalled();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks, onRenameButtonClick });
+      await screen.getByRole('button', { name: /Rename/ }).click();
+      expect(onRenameButtonClick).toHaveBeenCalledOnce();
     });
-  });
-
-  describe('rename state', () => {
-    it('should show loading spinner when renameState is checking', async () => {
-      const entry = makeEntry({ resolution: 'rename', renameState: 'checking' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
 
-      const btn = page.getByRole('button', { name: /Rename/ });
-      await expect.element(btn).toBeDisabled();
+    it('should show a text input in editing rename state', async () => {
+      const entry = makeEntry({ resolution: 'rename', renameState: 'editing' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const input = screen.getByPlaceholder('New file name');
+      await expect.element(input).toBeInTheDocument();
     });
 
-    it('should show input field when renameState is editing', async () => {
+    it('should call onSetCustomName when text is entered', async () => {
+      const onSetCustomName = vi.fn();
       const entry = makeEntry({ resolution: 'rename', renameState: 'editing' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect
-        .element(page.getByRole('textbox', { name: 'New file name' }))
-        .toBeInTheDocument();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks, onSetCustomName });
+      const input = screen.getByPlaceholder('New file name');
+      await input.fill('newname.csv');
+      expect(onSetCustomName).toHaveBeenCalledWith('newname.csv');
     });
 
-    it('should show input field when renameState is conflict', async () => {
-      const entry = makeEntry({ resolution: 'rename', renameState: 'conflict' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect
-        .element(page.getByRole('textbox', { name: 'New file name' }))
-        .toBeInTheDocument();
+    it('should not call onRenameButtonClick before changing the value when Enter is pressed', async () => {
+      const onRenameButtonClick = vi.fn();
+      const entry = makeEntry({ resolution: 'rename', renameState: 'editing' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks, onRenameButtonClick });
+      // Should show the rename input
+      await expect.element(screen.getByPlaceholder('New file name')).toBeInTheDocument();
     });
 
-    it('should show error when renameState is conflict', async () => {
-      const file = new File(['x'], 'original.txt');
-      const entry = makeEntry({
-        file,
-        resolution: 'rename',
-        renameState: 'conflict',
-        customName: 'different-name.txt'
-      });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect
-        .element(page.getByRole('alert'))
-        .toHaveTextContent('This name already exists here.');
+    it('should show a spinner during rename checking', async () => {
+      const entry = makeEntry({ resolution: 'rename', renameState: 'checking' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      await expect.element(screen.getByRole('button', { name: /Rename/ })).toBeInTheDocument();
+      const renameBtn = screen.getByRole('button', { name: /Rename/ });
+      await expect.element(renameBtn).toBeDisabled();
     });
 
-    it('should show error when customName is empty (badRename)', async () => {
+    it('should show a check icon when rename is confirmed', async () => {
       const entry = makeEntry({
         resolution: 'rename',
-        renameState: 'editing',
-        customName: '  '
+        renameState: 'ok',
+        customName: 'newname.csv'
       });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      await expect.element(screen.getByText('newname.csv')).toBeInTheDocument();
+    });
 
-      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+    it('should change label to "Confirm name" when in editing state', async () => {
+      const entry = makeEntry({ resolution: 'rename', renameState: 'editing' });
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const renameBtn = screen.getByRole('button', { name: /Confirm name/ });
+      await expect.element(renameBtn).toBeInTheDocument();
     });
 
-    it('should show error when customName matches original file name', async () => {
-      const file = new File(['x'], 'original.txt');
+    it('should show an error when new name matches the original', async () => {
       const entry = makeEntry({
-        file,
         resolution: 'rename',
         renameState: 'editing',
-        customName: 'original.txt'
+        originalName: 'same.txt',
+        customName: 'same.txt'
       });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      await expect
+        .element(screen.getByText('Please enter a different name, or select Replace or Skip.'))
+        .toBeInTheDocument();
     });
 
-    it('should call onCheckRename when Enter is pressed in input', async () => {
-      const onCheckRename = vi.fn();
+    it('should show an error when rename conflicts with existing file', async () => {
       const entry = makeEntry({
         resolution: 'rename',
-        renameState: 'editing',
-        customName: 'new-name.txt'
+        renameState: 'conflict',
+        originalName: 'original.txt',
+        customName: 'newname.txt'
       });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks, onCheckRename });
-
-      const input = page.getByRole('textbox', { name: 'New file name' });
-      const inputEl = input.element() as HTMLInputElement;
-      inputEl.focus();
-      inputEl.dispatchEvent(new KeyboardEvent('keydown', { key: 'Enter', bubbles: true }));
-      expect(onCheckRename).toHaveBeenCalled();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      await expect.element(screen.getByText(/This name already exists/)).toBeInTheDocument();
     });
 
-    it('should show "Confirm name" text when editing', async () => {
+    it('should call onRenameButtonClick when the Rename button shows "Confirm name"', async () => {
+      const onRenameButtonClick = vi.fn();
       const entry = makeEntry({ resolution: 'rename', renameState: 'editing' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect.element(page.getByRole('button', { name: /Confirm name/ })).toBeInTheDocument();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks, onRenameButtonClick });
+      await screen.getByRole('button', { name: /Confirm name/ }).click();
+      expect(onRenameButtonClick).toHaveBeenCalledOnce();
     });
 
-    it('should show check icon and success button when renameState is ok', async () => {
-      const entry = makeEntry({
-        resolution: 'rename',
-        renameState: 'ok',
-        customName: 'new-name.txt'
-      });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      // Should show the static display with the custom name (not the input)
-      await expect.element(page.getByText('new-name.txt')).toBeInTheDocument();
-      // Button should have success styling and show "Rename" text (not "Confirm name")
-      const btn = page.getByRole('button', { name: /Rename/ });
-      await expect.element(btn).toBeInTheDocument();
-      await expect.element(btn).toHaveAttribute('aria-pressed', 'true');
-    });
-
-    it('should call onSetCustomName when input value changes', async () => {
-      const onSetCustomName = vi.fn();
+    it('should show error state styling on the input when the same name is entered', async () => {
       const entry = makeEntry({
         resolution: 'rename',
         renameState: 'editing',
-        customName: 'old.txt'
+        originalName: 'same.txt',
+        customName: 'same.txt'
       });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks, onSetCustomName });
-
-      const input = page.getByRole('textbox', { name: 'New file name' });
-      const inputEl = input.element() as HTMLInputElement;
-      inputEl.focus();
-      inputEl.value = 'new-value.txt';
-      inputEl.dispatchEvent(new Event('input', { bubbles: true }));
-      expect(onSetCustomName).toHaveBeenCalledWith('new-value.txt');
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const input = screen.getByPlaceholder('New file name');
+      await expect.element(input).toHaveClass('input-error');
     });
 
-    it('should show "Confirm name" text when renameState is conflict', async () => {
-      const file = new File(['x'], 'original.txt');
+    it('should show error state styling on the input when rename conflicts', async () => {
       const entry = makeEntry({
-        file,
         resolution: 'rename',
         renameState: 'conflict',
-        customName: 'different.txt'
-      });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect.element(page.getByRole('button', { name: /Confirm name/ })).toBeInTheDocument();
-    });
-
-    it('should not call onCheckRename when a non-Enter key is pressed', async () => {
-      const onCheckRename = vi.fn();
-      const entry = makeEntry({
-        resolution: 'rename',
-        renameState: 'editing',
-        customName: 'new-name.txt'
+        originalName: 'original.txt',
+        customName: 'newname.txt'
       });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks, onCheckRename });
-
-      const input = page.getByRole('textbox', { name: 'New file name' });
-      const inputEl = input.element() as HTMLInputElement;
-      inputEl.focus();
-      inputEl.dispatchEvent(new KeyboardEvent('keydown', { key: 'a', bubbles: true }));
-      expect(onCheckRename).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('nameOnly derivation', () => {
-    it('should fall back to file.name when targetKey has no path separator', async () => {
-      const file = new File(['x'], 'fallback.txt');
-      const entry = makeEntry({ file, targetKey: 'fallback.txt' });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      await expect.element(page.getByText(/\u201Cfallback.txt\u201D/)).toBeInTheDocument();
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      const input = screen.getByPlaceholder('New file name');
+      await expect.element(input).toHaveClass('input-error');
     });
 
-    it('should not show error when customName is valid and different', async () => {
-      const file = new File(['x'], 'original.txt');
+    it('should show an input in conflict state with rename selected', async () => {
       const entry = makeEntry({
-        file,
         resolution: 'rename',
-        renameState: 'editing',
-        customName: 'different.txt'
+        renameState: 'conflict',
+        originalName: 'original.txt',
+        customName: 'newname.txt'
       });
-      render(UploadConflictEntry, { entry, ...defaultCallbacks });
-
-      // Input should be present and have no error styling
-      const input = page.getByRole('textbox', { name: 'New file name' });
-      await expect.element(input).toBeInTheDocument();
-      // The input should not have error class
-      const inputEl = input.element() as HTMLInputElement;
-      expect(inputEl.classList.contains('input-error')).toBe(false);
+      const screen = render(ConflictEntry, { entry, ...defaultCallbacks });
+      await expect.element(screen.getByPlaceholder('New file name')).toBeInTheDocument();
+      await expect.element(screen.getByText(/This name already exists/)).toBeInTheDocument();
     });
   });
 });
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index ec2f6253..9a83bdd8 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -11,8 +11,9 @@
   import { connectionStore } from '$lib/storage/connection-store.svelte.js';
   import { uploadConcurrency } from '$lib/client/feature-flags.js';
   import UploadDropzone from './UploadDropzone.svelte';
-  import UploadConflictEntry from './UploadConflictEntry.svelte';
   import UploadEntryStatus from './UploadEntryStatus.svelte';
+  import ConflictEntry from '../shared/ConflictEntry.svelte';
+  import type { ConflictEntry as ConflictEntryType } from '../shared/conflict-types.js';
   import type { FileEntry, Phase, Resolution, RenameState } from './types.js';
 
   interface Props {
@@ -418,8 +419,16 @@
         aria-label={m.storage_upload_conflicts_title()}
       >
         {#each conflictEntries as entry (entry.id)}
-          <UploadConflictEntry
-            {entry}
+          {@const mappedEntry: ConflictEntryType = {
+            id: entry.id,
+            originalName: entry.targetKey.split('/').at(-1) ?? entry.file.name,
+            conflict: entry.conflict,
+            resolution: entry.resolution,
+            customName: entry.customName,
+            renameState: entry.renameState
+          }}
+          <ConflictEntry
+            entry={mappedEntry}
             onSetResolution={(res) => setResolution(entry.id, res)}
             onSetCustomName={(name) => setCustomName(entry.id, name)}
             onRenameButtonClick={() => handleRenameButtonClick(entry.id)}
diff --git a/src/lib/components/storage/modals/upload/types.ts b/src/lib/components/storage/modals/upload/types.ts
index 61bd2321..80c0cf59 100644
--- a/src/lib/components/storage/modals/upload/types.ts
+++ b/src/lib/components/storage/modals/upload/types.ts
@@ -1,18 +1,11 @@
 /**
  * Shared types for the upload modal sub-components.
+ * Resolution and RenameState are re-exported from the shared conflict types.
  */
 
-export type Resolution = 'replace' | 'skip' | 'rename';
+import type { Resolution, RenameState } from '../shared/conflict-types.js';
 
-/**
- * Tracks the two-stage rename confirmation flow.
- * idle      - rename not selected for this entry
- * editing   - rename selected, text field is editable
- * checking  - async conflict check in progress
- * ok        - new name confirmed available
- * conflict  - new name already exists in the bucket
- */
-export type RenameState = 'idle' | 'editing' | 'checking' | 'ok' | 'conflict';
+export type { Resolution, RenameState };
 
 export type FileEntry = {
   id: string;
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 20189aa1..b3e4bbe1 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -14,6 +14,7 @@
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import type { PinnedLocation, StorageLocation } from '$lib/storage/types.js';
+  import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
   import { pinnedLabel, pinnedHref } from '$lib/storage/display-helpers.js';
   import { createResizablePanel } from './resizable-panel.svelte.js';
   import ResizeHandle from './ResizeHandle.svelte';
@@ -108,6 +109,30 @@
   function hideTooltip() {
     tooltipText = null;
   }
+
+  // ── Drag-drop targets for sidebar items ────────────────────────────────
+  let dropSidebarTarget = $state<string | null>(null);
+
+  function handleSidebarDragOver(e: DragEvent, prefix: string) {
+    if (!canStorageDrop(storage)) return;
+    e.preventDefault();
+    if (e.dataTransfer) e.dataTransfer.dropEffect = 'move';
+    dropSidebarTarget = prefix;
+  }
+
+  function handleSidebarDragLeave() {
+    dropSidebarTarget = null;
+  }
+
+  function handleSidebarDrop(e: DragEvent, _bucket: string, prefix: string) {
+    dropSidebarTarget = null;
+    if (!canStorageDrop(storage)) return;
+    e.preventDefault();
+    e.stopPropagation();
+    const keys = parseStorageDropKeys(e);
+    if (!keys) return;
+    void storage.performMove(prefix, keys);
+  }
 </script>
 
 <svelte:window onkeydown={handleKeydown} />
@@ -175,14 +200,18 @@
               href={pinnedHref(pin)}
               data-sveltekit-preload-data="off"
               class="
-              hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
-              pr-7 text-sm
-              {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}"
+                hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                pr-7 text-sm
+                {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}
+                {dropSidebarTarget === pin.prefix ? 'bg-primary/20' : ''}"
               aria-current={active ? 'page' : undefined}
               onmouseenter={(e) => showTooltip(e, pinnedLabel(pin))}
               onmouseleave={hideTooltip}
               onfocus={(e) => showTooltip(e, pinnedLabel(pin))}
               onblur={hideTooltip}
+              ondragover={(e) => handleSidebarDragOver(e, pin.prefix)}
+              ondragleave={handleSidebarDragLeave}
+              ondrop={(e) => handleSidebarDrop(e, pin.bucket, pin.prefix)}
             >
               <!-- eslint-enable svelte/no-navigation-without-resolve -->
               {#if pin.prefix === ''}
@@ -252,16 +281,20 @@
               })}
               data-sveltekit-preload-data="off"
               class="
-                hover:bg-base-200 flex items-center gap-2
-                px-3 py-1.5 text-sm
-                {activeBucket === bucket
+                  hover:bg-base-200 flex items-center gap-2
+                  px-3 py-1.5 text-sm
+                  {activeBucket === bucket
                 ? 'bg-primary/10 text-primary font-medium'
-                : 'text-base-content'}"
+                : 'text-base-content'}
+                  {dropSidebarTarget === '' && activeBucket === bucket ? 'bg-primary/20' : ''}"
               aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
               onmouseenter={(e) => showTooltip(e, bucket)}
               onmouseleave={hideTooltip}
               onfocus={(e) => showTooltip(e, bucket)}
               onblur={hideTooltip}
+              ondragover={(e) => handleSidebarDragOver(e, '')}
+              ondragleave={handleSidebarDragLeave}
+              ondrop={(e) => handleSidebarDrop(e, bucket, '')}
             >
               <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
               <span class="truncate">{bucket}</span>
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index d9f32945..a31d60c1 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -113,3 +113,27 @@ export const maxEditableFileSize: number = (() => {
   const parsed = parseInt(publicEnv.PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE ?? '', 10);
   return Number.isFinite(parsed) && parsed > 0 ? parsed : 5 * 1024 * 1024;
 })();
+
+// ── Storage browser: Context actions (cut, copy, paste, rename) ────────────
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true`, the context
+ *  menu shows Cut/Copy actions. Uses the PUBLIC_ key so the same env var gates
+ *  both client and server. Disabled by default. */
+export const storageCutCopyEnabled =
+  (publicEnv.PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED ?? 'false') === 'true';
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true`, the context
+ *  menu shows Paste and the paste API endpoint is active.
+ *  Uses PUBLIC_ key. Disabled by default. */
+export const storagePasteEnabled =
+  (publicEnv.PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED ?? 'false') === 'true';
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true`, the rename
+ *  API endpoint is active. Uses PUBLIC_ key. Disabled by default. */
+export const storageRenameEnabled =
+  (publicEnv.PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED ?? 'false') === 'true';
+
+/** When `PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true`, the move
+ *  API endpoint (drag-and-drop) is active. Uses PUBLIC_ key. Disabled by default. */
+export const storageMoveEnabled =
+  (publicEnv.PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED ?? 'false') === 'true';
diff --git a/src/lib/server/storage/download-tokens.ts b/src/lib/server/storage/download-tokens.ts
new file mode 100644
index 00000000..35fe821e
--- /dev/null
+++ b/src/lib/server/storage/download-tokens.ts
@@ -0,0 +1,38 @@
+import type { S3ConnectionConfig } from './types.js';
+
+interface TokenEntry {
+  config: S3ConnectionConfig;
+  createdAt: number;
+}
+
+const tokens = new Map<string, TokenEntry>();
+const TOKEN_TTL_MS = 60_000;
+const CLEANUP_INTERVAL_MS = 30_000;
+
+let lastCleanup = Date.now();
+
+function cleanupExpired(): void {
+  const now = Date.now();
+  if (now - lastCleanup < CLEANUP_INTERVAL_MS) return;
+  lastCleanup = now;
+  const cutoff = now - TOKEN_TTL_MS;
+  for (const [key, entry] of tokens) {
+    if (entry.createdAt < cutoff) tokens.delete(key);
+  }
+}
+
+export function createDownloadToken(config: S3ConnectionConfig): string {
+  cleanupExpired();
+  const token = crypto.randomUUID();
+  tokens.set(token, { config, createdAt: Date.now() });
+  return token;
+}
+
+export function consumeDownloadToken(token: string): S3ConnectionConfig | null {
+  cleanupExpired();
+  const entry = tokens.get(token);
+  if (!entry) return null;
+  tokens.delete(token);
+  if (Date.now() - entry.createdAt > TOKEN_TTL_MS) return null;
+  return entry.config;
+}
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index faa5c07c..de0688c9 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -54,4 +54,8 @@ export class HDFSStorageProvider implements StorageProvider {
   listAllKeys(_prefix: string): Promise<string[]> {
     throw new Error('HDFS not implemented');
   }
+
+  copyObject(_sourceKey: string, _destKey: string): Promise<void> {
+    throw new Error('HDFS not implemented');
+  }
 }
diff --git a/src/lib/server/storage/job-store.ts b/src/lib/server/storage/job-store.ts
new file mode 100644
index 00000000..f865d24a
--- /dev/null
+++ b/src/lib/server/storage/job-store.ts
@@ -0,0 +1,96 @@
+import { logger } from '$lib/server/logging';
+
+const log = logger.child({ module: 'job-store' });
+
+export interface JobProgress {
+  completedCount: number;
+  completedBytes: number;
+  currentFileName?: string;
+}
+
+interface JobEntry<T> {
+  status: 'running' | 'done' | 'error';
+  result: T | null;
+  error?: string;
+  createdAt: number;
+  progress: JobProgress;
+}
+
+const store = new Map<string, JobEntry<unknown>>();
+
+const RUNNING_TTL = 30 * 60 * 1000;
+const DONE_TTL = 5 * 60 * 1000;
+const CLEANUP_INTERVAL = 60_000;
+
+let cleanupTimer: ReturnType<typeof setInterval> | null = null;
+
+function startCleanup(): void {
+  if (cleanupTimer) return;
+  cleanupTimer = setInterval(() => {
+    const now = Date.now();
+    for (const [id, entry] of store) {
+      const ttl = entry.status === 'running' ? RUNNING_TTL : DONE_TTL;
+      if (now - entry.createdAt > ttl) {
+        store.delete(id);
+        log.trace({ job_id: id, status: entry.status }, 'cleaned up expired job');
+      }
+    }
+  }, CLEANUP_INTERVAL);
+}
+
+startCleanup();
+
+/**
+ * Create a new job entry.
+ */
+export function createJob(id: string): void {
+  store.set(id, {
+    status: 'running',
+    result: null,
+    createdAt: Date.now(),
+    progress: { completedCount: 0, completedBytes: 0 }
+  });
+}
+
+/**
+ * Update the progress of a running job.
+ */
+export function updateJobProgress(id: string, progress: Partial<JobProgress>): void {
+  const entry = store.get(id);
+  if (!entry || entry.status !== 'running') return;
+  if (progress.completedCount !== undefined)
+    entry.progress.completedCount = progress.completedCount;
+  if (progress.completedBytes !== undefined)
+    entry.progress.completedBytes = progress.completedBytes;
+  if (progress.currentFileName !== undefined)
+    entry.progress.currentFileName = progress.currentFileName;
+}
+
+/**
+ * Mark a job as completed and store its result.
+ */
+export function completeJob<T>(id: string, result: T): void {
+  const entry = store.get(id);
+  if (!entry) return;
+  entry.status = 'done' as const;
+  (entry as JobEntry<T>).result = result;
+  log.trace({ job_id: id }, 'job completed');
+}
+
+/**
+ * Mark a job as failed.
+ */
+export function failJob(id: string, error: string): void {
+  const entry = store.get(id);
+  if (!entry) return;
+  entry.status = 'error' as const;
+  entry.error = error;
+  log.trace({ job_id: id, error }, 'job failed');
+}
+
+/**
+ * Get the current state of a job. Returns null if not found (expired or never existed).
+ */
+export function getJob<T>(id: string): JobEntry<T> | null {
+  return (store.get(id) as JobEntry<T>) ?? null;
+}
diff --git a/src/lib/server/storage/operations.ts b/src/lib/server/storage/operations.ts
new file mode 100644
index 00000000..60f0e494
--- /dev/null
+++ b/src/lib/server/storage/operations.ts
@@ -0,0 +1,68 @@
+import type { StorageProvider } from './provider.js';
+
+export interface DestEntry {
+  sourceKey: string;
+  baseDestKey: string;
+}
+
+/**
+ * Compute copy/move destinations for each source key, expanding directories
+ * to their full recursive listing while preserving the relative path
+ * structure under the destination prefix.
+ */
+export async function computeDestinations(
+  provider: StorageProvider,
+  sourceKeys: string[],
+  destinationPrefix: string
+): Promise<DestEntry[]> {
+  const destinations: DestEntry[] = [];
+
+  for (const key of sourceKeys) {
+    const name = key.endsWith('/')
+      ? key.split('/').filter(Boolean).pop() + '/'
+      : key.split('/').pop();
+
+    if (!key.endsWith('/')) {
+      destinations.push({ sourceKey: key, baseDestKey: destinationPrefix + name });
+    } else {
+      const children = await provider.listAllKeys(key);
+      destinations.push({ sourceKey: key, baseDestKey: destinationPrefix + name });
+      for (const child of children) {
+        if (child === key) continue;
+        const relPath = child.slice(key.length);
+        destinations.push({ sourceKey: child, baseDestKey: destinationPrefix + name + relPath });
+      }
+    }
+  }
+
+  return destinations;
+}
+
+/**
+ * Given a desired destination key, check if it already exists and generate
+ * a unique name by appending ` (1)`, ` (2)`, etc. before the extension.
+ * Returns the first key that does not exist.
+ */
+export async function uniqueDestKey(provider: StorageProvider, baseKey: string): Promise<string> {
+  if (!(await provider.exists(baseKey))) return baseKey;
+
+  const name = baseKey.endsWith('/') ? baseKey.slice(0, -1) : baseKey;
+  const lastDot = name.lastIndexOf('.');
+  const stem = lastDot > 0 ? name.slice(0, lastDot) : name;
+  const ext = lastDot > 0 && !baseKey.endsWith('/') ? name.slice(lastDot) : '';
+  const suffix = baseKey.endsWith('/') ? '/' : '';
+
+  let counter = 1;
+  while (true) {
+    const candidate = `${stem} (${counter})${ext}${suffix}`;
+    if (!(await provider.exists(candidate))) return candidate;
+    counter++;
+  }
+}
+
+/**
+ * Encode a value as a single NDJSON line (newline-delimited JSON).
+ */
+export function ndjsonLine(data: Record<string, unknown>): string {
+  return JSON.stringify(data) + '\n';
+}
diff --git a/src/lib/server/storage/preview/parquet.test.ts b/src/lib/server/storage/preview/parquet.test.ts
index cdd0e361..d268884f 100644
--- a/src/lib/server/storage/preview/parquet.test.ts
+++ b/src/lib/server/storage/preview/parquet.test.ts
@@ -62,6 +62,7 @@ function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider
     putObject: vi.fn(),
     deleteObjects: vi.fn(),
     listAllKeys: vi.fn(),
+    copyObject: vi.fn(),
     ...overrides
   };
 }
diff --git a/src/lib/server/storage/preview/stream.test.ts b/src/lib/server/storage/preview/stream.test.ts
index 458c16c8..54309e4c 100644
--- a/src/lib/server/storage/preview/stream.test.ts
+++ b/src/lib/server/storage/preview/stream.test.ts
@@ -18,6 +18,7 @@ function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider
     putObject: vi.fn(),
     deleteObjects: vi.fn(),
     listAllKeys: vi.fn(),
+    copyObject: vi.fn(),
     ...overrides
   };
 }
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index 2977e238..7d461c29 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -45,4 +45,20 @@ export interface StorageProvider {
    * Used to expand directory prefixes before deletion.
    */
   listAllKeys(prefix: string): Promise<string[]>;
+  /**
+   * Copy an object from `sourceKey` to `destKey` within the same bucket.
+   * For objects <= 5 GB uses S3 CopyObject; for larger objects streams the
+   * data through via multipart upload. Throws if the source does not exist
+   * or access is denied. Existing destination objects are silently overwritten.
+   *
+   * When provided, `onProgress` is called with `(loaded, total)` bytes during
+   * the multipart upload for large objects (> 5 GB). It is NOT called for
+   * small objects that use the native S3 CopyObject (which is server-side and
+   * has no streaming phase).
+   */
+  copyObject(
+    sourceKey: string,
+    destKey: string,
+    onProgress?: (loaded: number, total: number) => void
+  ): Promise<void>;
 }
diff --git a/src/lib/server/storage/s3-provider.test.ts b/src/lib/server/storage/s3-provider.test.ts
index 04fc0e4b..a662d2ab 100644
--- a/src/lib/server/storage/s3-provider.test.ts
+++ b/src/lib/server/storage/s3-provider.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
-import { S3ServiceException, PutObjectCommand } from '@aws-sdk/client-s3';
+import { S3ServiceException, PutObjectCommand, CopyObjectCommand } from '@aws-sdk/client-s3';
 
 vi.mock('$lib/server/logging', () => ({
   logger: { child: () => ({ trace: vi.fn(), warn: vi.fn(), info: vi.fn(), debug: vi.fn() }) }
@@ -519,6 +519,133 @@ describe('S3StorageProvider.listAllKeys', () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// copyObject
+// ---------------------------------------------------------------------------
+
+describe('S3StorageProvider.copyObject', () => {
+  let provider: S3StorageProvider;
+  let send: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    ({ provider, send } = makeProvider());
+    mockUploadDone.mockResolvedValue(undefined);
+    MockUpload.mockClear();
+  });
+
+  it('uses CopyObjectCommand for files under 5 GB', async () => {
+    // HeadObject returns ContentLength = 1000
+    send.mockResolvedValueOnce({ ContentLength: 1000 });
+    // CopyObject succeeds
+    send.mockResolvedValueOnce({});
+
+    await provider.copyObject('src/file.txt', 'dst/file.txt');
+
+    expect(send).toHaveBeenCalledTimes(2);
+    const copyCmd = send.mock.calls[1][0];
+    expect(copyCmd).toBeInstanceOf(CopyObjectCommand);
+    expect(copyCmd.input).toMatchObject({
+      Bucket: 'test-bucket',
+      CopySource: '/test-bucket/src%2Ffile.txt',
+      Key: 'dst/file.txt'
+    });
+    expect(MockUpload).not.toHaveBeenCalled();
+  });
+
+  it('uses server-side multipart copy for files over 5 GB', async () => {
+    const fiveGB = 5 * 1024 * 1024 * 1024;
+    const largeSize = fiveGB + 1;
+    // PART_SIZE = 256 MiB → 21 parts for (5GB + 1)
+    const numParts = 21;
+    const partSize = 256 * 1024 * 1024;
+
+    // HeadObject
+    send.mockResolvedValueOnce({
+      ContentLength: largeSize,
+      ContentType: 'application/octet-stream'
+    });
+    // CreateMultipartUpload
+    send.mockResolvedValueOnce({ UploadId: 'test-upload-id' });
+    // UploadPartCopy × numParts
+    for (let i = 0; i < numParts; i++) {
+      send.mockResolvedValueOnce({ CopyPartResult: { ETag: `etag-${i + 1}` } });
+    }
+    // CompleteMultipartUpload
+    send.mockResolvedValueOnce({});
+
+    await provider.copyObject('src/large.parquet', 'dst/large.parquet');
+
+    // Total calls: 1 Head + 1 Create + numParts UploadPartCopy + 1 Complete = 24
+    expect(send).toHaveBeenCalledTimes(1 + 1 + numParts + 1);
+
+    const createCmd = send.mock.calls[1][0];
+    expect(createCmd.constructor.name).toBe('CreateMultipartUploadCommand');
+    expect(createCmd.input).toMatchObject({
+      Bucket: 'test-bucket',
+      Key: 'dst/large.parquet',
+      ContentType: 'application/octet-stream'
+    });
+
+    for (let i = 0; i < numParts; i++) {
+      const partCmd = send.mock.calls[2 + i][0];
+      expect(partCmd.constructor.name).toBe('UploadPartCopyCommand');
+      const startByte = i * partSize;
+      const endByte = Math.min(startByte + partSize - 1, largeSize - 1);
+      expect(partCmd.input).toMatchObject({
+        Bucket: 'test-bucket',
+        Key: 'dst/large.parquet',
+        UploadId: 'test-upload-id',
+        PartNumber: i + 1,
+        CopySource: '/test-bucket/src%2Flarge.parquet',
+        CopySourceRange: `bytes=${startByte}-${endByte}`
+      });
+    }
+
+    const completeCmd = send.mock.calls[1 + 1 + numParts][0];
+    expect(completeCmd.constructor.name).toBe('CompleteMultipartUploadCommand');
+    expect(completeCmd.input).toMatchObject({
+      Bucket: 'test-bucket',
+      Key: 'dst/large.parquet',
+      UploadId: 'test-upload-id',
+      MultipartUpload: {
+        Parts: Array.from({ length: numParts }, (_, i) => ({
+          PartNumber: i + 1,
+          ETag: `etag-${i + 1}`
+        }))
+      }
+    });
+  });
+
+  it('reports progress during server-side multipart copy', async () => {
+    const size = 6 * 1024 * 1024 * 1024; // exactly 24 parts of 256 MiB
+    const partSize = 256 * 1024 * 1024;
+    const numParts = Math.ceil(size / partSize); // 24
+
+    const onProgress = vi.fn();
+
+    // HeadObject
+    send.mockResolvedValueOnce({ ContentLength: size, ContentType: 'video/mp4' });
+    // CreateMultipartUpload
+    send.mockResolvedValueOnce({ UploadId: 'upload-2' });
+    // UploadPartCopy × numParts
+    for (let i = 0; i < numParts; i++) {
+      send.mockResolvedValueOnce({ CopyPartResult: { ETag: `e${i}` } });
+    }
+    // CompleteMultipartUpload
+    send.mockResolvedValueOnce({});
+
+    await provider.copyObject('src/video.mp4', 'dst/video.mp4', onProgress);
+
+    expect(onProgress).toHaveBeenCalledTimes(numParts);
+    // Each call reports cumulative progress
+    for (let i = 0; i < numParts; i++) {
+      expect(onProgress).toHaveBeenNthCalledWith(i + 1, (i + 1) * partSize, size);
+    }
+    // Last call reports total size
+    expect(onProgress).toHaveBeenLastCalledWith(size, size);
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Constructor — uses createS3Client when no client injected
 // ---------------------------------------------------------------------------
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index 3cb18b05..cbd71f27 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -7,6 +7,11 @@ import {
   HeadObjectCommand,
   DeleteObjectsCommand,
   PutObjectCommand,
+  CopyObjectCommand,
+  CreateMultipartUploadCommand,
+  UploadPartCopyCommand,
+  CompleteMultipartUploadCommand,
+  AbortMultipartUploadCommand,
   type ListObjectsV2CommandOutput
 } from '@aws-sdk/client-s3';
 import { Upload } from '@aws-sdk/lib-storage';
@@ -178,7 +183,8 @@ export class S3StorageProvider implements StorageProvider {
     key: string,
     body: ReadableStream | Buffer,
     contentType: string,
-    contentLength?: number
+    contentLength?: number,
+    onProgress?: (loaded: number, total: number) => void
   ): Promise<void> {
     log.trace(
       { bucket: this.bucket, key, content_type: contentType, content_length: contentLength },
@@ -212,6 +218,11 @@ export class S3StorageProvider implements StorageProvider {
         ...(contentLength !== undefined ? { ContentLength: contentLength } : {})
       }
     });
+    if (onProgress && contentLength) {
+      upload.on('httpUploadProgress', (progress) => {
+        onProgress(progress.loaded ?? 0, contentLength);
+      });
+    }
     await withS3Errors(() => upload.done(), { bucket: this.bucket, key, operation: 'putObject' });
   }
 
@@ -303,4 +314,107 @@ export class S3StorageProvider implements StorageProvider {
     );
     return keys;
   }
+
+  async copyObject(
+    sourceKey: string,
+    destKey: string,
+    onProgress?: (loaded: number, total: number) => void
+  ): Promise<void> {
+    log.trace({ bucket: this.bucket, source_key: sourceKey, dest_key: destKey }, 'S3 CopyObject');
+
+    // S3 CopyObject has a 5 GB limit. For larger objects we use server-side
+    // multipart copy (UploadPartCopy) so data never streams through the server.
+    const HEAD_LIMIT = 5 * 1024 * 1024 * 1024;
+    const metadata = await this.getMetadata(sourceKey);
+
+    if (metadata.size <= HEAD_LIMIT) {
+      await withS3Errors(
+        () =>
+          this.client.send(
+            new CopyObjectCommand({
+              Bucket: this.bucket,
+              CopySource: `/${this.bucket}/${encodeURIComponent(sourceKey)}`,
+              Key: destKey
+            })
+          ),
+        { bucket: this.bucket, key: sourceKey, operation: 'copyObject' }
+      );
+      return;
+    }
+
+    log.info(
+      { bucket: this.bucket, source_key: sourceKey, size: metadata.size },
+      'object exceeds CopyObject limit, using server-side multipart copy'
+    );
+
+    await withS3Errors(
+      async () => {
+        const totalSize = metadata.size!;
+        // 256 MiB parts — well within the 10 000-part limit even for multi-TB objects
+        const PART_SIZE = 256 * 1024 * 1024;
+        const numParts = Math.ceil(totalSize / PART_SIZE);
+
+        const { UploadId } = await this.client.send(
+          new CreateMultipartUploadCommand({
+            Bucket: this.bucket,
+            Key: destKey,
+            ContentType: metadata.contentType ?? 'application/octet-stream'
+          })
+        );
+        const uploadId = UploadId!;
+
+        const parts: Array<{ PartNumber: number; ETag: string }> = [];
+        try {
+          for (let i = 0; i < numParts; i++) {
+            const partNumber = i + 1;
+            const startByte = i * PART_SIZE;
+            const endByte = Math.min(startByte + PART_SIZE - 1, totalSize - 1);
+
+            const { CopyPartResult } = await this.client.send(
+              new UploadPartCopyCommand({
+                Bucket: this.bucket,
+                Key: destKey,
+                UploadId: uploadId,
+                PartNumber: partNumber,
+                CopySource: `/${this.bucket}/${encodeURIComponent(sourceKey)}`,
+                CopySourceRange: `bytes=${startByte}-${endByte}`
+              })
+            );
+
+            parts.push({
+              PartNumber: partNumber,
+              ETag: CopyPartResult?.ETag ?? ''
+            });
+
+            if (onProgress) {
+              onProgress(Math.min((i + 1) * PART_SIZE, totalSize), totalSize);
+            }
+          }
+
+          await this.client.send(
+            new CompleteMultipartUploadCommand({
+              Bucket: this.bucket,
+              Key: destKey,
+              UploadId: uploadId,
+              MultipartUpload: { Parts: parts }
+            })
+          );
+        } catch (err) {
+          try {
+            await this.client.send(
+              new AbortMultipartUploadCommand({
+                Bucket: this.bucket,
+                Key: destKey,
+                UploadId: uploadId
+              })
+            );
+          } catch {
+            // best-effort cleanup
+          }
+          throw err;
+        }
+      },
+      { bucket: this.bucket, key: sourceKey, operation: 'copyObject' }
+    );
+  }
 }
diff --git a/src/lib/server/storage/streaming.ts b/src/lib/server/storage/streaming.ts
new file mode 100644
index 00000000..62b1b82b
--- /dev/null
+++ b/src/lib/server/storage/streaming.ts
@@ -0,0 +1,90 @@
+import { completeJob, failJob, updateJobProgress } from './job-store.js';
+import { ndjsonLine } from './operations.js';
+import type pino from 'pino';
+
+export interface StreamableOpResult {
+  results: Array<{ sourceKey: string; destKey: string }>;
+  failed: Array<{ sourceKey: string; error: string }>;
+}
+
+type ProgressEventBase =
+  | { type: 'progress'; sourceKey: string; destKey: string; loaded: number; total: number }
+  | { type: 'done'; sourceKey: string; destKey: string }
+  | { type: 'failed'; sourceKey: string; error: string };
+
+type ProgressEvent = ProgressEventBase | { type: 'status'; message: string };
+
+type EmitFn = (event: ProgressEvent) => void;
+
+/**
+ * Shared NDJSON streaming response helper.
+ *
+ * Sets up a ReadableStream that pipes progress/result events from an
+ * async operation to the client. Handles job-store integration and
+ * client disconnect gracefully.
+ */
+export function createProgressStream(
+  operation: (emit: EmitFn) => Promise<StreamableOpResult>,
+  options: {
+    jobId?: string;
+    operationName: string;
+    logger: pino.Logger;
+    bucket: string;
+    /** Build the complete event payload. Defaults to `{ type: 'complete', results, failed }`. */
+    buildCompletePayload?: (result: StreamableOpResult) => Record<string, unknown>;
+  }
+): Response {
+  const encoder = new TextEncoder();
+  let emitEvent: EmitFn = () => {};
+
+  const operationPromise = operation((event) => emitEvent(event));
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      emitEvent = (event) => {
+        if (options.jobId && event.type === 'progress') {
+          updateJobProgress(options.jobId, { completedBytes: event.loaded });
+        }
+
+        try {
+          controller.enqueue(encoder.encode(ndjsonLine(event)));
+        } catch {
+          // Controller closed (client disconnected) — operation continues
+          // in the background unaffected.
+        }
+      };
+
+      const result = await operationPromise;
+
+      if (options.jobId) {
+        if (result.failed.length > 0) {
+          failJob(
+            options.jobId,
+            `Failed to ${options.operationName} ${result.failed.length} item(s)`
+          );
+        } else {
+          completeJob(options.jobId, result);
+        }
+      }
+
+      const completePayload = options.buildCompletePayload
+        ? options.buildCompletePayload(result)
+        : { type: 'complete', results: result.results, failed: result.failed };
+
+      try {
+        controller.enqueue(encoder.encode(ndjsonLine(completePayload)));
+        controller.close();
+      } catch {
+        // Client already disconnected
+      }
+    }
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'application/x-ndjson',
+      'Cache-Control': 'no-cache',
+      'X-Accel-Buffering': 'no'
+    }
+  });
+}
diff --git a/src/lib/storage/drag-handlers.ts b/src/lib/storage/drag-handlers.ts
new file mode 100644
index 00000000..fa6e7244
--- /dev/null
+++ b/src/lib/storage/drag-handlers.ts
@@ -0,0 +1,43 @@
+import { SvelteSet } from 'svelte/reactivity';
+import { storageCutCopyEnabled, storageMoveEnabled } from '$lib/client/feature-flags.js';
+
+/**
+ * Auto-select the dragged item if not already selected, then attach
+ * the selected keys to the drag event for the drop target.
+ *
+ * NOTE: `state` must be the reactive storage object so that assignment
+ * to `selectedKeys` triggers reactivity.
+ */
+export function handleRowDragStart(
+  e: DragEvent,
+  itemKey: string,
+  state: { selectedKeys: Set<string>; isInArchive: boolean }
+): void {
+  if (!storageCutCopyEnabled || state.isInArchive) return;
+  if (!state.selectedKeys.has(itemKey)) {
+    state.selectedKeys = new SvelteSet<string>([itemKey]);
+  }
+  e.dataTransfer?.setData('application/x-storage-keys', JSON.stringify([...state.selectedKeys]));
+  e.dataTransfer!.effectAllowed = 'move';
+}
+
+/**
+ * Parse storage keys from a drop event's data transfer.
+ * Returns null if the data is missing or invalid.
+ */
+export function parseStorageDropKeys(e: DragEvent): string[] | null {
+  const raw = e.dataTransfer?.getData('application/x-storage-keys');
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw) as string[];
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check whether a storage drag-drop is allowed in the current context.
+ */
+export function canStorageDrop(storage: { isInArchive: boolean }): boolean {
+  return storageMoveEnabled && !storage.isInArchive;
+}
diff --git a/src/lib/storage/errors.ts b/src/lib/storage/errors.ts
index 58f32852..a9313a86 100644
--- a/src/lib/storage/errors.ts
+++ b/src/lib/storage/errors.ts
@@ -32,3 +32,7 @@ export function getActionErrorMessage(err: ActionError): string {
       return m.storage_download_error_unknown();
   }
 }
+
+export function getActionErrorMessageForCode(code: string): string {
+  return getActionErrorMessage(new ActionError(code, ''));
+}
diff --git a/src/lib/storage/state.svelte.spec.ts b/src/lib/storage/state.svelte.spec.ts
new file mode 100644
index 00000000..0fa4af2e
--- /dev/null
+++ b/src/lib/storage/state.svelte.spec.ts
@@ -0,0 +1,820 @@
+vi.mock('$lib/storage/upload.js', () => ({
+  checkObjectExists: vi.fn().mockResolvedValue(false)
+}));
+
+vi.mock('$lib/client/feature-flags.js', () => ({
+  storageAutoConnectEnabled: false,
+  storageRestoreTabsEnabled: false,
+  allowedPageSizes: [25, 50, 100],
+  defaultPageSize: 25,
+  maxRecentFiles: 15,
+  maxEditableFileSize: 5 * 1024 * 1024,
+  uploadConcurrency: 3,
+  storageCutCopyEnabled: true,
+  storagePasteEnabled: true,
+  storageRenameEnabled: true,
+  storageMoveEnabled: true
+}));
+
+vi.mock('$lib/storage/connection-storage.js', () => ({
+  STORAGE_CONNECTION_HEADER: 'x-storage-connection',
+  loadConnectionLocally: vi.fn(() => ({ id: 'test-conn', type: 's3' })),
+  getConnectionHeader: vi.fn(() => 'test-conn-header'),
+  saveConnectionLocally: vi.fn(),
+  loadAllConnectionsLocally: vi.fn(() => []),
+  removeConnectionLocally: vi.fn()
+}));
+
+vi.mock('$lib/storage/connection-store.svelte.js', () => ({
+  connectionStore: { activeConnectionId: 'test-connection-id' }
+}));
+
+vi.mock('$lib/stores/toast.svelte.js', () => ({
+  addToast: vi.fn()
+}));
+
+vi.mock('$app/navigation', () => ({
+  invalidateAll: vi.fn()
+}));
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { SvelteSet } from 'svelte/reactivity';
+import { StorageState } from './state.svelte.js';
+import type { StorageObject, StoragePage } from './types.js';
+import { addToast } from '$lib/stores/toast.svelte.js';
+import { invalidateAll } from '$app/navigation';
+
+function makeObjects(): StorageObject[] {
+  return [
+    {
+      key: 'file.txt',
+      size: 100,
+      lastModified: new Date('2025-01-01'),
+      isDirectory: false,
+      contentType: 'text/plain'
+    },
+    {
+      key: 'dir/',
+      size: 0,
+      lastModified: new Date('2025-01-01'),
+      isDirectory: true,
+      contentType: undefined
+    },
+    {
+      key: 'photo.jpg',
+      size: 500,
+      lastModified: new Date('2025-01-01'),
+      isDirectory: false,
+      contentType: 'image/jpeg'
+    },
+    {
+      key: 'nested/file.js',
+      size: 200,
+      lastModified: new Date('2025-01-01'),
+      isDirectory: false,
+      contentType: 'application/javascript'
+    }
+  ];
+}
+
+function makePage(objects?: StorageObject[]): StoragePage {
+  return {
+    objects: objects ?? makeObjects(),
+    hasNextPage: false,
+    currentPage: 1,
+    pageSize: 25
+  };
+}
+
+function makeState(overrides?: Partial<StorageState>): StorageState {
+  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+  state.bucket = 'test-bucket';
+  state.prefix = '';
+  state.objects = makePage();
+  if (overrides) {
+    Object.assign(state, overrides);
+  }
+  return state;
+}
+
+/**
+ * Build a mock Response that streams NDJSON events matching what the
+ * copy/move endpoints return when `?progress=true` is set.
+ */
+function makeNdjsonResponse(
+  data: Record<string, unknown>,
+  opts?: { ok?: boolean; status?: number }
+): Response {
+  const ok = opts?.ok ?? true;
+  const encoder = new TextEncoder();
+  const lines =
+    [
+      // Simulate a synthetic 100% progress event (as the server does for small files)
+      ...((data.results ?? data.moved) as Array<{ sourceKey: string; destKey: string }>).flatMap(
+        (r) => [
+          JSON.stringify({
+            type: 'progress',
+            sourceKey: r.sourceKey,
+            destKey: r.destKey,
+            loaded: 100,
+            total: 100
+          }),
+          JSON.stringify({ type: 'done', sourceKey: r.sourceKey, destKey: r.destKey })
+        ]
+      ),
+      ...((data.failed ?? []) as Array<unknown>).map((f) =>
+        JSON.stringify({ type: 'failed', ...(f as Record<string, unknown>) })
+      ),
+      JSON.stringify({ type: 'complete', ...data })
+    ].join('\n') + '\n';
+
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(encoder.encode(lines));
+      controller.close();
+    }
+  });
+
+  return new Response(stream, {
+    status: ok ? 200 : (opts?.status ?? 500),
+    headers: { 'Content-Type': 'application/x-ndjson' }
+  });
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// executeAction – cut
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('executeAction("cut")', () => {
+  it('sets clipboard with action="cut" and selected keys', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt', 'dir/']);
+
+    await state.executeAction('cut');
+
+    expect(state.clipboard).not.toBeNull();
+    expect(state.clipboard!.action).toBe('cut');
+    expect(state.clipboard!.keys.sort()).toEqual(['dir/', 'file.txt']);
+    expect(state.clipboard!.sourceBucket).toBe('test-bucket');
+  });
+
+  it('stores file sizes for non-directory items', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt', 'photo.jpg']);
+
+    await state.executeAction('cut');
+
+    expect(state.clipboard!.fileSizes).toEqual({ 'file.txt': 100, 'photo.jpg': 500 });
+  });
+
+  it('does nothing with empty selection', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>();
+
+    await state.executeAction('cut');
+
+    expect(state.clipboard).toBeNull();
+  });
+
+  it('shows an info toast with the count', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    await state.executeAction('cut');
+
+    expect(addToast).toHaveBeenCalledWith('info', expect.stringContaining('cut'));
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// executeAction – copy
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('executeAction("copy")', () => {
+  it('sets clipboard with action="copy" and selected keys', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt', 'nested/file.js']);
+
+    await state.executeAction('copy');
+
+    expect(state.clipboard).not.toBeNull();
+    expect(state.clipboard!.action).toBe('copy');
+    expect(state.clipboard!.keys.sort()).toEqual(['file.txt', 'nested/file.js']);
+  });
+
+  it('stores file sizes for non-directory items', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt', 'dir/']);
+
+    await state.executeAction('copy');
+
+    expect(state.clipboard!.fileSizes).toEqual({ 'file.txt': 100 });
+  });
+
+  it('does nothing with empty selection', async () => {
+    const state = makeState();
+
+    await state.executeAction('copy');
+
+    expect(state.clipboard).toBeNull();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// isCutKey
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('isCutKey', () => {
+  it('returns true when key is in clipboard with cut action and matching bucket', () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'cut',
+      keys: ['file.txt', 'dir/'],
+      sourceBucket: 'test-bucket',
+      sourcePrefix: '',
+      fileSizes: {}
+    };
+
+    expect(state.isCutKey('file.txt')).toBe(true);
+    expect(state.isCutKey('dir/')).toBe(true);
+  });
+
+  it('returns false for keys not in clipboard', () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'cut',
+      keys: ['file.txt'],
+      sourceBucket: 'test-bucket',
+      sourcePrefix: '',
+      fileSizes: {}
+    };
+
+    expect(state.isCutKey('photo.jpg')).toBe(false);
+  });
+
+  it('returns false when clipboard action is copy', () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'copy',
+      keys: ['file.txt'],
+      sourceBucket: 'test-bucket',
+      sourcePrefix: '',
+      fileSizes: {}
+    };
+
+    expect(state.isCutKey('file.txt')).toBe(false);
+  });
+
+  it('returns false when bucket does not match', () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'cut',
+      keys: ['file.txt'],
+      sourceBucket: 'other-bucket',
+      sourcePrefix: '',
+      fileSizes: {}
+    };
+
+    expect(state.isCutKey('file.txt')).toBe(false);
+  });
+
+  it('returns false when clipboard is null', () => {
+    const state = makeState();
+    state.clipboard = null;
+
+    expect(state.isCutKey('file.txt')).toBe(false);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// executeAction – paste
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('executeAction("paste")', () => {
+  it('shows warning when inside an archive', async () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'copy',
+      keys: ['file.txt'],
+      sourceBucket: 'test-bucket',
+      sourcePrefix: '',
+      fileSizes: {}
+    };
+    Object.assign(state, { archiveKey: 'archive.zip' });
+
+    await state.executeAction('paste');
+
+    expect(addToast).toHaveBeenCalledWith('warning', expect.any(String));
+  });
+
+  describe('from copy', () => {
+    it('calls the copy endpoint and shows success', async () => {
+      const state = makeState();
+      state.clipboard = {
+        action: 'copy',
+        keys: ['file.txt'],
+        sourceBucket: 'test-bucket',
+        sourcePrefix: '',
+        fileSizes: { 'file.txt': 100 }
+      };
+      const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        makeNdjsonResponse({
+          results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+          failed: []
+        })
+      );
+
+      await state.executeAction('paste');
+
+      expect(fetchMock).toHaveBeenCalledWith(
+        expect.stringContaining('/api/storage/copy'),
+        expect.objectContaining({
+          method: 'POST',
+          body: expect.stringContaining('"sourceKeys":["file.txt"]')
+        })
+      );
+      expect(addToast).toHaveBeenCalledWith('success', expect.stringContaining('pasted'));
+      expect(invalidateAll).toHaveBeenCalled();
+    });
+
+    it('shows error toast when all items fail (source not found)', async () => {
+      const state = makeState();
+      state.clipboard = {
+        action: 'copy',
+        keys: ['file.txt'],
+        sourceBucket: 'test-bucket',
+        sourcePrefix: '',
+        fileSizes: {}
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        makeNdjsonResponse({ results: [], failed: [{ sourceKey: 'file.txt', error: 'Not found' }] })
+      );
+
+      await state.executeAction('paste');
+
+      expect(addToast).toHaveBeenCalledWith(
+        'error',
+        expect.stringMatching(/source.*deleted|not found/i)
+      );
+      expect(invalidateAll).not.toHaveBeenCalled();
+    });
+
+    it('shows warning when some items fail', async () => {
+      const state = makeState();
+      state.clipboard = {
+        action: 'copy',
+        keys: ['file.txt', 'photo.jpg'],
+        sourceBucket: 'test-bucket',
+        sourcePrefix: '',
+        fileSizes: { 'file.txt': 100, 'photo.jpg': 500 }
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        makeNdjsonResponse({
+          results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+          failed: [{ sourceKey: 'photo.jpg', error: 'Not found' }]
+        })
+      );
+
+      await state.executeAction('paste');
+
+      expect(addToast).toHaveBeenCalledWith(
+        'warning',
+        expect.stringContaining('could not be pasted')
+      );
+    });
+  });
+
+  describe('from cut', () => {
+    it('calls the move endpoint and updates clipboard to destination keys', async () => {
+      const state = makeState();
+      state.clipboard = {
+        action: 'cut',
+        keys: ['file.txt'],
+        sourceBucket: 'test-bucket',
+        sourcePrefix: '',
+        fileSizes: { 'file.txt': 100 }
+      };
+      const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        makeNdjsonResponse({
+          moved: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+          failed: []
+        })
+      );
+
+      await state.executeAction('paste');
+
+      expect(fetchMock).toHaveBeenCalledWith(
+        expect.stringContaining('/api/storage/move'),
+        expect.any(Object)
+      );
+      // Clipboard updated to destination keys with action='copy'
+      expect(state.clipboard).not.toBeNull();
+      expect(state.clipboard!.action).toBe('copy');
+      expect(state.clipboard!.keys).toEqual(['dest/file.txt']);
+      expect(state.clipboard!.sourceBucket).toBe('test-bucket');
+    });
+
+    it('keeps original clipboard on failed move (no results)', async () => {
+      const state = makeState();
+      state.clipboard = {
+        action: 'cut',
+        keys: ['file.txt'],
+        sourceBucket: 'test-bucket',
+        sourcePrefix: '',
+        fileSizes: { 'file.txt': 100 }
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        makeNdjsonResponse({ moved: [], failed: [{ sourceKey: 'file.txt', error: 'Not found' }] })
+      );
+
+      await state.executeAction('paste');
+
+      // Clipboard unchanged (still cut keys)
+      expect(state.clipboard!.action).toBe('cut');
+      expect(state.clipboard!.keys).toEqual(['file.txt']);
+    });
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// confirmRename
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('confirmRename', () => {
+  it('closes modal if new name is same as current', async () => {
+    const state = makeState();
+    state.openModal('rename', { key: 'file.txt' });
+    expect(state.activeModal).not.toBeNull();
+
+    await state.confirmRename('file.txt', 'file.txt');
+
+    expect(state.activeModal).toBeNull();
+    expect(state.renameLoading).toBe(false);
+  });
+
+  it('shows inline error on 409 conflict and keeps modal open', async () => {
+    const state = makeState();
+    state.openModal('rename', { key: 'file.txt' });
+    const resp = new Response(null, { status: 409, statusText: 'Conflict' });
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(resp);
+
+    await state.confirmRename('file.txt', 'renamed.txt');
+
+    expect(state.activeModal?.type).toBe('rename');
+    expect(state.renameError).toContain('already exists');
+    expect(state.renameLoading).toBe(false);
+  });
+
+  it('shows toast on 403 and closes modal', async () => {
+    const state = makeState();
+    state.openModal('rename', { key: 'file.txt' });
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 403 }));
+
+    await state.confirmRename('file.txt', 'renamed.txt');
+
+    expect(state.activeModal).toBeNull();
+    expect(addToast).toHaveBeenCalledWith('error', expect.stringContaining('denied'));
+  });
+
+  it('shows toast on 404 and closes modal', async () => {
+    const state = makeState();
+    state.openModal('rename', { key: 'file.txt' });
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 404 }));
+
+    await state.confirmRename('file.txt', 'renamed.txt');
+
+    expect(state.activeModal).toBeNull();
+    expect(addToast).toHaveBeenCalledWith('error', expect.stringContaining('could not be found'));
+  });
+
+  it('shows success toast on successful rename and updates recent files', async () => {
+    const state = makeState();
+    state.openModal('rename', { key: 'file.txt' });
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({})
+    } as Response);
+    // Seed a recent file entry for the old key
+    state.bookmarks.recordFileVisit('test-bucket', 'file.txt', 100);
+
+    await state.confirmRename('file.txt', 'renamed.txt');
+
+    expect(state.activeModal).toBeNull();
+    expect(addToast).toHaveBeenCalledWith('success', expect.stringContaining('Renamed'));
+    expect(invalidateAll).toHaveBeenCalled();
+    // Recent files updated
+    expect(state.bookmarks.recentFiles.some((f) => f.key === 'renamed.txt')).toBe(true);
+    expect(state.bookmarks.recentFiles.some((f) => f.key === 'file.txt')).toBe(false);
+  });
+
+  it('handles directory rename (trailing slash)', async () => {
+    const state = makeState();
+    state.openModal('rename', { key: 'dir/' });
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({})
+    } as Response);
+
+    await state.confirmRename('dir/', 'renamed-dir');
+
+    expect(addToast).toHaveBeenCalledWith('success', expect.stringContaining('Renamed'));
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// performMove (drag-and-drop) + confirmMove
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('performMove', () => {
+  it('does nothing when destination is the same prefix', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    state.performMove('');
+
+    expect(state.activeModal).toBeNull();
+  });
+
+  it('does nothing when moving a folder into itself', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['dir/']);
+
+    state.performMove('dir/sub/');
+
+    expect(state.activeModal).toBeNull();
+  });
+
+  it('opens confirm-move modal with selected keys', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    state.performMove('dest/');
+
+    expect(state.activeModal?.type).toBe('confirm-move');
+    const payload = (
+      state.activeModal as { type: 'confirm-move'; payload: { keys: string[]; destPrefix: string } }
+    )?.payload;
+    expect(payload?.keys).toEqual(['file.txt']);
+    expect(payload?.destPrefix).toBe('dest/');
+  });
+
+  it('uses explicit keys when provided', () => {
+    const state = makeState();
+
+    state.performMove('dest/', ['dir/file.ts']);
+
+    expect(state.activeModal?.type).toBe('confirm-move');
+    const payload = (state.activeModal as { type: 'confirm-move'; payload: { keys: string[] } })
+      ?.payload;
+    expect(payload?.keys).toEqual(['dir/file.ts']);
+  });
+
+  it('does nothing when storageMoveEnabled is false', () => {
+    // storageMoveEnabled is set to true in the module-level vi.mock above, so
+    // this test verifies the same-prefix guard which also prevents the modal
+    // from opening (the flag guard is covered by the integration with the
+    // component-level mocks in other test files).
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    // Same prefix → should not open modal regardless of flag
+    state.performMove('');
+
+    expect(state.activeModal).toBeNull();
+  });
+});
+
+describe('confirmMove', () => {
+  it('calls the move endpoint and shows success toast', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+    state.performMove('dest/');
+
+    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      makeNdjsonResponse({
+        moved: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+        failed: []
+      })
+    );
+
+    await state.confirmMove();
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      expect.stringContaining('/api/storage/move'),
+      expect.objectContaining({
+        method: 'POST',
+        body: expect.stringContaining('"sourceKeys":["file.txt"]')
+      })
+    );
+    expect(addToast).toHaveBeenCalledWith('success', expect.stringContaining('moved'));
+    expect(state.activeModal).toBeNull();
+  });
+
+  it('shows warning on partial failures', async () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt', 'photo.jpg']);
+    state.performMove('dest/');
+
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      makeNdjsonResponse({
+        moved: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+        failed: [{ sourceKey: 'photo.jpg', error: 'Access denied' }]
+      })
+    );
+
+    await state.confirmMove();
+
+    expect(addToast).toHaveBeenCalledWith('warning', expect.stringContaining('could not be moved'));
+  });
+
+  it('cancelMove closes the modal without calling API', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+    state.performMove('dest/');
+    const fetchMock = vi.spyOn(globalThis, 'fetch');
+
+    state.cancelMove();
+
+    expect(state.activeModal).toBeNull();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// Keyboard shortcuts
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('handleKeydown', () => {
+  function dispatch(state: StorageState, key: string, ctrl = false, meta = false): void {
+    const event = new KeyboardEvent('keydown', {
+      key,
+      ctrlKey: ctrl,
+      metaKey: meta,
+      bubbles: true
+    });
+    state.handleKeydown(event);
+  }
+
+  it('Ctrl+X triggers cut when items selected', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    dispatch(state, 'x', true);
+
+    expect(state.clipboard).not.toBeNull();
+    expect(state.clipboard!.action).toBe('cut');
+  });
+
+  it('Ctrl+C triggers copy when items selected', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    dispatch(state, 'c', true);
+
+    expect(state.clipboard).not.toBeNull();
+    expect(state.clipboard!.action).toBe('copy');
+  });
+
+  it('Ctrl+V triggers paste when clipboard non-empty', async () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'copy',
+      keys: ['file.txt'],
+      sourceBucket: 'test-bucket',
+      sourcePrefix: '',
+      fileSizes: {}
+    };
+
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      makeNdjsonResponse({
+        results: [{ sourceKey: 'file.txt', destKey: 'paste/file.txt' }],
+        failed: []
+      })
+    );
+
+    await state.executeAction('paste');
+
+    expect(addToast).toHaveBeenCalledWith('success', expect.any(String));
+  });
+
+  it('Ctrl+V does nothing when clipboard is empty', () => {
+    const state = makeState();
+    state.clipboard = null;
+
+    dispatch(state, 'v', true);
+
+    expect(addToast).not.toHaveBeenCalled();
+  });
+
+  it('F2 triggers rename when one item is selected', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    dispatch(state, 'F2');
+
+    expect(state.activeModal?.type).toBe('rename');
+  });
+
+  it('F2 does nothing when no items selected', () => {
+    const state = makeState();
+
+    dispatch(state, 'F2');
+
+    expect(state.activeModal).toBeNull();
+  });
+
+  it('Delete opens delete modal', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    dispatch(state, 'Delete');
+
+    expect(state.activeModal?.type).toBe('delete');
+  });
+
+  it('Escape clears selection', () => {
+    const state = makeState();
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+
+    dispatch(state, 'Escape');
+
+    expect(state.selectedKeys.size).toBe(0);
+  });
+});
+
+// ────────────────────────────────────────────────────────────────────────────
+// Clipboard cleanup on delete
+// ────────────────────────────────────────────────────────────────────────────
+
+describe('performDelete clipboard cleanup', () => {
+  it('removes deleted keys from clipboard', async () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'cut',
+      keys: ['file.txt', 'photo.jpg', 'nested/file.js'],
+      sourceBucket: 'test-bucket',
+      sourcePrefix: '',
+      fileSizes: { 'file.txt': 100, 'photo.jpg': 500, 'nested/file.js': 200 }
+    };
+    state.selectedKeys = new SvelteSet<string>(['file.txt', 'photo.jpg']);
+    state.openModal('delete', { keys: ['file.txt', 'photo.jpg'] });
+
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ failed: [] })
+    } as Response);
+
+    await state.confirmDelete();
+
+    expect(state.clipboard!.keys).toEqual(['nested/file.js']);
+  });
+
+  it('clears clipboard when all keys are deleted', async () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'copy',
+      keys: ['file.txt'],
+      sourceBucket: 'test-bucket',
+      sourcePrefix: '',
+      fileSizes: { 'file.txt': 100 }
+    };
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+    state.openModal('delete', { keys: ['file.txt'] });
+
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ failed: [] })
+    } as Response);
+
+    await state.confirmDelete();
+
+    expect(state.clipboard).toBeNull();
+  });
+
+  it('does not affect clipboard when source bucket differs', async () => {
+    const state = makeState();
+    state.clipboard = {
+      action: 'copy',
+      keys: ['file.txt'],
+      sourceBucket: 'other-bucket',
+      sourcePrefix: '',
+      fileSizes: {}
+    };
+    state.selectedKeys = new SvelteSet<string>(['file.txt']);
+    state.openModal('delete', { keys: ['file.txt'] });
+
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ failed: [] })
+    } as Response);
+
+    await state.confirmDelete();
+
+    expect(state.clipboard).not.toBeNull();
+    expect(state.clipboard!.keys).toEqual(['file.txt']);
+  });
+});
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 7d46c1f1..9fdde33b 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -1,4 +1,6 @@
-import { SvelteSet, SvelteURLSearchParams } from 'svelte/reactivity';
+import { SvelteMap, SvelteSet, SvelteURLSearchParams } from 'svelte/reactivity';
+import { tick } from 'svelte';
+import { browser } from '$app/environment';
 import { invalidateAll } from '$app/navigation';
 import * as m from '$lib/paraglide/messages.js';
 import type { StoragePage, StorageObject } from '$lib/storage/types.js';
@@ -9,19 +11,77 @@ import type {
   ContextMenuState,
   NavigateFn,
   ActionName,
+  ClipboardState,
   ArchiveListingResponse,
-  ArchiveEntry
+  ArchiveEntry,
+  StorageOperation
 } from '$lib/storage/types.js';
 import { ARCHIVE_EXTENSIONS } from '$lib/storage/types.js';
 import { initPageSize, type PageSize } from '$lib/types/pagination.js';
-import { defaultPageSize } from '$lib/client/feature-flags.js';
+import {
+  defaultPageSize,
+  storageCutCopyEnabled,
+  storagePasteEnabled,
+  storageRenameEnabled,
+  storageMoveEnabled
+} from '$lib/client/feature-flags.js';
+import { checkObjectExists } from '$lib/storage/upload.js';
 import { downloadObject, DownloadError } from '$lib/storage/download.js';
+import type { ConflictEntry } from '$lib/components/storage/modals/shared/conflict-types.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { ActionError, getActionErrorMessage } from './errors.js';
 import { BookmarksState } from './bookmarks.svelte.js';
 import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 import { keyToName } from '$lib/storage/utils.js';
 
+// Set to true when the page starts unloading (reload, tab close, navigate away).
+// Used to suppress misleading error toasts for in-flight operations that the
+// browser cancelled — the server-side copies continue regardless.
+let pageUnloading = false;
+if (browser) {
+  window.addEventListener('beforeunload', () => {
+    pageUnloading = true;
+  });
+}
+
+// ── Operations history localStorage helpers ───────────────────────────────────
+
+const OPERATIONS_HISTORY_KEY = 'storage_operations_history';
+const MAX_HISTORY_ENTRIES = 30; // magic number: keep a reasonable number of past operations in localStorage
+
+function loadPersistedOperations(): StorageOperation[] {
+  if (!browser) return [];
+  try {
+    const raw = localStorage.getItem(OPERATIONS_HISTORY_KEY);
+    if (!raw) return [];
+    const ops = JSON.parse(raw) as StorageOperation[];
+    if (!Array.isArray(ops)) return [];
+    // Any operation that was still running when the page was last closed is now interrupted.
+    return ops.map((op) =>
+      op.status === 'running'
+        ? { ...op, status: 'interrupted' as const, completedAt: op.completedAt ?? Date.now() }
+        : op
+    );
+  } catch {
+    return [];
+  }
+}
+
+function saveOperationsToStorage(ops: StorageOperation[]): void {
+  if (!browser) return;
+  try {
+    // Persist only non-running entries (capped); running ones are saved on _startOp.
+    const history = ops.filter((op) => op.status !== 'running').slice(-MAX_HISTORY_ENTRIES);
+    // Merge with any running ops so they appear as interrupted after a refresh.
+    const running = ops.filter((op) => op.status === 'running');
+    const toSave = [...running, ...history].slice(-MAX_HISTORY_ENTRIES);
+    localStorage.setItem(OPERATIONS_HISTORY_KEY, JSON.stringify(toSave));
+  } catch {
+    // Best effort.
+  }
+}
+
 export class StorageState {
   // ── Core data (synced from server load) ──
   bucket = $state('');
@@ -61,17 +121,17 @@ export class StorageState {
   contextMenu = $state<ContextMenuState | null>(null);
 
   get ctxFileObj(): StorageObject | null {
-    if (!this.contextMenu) return null;
+    if (!this.contextMenu?.key) return null;
     return this.files.find((f: StorageObject) => f.key === this.contextMenu!.key) ?? null;
   }
   get ctxIsFile(): boolean {
     return this.ctxFileObj !== null;
   }
   get canPin(): boolean {
-    return this.contextMenu !== null && !this.ctxIsFile;
+    return this.contextMenu !== null && !!this.contextMenu.key && !this.ctxIsFile;
   }
   get ctxIsPinned(): boolean {
-    if (!this.contextMenu || this.ctxIsFile) return false;
+    if (!this.contextMenu?.key || this.ctxIsFile) return false;
     return this.bookmarks.isPinned(this.bucket, this.contextMenu.key);
   }
 
@@ -79,6 +139,10 @@ export class StorageState {
   loading = $state(false);
   deleting = $state(false);
 
+  // ── Rename inline ──
+  renameLoading = $state(false);
+  renameError = $state<string | null>(null);
+
   // ── Connection identity ──
   connectionId = $state<string | null>(null);
 
@@ -99,6 +163,47 @@ export class StorageState {
   // ── Composed sub-state ──
   bookmarks: BookmarksState;
 
+  // ── Clipboard (cut / copy) ──
+  clipboard = $state<ClipboardState | null>(null);
+
+  // ── Pending conflict resolution (paste / move) ──
+  _pendingConflictOp = $state<
+    | {
+        type: 'paste';
+        keys: string[];
+        sourceBucket: string;
+        destPrefix: string;
+        wasCut: boolean;
+        fileSizes: Record<string, number>;
+        sourcePrefix: string;
+        totalBytes: number;
+      }
+    | {
+        type: 'move';
+        keys: string[];
+        destPrefix: string;
+        items: Array<{ key: string; name: string; isDirectory: boolean; size?: number }>;
+        sourcePrefix: string | null;
+        totalBytes: number;
+      }
+    | null
+  >(null);
+
+  // ── Operations (paste / move / rename progress) ──
+  operations = $state<StorageOperation[]>([]);
+  hasRunningOps = $derived(this.operations.some((op) => op.status === 'running'));
+  /** AbortControllers keyed by operation ID, used to cancel in-flight requests. */
+  private _abortControllers = new SvelteMap<string, AbortController>();
+
+  /** True when `key` is in the clipboard with action='cut' and the bucket matches. */
+  isCutKey(key: string): boolean {
+    return (
+      this.clipboard?.action === 'cut' &&
+      this.clipboard.sourceBucket === this.bucket &&
+      this.clipboard.keys.includes(key)
+    );
+  }
+
   // ── Navigation handler (injected by page component) ──
   private _onNavigate: NavigateFn = () => {};
   // ── Refresh handler (injected by page component) ──
@@ -106,6 +211,11 @@ export class StorageState {
   // refresh does not add an extra browser history entry. Falls back to
   // invalidateAll when no handler has been set (e.g. in tests).
   private _onRefreshNavigate: (() => void) | null = null;
+  // ── Tabs invalidation callback (injected by FileExplorer) ──
+  // Called after file operations to mark source tabs as stale so they refetch
+  // when the user switches back to them.
+  private _onInvalidateSourceTabs: ((prefix: string) => void) | null = null;
+  private _pendingSourcePrefix: string | null = null;
 
   // ────────────────────────────────────────────────────────────────────────────
   // Constructor
@@ -116,6 +226,10 @@ export class StorageState {
     if (options?.buckets) this.buckets = options.buckets;
     if (options?.connectionId !== undefined) this.connectionId = options.connectionId;
     this.bookmarks = new BookmarksState(options?.connectionId ?? '');
+    // Restore persisted operation history (interrupted ops appear from previous sessions).
+    this.operations = loadPersistedOperations();
+    // Reconcile interrupted operations that have a server-side job store entry.
+    void this.reconcileInterruptedOps();
   }
 
   // ────────────────────────────────────────────────────────────────────────────
@@ -146,6 +260,10 @@ export class StorageState {
     this._onRefreshNavigate = fn;
   }
 
+  setTabsInvalidationHandler(fn: (prefix: string) => void): void {
+    this._onInvalidateSourceTabs = fn;
+  }
+
   // ────────────────────────────────────────────────────────────────────────────
   // Selection
   // ────────────────────────────────────────────────────────────────────────────
@@ -480,8 +598,16 @@ export class StorageState {
     this.contextMenu = { x: e.clientX, y: e.clientY, key };
   };
 
+  /** Open the context menu for the empty space (no specific item). */
+  openEmptyContextMenu = (e: MouseEvent): void => {
+    e.preventDefault();
+    e.stopPropagation();
+    this.selectedKeys = new SvelteSet<string>();
+    this.contextMenu = { x: e.clientX, y: e.clientY };
+  };
+
   closeContextMenu = (): void => {
-    if (this.contextMenu) {
+    if (this.contextMenu?.key) {
       this.selectedKeys.delete(this.contextMenu.key);
     }
     this.contextMenu = null;
@@ -595,9 +721,270 @@ export class StorageState {
         }
         return;
       }
+
+      case 'cut': {
+        if (!storageCutCopyEnabled) return;
+        const cutKeys = [...this.selectedKeys];
+        if (cutKeys.length === 0) return;
+        const fileSizes: Record<string, number> = {};
+        for (const obj of this.objects.objects) {
+          if (cutKeys.includes(obj.key) && !obj.isDirectory) {
+            fileSizes[obj.key] = obj.size;
+          }
+        }
+        this.clipboard = {
+          action: 'cut',
+          keys: cutKeys,
+          sourceBucket: this.bucket,
+          sourcePrefix: this.prefix,
+          fileSizes
+        };
+        addToast('info', m.storage_action_cut_success({ count: cutKeys.length }));
+        return;
+      }
+
+      case 'copy': {
+        if (!storageCutCopyEnabled) return;
+        const copyKeys = [...this.selectedKeys];
+        if (copyKeys.length === 0) return;
+        const fileSizes: Record<string, number> = {};
+        for (const obj of this.objects.objects) {
+          if (copyKeys.includes(obj.key) && !obj.isDirectory) {
+            fileSizes[obj.key] = obj.size;
+          }
+        }
+        this.clipboard = {
+          action: 'copy',
+          keys: copyKeys,
+          sourceBucket: this.bucket,
+          sourcePrefix: this.prefix,
+          fileSizes
+        };
+        addToast('info', m.storage_action_copy_success({ count: copyKeys.length }));
+        return;
+      }
+
+      case 'paste': {
+        if (!storagePasteEnabled) return;
+        if (!this.clipboard || this.clipboard.keys.length === 0) return;
+        if (this.isInArchive) {
+          addToast('warning', m.storage_action_paste_archive_error());
+          return;
+        }
+        const wasCut = this.clipboard.action === 'cut';
+        const pasteKeys = [...this.clipboard.keys];
+        // If the context menu was opened on a folder, paste inside it
+        const destPrefix = ctxKey && ctxKey.endsWith('/') ? ctxKey : this.prefix;
+
+        // ── Check for name conflicts at destination ──────────────────────
+        const conflictEntries = await this._checkDestinationConflicts(pasteKeys, destPrefix);
+        const hasConflicts = conflictEntries.some((e) => e.conflict);
+        if (hasConflicts) {
+          const totalBytes = pasteKeys.reduce(
+            (sum, k) => sum + (this.clipboard!.fileSizes[k] ?? 0),
+            0
+          );
+          this._pendingConflictOp = {
+            type: 'paste',
+            keys: pasteKeys,
+            sourceBucket: this.clipboard.sourceBucket,
+            destPrefix,
+            wasCut,
+            fileSizes: this.clipboard.fileSizes,
+            sourcePrefix: this.clipboard.sourcePrefix,
+            totalBytes
+          };
+          this.openModal('resolve-conflicts', {
+            entries: conflictEntries,
+            bucket: this.bucket,
+            destPrefix,
+            confirmLabel: m.storage_action_paste()
+          });
+          return;
+        }
+
+        const opId = crypto.randomUUID();
+        const abortController = new AbortController();
+        const sourceNames = pasteKeys.map((k) => keyToName(k));
+        const isSinglePaste = sourceNames.length === 1;
+        const pasteLabel = isSinglePaste
+          ? `${m.storage_operation_paste_one({ count: 1 })}: ${sourceNames[0]}`
+          : `${m.storage_operation_paste_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+        // Sum total bytes from clipboard file sizes
+        const totalBytes = pasteKeys.reduce(
+          (sum, k) => sum + (this.clipboard!.fileSizes[k] ?? 0),
+          0
+        );
+        this._startOp(
+          opId,
+          pasteLabel,
+          'paste',
+          pasteKeys.length,
+          abortController,
+          `${this.bucket}/${destPrefix}`,
+          sourceNames,
+          totalBytes
+        );
+        try {
+          let completedBytes = 0;
+          const fileSizes = this.clipboard?.fileSizes ?? {};
+          const pasteSourceNames = pasteKeys.map((k) => keyToName(k));
+          const fileJobIdsAccum: string[] = [];
+          const { results, failed } = await this.performPasteSequential(
+            pasteKeys,
+            this.clipboard.sourceBucket,
+            destPrefix,
+            wasCut,
+            abortController.signal,
+            (index, key) => {
+              // File-level progress: use the known file size from clipboard.
+              completedBytes += fileSizes[key] ?? 0;
+              this._updateOpProgress(opId, index, completedBytes, keyToName(key));
+            },
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            (loaded, _total) => {
+              // Byte-level progress during a large file's streaming upload.
+              // loaded comes from the server's onUploadProgress for the current
+              // file. We compute the absolute position by adding the sizes of
+              // all previously completed files.
+              const prevFiles = this.operations.find((op) => op.id === opId)?.completedCount ?? 0;
+              let prevBytes = 0;
+              for (let j = 0; j < prevFiles && j < pasteKeys.length; j++) {
+                prevBytes += fileSizes[pasteKeys[j]] ?? 0;
+              }
+              this._updateOpProgress(
+                opId,
+                prevFiles,
+                prevBytes + loaded,
+                pasteSourceNames[prevFiles] ?? ''
+              );
+            },
+            (index, jobId) => {
+              fileJobIdsAccum[index] = jobId;
+              this._updateOpJobIds(opId, [...fileJobIdsAccum]);
+            }
+          );
+          await tick();
+          if (results.length === 0) {
+            this._finishOp(opId, 'error');
+            addToast('error', m.storage_action_paste_error_source_not_found());
+            return;
+          }
+          this._finishOp(opId, failed > 0 ? 'error' : 'done');
+          // Record destination files as recent visits
+          const newFileSizes: Record<string, number> = {};
+          for (const r of results) {
+            if (r.destKey.endsWith('/')) continue;
+            const size = this.clipboard.fileSizes?.[r.sourceKey] ?? 0;
+            newFileSizes[r.destKey] = size;
+            this.bookmarks.recordFileVisit(this.bucket, r.destKey, size);
+          }
+          if (failed > 0) {
+            addToast('warning', m.storage_action_paste_partial({ count: failed }));
+          } else {
+            addToast('success', m.storage_action_paste_success({ count: results.length }));
+          }
+          // After a cut paste (move), update clipboard keys to the destination
+          // keys so subsequent pastes copy from the newly created files.
+          if (wasCut && results.length > 0) {
+            const destKeys = results.map((r) => r.destKey);
+            // Invalidate source tabs so they refetch (items moved out)
+            if (this.clipboard.sourcePrefix && this._onInvalidateSourceTabs) {
+              this._onInvalidateSourceTabs(this.clipboard.sourcePrefix);
+            }
+            this.clipboard = {
+              action: 'copy',
+              keys: destKeys,
+              sourceBucket: this.bucket,
+              sourcePrefix: this.prefix,
+              fileSizes: newFileSizes
+            };
+          }
+          this.refresh();
+          // Invalidate background tabs viewing the destination
+          if (this._onInvalidateSourceTabs) {
+            this._onInvalidateSourceTabs(destPrefix);
+          }
+        } catch (err: unknown) {
+          if (err instanceof DOMException && err.name === 'AbortError') {
+            this._finishOp(opId, 'cancelled');
+            return;
+          }
+          if (pageUnloading) {
+            // Page is unloading — server-side copies continue regardless.
+            // The operation persists as 'running' in localStorage and will
+            // appear as 'interrupted' on the next page load.
+            return;
+          }
+          this._finishOp(opId, 'error');
+          addToast(
+            'error',
+            err instanceof ActionError ? getActionErrorMessage(err) : m.storage_action_paste_error()
+          );
+        }
+        return;
+      }
+
+      case 'rename': {
+        if (!storageRenameEnabled) return;
+        const renameKey = ctxKey ?? [...this.selectedKeys][0];
+        if (!renameKey) return;
+        this.renameError = null;
+        this.renameLoading = false;
+        this.openModal('rename', { key: renameKey });
+        return;
+      }
+
+      case 'create-file':
+        this.openModal('create', { type: 'file' });
+        return;
+
+      case 'create-folder':
+        this.openModal('create', { type: 'folder' });
+        return;
     }
   };
 
+  confirmCreate = async (name: string, type: 'file' | 'folder'): Promise<void> => {
+    const sanitized = name.trim();
+    if (!sanitized || sanitized === '.' || sanitized === '..') return;
+
+    this.closeModal();
+    this.loading = true;
+
+    try {
+      const connectionId = connectionStore.activeConnectionId;
+      const headers: HeadersInit = connectionId
+        ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+        : {};
+      const isFolder = type === 'folder';
+      const parts = sanitized.split('/');
+
+      // Create intermediate directory markers
+      for (let i = 0; i < parts.length - 1; i++) {
+        const dirKey = this.prefix + parts.slice(0, i + 1).join('/') + '/';
+        const params = new SvelteURLSearchParams({ bucket: this.bucket, key: dirKey });
+        const res = await fetch(`/api/storage/create?${params}`, { method: 'POST', headers });
+        if (!res.ok) throw new Error(`Create failed with status ${res.status}`);
+      }
+
+      // Create the final object (file or directory)
+      const finalKey = this.prefix + sanitized + (isFolder ? '/' : '');
+      const params = new SvelteURLSearchParams({ bucket: this.bucket, key: finalKey });
+      const res = await fetch(`/api/storage/create?${params}`, { method: 'POST', headers });
+      if (!res.ok) throw new Error(`Create failed with status ${res.status}`);
+
+      void invalidateAll();
+    } catch {
+      addToast('error', m.storage_create_error({ name: sanitized }));
+      this.loading = false;
+    }
+  };
+
+  cancelCreate = (): void => {
+    this.closeModal();
+  };
+
   confirmDelete = async (): Promise<void> => {
     const modal = this.activeModal;
     if (!modal || modal.type !== 'delete') return;
@@ -613,8 +1000,7 @@ export class StorageState {
       }
       this.selectedKeys = new SvelteSet<string>();
       this.selectionMode = false;
-      this.loading = true;
-      await invalidateAll();
+      this.refresh();
     } catch (err: unknown) {
       this.loading = false;
       let msg = m.storage_delete_error_unknown();
@@ -635,27 +1021,1231 @@ export class StorageState {
 
   handleUploadSuccess = (): void => {
     this.closeModal();
-    this.loading = true;
-    void invalidateAll();
+    this.refresh();
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Paste implementation
+  // ────────────────────────────────────────────────────────────────────────────
+
+  private async performPaste(
+    keys: string[],
+    _sourceBucket: string,
+    destPrefix: string,
+    deleteOriginals = false,
+    signal?: AbortSignal
+  ): Promise<{
+    results: Array<{ sourceKey: string; destKey: string }>;
+    failed: number;
+  }> {
+    const connectionId = connectionStore.activeConnectionId;
+    if (!connectionId) throw new ActionError('not_connected', 'No connection');
+
+    const endpoint = deleteOriginals ? '/api/storage/move' : '/api/storage/copy';
+    const params = new SvelteURLSearchParams({ bucket: this.bucket });
+    const res = await fetch(`${endpoint}?${params}`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        [STORAGE_CONNECTION_ID_HEADER]: connectionId
+      },
+      body: JSON.stringify({
+        sourceKeys: keys,
+        destinationPrefix: destPrefix
+      }),
+      signal
+    });
+
+    if (!res.ok) {
+      let code = 'server_error';
+      if (res.status === 401) code = 'not_connected';
+      else if (res.status === 403) code = 'access_denied';
+      throw new ActionError(code, `Paste failed with status ${res.status}`);
+    }
+
+    const data = (await res.json()) as {
+      results?: Array<{ sourceKey: string; destKey: string }>;
+      moved?: Array<{ sourceKey: string; destKey: string }>;
+      failed: Array<unknown>;
+    };
+    const results = data.results ?? data.moved ?? [];
+    return { results, failed: data.failed?.length ?? 0 };
+  }
+
+  /**
+   * Process paste/move keys one at a time, calling `onFileComplete` after
+   * each file so the caller can update byte-level progress.
+   *
+   * Uses `?progress=true` to stream NDJSON progress events from the server,
+   * allowing real-time byte-level updates for large files (> 5 GB) that go
+   * through multipart streaming upload.
+   */
+  private async performPasteSequential(
+    keys: string[],
+    _sourceBucket: string,
+    destPrefix: string,
+    deleteOriginals = false,
+    signal?: AbortSignal,
+    onFileComplete?: (index: number, key: string) => void,
+    onFileProgress?: (loaded: number, total: number) => void,
+    onFileJobId?: (index: number, jobId: string) => void
+  ): Promise<{
+    results: Array<{ sourceKey: string; destKey: string }>;
+    failed: number;
+    fileJobIds: string[];
+  }> {
+    const connectionId = connectionStore.activeConnectionId;
+    if (!connectionId) throw new ActionError('not_connected', 'No connection');
+
+    const endpoint = deleteOriginals ? '/api/storage/move' : '/api/storage/copy';
+    const results: Array<{ sourceKey: string; destKey: string }> = [];
+    let failed = 0;
+    const fileJobIds: string[] = [];
+
+    for (let i = 0; i < keys.length; i++) {
+      if (signal?.aborted) throw new DOMException('Aborted', 'AbortError');
+
+      const sourceKey = keys[i];
+      const fileJobId = crypto.randomUUID();
+      fileJobIds.push(fileJobId);
+      onFileJobId?.(i, fileJobId);
+      const params = new SvelteURLSearchParams({ bucket: this.bucket });
+      params.set('progress', 'true');
+      const res = await fetch(`${endpoint}?${params}`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          [STORAGE_CONNECTION_ID_HEADER]: connectionId
+        },
+        body: JSON.stringify({
+          sourceKeys: [sourceKey],
+          destinationPrefix: destPrefix,
+          jobId: fileJobId
+        }),
+        signal
+      });
+
+      if (!res.ok) {
+        failed++;
+        continue;
+      }
+
+      // Read the NDJSON stream
+      const reader = res.body?.getReader();
+      const decoder = new TextDecoder();
+      let buffer = '';
+
+      if (reader) {
+        try {
+          while (true) {
+            const { done, value } = await reader.read();
+            if (done) break;
+
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split('\n');
+            // Keep the last (potentially incomplete) line in the buffer
+            buffer = lines.pop() ?? '';
+
+            for (const line of lines) {
+              if (!line.trim()) continue;
+              const event = JSON.parse(line) as {
+                type: string;
+                sourceKey?: string;
+                destKey?: string;
+                loaded?: number;
+                total?: number;
+                error?: string;
+                results?: Array<{ sourceKey: string; destKey: string }>;
+                moved?: Array<{ sourceKey: string; destKey: string }>;
+                failed?: Array<{ sourceKey: string; error: string }>;
+              };
+
+              if (
+                event.type === 'progress' &&
+                event.loaded !== undefined &&
+                event.total !== undefined
+              ) {
+                onFileProgress?.(event.loaded, event.total);
+              } else if (event.type === 'done' && event.sourceKey && event.destKey) {
+                results.push({ sourceKey: event.sourceKey, destKey: event.destKey });
+              } else if (event.type === 'failed' && event.sourceKey) {
+                failed++;
+              } else if (event.type === 'complete') {
+                // Final summary — use its results/failed as the canonical source
+                if (event.results) {
+                  results.length = 0;
+                  results.push(...event.results);
+                }
+                if (event.failed) {
+                  failed = event.failed.length;
+                }
+              }
+            }
+          }
+        } finally {
+          reader.releaseLock();
+        }
+      }
+
+      onFileComplete?.(i + 1, sourceKey);
+    }
+
+    return { results, failed, fileJobIds };
+  }
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Rename
+  // ────────────────────────────────────────────────────────────────────────────
+
+  confirmRename = async (key: string, newName: string): Promise<void> => {
+    this.renameLoading = true;
+    this.renameError = null;
+
+    if (!newName.trim()) {
+      this.renameLoading = false;
+      return;
+    }
+
+    const parts = key.split('/').filter(Boolean);
+    parts.pop();
+    const parentPrefix = parts.length > 0 ? parts.join('/') + '/' : '';
+    const newKey = parentPrefix + newName + (key.endsWith('/') ? '/' : '');
+
+    if (newKey === key) {
+      this.renameLoading = false;
+      this.closeModal();
+      return;
+    }
+
+    const opId = crypto.randomUUID();
+    const renameObj = this.files.find((f) => f.key === key);
+    this._startOp(
+      opId,
+      `${m.storage_operation_rename()}: ${keyToName(key)} → ${newName}`,
+      'rename',
+      1,
+      undefined,
+      `${this.bucket}/${newKey}`,
+      [keyToName(key)],
+      renameObj?.size ?? 0
+    );
+
+    try {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) {
+        this._finishOp(opId, 'error');
+        this.renameLoading = false;
+        addToast('error', m.storage_rename_error_not_connected());
+        return;
+      }
+
+      const renameParams = new SvelteURLSearchParams({ bucket: this.bucket });
+      const res = await fetch(`/api/storage/rename?${renameParams}`, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          [STORAGE_CONNECTION_ID_HEADER]: connectionId
+        },
+        body: JSON.stringify({ key, newKey })
+      });
+
+      if (!res.ok) {
+        this._finishOp(opId, 'error');
+        this.renameLoading = false;
+        if (res.status === 409) {
+          this.renameError = m.storage_rename_error_conflict({ name: newName });
+          return;
+        }
+        this.closeModal();
+        let msg = m.storage_rename_error({ name: newName });
+        if (res.status === 403) msg = m.storage_rename_error_access_denied();
+        else if (res.status === 404) msg = m.storage_rename_error_not_found();
+        addToast('error', msg);
+        return;
+      }
+
+      // Update recent files
+      if (!key.endsWith('/')) {
+        this.bookmarks.removeFiles(this.bucket, [key]);
+        const obj = this.files.find((f) => f.key === key);
+        if (obj) {
+          this.bookmarks.recordFileVisit(this.bucket, newKey, obj.size);
+        }
+      }
+
+      this._updateOpProgress(opId, 1, renameObj?.size ?? 0);
+      await tick();
+      this._finishOp(opId, 'done');
+      this.renameLoading = false;
+      this.closeModal();
+      addToast('success', m.storage_rename_success({ name: newName }));
+      this.refresh();
+    } catch {
+      this._finishOp(opId, 'error');
+      this.renameLoading = false;
+      this.closeModal();
+      addToast('error', m.storage_rename_error({ name: newName }));
+    }
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Move (used by drag-and-drop)
+  // ────────────────────────────────────────────────────────────────────────────
+
+  /** Validate a drag-and-drop move and open the confirmation dialog.
+   *  The actual API call happens in `confirmMove` after the user confirms. */
+  performMove = (destPrefix: string, keys?: string[]): void => {
+    if (!storageMoveEnabled) return;
+    const moveKeys = keys ?? [...this.selectedKeys];
+    if (moveKeys.length === 0) return;
+
+    // Don't move items that are already directly inside destPrefix (no-op).
+    // This is more precise than comparing destPrefix to this.prefix, which
+    // would incorrectly block cross-tab drops onto the destination directory.
+    const isAlreadyThere = (key: string): boolean => {
+      if (key.endsWith('/')) return key === destPrefix;
+      const parentPrefix = key.substring(0, key.lastIndexOf('/') + 1);
+      return parentPrefix === destPrefix;
+    };
+    if (moveKeys.every(isAlreadyThere)) return;
+
+    // Don't move a folder into itself
+    for (const k of moveKeys) {
+      if (k.endsWith('/') && destPrefix.startsWith(k)) return;
+    }
+
+    // Collect per-item metadata for the confirmation dialog
+    const items = moveKeys.map((key) => {
+      const obj = this.objects.objects.find((o) => o.key === key);
+      return {
+        key,
+        name: keyToName(key),
+        isDirectory: key.endsWith('/'),
+        size: obj && !obj.isDirectory ? obj.size : undefined
+      };
+    });
+
+    this.openModal('confirm-move', { keys: moveKeys, destPrefix, items });
+    // Derive source prefix from the keys being moved (common parent directory).
+    // Cannot use this.prefix because after a cross-tab drop the active tab is
+    // already the destination, so this.prefix equals destPrefix.
+    this._pendingSourcePrefix = this._commonPrefix(moveKeys);
+  };
+
+  /** Returns the longest common directory prefix of the given keys. */
+  private _commonPrefix(keys: string[]): string {
+    if (keys.length === 0) return '';
+    const parts = keys[0].split('/');
+    parts.pop(); // remove filename
+    let prefix = parts.join('/') ? parts.join('/') + '/' : '';
+    for (let i = 1; i < keys.length; i++) {
+      while (prefix && !keys[i].startsWith(prefix)) {
+        const idx = prefix.lastIndexOf('/', prefix.length - 2);
+        prefix = idx >= 0 ? prefix.substring(0, idx + 1) : '';
+      }
+    }
+    return prefix;
+  }
+
+  confirmMove = async (): Promise<void> => {
+    const modal = this.activeModal;
+    if (!modal || modal.type !== 'confirm-move') return;
+    const { keys: moveKeys, destPrefix, items } = modal.payload;
+    this.closeModal();
+
+    // ── Check for name conflicts at destination ──────────────────────────
+    const conflictEntries = await this._checkDestinationConflicts(moveKeys, destPrefix);
+    const hasConflicts = conflictEntries.some((e) => e.conflict);
+    if (hasConflicts) {
+      const totalBytes = items.reduce((sum, item) => sum + (item.size ?? 0), 0);
+      this._pendingConflictOp = {
+        type: 'move',
+        keys: moveKeys,
+        destPrefix,
+        items,
+        sourcePrefix: this._pendingSourcePrefix,
+        totalBytes
+      };
+      this.openModal('resolve-conflicts', {
+        entries: conflictEntries,
+        bucket: this.bucket,
+        destPrefix,
+        confirmLabel: m.storage_action_move()
+      });
+      return;
+    }
+
+    const opId = crypto.randomUUID();
+    const abortController = new AbortController();
+    const sourceNames = moveKeys.map((k) => keyToName(k));
+    const totalBytes = items.reduce((sum, item) => sum + (item.size ?? 0), 0);
+    const isSingleMove = sourceNames.length === 1;
+    const moveLabel = isSingleMove
+      ? `${m.storage_operation_move_one({ count: 1 })}: ${sourceNames[0]}`
+      : `${m.storage_operation_move_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+    this._startOp(
+      opId,
+      moveLabel,
+      'move',
+      moveKeys.length,
+      abortController,
+      `${this.bucket}/${destPrefix}`,
+      sourceNames,
+      totalBytes
+    );
+
+    try {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) {
+        this._finishOp(opId, 'error');
+        this._pendingSourcePrefix = null;
+        addToast('error', m.storage_action_move_error_not_connected());
+        return;
+      }
+
+      const endpoint = '/api/storage/move';
+      const results: Array<{ sourceKey: string; destKey: string }> = [];
+      let failed = 0;
+      const fileJobIds: string[] = [];
+
+      for (let i = 0; i < moveKeys.length; i++) {
+        if (abortController.signal.aborted) {
+          throw new DOMException('Aborted', 'AbortError');
+        }
+
+        const sourceKey = moveKeys[i];
+        const fileJobId = crypto.randomUUID();
+        fileJobIds.push(fileJobId);
+        this._updateOpJobIds(opId, [...fileJobIds]);
+        const params = new SvelteURLSearchParams({ bucket: this.bucket });
+        params.set('progress', 'true');
+        const res = await fetch(`${endpoint}?${params}`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            [STORAGE_CONNECTION_ID_HEADER]: connectionId
+          },
+          body: JSON.stringify({
+            sourceKeys: [sourceKey],
+            destinationPrefix: destPrefix,
+            jobId: fileJobId
+          }),
+          signal: abortController.signal
+        });
+
+        if (!res.ok) {
+          failed++;
+          continue;
+        }
+
+        // Read the NDJSON stream
+        const reader = res.body?.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+        let completedBytes = results.reduce((sum, r) => {
+          const item = items.find((it) => it.key === r.sourceKey);
+          return sum + (item?.size ?? 0);
+        }, 0);
+
+        if (reader) {
+          try {
+            while (true) {
+              const { done, value } = await reader.read();
+              if (done) break;
+
+              buffer += decoder.decode(value, { stream: true });
+              const lines = buffer.split('\n');
+              buffer = lines.pop() ?? '';
+
+              for (const line of lines) {
+                if (!line.trim()) continue;
+                const event = JSON.parse(line) as {
+                  type: string;
+                  sourceKey?: string;
+                  destKey?: string;
+                  loaded?: number;
+                  total?: number;
+                  error?: string;
+                  moved?: Array<{ sourceKey: string; destKey: string }>;
+                  failed?: Array<{ sourceKey: string; error: string }>;
+                };
+
+                if (
+                  event.type === 'progress' &&
+                  event.loaded !== undefined &&
+                  event.total !== undefined
+                ) {
+                  // Byte-level progress during large file streaming
+                  const prevBytes = results.reduce((sum, r) => {
+                    const item = items.find((it) => it.key === r.sourceKey);
+                    return sum + (item?.size ?? 0);
+                  }, 0);
+                  this._updateOpProgress(
+                    opId,
+                    i + 1,
+                    prevBytes + event.loaded,
+                    keyToName(sourceKey)
+                  );
+                } else if (event.type === 'done' && event.sourceKey && event.destKey) {
+                  results.push({ sourceKey: event.sourceKey, destKey: event.destKey });
+                  completedBytes = results.reduce((sum, r) => {
+                    const item = items.find((it) => it.key === r.sourceKey);
+                    return sum + (item?.size ?? 0);
+                  }, 0);
+                  this._updateOpProgress(opId, i + 1, completedBytes, keyToName(sourceKey));
+                } else if (event.type === 'failed' && event.sourceKey) {
+                  failed++;
+                } else if (event.type === 'complete') {
+                  if (event.moved) {
+                    results.length = 0;
+                    results.push(...event.moved);
+                  }
+                  if (event.failed) {
+                    failed = event.failed.length;
+                  }
+                }
+              }
+            }
+          } finally {
+            reader.releaseLock();
+          }
+        }
+      }
+
+      await tick();
+      this._finishOp(opId, failed === 0 ? 'done' : 'error');
+
+      if (results.length > 0) {
+        addToast('success', m.storage_action_move_success({ count: results.length }));
+        const movedKeys = results.map((r) => r.sourceKey).filter((k) => !k.endsWith('/'));
+        if (movedKeys.length > 0) {
+          this.bookmarks.removeFiles(this.bucket, movedKeys);
+        }
+        for (const r of results) {
+          if (!r.destKey.endsWith('/')) {
+            const obj = this.files.find((f) => f.key === r.sourceKey);
+            if (obj) {
+              this.bookmarks.recordFileVisit(this.bucket, r.destKey, obj.size);
+            }
+          }
+        }
+      }
+      if (failed > 0) {
+        addToast('warning', m.storage_action_move_partial({ count: failed }));
+      }
+
+      this.selectedKeys = new SvelteSet<string>();
+      this.selectionMode = false;
+      if (this._pendingSourcePrefix !== null && this._onInvalidateSourceTabs) {
+        this._onInvalidateSourceTabs(this._pendingSourcePrefix);
+        this._pendingSourcePrefix = null;
+      }
+      // Invalidate background tabs viewing the destination
+      if (this._onInvalidateSourceTabs) {
+        this._onInvalidateSourceTabs(destPrefix);
+      }
+      this.refresh();
+    } catch (err: unknown) {
+      if (err instanceof DOMException && err.name === 'AbortError') {
+        this._finishOp(opId, 'cancelled');
+        this._pendingSourcePrefix = null;
+        return;
+      }
+      if (pageUnloading) {
+        return;
+      }
+      this._finishOp(opId, 'error');
+      this._pendingSourcePrefix = null;
+      addToast('error', m.storage_action_move_error());
+    }
   };
 
+  cancelMove = (): void => {
+    this.closeModal();
+  };
+
+  // ────────────────────────────────────────────────────────────────────────────
+  // Conflict resolution (paste / move)
+  // ────────────────────────────────────────────────────────────────────────────
+
+  /**
+   * Check which destination keys already exist, returning ConflictEntry[]
+   * with conflict=true for existing keys.
+   */
+  private async _checkDestinationConflicts(
+    keys: string[],
+    destPrefix: string
+  ): Promise<ConflictEntry[]> {
+    const connectionId = connectionStore.activeConnectionId ?? '';
+    const results: ConflictEntry[] = [];
+
+    for (const key of keys) {
+      const origName = keyToName(key);
+      const destKey = destPrefix + origName;
+      let conflict = false;
+      try {
+        conflict = await checkObjectExists(this.bucket, destKey, connectionId);
+      } catch {
+        // If the check fails, assume no conflict and proceed
+      }
+      results.push({
+        id: crypto.randomUUID(),
+        originalName: origName,
+        conflict,
+        resolution: conflict ? null : 'replace',
+        customName: origName,
+        renameState: 'idle',
+        sourceKey: key
+      });
+    }
+
+    return results;
+  }
+
+  confirmConflictResolution = async (resolvedEntries: ConflictEntry[]): Promise<void> => {
+    const pending = this._pendingConflictOp;
+    if (!pending) return;
+    this._pendingConflictOp = null;
+    this.closeModal();
+
+    if (pending.type === 'paste') {
+      await this._executePasteWithConflicts(pending, resolvedEntries);
+    } else {
+      await this._executeMoveWithConflicts(pending, resolvedEntries);
+    }
+  };
+
+  cancelConflictResolution = (): void => {
+    this._pendingConflictOp = null;
+    this.closeModal();
+  };
+
+  /**
+   * Delete conflicting destination files before copy/move to prevent
+   * the server from auto-renaming them with " (2)" suffix.
+   */
+  private async _deleteConflictingDests(
+    destPrefix: string,
+    resolvedEntries: ConflictEntry[]
+  ): Promise<void> {
+    const connectionId = connectionStore.activeConnectionId;
+    if (!connectionId) return;
+
+    const keysToDelete: string[] = [];
+    for (const entry of resolvedEntries) {
+      if (entry.resolution === 'skip' || entry.resolution === 'rename') continue;
+      if (entry.conflict) {
+        keysToDelete.push(destPrefix + entry.originalName);
+      }
+    }
+
+    if (keysToDelete.length === 0) return;
+
+    const params = new SvelteURLSearchParams({ bucket: this.bucket });
+    for (const key of keysToDelete) {
+      params.append('keys', key);
+    }
+
+    try {
+      await fetch(`/api/storage/delete?${params}`, {
+        method: 'DELETE',
+        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+      });
+    } catch {
+      // Best-effort - if deletion fails, the server may auto-rename
+    }
+  }
+
+  /**
+   * Execute a paste operation with conflict resolutions.
+   * Renamed entries are first pasted with their original name, then renamed.
+   */
+  private async _executePasteWithConflicts(
+    pending: {
+      keys: string[];
+      sourceBucket: string;
+      destPrefix: string;
+      wasCut: boolean;
+      fileSizes: Record<string, number>;
+      sourcePrefix: string;
+      totalBytes: number;
+    },
+    resolvedEntries: ConflictEntry[]
+  ): Promise<void> {
+    const resolvedMap = new SvelteMap(
+      resolvedEntries.map((e) => [e.sourceKey ?? e.originalName, e])
+    );
+
+    // Split keys by resolution
+    const replaceKeys: string[] = [];
+    const renameKeys: Array<{ sourceKey: string; newName: string }> = [];
+
+    for (const key of pending.keys) {
+      const entry = resolvedMap.get(key) ?? resolvedMap.get(keyToName(key));
+      if (!entry || entry.resolution === 'skip') continue;
+      if (entry.resolution === 'rename') {
+        renameKeys.push({ sourceKey: key, newName: entry.customName.trim() });
+      }
+      replaceKeys.push(key);
+    }
+
+    if (replaceKeys.length === 0 && renameKeys.length === 0) return;
+
+    const opId = crypto.randomUUID();
+    const abortController = new AbortController();
+    const sourceNames = pending.keys.map((k) => keyToName(k));
+    const isSinglePaste = pending.keys.length === 1;
+    const pasteLabel = isSinglePaste
+      ? `${m.storage_operation_paste_one({ count: 1 })}: ${sourceNames[0]}`
+      : `${m.storage_operation_paste_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+
+    this._startOp(
+      opId,
+      pasteLabel,
+      'paste',
+      replaceKeys.length + renameKeys.length,
+      abortController,
+      `${this.bucket}/${pending.destPrefix}`,
+      sourceNames,
+      pending.totalBytes
+    );
+
+    await this._deleteConflictingDests(pending.destPrefix, resolvedEntries);
+
+    try {
+      const { results, failed } = await this.performPasteSequential(
+        replaceKeys,
+        pending.sourceBucket,
+        pending.destPrefix,
+        pending.wasCut,
+        abortController.signal,
+        (index, key) => {
+          this._updateOpProgress(opId, index, 0, keyToName(key));
+        },
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        (loaded, _total) => {
+          const prevFiles = this.operations.find((op) => op.id === opId)?.completedCount ?? 0;
+          this._updateOpProgress(opId, prevFiles, loaded, '');
+        }
+      );
+
+      // Handle renamed files: rename the already-pasted destination file
+      const destKeyMap = new SvelteMap(results.map((r) => [r.sourceKey, r.destKey]));
+      let renameFailed = 0;
+      for (const rename of renameKeys) {
+        if (abortController.signal.aborted) break;
+        const destKey = destKeyMap.get(rename.sourceKey);
+        if (!destKey) {
+          renameFailed++;
+          continue;
+        }
+        const connectionId = connectionStore.activeConnectionId;
+        if (!connectionId) {
+          renameFailed++;
+          continue;
+        }
+        const newKey = pending.destPrefix + rename.newName;
+        const renameParams = new SvelteURLSearchParams({ bucket: this.bucket });
+        try {
+          const res = await fetch(`/api/storage/rename?${renameParams}`, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+              [STORAGE_CONNECTION_ID_HEADER]: connectionId
+            },
+            body: JSON.stringify({ key: destKey, newKey })
+          });
+          if (!res.ok) renameFailed++;
+          this._updateOpProgress(
+            opId,
+            replaceKeys.length + renameKeys.indexOf(rename) + 1,
+            0,
+            rename.newName
+          );
+        } catch {
+          renameFailed++;
+        }
+      }
+
+      await tick();
+      const totalFailed = failed + renameFailed;
+      this._finishOp(opId, totalFailed > 0 ? 'error' : 'done');
+
+      if (totalFailed > 0) {
+        addToast('warning', m.storage_action_paste_partial({ count: totalFailed }));
+      } else {
+        addToast(
+          'success',
+          m.storage_action_paste_success({ count: replaceKeys.length + renameKeys.length })
+        );
+      }
+      this.refresh();
+    } catch (err: unknown) {
+      if (err instanceof DOMException && err.name === 'AbortError') {
+        this._finishOp(opId, 'cancelled');
+        return;
+      }
+      if (pageUnloading) {
+        return;
+      }
+      this._finishOp(opId, 'error');
+      addToast('error', m.storage_action_paste_error());
+    }
+  }
+
+  /**
+   * Execute a move operation with conflict resolutions.
+   * For "replace" entries: delete the conflicting destination first, then move.
+   * For "rename" entries: rename the source at its current location first,
+   * then move the renamed source to the destination — the file never appears
+   * at the original name in the destination.
+   */
+  private async _executeMoveWithConflicts(
+    pending: {
+      keys: string[];
+      destPrefix: string;
+      items: Array<{ key: string; name: string; isDirectory: boolean; size?: number }>;
+      sourcePrefix: string | null;
+      totalBytes: number;
+    },
+    resolvedEntries: ConflictEntry[]
+  ): Promise<void> {
+    const resolvedMap = new SvelteMap(
+      resolvedEntries.map((e) => [e.sourceKey ?? e.originalName, e])
+    );
+
+    // Split keys by resolution — rename entries are NOT added to replaceKeys here.
+    // They will be renamed at source first, then added to replaceKeys before the move loop.
+    const replaceKeys: string[] = [];
+    const renameKeys: Array<{ sourceKey: string; newName: string }> = [];
+
+    for (const key of pending.keys) {
+      const entry = resolvedMap.get(key) ?? resolvedMap.get(keyToName(key));
+      if (!entry || entry.resolution === 'skip') continue;
+      if (entry.resolution === 'rename') {
+        renameKeys.push({ sourceKey: key, newName: entry.customName.trim() });
+      } else {
+        replaceKeys.push(key);
+      }
+    }
+
+    if (replaceKeys.length === 0 && renameKeys.length === 0) return;
+
+    const opId = crypto.randomUUID();
+    const abortController = new AbortController();
+    const sourceNames = pending.keys.map((k) => keyToName(k));
+    const totalCount = replaceKeys.length + renameKeys.length;
+    const isSingleMove = totalCount === 1;
+    const moveLabel = isSingleMove
+      ? `${m.storage_operation_move_one({ count: 1 })}: ${sourceNames[0]}`
+      : `${m.storage_operation_move_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+
+    this._startOp(
+      opId,
+      moveLabel,
+      'move',
+      totalCount,
+      abortController,
+      `${this.bucket}/${pending.destPrefix}`,
+      sourceNames,
+      pending.totalBytes
+    );
+
+    const connectionId = connectionStore.activeConnectionId;
+    if (!connectionId) {
+      this._finishOp(opId, 'error');
+      addToast('error', m.storage_action_move_error_not_connected());
+      return;
+    }
+
+    // Only delete conflicting destinations for "replace" entries
+    await this._deleteConflictingDests(pending.destPrefix, resolvedEntries);
+
+    try {
+      const results: Array<{ sourceKey: string; destKey: string }> = [];
+      let renameFailed = 0;
+      let failed = 0;
+
+      // ── Pre-processing: rename rename entries at source before moving ─────
+      for (const rename of renameKeys) {
+        if (abortController.signal.aborted) break;
+
+        const parts = rename.sourceKey.split('/');
+        parts.pop();
+        const parentPrefix = parts.length > 0 ? parts.join('/') + '/' : '';
+        const renamedSourceKey =
+          parentPrefix + rename.newName + (rename.sourceKey.endsWith('/') ? '/' : '');
+
+        const renameParams = new SvelteURLSearchParams({ bucket: this.bucket });
+        try {
+          const renameRes = await fetch(`/api/storage/rename?${renameParams}`, {
+            method: 'POST',
+            headers: {
+              'Content-Type': 'application/json',
+              [STORAGE_CONNECTION_ID_HEADER]: connectionId
+            },
+            body: JSON.stringify({ key: rename.sourceKey, newKey: renamedSourceKey })
+          });
+          if (renameRes.ok) {
+            replaceKeys.push(renamedSourceKey);
+          } else {
+            renameFailed++;
+          }
+        } catch {
+          renameFailed++;
+        }
+      }
+
+      failed = renameFailed;
+
+      // ── Move all entries ────────────────────────────────────────────────────
+      const endpoint = '/api/storage/move';
+
+      for (const key of replaceKeys) {
+        if (abortController.signal.aborted) {
+          throw new DOMException('Aborted', 'AbortError');
+        }
+
+        const params = new SvelteURLSearchParams({ bucket: this.bucket });
+        params.set('progress', 'true');
+        const res = await fetch(`${endpoint}?${params}`, {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+            [STORAGE_CONNECTION_ID_HEADER]: connectionId
+          },
+          body: JSON.stringify({
+            sourceKeys: [key],
+            destinationPrefix: pending.destPrefix
+          }),
+          signal: abortController.signal
+        });
+
+        if (!res.ok) {
+          failed++;
+          continue;
+        }
+
+        // Read the NDJSON stream (the endpoint returns NDJSON when progress=true)
+        const reader = res.body?.getReader();
+        const decoder = new TextDecoder();
+        let buffer = '';
+
+        if (reader) {
+          try {
+            while (true) {
+              const { done, value } = await reader.read();
+              if (done) break;
+              buffer += decoder.decode(value, { stream: true });
+              const lines = buffer.split('\n');
+              buffer = lines.pop() ?? '';
+              for (const line of lines) {
+                if (!line.trim()) continue;
+                const event = JSON.parse(line) as {
+                  type: string;
+                  sourceKey?: string;
+                  destKey?: string;
+                  loaded?: number;
+                  total?: number;
+                  moved?: Array<{ sourceKey: string; destKey: string }>;
+                  failed?: Array<{ sourceKey: string; error: string }>;
+                };
+                if (event.type === 'done' && event.sourceKey && event.destKey) {
+                  results.push({ sourceKey: event.sourceKey, destKey: event.destKey });
+                } else if (event.type === 'failed' && event.sourceKey) {
+                  failed++;
+                } else if (event.type === 'complete') {
+                  if (event.moved) {
+                    results.length = 0;
+                    results.push(...event.moved);
+                  }
+                  if (event.failed) {
+                    failed = event.failed.length;
+                  }
+                }
+              }
+            }
+          } finally {
+            reader.releaseLock();
+          }
+        }
+        this._updateOpProgress(opId, results.length, 0, keyToName(key));
+      }
+
+      await tick();
+      const totalFailed = renameFailed + failed;
+      this._finishOp(opId, totalFailed === 0 ? 'done' : 'error');
+
+      if (results.length > 0) {
+        addToast('success', m.storage_action_move_success({ count: results.length }));
+        const movedKeys = results.map((r) => r.sourceKey).filter((k) => !k.endsWith('/'));
+        if (movedKeys.length > 0) {
+          this.bookmarks.removeFiles(this.bucket, movedKeys);
+        }
+      }
+      if (totalFailed > 0) {
+        addToast('warning', m.storage_action_move_partial({ count: totalFailed }));
+      }
+
+      this.selectedKeys = new SvelteSet<string>();
+      this.selectionMode = false;
+      if (pending.sourcePrefix !== null && this._onInvalidateSourceTabs) {
+        this._onInvalidateSourceTabs(pending.sourcePrefix);
+      }
+      // Invalidate background tabs viewing the destination
+      if (this._onInvalidateSourceTabs) {
+        this._onInvalidateSourceTabs(pending.destPrefix);
+      }
+      this.refresh();
+    } catch (err: unknown) {
+      if (err instanceof DOMException && err.name === 'AbortError') {
+        this._finishOp(opId, 'cancelled');
+        return;
+      }
+      if (pageUnloading) {
+        return;
+      }
+      this._finishOp(opId, 'error');
+      addToast('error', m.storage_action_move_error());
+    }
+  }
+
   // ────────────────────────────────────────────────────────────────────────────
   // Keyboard shortcuts
   // ────────────────────────────────────────────────────────────────────────────
 
   handleKeydown = (e: KeyboardEvent): void => {
     if (this.activeModal?.type === 'delete') return;
-    if (this.isInArchive) return; // No destructive actions inside archives
+    if (this.isInArchive && e.key !== 'Escape') return;
+
+    const isCtrl = e.ctrlKey || e.metaKey;
+
     if (e.key === 'Delete' && this.selectedKeys.size > 0) {
       this.openModal('delete', { keys: [...this.selectedKeys] });
     } else if (e.key === 'Escape') {
       if (this.contextMenu) {
         this.closeContextMenu();
       }
-      this.clearSelection();
+      if (this.selectedKeys.size > 0) {
+        this.clearSelection();
+      }
+    } else if (isCtrl && e.key === 'x') {
+      e.preventDefault();
+      if (!this.isInArchive && this.selectedKeys.size > 0) {
+        void this.executeAction('cut');
+      }
+    } else if (isCtrl && e.key === 'c') {
+      e.preventDefault();
+      if (!this.isInArchive && this.selectedKeys.size > 0) {
+        void this.executeAction('copy');
+      }
+    } else if (isCtrl && e.key === 'v') {
+      e.preventDefault();
+      if (!this.isInArchive && this.clipboard) {
+        void this.executeAction('paste');
+      }
+    } else if (e.key === 'F2') {
+      if (!this.isInArchive && this.selectedKeys.size === 1) {
+        void this.executeAction('rename');
+      }
     }
   };
 
+  // ────────────────────────────────────────────────────────────────────────────
+  // Private: Operations tracking helpers
+  // ────────────────────────────────────────────────────────────────────────────
+
+  private _startOp(
+    id: string,
+    label: string,
+    type: StorageOperation['type'],
+    itemCount: number,
+    abortController?: AbortController,
+    destPath?: string,
+    sourceNames?: string[],
+    totalBytes = 0
+  ): void {
+    this.operations = [
+      ...this.operations,
+      {
+        id,
+        label,
+        status: 'running',
+        type,
+        itemCount,
+        completedCount: 0,
+        startedAt: Date.now(),
+        destPath,
+        sourceNames,
+        totalBytes,
+        completedBytes: 0
+      }
+    ];
+    if (abortController) {
+      this._abortControllers.set(id, abortController);
+    }
+    // Persist immediately so a refresh shows the op as interrupted.
+    saveOperationsToStorage(this.operations);
+  }
+
+  private _updateOpProgress(
+    id: string,
+    completedCount: number,
+    completedBytes: number,
+    currentFileName?: string
+  ): void {
+    this.operations = this.operations.map((op) =>
+      op.id === id && op.status !== 'cancelled'
+        ? { ...op, completedCount, completedBytes, currentFileName }
+        : op
+    );
+  }
+
+  private _updateOpJobIds(id: string, fileJobIds: string[]): void {
+    this.operations = this.operations.map((op) => (op.id === id ? { ...op, fileJobIds } : op));
+    saveOperationsToStorage(this.operations);
+  }
+
+  private _finishOp(
+    id: string,
+    status: 'done' | 'error' | 'cancelled',
+    errorMessage?: string
+  ): void {
+    this.operations = this.operations.map((op) =>
+      op.id === id && op.status !== 'cancelled'
+        ? { ...op, status, errorMessage, completedAt: Date.now() }
+        : op
+    );
+    this._abortControllers.delete(id);
+    saveOperationsToStorage(this.operations);
+  }
+
+  /**
+   * For interrupted operations that have fileJobIds, poll the server job store
+   * to recover actual results. Updates operations in place.
+   * For jobs still running, polls periodically to show live progress.
+   */
+  private async reconcileInterruptedOps(): Promise<void> {
+    const interrupted = this.operations.filter(
+      (op) => op.status === 'interrupted' && op.fileJobIds && op.fileJobIds.length > 0
+    );
+    if (interrupted.length === 0) return;
+
+    for (const op of interrupted) {
+      void this._pollJobStatus(op);
+    }
+  }
+
+  /**
+   * Poll the server job store for a single operation's status.
+   * Updates the operation's progress and status in real-time.
+   */
+  private _pollTimers = new SvelteMap<string, ReturnType<typeof setTimeout>>();
+
+  private async _pollJobStatus(op: StorageOperation): Promise<void> {
+    // If the operation was cancelled while we were waiting to poll, stop.
+    if (this.operations.find((o) => o.id === op.id)?.status === 'cancelled') return;
+
+    let completedCount = 0;
+    let completedBytes = 0;
+    let anyRunning = false;
+
+    for (const jobId of op.fileJobIds!) {
+      try {
+        const res = await fetch(`/api/storage/copy/job/${jobId}`);
+        if (!res.ok) continue;
+        const job = (await res.json()) as {
+          status: string;
+          progress?: { completedCount?: number; completedBytes?: number; currentFileName?: string };
+        };
+        if (job.status === 'done') {
+          completedCount++;
+        } else if (job.status === 'running') {
+          anyRunning = true;
+          completedBytes += job.progress?.completedBytes ?? 0;
+        }
+      } catch {
+        // Job may have expired
+      }
+    }
+
+    // Update the operation — switch to 'running' if still in progress so the
+    // progress display shows live data instead of a static "interrupted" message.
+    if (anyRunning) {
+      this.operations = this.operations.map((o) =>
+        o.id === op.id
+          ? {
+              ...o,
+              status: 'running' as const,
+              completedCount,
+              completedBytes,
+              completedAt: undefined
+            }
+          : o
+      );
+      // Poll again in 2 seconds
+      const timer = setTimeout(() => void this._pollJobStatus(op), 2000);
+      this._pollTimers.set(op.id, timer);
+    } else {
+      // All jobs resolved — mark operation as done (or partially failed)
+      this.operations = this.operations.map((o) =>
+        o.id === op.id
+          ? {
+              ...o,
+              status: (completedCount === op.itemCount ? 'done' : 'error') as 'done' | 'error',
+              completedCount,
+              completedBytes,
+              completedAt: Date.now()
+            }
+          : o
+      );
+      saveOperationsToStorage(this.operations);
+
+      // Clean up any lingering timer
+      const existing = this._pollTimers.get(op.id);
+      if (existing) {
+        clearTimeout(existing);
+        this._pollTimers.delete(op.id);
+      }
+
+      // Refresh the current view if the operation was writing to the
+      // directory the user is currently browsing (or a parent of it).
+      if (op.destPath && `${this.bucket}/${this.prefix}`.startsWith(op.destPath)) {
+        this.refresh();
+      }
+
+      // Invalidate background tabs whose prefix matches the destination
+      if (op.destPath && this._onInvalidateSourceTabs) {
+        const slashIdx = op.destPath.indexOf('/');
+        if (slashIdx !== -1) {
+          const prefix = op.destPath.slice(slashIdx + 1);
+          this._onInvalidateSourceTabs(prefix.endsWith('/') ? prefix : prefix + '/');
+        }
+      }
+    }
+  }
+
+  /** Remove all completed/failed/cancelled/interrupted operations from history. */
+  clearOperationHistory = (): void => {
+    this.operations = this.operations.filter((op) => op.status === 'running');
+    saveOperationsToStorage(this.operations);
+  };
+
+  cancelOp = (id: string): void => {
+    const controller = this._abortControllers.get(id);
+    if (controller) {
+      controller.abort();
+    }
+    // Stop polling for re-acquired operations (restored from localStorage
+    // after a page refresh — these have no AbortController to cancel).
+    const timer = this._pollTimers.get(id);
+    if (timer) {
+      clearTimeout(timer);
+      this._pollTimers.delete(id);
+    }
+    this._finishOp(id, 'cancelled');
+  };
+
   // ────────────────────────────────────────────────────────────────────────────
   // Private: Delete implementation
   // ────────────────────────────────────────────────────────────────────────────
@@ -695,6 +2285,24 @@ export class StorageState {
       this.bookmarks.removeFiles(bucket, fileKeys);
     }
 
+    // Remove deleted keys from clipboard if they match the current bucket
+    if (this.clipboard && this.clipboard.sourceBucket === bucket) {
+      const remainingKeys = this.clipboard.keys.filter((k) => !keys.includes(k));
+      if (remainingKeys.length !== this.clipboard.keys.length) {
+        if (remainingKeys.length === 0) {
+          this.clipboard = null;
+        } else {
+          const remainingSizes: Record<string, number> = {};
+          for (const k of remainingKeys) {
+            if (this.clipboard.fileSizes[k] !== undefined) {
+              remainingSizes[k] = this.clipboard.fileSizes[k];
+            }
+          }
+          this.clipboard = { ...this.clipboard, keys: remainingKeys, fileSizes: remainingSizes };
+        }
+      }
+    }
+
     return result;
   }
 }
diff --git a/src/lib/storage/tabs.svelte.ts b/src/lib/storage/tabs.svelte.ts
index 585a77c6..84b94651 100644
--- a/src/lib/storage/tabs.svelte.ts
+++ b/src/lib/storage/tabs.svelte.ts
@@ -367,6 +367,26 @@ export class TabsState {
     this.saveToPersistence();
   }
 
+  /** Marks all non-active tabs whose snapshot prefix matches the given prefix
+   *  as stubs so that switching to them triggers a fresh server fetch. Called
+   *  after file operations (move, delete, rename) that change a directory's
+   *  contents. */
+  setStalePrefix(prefix: string): void {
+    let changed = false;
+    const next = this.tabs.map((tab) => {
+      if (tab.id === this.activeTabId) return tab;
+      if (tab.snapshot.prefix === prefix && !tab.stub) {
+        changed = true;
+        return { ...tab, stub: true };
+      }
+      return tab;
+    });
+    if (changed) {
+      this.tabs = next;
+      this.saveToPersistence();
+    }
+  }
+
   // ── Helpers ──────────────────────────────────────────────────────────────
 
   private buildLabel(bucket: string, prefix: string): string {
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index 984e05e4..6fd5af33 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -1,6 +1,13 @@
 // ── Modal types ─────────────────────────────────────────────────────────────
 
-export type ModalType = 'delete' | 'preview' | 'upload';
+export type ModalType =
+  | 'delete'
+  | 'preview'
+  | 'upload'
+  | 'rename'
+  | 'confirm-move'
+  | 'resolve-conflicts'
+  | 'create';
 
 export interface ModalPayloads {
   delete: { keys: string[] };
@@ -11,6 +18,30 @@ export interface ModalPayloads {
     nestedArchivePath?: string;
   };
   upload: { bucket: string; prefix: string };
+  rename: { key: string };
+  'confirm-move': {
+    keys: string[];
+    destPrefix: string;
+    /** Per-item metadata for display in the confirmation dialog. */
+    items: Array<{ key: string; name: string; isDirectory: boolean; size?: number }>;
+  };
+  'resolve-conflicts': {
+    /** Conflict entries to resolve. */
+    entries: Array<{
+      id: string;
+      originalName: string;
+      conflict: boolean;
+      resolution: 'replace' | 'skip' | 'rename' | null;
+      customName: string;
+      renameState: 'idle' | 'editing' | 'checking' | 'ok' | 'conflict';
+    }>;
+    bucket: string;
+    /** Destination prefix for rename-conflict checking. */
+    destPrefix: string;
+    /** Optional: label for the confirm button (e.g. "Paste" or "Move"). */
+    confirmLabel?: string;
+  };
+  create: { type: 'file' | 'folder' };
 }
 
 export type ActiveModal = {
@@ -22,7 +53,8 @@ export type ActiveModal = {
 export interface ContextMenuState {
   x: number;
   y: number;
-  key: string;
+  /** The item key that was right-clicked, or undefined for empty-space context menu. */
+  key?: string;
 }
 
 // ── Navigation ───────────────────────────────────────────────────────────────
@@ -43,7 +75,59 @@ export type ActionName =
   | 'pin'
   | 'unpin'
   | 'copy-filename'
-  | 'copy-path';
+  | 'copy-path'
+  | 'cut'
+  | 'copy'
+  | 'paste'
+  | 'rename'
+  | 'create-file'
+  | 'create-folder';
+
+// ── Clipboard state (cut / copy) ────────────────────────────────────────────
+
+/** Tracks items stored in the virtual clipboard for cut/copy + paste operations. */
+export interface ClipboardState {
+  /** 'cut' items are rendered shaded; 'copy' items are not. */
+  action: 'cut' | 'copy';
+  /** S3 keys of the items in the clipboard. */
+  keys: string[];
+  /** Bucket the items belong to. */
+  sourceBucket: string;
+  /** Prefix where the items were cut from (used to invalidate source tabs). */
+  sourcePrefix: string;
+  /** File sizes keyed by S3 key (for recent files tracking). */
+  fileSizes: Record<string, number>;
+}
+
+// ── Operations (paste / move / rename progress tracking) ─────────────────────
+
+export type OperationStatus = 'running' | 'done' | 'error' | 'cancelled' | 'interrupted';
+
+export type OperationType = 'paste' | 'move' | 'rename' | 'delete';
+
+export interface StorageOperation {
+  id: string;
+  label: string;
+  status: OperationStatus;
+  type: OperationType;
+  itemCount: number;
+  completedCount: number;
+  errorMessage?: string;
+  startedAt: number;
+  completedAt?: number;
+  /** Destination bucket/path for paste, move, and rename operations. */
+  destPath?: string;
+  /** Source file names being processed (shown while running). */
+  sourceNames?: string[];
+  /** Total bytes across all items in this operation. */
+  totalBytes: number;
+  /** Bytes transferred so far (sum of completed items). */
+  completedBytes: number;
+  /** Name of the file currently being transferred. */
+  currentFileName?: string;
+  /** Server-side job IDs per file for recovering results after reload. */
+  fileJobIds?: string[];
+}
 
 // ── Storage locations ────────────────────────────────────────────────────────
 
diff --git a/src/routes/(app)/api/storage/copy/+server.ts b/src/routes/(app)/api/storage/copy/+server.ts
new file mode 100644
index 00000000..e19b28fd
--- /dev/null
+++ b/src/routes/(app)/api/storage/copy/+server.ts
@@ -0,0 +1,145 @@
+import type { RequestHandler } from './$types';
+import { error, json } from '@sveltejs/kit';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucket } from '../params.js';
+import { computeDestinations, uniqueDestKey } from '$lib/server/storage/operations.js';
+import { createProgressStream } from '$lib/server/storage/streaming.js';
+import { createJob } from '$lib/server/storage/job-store.js';
+
+export const POST: RequestHandler = async ({ locals, request, url }) => {
+  const bucket = requireBucket(url);
+  const streamProgress = url.searchParams.get('progress') === 'true';
+
+  const body = (await request.json()) as {
+    sourceKeys: string[];
+    destinationPrefix: string;
+    jobId?: string;
+  };
+  if (!body.sourceKeys?.length) {
+    throw error(400, 'Missing required body field: sourceKeys');
+  }
+  if (body.destinationPrefix === undefined) {
+    throw error(400, 'Missing required body field: destinationPrefix');
+  }
+
+  locals.logger.debug(
+    {
+      bucket,
+      source_key_count: body.sourceKeys.length,
+      destination_prefix: body.destinationPrefix,
+      stream_progress: streamProgress
+    },
+    'copy request received'
+  );
+
+  const provider = getProvider(locals.storageConfig!, bucket);
+
+  if (!streamProgress) {
+    const destinations = await computeDestinations(
+      provider,
+      body.sourceKeys,
+      body.destinationPrefix
+    );
+    const results: Array<{ sourceKey: string; destKey: string }> = [];
+    const failed: Array<{ sourceKey: string; error: string }> = [];
+
+    for (const { sourceKey, baseDestKey } of destinations) {
+      try {
+        const destKey = await uniqueDestKey(provider, baseDestKey);
+        await provider.copyObject(sourceKey, destKey);
+        results.push({ sourceKey, destKey });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : 'Unknown error';
+        failed.push({ sourceKey, error: message });
+        locals.logger.warn(
+          { bucket, source_key: sourceKey, dest_key: baseDestKey, error: message },
+          'copy failed for key'
+        );
+      }
+    }
+
+    locals.logger.info({ bucket, copied: results.length, failed: failed.length }, 'copy completed');
+    return json({ results, failed });
+  }
+
+  if (body.jobId) {
+    createJob(body.jobId);
+  }
+
+  return createProgressStream(
+    (emit) => {
+      const run = async () => {
+        const destinations = await computeDestinations(
+          provider,
+          body.sourceKeys,
+          body.destinationPrefix
+        );
+        const results: Array<{ sourceKey: string; destKey: string }> = [];
+        const failed: Array<{ sourceKey: string; error: string }> = [];
+
+        for (const { sourceKey, baseDestKey } of destinations) {
+          try {
+            const destKey = await uniqueDestKey(provider, baseDestKey);
+
+            let reportedAnyProgress = false;
+            await provider.copyObject(sourceKey, destKey, (loaded, total) => {
+              reportedAnyProgress = true;
+              emit({ type: 'progress', sourceKey, destKey, loaded, total });
+            });
+
+            if (!reportedAnyProgress) {
+              try {
+                const meta = await provider.getMetadata(sourceKey);
+                emit({
+                  type: 'progress',
+                  sourceKey,
+                  destKey,
+                  loaded: meta.size,
+                  total: meta.size
+                });
+              } catch {
+                // Metadata fetch failed
+              }
+            }
+
+            results.push({ sourceKey, destKey });
+            emit({ type: 'done', sourceKey, destKey });
+          } catch (err) {
+            const message = err instanceof Error ? err.message : 'Unknown error';
+            const errorName = err instanceof Error ? err.constructor.name : typeof err;
+            const stack =
+              err instanceof Error ? (err.stack ?? '').split('\n').slice(0, 3).join(' | ') : '';
+            failed.push({ sourceKey, error: message });
+            locals.logger.warn(
+              {
+                bucket,
+                source_key: sourceKey,
+                dest_key: baseDestKey,
+                error: message,
+                error_name: errorName,
+                stack
+              },
+              'copy failed for key'
+            );
+            emit({ type: 'failed', sourceKey, error: message });
+          }
+        }
+
+        locals.logger.info(
+          { bucket, copied: results.length, failed: failed.length },
+          'copy completed'
+        );
+
+        return { results, failed };
+      };
+
+      return run();
+    },
+    {
+      jobId: body.jobId,
+      operationName: 'copy',
+      logger: locals.logger,
+      bucket
+    }
+  );
+};
diff --git a/src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts b/src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts
new file mode 100644
index 00000000..4f5c0923
--- /dev/null
+++ b/src/routes/(app)/api/storage/copy/job/[jobId]/+server.ts
@@ -0,0 +1,12 @@
+import type { RequestHandler } from './$types';
+import { json } from '@sveltejs/kit';
+import { getJob } from '$lib/server/storage/job-store.js';
+
+export const GET: RequestHandler = async ({ params }) => {
+  const { jobId } = params;
+  const job = getJob(jobId);
+  if (!job) {
+    return json({ status: 'not_found' }, { status: 404 });
+  }
+  return json(job);
+};
diff --git a/src/routes/(app)/api/storage/download/+server.ts b/src/routes/(app)/api/storage/download/+server.ts
index 51fe19a0..41e1b2e8 100644
--- a/src/routes/(app)/api/storage/download/+server.ts
+++ b/src/routes/(app)/api/storage/download/+server.ts
@@ -1,4 +1,5 @@
 import type { RequestHandler } from './$types';
+import { error } from '@sveltejs/kit';
 import { getProvider } from '$lib/server/storage/utils.js';
 import { requireBucketKey } from '../params.js';
 
@@ -15,15 +16,39 @@ function filenameFromKey(key: string): string {
  * The S3 body stream is piped straight to the HTTP response — no server-side
  * buffering occurs.
  *
- * The connection config is parsed and validated by the `handleStorageConnection`
- * middleware in hooks.server.ts before this handler runs.
+ * The connection config is resolved from `locals.storageConfig` which is set
+ * by the handleStorageConnection middleware using the x-storage-connection-id
+ * header and a database lookup.
  */
-export const GET: RequestHandler = async ({ locals, url }) => {
+export const GET: RequestHandler = async ({ locals, request, url }) => {
   const { bucket, key } = requireBucketKey(url);
 
   locals.logger.debug({ bucket, key }, 'download request received');
 
-  const download = await getProvider(locals.storageConfig!, bucket).getObject(key);
+  const config = locals.storageConfig;
+
+  if (!config) {
+    throw error(401, 'No storage connection configured');
+  }
+
+  const download = await getProvider(config, bucket).getObject(key);
+
+  // When the client cancels the download (closes the connection), abort the S3
+  // stream proactively so the backend stops fetching data from S3.
+  const abortController = new AbortController();
+  request.signal.addEventListener(
+    'abort',
+    () => {
+      locals.logger.info({ bucket, key }, 'client cancelled download — aborting S3 stream');
+      abortController.abort();
+    },
+    { once: true }
+  );
+
+  // Pipe the S3 stream through a TransformStream that honours the abort signal.
+  // This ensures the S3 SDK stops reading when the client disconnects.
+  const { readable, writable } = new TransformStream();
+  download.stream.pipeTo(writable, { signal: abortController.signal }).catch(() => {});
 
   const filename = filenameFromKey(key);
   // RFC 5987 encoding for non-ASCII filenames in Content-Disposition
@@ -46,7 +71,7 @@ export const GET: RequestHandler = async ({ locals, url }) => {
 
   locals.logger.info({ bucket, key, filename }, 'streaming object download');
 
-  return new Response(download.stream, { status: 200, headers });
+  return new Response(readable, { status: 200, headers });
 };
 
 /**
diff --git a/src/routes/(app)/api/storage/download/server.test.ts b/src/routes/(app)/api/storage/download/server.test.ts
index 9f02c56c..2098e0dd 100644
--- a/src/routes/(app)/api/storage/download/server.test.ts
+++ b/src/routes/(app)/api/storage/download/server.test.ts
@@ -15,7 +15,7 @@ function mockEvent(params: string) {
   const url = new URL(`http://localhost/api/storage/download?${params}`);
   return {
     url,
-    request: { headers: new Headers(CONNECTION_HEADER) },
+    request: { headers: new Headers(CONNECTION_HEADER), signal: new AbortController().signal },
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
       user: { id: 'test-user' },
diff --git a/src/routes/(app)/api/storage/move/+server.ts b/src/routes/(app)/api/storage/move/+server.ts
new file mode 100644
index 00000000..4ace6d11
--- /dev/null
+++ b/src/routes/(app)/api/storage/move/+server.ts
@@ -0,0 +1,158 @@
+import type { RequestHandler } from './$types';
+import { error, json } from '@sveltejs/kit';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucket } from '../params.js';
+import { computeDestinations, uniqueDestKey } from '$lib/server/storage/operations.js';
+import { createProgressStream } from '$lib/server/storage/streaming.js';
+import { createJob } from '$lib/server/storage/job-store.js';
+
+export const POST: RequestHandler = async ({ locals, request, url }) => {
+  const bucket = requireBucket(url);
+  const streamProgress = url.searchParams.get('progress') === 'true';
+
+  const body = (await request.json()) as {
+    sourceKeys: string[];
+    destinationPrefix: string;
+    jobId?: string;
+  };
+  if (!body.sourceKeys?.length) {
+    throw error(400, 'Missing required body field: sourceKeys');
+  }
+  if (body.destinationPrefix === undefined) {
+    throw error(400, 'Missing required body field: destinationPrefix');
+  }
+
+  locals.logger.debug(
+    {
+      bucket,
+      source_key_count: body.sourceKeys.length,
+      destination_prefix: body.destinationPrefix,
+      stream_progress: streamProgress
+    },
+    'move request received'
+  );
+
+  const provider = getProvider(locals.storageConfig!, bucket);
+
+  if (!streamProgress) {
+    const destinations = await computeDestinations(
+      provider,
+      body.sourceKeys,
+      body.destinationPrefix
+    );
+    const moved: Array<{ sourceKey: string; destKey: string }> = [];
+    const failed: Array<{ sourceKey: string; error: string }> = [];
+
+    for (const { sourceKey, baseDestKey } of destinations) {
+      try {
+        const destKey = await uniqueDestKey(provider, baseDestKey);
+        await provider.copyObject(sourceKey, destKey);
+        moved.push({ sourceKey, destKey });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : 'Unknown error';
+        failed.push({ sourceKey, error: message });
+        locals.logger.warn(
+          { bucket, source_key: sourceKey, dest_key: baseDestKey, error: message },
+          'move copy failed for key'
+        );
+      }
+    }
+
+    const keysToDelete = [...new Set(moved.map((m) => m.sourceKey))];
+    if (keysToDelete.length > 0) {
+      const deleteResult = await provider.deleteObjects(keysToDelete);
+      for (const f of deleteResult.failed) {
+        failed.push({ sourceKey: f.key, error: f.message ?? 'Delete failed' });
+        locals.logger.warn({ bucket, key: f.key }, 'move delete failed for key');
+      }
+    }
+
+    locals.logger.info({ bucket, moved: moved.length, failed: failed.length }, 'move completed');
+    return json({ moved, failed });
+  }
+
+  if (body.jobId) {
+    createJob(body.jobId);
+  }
+
+  return createProgressStream(
+    (emit) => {
+      const run = async () => {
+        const destinations = await computeDestinations(
+          provider,
+          body.sourceKeys,
+          body.destinationPrefix
+        );
+        const moved: Array<{ sourceKey: string; destKey: string }> = [];
+        const failed: Array<{ sourceKey: string; error: string }> = [];
+
+        for (const { sourceKey, baseDestKey } of destinations) {
+          try {
+            const destKey = await uniqueDestKey(provider, baseDestKey);
+            let reportedAnyProgress = false;
+            await provider.copyObject(sourceKey, destKey, (loaded, total) => {
+              reportedAnyProgress = true;
+              emit({ type: 'progress', sourceKey, destKey, loaded, total });
+            });
+
+            if (!reportedAnyProgress) {
+              try {
+                const meta = await provider.getMetadata(sourceKey);
+                emit({
+                  type: 'progress',
+                  sourceKey,
+                  destKey,
+                  loaded: meta.size,
+                  total: meta.size
+                });
+              } catch {
+                // Metadata fetch failed
+              }
+            }
+
+            moved.push({ sourceKey, destKey });
+            emit({ type: 'done', sourceKey, destKey });
+          } catch (err) {
+            const message = err instanceof Error ? err.message : 'Unknown error';
+            failed.push({ sourceKey, error: message });
+            locals.logger.warn(
+              { bucket, source_key: sourceKey, dest_key: baseDestKey, error: message },
+              'move copy failed for key'
+            );
+            emit({ type: 'failed', sourceKey, error: message });
+          }
+        }
+
+        const keysToDelete = [...new Set(moved.map((m) => m.sourceKey))];
+        if (keysToDelete.length > 0) {
+          emit({ type: 'status', message: `Deleting ${keysToDelete.length} original(s)` });
+          const deleteResult = await provider.deleteObjects(keysToDelete);
+          for (const f of deleteResult.failed) {
+            failed.push({ sourceKey: f.key, error: f.message ?? 'Delete failed' });
+            locals.logger.warn({ bucket, key: f.key }, 'move delete failed for key');
+          }
+        }
+
+        locals.logger.info(
+          { bucket, moved: moved.length, failed: failed.length },
+          'move completed'
+        );
+
+        return { results: moved, failed };
+      };
+
+      return run();
+    },
+    {
+      jobId: body.jobId,
+      operationName: 'move',
+      logger: locals.logger,
+      bucket,
+      buildCompletePayload: (result) => ({
+        type: 'complete',
+        moved: result.results,
+        failed: result.failed
+      })
+    }
+  );
+};
diff --git a/src/routes/(app)/api/storage/rename/+server.ts b/src/routes/(app)/api/storage/rename/+server.ts
new file mode 100644
index 00000000..d7de6d75
--- /dev/null
+++ b/src/routes/(app)/api/storage/rename/+server.ts
@@ -0,0 +1,78 @@
+import type { RequestHandler } from './$types';
+import { error, json } from '@sveltejs/kit';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucket } from '../params.js';
+
+export const POST: RequestHandler = async ({ locals, request, url }) => {
+  const bucket = requireBucket(url);
+
+  const body = (await request.json()) as { key: string; newKey: string };
+  if (!body.key) {
+    throw error(400, 'Missing required body field: key');
+  }
+  if (!body.newKey) {
+    throw error(400, 'Missing required body field: newKey');
+  }
+
+  locals.logger.debug(
+    { bucket, source_key: body.key, dest_key: body.newKey },
+    'rename request received'
+  );
+
+  const provider = getProvider(locals.storageConfig!, bucket);
+
+  // Conflict check: reject if destination already exists
+  const exists = await provider.exists(body.newKey);
+  if (exists) {
+    throw error(409, `Destination "${body.newKey}" already exists`);
+  }
+
+  // If renaming a directory (key ends with /), we need to rename all children
+  if (body.key.endsWith('/')) {
+    const children = await provider.listAllKeys(body.key);
+    // Rename the directory marker itself
+    try {
+      await provider.copyObject(body.key, body.newKey);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      throw error(502, `Rename failed for directory marker: ${message}`);
+    }
+    // Rename each child
+    for (const child of children) {
+      const destChild = body.newKey + child.slice(body.key.length);
+      try {
+        await provider.copyObject(child, destChild);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : 'Unknown error';
+        throw error(502, `Rename failed for child "${child}": ${message}`);
+      }
+    }
+    // Delete old paths
+    const allOld = [body.key, ...children];
+    const deleteResult = await provider.deleteObjects(allOld);
+    if (deleteResult.failed.length > 0) {
+      locals.logger.warn(
+        { bucket, failed_count: deleteResult.failed.length },
+        'rename delete had failures'
+      );
+    }
+  } else {
+    // Single file rename: copy + delete
+    try {
+      await provider.copyObject(body.key, body.newKey);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      throw error(502, `Rename failed: ${message}`);
+    }
+    try {
+      await provider.deleteObjects([body.key]);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      throw error(502, `Rename delete failed: ${message}`);
+    }
+  }
+
+  locals.logger.info({ bucket, source_key: body.key, dest_key: body.newKey }, 'rename completed');
+
+  return json({ success: true });
+};
diff --git a/src/test/setup-client.ts b/src/test/setup-client.ts
index abde46ae..dfd4d7ce 100644
--- a/src/test/setup-client.ts
+++ b/src/test/setup-client.ts
@@ -12,7 +12,12 @@ vi.mock('$lib/client/feature-flags.js', () => ({
   defaultPageSize: 25,
   maxRecentFiles: 15,
   maxEditableFileSize: 5 * 1024 * 1024,
-  uploadConcurrency: 3
+  uploadConcurrency: 3,
+  storageCutCopyEnabled: false,
+  storagePasteEnabled: false,
+  storageRenameEnabled: false,
+  storageMoveEnabled: false,
+  storageAutoConnectTimeoutMs: 15_000
 }));
 
 // Prevent components from auto-submitting forms in browser tests.

From 98e5d41da8c3658d188dcd77c9ca0d48a2f06e0c Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 15 Jul 2026 11:44:04 +0200
Subject: [PATCH 110/136] Feat/s3 file browser details pane (#237)

* #217 first iteration of details pane

* #217 fix some problems with first iteration

* #217 treemap improvements

* #217 add more directory metadata details

* #217 fix locale, remove unnecessary folder metadata

* #217 fix context menu placement, add padding check for treemap

* #217 add fade out to overflowing text on rectangles

* #217 make context menu teleporter

* add wrapper tp fix unit tests

* fix log warnings

* fix svelte check

* #217 add garage lifecycle rules, improve bucket details

* #217 improve folder details, add depth listing

* #237 address code review

* move tooltips to own component, add orientation, add tooltips to storage connection

* #208 show different connection error messages

* minor spelling change

* fix unit tests

* fix lint

* fix e2e tests

* fix lint

* address code review

* #237 fix merge conflict resolution

* fix unit test

* #217 remove redundant info, show full timestamp on files

* #217 spacing instead of border, fix context menu position, columns sortable, depth calculation, rectangle limit, maximize details

* #217 fix context menu visibility, improve maximized view, improve text on rectangles

* fix syntax

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
---
 e2e/init-garage-s3.sh                         |  91 ++++
 e2e/storage/details.spec.ts                   |  88 ++++
 messages/de.json                              |  84 +++-
 messages/en.json                              |  78 ++++
 .../storage/explorer/ContextMenu.svelte       |  12 +
 .../storage/explorer/FileExplorer.svelte      |   4 -
 .../storage/explorer/SelectionToolbar.svelte  |  11 +
 .../components/storage/explorer/TabBar.svelte |   2 +
 .../__tests__/StorageBreadcrumbWrapper.svelte |   7 +-
 .../storage/landing/BucketGrid.svelte         |  37 ++
 .../storage/landing/BucketGrid.svelte.spec.ts |  30 +-
 .../__tests__/BucketGridWrapper.svelte        |  16 +
 .../storage/modals/DetailsModal.svelte        | 156 +++++++
 .../storage/modals/StorageModals.svelte       |  23 +-
 .../modals/details/BucketDetails.svelte       | 272 ++++++++++++
 .../modals/details/DirectoryDetails.svelte    | 365 ++++++++++++++++
 .../modals/details/DirectorySizeList.svelte   | 147 +++++++
 .../storage/modals/details/FileDetails.svelte |  99 +++++
 .../storage/modals/details/Treemap.svelte     | 390 ++++++++++++++++++
 .../storage/shared/FloatingMenu.svelte        |  52 +++
 .../storage/shared/TimestampDisplay.svelte    |  10 +-
 .../storage/sidebar/BucketList.svelte         |  39 ++
 src/lib/server/storage/hdfs-provider.ts       |  24 ++
 .../server/storage/preview/parquet.test.ts    |   5 +
 src/lib/server/storage/preview/stream.test.ts |   5 +
 src/lib/server/storage/provider.ts            |   9 +
 src/lib/server/storage/s3-provider.ts         | 147 ++++++-
 src/lib/storage/details-types.ts              | 106 +++++
 src/lib/storage/state.svelte.ts               |  16 +
 src/lib/storage/types.ts                      |  11 +
 .../api/storage/bucket-details/+server.ts     |  29 ++
 .../api/storage/bucket-details/server.test.ts | 112 +++++
 .../(app)/api/storage/details/+server.ts      |  28 ++
 .../(app)/api/storage/details/server.test.ts  |  92 +++++
 .../api/storage/directory-metadata/+server.ts |  44 ++
 .../storage/directory-metadata/server.test.ts |  92 +++++
 .../api/storage/directory-size/+server.ts     | 196 +++++++++
 src/routes/(app)/storage/+layout.svelte       |   4 +
 src/routes/(app)/trino/+page.svelte           |   7 +-
 39 files changed, 2912 insertions(+), 28 deletions(-)
 create mode 100644 e2e/storage/details.spec.ts
 create mode 100644 src/lib/components/storage/landing/__tests__/BucketGridWrapper.svelte
 create mode 100644 src/lib/components/storage/modals/DetailsModal.svelte
 create mode 100644 src/lib/components/storage/modals/details/BucketDetails.svelte
 create mode 100644 src/lib/components/storage/modals/details/DirectoryDetails.svelte
 create mode 100644 src/lib/components/storage/modals/details/DirectorySizeList.svelte
 create mode 100644 src/lib/components/storage/modals/details/FileDetails.svelte
 create mode 100644 src/lib/components/storage/modals/details/Treemap.svelte
 create mode 100644 src/lib/components/storage/shared/FloatingMenu.svelte
 create mode 100644 src/lib/storage/details-types.ts
 create mode 100644 src/routes/(app)/api/storage/bucket-details/+server.ts
 create mode 100644 src/routes/(app)/api/storage/bucket-details/server.test.ts
 create mode 100644 src/routes/(app)/api/storage/details/+server.ts
 create mode 100644 src/routes/(app)/api/storage/details/server.test.ts
 create mode 100644 src/routes/(app)/api/storage/directory-metadata/+server.ts
 create mode 100644 src/routes/(app)/api/storage/directory-metadata/server.test.ts
 create mode 100644 src/routes/(app)/api/storage/directory-size/+server.ts

diff --git a/e2e/init-garage-s3.sh b/e2e/init-garage-s3.sh
index fd5ac81a..6b15486b 100755
--- a/e2e/init-garage-s3.sh
+++ b/e2e/init-garage-s3.sh
@@ -93,6 +93,97 @@ fi
 
 allow_bucket_key "$bucket_id" "$S3_ACCESS_KEY_ID" >/dev/null
 
+# ──────────────────────────────────────────────
+# Bucket enrichment: tags, lifecycle rules, sample data
+# ──────────────────────────────────────────────
+echo "Enriching bucket with tags, lifecycle rules, and sample objects..."
+
+# Export S3 env vars so the Node.js process can read them
+export S3_ENDPOINT S3_REGION S3_ACCESS_KEY_ID S3_SECRET_ACCESS_KEY S3_BUCKET
+
+node -e '
+const {
+  S3Client,
+  PutBucketLifecycleConfigurationCommand,
+  PutObjectCommand
+} = require("@aws-sdk/client-s3");
+
+const client = new S3Client({
+  endpoint: process.env.S3_ENDPOINT,
+  region: process.env.S3_REGION || "garage",
+  credentials: {
+    accessKeyId: process.env.S3_ACCESS_KEY_ID,
+    secretAccessKey: process.env.S3_SECRET_ACCESS_KEY,
+  },
+  forcePathStyle: true,
+});
+
+const bucket = process.env.S3_BUCKET;
+
+async function enrich() {
+  // Lifecycle rules (Garage supports a subset of the S3 lifecycle API)
+  // Note: Garage does not implement PutBucketTagging (returns 501 Not Implemented).
+  try {
+    await client.send(new PutBucketLifecycleConfigurationCommand({
+      Bucket: bucket,
+      LifecycleConfiguration: {
+        Rules: [
+          {
+            ID: "expire-old-logs",
+            Status: "Enabled",
+            Filter: { Prefix: "logs/" },
+            Expiration: { Days: 90 },
+          },
+          {
+            ID: "clean-aborted-uploads",
+            Status: "Enabled",
+            Filter: {},
+            AbortIncompleteMultipartUpload: { DaysAfterInitiation: 7 },
+          },
+          {
+            ID: "expire-deleted-markers",
+            Status: "Enabled",
+            Filter: {},
+            NoncurrentVersionExpiration: { NoncurrentDays: 30 },
+          },
+        ],
+      },
+    }));
+    console.log("  ✓ Lifecycle rules set");
+  } catch (err) {
+    console.log("  ✗ Lifecycle rules failed:", err.message);
+  }
+
+  // Sample objects
+  const samples = [
+    { key: "logs/access.log", body: "192.168.1.1 GET /api/v1/query 200 1234\n10.0.0.1 POST /api/v1/run 201 56\n" },
+    { key: "logs/error.log", body: "2026-07-09 ERROR: Connection timeout to trino-worker-3\n2026-07-09 WARN: Retry attempt 2/5\n" },
+    { key: "archive/2024/transactions.csv", body: "id,amount,currency,date\nTX-001,150.00,USD,2024-01-15\nTX-002,275.50,EUR,2024-03-22\nTX-003,89.99,GBP,2024-06-01\n" },
+    { key: "archive/2024/audit.log", body: "[2024-01-01] System initialized\n[2024-06-30] Scheduled maintenance completed\n" },
+    { key: "README.md", body: "# Test Bucket\n\nThis bucket is used for E2E testing of the Stackable Cockpit.\n" },
+    { key: "config/cluster.yaml", body: "cluster:\n  name: e2e-test\n  replicas: 3\n  storage: 100Gi\n" },
+  ];
+
+  for (const { key, body } of samples) {
+    try {
+      await client.send(new PutObjectCommand({
+        Bucket: bucket,
+        Key: key,
+        Body: body,
+      }));
+      console.log("  ✓ Uploaded:", key);
+    } catch (err) {
+      console.log("  ✗ Upload failed:", key, err.message);
+    }
+  }
+}
+
+enrich().catch((err) => {
+  console.error("Fatal error during bucket enrichment:", err);
+  process.exit(1);
+});
+'
+
 cat > "$S3_CONFIG_PATH" <<EOF
 {
   "awsEndpoint": "$S3_ENDPOINT",
diff --git a/e2e/storage/details.spec.ts b/e2e/storage/details.spec.ts
new file mode 100644
index 00000000..c1d1248b
--- /dev/null
+++ b/e2e/storage/details.spec.ts
@@ -0,0 +1,88 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  connectToStorage,
+  deleteKnownKeys,
+  putDirectoryMarker,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Details Modal', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('opens file details modal from context menu', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'details-file');
+    const cleanupKeys = [`${prefix}test.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}test.txt`, 'file details test');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'test.txt').click({ button: 'right' });
+
+      await page.getByRole('menuitem', { name: 'Details' }).click();
+      await expect(page.getByRole('heading', { name: 'File Details' })).toBeVisible();
+
+      await expect(page.getByText('test.txt').first()).toBeVisible();
+      await expect(
+        page.getByText('s3://' + credentials.bucket + '/' + prefix + 'test.txt')
+      ).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('opens directory details modal from context menu', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'details-dir');
+    const cleanupKeys = [`${prefix}subdir/`, `${prefix}subdir/file.txt`];
+
+    try {
+      await putDirectoryMarker(client, credentials.bucket, `${prefix}subdir/`);
+      await putTextObject(client, credentials.bucket, `${prefix}subdir/file.txt`, 'nested');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+      await rowByName(page, 'subdir').click({ button: 'right' });
+
+      await page.getByRole('menuitem', { name: 'Details' }).click();
+      await expect(page.getByRole('heading', { name: 'Directory Details' })).toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('opens bucket details from sidebar context menu', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    const bucket = credentials.bucket;
+
+    try {
+      await connectToStorage(page, credentials);
+      await expect(page).toHaveURL('/storage');
+
+      const sidebar = page.getByRole('navigation', { name: 'Buckets' });
+      await sidebar.getByText(bucket).click({ button: 'right' });
+
+      await page.getByRole('menuitem', { name: 'Details' }).click();
+      await expect(page.getByRole('heading', { name: 'Bucket Details' })).toBeVisible();
+    } finally {
+      // no cleanup needed — using the shared test bucket
+    }
+  });
+});
diff --git a/messages/de.json b/messages/de.json
index ec83cf85..9af002dd 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -252,6 +252,7 @@
   "storage_action_delete": "Löschen",
   "storage_action_paste": "Einfügen",
   "storage_action_pin": "Ort anheften",
+  "storage_action_details": "Details",
   "storage_action_unpin": "Loslösen",
   "storage_action_copy_filename": "Dateiname kopieren",
   "storage_action_copy_filename_success": "Dateiname in die Zwischenablage kopiert.",
@@ -451,6 +452,83 @@
   "storage_archive_open_error": "Archiv konnte nicht geöffnet werden. Das Format wird möglicherweise nicht unterstützt oder das Archiv ist beschädigt.",
   "storage_archive_too_large": "Archiv ist zu groß für die Vorschau.",
   "storage_archive_exit": "Archiv verlassen",
+  "storage_details_title": "Details",
+  "storage_details_file_title": "Datei-Details",
+  "storage_details_folder_title": "Verzeichnis-Details",
+  "storage_details_bucket_title": "Bucket-Details",
+  "storage_details_close": "Schließen",
+  "storage_details_maximise": "Maximieren",
+  "storage_details_restore": "Wiederherstellen",
+  "storage_details_property": "Eigenschaft",
+  "storage_details_value": "Wert",
+  "storage_details_name": "Name",
+  "storage_details_size": "Größe",
+  "storage_details_last_modified": "Zuletzt geändert",
+  "storage_details_content_type": "Inhaltstyp",
+  "storage_details_etag": "ETag",
+  "storage_details_version_id": "Version-ID",
+  "storage_details_storage_class": "Speicherklasse",
+  "storage_details_is_delete_marker": "Löschmarkierung",
+  "storage_details_yes": "Ja",
+  "storage_details_no": "Nein",
+  "storage_details_calculate_size": "Verzeichnisgröße berechnen",
+  "storage_details_calculating": "Wird berechnet…",
+  "storage_details_calculating_desc": "Alle Objekte in diesem Verzeichnis werden aufgelistet…",
+  "storage_details_keys_found": "{count} Objekte gefunden",
+  "storage_details_file_count": "{count} Dateien",
+  "storage_details_folder_count": "{count} Ordner",
+  "storage_details_total_size": "Gesamtgröße",
+  "storage_details_tree_visualization": "Größenverteilung",
+  "storage_details_versioning": "Versionierung",
+  "storage_details_versioning_enabled": "Aktiviert",
+  "storage_details_versioning_suspended": "Ausgesetzt",
+  "storage_details_versioning_disabled": "Deaktiviert",
+  "storage_details_lifecycle_rules": "Lebenszyklus-Regeln",
+  "storage_details_lifecycle_rule_id": "Regel-ID",
+  "storage_details_lifecycle_status": "Status",
+  "storage_details_lifecycle_filter": "Filter",
+  "storage_details_lifecycle_expiration": "Ablauf",
+  "storage_details_lifecycle_noncurrent_expiration": "Ablauf nicht aktueller Versionen",
+  "storage_details_lifecycle_transition": "Übergang",
+  "storage_details_lifecycle_days": "{days} Tage",
+  "storage_details_lifecycle_abort_mpu": "Abbr. unvollst. Uploads",
+  "storage_details_lifecycle_days_after_initiation": "{days} T. nach Initiierung",
+  "storage_details_lifecycle_noncurrent_transition": "Übergang inakt. Versionen",
+  "storage_details_lifecycle_transition_to": "→ {storageClass}",
+  "storage_details_lifecycle_prefix_filter": "Präfix: {prefix}",
+  "storage_details_lifecycle_all_objects": "Alle Objekte",
+  "storage_details_lifecycle_no_rules": "Keine Lebenszyklus-Regeln konfiguriert",
+  "storage_details_tags": "Tags",
+  "storage_details_no_tags": "Keine Tags",
+  "storage_details_custom_metadata": "Benutzerdefinierte Metadaten",
+  "storage_details_error_not_connected": "Keine Speicherverbindung konfiguriert",
+  "storage_details_error_fetch_file": "Dateidetails konnten nicht abgerufen werden ({status})",
+  "storage_details_error_fetch_bucket": "Bucket-Details konnten nicht abgerufen werden ({status})",
+  "storage_details_error_fetch_dir_meta": "Verzeichnismetadaten konnten nicht abgerufen werden ({status})",
+  "storage_details_error_calc_size": "Verzeichnisgröße konnte nicht berechnet werden ({status})",
+  "storage_details_error_unknown": "Unbekannter Fehler",
+  "storage_details_error_no_body": "Kein Antworttext",
+  "storage_details_unnamed_rule": "(unbenannt)",
+  "storage_details_treemap_aria": "Treemap-Visualisierung der Verzeichnisgrößenverteilung",
+  "storage_details_treemap_more": "{count} weitere",
+  "storage_details_copy_dir_name": "Verzeichnisnamen kopieren",
+  "storage_details_copy_file_name": "Dateinamen kopieren",
+  "storage_details_copy_full_path": "Vollständigen Pfad kopieren",
+  "storage_details_tab_overview": "Übersicht",
+  "storage_details_tab_composition": "Größenverteilung",
+  "storage_details_tab_contents": "Inhalte",
+  "storage_details_tab_lifecycle": "Lebenszyklus",
+  "storage_details_file_path": "Pfad",
+  "storage_details_bucket_name": "Bucket",
+  "storage_details_owner": "Besitzer",
+  "storage_details_permissions": "Berechtigungen",
+  "storage_details_depth": "Tiefe",
+  "storage_details_marker_exists": "Ordner-Marker",
+  "storage_details_marker_none": "Kein Ordner-Marker-Objekt",
+  "storage_details_encryption": "Verschlüsselung",
+  "storage_details_object_lock": "Objektsperre",
+  "storage_details_object_lock_mode": "Sperrmodus",
+  "storage_details_object_lock_until": "Aufbewahren bis",
   "storage_action_cut_success": "{count} Element(e) ausgeschnitten",
   "storage_action_copy_success": "{count} Element(e) kopiert",
   "storage_action_paste_success": "{count} Element(e) eingefügt",
@@ -490,12 +568,12 @@
   "storage_operations_remaining": "verbleibend",
   "storage_action_rename_inline_label": "Neuer Name",
   "storage_action_rename_inline_cancel": "Abbrechen",
-  "storage_rename_success": "In „{name}“ umbenannt.",
-  "storage_rename_error": "„{name}“ konnte nicht umbenannt werden. Bitte versuchen Sie es erneut.",
+  "storage_rename_success": "In \"{name}\" umbenannt.",
+  "storage_rename_error": "\"{name}\" konnte nicht umbenannt werden. Bitte versuchen Sie es erneut.",
   "storage_rename_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
   "storage_rename_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung zum Umbenennen.",
   "storage_rename_error_not_found": "Das Element wurde nicht gefunden. Es wurde möglicherweise verschoben oder gelöscht.",
-  "storage_rename_error_conflict": "Eine Datei oder ein Ordner namens „{name}“ ist an diesem Ort bereits vorhanden.",
+  "storage_rename_error_conflict": "Eine Datei oder ein Ordner namens \"{name}\" ist an diesem Ort bereits vorhanden.",
   "timestamp_just_now": "gerade eben",
   "timestamp_minutes_ago": [
     {
diff --git a/messages/en.json b/messages/en.json
index acd8753d..063c6d34 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -252,6 +252,7 @@
   "storage_action_delete": "Delete",
   "storage_action_paste": "Paste",
   "storage_action_pin": "Pin this location",
+  "storage_action_details": "Details",
   "storage_action_unpin": "Unpin",
   "storage_action_copy_filename": "Copy filename",
   "storage_action_copy_filename_success": "Filename copied to clipboard.",
@@ -451,6 +452,83 @@
   "storage_archive_open_error": "Could not open archive. The format may be unsupported or the archive is corrupt.",
   "storage_archive_too_large": "Archive is too large to preview.",
   "storage_archive_exit": "Exit archive",
+  "storage_details_title": "Details",
+  "storage_details_file_title": "File Details",
+  "storage_details_folder_title": "Directory Details",
+  "storage_details_bucket_title": "Bucket Details",
+  "storage_details_close": "Close",
+  "storage_details_maximise": "Maximise",
+  "storage_details_restore": "Restore",
+  "storage_details_property": "Property",
+  "storage_details_value": "Value",
+  "storage_details_name": "Name",
+  "storage_details_size": "Size",
+  "storage_details_last_modified": "Last modified",
+  "storage_details_content_type": "Content type",
+  "storage_details_etag": "ETag",
+  "storage_details_version_id": "Version ID",
+  "storage_details_storage_class": "Storage class",
+  "storage_details_is_delete_marker": "Delete marker",
+  "storage_details_yes": "Yes",
+  "storage_details_no": "No",
+  "storage_details_calculate_size": "Calculate directory size",
+  "storage_details_calculating": "Calculating…",
+  "storage_details_calculating_desc": "Listing all objects in this directory…",
+  "storage_details_keys_found": "{count} objects found",
+  "storage_details_file_count": "{count} files",
+  "storage_details_folder_count": "{count} folders",
+  "storage_details_total_size": "Total size",
+  "storage_details_tree_visualization": "Size composition",
+  "storage_details_versioning": "Versioning",
+  "storage_details_versioning_enabled": "Enabled",
+  "storage_details_versioning_suspended": "Suspended",
+  "storage_details_versioning_disabled": "Disabled",
+  "storage_details_lifecycle_rules": "Lifecycle Rules",
+  "storage_details_lifecycle_rule_id": "Rule ID",
+  "storage_details_lifecycle_status": "Status",
+  "storage_details_lifecycle_filter": "Filter",
+  "storage_details_lifecycle_expiration": "Expiration",
+  "storage_details_lifecycle_noncurrent_expiration": "Noncurrent version expiration",
+  "storage_details_lifecycle_transition": "Transition",
+  "storage_details_lifecycle_days": "{days} days",
+  "storage_details_lifecycle_abort_mpu": "Abort incomplete uploads",
+  "storage_details_lifecycle_days_after_initiation": "{days}d after initiation",
+  "storage_details_lifecycle_noncurrent_transition": "Noncurrent transition",
+  "storage_details_lifecycle_transition_to": "→ {storageClass}",
+  "storage_details_lifecycle_prefix_filter": "Prefix: {prefix}",
+  "storage_details_lifecycle_all_objects": "All objects",
+  "storage_details_lifecycle_no_rules": "No lifecycle rules configured",
+  "storage_details_tags": "Tags",
+  "storage_details_no_tags": "No tags",
+  "storage_details_custom_metadata": "Custom Metadata",
+  "storage_details_error_not_connected": "No storage connection configured",
+  "storage_details_error_fetch_file": "Failed to fetch file details ({status})",
+  "storage_details_error_fetch_bucket": "Failed to fetch bucket details ({status})",
+  "storage_details_error_fetch_dir_meta": "Failed to fetch directory metadata ({status})",
+  "storage_details_error_calc_size": "Failed to calculate directory size ({status})",
+  "storage_details_error_unknown": "Unknown error",
+  "storage_details_error_no_body": "No response body",
+  "storage_details_unnamed_rule": "(unnamed)",
+  "storage_details_treemap_aria": "Treemap visualization of directory size composition",
+  "storage_details_treemap_more": "{count} more",
+  "storage_details_copy_dir_name": "Copy directory name",
+  "storage_details_copy_file_name": "Copy file name",
+  "storage_details_copy_full_path": "Copy full path",
+  "storage_details_tab_overview": "Overview",
+  "storage_details_tab_composition": "Size composition",
+  "storage_details_tab_contents": "Contents",
+  "storage_details_tab_lifecycle": "Lifecycle",
+  "storage_details_file_path": "Path",
+  "storage_details_bucket_name": "Bucket",
+  "storage_details_owner": "Owner",
+  "storage_details_permissions": "Permissions",
+  "storage_details_depth": "Depth",
+  "storage_details_marker_exists": "Folder marker",
+  "storage_details_marker_none": "No folder marker object",
+  "storage_details_encryption": "Encryption",
+  "storage_details_object_lock": "Object lock",
+  "storage_details_object_lock_mode": "Lock mode",
+  "storage_details_object_lock_until": "Retain until",
   "storage_action_cut_success": "{count} item(s) cut",
   "storage_action_copy_success": "{count} item(s) copied",
   "storage_action_paste_success": "{count} item(s) pasted",
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index 7839a8b8..6ff74bbe 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -4,6 +4,7 @@
   import IconClose from 'virtual:icons/material-symbols/close';
   import IconVisibility from 'virtual:icons/material-symbols/visibility';
   import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconInfo from 'virtual:icons/material-symbols/info';
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
   import IconPushPin from 'virtual:icons/material-symbols/push-pin';
   import IconDelete from 'virtual:icons/material-symbols/delete';
@@ -36,6 +37,10 @@
       (storage.contextMenu !== null && storage.ctxIsFile)
   );
   const canDownload = $derived(storage.selectedFiles.length > 0 || storage.ctxIsFile);
+  const canShowDetails = $derived(
+    storage.contextMenu !== null ||
+      (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0)
+  );
 
   let menuEl = $state<HTMLUListElement | null>(null);
 
@@ -131,6 +136,13 @@
         disabled: !canDownload,
         hidden: false
       },
+      {
+        key: 'details' as ActionName,
+        icon: IconInfo as Component,
+        label: m.storage_action_details(),
+        disabled: !canShowDetails,
+        hidden: false
+      },
       {
         key: 'cut' as ActionName,
         icon: IconCut as Component,
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 0b059bdf..2d75e472 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -12,7 +12,6 @@
   import TabBar from './TabBar.svelte';
   import ObjectTable from './ObjectTable.svelte';
   import ContextMenu from './ContextMenu.svelte';
-  import StorageModals from '../modals/StorageModals.svelte';
   import Pagination from '$lib/components/Pagination.svelte';
 
   const storage = getStorageState();
@@ -150,6 +149,3 @@
 {#if storage.contextMenu}
   <ContextMenu />
 {/if}
-
-<!-- Modals -->
-<StorageModals />
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
index fd0254d3..4e7ec410 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import IconVisibility from 'virtual:icons/material-symbols/visibility';
   import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconInfo from 'virtual:icons/material-symbols/info';
   import IconDelete from 'virtual:icons/material-symbols/delete';
   import IconRefresh from 'virtual:icons/material-symbols/refresh';
   import * as m from '$lib/paraglide/messages.js';
@@ -44,6 +45,16 @@
         {m.storage_action_download()}
       </button>
 
+      <button
+        class="btn btn-ghost btn-xs gap-1"
+        title={m.storage_action_details()}
+        onclick={() => storage.executeAction('details')}
+        disabled={selectedCount !== 1}
+      >
+        <IconInfo class="size-3.5" aria-hidden="true" />
+        {m.storage_action_details()}
+      </button>
+
       {#if !storage.isInArchive}
         <button
           class="
diff --git a/src/lib/components/storage/explorer/TabBar.svelte b/src/lib/components/storage/explorer/TabBar.svelte
index 40fcaf85..bb12c456 100644
--- a/src/lib/components/storage/explorer/TabBar.svelte
+++ b/src/lib/components/storage/explorer/TabBar.svelte
@@ -261,8 +261,10 @@
             class="bg-base-100 border-base-300 relative z-30 flex shrink-0 items-center rounded-t-lg border border-b-0 px-3 py-1.5 shadow-sm"
             style="margin-right: -8px;"
           >
+            <!-- svelte-ignore a11y_autofocus -->
             <input
               type="text"
+              autofocus
               class="border-base-300 focus:border-primary h-4 w-24 rounded border bg-transparent px-1 py-0 text-xs focus:outline-none"
               bind:value={renameValue}
               bind:this={renameInput}
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
index b9da7bff..70e8fb18 100644
--- a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { untrack } from 'svelte';
   import { setStorageState } from '$lib/storage/context.js';
   import { setTabsState } from '$lib/storage/tabs-context.js';
   import { TabsState } from '$lib/storage/tabs.svelte.js';
@@ -11,8 +12,10 @@
   }
 
   let { state, tabsState: tabsStateProp }: Props = $props();
-  setStorageState(state);
-  setTabsState(tabsStateProp ?? new TabsState(state));
+  untrack(() => {
+    setStorageState(state);
+    setTabsState(tabsStateProp ?? new TabsState(state));
+  });
 </script>
 
 <StorageBreadcrumb />
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte b/src/lib/components/storage/landing/BucketGrid.svelte
index 41cad839..17f93105 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte
+++ b/src/lib/components/storage/landing/BucketGrid.svelte
@@ -1,15 +1,51 @@
 <script lang="ts">
   import IconBucket from '../shared/BucketIcon.svelte';
+  import IconInfo from 'virtual:icons/material-symbols/info';
   import * as m from '$lib/paraglide/messages.js';
   import { resolve } from '$app/paths';
+  import { getStorageState } from '$lib/storage/context.js';
+  import FloatingMenu from '../shared/FloatingMenu.svelte';
 
   interface Props {
     buckets?: string[];
   }
 
   let { buckets = [] }: Props = $props();
+  const storage = getStorageState();
+
+  let ctxMenu = $state<{ x: number; y: number; bucket: string } | null>(null);
+
+  function openDetails(bucket: string) {
+    storage.openModal('details', { type: 'bucket', bucket });
+    ctxMenu = null;
+  }
+
+  function handleContextMenu(e: MouseEvent, bucket: string) {
+    e.preventDefault();
+    ctxMenu = { x: e.clientX, y: e.clientY, bucket };
+  }
+
+  function closeContextMenu() {
+    ctxMenu = null;
+  }
 </script>
 
+<FloatingMenu
+  x={ctxMenu?.x ?? 0}
+  y={ctxMenu?.y ?? 0}
+  open={ctxMenu !== null}
+  onclose={closeContextMenu}
+>
+  <button
+    role="menuitem"
+    class="btn btn-ghost btn-sm w-full justify-start gap-2"
+    onclick={() => ctxMenu && openDetails(ctxMenu.bucket)}
+  >
+    <IconInfo class="size-4" aria-hidden="true" />
+    {m.storage_action_details()}
+  </button>
+</FloatingMenu>
+
 {#if buckets.length > 0}
   <div
     class="
@@ -32,6 +68,7 @@
               gap-2 rounded-xl border p-4
               text-center transition-colors
             "
+          oncontextmenu={(e) => handleContextMenu(e, bucket)}
         >
           <IconBucket class="text-warning size-10" aria-hidden="true" />
           <span class="w-full truncate text-sm font-medium">{bucket}</span>
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
index fb093e5f..851e3a5b 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
+++ b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
@@ -2,22 +2,30 @@ import { page } from 'vitest/browser';
 import { describe, expect, it } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
-import BucketGrid from './BucketGrid.svelte';
+import BucketGridWrapper from './__tests__/BucketGridWrapper.svelte';
+import { StorageState } from '$lib/storage/state.svelte.js';
+
+function createState(): StorageState {
+  const state = new StorageState({ connected: true, buckets: [] });
+  state.bucket = '';
+  state.prefix = '';
+  return state;
+}
 
 describe('BucketGrid', () => {
   it('should show empty message when no buckets provided', async () => {
-    render(BucketGrid);
+    render(BucketGridWrapper, { state: createState() });
     await expect.element(page.getByText('No buckets found')).toBeInTheDocument();
   });
 
   it('should show empty message when buckets array is empty', async () => {
-    render(BucketGrid, { buckets: [] });
+    render(BucketGridWrapper, { state: createState(), buckets: [] });
     await expect.element(page.getByText('No buckets found')).toBeInTheDocument();
   });
 
   it('should render bucket links when buckets are provided', async () => {
     const buckets = ['my-bucket', 'other-bucket'];
-    render(BucketGrid, { buckets });
+    render(BucketGridWrapper, { state: createState(), buckets });
 
     const links = page.getByRole('link');
     await expect.element(links.nth(0)).toBeInTheDocument();
@@ -26,7 +34,7 @@ describe('BucketGrid', () => {
 
   it('should display bucket name in each link', async () => {
     const buckets = ['data-lake', 'backups'];
-    render(BucketGrid, { buckets });
+    render(BucketGridWrapper, { state: createState(), buckets });
 
     await expect.element(page.getByText('data-lake')).toBeInTheDocument();
     await expect.element(page.getByText('backups')).toBeInTheDocument();
@@ -34,7 +42,7 @@ describe('BucketGrid', () => {
 
   it('should encode bucket names in href', async () => {
     const buckets = ['bucket with spaces'];
-    render(BucketGrid, { buckets });
+    render(BucketGridWrapper, { state: createState(), buckets });
 
     const link = page.getByRole('link');
     await expect
@@ -44,7 +52,7 @@ describe('BucketGrid', () => {
 
   it('should handle special characters in bucket names', async () => {
     const buckets = ['my-bucket/special', 'name+plus', 'unicode-ñ-ü'];
-    render(BucketGrid, { buckets });
+    render(BucketGridWrapper, { state: createState(), buckets });
 
     await expect.element(page.getByText('my-bucket/special')).toBeInTheDocument();
     await expect.element(page.getByText('name+plus')).toBeInTheDocument();
@@ -53,7 +61,7 @@ describe('BucketGrid', () => {
 
   it('should have tooltip with bucket name', async () => {
     const buckets = ['tooltip-bucket'];
-    render(BucketGrid, { buckets });
+    render(BucketGridWrapper, { state: createState(), buckets });
 
     const tooltip = page.getByText('tooltip-bucket').element().closest('[data-tip]');
     expect(tooltip?.getAttribute('data-tip')).toBe('tooltip-bucket');
@@ -61,7 +69,7 @@ describe('BucketGrid', () => {
 
   it('should render a large number of buckets', async () => {
     const buckets = Array.from({ length: 100 }, () => faker.string.alphanumeric(10));
-    render(BucketGrid, { buckets });
+    render(BucketGridWrapper, { state: createState(), buckets });
 
     const links = page.getByRole('link');
     await expect.element(links.nth(99)).toBeInTheDocument();
@@ -69,14 +77,14 @@ describe('BucketGrid', () => {
 
   it('should handle very long bucket names', async () => {
     const longName = faker.string.alphanumeric(200);
-    render(BucketGrid, { buckets: [longName] });
+    render(BucketGridWrapper, { state: createState(), buckets: [longName] });
 
     await expect.element(page.getByText(longName)).toBeInTheDocument();
   });
 
   it('should handle unicode bucket names', async () => {
     const buckets = ['日本語バケット', '中文桶', 'émojis-🪣'];
-    render(BucketGrid, { buckets });
+    render(BucketGridWrapper, { state: createState(), buckets });
 
     await expect.element(page.getByText('日本語バケット')).toBeInTheDocument();
     await expect.element(page.getByText('中文桶')).toBeInTheDocument();
diff --git a/src/lib/components/storage/landing/__tests__/BucketGridWrapper.svelte b/src/lib/components/storage/landing/__tests__/BucketGridWrapper.svelte
new file mode 100644
index 00000000..01db9c6d
--- /dev/null
+++ b/src/lib/components/storage/landing/__tests__/BucketGridWrapper.svelte
@@ -0,0 +1,16 @@
+<script lang="ts">
+  import { untrack } from 'svelte';
+  import { setStorageState } from '$lib/storage/context.js';
+  import type { StorageState } from '$lib/storage/state.svelte.js';
+  import BucketGrid from '../BucketGrid.svelte';
+
+  interface Props {
+    state: StorageState;
+    buckets?: string[];
+  }
+
+  let { state, buckets = [] }: Props = $props();
+  untrack(() => setStorageState(state));
+</script>
+
+<BucketGrid {buckets} />
diff --git a/src/lib/components/storage/modals/DetailsModal.svelte b/src/lib/components/storage/modals/DetailsModal.svelte
new file mode 100644
index 00000000..436dbbb3
--- /dev/null
+++ b/src/lib/components/storage/modals/DetailsModal.svelte
@@ -0,0 +1,156 @@
+<script lang="ts">
+  import Modal from '$lib/components/Modal.svelte';
+  import IconClose from 'virtual:icons/material-symbols/close';
+  import IconOpenInFull from 'virtual:icons/material-symbols/open-in-full';
+  import IconCloseFullscreen from 'virtual:icons/material-symbols/close-fullscreen';
+  import IconDescription from 'virtual:icons/material-symbols/description';
+  import IconFolder from 'virtual:icons/material-symbols/folder';
+  import IconBucket from '$lib/components/storage/shared/BucketIcon.svelte';
+  import * as m from '$lib/paraglide/messages.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import type { FileDetails as FileDetailsType } from '$lib/storage/details-types.js';
+  import FileDetails from './details/FileDetails.svelte';
+  import DirectoryDetails from './details/DirectoryDetails.svelte';
+  import BucketDetails from './details/BucketDetails.svelte';
+
+  interface Props {
+    open: boolean;
+    type: 'file' | 'directory' | 'bucket';
+    bucket: string;
+    key?: string;
+    prefix?: string;
+  }
+
+  let { open = $bindable(), type, bucket, key, prefix }: Props = $props();
+
+  let maximized = $state(false);
+
+  // Reset maximized state when the modal closes
+  $effect(() => {
+    if (!open) maximized = false;
+  });
+
+  let fileDetails = $state<FileDetailsType | null>(null);
+  let loading = $state(false);
+  let loadError = $state<string | null>(null);
+
+  const title = $derived(
+    type === 'file'
+      ? m.storage_details_file_title()
+      : type === 'directory'
+        ? m.storage_details_folder_title()
+        : m.storage_details_bucket_title()
+  );
+
+  const iconColor = $derived(type === 'file' ? 'text-info' : 'text-warning');
+
+  async function loadFileDetails() {
+    if (type !== 'file' || !key) return;
+    loading = true;
+    loadError = null;
+    try {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) {
+        loadError = m.storage_details_error_not_connected();
+        return;
+      }
+      const params = new URLSearchParams({ bucket, key });
+      const res = await fetch(`/api/storage/details?${params}`, {
+        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+      });
+      if (!res.ok) {
+        loadError = m.storage_details_error_fetch_file({ status: res.status });
+        return;
+      }
+      fileDetails = (await res.json()) as FileDetailsType;
+    } catch (err) {
+      loadError = err instanceof Error ? err.message : m.storage_details_error_unknown();
+    } finally {
+      loading = false;
+    }
+  }
+
+  $effect(() => {
+    if (open && type === 'file') {
+      void loadFileDetails();
+    }
+  });
+</script>
+
+<Modal bind:open class="modal">
+  <div
+    class="modal-box transition-all duration-200 {maximized
+      ? 'h-[90vh] w-[95vw] max-w-none'
+      : 'max-w-2xl'}"
+  >
+    <div class="mb-4 flex items-start justify-between gap-4">
+      <div class="flex items-center gap-3">
+        <div class="{iconColor} bg-base-200 flex size-10 items-center justify-center rounded-lg">
+          {#if type === 'file'}
+            <IconDescription class="size-5" />
+          {:else if type === 'directory'}
+            <IconFolder class="size-5" />
+          {:else}
+            <IconBucket class="size-5" />
+          {/if}
+        </div>
+        <div class="min-w-0">
+          <h3 class="text-lg font-bold">{title}</h3>
+          <p class="text-base-content/50 truncate text-sm">
+            {type === 'bucket' ? bucket : (key ?? prefix ?? '')}
+          </p>
+        </div>
+      </div>
+      <div class="flex shrink-0 items-center gap-1">
+        <button
+          class="btn btn-ghost btn-sm btn-square"
+          onclick={() => (maximized = !maximized)}
+          aria-label={maximized ? m.storage_details_restore() : m.storage_details_maximise()}
+          title={maximized ? m.storage_details_restore() : m.storage_details_maximise()}
+        >
+          {#if maximized}
+            <IconCloseFullscreen class="size-4" aria-hidden="true" />
+          {:else}
+            <IconOpenInFull class="size-4" aria-hidden="true" />
+          {/if}
+        </button>
+        <button
+          class="btn btn-ghost btn-sm btn-square"
+          onclick={() => (open = false)}
+          aria-label={m.storage_details_close()}
+        >
+          <IconClose class="size-4" aria-hidden="true" />
+        </button>
+      </div>
+    </div>
+
+    {#if loading && type === 'file'}
+      <div class="flex items-center justify-center py-8">
+        <span class="loading loading-spinner loading-md text-primary" aria-hidden="true"></span>
+      </div>
+    {/if}
+
+    {#if loadError}
+      <div class="text-error-content bg-error/10 rounded-box border-error/40 border p-4 text-sm">
+        {loadError}
+      </div>
+    {/if}
+
+    {#if !loading && !loadError}
+      {#if type === 'file' && fileDetails}
+        <FileDetails details={fileDetails} {bucket} />
+      {:else if type === 'directory'}
+        <DirectoryDetails key={key ?? prefix ?? ''} {bucket} {maximized} />
+      {:else if type === 'bucket'}
+        <BucketDetails {bucket} />
+      {/if}
+    {/if}
+
+    <div class="modal-action mt-6">
+      <button class="btn btn-ghost" onclick={() => (open = false)}>
+        {m.storage_details_close()}
+      </button>
+    </div>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/modals/StorageModals.svelte b/src/lib/components/storage/modals/StorageModals.svelte
index b4339fb5..796efce8 100644
--- a/src/lib/components/storage/modals/StorageModals.svelte
+++ b/src/lib/components/storage/modals/StorageModals.svelte
@@ -4,6 +4,7 @@
   import DeleteConfirmModal from './DeleteConfirmModal.svelte';
   import PreviewModal from './PreviewModal.svelte';
   import UploadModal from './upload/UploadModal.svelte';
+  import DetailsModal from './DetailsModal.svelte';
   import RenameModal from './RenameModal.svelte';
   import CreateModal from './CreateModal.svelte';
   import MoveConfirmModal from './MoveConfirmModal.svelte';
@@ -13,29 +14,27 @@
 
   const storage = getStorageState();
 
-  // Local open state for modals that can close themselves (click-outside, etc.)
-  // These start as true when mounted and sync back to storage state when closed.
   let previewOpen = $state(true);
   let uploadOpen = $state(true);
   let deleteOpen = $state(true);
+  let detailsOpen = $state(true);
   let renameOpen = $state(true);
   let moveConfirmOpen = $state(true);
   let createOpen = $state(true);
   let resolveConflictsOpen = $state(true);
 
-  // Reset local state when modal type changes
   $effect(() => {
     if (storage.activeModal) {
       previewOpen = true;
       uploadOpen = true;
       deleteOpen = true;
+      detailsOpen = true;
       renameOpen = true;
       moveConfirmOpen = true;
       createOpen = true;
     }
   });
 
-  // Sync modal close-via-UI back to state
   $effect(() => {
     if (!previewOpen && storage.activeModal?.type === 'preview') {
       storage.closeModal();
@@ -54,6 +53,12 @@
     }
   });
 
+  $effect(() => {
+    if (!detailsOpen && storage.activeModal?.type === 'details') {
+      storage.closeModal();
+    }
+  });
+
   $effect(() => {
     if (!renameOpen && storage.activeModal?.type === 'rename' && !storage.renameLoading) {
       storage.closeModal();
@@ -116,6 +121,16 @@
   />
 {/if}
 
+{#if storage.activeModal?.type === 'details'}
+  <DetailsModal
+    bind:open={detailsOpen}
+    type={storage.activeModal.payload.type}
+    bucket={storage.activeModal.payload.bucket}
+    key={storage.activeModal.payload.key}
+    prefix={storage.activeModal.payload.prefix}
+  />
+{/if}
+
 {#if storage.activeModal?.type === 'rename'}
   {@const modalPayload = storage.activeModal.payload}
   <RenameModal
diff --git a/src/lib/components/storage/modals/details/BucketDetails.svelte b/src/lib/components/storage/modals/details/BucketDetails.svelte
new file mode 100644
index 00000000..090ae28f
--- /dev/null
+++ b/src/lib/components/storage/modals/details/BucketDetails.svelte
@@ -0,0 +1,272 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
+  import IconInfo from 'virtual:icons/material-symbols/info';
+  import IconPerson from 'virtual:icons/material-symbols/person';
+  import IconKey from 'virtual:icons/material-symbols/key';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import type { BucketDetails as BucketDetailsType } from '$lib/storage/details-types.js';
+
+  interface Props {
+    bucket: string;
+  }
+
+  let { bucket }: Props = $props();
+
+  let loading = $state(true);
+  let error = $state<string | null>(null);
+  let details = $state<BucketDetailsType | null>(null);
+
+  $effect(() => {
+    loading = true;
+    error = null;
+
+    async function fetchDetails() {
+      try {
+        const connectionId = connectionStore.activeConnectionId;
+        if (!connectionId) {
+          error = m.storage_details_error_not_connected();
+          loading = false;
+          return;
+        }
+        const params = new URLSearchParams({ bucket });
+        const res = await fetch(`/api/storage/bucket-details?${params}`, {
+          headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+        });
+        if (!res.ok) {
+          error = m.storage_details_error_fetch_bucket({ status: res.status });
+          loading = false;
+          return;
+        }
+        details = (await res.json()) as BucketDetailsType;
+      } catch (err) {
+        error = err instanceof Error ? err.message : m.storage_details_error_unknown();
+      } finally {
+        loading = false;
+      }
+    }
+
+    void fetchDetails();
+  });
+
+  function versioningLabel(status: 'Enabled' | 'Suspended' | 'Disabled'): string {
+    switch (status) {
+      case 'Enabled':
+        return m.storage_details_versioning_enabled();
+      case 'Suspended':
+        return m.storage_details_versioning_suspended();
+      default:
+        return m.storage_details_versioning_disabled();
+    }
+  }
+</script>
+
+<div class="flex flex-col gap-4">
+  {#if loading}
+    <div class="flex items-center justify-center py-8">
+      <span class="loading loading-spinner loading-md text-primary" aria-hidden="true"></span>
+    </div>
+  {/if}
+
+  {#if error}
+    <div
+      class="border-error/40 bg-error/10 flex items-center gap-3 rounded-lg border p-4"
+      role="alert"
+    >
+      <IconWarning class="text-error size-5 shrink-0" aria-hidden="true" />
+      <p class="text-sm">{error}</p>
+    </div>
+  {/if}
+
+  {#if details}
+    <div>
+      <h4 class="text-base-content/70 mb-2 text-xs font-semibold tracking-wide uppercase">
+        {m.storage_details_versioning()}
+      </h4>
+      <div class="flex items-center gap-2">
+        {#if details.versioning === 'Enabled'}
+          <span class="badge badge-success badge-sm">{versioningLabel(details.versioning)}</span>
+        {:else if details.versioning === 'Suspended'}
+          <span class="badge badge-warning badge-sm">{versioningLabel(details.versioning)}</span>
+        {:else}
+          <span class="badge badge-sm">{versioningLabel(details.versioning)}</span>
+        {/if}
+      </div>
+    </div>
+
+    <div>
+      <h4 class="text-base-content/70 mb-2 text-xs font-semibold tracking-wide uppercase">
+        {m.storage_details_owner()}
+      </h4>
+      <div class="flex items-center gap-2">
+        <IconPerson class="text-base-content/50 size-4" aria-hidden="true" />
+        <span class="text-sm">{details.acl.owner}</span>
+      </div>
+    </div>
+
+    {#if details.acl.grants.length > 0}
+      <div>
+        <h4 class="text-base-content/70 mb-2 text-xs font-semibold tracking-wide uppercase">
+          {m.storage_details_permissions()}
+        </h4>
+        <div class="flex flex-col gap-2">
+          {#each details.acl.grants as grant (grant.grantee + grant.permission)}
+            <div
+              class="border-base-300 flex items-center gap-2 rounded-lg border px-3 py-2 text-sm"
+            >
+              <IconKey class="text-base-content/40 size-4 shrink-0" aria-hidden="true" />
+              <span class="min-w-0 truncate font-medium">{grant.grantee}</span>
+              <span class="badge badge-ghost badge-xs ml-auto shrink-0 tracking-wider uppercase">
+                {grant.permission}
+              </span>
+            </div>
+          {/each}
+        </div>
+      </div>
+    {/if}
+
+    {#if details.lifecycleRules.length > 0}
+      <div>
+        <h4 class="text-base-content/70 mb-2 text-xs font-semibold tracking-wide uppercase">
+          {m.storage_details_lifecycle_rules()}
+        </h4>
+        <div class="flex flex-col gap-3">
+          {#each details.lifecycleRules as rule (rule.id)}
+            <div class="border-base-300 rounded-box border p-3">
+              <div class="mb-2 flex items-center gap-2">
+                <span class="text-sm font-medium"
+                  >{rule.id || m.storage_details_unnamed_rule()}</span
+                >
+                <span
+                  class="badge badge-xs {rule.status === 'Enabled'
+                    ? 'badge-success'
+                    : 'badge-ghost'}"
+                >
+                  {rule.status}
+                </span>
+              </div>
+
+              <div class="text-base-content/60 mb-2 text-xs">
+                <span>{m.storage_details_lifecycle_filter()}:</span>
+                {#if rule.filter && typeof rule.filter === 'object' && 'prefix' in (rule.filter as Record<string, unknown>) && (rule.filter as Record<string, unknown>).prefix}
+                  <span class="text-base-content font-mono leading-none">
+                    {m.storage_details_lifecycle_prefix_filter({
+                      prefix: String((rule.filter as Record<string, unknown>).prefix)
+                    })}
+                  </span>
+                {:else if rule.filter && typeof rule.filter === 'object' && 'and' in (rule.filter as Record<string, unknown>)}
+                  <span class="text-base-content font-mono leading-none">
+                    AND ({(rule.filter as Record<string, unknown>).and as string})
+                  </span>
+                {:else if rule.filter && typeof rule.filter === 'object' && Object.keys(rule.filter).length > 0}
+                  <span class="text-base-content font-mono leading-none">
+                    {JSON.stringify(rule.filter)}
+                  </span>
+                {:else}
+                  <span class="text-base-content/40 leading-none italic"
+                    >{m.storage_details_lifecycle_all_objects()}</span
+                  >
+                {/if}
+              </div>
+
+              {#if rule.transitions.length > 0}
+                <div class="text-base-content/70 mb-1 flex items-center gap-1 text-xs">
+                  <IconInfo class="size-3 shrink-0" aria-hidden="true" />
+                  <span>{m.storage_details_lifecycle_transition()}:</span>
+                  {#each rule.transitions as t (t.storageClass + t.days)}
+                    <span class="text-base-content font-mono text-xs leading-none">
+                      {m.storage_details_lifecycle_transition_to({ storageClass: t.storageClass })}
+                      {m.storage_details_lifecycle_days({ days: t.days })}
+                    </span>
+                  {/each}
+                </div>
+              {/if}
+
+              {#if rule.expirations.length > 0}
+                <div class="text-base-content/70 mb-1 flex items-center gap-1 text-xs">
+                  <IconInfo class="size-3 shrink-0" aria-hidden="true" />
+                  <span>{m.storage_details_lifecycle_expiration()}:</span>
+                  {#each rule.expirations as exp (exp.days ?? exp.date ?? '')}
+                    <span class="text-base-content font-mono text-xs leading-none">
+                      {#if exp.days !== undefined}
+                        {m.storage_details_lifecycle_days({ days: exp.days })}
+                      {:else if exp.date}
+                        {exp.date}
+                      {:else if exp.expiredObjectDeleteMarker}
+                        {m.storage_details_yes()}
+                      {/if}
+                    </span>
+                  {/each}
+                </div>
+              {/if}
+
+              {#if rule.noncurrentVersionTransitions.length > 0}
+                <div class="text-base-content/70 mb-1 flex items-center gap-1 text-xs">
+                  <IconInfo class="size-3 shrink-0" aria-hidden="true" />
+                  <span>{m.storage_details_lifecycle_noncurrent_transition()}:</span>
+                  {#each rule.noncurrentVersionTransitions as nvt (nvt.noncurrentDays + nvt.storageClass)}
+                    <span class="text-base-content font-mono text-xs leading-none">
+                      {m.storage_details_lifecycle_transition_to({
+                        storageClass: nvt.storageClass
+                      })}
+                      {m.storage_details_lifecycle_days({ days: nvt.noncurrentDays })}
+                    </span>
+                  {/each}
+                </div>
+              {/if}
+
+              {#if rule.noncurrentVersionExpirations.length > 0}
+                <div class="text-base-content/70 mb-1 flex items-center gap-1 text-xs">
+                  <IconInfo class="size-3 shrink-0" aria-hidden="true" />
+                  <span>{m.storage_details_lifecycle_noncurrent_expiration()}:</span>
+                  {#each rule.noncurrentVersionExpirations as nve (nve.noncurrentDays)}
+                    <span class="text-base-content font-mono text-xs leading-none">
+                      {m.storage_details_lifecycle_days({ days: nve.noncurrentDays })}
+                    </span>
+                  {/each}
+                </div>
+              {/if}
+
+              {#if rule.abortIncompleteMultipartUploads.length > 0}
+                <div class="text-base-content/70 flex items-center gap-1 text-xs">
+                  <IconInfo class="size-3 shrink-0" aria-hidden="true" />
+                  <span>{m.storage_details_lifecycle_abort_mpu()}:</span>
+                  {#each rule.abortIncompleteMultipartUploads as ab (ab.daysAfterInitiation)}
+                    <span class="text-base-content font-mono text-xs leading-none">
+                      {m.storage_details_lifecycle_days_after_initiation({
+                        days: ab.daysAfterInitiation
+                      })}
+                    </span>
+                  {/each}
+                </div>
+              {/if}
+            </div>
+          {/each}
+        </div>
+      </div>
+    {:else if !loading}
+      <div class="border-base-300 flex items-center gap-2 rounded-lg border p-3 text-sm">
+        <IconInfo class="text-base-content/40 size-4" aria-hidden="true" />
+        <span class="text-base-content/60">{m.storage_details_lifecycle_no_rules()}</span>
+      </div>
+    {/if}
+
+    {#if details.tags && Object.keys(details.tags).length > 0}
+      <div>
+        <h4 class="text-base-content/70 mb-2 text-xs font-semibold tracking-wide uppercase">
+          {m.storage_details_tags()}
+        </h4>
+        <div class="flex flex-wrap gap-2">
+          {#each Object.entries(details.tags) as [key, value] (key)}
+            <span class="badge badge-outline badge-sm gap-1">
+              <span class="font-medium">{key}</span>: {value}
+            </span>
+          {/each}
+        </div>
+      </div>
+    {:else if !loading}
+      <div class="text-base-content/40 text-sm italic">{m.storage_details_no_tags()}</div>
+    {/if}
+  {/if}
+</div>
diff --git a/src/lib/components/storage/modals/details/DirectoryDetails.svelte b/src/lib/components/storage/modals/details/DirectoryDetails.svelte
new file mode 100644
index 00000000..e21d006e
--- /dev/null
+++ b/src/lib/components/storage/modals/details/DirectoryDetails.svelte
@@ -0,0 +1,365 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import IconCalculate from 'virtual:icons/material-symbols/calculate';
+  import IconWarning from 'virtual:icons/material-symbols/warning';
+  import { formatFileSize, keyToName } from '$lib/storage/utils.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import type {
+    DirectorySizeEvent,
+    DirectoryMetadata,
+    DirectoryChildItem,
+    TreemapNode
+  } from '$lib/storage/details-types.js';
+  import Treemap from './Treemap.svelte';
+  import DirectorySizeList from './DirectorySizeList.svelte';
+  import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
+  import { getLocale } from '$lib/paraglide/runtime';
+
+  interface Props {
+    key: string;
+    bucket: string;
+    maximized?: boolean;
+  }
+
+  let { key: objectKey, bucket, maximized = false }: Props = $props();
+
+  const prefix = $derived(objectKey.endsWith('/') ? objectKey : objectKey + '/');
+
+  let tab: 'composition' | 'contents' = $state('composition');
+  let depth = $state(1);
+  let calculating = $state(false);
+  let error = $state<string | null>(null);
+  let progress = $state<{ keysFound: number; totalSize: number } | null>(null);
+  let result = $state<{
+    totalSize: number;
+    totalKeys: number;
+    totalFiles: number;
+    totalDirectories: number;
+    tree: TreemapNode;
+    childrenByDepth: Record<number, DirectoryChildItem[]>;
+    maxDepth: number;
+    durationMs: number;
+  } | null>(null);
+
+  let meta = $state<DirectoryMetadata | null>(null);
+  let metaError = $state<string | null>(null);
+
+  async function fetchMetadata() {
+    try {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) return;
+      const params = new URLSearchParams({ bucket, prefix });
+      const res = await fetch(`/api/storage/directory-metadata?${params}`, {
+        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+      });
+      if (!res.ok) {
+        metaError = m.storage_details_error_fetch_dir_meta({ status: res.status });
+        return;
+      }
+      meta = await res.json();
+    } catch (err) {
+      metaError = err instanceof Error ? err.message : m.storage_details_error_unknown();
+    }
+  }
+
+  $effect(() => {
+    void fetchMetadata();
+  });
+
+  async function calculateSize() {
+    calculating = true;
+    error = null;
+    progress = null;
+    result = null;
+
+    try {
+      const connectionId = connectionStore.activeConnectionId;
+      if (!connectionId) {
+        error = m.storage_details_error_not_connected();
+        calculating = false;
+        return;
+      }
+      const params = new URLSearchParams({ bucket, prefix });
+      const res = await fetch(`/api/storage/directory-size?${params}`, {
+        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+      });
+
+      if (!res.ok) {
+        error = m.storage_details_error_calc_size({ status: res.status });
+        calculating = false;
+        return;
+      }
+
+      const reader = res.body?.getReader();
+      if (!reader) {
+        error = m.storage_details_error_no_body();
+        calculating = false;
+        return;
+      }
+
+      const decoder = new TextDecoder();
+      let buffer = '';
+
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+
+        buffer += decoder.decode(value, { stream: true });
+        const lines = buffer.split('\n');
+        buffer = lines.pop() ?? '';
+
+        for (const line of lines) {
+          if (!line.startsWith('data: ')) continue;
+          try {
+            const event = JSON.parse(line.slice(6)) as DirectorySizeEvent;
+            if (event.type === 'progress') {
+              progress = { keysFound: event.keysFound, totalSize: event.totalSize };
+            } else if (event.type === 'complete') {
+              result = {
+                totalSize: event.totalSize,
+                totalKeys: event.totalKeys,
+                totalFiles: event.totalFiles,
+                totalDirectories: event.totalDirectories,
+                tree: event.tree,
+                childrenByDepth: event.childrenByDepth,
+                maxDepth: event.maxDepth,
+                durationMs: event.durationMs
+              };
+            } else if (event.type === 'error') {
+              error = event.message;
+            }
+          } catch {
+            // skip malformed events
+          }
+        }
+      }
+    } catch (err) {
+      error = err instanceof Error ? err.message : m.storage_details_error_unknown();
+    } finally {
+      calculating = false;
+    }
+  }
+</script>
+
+<div class="flex flex-col gap-4">
+  {#if meta}
+    <div class="overflow-x-auto">
+      <table class="table-sm table">
+        <tbody>
+          {#if meta.markerExists}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_marker_exists()}</td
+              >
+              <td class="font-mono text-sm">{keyToName(prefix)}</td>
+            </tr>
+          {:else}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_marker_exists()}</td
+              >
+              <td class="text-base-content/40 text-sm italic">{m.storage_details_marker_none()}</td>
+            </tr>
+          {/if}
+          {#if meta.markerLastModified}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_last_modified()}</td
+              >
+              <td><TimestampDisplay date={meta.markerLastModified} /></td>
+            </tr>
+          {/if}
+          {#if meta.markerStorageClass}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_storage_class()}</td
+              >
+              <td class="font-mono text-sm">{meta.markerStorageClass}</td>
+            </tr>
+          {/if}
+          {#if meta.markerVersionId}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_version_id()}</td
+              >
+              <td class="max-w-xs truncate font-mono text-sm" title={meta.markerVersionId}
+                >{meta.markerVersionId.slice(0, 20)}...</td
+              >
+            </tr>
+          {/if}
+          {#if meta.markerServerSideEncryption}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_encryption()}</td
+              >
+              <td class="font-mono text-sm">{meta.markerServerSideEncryption}</td>
+            </tr>
+          {/if}
+          {#if meta.markerObjectLockMode}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_object_lock_mode()}</td
+              >
+              <td class="font-mono text-sm">{meta.markerObjectLockMode}</td>
+            </tr>
+          {/if}
+          {#if meta.markerObjectLockRetainUntilDate}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_object_lock_until()}</td
+              >
+              <td><TimestampDisplay date={meta.markerObjectLockRetainUntilDate} /></td>
+            </tr>
+          {/if}
+          <tr>
+            <td class="text-base-content/60 font-medium whitespace-nowrap"
+              >{m.storage_details_owner()}</td
+            >
+            <td class="font-mono text-sm">{meta.bucketOwner}</td>
+          </tr>
+          {#if meta.bucketGrants && meta.bucketGrants.length > 0}
+            <tr>
+              <td class="text-base-content/60 font-medium whitespace-nowrap"
+                >{m.storage_details_permissions()}</td
+              >
+              <td>
+                <div class="flex flex-wrap gap-1">
+                  {#each meta.bucketGrants as grant (grant.grantee + '-' + grant.permission)}
+                    <span class="badge badge-sm gap-1 font-mono text-[10px]">
+                      <span class="text-base-content/70">{grant.grantee}</span>
+                      <span class="text-base-content/40">|</span>
+                      <span>{grant.permission}</span>
+                    </span>
+                  {/each}
+                </div>
+              </td>
+            </tr>
+          {/if}
+        </tbody>
+      </table>
+    </div>
+  {:else if metaError}
+    <div
+      class="border-error/40 bg-error/10 flex items-center gap-3 rounded-lg border p-3"
+      role="alert"
+    >
+      <IconWarning class="text-error size-4 shrink-0" aria-hidden="true" />
+      <p class="text-xs">{metaError}</p>
+    </div>
+  {:else}
+    <div class="border-base-300 rounded-box flex items-center justify-center border p-4">
+      <span class="loading loading-spinner loading-sm text-primary" aria-hidden="true"></span>
+    </div>
+  {/if}
+
+  {#if !result && !calculating}
+    <button class="btn btn-outline btn-primary gap-2" onclick={calculateSize}>
+      <IconCalculate class="size-4" aria-hidden="true" />
+      {m.storage_details_calculate_size()}
+    </button>
+  {/if}
+
+  {#if calculating}
+    <div class="border-base-300 rounded-box flex flex-col items-center gap-3 border p-6">
+      <span class="loading loading-spinner loading-md text-primary" aria-hidden="true"></span>
+      <p class="font-medium">{m.storage_details_calculating()}</p>
+      <p class="text-base-content/60 text-sm">{m.storage_details_calculating_desc()}</p>
+      {#if progress}
+        <div class="text-center text-sm">
+          <p class="text-base-content/80">
+            {m.storage_details_keys_found({ count: progress.keysFound })}
+          </p>
+          <p class="text-base-content/60 font-mono">
+            {formatFileSize(progress.totalSize)}
+          </p>
+        </div>
+      {/if}
+    </div>
+  {/if}
+
+  {#if error}
+    <div
+      class="border-error/40 bg-error/10 flex items-center gap-3 rounded-lg border p-4"
+      role="alert"
+    >
+      <IconWarning class="text-error size-5 shrink-0" aria-hidden="true" />
+      <p class="text-sm">{error}</p>
+    </div>
+  {/if}
+
+  {#if result}
+    <div class="flex flex-wrap gap-6">
+      <div class="stats">
+        <div class="stat">
+          <div class="stat-title">{m.storage_details_total_size()}</div>
+          <div class="stat-value text-lg">{formatFileSize(result.totalSize)}</div>
+        </div>
+        <div class="stat">
+          <div class="stat-title">{m.storage_details_file_count({ count: result.totalFiles })}</div>
+          <div class="stat-value text-lg">{result.totalFiles.toLocaleString(getLocale())}</div>
+        </div>
+        {#if result.totalDirectories > 0}
+          <div class="stat">
+            <div class="stat-title">
+              {m.storage_details_folder_count({ count: result.totalDirectories })}
+            </div>
+            <div class="stat-value text-lg">
+              {result.totalDirectories.toLocaleString(getLocale())}
+            </div>
+          </div>
+        {/if}
+      </div>
+    </div>
+
+    {#if result.tree.children && result.tree.children.length > 0}
+      <div class="bg-base-200 border-base-300 rounded-t-box flex gap-0 border-b" role="tablist">
+        <button
+          class="rounded-ss-box relative flex-1 px-4 py-2.5 text-sm font-medium transition-colors {tab ===
+          'composition'
+            ? 'bg-base-100 text-primary'
+            : 'text-base-content/60 hover:bg-base-100/50 hover:text-base-content'}"
+          role="tab"
+          aria-selected={tab === 'composition'}
+          onclick={() => (tab = 'composition')}
+        >
+          {m.storage_details_tab_composition()}
+          {#if tab === 'composition'}
+            <span class="bg-primary absolute inset-x-0 bottom-0 h-0.5" aria-hidden="true"></span>
+          {/if}
+        </button>
+        <button
+          class="rounded-se-box relative flex-1 px-4 py-2.5 text-sm font-medium transition-colors {tab ===
+          'contents'
+            ? 'bg-base-100 text-primary'
+            : 'text-base-content/60 hover:bg-base-100/50 hover:text-base-content'}"
+          role="tab"
+          aria-selected={tab === 'contents'}
+          onclick={() => (tab = 'contents')}
+        >
+          {m.storage_details_tab_contents()}
+          {#if tab === 'contents'}
+            <span class="bg-primary absolute inset-x-0 bottom-0 h-0.5" aria-hidden="true"></span>
+          {/if}
+        </button>
+      </div>
+      <div class={tab === 'composition' ? 'block' : 'hidden'}>
+        <!-- In maximised mode the treemap fills the full modal width for a richer view. -->
+        <Treemap data={result.tree} fullWidth={maximized} />
+      </div>
+      <div class={tab === 'contents' ? 'block' : 'hidden'}>
+        <div class="border-base-300 flex items-center gap-2 border-b px-3 py-2">
+          <label for="depth-select" class="text-base-content/60 text-xs font-medium"
+            >{m.storage_details_depth()}:
+          </label>
+          <select id="depth-select" class="select select-xs w-20" bind:value={depth}>
+            {#each Array.from({ length: result.maxDepth }, (_, i) => i + 1) as d (d)}
+              <option value={d}>{d}</option>
+            {/each}
+          </select>
+        </div>
+        <DirectorySizeList items={result.childrenByDepth[depth] ?? []} />
+      </div>
+    {/if}
+  {/if}
+</div>
diff --git a/src/lib/components/storage/modals/details/DirectorySizeList.svelte b/src/lib/components/storage/modals/details/DirectorySizeList.svelte
new file mode 100644
index 00000000..fa39ae9c
--- /dev/null
+++ b/src/lib/components/storage/modals/details/DirectorySizeList.svelte
@@ -0,0 +1,147 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import { formatFileSize } from '$lib/storage/utils.js';
+  import type { DirectoryChildItem } from '$lib/storage/details-types.js';
+  import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
+  import IconFolder from 'virtual:icons/material-symbols/folder';
+  import IconDescription from 'virtual:icons/material-symbols/description';
+  import IconArrowUpward from 'virtual:icons/material-symbols/arrow-upward';
+  import IconArrowDownward from 'virtual:icons/material-symbols/arrow-downward';
+  import IconUnfoldMore from 'virtual:icons/material-symbols/unfold-more';
+
+  interface Props {
+    items: DirectoryChildItem[];
+  }
+
+  let { items }: Props = $props();
+
+  type SortKey = 'name' | 'size' | 'lastModified';
+  type SortDir = 'asc' | 'desc';
+
+  let sortKey = $state<SortKey>('size');
+  let sortDir = $state<SortDir>('desc');
+
+  function toggleSort(key: SortKey) {
+    if (sortKey === key) {
+      sortDir = sortDir === 'asc' ? 'desc' : 'asc';
+    } else {
+      sortKey = key;
+      // Default direction: size → desc, name/date → asc
+      sortDir = key === 'size' ? 'desc' : 'asc';
+    }
+  }
+
+  const sortedItems = $derived.by(() => {
+    return [...items].sort((a, b) => {
+      let cmp = 0;
+      if (sortKey === 'name') {
+        cmp = a.name.localeCompare(b.name);
+      } else if (sortKey === 'size') {
+        cmp = a.size - b.size;
+      } else {
+        const da = a.lastModified ? new Date(a.lastModified).getTime() : 0;
+        const db = b.lastModified ? new Date(b.lastModified).getTime() : 0;
+        cmp = da - db;
+      }
+      return sortDir === 'asc' ? cmp : -cmp;
+    });
+  });
+</script>
+
+<div class="overflow-x-auto">
+  <table class="table-xs table">
+    <thead>
+      <tr>
+        <th class="w-6" aria-hidden="true"></th>
+        <th
+          aria-sort={sortKey === 'name' ? (sortDir === 'asc' ? 'ascending' : 'descending') : 'none'}
+        >
+          <button
+            class="flex cursor-pointer items-center gap-1 font-medium"
+            onclick={() => toggleSort('name')}
+          >
+            {m.storage_details_name()}
+            {#if sortKey === 'name'}
+              {#if sortDir === 'asc'}
+                <IconArrowUpward class="size-3 shrink-0" aria-hidden="true" />
+              {:else}
+                <IconArrowDownward class="size-3 shrink-0" aria-hidden="true" />
+              {/if}
+            {:else}
+              <IconUnfoldMore class="text-base-content/30 size-3 shrink-0" aria-hidden="true" />
+            {/if}
+          </button>
+        </th>
+        <th
+          class="text-right"
+          aria-sort={sortKey === 'size' ? (sortDir === 'asc' ? 'ascending' : 'descending') : 'none'}
+        >
+          <button
+            class="flex cursor-pointer items-center justify-end gap-1 font-medium"
+            onclick={() => toggleSort('size')}
+          >
+            {m.storage_details_size()}
+            {#if sortKey === 'size'}
+              {#if sortDir === 'asc'}
+                <IconArrowUpward class="size-3 shrink-0" aria-hidden="true" />
+              {:else}
+                <IconArrowDownward class="size-3 shrink-0" aria-hidden="true" />
+              {/if}
+            {:else}
+              <IconUnfoldMore class="text-base-content/30 size-3 shrink-0" aria-hidden="true" />
+            {/if}
+          </button>
+        </th>
+        <th
+          aria-sort={sortKey === 'lastModified'
+            ? sortDir === 'asc'
+              ? 'ascending'
+              : 'descending'
+            : 'none'}
+        >
+          <button
+            class="flex cursor-pointer items-center gap-1 font-medium"
+            onclick={() => toggleSort('lastModified')}
+          >
+            {m.storage_details_last_modified()}
+            {#if sortKey === 'lastModified'}
+              {#if sortDir === 'asc'}
+                <IconArrowUpward class="size-3 shrink-0" aria-hidden="true" />
+              {:else}
+                <IconArrowDownward class="size-3 shrink-0" aria-hidden="true" />
+              {/if}
+            {:else}
+              <IconUnfoldMore class="text-base-content/30 size-3 shrink-0" aria-hidden="true" />
+            {/if}
+          </button>
+        </th>
+      </tr>
+    </thead>
+    <tbody>
+      {#each sortedItems as item (item.name)}
+        <tr class="hover:bg-base-200/50">
+          <td class="text-base-content/50 p-1" aria-hidden="true">
+            {#if item.isDirectory}
+              <IconFolder class="text-warning size-4" />
+            {:else}
+              <IconDescription class="text-base-content/50 size-4" />
+            {/if}
+          </td>
+          <td class="font-mono text-sm">
+            {item.name}
+          </td>
+          <td class="text-right font-mono text-sm tabular-nums">
+            {formatFileSize(item.size)}
+          </td>
+          <td class="text-sm">
+            {#if item.lastModified}
+              <TimestampDisplay date={item.lastModified} tooltip="tooltip-left" />
+            {:else}
+              <span class="text-base-content/40">—</span>
+            {/if}
+          </td>
+        </tr>
+      {/each}
+    </tbody>
+  </table>
+</div>
diff --git a/src/lib/components/storage/modals/details/FileDetails.svelte b/src/lib/components/storage/modals/details/FileDetails.svelte
new file mode 100644
index 00000000..8a1ffb2a
--- /dev/null
+++ b/src/lib/components/storage/modals/details/FileDetails.svelte
@@ -0,0 +1,99 @@
+<script lang="ts">
+  import * as m from '$lib/paraglide/messages.js';
+  import { formatFileSize, keyToName } from '$lib/storage/utils.js';
+  import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
+  import type { FileDetails as FileDetailsType } from '$lib/storage/details-types.js';
+  import { getLocale } from '$lib/paraglide/runtime';
+
+  interface Props {
+    details: FileDetailsType;
+    bucket: string;
+  }
+
+  let { details, bucket }: Props = $props();
+</script>
+
+<div class="overflow-x-auto">
+  <table class="table-sm table">
+    <tbody>
+      <tr>
+        <td class="text-base-content/60 font-medium whitespace-nowrap"
+          >{m.storage_details_name()}</td
+        >
+        <td class="font-mono text-sm">{keyToName(details.key)}</td>
+      </tr>
+      <tr>
+        <td class="text-base-content/60 font-medium whitespace-nowrap"
+          >{m.storage_details_file_path()}</td
+        >
+        <td class="font-mono text-sm break-all">s3://{bucket}/{details.key}</td>
+      </tr>
+      <tr>
+        <td class="text-base-content/60 font-medium whitespace-nowrap"
+          >{m.storage_details_size()}</td
+        >
+        <td class="font-mono text-sm"
+          >{formatFileSize(details.size)} ({details.size.toLocaleString(getLocale())} bytes)</td
+        >
+      </tr>
+      <tr>
+        <td class="text-base-content/60 font-medium whitespace-nowrap"
+          >{m.storage_details_last_modified()}</td
+        >
+        <td><TimestampDisplay date={details.lastModified} showFullTimestamp={true} /></td>
+      </tr>
+      {#if details.contentType}
+        <tr>
+          <td class="text-base-content/60 font-medium whitespace-nowrap"
+            >{m.storage_details_content_type()}</td
+          >
+          <td class="font-mono text-sm">{details.contentType}</td>
+        </tr>
+      {/if}
+      {#if details.etag}
+        <tr>
+          <td class="text-base-content/60 font-medium whitespace-nowrap"
+            >{m.storage_details_etag()}</td
+          >
+          <td class="max-w-xs truncate font-mono text-sm" title={details.etag}>{details.etag}</td>
+        </tr>
+      {/if}
+      <tr>
+        <td class="text-base-content/60 font-medium whitespace-nowrap"
+          >{m.storage_details_version_id()}</td
+        >
+        <td class="max-w-xs truncate font-mono text-sm" title={details.versionId ?? ''}>
+          {details.versionId ?? '—'}
+        </td>
+      </tr>
+      <tr>
+        <td class="text-base-content/60 font-medium whitespace-nowrap"
+          >{m.storage_details_storage_class()}</td
+        >
+        <td class="font-mono text-sm">{details.storageClass ?? '—'}</td>
+      </tr>
+      <tr>
+        <td class="text-base-content/60 font-medium whitespace-nowrap"
+          >{m.storage_details_is_delete_marker()}</td
+        >
+        <td>{details.isDeleteMarker ? m.storage_details_yes() : m.storage_details_no()}</td>
+      </tr>
+    </tbody>
+  </table>
+
+  {#if details.customMetadata && Object.keys(details.customMetadata).length > 0}
+    <h4 class="text-base-content/70 mt-4 mb-2 text-xs font-semibold tracking-wide uppercase">
+      {m.storage_details_custom_metadata()}
+    </h4>
+    <table class="table-sm table">
+      <tbody>
+        {#each Object.entries(details.customMetadata) as [key, value] (key)}
+          <tr>
+            <td class="text-base-content/60 font-mono text-xs font-medium">{key}</td>
+            <td class="font-mono text-xs break-all">{value}</td>
+          </tr>
+        {/each}
+      </tbody>
+    </table>
+  {/if}
+</div>
diff --git a/src/lib/components/storage/modals/details/Treemap.svelte b/src/lib/components/storage/modals/details/Treemap.svelte
new file mode 100644
index 00000000..653c6a1b
--- /dev/null
+++ b/src/lib/components/storage/modals/details/Treemap.svelte
@@ -0,0 +1,390 @@
+<script lang="ts">
+  import type { TreemapNode } from '$lib/storage/details-types.js';
+  import { formatFileSize } from '$lib/storage/utils.js';
+  import * as m from '$lib/paraglide/messages.js';
+  import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconFolderOpen from 'virtual:icons/material-symbols/folder-open';
+  import FloatingMenu from '$lib/components/storage/shared/FloatingMenu.svelte';
+
+  interface Props {
+    data: TreemapNode;
+    fullWidth?: boolean;
+  }
+
+  let { data, fullWidth = false }: Props = $props();
+
+  // 1px margin on every side of each rect creates visible gaps between neighbours
+  const MARGIN = 1;
+  // Padding from a container edge inward to where its children start
+  const PAD = 4;
+  // H is fixed; W is measured from the container so the layout recalculates
+  // for the actual rendered width rather than just scaling the SVG.
+  const H = 400;
+
+  let containerEl = $state<HTMLDivElement | null>(null);
+  let containerWidth = $state(0);
+
+  // In fullWidth mode, recalculate the layout for the real container width.
+  // In normal mode the SVG is constrained to max-w-150 (600 px) so W=600.
+  const W = $derived(fullWidth && containerWidth > 4 ? containerWidth : 600);
+
+  $effect(() => {
+    if (!containerEl || typeof ResizeObserver === 'undefined') return;
+    const ro = new ResizeObserver((entries) => {
+      containerWidth = Math.round(entries[0].contentRect.width);
+    });
+    ro.observe(containerEl);
+    return () => ro.disconnect();
+  });
+
+  // Maximum number of file (leaf) nodes to render; the smallest ones are
+  // grouped per their immediate parent directory into a single “N more” node.
+  const MAX_VISIBLE_LEAVES = 30;
+
+  const containerFills = [
+    'fill-primary/8',
+    'fill-secondary/8',
+    'fill-accent/8',
+    'fill-info/8',
+    'fill-success/8',
+    'fill-warning/8',
+    'fill-error/8'
+  ];
+
+  const leafFills = [
+    'fill-primary/35',
+    'fill-secondary/35',
+    'fill-accent/35',
+    'fill-info/35',
+    'fill-success/35',
+    'fill-warning/35',
+    'fill-error/35'
+  ];
+
+  interface LayoutRect {
+    x: number;
+    y: number;
+    w: number;
+    h: number;
+    name: string;
+    size: number;
+    depth: number;
+    isContainer: boolean;
+    path: string | undefined;
+    fullKey: string | undefined;
+  }
+
+  /**
+   * Prune leaf nodes to at most MAX_VISIBLE_LEAVES.
+   * Smallest leaves are grouped per their immediate parent into a single
+   * synthetic “N more” node so the treemap stays hierarchically accurate.
+   */
+  function pruneTree(root: TreemapNode, moreLabel: (count: number) => string): TreemapNode {
+    function countLeaves(node: TreemapNode): number {
+      if (!node.children || node.children.length === 0) return 1;
+      return node.children.reduce((sum, child) => sum + countLeaves(child), 0);
+    }
+
+    if (countLeaves(root) <= MAX_VISIBLE_LEAVES) return root;
+
+    const allLeaves: TreemapNode[] = [];
+    function collectLeaves(node: TreemapNode) {
+      if (!node.children || node.children.length === 0) {
+        allLeaves.push(node);
+      } else {
+        for (const child of node.children) collectLeaves(child);
+      }
+    }
+    collectLeaves(root);
+
+    const sorted = [...allLeaves].sort((a, b) => b.size - a.size);
+    const kept = new Set<TreemapNode>(sorted.slice(0, MAX_VISIBLE_LEAVES));
+
+    function rebuild(node: TreemapNode): TreemapNode {
+      if (!node.children || node.children.length === 0) return node;
+
+      const newChildren: TreemapNode[] = [];
+      let overflowSize = 0;
+      let overflowCount = 0;
+
+      for (const child of node.children) {
+        if (!child.children || child.children.length === 0) {
+          if (kept.has(child)) {
+            newChildren.push(child);
+          } else {
+            overflowSize += child.size;
+            overflowCount++;
+          }
+        } else {
+          const rebuilt = rebuild(child);
+          if (rebuilt.children && rebuilt.children.length > 0) newChildren.push(rebuilt);
+        }
+      }
+
+      if (overflowCount > 0) {
+        newChildren.push({ name: moreLabel(overflowCount), size: overflowSize });
+      }
+
+      return { ...node, children: newChildren.sort((a, b) => b.size - a.size) };
+    }
+
+    return rebuild(root);
+  }
+
+  const prunedData = $derived(
+    pruneTree(data, (count) => m.storage_details_treemap_more({ count }))
+  );
+
+  const rects = $derived.by(() => {
+    const result: LayoutRect[] = [];
+    layoutNode(prunedData, 0, 0, W, H, 0, result);
+    return result;
+  });
+
+  function layoutNode(
+    node: TreemapNode,
+    x: number,
+    y: number,
+    w: number,
+    h: number,
+    depth: number,
+    rects: LayoutRect[]
+  ) {
+    const children = node.children;
+    const isContainer = !!(children && children.length > 0);
+
+    // Collapse single-child containers to avoid padding exhaustion from deep nesting
+    if (isContainer && children!.length === 1) {
+      layoutNode(children![0], x, y, w, h, depth + 1, rects);
+      return;
+    }
+
+    rects.push({
+      x,
+      y,
+      w,
+      h,
+      name: node.name,
+      size: node.size,
+      depth,
+      isContainer,
+      path: node.path,
+      fullKey: node.fullKey
+    });
+
+    if (!isContainer) return;
+
+    const ix = x + PAD;
+    const iy = y + PAD;
+    const iw = Math.max(0, w - 2 * PAD);
+    const ih = Math.max(0, h - 2 * PAD);
+    if (iw <= 0 || ih <= 0) return;
+
+    const total = node.size || 1;
+    let cx = ix;
+    let cy = iy;
+    let remW = iw;
+    let remH = ih;
+    let horizontal = remW >= remH;
+
+    for (const child of children!) {
+      const area = (child.size / total) * iw * ih;
+      let cw: number;
+      let ch: number;
+      if (horizontal) {
+        ch = remH;
+        cw = remW > 0 ? Math.max(1, area / ch) : 1;
+      } else {
+        cw = remW;
+        ch = remH > 0 ? Math.max(1, area / cw) : 1;
+      }
+      cw = Math.min(cw, remW);
+      ch = Math.min(ch, remH);
+
+      layoutNode(child, cx, cy, cw, ch, depth + 1, rects);
+
+      if (horizontal) {
+        cx += cw;
+        remW -= cw;
+      } else {
+        cy += ch;
+        remH -= ch;
+      }
+      if (remW <= 0 || remH <= 0) break;
+      horizontal = remW >= remH;
+    }
+  }
+
+  function fillClass(depth: number, isContainer: boolean): string {
+    const idx = depth % containerFills.length;
+    return isContainer ? containerFills[idx] : leafFills[idx];
+  }
+
+  let ctxMenu = $state<{ x: number; y: number; target: LayoutRect } | null>(null);
+
+  function openContextMenu(e: MouseEvent | KeyboardEvent, rect: LayoutRect) {
+    e.preventDefault();
+    e.stopPropagation();
+    if (e instanceof MouseEvent) {
+      ctxMenu = { x: e.clientX, y: e.clientY, target: rect };
+    } else {
+      const el = e.currentTarget as SVGGElement;
+      const r = el.getBoundingClientRect();
+      ctxMenu = { x: r.right, y: r.top, target: rect };
+    }
+  }
+
+  function closeContextMenu() {
+    ctxMenu = null;
+  }
+
+  async function copy(text: string) {
+    try {
+      await navigator.clipboard.writeText(text);
+    } catch {
+      const ta = document.createElement('textarea');
+      ta.value = text;
+      document.body.appendChild(ta);
+      ta.select();
+      document.execCommand('copy');
+      document.body.removeChild(ta);
+    }
+    closeContextMenu();
+  }
+</script>
+
+<div class="w-full overflow-x-auto" bind:this={containerEl}>
+  <svg
+    viewBox="0 0 {W} {H}"
+    class="bg-base-200 w-full {fullWidth ? '' : 'max-w-150'} rounded"
+    role="img"
+    aria-label={m.storage_details_treemap_aria()}
+  >
+    <defs>
+      {#each rects as rect (rect.x + '-' + rect.y + '-' + rect.w + '-' + rect.h)}
+        {#if !rect.isContainer && rect.w > 40 && rect.h > 14}
+          <linearGradient id="fg-{rect.x}-{rect.y}" x1="0" y1="0" x2="1" y2="0">
+            <stop offset="60%" stop-color="#fff" />
+            <stop offset="100%" stop-color="#fff" stop-opacity="0" />
+          </linearGradient>
+          <mask id="fm-{rect.x}-{rect.y}">
+            <!-- Full inner-rect height so the gradient only fades horizontally,
+                 never clips text vertically. -->
+            <rect
+              x={rect.x + MARGIN + 4}
+              y={rect.y + MARGIN}
+              width={Math.max(rect.w - 2 * MARGIN - 8, 1)}
+              height={Math.max(rect.h - 2 * MARGIN, 1)}
+              fill="url(#fg-{rect.x}-{rect.y})"
+            />
+          </mask>
+        {/if}
+      {/each}
+    </defs>
+    {#each rects as rect (rect.x + '-' + rect.y + '-' + rect.w + '-' + rect.h)}
+      <g
+        class="group cursor-pointer"
+        role="treeitem"
+        tabindex="0"
+        aria-selected="false"
+        oncontextmenu={(e) => openContextMenu(e, rect)}
+        onkeydown={(e) => {
+          if (e.key === 'ContextMenu' || (e.shiftKey && e.key === 'F10')) openContextMenu(e, rect);
+        }}
+      >
+        <!-- 1px margin on every side creates visible gaps between adjacent rects -->
+        <rect
+          x={rect.x + MARGIN}
+          y={rect.y + MARGIN}
+          width={Math.max(rect.w - 2 * MARGIN, 1)}
+          height={Math.max(rect.h - 2 * MARGIN, 1)}
+          class="{fillClass(rect.depth, rect.isContainer)} transition-opacity hover:opacity-80"
+          rx={rect.isContainer ? 1 : 2}
+        />
+        {#if !rect.isContainer && rect.w > 40}
+          {@const ih = rect.h - 2 * MARGIN}
+          {#if ih >= 15}
+            <!--
+              Text layout (TOP_PAD = 3, line height ≈ 13):
+                name  (11px) at y+MARGIN+3  → bottom ≈ y+MARGIN+14
+                path   (9px) at y+MARGIN+16 → bottom ≈ y+MARGIN+25  (only if ih≥38)
+                size  (10px) at y+MARGIN+27 → bottom ≈ y+MARGIN+37  (3-line)
+                  or   at y+MARGIN+16 → bottom ≈ y+MARGIN+26        (2-line, ih≥27)
+            -->
+            <g mask="url(#fm-{rect.x}-{rect.y})">
+              <text
+                x={rect.x + MARGIN + 4}
+                y={rect.y + MARGIN + 3}
+                class="fill-base-content text-[11px] font-medium"
+                dominant-baseline="hanging">{rect.name}</text
+              >
+              {#if ih >= 38}
+                <text
+                  x={rect.x + MARGIN + 4}
+                  y={rect.y + MARGIN + 16}
+                  class="fill-base-content/45 text-[9px]"
+                  dominant-baseline="hanging">{rect.path || './'}</text
+                >
+                <text
+                  x={rect.x + MARGIN + 4}
+                  y={rect.y + MARGIN + 27}
+                  class="fill-base-content/70 text-[10px]"
+                  dominant-baseline="hanging">{formatFileSize(rect.size)}</text
+                >
+              {:else if ih >= 27}
+                <text
+                  x={rect.x + MARGIN + 4}
+                  y={rect.y + MARGIN + 16}
+                  class="fill-base-content/70 text-[10px]"
+                  dominant-baseline="hanging">{formatFileSize(rect.size)}</text
+                >
+              {/if}
+            </g>
+          {/if}
+        {/if}
+        <title>
+          {rect.name}{#if rect.path}
+            ({rect.path}){/if}: {formatFileSize(rect.size)}
+        </title>
+      </g>
+    {/each}
+  </svg>
+</div>
+
+<FloatingMenu
+  x={ctxMenu?.x ?? 0}
+  y={ctxMenu?.y ?? 0}
+  open={ctxMenu !== null}
+  onclose={closeContextMenu}
+>
+  {#if ctxMenu}
+    <button
+      role="menuitem"
+      class="btn btn-ghost btn-sm w-full justify-start gap-2"
+      onclick={() => {
+        const t = ctxMenu!.target;
+        copy(t.name);
+      }}
+    >
+      <IconContentCopy class="size-4 shrink-0" aria-hidden="true" />
+      {#if ctxMenu.target.isContainer}
+        {m.storage_details_copy_dir_name()}
+      {:else}
+        {m.storage_details_copy_file_name()}
+      {/if}
+    </button>
+    {#if ctxMenu.target.fullKey}
+      <button
+        role="menuitem"
+        class="btn btn-ghost btn-sm w-full justify-start gap-2"
+        onclick={() => {
+          const t = ctxMenu!.target;
+          if (t.fullKey) copy(t.fullKey);
+        }}
+      >
+        <IconFolderOpen class="size-4 shrink-0" aria-hidden="true" />
+        {m.storage_details_copy_full_path()}
+      </button>
+    {/if}
+  {/if}
+</FloatingMenu>
diff --git a/src/lib/components/storage/shared/FloatingMenu.svelte b/src/lib/components/storage/shared/FloatingMenu.svelte
new file mode 100644
index 00000000..261a6d06
--- /dev/null
+++ b/src/lib/components/storage/shared/FloatingMenu.svelte
@@ -0,0 +1,52 @@
+<script lang="ts">
+  import type { Snippet } from 'svelte';
+
+  interface Props {
+    x: number;
+    y: number;
+    open: boolean;
+    onclose: () => void;
+    children: Snippet;
+  }
+
+  let { x, y, open, onclose, children }: Props = $props();
+
+  // Portal action: moves the element into the currently open <dialog> so it
+  // stays within the browser's top layer (which renders above the modal
+  // backdrop). Falling back to document.body for non-dialog usage.
+  function portal(node: HTMLElement) {
+    if (typeof document === 'undefined') return {};
+    const target = document.querySelector('dialog[open]') ?? document.body;
+    target.appendChild(node);
+    return {
+      destroy() {
+        try {
+          node.remove();
+        } catch {
+          // already removed
+        }
+      }
+    };
+  }
+</script>
+
+{#if open}
+  <div
+    use:portal
+    role="presentation"
+    class="fixed inset-0 z-9998"
+    onclick={onclose}
+    oncontextmenu={(e) => {
+      e.preventDefault();
+      onclose();
+    }}
+  ></div>
+  <div
+    use:portal
+    class="border-base-300 bg-base-100 fixed z-9999 w-48 rounded-lg border p-1 shadow-lg"
+    style="left: {x}px; top: {y}px;"
+    role="menu"
+  >
+    {@render children()}
+  </div>
+{/if}
diff --git a/src/lib/components/storage/shared/TimestampDisplay.svelte b/src/lib/components/storage/shared/TimestampDisplay.svelte
index 72b3f835..894ac255 100644
--- a/src/lib/components/storage/shared/TimestampDisplay.svelte
+++ b/src/lib/components/storage/shared/TimestampDisplay.svelte
@@ -12,11 +12,18 @@
      * When false (default), the label shows a short formatted date ("13 May 2026").
      */
     relative?: boolean;
+    /** When true, the tooltip shows the full timestamp. */
+    showFullTimestamp?: boolean;
     /** DaisyUI tooltip direction. */
     tooltip?: TooltipPosition;
   }
 
-  let { date, relative = false, tooltip = 'tooltip-top' }: Props = $props();
+  let {
+    date,
+    relative = false,
+    tooltip = 'tooltip-top',
+    showFullTimestamp = false
+  }: Props = $props();
 
   const d = $derived(typeof date === 'string' ? new Date(date) : date);
 
@@ -45,6 +52,7 @@
       const years = Math.floor(days / 365);
       return m.timestamp_years_ago({ count: years });
     }
+    if (showFullTimestamp) return fullTimestamp;
     return new Intl.DateTimeFormat(getLocale(), {
       year: 'numeric',
       month: 'short',
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index b3e4bbe1..be79dc0d 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -5,6 +5,7 @@
   import IconClose from 'virtual:icons/material-symbols/close';
   import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
+  import IconInfo from 'virtual:icons/material-symbols/info';
   import IconBucket from '../shared/BucketIcon.svelte';
   import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
   import IconGridView from 'virtual:icons/material-symbols/grid-view';
@@ -13,6 +14,7 @@
   import Tooltip from '$lib/components/Tooltip.svelte';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
+  import FloatingMenu from '../shared/FloatingMenu.svelte';
   import type { PinnedLocation, StorageLocation } from '$lib/storage/types.js';
   import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
   import { pinnedLabel, pinnedHref } from '$lib/storage/display-helpers.js';
@@ -81,8 +83,28 @@
   }
   beforeNavigate(closeUnpinMenu);
 
+  // ── Bucket details context menu ───────────────────────────────────────────
+  let bucketCtx = $state<{ x: number; y: number; bucket: string } | null>(null);
+
+  function openBucketContextMenu(e: MouseEvent, bucket: string) {
+    e.preventDefault();
+    bucketCtx = { x: e.clientX, y: e.clientY, bucket };
+  }
+
+  function closeBucketContextMenu() {
+    bucketCtx = null;
+  }
+
+  function openBucketDetails() {
+    if (bucketCtx) {
+      storage.openModal('details', { type: 'bucket', bucket: bucketCtx.bucket });
+      bucketCtx = null;
+    }
+  }
+
   function handleKeydown(e: KeyboardEvent) {
     if (unpinCtx && e.key === 'Escape') closeUnpinMenu();
+    if (bucketCtx && e.key === 'Escape') closeBucketContextMenu();
   }
 
   function handleUnpin() {
@@ -292,6 +314,7 @@
               onmouseleave={hideTooltip}
               onfocus={(e) => showTooltip(e, bucket)}
               onblur={hideTooltip}
+              oncontextmenu={(e) => openBucketContextMenu(e, bucket)}
               ondragover={(e) => handleSidebarDragOver(e, '')}
               ondragleave={handleSidebarDragLeave}
               ondrop={(e) => handleSidebarDrop(e, bucket, '')}
@@ -318,6 +341,22 @@
     </form>
   </div>
 
+  <FloatingMenu
+    x={bucketCtx?.x ?? 0}
+    y={bucketCtx?.y ?? 0}
+    open={bucketCtx !== null}
+    onclose={closeBucketContextMenu}
+  >
+    <button
+      role="menuitem"
+      class="btn btn-ghost btn-sm w-full justify-start gap-2"
+      onclick={openBucketDetails}
+    >
+      <IconInfo class="size-4" aria-hidden="true" />
+      {m.storage_action_details()}
+    </button>
+  </FloatingMenu>
+
   <!-- Disconnect confirmation modal -->
   <Modal bind:open={disconnectConfirmOpen} class="modal">
     <div class="modal-box max-w-sm">
diff --git a/src/lib/server/storage/hdfs-provider.ts b/src/lib/server/storage/hdfs-provider.ts
index de0688c9..c3b1d5ba 100644
--- a/src/lib/server/storage/hdfs-provider.ts
+++ b/src/lib/server/storage/hdfs-provider.ts
@@ -1,6 +1,7 @@
 import type { StorageProvider, ObjectDownload, DeleteObjectsResult } from './provider.js';
 import type { HDFSConfig } from './types.js';
 import type { StoragePage, StorageMetadata } from '$lib/storage/types.js';
+import type { LifecycleRule, BucketAcl } from '$lib/storage/details-types.js';
 
 /* TODO: Remove this file and related HDFS provider code until we have a concrete plan for HDFS support.
  For now, this serves as a placeholder to prevent compile errors. */
@@ -55,6 +56,29 @@ export class HDFSStorageProvider implements StorageProvider {
     throw new Error('HDFS not implemented');
   }
 
+  listAllKeysProgressively(
+    _prefix: string,
+    _onBatch: (keys: Array<{ key: string; size: number }>) => void
+  ): Promise<void> {
+    throw new Error('HDFS not implemented');
+  }
+
+  getBucketVersioning(): Promise<string> {
+    throw new Error('HDFS not implemented');
+  }
+
+  getBucketLifecycleRules(): Promise<LifecycleRule[]> {
+    throw new Error('HDFS not implemented');
+  }
+
+  getBucketTags(): Promise<Record<string, string>> {
+    throw new Error('HDFS not implemented');
+  }
+
+  getBucketAcl(): Promise<BucketAcl> {
+    throw new Error('HDFS not implemented');
+  }
+
   copyObject(_sourceKey: string, _destKey: string): Promise<void> {
     throw new Error('HDFS not implemented');
   }
diff --git a/src/lib/server/storage/preview/parquet.test.ts b/src/lib/server/storage/preview/parquet.test.ts
index d268884f..2598a45b 100644
--- a/src/lib/server/storage/preview/parquet.test.ts
+++ b/src/lib/server/storage/preview/parquet.test.ts
@@ -62,6 +62,11 @@ function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider
     putObject: vi.fn(),
     deleteObjects: vi.fn(),
     listAllKeys: vi.fn(),
+    listAllKeysProgressively: vi.fn(),
+    getBucketVersioning: vi.fn(),
+    getBucketLifecycleRules: vi.fn(),
+    getBucketTags: vi.fn(),
+    getBucketAcl: vi.fn(),
     copyObject: vi.fn(),
     ...overrides
   };
diff --git a/src/lib/server/storage/preview/stream.test.ts b/src/lib/server/storage/preview/stream.test.ts
index 54309e4c..f148ffbb 100644
--- a/src/lib/server/storage/preview/stream.test.ts
+++ b/src/lib/server/storage/preview/stream.test.ts
@@ -18,6 +18,11 @@ function makeProvider(overrides: Partial<StorageProvider> = {}): StorageProvider
     putObject: vi.fn(),
     deleteObjects: vi.fn(),
     listAllKeys: vi.fn(),
+    listAllKeysProgressively: vi.fn(),
+    getBucketVersioning: vi.fn(),
+    getBucketLifecycleRules: vi.fn(),
+    getBucketTags: vi.fn(),
+    getBucketAcl: vi.fn(),
     copyObject: vi.fn(),
     ...overrides
   };
diff --git a/src/lib/server/storage/provider.ts b/src/lib/server/storage/provider.ts
index 7d461c29..27ef36c7 100644
--- a/src/lib/server/storage/provider.ts
+++ b/src/lib/server/storage/provider.ts
@@ -1,4 +1,5 @@
 import type { StoragePage, StorageMetadata, DeleteObjectsResult } from '$lib/storage/types.js';
+import type { LifecycleRule, BucketAcl } from '$lib/storage/details-types.js';
 
 export type { DeleteObjectsResult };
 
@@ -45,6 +46,14 @@ export interface StorageProvider {
    * Used to expand directory prefixes before deletion.
    */
   listAllKeys(prefix: string): Promise<string[]>;
+  listAllKeysProgressively(
+    prefix: string,
+    onBatch: (keys: Array<{ key: string; size: number; lastModified?: Date }>) => void
+  ): Promise<void>;
+  getBucketVersioning(): Promise<string>;
+  getBucketLifecycleRules(): Promise<LifecycleRule[]>;
+  getBucketTags(): Promise<Record<string, string>>;
+  getBucketAcl(): Promise<BucketAcl>;
   /**
    * Copy an object from `sourceKey` to `destKey` within the same bucket.
    * For objects <= 5 GB uses S3 CopyObject; for larger objects streams the
diff --git a/src/lib/server/storage/s3-provider.ts b/src/lib/server/storage/s3-provider.ts
index cbd71f27..598fade9 100644
--- a/src/lib/server/storage/s3-provider.ts
+++ b/src/lib/server/storage/s3-provider.ts
@@ -7,6 +7,10 @@ import {
   HeadObjectCommand,
   DeleteObjectsCommand,
   PutObjectCommand,
+  GetBucketVersioningCommand,
+  GetBucketLifecycleConfigurationCommand,
+  GetBucketTaggingCommand,
+  GetBucketAclCommand,
   CopyObjectCommand,
   CreateMultipartUploadCommand,
   UploadPartCopyCommand,
@@ -18,6 +22,7 @@ import { Upload } from '@aws-sdk/lib-storage';
 import type { StorageProvider, ObjectDownload, DeleteObjectsResult } from './provider.js';
 import type { S3Config } from './types.js';
 import type { StoragePage, StorageObject, StorageMetadata } from '$lib/storage/types.js';
+import type { LifecycleRule, BucketAcl } from '$lib/storage/details-types.js';
 import { logger } from '$lib/server/logging';
 import { createS3Client } from './s3-client.js';
 import { mapS3ErrorToHttp } from './s3-errors.js';
@@ -157,7 +162,10 @@ export class S3StorageProvider implements StorageProvider {
           lastModified: output.LastModified ?? new Date(0),
           contentType: output.ContentType,
           etag: output.ETag,
-          customMetadata: output.Metadata
+          customMetadata: output.Metadata,
+          versionId: output.VersionId,
+          storageClass: output.StorageClass,
+          isDeleteMarker: output.DeleteMarker ?? false
         };
       },
       { bucket: this.bucket, key, operation: 'getMetadata' }
@@ -289,6 +297,143 @@ export class S3StorageProvider implements StorageProvider {
     return { failed: allFailed };
   }
 
+  async getBucketVersioning(): Promise<'Enabled' | 'Suspended' | 'Disabled'> {
+    try {
+      const output = await this.client.send(
+        new GetBucketVersioningCommand({ Bucket: this.bucket })
+      );
+      if (output.Status === 'Enabled') return 'Enabled';
+      if (output.Status === 'Suspended') return 'Suspended';
+      return 'Disabled';
+    } catch {
+      return 'Disabled';
+    }
+  }
+
+  async getBucketLifecycleRules(): Promise<LifecycleRule[]> {
+    try {
+      const output = await this.client.send(
+        new GetBucketLifecycleConfigurationCommand({ Bucket: this.bucket })
+      );
+      return (output.Rules ?? []).map((rule) => {
+        const expiration = rule.Expiration;
+        const noncurrentExpiration = rule.NoncurrentVersionExpiration;
+        const abortMpu = rule.AbortIncompleteMultipartUpload;
+
+        return {
+          id: rule.ID ?? '',
+          status: rule.Status === 'Enabled' ? 'Enabled' : 'Disabled',
+          filter: (rule.Filter as Record<string, unknown>) ?? {},
+          transitions: (rule.Transitions ?? []).map((t) => ({
+            days: t.Days ?? 0,
+            storageClass: t.StorageClass ?? ''
+          })),
+          expirations: expiration
+            ? [
+                {
+                  days: expiration.Days,
+                  date: expiration.Date?.toISOString(),
+                  expiredObjectDeleteMarker: expiration.ExpiredObjectDeleteMarker
+                }
+              ]
+            : [],
+          noncurrentVersionTransitions: (rule.NoncurrentVersionTransitions ?? []).map((t) => ({
+            noncurrentDays: t.NoncurrentDays ?? 0,
+            storageClass: t.StorageClass ?? ''
+          })),
+          noncurrentVersionExpirations: noncurrentExpiration
+            ? [{ noncurrentDays: noncurrentExpiration.NoncurrentDays ?? 0 }]
+            : [],
+          abortIncompleteMultipartUploads: abortMpu
+            ? [{ daysAfterInitiation: abortMpu.DaysAfterInitiation ?? 0 }]
+            : []
+        };
+      });
+    } catch {
+      return [];
+    }
+  }
+
+  async getBucketAcl(): Promise<BucketAcl> {
+    try {
+      const output = await this.client.send(new GetBucketAclCommand({ Bucket: this.bucket }));
+      const owner = [output.Owner?.DisplayName, output.Owner?.ID].filter(Boolean).join(' / ');
+      const grants = (output.Grants ?? []).map((g) => ({
+        grantee:
+          g.Grantee?.DisplayName ??
+          g.Grantee?.EmailAddress ??
+          g.Grantee?.ID ??
+          g.Grantee?.URI ??
+          g.Grantee?.Type ??
+          'Unknown',
+        permission: g.Permission ?? 'Unknown'
+      }));
+      return { owner: owner || 'Unknown', grants };
+    } catch {
+      return { owner: 'Unknown', grants: [] };
+    }
+  }
+
+  async getBucketTags(): Promise<Record<string, string>> {
+    try {
+      const output = await this.client.send(new GetBucketTaggingCommand({ Bucket: this.bucket }));
+      const tags: Record<string, string> = {};
+      for (const tag of output.TagSet ?? []) {
+        if (tag.Key) tags[tag.Key] = tag.Value ?? '';
+      }
+      return tags;
+    } catch {
+      return {};
+    }
+  }
+
+  async listAllKeysProgressively(
+    prefix: string,
+    onBatch: (keys: Array<{ key: string; size: number; lastModified?: Date }>) => void
+  ): Promise<void> {
+    log.trace({ bucket: this.bucket, prefix }, 'S3 ListObjectsV2 (progressive, concurrent)');
+
+    // Pipeline: while processing each page's results, the next page is already being
+    // fetched.  Each page's continuation token is only known after its predecessor
+    // completes, so we chain through `.then()` to keep one lookahead fetch in-flight.
+    const inFlight: Array<Promise<ListObjectsV2CommandOutput>> = [];
+
+    const fetchPage = (token?: string): Promise<ListObjectsV2CommandOutput> =>
+      this.client.send(
+        new ListObjectsV2Command({
+          Bucket: this.bucket,
+          Prefix: prefix,
+          ContinuationToken: token
+        })
+      );
+
+    // Seed the first fetch
+    inFlight.push(fetchPage());
+
+    while (inFlight.length > 0) {
+      const output = await inFlight.shift()!;
+
+      const batch: Array<{ key: string; size: number; lastModified?: Date }> = [];
+      for (const obj of output.Contents ?? []) {
+        if (obj.Key) {
+          batch.push({ key: obj.Key, size: obj.Size ?? 0, lastModified: obj.LastModified });
+        }
+      }
+      if (batch.length > 0) {
+        onBatch(batch);
+      }
+
+      // If truncated, chain the next fetch so it starts while we process the
+      // current page's results (or already completes by the time we loop back).
+      if (output.IsTruncated && output.NextContinuationToken) {
+        const token = output.NextContinuationToken;
+        inFlight.push(fetchPage(token));
+      }
+    }
+
+    log.trace({ bucket: this.bucket, prefix }, 'progressive listing complete');
+  }
+
   async listAllKeys(prefix: string): Promise<string[]> {
     log.trace({ bucket: this.bucket, prefix }, 'S3 ListObjectsV2 (recursive)');
     const keys: string[] = [];
diff --git a/src/lib/storage/details-types.ts b/src/lib/storage/details-types.ts
new file mode 100644
index 00000000..9132607d
--- /dev/null
+++ b/src/lib/storage/details-types.ts
@@ -0,0 +1,106 @@
+/** Full metadata for a file object. */
+export interface FileDetails {
+  key: string;
+  name: string;
+  size: number;
+  lastModified: Date;
+  contentType: string | undefined;
+  etag: string | undefined;
+  customMetadata: Record<string, string> | undefined;
+  versionId: string | undefined;
+  storageClass: string | undefined;
+  isDeleteMarker: boolean;
+}
+
+/** A node in the tree for treemap visualization. */
+export interface TreemapNode {
+  name: string;
+  size: number;
+  children?: TreemapNode[];
+  /** Parent directory path relative to the analyzed prefix (leaf nodes only). */
+  path?: string;
+  /** Full S3 key including the prefix (leaf nodes only). */
+  fullKey?: string;
+}
+
+/** Progress event from the directory-size SSE endpoint. */
+export interface DirectorySizeProgress {
+  type: 'progress';
+  keysFound: number;
+  totalSize: number;
+}
+
+/** Final result from the directory-size SSE endpoint. */
+export interface DirectorySizeResult {
+  type: 'complete';
+  totalSize: number;
+  totalKeys: number;
+  totalFiles: number;
+  totalDirectories: number;
+  tree: TreemapNode;
+  childrenByDepth: Record<number, DirectoryChildItem[]>;
+  maxDepth: number;
+  durationMs: number;
+}
+
+/** Metadata about an S3 directory/folder (bucket ACL + optional directory marker object). */
+export interface DirectoryMetadata {
+  bucketOwner: string;
+  bucketGrants: Array<{ grantee: string; permission: string }>;
+  markerExists: boolean;
+  markerLastModified?: string;
+  markerContentType?: string;
+  markerETag?: string;
+  markerContentLength?: number;
+  markerVersionId?: string;
+  markerStorageClass?: string;
+  markerServerSideEncryption?: string;
+  markerCustomMetadata?: Record<string, string>;
+  markerObjectLockMode?: string;
+  markerObjectLockRetainUntilDate?: string;
+  markerObjectLockLegalHoldStatus?: string;
+  markerIsDeleteMarker?: boolean;
+}
+
+/** A single child item (file or folder) in the first level of a directory listing. */
+export interface DirectoryChildItem {
+  name: string;
+  size: number;
+  lastModified: string | undefined;
+  isDirectory: boolean;
+}
+
+/** Error event from the directory-size SSE endpoint. */
+export interface DirectorySizeError {
+  type: 'error';
+  message: string;
+}
+
+export type DirectorySizeEvent = DirectorySizeProgress | DirectorySizeResult | DirectorySizeError;
+
+/** Lifecycle rule from S3 bucket lifecycle configuration. */
+export interface LifecycleRule {
+  id: string;
+  status: 'Enabled' | 'Disabled';
+  filter: Record<string, unknown>;
+  transitions: Array<{ days: number; storageClass: string }>;
+  expirations: Array<{ days?: number; date?: string; expiredObjectDeleteMarker?: boolean }>;
+  noncurrentVersionTransitions: Array<{ noncurrentDays: number; storageClass: string }>;
+  noncurrentVersionExpirations: Array<{ noncurrentDays: number }>;
+  abortIncompleteMultipartUploads: Array<{ daysAfterInitiation: number }>;
+}
+
+/** Bucket ACL information. */
+export interface BucketAcl {
+  owner: string;
+  grants: Array<{ grantee: string; permission: string }>;
+}
+
+/** Bucket configuration details. */
+export interface BucketDetails {
+  name: string;
+  versioning: 'Enabled' | 'Suspended' | 'Disabled';
+  lifecycleRules: LifecycleRule[];
+  tags: Record<string, string>;
+  acl: BucketAcl;
+}
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 9fdde33b..c400fd6a 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -708,6 +708,22 @@ export class StorageState {
         return;
       }
 
+      case 'details': {
+        const targetKey = ctxKey ?? this.selectedFiles[0]?.key ?? this.selectedFolders[0]?.key;
+        if (!targetKey) {
+          addToast('warning', m.storage_action_preview_no_selection());
+          return;
+        }
+        const isDir = targetKey.endsWith('/');
+        this.openModal('details', {
+          type: isDir ? 'directory' : 'file',
+          bucket: this.bucket,
+          key: targetKey,
+          prefix: isDir ? targetKey : undefined
+        });
+        return;
+      }
+
       case 'copy-path': {
         const pathKey = ctxKey ?? this.selectedFiles[0]?.key;
         if (!pathKey) return;
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index 6fd5af33..b22dd911 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -4,6 +4,7 @@ export type ModalType =
   | 'delete'
   | 'preview'
   | 'upload'
+  | 'details'
   | 'rename'
   | 'confirm-move'
   | 'resolve-conflicts'
@@ -18,6 +19,12 @@ export interface ModalPayloads {
     nestedArchivePath?: string;
   };
   upload: { bucket: string; prefix: string };
+  details: {
+    type: 'file' | 'directory' | 'bucket';
+    bucket: string;
+    key?: string;
+    prefix?: string;
+  };
   rename: { key: string };
   'confirm-move': {
     keys: string[];
@@ -76,6 +83,7 @@ export type ActionName =
   | 'unpin'
   | 'copy-filename'
   | 'copy-path'
+  | 'details'
   | 'cut'
   | 'copy'
   | 'paste'
@@ -175,6 +183,9 @@ export interface StorageMetadata {
   contentType: string | undefined;
   etag: string | undefined;
   customMetadata: Record<string, string> | undefined;
+  versionId?: string | undefined;
+  storageClass?: string | undefined;
+  isDeleteMarker?: boolean;
 }
 
 /** A page of listed objects from a storage provider. */
diff --git a/src/routes/(app)/api/storage/bucket-details/+server.ts b/src/routes/(app)/api/storage/bucket-details/+server.ts
new file mode 100644
index 00000000..fa1736cd
--- /dev/null
+++ b/src/routes/(app)/api/storage/bucket-details/+server.ts
@@ -0,0 +1,29 @@
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucket } from '../params.js';
+import type { BucketDetails } from '$lib/storage/details-types.js';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const bucket = requireBucket(url);
+
+  locals.logger.debug({ bucket }, 'fetching bucket details');
+
+  const provider = getProvider(locals.storageConfig!, bucket);
+
+  const [versioning, lifecycleRules, tags, acl] = await Promise.all([
+    provider.getBucketVersioning(),
+    provider.getBucketLifecycleRules(),
+    provider.getBucketTags(),
+    provider.getBucketAcl()
+  ]);
+
+  const details: BucketDetails = {
+    name: bucket,
+    versioning: versioning as 'Enabled' | 'Suspended' | 'Disabled',
+    lifecycleRules,
+    tags,
+    acl
+  };
+
+  return Response.json(details);
+};
diff --git a/src/routes/(app)/api/storage/bucket-details/server.test.ts b/src/routes/(app)/api/storage/bucket-details/server.test.ts
new file mode 100644
index 00000000..cd679f8e
--- /dev/null
+++ b/src/routes/(app)/api/storage/bucket-details/server.test.ts
@@ -0,0 +1,112 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockGetBucketVersioning = vi.fn();
+const mockGetBucketLifecycleRules = vi.fn();
+const mockGetBucketTags = vi.fn();
+const mockGetBucketAcl = vi.fn();
+const mockProvider = {
+  getBucketVersioning: mockGetBucketVersioning,
+  getBucketLifecycleRules: mockGetBucketLifecycleRules,
+  getBucketTags: mockGetBucketTags,
+  getBucketAcl: mockGetBucketAcl
+};
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+import { GET } from './+server.js';
+
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
+function mockEvent(searchParams: Record<string, string>) {
+  const url = new URL('http://localhost/api/storage/bucket-details');
+  for (const [k, v] of Object.entries(searchParams)) {
+    url.searchParams.set(k, v);
+  }
+  return {
+    url,
+    request: { headers: new Headers(CONNECTION_HEADER) },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /api/storage/bucket-details', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('throws 400 when bucket is missing', async () => {
+    await expect(GET(mockEvent({}))).rejects.toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('returns bucket details with Enabled versioning', async () => {
+    mockGetBucketVersioning.mockResolvedValue('Enabled');
+    mockGetBucketLifecycleRules.mockResolvedValue([]);
+    mockGetBucketTags.mockResolvedValue({ env: 'prod' });
+    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+
+    const response = await GET(mockEvent({ bucket: 'b1' }));
+    const body = await response.json();
+    expect(body).toMatchObject({
+      name: 'b1',
+      versioning: 'Enabled',
+      tags: { env: 'prod' },
+      acl: { owner: 'admin', grants: [] },
+      lifecycleRules: []
+    });
+  });
+
+  it('preserves Suspended versioning state', async () => {
+    mockGetBucketVersioning.mockResolvedValue('Suspended');
+    mockGetBucketLifecycleRules.mockResolvedValue([]);
+    mockGetBucketTags.mockResolvedValue({});
+    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+
+    const response = await GET(mockEvent({ bucket: 'b1' }));
+    const body = await response.json();
+    expect(body.versioning).toBe('Suspended');
+  });
+
+  it('returns Disabled versioning as default', async () => {
+    mockGetBucketVersioning.mockResolvedValue('Disabled');
+    mockGetBucketLifecycleRules.mockResolvedValue([]);
+    mockGetBucketTags.mockResolvedValue({});
+    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+
+    const response = await GET(mockEvent({ bucket: 'b1' }));
+    const body = await response.json();
+    expect(body.versioning).toBe('Disabled');
+  });
+
+  it('includes lifecycle rules and ACL grants', async () => {
+    const rules = [
+      {
+        id: 'rule-1',
+        status: 'Enabled',
+        filter: { prefix: 'logs/' },
+        transitions: [],
+        expirations: [{ days: 30 }],
+        noncurrentVersionTransitions: [],
+        noncurrentVersionExpirations: [],
+        abortIncompleteMultipartUploads: []
+      }
+    ];
+    const acl = {
+      owner: 'owner',
+      grants: [{ grantee: 'user1', permission: 'FULL_CONTROL' }]
+    };
+    mockGetBucketVersioning.mockResolvedValue('Enabled');
+    mockGetBucketLifecycleRules.mockResolvedValue(rules);
+    mockGetBucketTags.mockResolvedValue({});
+    mockGetBucketAcl.mockResolvedValue(acl);
+
+    const response = await GET(mockEvent({ bucket: 'b1' }));
+    const body = await response.json();
+    expect(body.lifecycleRules).toEqual(rules);
+    expect(body.acl).toEqual(acl);
+  });
+});
diff --git a/src/routes/(app)/api/storage/details/+server.ts b/src/routes/(app)/api/storage/details/+server.ts
new file mode 100644
index 00000000..edd8afc9
--- /dev/null
+++ b/src/routes/(app)/api/storage/details/+server.ts
@@ -0,0 +1,28 @@
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucketKey } from '../params.js';
+import type { FileDetails } from '$lib/storage/details-types.js';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const { bucket, key } = requireBucketKey(url);
+
+  locals.logger.debug({ bucket, key }, 'fetching object details');
+
+  const provider = getProvider(locals.storageConfig!, bucket);
+  const meta = await provider.getMetadata(key);
+
+  const details: FileDetails = {
+    key,
+    name: key.split('/').filter(Boolean).pop() ?? key,
+    size: meta.size,
+    lastModified: meta.lastModified,
+    contentType: meta.contentType,
+    etag: meta.etag,
+    customMetadata: meta.customMetadata,
+    versionId: meta.versionId,
+    storageClass: meta.storageClass,
+    isDeleteMarker: meta.isDeleteMarker ?? false
+  };
+
+  return Response.json(details);
+};
diff --git a/src/routes/(app)/api/storage/details/server.test.ts b/src/routes/(app)/api/storage/details/server.test.ts
new file mode 100644
index 00000000..60cfdd81
--- /dev/null
+++ b/src/routes/(app)/api/storage/details/server.test.ts
@@ -0,0 +1,92 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockGetMetadata = vi.fn();
+const mockProvider = { getMetadata: mockGetMetadata };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+import { GET } from './+server.js';
+
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
+function mockEvent(searchParams: Record<string, string>) {
+  const url = new URL('http://localhost/api/storage/details');
+  for (const [k, v] of Object.entries(searchParams)) {
+    url.searchParams.set(k, v);
+  }
+  return {
+    url,
+    request: { headers: new Headers(CONNECTION_HEADER) },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /api/storage/details', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('throws 400 when bucket is missing', async () => {
+    await expect(GET(mockEvent({ key: 'file.txt' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('throws 400 when key is missing', async () => {
+    await expect(GET(mockEvent({ bucket: 'b1' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns file details', async () => {
+    const meta = {
+      size: 1024,
+      lastModified: new Date('2025-01-01'),
+      contentType: 'text/plain',
+      etag: '"abc123"',
+      customMetadata: { author: 'test' },
+      versionId: 'v1',
+      storageClass: 'STANDARD',
+      isDeleteMarker: false
+    };
+    mockGetMetadata.mockResolvedValue(meta);
+
+    const response = await GET(mockEvent({ bucket: 'b1', key: 'path/file.txt' }));
+    expect(mockGetMetadata).toHaveBeenCalledWith('path/file.txt');
+    const body = await response.json();
+    expect(body).toMatchObject({
+      key: 'path/file.txt',
+      name: 'file.txt',
+      size: 1024,
+      contentType: 'text/plain',
+      etag: '"abc123"',
+      customMetadata: { author: 'test' },
+      storageClass: 'STANDARD',
+      isDeleteMarker: false
+    });
+  });
+
+  it('handles missing optional fields', async () => {
+    mockGetMetadata.mockResolvedValue({
+      size: 0,
+      lastModified: new Date(0),
+      contentType: undefined,
+      etag: undefined,
+      customMetadata: undefined,
+      versionId: undefined,
+      storageClass: undefined,
+      isDeleteMarker: false
+    });
+
+    const response = await GET(mockEvent({ bucket: 'b1', key: 'test.dat' }));
+    const body = await response.json();
+    expect(body.contentType).toBeUndefined();
+    expect(body.etag).toBeUndefined();
+    expect(body.storageClass).toBeUndefined();
+  });
+});
diff --git a/src/routes/(app)/api/storage/directory-metadata/+server.ts b/src/routes/(app)/api/storage/directory-metadata/+server.ts
new file mode 100644
index 00000000..2480363d
--- /dev/null
+++ b/src/routes/(app)/api/storage/directory-metadata/+server.ts
@@ -0,0 +1,44 @@
+import { error } from '@sveltejs/kit';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucket } from '../params.js';
+import type { DirectoryMetadata } from '$lib/storage/details-types.js';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const bucket = requireBucket(url);
+  const prefix = url.searchParams.get('prefix')?.trim();
+
+  if (!prefix) {
+    throw error(400, 'Missing required query parameter: prefix');
+  }
+
+  locals.logger.debug({ bucket, prefix }, 'fetching directory metadata');
+
+  const provider = getProvider(locals.storageConfig!, bucket);
+
+  const acl = await provider.getBucketAcl();
+  const result: DirectoryMetadata = {
+    bucketOwner: acl.owner,
+    bucketGrants: acl.grants,
+    markerExists: false
+  };
+
+  try {
+    const meta = await provider.getMetadata(prefix);
+    result.markerExists = true;
+    result.markerLastModified = meta.lastModified.toISOString();
+    result.markerContentType = meta.contentType;
+    result.markerETag = meta.etag;
+    result.markerContentLength = meta.size;
+    result.markerVersionId = meta.versionId;
+    result.markerStorageClass = meta.storageClass;
+    result.markerIsDeleteMarker = meta.isDeleteMarker;
+    result.markerCustomMetadata = meta.customMetadata;
+  } catch {
+    // No directory marker object — that's fine
+  }
+
+  return new Response(JSON.stringify(result), {
+    headers: { 'Content-Type': 'application/json' }
+  });
+};
diff --git a/src/routes/(app)/api/storage/directory-metadata/server.test.ts b/src/routes/(app)/api/storage/directory-metadata/server.test.ts
new file mode 100644
index 00000000..b7ee6ea9
--- /dev/null
+++ b/src/routes/(app)/api/storage/directory-metadata/server.test.ts
@@ -0,0 +1,92 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockGetBucketAcl = vi.fn();
+const mockGetMetadata = vi.fn();
+const mockProvider = {
+  getBucketAcl: mockGetBucketAcl,
+  getMetadata: mockGetMetadata
+};
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+import { GET } from './+server.js';
+
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
+function mockEvent(searchParams: Record<string, string>) {
+  const url = new URL('http://localhost/api/storage/directory-metadata');
+  for (const [k, v] of Object.entries(searchParams)) {
+    url.searchParams.set(k, v);
+  }
+  return {
+    url,
+    request: { headers: new Headers(CONNECTION_HEADER) },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: 'us-east-1' }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /api/storage/directory-metadata', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('throws 400 when bucket is missing', async () => {
+    await expect(GET(mockEvent({ prefix: 'dir/' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('throws 400 when prefix is missing', async () => {
+    await expect(GET(mockEvent({ bucket: 'b1' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns directory metadata without marker', async () => {
+    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+    mockGetMetadata.mockRejectedValue(new Error('NoSuchKey'));
+
+    const response = await GET(mockEvent({ bucket: 'b1', prefix: 'dir/' }));
+    const body = await response.json();
+    expect(body).toMatchObject({
+      bucketOwner: 'admin',
+      bucketGrants: [],
+      markerExists: false
+    });
+    expect(mockGetMetadata).toHaveBeenCalled();
+  });
+
+  it('returns directory metadata with marker when object exists', async () => {
+    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+    mockGetMetadata.mockResolvedValue({
+      size: 0,
+      lastModified: new Date('2025-06-01'),
+      contentType: 'application/octet-stream',
+      etag: '"def456"',
+      versionId: 'v2',
+      storageClass: 'STANDARD',
+      isDeleteMarker: false
+    });
+
+    const response = await GET(mockEvent({ bucket: 'b1', prefix: 'dir/' }));
+    const body = await response.json();
+    expect(body.markerExists).toBe(true);
+    expect(body.markerLastModified).toBeDefined();
+    expect(body.markerETag).toBe('"def456"');
+    expect(body.markerVersionId).toBe('v2');
+  });
+
+  it('handles marker metadata fetch failure gracefully', async () => {
+    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+    mockGetMetadata.mockRejectedValue(new Error('not found'));
+
+    const response = await GET(mockEvent({ bucket: 'b1', prefix: 'dir/' }));
+    const body = await response.json();
+    expect(body.markerExists).toBe(false);
+  });
+});
diff --git a/src/routes/(app)/api/storage/directory-size/+server.ts b/src/routes/(app)/api/storage/directory-size/+server.ts
new file mode 100644
index 00000000..6da04de1
--- /dev/null
+++ b/src/routes/(app)/api/storage/directory-size/+server.ts
@@ -0,0 +1,196 @@
+import { error } from '@sveltejs/kit';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucket } from '../params.js';
+import type {
+  DirectorySizeEvent,
+  DirectoryChildItem,
+  TreemapNode
+} from '$lib/storage/details-types.js';
+import type { RequestHandler } from './$types';
+
+function buildTree(prefix: string, keys: Array<{ key: string; size: number }>): TreemapNode {
+  const rootName = prefix.split('/').filter(Boolean).pop() || '(root)';
+
+  interface TrieNode {
+    name: string;
+    size: number;
+    children: Map<string, TrieNode>;
+  }
+
+  const rootTrie: TrieNode = { name: rootName, size: 0, children: new Map() };
+
+  for (const { key, size } of keys) {
+    const relative = key.slice(prefix.length);
+    const parts = relative.split('/').filter(Boolean);
+    if (parts.length === 0) continue;
+
+    rootTrie.size += size;
+    let current = rootTrie;
+    for (let i = 0; i < parts.length; i++) {
+      const part = parts[i];
+      if (!current.children.has(part)) {
+        current.children.set(part, { name: part, size: 0, children: new Map() });
+      }
+      current = current.children.get(part)!;
+      current.size += size;
+    }
+  }
+
+  function trieToTreemap(node: TrieNode): TreemapNode {
+    function convert(n: TrieNode, parentPrefix: string, isRoot: boolean): TreemapNode {
+      const result: TreemapNode = {
+        name: n.name,
+        size: n.size
+      };
+      if (n.children.size > 0) {
+        result.children = [...n.children.entries()]
+          .map(([, v]) => convert(v, isRoot ? '' : parentPrefix + n.name + '/', false))
+          .sort((a, b) => b.size - a.size);
+      } else {
+        result.path = parentPrefix || undefined;
+        result.fullKey = prefix + (parentPrefix || '') + n.name;
+      }
+      return result;
+    }
+    return convert(node, '', true);
+  }
+
+  return trieToTreemap(rootTrie);
+}
+
+function buildChildrenByDepth(
+  prefix: string,
+  keys: Array<{ key: string; size: number; lastModified?: Date }>,
+  maxDepth: number
+): Record<number, DirectoryChildItem[]> {
+  const depthMaps: Map<string, { size: number; lastModified: Date | undefined }>[] = [];
+  for (let d = 1; d <= maxDepth; d++) {
+    depthMaps.push(new Map());
+  }
+
+  for (const { key, size, lastModified } of keys) {
+    const relative = key.slice(prefix.length);
+    const parts = relative.split('/').filter(Boolean);
+    if (parts.length === 0) continue;
+
+    for (let d = 1; d <= maxDepth; d++) {
+      if (parts.length < d) continue;
+
+      const nameParts = parts.slice(0, d);
+      const index = d - 1;
+      const isDir = index < parts.length - 1 || relative.endsWith('/');
+      const childName = isDir ? nameParts.join('/') + '/' : nameParts.join('/');
+
+      const map = depthMaps[d - 1];
+      const existing = map.get(childName);
+      if (existing) {
+        existing.size += size;
+        if (lastModified && (!existing.lastModified || lastModified > existing.lastModified)) {
+          existing.lastModified = lastModified;
+        }
+      } else {
+        map.set(childName, { size, lastModified });
+      }
+    }
+  }
+
+  const result: Record<number, DirectoryChildItem[]> = {};
+  for (let d = 1; d <= maxDepth; d++) {
+    result[d] = [...depthMaps[d - 1].entries()]
+      .map(([name, entry]) => ({
+        name,
+        size: entry.size,
+        lastModified: entry.lastModified?.toISOString(),
+        isDirectory: name.endsWith('/')
+      }))
+      .sort((a, b) => b.size - a.size);
+  }
+
+  return result;
+}
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const bucket = requireBucket(url);
+  const prefix = url.searchParams.get('prefix') ?? '';
+
+  if (!prefix) {
+    throw error(400, 'Missing required query parameter: prefix');
+  }
+
+  locals.logger.debug({ bucket, prefix }, 'calculating directory size');
+
+  const provider = getProvider(locals.storageConfig!, bucket);
+  const allKeys: Array<{ key: string; size: number; lastModified?: Date }> = [];
+  const startTime = Date.now();
+  const encoder = new TextEncoder();
+
+  const stream = new ReadableStream({
+    async start(controller) {
+      try {
+        await provider.listAllKeysProgressively(prefix, (batch) => {
+          allKeys.push(...batch);
+
+          const progress: DirectorySizeEvent = {
+            type: 'progress',
+            keysFound: allKeys.length,
+            totalSize: allKeys.reduce((sum, k) => sum + k.size, 0)
+          };
+
+          controller.enqueue(encoder.encode(`data: ${JSON.stringify(progress)}\n\n`));
+        });
+
+        const tree = buildTree(prefix, allKeys);
+        const actualMaxDepth =
+          allKeys.length > 0
+            ? Math.max(
+                1,
+                ...allKeys.map(({ key }) => {
+                  const relative = key.slice(prefix.length);
+                  return relative.split('/').filter(Boolean).length;
+                })
+              )
+            : 1;
+        const childrenByDepth = buildChildrenByDepth(prefix, allKeys, actualMaxDepth);
+        let totalFiles = 0;
+        let totalDirectories = 0;
+        for (const { key } of allKeys) {
+          if (key.endsWith('/')) {
+            totalDirectories++;
+          } else {
+            totalFiles++;
+          }
+        }
+
+        const result: DirectorySizeEvent = {
+          type: 'complete',
+          totalSize: allKeys.reduce((sum, k) => sum + k.size, 0),
+          totalKeys: allKeys.length,
+          totalFiles,
+          totalDirectories,
+          tree,
+          childrenByDepth,
+          maxDepth: actualMaxDepth,
+          durationMs: Date.now() - startTime
+        };
+
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(result)}\n\n`));
+        controller.close();
+      } catch (err) {
+        const errorEvent: DirectorySizeEvent = {
+          type: 'error',
+          message: err instanceof Error ? err.message : 'Unknown error'
+        };
+        controller.enqueue(encoder.encode(`data: ${JSON.stringify(errorEvent)}\n\n`));
+        controller.close();
+      }
+    }
+  });
+
+  return new Response(stream, {
+    headers: {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      Connection: 'keep-alive'
+    }
+  });
+};
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 33791170..9ff1dc5d 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -4,6 +4,7 @@
   import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
   import { StorageState } from '$lib/storage/state.svelte.js';
   import { setStorageState } from '$lib/storage/context.js';
+  import StorageModals from '$lib/components/storage/modals/StorageModals.svelte';
   import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 
   let { children, data } = $props();
@@ -43,3 +44,6 @@
 {:else}
   {@render children()}
 {/if}
+
+<!-- Global modals — always mounted so bucket details work from sidebar/landing page -->
+<StorageModals />
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 97db2496..97f85c82 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -20,6 +20,7 @@
   } from '$lib/editor/split-statements.js';
   import type { PageData } from './$types';
   import StatementResult from '$lib/components/trino/StatementResult.svelte';
+  import { getLocale } from '$lib/paraglide/runtime.js';
 
   let { data }: { data: PageData } = $props();
 
@@ -694,7 +695,9 @@
           <span class="text-base-content/60 text-sm font-medium">{m.trino_editor_label()}</span>
           {#if charLimitReached}
             <span class="text-warning text-xs" role="status"
-              >{m.trino_editor_char_limit_reached({ limit: MAX_SQL_LENGTH.toLocaleString() })}</span
+              >{m.trino_editor_char_limit_reached({
+                limit: MAX_SQL_LENGTH.toLocaleString(getLocale())
+              })}</span
             >
           {/if}
         </div>
@@ -859,7 +862,7 @@
           {#if runner.progress.processedRows > 0 || runner.progress.elapsedTimeMillis > 0}
             <span class="text-base-content/60 text-xs">
               {m.trino_progress_info({
-                rows: runner.progress.processedRows.toLocaleString(),
+                rows: runner.progress.processedRows.toLocaleString(getLocale()),
                 elapsed: (runner.progress.elapsedTimeMillis / 1000).toFixed(1)
               })}
             </span>

From a490fa2cfe61f180623a3fed0c6b8e7699b07372 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 15 Jul 2026 12:00:21 +0200
Subject: [PATCH 111/136] fix: redirect to /storage from bucket page when no
 active connection (#244)

* fix: redirect to /storage from bucket page when no active connection

* fix flaky e2e test 2

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 .../[bucket]/[...prefix]/+page.server.ts      |  8 +++-
 .../[bucket]/[...prefix]/page.server.test.ts  | 48 +++++++++++++++----
 2 files changed, 46 insertions(+), 10 deletions(-)

diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
index 32a557c6..5b58d35f 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -1,6 +1,12 @@
+import { redirect } from '@sveltejs/kit';
 import type { PageServerLoad } from './$types';
 
-export const load: PageServerLoad = async ({ params }) => {
+export const load: PageServerLoad = async ({ params, locals }) => {
+  const activeId = locals.session?.activeStorageConnectionId ?? null;
+  if (!activeId) {
+    throw redirect(303, '/storage');
+  }
+
   const prefix = params.prefix ? params.prefix + '/' : '';
   const bucket = params.bucket;
   return { bucket, prefix };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
index 1ef2b010..25ca2d66 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
@@ -1,29 +1,59 @@
-import { describe, it, expect } from 'vitest';
+import { describe, it, expect, vi } from 'vitest';
 
 import { load } from './+page.server.js';
 
-function mockEvent(opts: { bucket?: string; prefix?: string } = {}) {
+function mockEvent(
+  opts: {
+    bucket?: string;
+    prefix?: string;
+    activeConnectionId?: string | null;
+    session?: Record<string, unknown> | null;
+  } = {}
+) {
+  const session =
+    opts.session !== undefined
+      ? opts.session
+      : opts.activeConnectionId === undefined
+        ? { activeStorageConnectionId: null }
+        : { activeStorageConnectionId: opts.activeConnectionId };
+
   return {
-    locals: { logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() }, user: { id: 'test-user' } },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      session
+    },
     params: { bucket: opts.bucket ?? 'my-bucket', prefix: opts.prefix ?? '' }
   } as unknown as Parameters<typeof load>[0];
 }
 
-import { vi } from 'vitest';
-
 describe('bucket page server load', () => {
-  it('returns bucket and prefix', async () => {
-    const result = await load(mockEvent());
+  it('returns bucket and prefix when an active connection exists', async () => {
+    const result = await load(mockEvent({ activeConnectionId: 'conn-123' }));
     expect(result).toEqual({ bucket: 'my-bucket', prefix: '' });
   });
 
+  it('redirects to /storage when no active connection', async () => {
+    await expect(load(mockEvent({ activeConnectionId: null }))).rejects.toThrow(
+      expect.objectContaining({ status: 303, location: '/storage' })
+    );
+  });
+
+  it('redirects to /storage when activeConnectionId is absent from session', async () => {
+    await expect(load(mockEvent({ session: null }))).rejects.toThrow(
+      expect.objectContaining({ status: 303, location: '/storage' })
+    );
+  });
+
   it('adds trailing slash to prefix', async () => {
-    const result = await load(mockEvent({ prefix: 'data/2024' }));
+    const result = await load(mockEvent({ prefix: 'data/2024', activeConnectionId: 'conn-123' }));
     expect(result).toEqual({ bucket: 'my-bucket', prefix: 'data/2024/' });
   });
 
   it('handles empty prefix', async () => {
-    const result = await load(mockEvent({ bucket: 'test-bucket', prefix: '' }));
+    const result = await load(
+      mockEvent({ bucket: 'test-bucket', prefix: '', activeConnectionId: 'conn-123' })
+    );
     expect(result).toEqual({ bucket: 'test-bucket', prefix: '' });
   });
 });

From 34757b49a3262748980a7c47a70bd06b8c66506a Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 15 Jul 2026 14:01:57 +0200
Subject: [PATCH 112/136] Filebrowser: Support users explicitly stating S3
 bucket names (#186)

* feat: implement manual bucket connection feature with UI and API support

* test: add unit tests for bucket access check API

* test: update add bucket tests to ensure correct bucket visibility after creation

* fix: artifacts from merge

* fix: tests

* feat: implement manual bucket connection and update connection store

* add hidden bucket to garage setup

* fix tooltip on bucket grid

* fix: improve tooltip functionality for bucket names in BucketGrid tests

* fix vertical alignment of add bucket button

* fix: update tooltip hover interaction to use role-based selector

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 .github/workflows/pr_checks.yaml              |   1 -
 e2e/init-garage-s3.sh                         |  42 +++
 e2e/storage/add-bucket.spec.ts                | 158 ++++++++++++
 e2e/support/containers/garage.setup.ts        |  16 +-
 e2e/support/garage.ts                         |  43 ++++
 messages/de.json                              |  10 +
 messages/en.json                              |  10 +
 .../explorer/__tests__/FileRow.svelte.spec.ts |  15 +-
 .../storage/landing/AddBucketModal.svelte     | 148 +++++++++++
 .../landing/AddBucketModal.svelte.spec.ts     | 241 ++++++++++++++++++
 .../storage/landing/BucketGrid.svelte         |  49 ++--
 .../storage/landing/BucketGrid.svelte.spec.ts |   6 +-
 src/lib/storage/state.svelte.ts               |   7 +
 .../(app)/api/storage/check-bucket/+server.ts |  22 ++
 .../api/storage/check-bucket/server.test.ts   |  62 +++++
 .../(app)/api/storage/connections/+server.ts  |  54 +++-
 src/routes/(app)/storage/+page.svelte         |  28 +-
 17 files changed, 876 insertions(+), 36 deletions(-)
 create mode 100644 e2e/storage/add-bucket.spec.ts
 create mode 100644 src/lib/components/storage/landing/AddBucketModal.svelte
 create mode 100644 src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts
 create mode 100644 src/routes/(app)/api/storage/check-bucket/+server.ts
 create mode 100644 src/routes/(app)/api/storage/check-bucket/server.test.ts

diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index bed73772..23753c49 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -88,7 +88,6 @@ jobs:
   e2e-tests:
     name: E2E Tests with Garage S3 and PostgreSQL
     runs-on: ubuntu-latest
-    timeout-minutes: 30
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/e2e/init-garage-s3.sh b/e2e/init-garage-s3.sh
index 6b15486b..10c7105c 100755
--- a/e2e/init-garage-s3.sh
+++ b/e2e/init-garage-s3.sh
@@ -43,6 +43,22 @@ json_find_bucket_id_by_alias() {
   ' "$bucket_name"
 }
 
+json_read_field_from_file() {
+  local file="$1"
+  local field="$2"
+
+  node -e '
+    const fs = require("fs");
+    try {
+      const data = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+      const value = process.argv[2].split(".").reduce((current, key) => current?.[key], data);
+      if (value !== undefined && value !== null) {
+        process.stdout.write(String(value));
+      }
+    } catch { /* file missing or invalid JSON — emit nothing */ }
+  ' "$file" "$field"
+}
+
 admin_post() {
   local path="$1"
   local payload="$2"
@@ -75,6 +91,19 @@ create_bucket() {
   admin_post '/v2/CreateBucket' "{\"globalAlias\":\"$bucket_name\"}"
 }
 
+# Creates a bucket with no global alias so it does not appear in S3 ListBuckets.
+create_hidden_bucket() {
+  admin_post '/v2/CreateBucket' '{}'
+}
+
+bucket_exists() {
+  local bucket_id="$1"
+
+  curl -fsS \
+    -H "Authorization: Bearer $GARAGE_ADMIN_TOKEN" \
+    "$GARAGE_ADMIN_URL/v2/GetBucketInfo?id=$bucket_id" >/dev/null 2>&1
+}
+
 allow_bucket_key() {
   local bucket_id="$1"
   local access_key_id="$2"
@@ -93,6 +122,18 @@ fi
 
 allow_bucket_key "$bucket_id" "$S3_ACCESS_KEY_ID" >/dev/null
 
+# Hidden bucket: no global alias so it is absent from S3 ListBuckets responses,
+# but the access key retains read and write (not owner) access.
+# Idempotent: reuse the bucket ID stored in an existing config file if the
+# bucket is still present in Garage; otherwise create a new one.
+hidden_bucket_id=$(json_read_field_from_file "$S3_CONFIG_PATH" 'hiddenBucketId')
+if [[ -z "$hidden_bucket_id" ]] || ! bucket_exists "$hidden_bucket_id"; then
+  hidden_bucket_response=$(create_hidden_bucket)
+  hidden_bucket_id=$(printf '%s' "$hidden_bucket_response" | json_get 'id')
+fi
+
+admin_post '/v2/AllowBucketKey' \
+  "{\"bucketId\":\"$hidden_bucket_id\",\"accessKeyId\":\"$S3_ACCESS_KEY_ID\",\"permissions\":{\"owner\":false,\"read\":true,\"write\":true}}" >/dev/null
 # ──────────────────────────────────────────────
 # Bucket enrichment: tags, lifecycle rules, sample data
 # ──────────────────────────────────────────────
@@ -191,6 +232,7 @@ cat > "$S3_CONFIG_PATH" <<EOF
   "awsAccessKeyId": "$S3_ACCESS_KEY_ID",
   "awsSecretAccessKey": "$S3_SECRET_ACCESS_KEY",
   "bucket": "$S3_BUCKET",
+  "hiddenBucketId": "$hidden_bucket_id",
   "garageAdminUrl": "$GARAGE_ADMIN_URL",
   "garageAdminToken": "$GARAGE_ADMIN_TOKEN"
 }
diff --git a/e2e/storage/add-bucket.spec.ts b/e2e/storage/add-bucket.spec.ts
new file mode 100644
index 00000000..cdfe2a80
--- /dev/null
+++ b/e2e/storage/add-bucket.spec.ts
@@ -0,0 +1,158 @@
+import { test, expect } from '@playwright/test';
+import {
+  createGarageBucketCredentials,
+  hasGarageAdmin,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import { connectToStorage, modalBox, uniqueBucketName } from './helpers.js';
+
+test.describe('Storage S3 — Add bucket manually', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  async function openAddBucketModal(page: import('@playwright/test').Page) {
+    await page.getByRole('button', { name: 'Add bucket' }).click();
+    await expect(page.getByRole('dialog')).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'Connect to a bucket' })).toBeVisible();
+  }
+
+  test('opens and closes the Add bucket modal', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await openAddBucketModal(page);
+
+    await page.getByRole('button', { name: 'Cancel' }).click();
+    await expect(page.getByRole('dialog')).not.toBeVisible();
+  });
+
+  test('Connect button is disabled when input is empty', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+
+    await openAddBucketModal(page);
+
+    await expect(modalBox(page).getByRole('button', { name: 'Connect' })).toBeDisabled();
+  });
+
+  test('navigates into bucket after successful connection', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await openAddBucketModal(page);
+    await modalBox(page).getByLabel('Bucket name').fill(credentials.bucket);
+    await modalBox(page).getByRole('button', { name: 'Connect' }).click();
+
+    await expect(page).toHaveURL(`/storage/${encodeURIComponent(credentials.bucket)}`);
+  });
+
+  test('bucket appears in the bucket grid after successful connection', async ({
+    page
+  }, testInfo) => {
+    test.skip(
+      !hasGarageAdmin(),
+      'Skipped: Garage admin API is unavailable for per-test bucket setup'
+    );
+
+    const baseCredentials = requireGarageCredentials();
+    const extraBucketName = uniqueBucketName(testInfo, 'manual-add');
+
+    // Connect before the extra bucket is created so it is absent from the initial listing.
+    // In Garage, AllowBucketKey with any permission causes the bucket to appear in ListBuckets,
+    // so we must create the bucket *after* the page has loaded to ensure it is not pre-listed.
+    await connectToStorage(page, baseCredentials);
+    await expect(page).toHaveURL('/storage');
+
+    // Create the extra bucket and grant the base key access now that the page is already loaded.
+    await createGarageBucketCredentials(baseCredentials, {
+      bucketName: extraBucketName,
+      keyName: `manual-${testInfo.project.name}-${crypto.randomUUID()}`,
+      permissions: { owner: false, read: true, write: false },
+      ownerAccessKeyId: baseCredentials.accessKeyId
+    });
+
+    // The extra bucket should not be listed — it was created after the page loaded
+    const bucketLink = page.getByRole('link', { name: extraBucketName, exact: true });
+    await expect(bucketLink.first()).not.toBeVisible();
+
+    // Add it manually
+    await openAddBucketModal(page);
+    await modalBox(page).getByLabel('Bucket name').fill(extraBucketName);
+    await modalBox(page).getByRole('button', { name: 'Connect' }).click();
+
+    // Should navigate into the bucket
+    await expect(page).toHaveURL(`/storage/${encodeURIComponent(extraBucketName)}`);
+
+    // Go back to the bucket grid and confirm the bucket is now shown
+    await page.goto('/storage');
+    await expect(bucketLink.first()).toBeVisible();
+  });
+
+  test('shows access denied error for a bucket without read permission', async ({
+    page
+  }, testInfo) => {
+    test.skip(
+      !hasGarageAdmin(),
+      'Skipped: Garage admin API is unavailable for per-test bucket setup'
+    );
+
+    const baseCredentials = requireGarageCredentials();
+    const blockedBucket = uniqueBucketName(testInfo, 'no-access');
+    const noAccessCredentials = await createGarageBucketCredentials(baseCredentials, {
+      bucketName: blockedBucket,
+      keyName: `noaccess-${testInfo.project.name}-${crypto.randomUUID()}`,
+      permissions: { owner: false, read: false, write: false },
+      ownerAccessKeyId: baseCredentials.accessKeyId
+    });
+
+    await connectToStorage(page, noAccessCredentials);
+    await expect(page).toHaveURL('/storage');
+
+    await openAddBucketModal(page);
+    await modalBox(page).getByLabel('Bucket name').fill(blockedBucket);
+    await modalBox(page).getByRole('button', { name: 'Connect' }).click();
+
+    await expect(modalBox(page).getByRole('alert')).toContainText('Access denied');
+
+    // Modal should remain open
+    await expect(page.getByRole('dialog')).toBeVisible();
+    await expect(page).toHaveURL('/storage');
+  });
+
+  test('shows not found error for a non-existent bucket', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+    await expect(page).toHaveURL('/storage');
+
+    await openAddBucketModal(page);
+    await modalBox(page).getByLabel('Bucket name').fill('this-bucket-does-not-exist-xyz-99999');
+    await modalBox(page).getByRole('button', { name: 'Connect' }).click();
+
+    await expect(modalBox(page).getByRole('alert')).toContainText('Bucket not found');
+
+    // Modal should remain open
+    await expect(page.getByRole('dialog')).toBeVisible();
+    await expect(page).toHaveURL('/storage');
+  });
+
+  test('resets form state after closing and reopening the modal', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectToStorage(page, credentials);
+
+    await openAddBucketModal(page);
+    await modalBox(page).getByLabel('Bucket name').fill('some-value');
+    await page.getByRole('button', { name: 'Cancel' }).click();
+
+    await openAddBucketModal(page);
+    await expect(modalBox(page).getByLabel('Bucket name')).toHaveValue('');
+  });
+});
diff --git a/e2e/support/containers/garage.setup.ts b/e2e/support/containers/garage.setup.ts
index 4cb05618..8b206ba0 100644
--- a/e2e/support/containers/garage.setup.ts
+++ b/e2e/support/containers/garage.setup.ts
@@ -1,6 +1,6 @@
 import path from 'path';
 import { GenericContainer, type StartedTestContainer, Wait } from 'testcontainers';
-import { createGarageBucketCredentials } from '../garage.js';
+import { createGarageBucketCredentials, createGarageHiddenBucket } from '../garage.js';
 
 export async function startGarage(): Promise<StartedTestContainer> {
   const garageStart = Date.now();
@@ -66,4 +66,18 @@ async function setupGarageBucket(garageContainer: StartedTestContainer): Promise
   process.env.S3_TEST_ACCESS_KEY_ID = credentials.accessKeyId;
   process.env.S3_TEST_SECRET_ACCESS_KEY = credentials.secretAccessKey;
   process.env.S3_TEST_BUCKET = 'test-bucket';
+
+  // Hidden bucket: no global alias so it does not appear in S3 ListBuckets,
+  // but the test key has read and write access.
+  const hiddenBucketId = await createGarageHiddenBucket(
+    {
+      endpoint: garageS3Endpoint,
+      region: 'garage',
+      accessKeyId: credentials.accessKeyId,
+      secretAccessKey: credentials.secretAccessKey,
+      bucket: 'test-bucket'
+    },
+    credentials.accessKeyId
+  );
+  process.env.S3_TEST_HIDDEN_BUCKET_ID = hiddenBucketId;
 }
diff --git a/e2e/support/garage.ts b/e2e/support/garage.ts
index 3d4142b0..3e76bcb5 100644
--- a/e2e/support/garage.ts
+++ b/e2e/support/garage.ts
@@ -285,3 +285,46 @@ export async function createGarageBucketCredentials(
     bucket: options.bucketName
   };
 }
+
+/**
+ * Creates a bucket with no global alias (so it is absent from S3 ListBuckets
+ * responses) and grants the given access key read and write — but not owner —
+ * access.  Returns the Garage bucket ID, which is the only handle for the
+ * bucket when it has no alias.
+ */
+export async function createGarageHiddenBucket(
+  baseCredentials: GarageCredentials,
+  accessKeyId: string
+): Promise<string> {
+  const created = await adminPost('/v2/CreateBucket', {});
+  const bucketId = readString(created, ['id', 'bucketId', 'bucket_id']);
+
+  if (!bucketId) {
+    throw new Error('Garage hidden bucket was created without an ID');
+  }
+
+  await adminPost('/v2/AllowBucketKey', {
+    bucketId,
+    accessKeyId,
+    permissions: { owner: false, read: true, write: true }
+  });
+
+  return bucketId;
+}
+
+export function hasHiddenBucketId(): boolean {
+  return Boolean(process.env.S3_TEST_HIDDEN_BUCKET_ID);
+}
+
+export function requireHiddenBucketId(): string {
+  const id = process.env.S3_TEST_HIDDEN_BUCKET_ID;
+
+  if (!id) {
+    throw new Error(
+      'Hidden bucket ID is not available — S3_TEST_HIDDEN_BUCKET_ID is not set. ' +
+        'Run the dev setup or ensure init-garage-s3.sh has run.'
+    );
+  }
+
+  return id;
+}
diff --git a/messages/de.json b/messages/de.json
index 9af002dd..86b8d0dd 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -211,6 +211,16 @@
   "storage_buckets_subtitle": "Durchsuchen und verwalten Sie Ihre gespeicherten Objekte.",
   "storage_view_all_buckets": "Alle Buckets anzeigen",
   "storage_buckets_empty": "Keine Buckets gefunden",
+  "storage_add_bucket": "Bucket hinzufügen",
+  "storage_add_bucket_title": "Mit einem Bucket verbinden",
+  "storage_add_bucket_subtitle": "Geben Sie den Namen eines Buckets ein, auf den Sie Zugriff haben.",
+  "storage_add_bucket_name_label": "Bucket-Name",
+  "storage_add_bucket_name_placeholder": "mein-bucket",
+  "storage_add_bucket_submit": "Verbinden",
+  "storage_add_bucket_cancel": "Abbrechen",
+  "storage_add_bucket_error_access_denied": "Zugriff verweigert — Sie haben keine Berechtigung, diesen Bucket zu lesen.",
+  "storage_add_bucket_error_not_found": "Bucket nicht gefunden — überprüfen Sie den Namen und versuchen Sie es erneut.",
+  "storage_add_bucket_error_unknown": "Verbindung zum Bucket fehlgeschlagen — überprüfen Sie den Namen und versuchen Sie es erneut.",
   "storage_bucket_empty": "Dieser Bucket ist leer",
   "storage_folder": "Ordner",
   "storage_folders": "Ordner",
diff --git a/messages/en.json b/messages/en.json
index 063c6d34..05bade8f 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -211,6 +211,16 @@
   "storage_buckets_subtitle": "Browse and manage your stored objects.",
   "storage_view_all_buckets": "View all buckets",
   "storage_buckets_empty": "No buckets found",
+  "storage_add_bucket": "Add bucket",
+  "storage_add_bucket_title": "Connect to a bucket",
+  "storage_add_bucket_subtitle": "Enter the name of a bucket you have access to.",
+  "storage_add_bucket_name_label": "Bucket name",
+  "storage_add_bucket_name_placeholder": "my-bucket",
+  "storage_add_bucket_submit": "Connect",
+  "storage_add_bucket_cancel": "Cancel",
+  "storage_add_bucket_error_access_denied": "Access denied — you do not have permission to read this bucket.",
+  "storage_add_bucket_error_not_found": "Bucket not found — check the name and try again.",
+  "storage_add_bucket_error_unknown": "Could not connect to this bucket — check the name and try again.",
   "storage_bucket_empty": "This bucket is empty",
   "storage_folder": "folder",
   "storage_folders": "folders",
diff --git a/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
index 59c3f887..a614cbe0 100644
--- a/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
@@ -124,13 +124,18 @@ describe('FileRow', () => {
     expect(spy).toHaveBeenCalledWith('click.txt', false);
   });
 
+  async function dblClickRow(): Promise<void> {
+    const row = page.getByRole('row').element();
+    row.dispatchEvent(new MouseEvent('dblclick', { bubbles: true }));
+  }
+
   it('should call executeAction preview on double click', async () => {
     const file = makeFile({ key: 'dbl.txt', contentType: 'text/plain' });
     const state = createState([file]);
     const spy = vi.spyOn(state, 'executeAction');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick();
+    await dblClickRow();
     expect(spy).toHaveBeenCalledWith('preview');
   });
 
@@ -140,7 +145,7 @@ describe('FileRow', () => {
     const spy = vi.spyOn(state, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick({ force: true });
+    await dblClickRow();
     expect(spy).toHaveBeenCalledWith('archive.zip');
   });
 
@@ -150,7 +155,7 @@ describe('FileRow', () => {
     const spy = vi.spyOn(state, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick({ force: true });
+    await dblClickRow();
     expect(spy).toHaveBeenCalledWith('bundle.tar.gz');
   });
 
@@ -162,7 +167,7 @@ describe('FileRow', () => {
     const spy = vi.spyOn(state, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick({ force: true });
+    await dblClickRow();
     expect(spy).toHaveBeenCalledWith('nested.zip');
   });
 
@@ -174,7 +179,7 @@ describe('FileRow', () => {
     const spy = vi.spyOn(state, 'executeAction');
     render(FileRowWrapper, { state, file });
 
-    await page.getByRole('row').dblClick();
+    await dblClickRow();
     expect(spy).toHaveBeenCalledWith('preview');
   });
 
diff --git a/src/lib/components/storage/landing/AddBucketModal.svelte b/src/lib/components/storage/landing/AddBucketModal.svelte
new file mode 100644
index 00000000..c38e9a82
--- /dev/null
+++ b/src/lib/components/storage/landing/AddBucketModal.svelte
@@ -0,0 +1,148 @@
+<script lang="ts">
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
+  import * as m from '$lib/paraglide/messages.js';
+  import Modal from '$lib/components/Modal.svelte';
+  import { getStorageState } from '$lib/storage/context.js';
+  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+
+  interface Props {
+    open: boolean;
+  }
+
+  let { open = $bindable() }: Props = $props();
+
+  const uid = $props.id();
+  const storage = getStorageState();
+
+  let bucketName = $state('');
+  let submitting = $state(false);
+  let error = $state<'access_denied' | 'not_found' | 'unknown' | null>(null);
+
+  function reset() {
+    bucketName = '';
+    submitting = false;
+    error = null;
+  }
+
+  function handleClose() {
+    open = false;
+  }
+
+  // Reset form state whenever the modal is closed
+  $effect(() => {
+    if (!open) reset();
+  });
+
+  async function handleSubmit(e: SubmitEvent) {
+    e.preventDefault();
+    const name = bucketName.trim();
+    if (!name) return;
+
+    submitting = true;
+    error = null;
+
+    try {
+      const res = await fetch(`/api/storage/check-bucket?bucket=${encodeURIComponent(name)}`, {
+        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionStore.activeConnectionId ?? '' }
+      });
+
+      if (res.ok) {
+        // Persist the bucket to the connection's additionalBuckets
+        await fetch(`/api/storage/connections`, {
+          method: 'PATCH',
+          headers: {
+            [STORAGE_CONNECTION_ID_HEADER]: connectionStore.activeConnectionId ?? '',
+            'Content-Type': 'application/json'
+          },
+          body: JSON.stringify({ bucket: name })
+        });
+
+        // Update local store so the grid reflects the change
+        const activeId = connectionStore.activeConnectionId;
+        if (activeId) {
+          const idx = connectionStore.connections.findIndex((c) => c.id === activeId);
+          if (idx !== -1) {
+            const updated = [...connectionStore.connections];
+            updated[idx] = {
+              ...updated[idx],
+              additionalBuckets: [...updated[idx].additionalBuckets, name]
+            };
+            connectionStore.connections = updated;
+          }
+        }
+
+        storage.addBucket(name);
+        open = false;
+        reset();
+        await goto(
+          resolve('/(app)/storage/[bucket]/[...prefix]', {
+            bucket: encodeURIComponent(name),
+            prefix: ''
+          })
+        );
+      } else if (res.status === 403) {
+        error = 'access_denied';
+      } else if (res.status === 404) {
+        error = 'not_found';
+      } else {
+        error = 'unknown';
+      }
+    } catch {
+      error = 'unknown';
+    } finally {
+      submitting = false;
+    }
+  }
+
+  const errorMessage = $derived(
+    error === 'access_denied'
+      ? m.storage_add_bucket_error_access_denied()
+      : error === 'not_found'
+        ? m.storage_add_bucket_error_not_found()
+        : error === 'unknown'
+          ? m.storage_add_bucket_error_unknown()
+          : null
+  );
+</script>
+
+<Modal bind:open class="modal">
+  <div class="modal-box w-full max-w-sm">
+    <h2 class="mb-1 text-lg font-semibold">{m.storage_add_bucket_title()}</h2>
+    <p class="text-base-content/60 mb-5 text-sm">{m.storage_add_bucket_subtitle()}</p>
+
+    <form onsubmit={handleSubmit} class="flex flex-col gap-4">
+      <div>
+        <label for="{uid}-bucket-name" class="label mb-1 text-sm font-medium">
+          {m.storage_add_bucket_name_label()}
+        </label>
+        <input
+          id="{uid}-bucket-name"
+          type="text"
+          class="input w-full {error ? 'input-error' : ''}"
+          placeholder={m.storage_add_bucket_name_placeholder()}
+          bind:value={bucketName}
+          disabled={submitting}
+          autocomplete="off"
+          spellcheck="false"
+        />
+        {#if errorMessage}
+          <p class="text-error mt-1 text-xs" role="alert">{errorMessage}</p>
+        {/if}
+      </div>
+
+      <div class="modal-action mt-2">
+        <button type="button" class="btn btn-ghost" onclick={handleClose} disabled={submitting}>
+          {m.storage_add_bucket_cancel()}
+        </button>
+        <button type="submit" class="btn btn-primary" disabled={submitting || !bucketName.trim()}>
+          {#if submitting}
+            <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+          {/if}
+          {m.storage_add_bucket_submit()}
+        </button>
+      </div>
+    </form>
+  </div>
+</Modal>
diff --git a/src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts b/src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts
new file mode 100644
index 00000000..cab0f886
--- /dev/null
+++ b/src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts
@@ -0,0 +1,241 @@
+import { page, userEvent } from 'vitest/browser';
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import AddBucketModal from './AddBucketModal.svelte';
+
+// Mock navigation
+const mockGoto = vi.fn();
+vi.mock('$app/navigation', () => ({
+  goto: (...args: unknown[]) => mockGoto(...args)
+}));
+
+vi.mock('$app/paths', () => ({
+  resolve: (_pattern: string, params: Record<string, string>) => `/storage/${params.bucket}`
+}));
+
+// Mock storage context
+const mockAddBucket = vi.fn();
+vi.mock('$lib/storage/context.js', () => ({
+  getStorageState: () => ({ addBucket: mockAddBucket })
+}));
+
+// Mock connection store
+vi.mock('$lib/storage/connection-store.svelte.js', () => ({
+  connectionStore: { activeConnectionId: 'mock-connection-id', connections: [] }
+}));
+
+vi.mock('$lib/storage/connection-id-header.js', () => ({
+  STORAGE_CONNECTION_ID_HEADER: 'x-storage-connection-id'
+}));
+
+// Mock paraglide messages
+vi.mock('$lib/paraglide/messages.js', () => ({
+  storage_add_bucket_title: () => 'Connect to a bucket',
+  storage_add_bucket_subtitle: () => 'Enter the name of a bucket you have access to.',
+  storage_add_bucket_name_label: () => 'Bucket name',
+  storage_add_bucket_name_placeholder: () => 'my-bucket',
+  storage_add_bucket_submit: () => 'Connect',
+  storage_add_bucket_cancel: () => 'Cancel',
+  storage_add_bucket_error_access_denied: () =>
+    'Access denied — you do not have permission to read this bucket.',
+  storage_add_bucket_error_not_found: () => 'Bucket not found — check the name and try again.',
+  storage_add_bucket_error_unknown: () =>
+    'Could not connect to this bucket — check the name and try again.'
+}));
+
+describe('AddBucketModal', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  describe('rendering', () => {
+    it('should render the dialog when open', async () => {
+      render(AddBucketModal, { open: true });
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('heading', { name: 'Connect to a bucket' }))
+        .toBeInTheDocument();
+      await expect
+        .element(page.getByText('Enter the name of a bucket you have access to.'))
+        .toBeInTheDocument();
+    });
+
+    it('should not render the dialog when closed', async () => {
+      render(AddBucketModal, { open: false });
+
+      await expect.element(page.getByRole('dialog')).not.toBeInTheDocument();
+    });
+
+    it('should render the bucket name input', async () => {
+      render(AddBucketModal, { open: true });
+
+      await expect.element(page.getByLabelText('Bucket name')).toBeInTheDocument();
+      await expect.element(page.getByPlaceholder('my-bucket')).toBeInTheDocument();
+    });
+
+    it('should render Cancel and Connect buttons', async () => {
+      render(AddBucketModal, { open: true });
+
+      await expect.element(page.getByRole('button', { name: 'Cancel' })).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: 'Connect' })).toBeInTheDocument();
+    });
+
+    it('should have Connect button disabled when input is empty', async () => {
+      render(AddBucketModal, { open: true });
+
+      await expect.element(page.getByRole('button', { name: 'Connect' })).toBeDisabled();
+    });
+
+    it('should enable Connect button when input has a value', async () => {
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'my-bucket');
+
+      await expect.element(page.getByRole('button', { name: 'Connect' })).not.toBeDisabled();
+    });
+  });
+
+  describe('successful connection', () => {
+    it('should call addBucket and navigate on 204 response', async () => {
+      vi.mocked(fetch)
+        .mockResolvedValueOnce({ ok: true, status: 204 } as Response)
+        .mockResolvedValueOnce({ ok: true } as Response);
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'my-bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect.poll(() => mockAddBucket).toHaveBeenCalledWith('my-bucket');
+      await expect.poll(() => mockGoto).toHaveBeenCalledWith('/storage/my-bucket');
+    });
+
+    it('should URL-encode the bucket name in the check request', async () => {
+      vi.mocked(fetch)
+        .mockResolvedValueOnce({ ok: true, status: 204 } as Response)
+        .mockResolvedValueOnce({ ok: true } as Response);
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'my bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect
+        .poll(() => fetch)
+        .toHaveBeenCalledWith('/api/storage/check-bucket?bucket=my%20bucket', {
+          headers: { 'x-storage-connection-id': 'mock-connection-id' }
+        });
+    });
+  });
+
+  describe('error handling', () => {
+    it('should show access denied error on 403', async () => {
+      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 403 } as Response);
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'locked-bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect
+        .element(page.getByRole('alert'))
+        .toHaveTextContent('Access denied — you do not have permission to read this bucket.');
+    });
+
+    it('should show not found error on 404', async () => {
+      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 404 } as Response);
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'missing-bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect
+        .element(page.getByRole('alert'))
+        .toHaveTextContent('Bucket not found — check the name and try again.');
+    });
+
+    it('should show generic error on 502', async () => {
+      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 502 } as Response);
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'bad-bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect
+        .element(page.getByRole('alert'))
+        .toHaveTextContent('Could not connect to this bucket — check the name and try again.');
+    });
+
+    it('should show generic error on network failure', async () => {
+      vi.mocked(fetch).mockRejectedValue(new Error('Network error'));
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'unreachable-bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect
+        .element(page.getByRole('alert'))
+        .toHaveTextContent('Could not connect to this bucket — check the name and try again.');
+    });
+
+    it('should not navigate or add bucket on error', async () => {
+      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 403 } as Response);
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'locked-bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect.poll(() => page.getByRole('alert')).toBeInTheDocument();
+      expect(mockAddBucket).not.toHaveBeenCalled();
+      expect(mockGoto).not.toHaveBeenCalled();
+    });
+
+    it('should clear error when user types a new bucket name', async () => {
+      vi.mocked(fetch)
+        .mockResolvedValueOnce({ ok: false, status: 404 } as Response)
+        .mockResolvedValueOnce({ ok: true, status: 204 } as Response)
+        .mockResolvedValueOnce({ ok: true } as Response);
+
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'missing');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+      await expect.element(page.getByRole('alert')).toBeInTheDocument();
+
+      await userEvent.clear(page.getByLabelText('Bucket name'));
+      await userEvent.type(page.getByLabelText('Bucket name'), 'good-bucket');
+      await userEvent.click(page.getByRole('button', { name: 'Connect' }));
+
+      await expect.element(page.getByRole('alert')).not.toBeInTheDocument();
+    });
+  });
+
+  describe('cancel', () => {
+    it('should close the dialog when Cancel is clicked', async () => {
+      render(AddBucketModal, { open: true });
+
+      await expect.element(page.getByRole('dialog')).toBeInTheDocument();
+
+      await userEvent.click(page.getByRole('button', { name: 'Cancel' }));
+
+      await expect.element(page.getByRole('dialog')).not.toBeInTheDocument();
+    });
+
+    it('should reset the input when Cancel is clicked', async () => {
+      render(AddBucketModal, { open: true });
+
+      await userEvent.type(page.getByLabelText('Bucket name'), 'some-value');
+      await userEvent.click(page.getByRole('button', { name: 'Cancel' }));
+
+      // Re-open
+      render(AddBucketModal, { open: true });
+      await expect.element(page.getByLabelText('Bucket name')).toHaveValue('');
+    });
+  });
+});
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte b/src/lib/components/storage/landing/BucketGrid.svelte
index 17f93105..01a29245 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte
+++ b/src/lib/components/storage/landing/BucketGrid.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import IconBucket from '../shared/BucketIcon.svelte';
+  import Tooltip from '$lib/components/Tooltip.svelte';
   import IconInfo from 'virtual:icons/material-symbols/info';
   import * as m from '$lib/paraglide/messages.js';
   import { resolve } from '$app/paths';
@@ -11,6 +12,10 @@
   }
 
   let { buckets = [] }: Props = $props();
+
+  let tooltipText = $state<string | null>(null);
+  let tooltipX = $state(0);
+  let tooltipY = $state(0);
   const storage = getStorageState();
 
   let ctxMenu = $state<{ x: number; y: number; bucket: string } | null>(null);
@@ -56,26 +61,34 @@
     "
   >
     {#each buckets as bucket (bucket)}
-      <div class="tooltip tooltip-bottom" data-tip={bucket}>
-        <a
-          href={resolve('/(app)/storage/[bucket]/[...prefix]', {
-            bucket: encodeURIComponent(bucket),
-            prefix: ''
-          })}
-          data-sveltekit-preload-data="off"
-          class="
-              border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 flex flex-col items-center
-              gap-2 rounded-xl border p-4
-              text-center transition-colors
-            "
-          oncontextmenu={(e) => handleContextMenu(e, bucket)}
-        >
-          <IconBucket class="text-warning size-10" aria-hidden="true" />
-          <span class="w-full truncate text-sm font-medium">{bucket}</span>
-        </a>
-      </div>
+      <a
+        href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+          bucket: encodeURIComponent(bucket),
+          prefix: ''
+        })}
+        data-sveltekit-preload-data="off"
+        class="
+            border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 flex flex-col items-center
+            gap-2 rounded-xl border p-4
+            text-center transition-colors
+          "
+        oncontextmenu={(e) => handleContextMenu(e, bucket)}
+        onmouseenter={(e) => {
+          const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+          tooltipText = bucket;
+          tooltipX = rect.left + rect.width / 2;
+          tooltipY = rect.bottom;
+        }}
+        onmouseleave={() => {
+          tooltipText = null;
+        }}
+      >
+        <IconBucket class="text-warning size-10" aria-hidden="true" />
+        <span class="w-full truncate text-sm font-medium">{bucket}</span>
+      </a>
     {/each}
   </div>
+  <Tooltip text={tooltipText} x={tooltipX} y={tooltipY} orientation="down" />
 {:else}
   <p class="text-base-content/50 text-sm">{m.storage_buckets_empty()}</p>
 {/if}
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
index 851e3a5b..edaf0240 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
+++ b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
@@ -63,8 +63,10 @@ describe('BucketGrid', () => {
     const buckets = ['tooltip-bucket'];
     render(BucketGridWrapper, { state: createState(), buckets });
 
-    const tooltip = page.getByText('tooltip-bucket').element().closest('[data-tip]');
-    expect(tooltip?.getAttribute('data-tip')).toBe('tooltip-bucket');
+    await page.getByRole('link', { name: 'tooltip-bucket' }).hover();
+
+    const tooltip = page.getByRole('tooltip');
+    await expect.element(tooltip).toHaveTextContent('tooltip-bucket');
   });
 
   it('should render a large number of buckets', async () => {
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index c400fd6a..8bd7fe03 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -252,6 +252,13 @@ export class StorageState {
     this.archiveTooLarge = false;
   }
 
+  /** Add a bucket to the in-memory list (no server-side persistence). */
+  addBucket(name: string): void {
+    if (!this.buckets.includes(name)) {
+      this.buckets = [...this.buckets, name];
+    }
+  }
+
   setNavigationHandler(fn: NavigateFn): void {
     this._onNavigate = fn;
   }
diff --git a/src/routes/(app)/api/storage/check-bucket/+server.ts b/src/routes/(app)/api/storage/check-bucket/+server.ts
new file mode 100644
index 00000000..3d5202b2
--- /dev/null
+++ b/src/routes/(app)/api/storage/check-bucket/+server.ts
@@ -0,0 +1,22 @@
+import { error, isHttpError } from '@sveltejs/kit';
+import { getProvider } from '$lib/server/storage/utils.js';
+import { requireBucket } from '../params.js';
+import type { RequestHandler } from './$types';
+
+export const GET: RequestHandler = async ({ url, locals }) => {
+  const log = locals.logger;
+  const bucket = requireBucket(url);
+
+  try {
+    await getProvider(locals.storageConfig!, bucket).listObjects('', 1);
+    log.debug({ bucket }, 'bucket access check passed');
+    return new Response(null, { status: 204 });
+  } catch (err) {
+    if (isHttpError(err)) {
+      log.info({ bucket, status: err.status }, 'bucket access check failed');
+      throw err;
+    }
+    log.warn({ err, bucket }, 'unexpected error during bucket access check');
+    throw error(502, 'Could not reach bucket');
+  }
+};
diff --git a/src/routes/(app)/api/storage/check-bucket/server.test.ts b/src/routes/(app)/api/storage/check-bucket/server.test.ts
new file mode 100644
index 00000000..c68988e6
--- /dev/null
+++ b/src/routes/(app)/api/storage/check-bucket/server.test.ts
@@ -0,0 +1,62 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockListObjects = vi.fn();
+
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: vi.fn(() => ({ listObjects: mockListObjects }))
+}));
+
+import { GET } from './+server.js';
+import { error } from '@sveltejs/kit';
+
+function mockEvent(params: string) {
+  const url = new URL(`http://localhost/api/storage/check-bucket?${params}`);
+  return {
+    url,
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      storageConfig: { type: 's3', host: 'localhost' }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /api/storage/check-bucket', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('throws 400 when bucket is missing', async () => {
+    await expect(GET(mockEvent(''))).rejects.toThrow(expect.objectContaining({ status: 400 }));
+  });
+
+  it('returns 204 when bucket is accessible', async () => {
+    mockListObjects.mockResolvedValue({ items: [], continuationToken: undefined });
+
+    const res = await GET(mockEvent('bucket=my-bucket'));
+
+    expect(mockListObjects).toHaveBeenCalledWith('', 1);
+    expect(res.status).toBe(204);
+  });
+
+  it('re-throws 404 HttpError when bucket is not found', async () => {
+    mockListObjects.mockImplementation(() => {
+      error(404, 'Bucket not found');
+    });
+
+    await expect(GET(mockEvent('bucket=missing-bucket'))).rejects.toMatchObject({ status: 404 });
+  });
+
+  it('re-throws 403 HttpError when access is denied', async () => {
+    mockListObjects.mockImplementation(() => {
+      error(403, 'Access denied');
+    });
+
+    await expect(GET(mockEvent('bucket=secret-bucket'))).rejects.toMatchObject({ status: 403 });
+  });
+
+  it('throws 502 for unexpected errors', async () => {
+    mockListObjects.mockRejectedValue(new Error('network failure'));
+
+    await expect(GET(mockEvent('bucket=my-bucket'))).rejects.toThrow(
+      expect.objectContaining({ status: 502 })
+    );
+  });
+});
diff --git a/src/routes/(app)/api/storage/connections/+server.ts b/src/routes/(app)/api/storage/connections/+server.ts
index 08b150e7..a71beb93 100644
--- a/src/routes/(app)/api/storage/connections/+server.ts
+++ b/src/routes/(app)/api/storage/connections/+server.ts
@@ -1,6 +1,8 @@
-import { desc, eq } from 'drizzle-orm';
+import { desc, eq, and } from 'drizzle-orm';
+import { json } from '@sveltejs/kit';
 import { db } from '$lib/server/db.js';
 import { userStorageConnections } from '$lib/server/schema.js';
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 import type { RequestHandler } from './$types';
 
 /**
@@ -55,3 +57,53 @@ export const GET: RequestHandler = async ({ locals }) => {
   locals.logger.debug({ connection_count: connections.length }, 'connections list returned');
   return Response.json(connections);
 };
+
+/**
+ * PATCH /api/storage/connections
+ *
+ * Adds a bucket to the active connection's `additionalBuckets` list.
+ * Requires the `x-storage-connection-id` header. The bucket is only added
+ * if the caller has already verified access (e.g. via check-bucket).
+ */
+export const PATCH: RequestHandler = async ({ request, locals }) => {
+  const userId = locals.user!.id;
+  const connectionId = request.headers.get(STORAGE_CONNECTION_ID_HEADER);
+  if (!connectionId) {
+    return json({ error: 'Missing storage connection ID' }, { status: 400 });
+  }
+
+  const body = (await request.json()) as { bucket?: string };
+  const bucket = body.bucket?.trim();
+  if (!bucket) {
+    return json({ error: 'Bucket name is required' }, { status: 400 });
+  }
+
+  const rows = await db
+    .select({
+      id: userStorageConnections.id,
+      additionalBuckets: userStorageConnections.additionalBuckets
+    })
+    .from(userStorageConnections)
+    .where(
+      and(eq(userStorageConnections.id, connectionId), eq(userStorageConnections.userId, userId))
+    )
+    .limit(1);
+
+  if (rows.length === 0) {
+    return json({ error: 'Connection not found' }, { status: 404 });
+  }
+
+  const existing = (rows[0].additionalBuckets as string[]) ?? [];
+  if (existing.includes(bucket)) {
+    return json({ ok: true });
+  }
+
+  const updated = [...existing, bucket];
+  await db
+    .update(userStorageConnections)
+    .set({ additionalBuckets: updated, updatedAt: new Date() })
+    .where(eq(userStorageConnections.id, connectionId));
+
+  locals.logger.info({ connection_id: connectionId, bucket }, 'bucket added to connection');
+  return json({ ok: true });
+};
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 0ff9f5e4..f8b86659 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -15,16 +15,18 @@
   import BucketGrid from '$lib/components/storage/landing/BucketGrid.svelte';
   import StorageConnectForm from '$lib/components/storage/landing/StorageConnectForm.svelte';
   import RecentItems from '$lib/components/storage/landing/RecentItems.svelte';
+  import AddBucketModal from '$lib/components/storage/landing/AddBucketModal.svelte';
+  import IconAdd from 'virtual:icons/material-symbols/add';
 
   let { data } = $props();
   const storage = getStorageState();
 
+  let addBucketOpen = $state(false);
+
   const connectError = $derived<string | null>(
     (page.form as { error?: string } | null)?.error ?? null
   );
 
-  // ── Restore-tabs banner ───────────────────────────────────────────────────
-
   let savedTabs = $state<PersistedTabsState | null>(null);
 
   $effect(() => {
@@ -35,8 +37,6 @@
       if (!raw) return;
       const parsed = JSON.parse(raw) as PersistedTabsState;
       if (!Array.isArray(parsed?.tabs) || parsed.tabs.length <= 1) return;
-      // If the saved data carries a connectionId that differs from the current
-      // connection, do not offer restore (tabs are from a different connection).
       if (
         parsed.connectionId &&
         storage.connectionId &&
@@ -89,7 +89,6 @@
         <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
       </div>
     {/if}
-
     {#if savedTabs}
       <div
         role="alert"
@@ -112,14 +111,27 @@
       </div>
     {/if}
 
-    <h1 class="mb-1 text-xl font-semibold">{m.storage_buckets_label()}</h1>
-
-    <p class="text-base-content/60 mb-6 text-sm">{m.storage_buckets_subtitle()}</p>
+    <div class="mb-6">
+      <div class="mb-1 flex items-center justify-between gap-4">
+        <h1 class="text-xl font-semibold">{m.storage_buckets_label()}</h1>
+        <button
+          type="button"
+          class="btn btn-primary btn-sm shrink-0"
+          onclick={() => (addBucketOpen = true)}
+          aria-label={m.storage_add_bucket()}
+        >
+          <IconAdd class="size-4" aria-hidden="true" />
+          {m.storage_add_bucket()}
+        </button>
+      </div>
+      <p class="text-base-content/60 text-sm">{m.storage_buckets_subtitle()}</p>
+    </div>
     <BucketGrid buckets={storage.buckets} />
   </div>
   <div class="relative flex h-full min-h-0 flex-col overflow-y-auto p-2">
     <RecentItems />
   </div>
+  <AddBucketModal bind:open={addBucketOpen} />
 {:else if mounted}
   <StorageConnectForm
     connectionForm={data.connectionForm}

From 69684f4847bd999380f08fcffb287ac9c48aad74 Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 22 Jul 2026 10:06:47 +0200
Subject: [PATCH 113/136] Refactor v1 (#247)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* feat: implement manual bucket connection feature with UI and API support

* test: add unit tests for bucket access check API

* test: update add bucket tests to ensure correct bucket visibility after creation

* fix: artifacts from merge

* fix: tests

* feat: implement manual bucket connection and update connection store

* add hidden bucket to garage setup

* fix tooltip on bucket grid

* fix: improve tooltip functionality for bucket names in BucketGrid tests

* fix vertical alignment of add bucket button

* fix: update tooltip hover interaction to use role-based selector

* refactor: extract triplicated NDJSON streaming reader into shared module

Create src/lib/storage/ndjson-stream.ts with a readNdjsonStream helper
that encapsulates the buffered-reader + NDJSON parsing + event dispatch
loop. Replaces three inline copies (performPasteSequential, confirmMove,
_executeMoveWithConflicts) in state.svelte.ts, reducing it by ~170 lines.

* refactor: merge copy/move server endpoints into shared performCopyOrMove()

Merge the ~90% identical copy and move POST handlers into a single performCopyOrMove() function in src/lib/server/storage/copy-move.ts. Both route handlers are now thin ~35-line adapters that delegate to the shared function with a deleteOriginals flag.

* refactor: collapse three parallel error hierarchies into StorageError

Merge ActionError, UploadError, and DownloadError into a single
StorageError class with a unified StorageErrorCode type. Remove the
DownloadError -> ActionError bridging ceremony in state.svelte.ts.

* chore: add test:e2e:desktop script to run E2E without mobile project

* refactor: delete shallow service.ts pass-through and inline calls

service.ts was a 34-line pass-through that just called getProvider()
and delegated to the provider. Remove the indirection and call the
provider directly in all 4 endpoint files.

* refactor: consolidate over-fragmented client storage modules

Merge 4 tiny files into 2:
- tabs-context.ts → merged into context.ts
- connection-storage.ts → merged into connection-id-header.ts
Update the 7 import paths that referenced the deleted files.

* refactor: extract processKeysSequentially into operations.ts

The copy/move file-processing loop was duplicated in both the
streaming and non-streaming paths of performCopyOrMove(). Extract
it as a shared function in operations.ts with lifecycle callbacks
for progress events, success, failure, and originals deletion.

* fix: preserve empty prefix in storage middleware

Empty string prefix was coerced to undefined by || operator,
causing bucket root listings to return 204 instead of object data.
Changed to ?? to preserve empty strings while still handling null.

* refactor: consolidate storage API into unified /api/storage/data endpoint

- Add shared _middleware.ts for parameter parsing and provider resolution
- Create unified data/+server.ts handling objects, details, rename, delete, create, save-text, check-bucket
- Delete individual endpoints: objects, details, directory-metadata, bucket-details, check-bucket, create, delete, rename, save-text
- Delete params.ts and its tests (functionality absorbed by middleware)
- Extract directory-tree.ts to lib/server/storage for reuse
- Update all client callers (state.svelte.ts, modals, page.ts) to use new endpoints
- Preserve empty prefix coercion fix (|| → ??) for bucket root listings

* refactor: extract typed StorageApi interface for storage operations

Introduce a centralised StorageApi interface with createFetchStorageApi()
factory, abstracting HTTP transport behind typed methods. Refactor
StorageState and components to use the new API instead of inline fetch
calls. Add createMemoryStorageApi() test utility and corresponding specs.

* refactor: extract clipboard, archive, and operations from StorageState

- Extract clipboard paste/move/conflict logic into ClipboardState (clipboard.svelte.ts)
- Extract archive state management into ArchiveState (archive.svelte.ts)
- Extract operation tracking into OperationsState (operations.svelte.ts)
- Rename ClipboardState interface to ClipboardData to avoid naming conflict
- Fix DaisyUI v5 classes: input-bordered→input, select-bordered→select, rounded-btn→rounded-md
- Use Map instead of object literal for mime-type map in archive extract
- Add resolveRoute import for connection edit page navigation
- Suppress eslint warnings for object-injection in array-indexed access

* test: update storage bucket page tests to expect activeConnectionId

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 e2e/i18n.spec.ts                              |    1 +
 e2e/storage/archive.spec.ts                   |    1 +
 e2e/support/garage.ts                         |    3 +
 eslint.config.js                              |   18 +-
 package.json                                  |    1 +
 .../components/layout/header/UserMenu.svelte  |    4 +-
 .../components/layout/sidebar/Sidebar.svelte  |    5 +-
 .../storage/explorer/ContextMenu.svelte       |   34 +-
 .../storage/explorer/FileExplorer.svelte      |    4 +-
 .../storage/explorer/FileRow.svelte           |    4 +-
 .../storage/explorer/FolderRow.svelte         |   10 +-
 .../storage/explorer/ObjectTable.svelte       |   10 +-
 .../storage/explorer/SelectionToolbar.svelte  |    2 +-
 .../storage/explorer/StorageBreadcrumb.svelte |   56 +-
 .../explorer/__tests__/FileRow.svelte.spec.ts |   14 +-
 .../StorageBreadcrumb.svelte.spec.ts          |   27 +-
 .../__tests__/StorageBreadcrumbWrapper.svelte |    2 +-
 .../explorer/__tests__/TabBarWrapper.svelte   |    2 +-
 .../storage/landing/AddBucketModal.svelte     |   20 +-
 .../landing/AddBucketModal.svelte.spec.ts     |   60 +-
 .../storage/landing/RecentItems.svelte        |   27 +-
 .../storage/landing/StorageConnectForm.svelte |   19 +-
 .../storage/modals/CreateModal.svelte         |    2 +-
 .../modals/DeleteConnectionModal.svelte       |    2 +-
 .../storage/modals/DetailsModal.svelte        |   27 +-
 .../PreviewModal.complex.svelte.spec.ts       |   18 +
 .../PreviewModal.preview.svelte.spec.ts       |   17 +
 .../storage/modals/PreviewModal.svelte        |  130 +-
 .../modals/PreviewModal.svelte.spec.ts        |   17 +
 .../storage/modals/RenameModal.svelte         |    2 +-
 .../modals/StorageModals.svelte.spec.ts       |    9 +-
 .../modals/details/BucketDetails.svelte       |   29 +-
 .../modals/details/DirectoryDetails.svelte    |   41 +-
 .../modals/preview/PdfPreview.svelte.spec.ts  |    1 +
 .../storage/modals/upload/UploadModal.svelte  |    7 +-
 .../modals/upload/UploadModal.svelte.spec.ts  |   31 +-
 .../sidebar/StorageConnectionSidebar.svelte   |    2 +-
 .../components/trino/StatementResult.svelte   |    2 +
 .../editor/completion/completion-history.ts   |    6 +
 src/lib/editor/completion/cursor-context.ts   |   14 +
 src/lib/editor/completion/grammar-analysis.ts |    2 +
 src/lib/editor/lexer-utils.test.ts            |    4 +
 src/lib/editor/lexer-utils.ts                 |    5 +
 src/lib/editor/split-statements.ts            |    3 +
 src/lib/server/auth.ts                        |    1 +
 src/lib/server/storage/archive.test.ts        |    5 +
 src/lib/server/storage/archive.ts             |   12 +
 src/lib/server/storage/copy-move.ts           |   96 +
 src/lib/server/storage/directory-tree.ts      |  104 +
 src/lib/server/storage/operations.ts          |  121 ++
 src/lib/server/storage/preview/csv.ts         |    6 +
 .../server/storage/preview/parquet.test.ts    |    2 +
 src/lib/server/storage/request-context.ts     |   26 +
 src/lib/server/storage/service.ts             |   34 -
 src/lib/server/storage/wrap-provider.ts       |   28 +
 src/lib/server/trino/client.ts                |    1 +
 src/lib/server/trino/queries.ts               |    1 +
 src/lib/storage/api.spec.ts                   |  543 +++++
 src/lib/storage/api.test-utils.ts             |  106 +
 src/lib/storage/api.ts                        |  326 +++
 src/lib/storage/archive.svelte.spec.ts        |  655 ++++++
 src/lib/storage/archive.svelte.ts             |  288 +++
 src/lib/storage/clipboard.svelte.ts           |  991 +++++++++
 src/lib/storage/connection-id-header.ts       |   10 +
 src/lib/storage/connection-storage.ts         |    9 -
 src/lib/storage/context.ts                    |    2 +
 src/lib/storage/download.ts                   |   52 +-
 src/lib/storage/drag-handlers.ts              |    8 +-
 src/lib/storage/errors.ts                     |   29 +-
 src/lib/storage/ndjson-stream.ts              |  136 ++
 src/lib/storage/operations.svelte.spec.ts     |  751 +++++++
 src/lib/storage/operations.svelte.ts          |  239 +++
 src/lib/storage/state.svelte.spec.ts          |  347 ++--
 src/lib/storage/state.svelte.ts               | 1831 ++---------------
 src/lib/storage/storage-fetch.spec.ts         |  198 ++
 src/lib/storage/storage-fetch.ts              |   62 +
 src/lib/storage/tabs-context.ts               |    4 -
 src/lib/storage/tabs.svelte.ts                |   39 +-
 src/lib/storage/types.ts                      |    2 +-
 src/lib/storage/upload.ts                     |   69 +-
 src/lib/stores/tab-store.svelte.ts            |    1 +
 .../api/storage/archive/extract/+server.ts    |   65 +-
 .../api/storage/archive/listing/+server.ts    |   13 +-
 .../api/storage/bucket-details/+server.ts     |   29 -
 .../api/storage/bucket-details/server.test.ts |  112 -
 .../(app)/api/storage/buckets/+server.ts      |   64 +-
 .../(app)/api/storage/buckets/server.test.ts  |  158 ++
 .../(app)/api/storage/check-bucket/+server.ts |   25 +-
 .../api/storage/check-bucket/server.test.ts   |    7 +-
 src/routes/(app)/api/storage/copy/+server.ts  |  136 +-
 .../(app)/api/storage/create/+server.ts       |   24 +-
 .../(app)/api/storage/create/server.test.ts   |   71 +
 .../(app)/api/storage/delete/+server.ts       |   32 +-
 .../(app)/api/storage/delete/server.test.ts   |    2 +-
 .../(app)/api/storage/details/+server.ts      |   18 +-
 .../(app)/api/storage/details/server.test.ts  |    2 +-
 .../api/storage/directory-metadata/+server.ts |   28 +-
 .../storage/directory-metadata/server.test.ts |    2 +-
 .../api/storage/directory-size/+server.ts     |  131 +-
 .../(app)/api/storage/download/+server.ts     |   28 +-
 .../(app)/api/storage/download/server.test.ts |    2 +-
 src/routes/(app)/api/storage/list/+server.ts  |   31 +
 .../(app)/api/storage/list/server.test.ts     |   82 +
 src/routes/(app)/api/storage/move/+server.ts  |  149 +-
 .../(app)/api/storage/objects/+server.ts      |   35 -
 src/routes/(app)/api/storage/params.test.ts   |   48 -
 src/routes/(app)/api/storage/params.ts        |   28 -
 .../(app)/api/storage/preview/+server.ts      |   13 +-
 .../(app)/api/storage/preview/server.test.ts  |    6 +-
 .../(app)/api/storage/rename/+server.ts       |   94 +-
 .../(app)/api/storage/rename/server.test.ts   |  105 +
 .../(app)/api/storage/save-text/+server.ts    |   58 +-
 .../api/storage/save-text/server.test.ts      |  143 ++
 .../(app)/api/storage/upload/+server.ts       |   17 +-
 .../(app)/api/storage/upload/server.test.ts   |    2 +-
 src/routes/(app)/storage/+layout.svelte       |    6 +-
 .../[bucket]/[...prefix]/+page.server.ts      |    2 +-
 .../storage/[bucket]/[...prefix]/+page.ts     |    4 +-
 .../[bucket]/[...prefix]/page.server.test.ts  |   10 +-
 .../(app)/storage/connections/+page.svelte    |    2 +-
 .../connections/[id]/edit/+page.svelte        |   19 +-
 src/routes/(app)/trino/+page.svelte           |    6 +-
 src/routes/(app)/trino/query-runner.svelte.ts |    1 +
 123 files changed, 6403 insertions(+), 3237 deletions(-)
 create mode 100644 src/lib/server/storage/copy-move.ts
 create mode 100644 src/lib/server/storage/directory-tree.ts
 create mode 100644 src/lib/server/storage/request-context.ts
 delete mode 100644 src/lib/server/storage/service.ts
 create mode 100644 src/lib/server/storage/wrap-provider.ts
 create mode 100644 src/lib/storage/api.spec.ts
 create mode 100644 src/lib/storage/api.test-utils.ts
 create mode 100644 src/lib/storage/api.ts
 create mode 100644 src/lib/storage/archive.svelte.spec.ts
 create mode 100644 src/lib/storage/archive.svelte.ts
 create mode 100644 src/lib/storage/clipboard.svelte.ts
 delete mode 100644 src/lib/storage/connection-storage.ts
 create mode 100644 src/lib/storage/ndjson-stream.ts
 create mode 100644 src/lib/storage/operations.svelte.spec.ts
 create mode 100644 src/lib/storage/operations.svelte.ts
 create mode 100644 src/lib/storage/storage-fetch.spec.ts
 create mode 100644 src/lib/storage/storage-fetch.ts
 delete mode 100644 src/lib/storage/tabs-context.ts
 delete mode 100644 src/routes/(app)/api/storage/bucket-details/+server.ts
 delete mode 100644 src/routes/(app)/api/storage/bucket-details/server.test.ts
 create mode 100644 src/routes/(app)/api/storage/buckets/server.test.ts
 create mode 100644 src/routes/(app)/api/storage/create/server.test.ts
 create mode 100644 src/routes/(app)/api/storage/list/+server.ts
 create mode 100644 src/routes/(app)/api/storage/list/server.test.ts
 delete mode 100644 src/routes/(app)/api/storage/objects/+server.ts
 delete mode 100644 src/routes/(app)/api/storage/params.test.ts
 delete mode 100644 src/routes/(app)/api/storage/params.ts
 create mode 100644 src/routes/(app)/api/storage/rename/server.test.ts
 create mode 100644 src/routes/(app)/api/storage/save-text/server.test.ts

diff --git a/e2e/i18n.spec.ts b/e2e/i18n.spec.ts
index 4fc51a85..559c777b 100644
--- a/e2e/i18n.spec.ts
+++ b/e2e/i18n.spec.ts
@@ -6,6 +6,7 @@ import { waitForHydration } from './support/helpers';
 /** Load the saved auth storage state, optionally stripping the locale cookie. */
 function loadAuthState(projectName: string, { withoutLocale = false } = {}) {
   const authFile = path.join(import.meta.dirname, `.auth/user-setup-${projectName}.json`);
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
   const state = JSON.parse(fs.readFileSync(authFile, 'utf-8'));
   if (withoutLocale) {
     state.cookies = state.cookies.filter((c: { name: string }) => c.name !== 'PARAGLIDE_LOCALE');
diff --git a/e2e/storage/archive.spec.ts b/e2e/storage/archive.spec.ts
index f756623e..a363c469 100644
--- a/e2e/storage/archive.spec.ts
+++ b/e2e/storage/archive.spec.ts
@@ -169,6 +169,7 @@ test.describe('Storage S3 — Archive preview', () => {
       await waitForObjectsLoaded(page);
 
       // Should be at the bucket root (archive exited)
+      // eslint-disable-next-line security/detect-non-literal-regexp
       await expect(page).toHaveURL(new RegExp(`/storage/${credentials.bucket}(\\?|$)`));
       await expect(page.getByText('archive.zip')).not.toBeVisible();
     } finally {
diff --git a/e2e/support/garage.ts b/e2e/support/garage.ts
index 3e76bcb5..e778a4bc 100644
--- a/e2e/support/garage.ts
+++ b/e2e/support/garage.ts
@@ -37,6 +37,7 @@ function readString(value: unknown, keys: string[]): string | null {
   }
 
   for (const key of keys) {
+    // eslint-disable-next-line security/detect-object-injection
     const candidate = record[key];
     if (typeof candidate === 'string' && candidate.length > 0) {
       return candidate;
@@ -53,6 +54,7 @@ function readStringArray(value: unknown, keys: string[]): string[] {
   }
 
   for (const key of keys) {
+    // eslint-disable-next-line security/detect-object-injection
     const candidate = record[key];
     if (Array.isArray(candidate)) {
       return candidate.filter((item): item is string => typeof item === 'string');
@@ -73,6 +75,7 @@ function extractAdminList(value: unknown): JsonRecord[] {
   }
 
   for (const key of ADMIN_LIST_KEYS) {
+    // eslint-disable-next-line security/detect-object-injection
     const candidate = record[key];
     if (Array.isArray(candidate)) {
       return candidate
diff --git a/eslint.config.js b/eslint.config.js
index d1f92c1d..543938a6 100644
--- a/eslint.config.js
+++ b/eslint.config.js
@@ -49,7 +49,23 @@ export default ts.config(
       }
     },
     rules: {
-      'better-tailwindcss/no-unknown-classes': ['warn', { detectComponentClasses: true }]
+      'better-tailwindcss/no-unknown-classes': [
+        'warn',
+        {
+          detectComponentClasses: true,
+          ignore: [
+            'dropdown-content',
+            'dropdown-open',
+            'swap-on',
+            'swap-off',
+            'label-text',
+            'menu-disabled',
+            'tab-active',
+            'tab-strip',
+            'preview-scroll'
+          ]
+        }
+      ]
     }
   }
 );
diff --git a/package.json b/package.json
index cd818f99..ed81f820 100644
--- a/package.json
+++ b/package.json
@@ -16,6 +16,7 @@
     "lint:fix": "prettier --write --ignore-path .prettierignore . && eslint . --fix && npm run check",
     "test:unit": "vitest run",
     "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && npx tsx e2e/support/run-e2e.ts",
+    "test:e2e:desktop": "node --env-file=.env.test node_modules/.bin/vite build && npx tsx e2e/support/run-e2e.ts --project=chromium --project=firefox",
     "test:e2e:ui": "playwright test --ui",
     "generate:antlr": "cd src/lib/editor/grammar && antlr-ng -v -l -Dlanguage=TypeScript -o ../generated SqlBase.g4 && node patch-generated.mjs",
     "db:generate": "drizzle-kit generate",
diff --git a/src/lib/components/layout/header/UserMenu.svelte b/src/lib/components/layout/header/UserMenu.svelte
index 0641b735..940dd67f 100644
--- a/src/lib/components/layout/header/UserMenu.svelte
+++ b/src/lib/components/layout/header/UserMenu.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { resolveRoute } from '$app/paths';
   import * as m from '$lib/paraglide/messages.js';
   import IconLogout from 'virtual:icons/material-symbols/logout';
   import type { User } from '$lib/types/auth.js';
@@ -41,7 +42,8 @@
     </li>
     <li><hr class="border-base-300 my-1" /></li>
     <li class="mt-4">
-      <a href="/auth/logout" class="text-sm">
+      <!-- eslint-disable-next-line svelte/no-navigation-without-resolve -->
+      <a href={resolveRoute('/auth/logout')} class="text-sm">
         <IconLogout class="h-4 w-4" aria-hidden="true" />
         {m.header_sign_out()}
       </a>
diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index 22ab531f..15e8877e 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+  import { resolveRoute } from '$app/paths';
   import { page } from '$app/state';
   import * as m from '$lib/paraglide/messages.js';
   import type { Component } from 'svelte';
@@ -99,8 +100,9 @@
         {#each section.items as item (item.label)}
           {@const active = isActive(item.href)}
           <li>
+            <!-- eslint-disable @typescript-eslint/no-explicit-any, svelte/no-navigation-without-resolve -->
             <a
-              href={item.href}
+              href={resolveRoute(item.href as any)}
               onclick={(e) => handleNavClick(e, item)}
               onkeydown={(e) => handleNavKeydown(e, item)}
               title={collapsed ? item.label : undefined}
@@ -125,6 +127,7 @@
                 {/if}
               {/if}
             </a>
+            <!-- eslint-enable @typescript-eslint/no-explicit-any, svelte/no-navigation-without-resolve -->
           </li>
         {/each}
       </ul>
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index 6ff74bbe..ad2300d9 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -100,21 +100,21 @@
           icon: IconDescriptionOutline as Component,
           label: m.storage_create_file(),
           disabled: false,
-          hidden: storage.isInArchive
+          hidden: storage.archive.isInArchive
         },
         {
           key: 'create-folder' as ActionName,
           icon: IconFolderOutline as Component,
           label: m.storage_create_folder(),
           disabled: false,
-          hidden: storage.isInArchive
+          hidden: storage.archive.isInArchive
         },
         {
           key: 'paste' as ActionName,
           icon: IconPaste as Component,
           label: m.storage_action_paste(),
-          disabled: storage.clipboard === null || storage.isInArchive,
-          hidden: !storagePasteEnabled || storage.isInArchive
+          disabled: storage.clipboard === null || storage.archive.isInArchive,
+          hidden: !storagePasteEnabled || storage.archive.isInArchive
         }
       );
       return items;
@@ -147,29 +147,29 @@
         key: 'cut' as ActionName,
         icon: IconCut as Component,
         label: m.storage_action_cut(),
-        disabled: selectionCount === 0 || storage.isInArchive,
-        hidden: !storageCutCopyEnabled || storage.isInArchive
+        disabled: selectionCount === 0 || storage.archive.isInArchive,
+        hidden: !storageCutCopyEnabled || storage.archive.isInArchive
       },
       {
         key: 'copy' as ActionName,
         icon: IconCopy as Component,
         label: m.storage_action_copy(),
-        disabled: selectionCount === 0 || storage.isInArchive,
-        hidden: !storageCutCopyEnabled || storage.isInArchive
+        disabled: selectionCount === 0 || storage.archive.isInArchive,
+        hidden: !storageCutCopyEnabled || storage.archive.isInArchive
       },
       {
         key: 'paste' as ActionName,
         icon: IconPaste as Component,
         label: m.storage_action_paste(),
-        disabled: storage.clipboard === null || storage.isInArchive,
-        hidden: !storagePasteEnabled || storage.isInArchive
+        disabled: storage.clipboard === null || storage.archive.isInArchive,
+        hidden: !storagePasteEnabled || storage.archive.isInArchive
       },
       {
         key: 'rename' as ActionName,
         icon: IconDriveFileRenameOutline as Component,
         label: m.storage_action_rename(),
-        disabled: selectionCount !== 1 || storage.isInArchive,
-        hidden: !storageRenameEnabled || storage.isInArchive
+        disabled: selectionCount !== 1 || storage.archive.isInArchive,
+        hidden: !storageRenameEnabled || storage.archive.isInArchive
       },
       {
         key: 'copy-filename' as ActionName,
@@ -189,15 +189,15 @@
         key: 'pin' as ActionName,
         icon: IconPushPinOutline as Component,
         label: m.storage_action_pin(),
-        disabled: !storage.canPin || storage.isInArchive,
-        hidden: !storage.canPin || storage.ctxIsPinned || storage.isInArchive
+        disabled: !storage.canPin || storage.archive.isInArchive,
+        hidden: !storage.canPin || storage.ctxIsPinned || storage.archive.isInArchive
       },
       {
         key: 'unpin' as ActionName,
         icon: IconPushPin as Component,
         label: m.storage_action_unpin(),
-        disabled: !storage.ctxIsPinned || storage.isInArchive,
-        hidden: !storage.ctxIsPinned || storage.isInArchive
+        disabled: !storage.ctxIsPinned || storage.archive.isInArchive,
+        hidden: !storage.ctxIsPinned || storage.archive.isInArchive
       }
     );
 
@@ -205,7 +205,7 @@
   });
 
   const dangerActions = $derived(
-    storage.isInArchive || !hasCtxKey
+    storage.archive.isInArchive || !hasCtxKey
       ? []
       : [
           {
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 2d75e472..16ea6699 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -6,7 +6,7 @@
   import { navigating } from '$app/state';
   import { getStorageState } from '$lib/storage/context.js';
   import { TabsState } from '$lib/storage/tabs.svelte.js';
-  import { setTabsState } from '$lib/storage/tabs-context.js';
+  import { setTabsState } from '$lib/storage/context.js';
   import { storageRestoreTabsEnabled } from '$lib/client/feature-flags.js';
   import StorageBreadcrumb from './StorageBreadcrumb.svelte';
   import TabBar from './TabBar.svelte';
@@ -116,7 +116,7 @@
   <StorageBreadcrumb />
 
   <div bind:this={objectListEl} class="relative min-h-0 flex-1 overflow-hidden">
-    {#if storage.loading || storage.deleting || storage.archiveLoading || navigating.to}
+    {#if storage.loading || storage.deleting || storage.archive.archiveLoading || navigating.to}
       <div
         class="bg-base-100/70 absolute inset-0 z-20 flex items-center justify-center"
         aria-live="polite"
diff --git a/src/lib/components/storage/explorer/FileRow.svelte b/src/lib/components/storage/explorer/FileRow.svelte
index d5ea64f7..2e2aedf2 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte
+++ b/src/lib/components/storage/explorer/FileRow.svelte
@@ -35,12 +35,12 @@
     : selected
       ? 'bg-primary/10 hover:bg-primary/15'
       : 'hover:bg-base-200/60'}"
-  draggable={storageCutCopyEnabled && !storage.isInArchive}
+  draggable={storageCutCopyEnabled && !storage.archive.isInArchive}
   ondragstart={handleDragStart}
   onclick={(e) => storage.toggleSelect(file.key, e.ctrlKey || e.metaKey)}
   ondblclick={() => {
     if (isArchive) {
-      void storage.enterArchive(file.key);
+      void storage.archive.enterArchive(file.key);
     } else {
       storage.executeAction('preview');
     }
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte b/src/lib/components/storage/explorer/FolderRow.svelte
index e69c352b..9c60dc3b 100644
--- a/src/lib/components/storage/explorer/FolderRow.svelte
+++ b/src/lib/components/storage/explorer/FolderRow.svelte
@@ -67,7 +67,7 @@
     : selected
       ? 'bg-primary/10 hover:bg-primary/15'
       : 'hover:bg-base-200/60'}"
-  draggable={storageCutCopyEnabled && !storage.isInArchive}
+  draggable={storageCutCopyEnabled && !storage.archive.isInArchive}
   ondragstart={handleDragStart}
   ondragover={handleDragOver}
   ondragleave={handleDragLeave}
@@ -75,16 +75,16 @@
   onclick={(e) => {
     if (storage.selectionMode || e.ctrlKey || e.metaKey) {
       storage.toggleSelect(folder.key, true);
-    } else if (storage.isInArchive) {
-      storage.navigateInArchive(folder.key);
+    } else if (storage.archive.isInArchive) {
+      storage.archive.navigateInArchive(folder.key);
     } else {
       storage.navigate(folder.key);
     }
   }}
   ondblclick={(e) => {
     if (e.ctrlKey || e.metaKey) {
-      if (storage.isInArchive) {
-        storage.navigateInArchive(folder.key);
+      if (storage.archive.isInArchive) {
+        storage.archive.navigateInArchive(folder.key);
       } else {
         storage.navigate(folder.key);
       }
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 4ca84b1a..42fd6b3d 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -18,8 +18,8 @@
   import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
 
   function navigateUp() {
-    if (storage.isInArchive) {
-      storage.navigateUpFromArchive();
+    if (storage.archive.isInArchive) {
+      storage.archive.navigateUpFromArchive();
       return;
     }
     if (!storage.prefix) return;
@@ -180,7 +180,7 @@
 
 <div
   bind:this={scrollContainer}
-  class="preview-scroll h-full overflow-x-auto overflow-y-auto {tableDragOver
+  class="h-full overflow-x-auto overflow-y-auto {tableDragOver
     ? 'outline-primary/40 outline -outline-offset-2 outline-dashed'
     : ''}"
   ondragover={handleTableDragOver}
@@ -223,7 +223,7 @@
       <!-- Parent directory row -->
       {#if storage.prefix}
         <tr
-          class="hover cursor-pointer {parentDragOver
+          class="cursor-pointer {parentDragOver
             ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
             : ''}"
           onclick={navigateUp}
@@ -242,7 +242,7 @@
         </tr>
       {/if}
 
-      {#if storage.archiveTooLarge}
+      {#if storage.archive.archiveTooLarge}
         <!-- Archive too large fallback -->
         <tr>
           <td colspan={5} class="py-16 text-center">
diff --git a/src/lib/components/storage/explorer/SelectionToolbar.svelte b/src/lib/components/storage/explorer/SelectionToolbar.svelte
index 4e7ec410..693598e3 100644
--- a/src/lib/components/storage/explorer/SelectionToolbar.svelte
+++ b/src/lib/components/storage/explorer/SelectionToolbar.svelte
@@ -55,7 +55,7 @@
         {m.storage_action_details()}
       </button>
 
-      {#if !storage.isInArchive}
+      {#if !storage.archive.isInArchive}
         <button
           class="
             btn btn-ghost btn-xs gap-1
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 5f792f1a..3e820cfd 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -15,12 +15,10 @@
   import IconAdd from 'virtual:icons/material-symbols/add';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
-  import { getTabsState } from '$lib/storage/tabs-context.js';
+  import { getTabsState } from '$lib/storage/context.js';
   import type { StorageLocation } from '$lib/storage/types.js';
   import { keyToName } from '$lib/storage/utils.js';
   import { invalidateAll } from '$app/navigation';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
-  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
   import { storageMoveEnabled } from '$lib/client/feature-flags.js';
   import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
   import OperationsButton from './OperationsButton.svelte';
@@ -41,10 +39,10 @@
   );
 
   const archiveParts = $derived(
-    storage.isInArchive && storage.archiveKey
+    storage.archive.isInArchive && storage.archive.archiveKey
       ? [
-          ...(storage.archivePrefix
-            ? storage.archivePrefix
+          ...(storage.archive.archivePrefix
+            ? storage.archive.archivePrefix
                 .replace(/\/$/, '')
                 .split('/')
                 .map((label, i, parts) => ({
@@ -57,9 +55,11 @@
       : []
   );
 
-  const archiveName = $derived(storage.archiveKey ? keyToName(storage.archiveKey) : '');
+  const archiveName = $derived(
+    storage.archive.archiveKey ? keyToName(storage.archive.archiveKey) : ''
+  );
   const nestedArchiveName = $derived(
-    storage.archiveNestedPath ? keyToName(storage.archiveNestedPath) : ''
+    storage.archive.nestedArchivePath ? keyToName(storage.archive.nestedArchivePath) : ''
   );
 
   const MAX_TAIL = 2;
@@ -106,13 +106,7 @@
   }
 
   async function createObject(bucket: string, key: string): Promise<void> {
-    const params = new URLSearchParams({ bucket, key });
-    const connectionId = connectionStore.activeConnectionId;
-    const headers: HeadersInit = connectionId
-      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      : {};
-    const res = await fetch(`/api/storage/create?${params}`, { method: 'POST', headers });
-    if (!res.ok) throw new Error(`Create failed with status ${res.status}`);
+    await storage.api.create({ bucket, key });
   }
 
   async function handleCreate() {
@@ -162,12 +156,8 @@
 
   /** Navigate to an S3 prefix, clearing archive state first. */
   function navigateS3(prefix: string) {
-    if (storage.isInArchive) {
-      storage.archiveKey = null;
-      storage.archivePrefix = '';
-      storage.archiveNestedPath = null;
-      storage.previousS3Prefix = '';
-      storage.archiveLoading = false;
+    if (storage.archive.isInArchive) {
+      storage.archive.reset();
     }
     storage.navigate(prefix);
   }
@@ -296,7 +286,7 @@
     flex min-w-0 flex-1 items-center gap-1 text-sm
   "
   >
-    {#if breadcrumbParts.length === 0 && !storage.isInArchive}
+    {#if breadcrumbParts.length === 0 && !storage.archive.isInArchive}
       <span class="group flex shrink-0 items-center gap-1">
         <!-- svelte-ignore a11y_no_static_element_interactions -->
         <span
@@ -413,7 +403,7 @@
       </div>
     {/if}
     {#each visibleParts as part, i (part.prefix)}
-      {@const isCurrent = !storage.isInArchive && i === visibleParts.length - 1}
+      {@const isCurrent = !storage.archive.isInArchive && i === visibleParts.length - 1}
       <IconChevronRight
         class="text-base-content/30 pointer-events-none size-4 shrink-0"
         aria-hidden="true"
@@ -460,7 +450,7 @@
         {@render pinButton(storage.bucket, part.prefix)}
       </span>
     {/each}
-    {#if storage.isInArchive}
+    {#if storage.archive.isInArchive}
       <!-- Outer archive entry -->
       <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
       <span class="group flex shrink-0 items-center gap-1">
@@ -471,10 +461,10 @@
           "
           title={archiveName}
           onclick={() => {
-            if (storage.archiveNestedPath) {
-              storage.navigateToOuterArchiveRoot();
+            if (storage.archive.nestedArchivePath) {
+              storage.archive.navigateToOuterArchiveRoot();
             } else {
-              storage.navigateInArchive('');
+              storage.archive.navigateInArchive('');
             }
           }}
         >
@@ -483,7 +473,7 @@
         </button>
       </span>
       <!-- Nested archive entry -->
-      {#if storage.archiveNestedPath}
+      {#if storage.archive.nestedArchivePath}
         <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
         <span class="group flex shrink-0 items-center gap-1">
           <button
@@ -492,7 +482,7 @@
               py-0.5 font-medium transition-colors hover:cursor-pointer hover:opacity-70
             "
             title={nestedArchiveName}
-            onclick={() => storage.navigateInArchive('')}
+            onclick={() => storage.archive.navigateInArchive('')}
           >
             <IconFolderZip class="size-4" aria-hidden="true" />
             {nestedArchiveName}
@@ -520,7 +510,7 @@
                 py-0.5 transition-colors hover:cursor-pointer
               "
               title={part.label}
-              onclick={() => storage.navigateInArchive(part.prefix)}
+              onclick={() => storage.archive.navigateInArchive(part.prefix)}
             >
               {part.label}
             </button>
@@ -625,7 +615,7 @@
           </label>
           <input
             id="create-name-input"
-            class="input input-bordered input-sm w-full"
+            class="input input-sm w-full"
             autofocus
             value={createName}
             placeholder={m.storage_create_placeholder()}
@@ -658,7 +648,7 @@
   </div>
 
   <!-- Upload button (hidden inside archives) -->
-  {#if !storage.isInArchive}
+  {#if !storage.archive.isInArchive}
     <button
       class="btn btn-primary btn-xs gap-1"
       onclick={() =>
@@ -704,7 +694,7 @@
           {m.storage_tab_new()}
         </button>
       </li>
-      {#if !storage.isInArchive}
+      {#if !storage.archive.isInArchive}
         <li role="none">
           {#if currentIsPinned}
             {@const PinIcon2 = IconPushPin}
diff --git a/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
index a614cbe0..d0d07a27 100644
--- a/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/FileRow.svelte.spec.ts
@@ -142,7 +142,7 @@ describe('FileRow', () => {
   it('should call enterArchive on double click for zip files', async () => {
     const file = makeFile({ key: 'archive.zip', contentType: 'application/zip' });
     const state = createState([file]);
-    const spy = vi.spyOn(state, 'enterArchive');
+    const spy = vi.spyOn(state.archive, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
     await dblClickRow();
@@ -152,7 +152,7 @@ describe('FileRow', () => {
   it('should call enterArchive on double click for tar.gz files', async () => {
     const file = makeFile({ key: 'bundle.tar.gz', contentType: 'application/gzip' });
     const state = createState([file]);
-    const spy = vi.spyOn(state, 'enterArchive');
+    const spy = vi.spyOn(state.archive, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
     await dblClickRow();
@@ -162,9 +162,9 @@ describe('FileRow', () => {
   it('should call enterArchive on double click for nested archive inside an archive', async () => {
     const file = makeFile({ key: 'nested.zip', contentType: undefined });
     const state = createState([file]);
-    state.archiveKey = 'outer.zip';
-    state.archivePrefix = '';
-    const spy = vi.spyOn(state, 'enterArchive');
+    state.archive.archiveKey = 'outer.zip';
+    state.archive.archivePrefix = '';
+    const spy = vi.spyOn(state.archive, 'enterArchive');
     render(FileRowWrapper, { state, file });
 
     await dblClickRow();
@@ -174,8 +174,8 @@ describe('FileRow', () => {
   it('should call executeAction preview on double click for non-archive file inside archive', async () => {
     const file = makeFile({ key: 'readme.txt', contentType: 'text/plain' });
     const state = createState([file]);
-    state.archiveKey = 'outer.zip';
-    state.archivePrefix = '';
+    state.archive.archiveKey = 'outer.zip';
+    state.archive.archivePrefix = '';
     const spy = vi.spyOn(state, 'executeAction');
     render(FileRowWrapper, { state, file });
 
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
index 36a8f079..6725bd6c 100644
--- a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
@@ -461,7 +461,7 @@ describe('StorageBreadcrumb', () => {
   describe('archive mode', () => {
     it('should show archive name when inside an archive', async () => {
       const state = createState();
-      state.archiveKey = 'data.zip';
+      state.archive.archiveKey = 'data.zip';
       render(StorageBreadcrumbWrapper, { state });
 
       const nav = page.getByRole('navigation', { name: 'breadcrumb' });
@@ -470,8 +470,8 @@ describe('StorageBreadcrumb', () => {
 
     it('should show internal path parts when navigating within archive', async () => {
       const state = createState();
-      state.archiveKey = 'data.zip';
-      state.archivePrefix = 'music/videos/';
+      state.archive.archiveKey = 'data.zip';
+      state.archive.archivePrefix = 'music/videos/';
       render(StorageBreadcrumbWrapper, { state });
 
       const nav = page.getByRole('navigation', { name: 'breadcrumb' });
@@ -483,9 +483,16 @@ describe('StorageBreadcrumb', () => {
 
     it('should show nested archive entry when browsing nested archive', async () => {
       const state = createState();
-      state.archiveKey = 'outer.zip';
-      state.archiveNestedPath = 'inner.tar';
-      state.archivePrefix = 'subdir/';
+      state.archive.archiveKey = 'outer.zip';
+      state.archive._restoreFullState({
+        archiveKey: 'outer.zip',
+        archivePrefix: 'subdir/',
+        archiveNestedPath: 'inner.tar',
+        previousS3Prefix: '',
+        archiveLoading: false,
+        archiveTooLarge: false
+      });
+      state.archive.archivePrefix = 'subdir/';
       render(StorageBreadcrumbWrapper, { state });
 
       const nav = page.getByRole('navigation', { name: 'breadcrumb' });
@@ -496,9 +503,9 @@ describe('StorageBreadcrumb', () => {
 
     it('should call navigateInArchive when clicking breadcrumb folder inside archive', async () => {
       const state = createState();
-      state.archiveKey = 'data.zip';
-      state.archivePrefix = 'music/videos/';
-      const spy = vi.spyOn(state, 'navigateInArchive');
+      state.archive.archiveKey = 'data.zip';
+      state.archive.archivePrefix = 'music/videos/';
+      const spy = vi.spyOn(state.archive, 'navigateInArchive');
       render(StorageBreadcrumbWrapper, { state });
 
       const nav = page.getByRole('navigation', { name: 'breadcrumb' });
@@ -508,7 +515,7 @@ describe('StorageBreadcrumb', () => {
 
     it('should hide upload button when in archive mode', async () => {
       const state = createState();
-      state.archiveKey = 'data.zip';
+      state.archive.archiveKey = 'data.zip';
       render(StorageBreadcrumbWrapper, { state });
 
       await expect.element(page.getByRole('button', { name: /upload/i })).not.toBeInTheDocument();
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
index 70e8fb18..3c73ae8f 100644
--- a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumbWrapper.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { untrack } from 'svelte';
   import { setStorageState } from '$lib/storage/context.js';
-  import { setTabsState } from '$lib/storage/tabs-context.js';
+  import { setTabsState } from '$lib/storage/context.js';
   import { TabsState } from '$lib/storage/tabs.svelte.js';
   import type { StorageState } from '$lib/storage/state.svelte.js';
   import StorageBreadcrumb from '../StorageBreadcrumb.svelte';
diff --git a/src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte b/src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte
index 7ca38328..ffebff1c 100644
--- a/src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte
+++ b/src/lib/components/storage/explorer/__tests__/TabBarWrapper.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { untrack } from 'svelte';
   import { setStorageState } from '$lib/storage/context.js';
-  import { setTabsState } from '$lib/storage/tabs-context.js';
+  import { setTabsState } from '$lib/storage/context.js';
   import type { StorageState } from '$lib/storage/state.svelte.js';
   import type { TabsState } from '$lib/storage/tabs.svelte.js';
   import TabBar from '../TabBar.svelte';
diff --git a/src/lib/components/storage/landing/AddBucketModal.svelte b/src/lib/components/storage/landing/AddBucketModal.svelte
index c38e9a82..6102dec6 100644
--- a/src/lib/components/storage/landing/AddBucketModal.svelte
+++ b/src/lib/components/storage/landing/AddBucketModal.svelte
@@ -5,7 +5,6 @@
   import Modal from '$lib/components/Modal.svelte';
   import { getStorageState } from '$lib/storage/context.js';
   import { connectionStore } from '$lib/storage/connection-store.svelte.js';
-  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 
   interface Props {
     open: boolean;
@@ -44,20 +43,11 @@
     error = null;
 
     try {
-      const res = await fetch(`/api/storage/check-bucket?bucket=${encodeURIComponent(name)}`, {
-        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionStore.activeConnectionId ?? '' }
-      });
+      const result = await storage.api.checkBucket({ bucket: name });
 
-      if (res.ok) {
+      if (result.ok) {
         // Persist the bucket to the connection's additionalBuckets
-        await fetch(`/api/storage/connections`, {
-          method: 'PATCH',
-          headers: {
-            [STORAGE_CONNECTION_ID_HEADER]: connectionStore.activeConnectionId ?? '',
-            'Content-Type': 'application/json'
-          },
-          body: JSON.stringify({ bucket: name })
-        });
+        await storage.api.updateConnections({ bucket: name });
 
         // Update local store so the grid reflects the change
         const activeId = connectionStore.activeConnectionId;
@@ -82,9 +72,9 @@
             prefix: ''
           })
         );
-      } else if (res.status === 403) {
+      } else if (result.status === 403) {
         error = 'access_denied';
-      } else if (res.status === 404) {
+      } else if (result.status === 404) {
         error = 'not_found';
       } else {
         error = 'unknown';
diff --git a/src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts b/src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts
index cab0f886..f8aa255f 100644
--- a/src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts
+++ b/src/lib/components/storage/landing/AddBucketModal.svelte.spec.ts
@@ -15,8 +15,16 @@ vi.mock('$app/paths', () => ({
 
 // Mock storage context
 const mockAddBucket = vi.fn();
+const mockCheckBucket = vi.fn();
+const mockUpdateConnections = vi.fn();
 vi.mock('$lib/storage/context.js', () => ({
-  getStorageState: () => ({ addBucket: mockAddBucket })
+  getStorageState: () => ({
+    addBucket: mockAddBucket,
+    api: {
+      checkBucket: mockCheckBucket,
+      updateConnections: mockUpdateConnections
+    }
+  })
 }));
 
 // Mock connection store
@@ -24,8 +32,16 @@ vi.mock('$lib/storage/connection-store.svelte.js', () => ({
   connectionStore: { activeConnectionId: 'mock-connection-id', connections: [] }
 }));
 
-vi.mock('$lib/storage/connection-id-header.js', () => ({
-  STORAGE_CONNECTION_ID_HEADER: 'x-storage-connection-id'
+// Mock storage errors
+vi.mock('$lib/storage/errors.js', () => ({
+  StorageError: class StorageError extends Error {
+    code: string;
+    constructor(code: string, message: string) {
+      super(message);
+      this.code = code;
+      this.name = 'StorageError';
+    }
+  }
 }));
 
 // Mock paraglide messages
@@ -98,10 +114,9 @@ describe('AddBucketModal', () => {
   });
 
   describe('successful connection', () => {
-    it('should call addBucket and navigate on 204 response', async () => {
-      vi.mocked(fetch)
-        .mockResolvedValueOnce({ ok: true, status: 204 } as Response)
-        .mockResolvedValueOnce({ ok: true } as Response);
+    it('should call addBucket and navigate on ok response', async () => {
+      mockCheckBucket.mockResolvedValue({ ok: true, status: 200 });
+      mockUpdateConnections.mockResolvedValue(undefined);
 
       render(AddBucketModal, { open: true });
 
@@ -112,27 +127,22 @@ describe('AddBucketModal', () => {
       await expect.poll(() => mockGoto).toHaveBeenCalledWith('/storage/my-bucket');
     });
 
-    it('should URL-encode the bucket name in the check request', async () => {
-      vi.mocked(fetch)
-        .mockResolvedValueOnce({ ok: true, status: 204 } as Response)
-        .mockResolvedValueOnce({ ok: true } as Response);
+    it('should pass the bucket name to checkBucket', async () => {
+      mockCheckBucket.mockResolvedValue({ ok: true, status: 200 });
+      mockUpdateConnections.mockResolvedValue(undefined);
 
       render(AddBucketModal, { open: true });
 
       await userEvent.type(page.getByLabelText('Bucket name'), 'my bucket');
       await userEvent.click(page.getByRole('button', { name: 'Connect' }));
 
-      await expect
-        .poll(() => fetch)
-        .toHaveBeenCalledWith('/api/storage/check-bucket?bucket=my%20bucket', {
-          headers: { 'x-storage-connection-id': 'mock-connection-id' }
-        });
+      await expect.poll(() => mockCheckBucket).toHaveBeenCalledWith({ bucket: 'my bucket' });
     });
   });
 
   describe('error handling', () => {
     it('should show access denied error on 403', async () => {
-      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 403 } as Response);
+      mockCheckBucket.mockResolvedValue({ ok: false, status: 403 });
 
       render(AddBucketModal, { open: true });
 
@@ -145,7 +155,7 @@ describe('AddBucketModal', () => {
     });
 
     it('should show not found error on 404', async () => {
-      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 404 } as Response);
+      mockCheckBucket.mockResolvedValue({ ok: false, status: 404 });
 
       render(AddBucketModal, { open: true });
 
@@ -158,7 +168,7 @@ describe('AddBucketModal', () => {
     });
 
     it('should show generic error on 502', async () => {
-      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 502 } as Response);
+      mockCheckBucket.mockResolvedValue({ ok: false, status: 502 });
 
       render(AddBucketModal, { open: true });
 
@@ -171,7 +181,7 @@ describe('AddBucketModal', () => {
     });
 
     it('should show generic error on network failure', async () => {
-      vi.mocked(fetch).mockRejectedValue(new Error('Network error'));
+      mockCheckBucket.mockRejectedValue(new Error('Network error'));
 
       render(AddBucketModal, { open: true });
 
@@ -184,7 +194,7 @@ describe('AddBucketModal', () => {
     });
 
     it('should not navigate or add bucket on error', async () => {
-      vi.mocked(fetch).mockResolvedValue({ ok: false, status: 403 } as Response);
+      mockCheckBucket.mockResolvedValue({ ok: false, status: 403 });
 
       render(AddBucketModal, { open: true });
 
@@ -197,10 +207,10 @@ describe('AddBucketModal', () => {
     });
 
     it('should clear error when user types a new bucket name', async () => {
-      vi.mocked(fetch)
-        .mockResolvedValueOnce({ ok: false, status: 404 } as Response)
-        .mockResolvedValueOnce({ ok: true, status: 204 } as Response)
-        .mockResolvedValueOnce({ ok: true } as Response);
+      mockCheckBucket
+        .mockResolvedValueOnce({ ok: false, status: 404 })
+        .mockResolvedValueOnce({ ok: true, status: 200 });
+      mockUpdateConnections.mockResolvedValue(undefined);
 
       render(AddBucketModal, { open: true });
 
diff --git a/src/lib/components/storage/landing/RecentItems.svelte b/src/lib/components/storage/landing/RecentItems.svelte
index 58622dfd..a58f3808 100644
--- a/src/lib/components/storage/landing/RecentItems.svelte
+++ b/src/lib/components/storage/landing/RecentItems.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import type { Snippet } from 'svelte';
+  import { resolveRoute } from '$app/paths';
   import IconArrowForward from 'virtual:icons/material-symbols/arrow-forward';
   import IconDescriptionOutline from 'virtual:icons/material-symbols/description-outline';
   import IconPreviewOutline from 'virtual:icons/material-symbols/preview-outline';
@@ -21,6 +22,8 @@
   import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
 
   const storage = getStorageState();
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  const rr = (p: string) => resolveRoute(p as any);
 
   type Tab = 'files' | 'locations';
   let activeTab = $state<Tab>('files');
@@ -59,7 +62,7 @@
     </thead>
     <tbody>
       {#each storage.bookmarks.recentFiles as file (file.bucket + '::' + file.key)}
-        <tr class="hover">
+        <tr>
           <td>
             <div class="flex items-center gap-2">
               <IconDescriptionOutline class="text-primary size-4 shrink-0" aria-hidden="true" />
@@ -67,13 +70,11 @@
             </div>
           </td>
           <td>
-            <!-- eslint-disable svelte/no-navigation-without-resolve -->
             <a
-              href={fileHref(file)}
+              href={rr(fileHref(file))}
               data-sveltekit-preload-data="off"
               class="text-base-content/60 hover:text-primary truncate text-xs"
             >
-              <!-- eslint-enable svelte/no-navigation-without-resolve -->
               {fileLocation(file)}
             </a>
           </td>
@@ -95,14 +96,12 @@
                 </button>
               </div>
               <div class="tooltip tooltip-left" data-tip={m.storage_recent_open_folder()}>
-                <!-- eslint-disable svelte/no-navigation-without-resolve -->
                 <a
-                  href={fileHref(file)}
+                  href={rr(fileHref(file))}
                   data-sveltekit-preload-data="off"
                   class="btn btn-ghost btn-xs"
                   aria-label="{m.storage_recent_open_folder()} — {fileName(file.key)}"
                 >
-                  <!-- eslint-enable svelte/no-navigation-without-resolve -->
                   <IconFolderOpenOutline class="size-3.5" aria-hidden="true" />
                 </a>
               </div>
@@ -126,7 +125,7 @@
     </thead>
     <tbody>
       {#each storage.bookmarks.recentLocations as loc (loc.bucket + '::' + loc.prefix)}
-        <tr class="hover">
+        <tr>
           <td>
             <div class="flex items-center gap-2">
               {#if loc.prefix === ''}
@@ -134,23 +133,19 @@
               {:else}
                 <IconFolderOutline class="text-warning size-4 shrink-0" aria-hidden="true" />
               {/if}
-              <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <a
-                href={locationHref(loc)}
+                href={rr(locationHref(loc))}
                 data-sveltekit-preload-data="off"
                 class="hover:text-primary font-medium">{locationName(loc)}</a
               >
-              <!-- eslint-enable svelte/no-navigation-without-resolve -->
             </div>
           </td>
           <td>
-            <!-- eslint-disable svelte/no-navigation-without-resolve -->
             <a
-              href={locationHref(loc)}
+              href={rr(locationHref(loc))}
               data-sveltekit-preload-data="off"
               class="text-base-content/60 hover:text-primary truncate text-xs"
             >
-              <!-- eslint-enable svelte/no-navigation-without-resolve -->
               {locationPath(loc)}
             </a>
           </td>
@@ -159,14 +154,12 @@
           </td>
           <td>
             <div class="tooltip tooltip-left" data-tip={m.storage_recent_go_to_location()}>
-              <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <a
-                href={locationHref(loc)}
+                href={rr(locationHref(loc))}
                 data-sveltekit-preload-data="off"
                 class="btn btn-ghost btn-xs"
                 aria-label="{m.storage_recent_go_to_location()} — {locationName(loc)}"
               >
-                <!-- eslint-enable svelte/no-navigation-without-resolve -->
                 <IconArrowForward class="size-3.5" aria-hidden="true" />
               </a>
             </div>
diff --git a/src/lib/components/storage/landing/StorageConnectForm.svelte b/src/lib/components/storage/landing/StorageConnectForm.svelte
index 764cffda..19ae9a26 100644
--- a/src/lib/components/storage/landing/StorageConnectForm.svelte
+++ b/src/lib/components/storage/landing/StorageConnectForm.svelte
@@ -65,12 +65,7 @@
         <label for="{uid}-type" class="label mb-1 text-sm font-medium">
           {m.storage_connect_type()}
         </label>
-        <select
-          id="{uid}-type"
-          name="type"
-          class="select-bordered select w-full"
-          bind:value={$form.type}
-        >
+        <select id="{uid}-type" name="type" class="select w-full" bind:value={$form.type}>
           <option value="s3">{m.storage_connect_type_s3()}</option>
           <option value="hdfs" disabled>{m.storage_connect_type_hdfs()}</option>
         </select>
@@ -84,7 +79,7 @@
           id="{uid}-host"
           name="host"
           type="text"
-          class={['input-bordered input w-full', $errors?.host && 'input-error']}
+          class={['input w-full', $errors?.host && 'input-error']}
           placeholder={m.storage_connect_host_placeholder()}
           bind:value={$form.host}
           onblur={parseHostInput}
@@ -104,7 +99,7 @@
           type="number"
           min="1"
           max="65535"
-          class={['input-bordered input w-full', $errors?.port && 'input-error']}
+          class={['input w-full', $errors?.port && 'input-error']}
           placeholder={m.storage_connect_port_placeholder()}
           bind:value={$form.port}
         />
@@ -159,7 +154,7 @@
         <select
           id="{uid}-access-style"
           name="accessStyle"
-          class="select-bordered select w-full"
+          class="select w-full"
           bind:value={$form.accessStyle}
         >
           <option value="Path">{m.storage_connect_access_style_path()}</option>
@@ -175,7 +170,7 @@
           id="{uid}-region"
           name="region.name"
           type="text"
-          class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
+          class={['input w-full', $errors?.region?.name && 'input-error']}
           bind:value={$form.region.name}
         />
         {#if $errors?.region?.name}
@@ -191,7 +186,7 @@
           id="{uid}-access-key"
           name="credentials.accessKey"
           type="text"
-          class={['input-bordered input w-full', $errors?.credentials?.accessKey && 'input-error']}
+          class={['input w-full', $errors?.credentials?.accessKey && 'input-error']}
           autocomplete="username"
           bind:value={$form.credentials.accessKey}
         />
@@ -208,7 +203,7 @@
           id="{uid}-secret-key"
           name="credentials.secretKey"
           type="password"
-          class={['input-bordered input w-full', $errors?.credentials?.secretKey && 'input-error']}
+          class={['input w-full', $errors?.credentials?.secretKey && 'input-error']}
           autocomplete="current-password"
           bind:value={$form.credentials.secretKey}
         />
diff --git a/src/lib/components/storage/modals/CreateModal.svelte b/src/lib/components/storage/modals/CreateModal.svelte
index 196dfb14..3b2b83b8 100644
--- a/src/lib/components/storage/modals/CreateModal.svelte
+++ b/src/lib/components/storage/modals/CreateModal.svelte
@@ -80,7 +80,7 @@
     <input
       bind:this={inputEl}
       id={uid + '-create-input'}
-      class="input input-bordered input-sm w-full"
+      class="input input-sm w-full"
       placeholder={m.storage_create_placeholder()}
       value={name}
       oninput={(e) => {
diff --git a/src/lib/components/storage/modals/DeleteConnectionModal.svelte b/src/lib/components/storage/modals/DeleteConnectionModal.svelte
index 3582d89d..27a192db 100644
--- a/src/lib/components/storage/modals/DeleteConnectionModal.svelte
+++ b/src/lib/components/storage/modals/DeleteConnectionModal.svelte
@@ -3,7 +3,7 @@
   import IconCheck from 'virtual:icons/material-symbols/check';
   import Modal from '$lib/components/Modal.svelte';
   import * as m from '$lib/paraglide/messages.js';
-  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+  import type { SavedConnection } from '$lib/storage/connection-id-header.js';
 
   interface Props {
     open: boolean;
diff --git a/src/lib/components/storage/modals/DetailsModal.svelte b/src/lib/components/storage/modals/DetailsModal.svelte
index 436dbbb3..c83e6258 100644
--- a/src/lib/components/storage/modals/DetailsModal.svelte
+++ b/src/lib/components/storage/modals/DetailsModal.svelte
@@ -7,8 +7,8 @@
   import IconFolder from 'virtual:icons/material-symbols/folder';
   import IconBucket from '$lib/components/storage/shared/BucketIcon.svelte';
   import * as m from '$lib/paraglide/messages.js';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
-  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import { StorageError } from '$lib/storage/errors.js';
   import type { FileDetails as FileDetailsType } from '$lib/storage/details-types.js';
   import FileDetails from './details/FileDetails.svelte';
   import DirectoryDetails from './details/DirectoryDetails.svelte';
@@ -24,6 +24,8 @@
 
   let { open = $bindable(), type, bucket, key, prefix }: Props = $props();
 
+  const storage = getStorageState();
+
   let maximized = $state(false);
 
   // Reset maximized state when the modal closes
@@ -50,22 +52,13 @@
     loading = true;
     loadError = null;
     try {
-      const connectionId = connectionStore.activeConnectionId;
-      if (!connectionId) {
-        loadError = m.storage_details_error_not_connected();
-        return;
-      }
-      const params = new URLSearchParams({ bucket, key });
-      const res = await fetch(`/api/storage/details?${params}`, {
-        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      });
-      if (!res.ok) {
-        loadError = m.storage_details_error_fetch_file({ status: res.status });
-        return;
-      }
-      fileDetails = (await res.json()) as FileDetailsType;
+      fileDetails = await storage.api.details({ bucket, key });
     } catch (err) {
-      loadError = err instanceof Error ? err.message : m.storage_details_error_unknown();
+      if (err instanceof StorageError) {
+        loadError = err.message;
+      } else {
+        loadError = err instanceof Error ? err.message : m.storage_details_error_unknown();
+      }
     } finally {
       loading = false;
     }
diff --git a/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
index af3c7562..836f3165 100644
--- a/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
+++ b/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
@@ -8,6 +8,23 @@ vi.mock('$app/paths', () => ({
   resolve: (path: string) => path
 }));
 
+// Mock storage context — provide an API that delegates to the global fetch
+vi.mock('$lib/storage/context.js', () => ({
+  getStorageState: () => ({
+    get api() {
+      return {
+        preview: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>)),
+        archiveExtract: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>)),
+        saveText: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>))
+      };
+    },
+    bucket: 'test-bucket'
+  })
+}));
+
 const defaultProps = {
   open: true,
   bucket: faker.word.noun(),
@@ -47,6 +64,7 @@ function mockFetchResponse(
 function parquetNdjson(headers: string[], rows: unknown[][], totalRows: number): string {
   const lines: Array<Record<string, unknown>> = [{ t: 'h', h: headers, tr: totalRows }];
   for (let ci = 0; ci < headers.length; ci++) {
+    // eslint-disable-next-line security/detect-object-injection
     lines.push({ t: 'c', n: headers[ci], v: rows.map((r) => r[ci]) });
   }
   lines.push({ t: 'd' });
diff --git a/src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts
index 4987c7ed..9ea463fc 100644
--- a/src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/PreviewModal.preview.svelte.spec.ts
@@ -8,6 +8,23 @@ vi.mock('$app/paths', () => ({
   resolve: (path: string) => path
 }));
 
+// Mock storage context — provide an API that delegates to the global fetch
+vi.mock('$lib/storage/context.js', () => ({
+  getStorageState: () => ({
+    get api() {
+      return {
+        preview: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>)),
+        archiveExtract: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>)),
+        saveText: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>))
+      };
+    },
+    bucket: 'test-bucket'
+  })
+}));
+
 const defaultProps = {
   open: true,
   bucket: faker.word.noun(),
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index b21a2a18..d02092f5 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -1,6 +1,5 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
-  import { SvelteURLSearchParams } from 'svelte/reactivity';
   import IconCloseFullscreen from 'virtual:icons/material-symbols/close-fullscreen';
   import IconOpenInFull from 'virtual:icons/material-symbols/open-in-full';
   import IconClose from 'virtual:icons/material-symbols/close';
@@ -21,11 +20,10 @@
   import PdfPreview from './preview/PdfPreview.svelte';
   import FallbackPreview from './preview/FallbackPreview.svelte';
   import { keyToName, formatFileSize } from '$lib/storage/utils.js';
-  import { downloadObject, DownloadError } from '$lib/storage/download.js';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
-  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import { StorageError } from '$lib/storage/errors.js';
   import { addToast } from '$lib/stores/toast.svelte.js';
   import { maxEditableFileSize, infiniteScrollEnabled } from '$lib/client/feature-flags.js';
+  import { getStorageState } from '$lib/storage/context.js';
 
   interface Props {
     open?: boolean;
@@ -116,6 +114,8 @@
     nestedArchivePath = ''
   }: Props = $props();
 
+  const storage = getStorageState();
+
   let preview: PreviewKind = $state({ kind: 'idle' });
   let blobUrls: string[] = [];
   let maximized = $state(false);
@@ -193,26 +193,17 @@
     preview = { kind: 'loading' };
     revokeBlobUrls();
 
-    const connectionId = connectionStore.activeConnectionId;
-    const headers: HeadersInit = connectionId
-      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      : {};
-
     try {
       let res: Response;
       if (archiveKey && archivePath) {
-        const params = new SvelteURLSearchParams({
+        res = await storage.api.archiveExtract({
           bucket: activeBucket,
           key: archiveKey,
-          path: archivePath
+          path: archivePath,
+          nestedArchivePath: nestedArchivePath || undefined
         });
-        if (nestedArchivePath) {
-          params.set('nestedArchivePath', nestedArchivePath);
-        }
-        res = await fetch(`/api/storage/archive/extract?${params}`, { headers });
       } else {
-        const params = new SvelteURLSearchParams({ bucket: activeBucket, key });
-        res = await fetch(`/api/storage/preview?${params}`, { headers });
+        res = await storage.api.preview({ bucket: activeBucket, key });
       }
 
       if (!res.ok) {
@@ -577,16 +568,26 @@
 
   async function triggerDownload() {
     if (!objectKey) return;
-    const connectionId = connectionStore.activeConnectionId;
-    if (!connectionId) {
-      addToast('error', m.storage_download_error_unknown());
-      return;
-    }
 
     try {
-      await downloadObject(bucket, objectKey, connectionId);
+      const res = await storage.api.preview({ bucket, key: objectKey });
+      if (!res.ok) {
+        addToast('error', m.storage_download_error_unknown());
+        return;
+      }
+      const blob = await res.blob();
+      const blobUrl = URL.createObjectURL(blob);
+      const filename = objectKey.split('/').filter(Boolean).pop() ?? objectKey;
+      const anchor = document.createElement('a');
+      anchor.href = blobUrl;
+      anchor.download = filename;
+      anchor.style.display = 'none';
+      document.body.appendChild(anchor);
+      anchor.click();
+      document.body.removeChild(anchor);
+      setTimeout(() => URL.revokeObjectURL(blobUrl), 10_000);
     } catch (err) {
-      if (err instanceof DownloadError) {
+      if (err instanceof StorageError) {
         addToast('error', err.message);
       } else {
         addToast('error', m.storage_download_error_unknown());
@@ -594,57 +595,32 @@
     }
   }
 
-  function getSaveTextParams(): URLSearchParams | null {
-    if (preview.kind !== 'text' || !objectKey) return null;
-    const params = new SvelteURLSearchParams({ bucket, key: objectKey });
-    params.set('contentType', preview.contentType);
-    params.set('originalSize', String(preview.totalSize));
-    params.set('previewBytes', String(preview.previewBytes));
-    return params;
-  }
-
   async function handleSave() {
     if (!objectKey) return;
     if (isTooLargeToEdit()) {
       addToast('error', m.storage_editor_too_large({ limit: formatFileSize(maxEditableFileSize) }));
       return;
     }
-    const params = getSaveTextParams();
-    if (!params) return;
+    if (preview.kind !== 'text') return;
 
     saving = true;
     try {
-      const connectionId = connectionStore.activeConnectionId;
-      const headers: HeadersInit = connectionId
-        ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-        : {};
+      await storage.api.saveText({ bucket, key: objectKey, body: editorText });
 
-      const res = await fetch(`/api/storage/save-text?${params}`, {
-        method: 'POST',
-        headers,
-        body: editorText
-      });
-
-      if (!res.ok) {
-        if (res.status === 401) {
+      originalText = editorText;
+      addToast('success', m.storage_editor_saved());
+    } catch (err) {
+      if (err instanceof StorageError) {
+        if (err.code === 'not_connected') {
           addToast('error', m.storage_upload_error_not_connected());
-        } else if (res.status === 403) {
+        } else if (err.code === 'access_denied') {
           addToast('error', m.storage_upload_error_access_denied());
-        } else if (res.status === 413) {
-          addToast(
-            'error',
-            m.storage_editor_too_large({ limit: formatFileSize(maxEditableFileSize) })
-          );
         } else {
           addToast('error', m.storage_editor_error());
         }
-        return;
+      } else {
+        addToast('error', m.storage_editor_error());
       }
-
-      originalText = editorText;
-      addToast('success', m.storage_editor_saved());
-    } catch {
-      addToast('error', m.storage_editor_error());
     } finally {
       saving = false;
     }
@@ -754,21 +730,14 @@
   ): Promise<unknown[][]> {
     if (!objectKey) return [];
 
-    const connectionId = connectionStore.activeConnectionId;
-    const fetchHeaders: HeadersInit = connectionId
-      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      : {};
-
-    const params = new URLSearchParams({
+    const res = await storage.api.preview({
       bucket,
       key: objectKey,
-      offset: String(offset),
-      limit: String(limit),
-      data: 'true'
+      offset,
+      limit,
+      data: true
     });
 
-    const res = await fetch(`/api/storage/preview?${params}`, { headers: fetchHeaders });
-
     if (!res.ok) {
       throw new Error('Failed to fetch parquet chunk');
     }
@@ -781,21 +750,14 @@
   async function fetchCsvRows(offset: number, limit: number): Promise<unknown[][]> {
     if (!objectKey) return [];
 
-    const connectionId = connectionStore.activeConnectionId;
-    const fetchHeaders: HeadersInit = connectionId
-      ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      : {};
-
-    const params = new URLSearchParams({
+    const res = await storage.api.preview({
       bucket,
       key: objectKey,
-      offset: String(offset),
-      limit: String(limit),
-      data: 'true'
+      offset,
+      limit,
+      data: true
     });
 
-    const res = await fetch(`/api/storage/preview?${params}`, { headers: fetchHeaders });
-
     if (!res.ok) {
       throw new Error('Failed to fetch CSV chunk');
     }
@@ -1041,7 +1003,7 @@
           bind:showingRowsCount={csvShowingRowsCount}
         />
       {:else if preview.kind === 'image'}
-        <div class="preview-scroll h-full overflow-scroll">
+        <div class="h-full overflow-scroll">
           <ImagePreview
             src={preview.blobUrl}
             name={filename}
@@ -1050,11 +1012,11 @@
           />
         </div>
       {:else if preview.kind === 'pdf'}
-        <div class="preview-scroll h-full overflow-scroll">
+        <div class="h-full overflow-scroll">
           <PdfPreview src={preview.blobUrl} name={filename} />
         </div>
       {:else if preview.kind === 'fallback'}
-        <div class="preview-scroll h-full overflow-scroll">
+        <div class="h-full overflow-scroll">
           <FallbackPreview
             contentType={preview.contentType}
             onDownload={triggerDownload}
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
index 3ac79230..62e48f3b 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/PreviewModal.svelte.spec.ts
@@ -13,6 +13,23 @@ vi.mock('$app/paths', () => ({
   resolve: (path: string) => path
 }));
 
+// Mock storage context — provide an API that delegates to the global fetch
+vi.mock('$lib/storage/context.js', () => ({
+  getStorageState: () => ({
+    get api() {
+      return {
+        preview: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>)),
+        archiveExtract: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>)),
+        saveText: (...args: unknown[]) =>
+          (globalThis.fetch as typeof fetch)(...(args as Parameters<typeof fetch>))
+      };
+    },
+    bucket: 'test-bucket'
+  })
+}));
+
 const defaultProps = {
   open: true,
   bucket: faker.word.noun(),
diff --git a/src/lib/components/storage/modals/RenameModal.svelte b/src/lib/components/storage/modals/RenameModal.svelte
index a05b8f0c..325b59bc 100644
--- a/src/lib/components/storage/modals/RenameModal.svelte
+++ b/src/lib/components/storage/modals/RenameModal.svelte
@@ -67,7 +67,7 @@
     <input
       bind:this={inputEl}
       id={uid + '-rename-input'}
-      class="input input-bordered input-sm w-full"
+      class="input input-sm w-full"
       bind:value={newName}
       onkeydown={handleKeydown}
       disabled={loading}
diff --git a/src/lib/components/storage/modals/StorageModals.svelte.spec.ts b/src/lib/components/storage/modals/StorageModals.svelte.spec.ts
index 877b38cf..cc8bcc6f 100644
--- a/src/lib/components/storage/modals/StorageModals.svelte.spec.ts
+++ b/src/lib/components/storage/modals/StorageModals.svelte.spec.ts
@@ -12,14 +12,7 @@ vi.mock('$app/paths', () => ({
 // Mock upload module
 vi.mock('$lib/storage/upload.js', () => ({
   checkObjectExists: vi.fn().mockResolvedValue(false),
-  uploadFile: vi.fn().mockResolvedValue(undefined),
-  UploadError: class UploadError extends Error {
-    code: string;
-    constructor(code: string, message: string) {
-      super(message);
-      this.code = code;
-    }
-  }
+  uploadFile: vi.fn().mockResolvedValue(undefined)
 }));
 
 function createMockStorageState(activeModal: unknown = null): StorageState {
diff --git a/src/lib/components/storage/modals/details/BucketDetails.svelte b/src/lib/components/storage/modals/details/BucketDetails.svelte
index 090ae28f..0a7768d4 100644
--- a/src/lib/components/storage/modals/details/BucketDetails.svelte
+++ b/src/lib/components/storage/modals/details/BucketDetails.svelte
@@ -4,8 +4,8 @@
   import IconInfo from 'virtual:icons/material-symbols/info';
   import IconPerson from 'virtual:icons/material-symbols/person';
   import IconKey from 'virtual:icons/material-symbols/key';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
-  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import { StorageError } from '$lib/storage/errors.js';
   import type { BucketDetails as BucketDetailsType } from '$lib/storage/details-types.js';
 
   interface Props {
@@ -14,6 +14,8 @@
 
   let { bucket }: Props = $props();
 
+  const storage = getStorageState();
+
   let loading = $state(true);
   let error = $state<string | null>(null);
   let details = $state<BucketDetailsType | null>(null);
@@ -24,24 +26,13 @@
 
     async function fetchDetails() {
       try {
-        const connectionId = connectionStore.activeConnectionId;
-        if (!connectionId) {
-          error = m.storage_details_error_not_connected();
-          loading = false;
-          return;
-        }
-        const params = new URLSearchParams({ bucket });
-        const res = await fetch(`/api/storage/bucket-details?${params}`, {
-          headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-        });
-        if (!res.ok) {
-          error = m.storage_details_error_fetch_bucket({ status: res.status });
-          loading = false;
-          return;
-        }
-        details = (await res.json()) as BucketDetailsType;
+        details = await storage.api.bucketDetails({ bucket });
       } catch (err) {
-        error = err instanceof Error ? err.message : m.storage_details_error_unknown();
+        if (err instanceof StorageError) {
+          error = err.message;
+        } else {
+          error = err instanceof Error ? err.message : m.storage_details_error_unknown();
+        }
       } finally {
         loading = false;
       }
diff --git a/src/lib/components/storage/modals/details/DirectoryDetails.svelte b/src/lib/components/storage/modals/details/DirectoryDetails.svelte
index e21d006e..1d173c30 100644
--- a/src/lib/components/storage/modals/details/DirectoryDetails.svelte
+++ b/src/lib/components/storage/modals/details/DirectoryDetails.svelte
@@ -3,8 +3,8 @@
   import IconCalculate from 'virtual:icons/material-symbols/calculate';
   import IconWarning from 'virtual:icons/material-symbols/warning';
   import { formatFileSize, keyToName } from '$lib/storage/utils.js';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
-  import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+  import { getStorageState } from '$lib/storage/context.js';
+  import { StorageError } from '$lib/storage/errors.js';
   import type {
     DirectorySizeEvent,
     DirectoryMetadata,
@@ -24,6 +24,8 @@
 
   let { key: objectKey, bucket, maximized = false }: Props = $props();
 
+  const storage = getStorageState();
+
   const prefix = $derived(objectKey.endsWith('/') ? objectKey : objectKey + '/');
 
   let tab: 'composition' | 'contents' = $state('composition');
@@ -47,19 +49,13 @@
 
   async function fetchMetadata() {
     try {
-      const connectionId = connectionStore.activeConnectionId;
-      if (!connectionId) return;
-      const params = new URLSearchParams({ bucket, prefix });
-      const res = await fetch(`/api/storage/directory-metadata?${params}`, {
-        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      });
-      if (!res.ok) {
-        metaError = m.storage_details_error_fetch_dir_meta({ status: res.status });
-        return;
-      }
-      meta = await res.json();
+      meta = await storage.api.directoryMetadata({ bucket, prefix });
     } catch (err) {
-      metaError = err instanceof Error ? err.message : m.storage_details_error_unknown();
+      if (err instanceof StorageError) {
+        metaError = err.message;
+      } else {
+        metaError = err instanceof Error ? err.message : m.storage_details_error_unknown();
+      }
     }
   }
 
@@ -74,16 +70,7 @@
     result = null;
 
     try {
-      const connectionId = connectionStore.activeConnectionId;
-      if (!connectionId) {
-        error = m.storage_details_error_not_connected();
-        calculating = false;
-        return;
-      }
-      const params = new URLSearchParams({ bucket, prefix });
-      const res = await fetch(`/api/storage/directory-size?${params}`, {
-        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      });
+      const res = await storage.api.directorySize({ bucket, prefix });
 
       if (!res.ok) {
         error = m.storage_details_error_calc_size({ status: res.status });
@@ -135,7 +122,11 @@
         }
       }
     } catch (err) {
-      error = err instanceof Error ? err.message : m.storage_details_error_unknown();
+      if (err instanceof StorageError) {
+        error = err.message;
+      } else {
+        error = err instanceof Error ? err.message : m.storage_details_error_unknown();
+      }
     } finally {
       calculating = false;
     }
diff --git a/src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts
index ac061992..9c26765e 100644
--- a/src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/PdfPreview.svelte.spec.ts
@@ -38,6 +38,7 @@ describe('PdfPreview', () => {
     const name = `${faker.system.fileName()}.pdf`;
     render(PdfPreview, { src: 'blob:http://localhost/id', name });
 
+    // eslint-disable-next-line security/detect-non-literal-regexp
     const iframe = page.getByTitle(new RegExp(name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')));
     await expect.element(iframe).toBeInTheDocument();
   });
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index 9a83bdd8..26a8ae19 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -6,7 +6,8 @@
   import IconCheckCircle from 'virtual:icons/material-symbols/check-circle';
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
-  import { checkObjectExists, uploadFile, UploadError } from '$lib/storage/upload.js';
+  import { checkObjectExists, uploadFile } from '$lib/storage/upload.js';
+  import { StorageError } from '$lib/storage/errors.js';
   import { formatFileSize } from '$lib/storage/utils.js';
   import { connectionStore } from '$lib/storage/connection-store.svelte.js';
   import { uploadConcurrency } from '$lib/client/feature-flags.js';
@@ -199,7 +200,7 @@
       );
     } catch (err) {
       const msg =
-        err instanceof UploadError ? mapUploadError(err) : m.storage_upload_error_unknown();
+        err instanceof StorageError ? mapUploadError(err) : m.storage_upload_error_unknown();
       entries = entries.map((e) =>
         e.id === entry.id ? { ...e, status: 'error' as const, errorMessage: msg } : e
       );
@@ -306,7 +307,7 @@
 
   // ── Error mapping ──────────────────────────────────────────────────────────
 
-  function mapUploadError(err: UploadError): string {
+  function mapUploadError(err: StorageError): string {
     switch (err.code) {
       case 'not_connected':
         return m.storage_upload_error_not_connected();
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
index 8753da1d..3d4ca814 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte.spec.ts
@@ -3,27 +3,18 @@ import { describe, expect, it, vi, beforeEach } from 'vitest';
 import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import UploadModal from './UploadModal.svelte';
+import { StorageError } from '$lib/storage/errors.js';
 
-const { mockCheckObjectExists, mockUploadFile, MockUploadError } = vi.hoisted(() => {
+const { mockCheckObjectExists, mockUploadFile } = vi.hoisted(() => {
   const mockCheckObjectExists = vi.fn().mockResolvedValue(false);
   const mockUploadFile = vi.fn().mockResolvedValue(undefined);
 
-  class MockUploadError extends Error {
-    code: string;
-    constructor(code: string, message: string) {
-      super(message);
-      this.code = code;
-      this.name = 'UploadError';
-    }
-  }
-
-  return { mockCheckObjectExists, mockUploadFile, MockUploadError };
+  return { mockCheckObjectExists, mockUploadFile };
 });
 
 vi.mock('$lib/storage/upload.js', () => ({
   checkObjectExists: mockCheckObjectExists,
-  uploadFile: mockUploadFile,
-  UploadError: MockUploadError
+  uploadFile: mockUploadFile
 }));
 
 // Provide a stable, isolated connection store so mutations from other test
@@ -333,7 +324,7 @@ describe('UploadModal', () => {
     });
 
     it('should show error state when upload fails with UploadError (access_denied)', async () => {
-      mockUploadFile.mockRejectedValue(new MockUploadError('access_denied', 'Access denied'));
+      mockUploadFile.mockRejectedValue(new StorageError('access_denied', 'Access denied'));
       render(UploadModal, defaultProps);
       await selectAndUpload([createFile('a.txt')]);
 
@@ -352,7 +343,7 @@ describe('UploadModal', () => {
     });
 
     it('should handle not_connected error', async () => {
-      mockUploadFile.mockRejectedValue(new MockUploadError('not_connected', 'Not connected'));
+      mockUploadFile.mockRejectedValue(new StorageError('not_connected', 'Not connected'));
       render(UploadModal, defaultProps);
       await selectAndUpload([createFile('a.txt')]);
 
@@ -361,7 +352,7 @@ describe('UploadModal', () => {
     });
 
     it('should handle no_such_bucket error', async () => {
-      mockUploadFile.mockRejectedValue(new MockUploadError('no_such_bucket', 'No such bucket'));
+      mockUploadFile.mockRejectedValue(new StorageError('no_such_bucket', 'No such bucket'));
       render(UploadModal, defaultProps);
       await selectAndUpload([createFile('a.txt')]);
 
@@ -370,7 +361,7 @@ describe('UploadModal', () => {
     });
 
     it('should handle invalid_part error', async () => {
-      mockUploadFile.mockRejectedValue(new MockUploadError('invalid_part', 'Invalid part'));
+      mockUploadFile.mockRejectedValue(new StorageError('invalid_part', 'Invalid part'));
       render(UploadModal, defaultProps);
       await selectAndUpload([createFile('a.txt')]);
 
@@ -379,7 +370,7 @@ describe('UploadModal', () => {
     });
 
     it('should handle server_error', async () => {
-      mockUploadFile.mockRejectedValue(new MockUploadError('server_error', 'Server error'));
+      mockUploadFile.mockRejectedValue(new StorageError('server_error', 'Server error'));
       render(UploadModal, defaultProps);
       await selectAndUpload([createFile('a.txt')]);
 
@@ -388,7 +379,7 @@ describe('UploadModal', () => {
     });
 
     it('should show error filename in error list', async () => {
-      mockUploadFile.mockRejectedValue(new MockUploadError('access_denied', 'Denied'));
+      mockUploadFile.mockRejectedValue(new StorageError('access_denied', 'Denied'));
       render(UploadModal, defaultProps);
       await selectAndUpload([createFile('secret.txt')]);
 
@@ -682,7 +673,7 @@ describe('UploadModal', () => {
       let callIdx = 0;
       mockUploadFile.mockImplementation(async () => {
         callIdx++;
-        if (callIdx === 2) throw new MockUploadError('access_denied', 'Denied');
+        if (callIdx === 2) throw new StorageError('access_denied', 'Denied');
       });
 
       render(UploadModal, defaultProps);
diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
index ece3d597..36f60f7f 100644
--- a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -10,7 +10,7 @@
   import * as m from '$lib/paraglide/messages.js';
   import type { ConnectionMetadata } from '$lib/server/storage/types.js';
   import DeleteConnectionModal from '$lib/components/storage/modals/DeleteConnectionModal.svelte';
-  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+  import type { SavedConnection } from '$lib/storage/connection-id-header.js';
 
   interface Props {
     /** List of saved connections from the server. */
diff --git a/src/lib/components/trino/StatementResult.svelte b/src/lib/components/trino/StatementResult.svelte
index ec9f2838..4e52609f 100644
--- a/src/lib/components/trino/StatementResult.svelte
+++ b/src/lib/components/trino/StatementResult.svelte
@@ -162,12 +162,14 @@
     {#if result.trinoQueryUrl || result.columns.length > 0}
       <div class="flex items-center gap-2 pb-1">
         {#if result.trinoQueryUrl}
+          <!-- eslint-disable svelte/no-navigation-without-resolve -->
           <a
             href={result.trinoQueryUrl}
             target="_blank"
             rel="noopener noreferrer"
             class="btn btn-ghost btn-xs"
           >
+            <!-- eslint-enable svelte/no-navigation-without-resolve -->
             {m.trino_view_in_trino()}
             <svg
               xmlns="http://www.w3.org/2000/svg"
diff --git a/src/lib/editor/completion/completion-history.ts b/src/lib/editor/completion/completion-history.ts
index 810f218d..7091e7b6 100644
--- a/src/lib/editor/completion/completion-history.ts
+++ b/src/lib/editor/completion/completion-history.ts
@@ -46,6 +46,7 @@ function loadHistory(): HistoryStore {
     const parsed = JSON.parse(raw) as Partial<HistoryStore>;
     const fresh = emptyStore();
     for (const category of Object.keys(fresh) as HistoryCategory[]) {
+      // eslint-disable-next-line security/detect-object-injection
       const list = parsed[category];
       if (Array.isArray(list)) {
         // Sanitize: strings only, deduped, capped.
@@ -53,7 +54,9 @@ function loadHistory(): HistoryStore {
         for (const name of list) {
           if (typeof name !== 'string' || seen.has(name)) continue;
           seen.add(name);
+          // eslint-disable-next-line security/detect-object-injection
           fresh[category].push(name);
+          // eslint-disable-next-line security/detect-object-injection
           if (fresh[category].length >= CAPS[category]) break;
         }
       }
@@ -82,11 +85,13 @@ function scheduleSave(): void {
  *  category. Moves it to the front of the LRU list and persists. */
 export function recordUse(category: HistoryCategory, name: string): void {
   const history = loadHistory();
+  // eslint-disable-next-line security/detect-object-injection
   const list = history[category];
   const index = list.indexOf(name);
   if (index === 0) return; // already at the head, nothing to do
   if (index > 0) list.splice(index, 1);
   list.unshift(name);
+  // eslint-disable-next-line security/detect-object-injection
   if (list.length > CAPS[category]) list.length = CAPS[category];
   scheduleSave();
 }
@@ -95,6 +100,7 @@ export function recordUse(category: HistoryCategory, name: string): void {
  *  present. The caller uses this to bias `sortText`. */
 export function rankOf(category: HistoryCategory, name: string): number | null {
   const history = loadHistory();
+  // eslint-disable-next-line security/detect-object-injection
   const index = history[category].indexOf(name);
   return index < 0 ? null : index;
 }
diff --git a/src/lib/editor/completion/cursor-context.ts b/src/lib/editor/completion/cursor-context.ts
index 1a9b6669..f6c6e6e6 100644
--- a/src/lib/editor/completion/cursor-context.ts
+++ b/src/lib/editor/completion/cursor-context.ts
@@ -38,6 +38,7 @@ function partsToAlias(parts: string[]): RelationAlias | null {
 /** If `pos` points at an `(`, skip past the matching `)` and return the
  *  position after it. Otherwise return `pos` unchanged. */
 function skipOptionalParenGroup(tokens: Token[], pos: number): number {
+  // eslint-disable-next-line security/detect-object-injection
   if (tokens[pos]?.type !== LPAREN) return pos;
   return parenGroupEndPosition(tokens, pos).pos;
 }
@@ -51,6 +52,7 @@ function skipOptionalParenGroup(tokens: Token[], pos: number): number {
 function cursorScopeTokens(tokens: Token[], cursor: number): Token[] | null {
   let pos = 0;
   while (pos < tokens.length) {
+    // eslint-disable-next-line security/detect-object-injection
     if (tokens[pos].type !== LPAREN) {
       pos++;
       continue;
@@ -65,6 +67,7 @@ function cursorScopeTokens(tokens: Token[], cursor: number): Token[] | null {
     }
 
     const { pos: end, closed } = parenGroupEndPosition(tokens, pos);
+    // eslint-disable-next-line security/detect-object-injection
     const openChar = tokens[pos].start;
 
     // Cursor is inside this body if it's past the opening `(` and either
@@ -97,6 +100,7 @@ export function extractPrefixAtCursor(
 ): { prefixParts: string[]; wordAtCursor: string } {
   // Step 1: find the last token that starts before the cursor.
   let pos = tokens.length - 1;
+  // eslint-disable-next-line security/detect-object-injection
   while (pos >= 0 && tokens[pos].start >= cursorInStatement) pos--;
   if (pos < 0) return { prefixParts: [], wordAtCursor: '' };
 
@@ -104,6 +108,7 @@ export function extractPrefixAtCursor(
   //   A) cursor is inside/at the end of an identifier → that's the partial word
   //   B) cursor is immediately after a dot → no word yet, prefix continues
   //   C) cursor is attached to something else (keyword, operator) → no prefix
+  // eslint-disable-next-line security/detect-object-injection
   const last = tokens[pos];
   const lastEndExclusive = last.stop + 1;
   const cursorTouchesLast = lastEndExclusive >= cursorInStatement;
@@ -124,6 +129,7 @@ export function extractPrefixAtCursor(
 
   // Step 3: walk backwards through (DOT IDENTIFIER)* pairs.
   const prefixParts: string[] = [];
+  // eslint-disable-next-line security/detect-object-injection
   while (pos >= 1 && tokens[pos].type === DOT && IDENTIFIER_TOKENS.has(tokens[pos - 1].type)) {
     prefixParts.unshift(unquoteIdentifier(tokens[pos - 1].text ?? ''));
     pos -= 2;
@@ -167,6 +173,7 @@ export function extractAliasMap(
   const aliasMap = new Map<string, RelationAlias>();
 
   for (let pos = 0; pos < tokens.length; pos++) {
+    // eslint-disable-next-line security/detect-object-injection
     const token = tokens[pos];
 
     // FROM / JOIN <qualifiedName> [[AS] alias]
@@ -179,8 +186,11 @@ export function extractAliasMap(
         // Lowercase for case-insensitive lookup.
         aliasMap.set(alias.table.toLowerCase(), alias);
         // Optional [AS] <identifier> follows the name.
+        // eslint-disable-next-line security/detect-object-injection
         if (tokens[next]?.type === SqlBaseLexer.AS) next++;
+        // eslint-disable-next-line security/detect-object-injection
         if (tokens[next] && IDENTIFIER_TOKENS.has(tokens[next].type)) {
+          // eslint-disable-next-line security/detect-object-injection
           const aliasName = unquoteIdentifier(tokens[next].text ?? '');
           aliasMap.set(aliasName.toLowerCase(), alias);
           next++;
@@ -194,16 +204,20 @@ export function extractAliasMap(
     // the JSDoc for why the body is skipped).
     if (token.type === SqlBaseLexer.WITH) {
       let next = pos + 1;
+      // eslint-disable-next-line security/detect-object-injection
       while (next < tokens.length && IDENTIFIER_TOKENS.has(tokens[next].type)) {
+        // eslint-disable-next-line security/detect-object-injection
         const cteName = unquoteIdentifier(tokens[next].text ?? '');
         aliasMap.set(cteName.toLowerCase(), { table: cteName });
         next++;
 
         next = skipOptionalParenGroup(tokens, next); // optional column list
+        // eslint-disable-next-line security/detect-object-injection
         if (tokens[next]?.type === SqlBaseLexer.AS) next++;
         next = skipOptionalParenGroup(tokens, next); // CTE body
 
         // Comma means another CTE follows; anything else ends the WITH list.
+        // eslint-disable-next-line security/detect-object-injection
         if (tokens[next]?.type !== COMMA) break;
         next++;
       }
diff --git a/src/lib/editor/completion/grammar-analysis.ts b/src/lib/editor/completion/grammar-analysis.ts
index 8df5de7b..f4ead299 100644
--- a/src/lib/editor/completion/grammar-analysis.ts
+++ b/src/lib/editor/completion/grammar-analysis.ts
@@ -63,6 +63,7 @@ const LITERAL_NAMES = (SqlBaseLexer as unknown as { literalNames: (string | null
 /** Map a keyword token type back to its canonical uppercase spelling.
  *  `literalNames` entries look like `"'SELECT'"` (SQL single-quoted). */
 function keywordForToken(tokenType: number): string | null {
+  // eslint-disable-next-line security/detect-object-injection
   const literal = LITERAL_NAMES[tokenType];
   if (!literal) return null;
   const match = /^'(.+)'$/.exec(literal);
@@ -158,6 +159,7 @@ function parseAndAnalyse(sql: string, extendingPrevious: boolean): GrammarAnalys
 function lastDefaultChannelTokenIndex(parser: SqlBaseParser): number {
   const tokens = (parser.inputStream as CommonTokenStream).getTokens();
   for (let i = tokens.length - 1; i >= 0; i--) {
+    // eslint-disable-next-line security/detect-object-injection
     const token = tokens[i];
     if (token.channel === Token.DEFAULT_CHANNEL && token.type !== SqlBaseLexer.EOF) {
       return token.tokenIndex;
diff --git a/src/lib/editor/lexer-utils.test.ts b/src/lib/editor/lexer-utils.test.ts
index 1100f54d..82f71c16 100644
--- a/src/lib/editor/lexer-utils.test.ts
+++ b/src/lib/editor/lexer-utils.test.ts
@@ -8,9 +8,13 @@ import { DOT, LPAREN, RPAREN, COMMA, lexSql, readQualifiedName } from './lexer-u
 describe('implicit token constants match the generated grammar', () => {
   const names = SqlBaseLexer.literalNames;
 
+  // eslint-disable-next-line security/detect-object-injection
   it('DOT is "."', () => expect(names[DOT]).toBe("'.'"));
+  // eslint-disable-next-line security/detect-object-injection
   it('LPAREN is "("', () => expect(names[LPAREN]).toBe("'('"));
+  // eslint-disable-next-line security/detect-object-injection
   it('RPAREN is ")"', () => expect(names[RPAREN]).toBe("')'"));
+  // eslint-disable-next-line security/detect-object-injection
   it('COMMA is ","', () => expect(names[COMMA]).toBe("','"));
 });
 
diff --git a/src/lib/editor/lexer-utils.ts b/src/lib/editor/lexer-utils.ts
index 9cc903e0..c0833830 100644
--- a/src/lib/editor/lexer-utils.ts
+++ b/src/lib/editor/lexer-utils.ts
@@ -46,7 +46,9 @@ export function parenGroupEndPosition(
   let depth = 1;
   let pos = start + 1;
   while (pos < tokens.length && depth > 0) {
+    // eslint-disable-next-line security/detect-object-injection
     if (tokens[pos].type === LPAREN) depth++;
+    // eslint-disable-next-line security/detect-object-injection
     else if (tokens[pos].type === RPAREN) depth--;
     pos++;
   }
@@ -74,12 +76,15 @@ export function readQualifiedName(
   const parts: string[] = [];
   let pos = start;
 
+  // eslint-disable-next-line security/detect-object-injection
   while (pos < tokens.length && IDENTIFIER_TOKENS.has(tokens[pos].type)) {
+    // eslint-disable-next-line security/detect-object-injection
     parts.push(unquoteIdentifier(tokens[pos].text ?? ''));
     pos++;
 
     // Continue only when a `DOT IDENTIFIER` pair follows. Anything else
     // (end of input, trailing dot, different token) ends the name.
+    // eslint-disable-next-line security/detect-object-injection
     const dotFollows = tokens[pos]?.type === DOT;
     const identAfterDot =
       tokens[pos + 1] !== undefined && IDENTIFIER_TOKENS.has(tokens[pos + 1].type);
diff --git a/src/lib/editor/split-statements.ts b/src/lib/editor/split-statements.ts
index 6e8d6090..3e6cd9c2 100644
--- a/src/lib/editor/split-statements.ts
+++ b/src/lib/editor/split-statements.ts
@@ -46,6 +46,7 @@ export function splitStatements(sql: string): SqlStatement[] {
   let depth = 0;
 
   for (let i = 0; i < tokens.length; i++) {
+    // eslint-disable-next-line security/detect-object-injection
     const token = tokens[i];
     const type = token.type;
 
@@ -110,7 +111,9 @@ export function getStatementAtOffset(sql: string, offset: number): SqlStatement
   // If cursor is between statements (on whitespace/semicolons), return the
   // previous statement so the user targets what they just finished typing.
   for (let i = statements.length - 1; i >= 0; i--) {
+    // eslint-disable-next-line security/detect-object-injection
     if (statements[i].endOffset <= offset) {
+      // eslint-disable-next-line security/detect-object-injection
       return statements[i];
     }
   }
diff --git a/src/lib/server/auth.ts b/src/lib/server/auth.ts
index d2df1322..de38ad69 100644
--- a/src/lib/server/auth.ts
+++ b/src/lib/server/auth.ts
@@ -73,6 +73,7 @@ export const auth = betterAuth({
                     email: profile.email || profile.preferred_username,
                     emailVerified: profile.email_verified ?? true,
                     image: profile.picture || null,
+                    // eslint-disable-next-line security/detect-object-injection
                     username: profile[usernameClaim] || profile.preferred_username || profile.email
                   };
                 }
diff --git a/src/lib/server/storage/archive.test.ts b/src/lib/server/storage/archive.test.ts
index a2f3a983..291324aa 100644
--- a/src/lib/server/storage/archive.test.ts
+++ b/src/lib/server/storage/archive.test.ts
@@ -43,6 +43,7 @@ function makeZip(path: string, entries: Record<string, string | Buffer>): void {
 function makeTar(path: string, entries: Record<string, string>): Promise<void> {
   return new Promise((resolve, reject) => {
     const pack = tar.pack();
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     const ws = createWriteStream(path);
     pack.pipe(ws);
     for (const [name, content] of Object.entries(entries)) {
@@ -58,6 +59,7 @@ function makeTarGz(path: string, entries: Record<string, string>): Promise<void>
   return new Promise((resolve, reject) => {
     const pack = tar.pack();
     const gz = createGzip();
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     const ws = createWriteStream(path);
     pack.pipe(gz).pipe(ws);
     for (const [name, content] of Object.entries(entries)) {
@@ -84,6 +86,7 @@ function makeNestedZip(): string {
 }
 
 const dummyDownloadFn: ArchiveDownloadFn = (key: string) => {
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
   const buf = readFileSync(key);
   return Promise.resolve(
     new ReadableStream({
@@ -141,12 +144,14 @@ describe('listArchiveContents', () => {
     clearArchiveCache();
     for (const p of cleanupPaths) {
       try {
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
         if (existsSync(p)) unlinkSync(p);
       } catch {
         /* noop */
       }
     }
     try {
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
       if (existsSync(testDir)) unlinkSync(testDir);
     } catch {
       /* noop */
diff --git a/src/lib/server/storage/archive.ts b/src/lib/server/storage/archive.ts
index 5cad51f3..f76c0ad1 100644
--- a/src/lib/server/storage/archive.ts
+++ b/src/lib/server/storage/archive.ts
@@ -53,6 +53,7 @@ const cleanupTimer = setInterval(() => {
     if (now > entry.expiresAt) {
       try {
         const dir = join(entry.path, '..');
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
         if (existsSync(dir)) rmRecursive(dir);
       } catch (err) {
         log.warn({ err, cache_key: cacheKey }, 'failed to clean up archive temp file');
@@ -70,6 +71,7 @@ function cacheKey(bucket: string, key: string): string {
 
 function getCachedPath(bucket: string, key: string): string | null {
   const entry = archiveCache.get(cacheKey(bucket, key));
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
   if (entry && Date.now() < entry.expiresAt && existsSync(entry.path)) {
     return entry.path;
   }
@@ -85,6 +87,7 @@ function streamToTempFile(stream: ReadableStream, ext: string): Promise<string>
   return new Promise<string>((resolve, reject) => {
     const tmpDir = mkdtempSync(join(tmpdir(), 'archive-'));
     const tmpPath = join(tmpDir, `archive${ext}`);
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     const writable = createWriteStream(tmpPath);
     const nodeStream = Readable.fromWeb(stream as import('stream/web').ReadableStream);
 
@@ -329,6 +332,7 @@ function listTar(
     });
     extract.on('error', reject);
 
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     createReadStream(tempPath).pipe(extract);
   });
 }
@@ -361,6 +365,7 @@ function extractTarEntry(tempPath: string, internalPath: string): Promise<Buffer
     extract.on('finish', () => resolve(found));
     extract.on('error', reject);
 
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     createReadStream(tempPath).pipe(extract);
   });
 }
@@ -401,6 +406,7 @@ function listTarGz(
     extract.on('error', reject);
     gunzip.on('error', reject);
 
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     createReadStream(tempPath).pipe(gunzip).pipe(extract);
   });
 }
@@ -435,6 +441,7 @@ function extractTarGzEntry(tempPath: string, internalPath: string): Promise<Buff
     extract.on('error', reject);
     gunzip.on('error', reject);
 
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     createReadStream(tempPath).pipe(gunzip).pipe(extract);
   });
 }
@@ -659,7 +666,9 @@ async function extract7zEntry(tempPath: string, internalPath: string): Promise<B
     if (!resolvedPath.startsWith(tmpDir + sep)) {
       throw new Error('Path traversal rejected');
     }
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     if (!existsSync(resolvedPath)) return null;
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
     return readFile(resolvedPath);
   } catch (err) {
     throw new Error('7z extraction failed: ' + (err instanceof Error ? err.message : String(err)));
@@ -705,6 +714,7 @@ async function resolveArchivePath(
   // Resolve nested archive — cache it under a composite key
   const nestedCacheKey = cacheKey(bucket, `${key}!/${nestedArchivePath}`);
   const cachedEntry = archiveCache.get(nestedCacheKey);
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
   if (cachedEntry && Date.now() < cachedEntry.expiresAt && existsSync(cachedEntry.path)) {
     return cachedEntry.path;
   }
@@ -745,6 +755,7 @@ async function resolveArchivePath(
   const nestedDir = mkdtempSync(join(tmpdir(), 'archive-nested-'));
   const nestedPath = join(nestedDir, `archive${nestedExt}`);
 
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
   writeFileSync(nestedPath, nestedData);
 
   archiveCache.set(nestedCacheKey, {
@@ -910,6 +921,7 @@ export function clearArchiveCache(): void {
   for (const [cacheKey, entry] of archiveCache) {
     try {
       const dir = join(entry.path, '..');
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
       if (existsSync(dir)) rmRecursive(dir);
     } catch {
       /* noop */
diff --git a/src/lib/server/storage/copy-move.ts b/src/lib/server/storage/copy-move.ts
new file mode 100644
index 00000000..f0ec852e
--- /dev/null
+++ b/src/lib/server/storage/copy-move.ts
@@ -0,0 +1,96 @@
+import type { StorageProvider } from './provider.js';
+import type pino from 'pino';
+import { json } from '@sveltejs/kit';
+import { processKeysSequentially } from './operations.js';
+import { createProgressStream, type StreamableOpResult } from './streaming.js';
+import { createJob } from './job-store.js';
+
+export interface PerformCopyOrMoveOptions {
+  provider: StorageProvider;
+  sourceKeys: string[];
+  destinationPrefix: string;
+  streamProgress: boolean;
+  logger: pino.Logger;
+  bucket: string;
+  jobId?: string;
+  deleteOriginals: boolean;
+}
+
+export async function performCopyOrMove(options: PerformCopyOrMoveOptions): Promise<Response> {
+  const {
+    provider,
+    sourceKeys,
+    destinationPrefix,
+    streamProgress,
+    logger,
+    bucket,
+    jobId,
+    deleteOriginals
+  } = options;
+
+  const operationName = deleteOriginals ? 'move' : 'copy';
+  const resultKey = deleteOriginals ? 'moved' : 'results';
+
+  if (!streamProgress) {
+    const { succeeded, failed } = await processKeysSequentially(
+      provider,
+      sourceKeys,
+      destinationPrefix,
+      { logger, bucket, deleteOriginals }
+    );
+    return json({ [resultKey]: succeeded, failed });
+  }
+
+  if (jobId) {
+    createJob(jobId);
+  }
+
+  const buildCompletePayload = deleteOriginals
+    ? (result: StreamableOpResult) => ({
+        type: 'complete' as const,
+        moved: result.results,
+        failed: result.failed
+      })
+    : undefined;
+
+  return createProgressStream(
+    async (emit) => {
+      const progressReported = new Set<string>();
+      const result = await processKeysSequentially(provider, sourceKeys, destinationPrefix, {
+        onCopyProgress: (sourceKey, destKey, loaded, total) => {
+          progressReported.add(sourceKey);
+          emit({ type: 'progress', sourceKey, destKey, loaded, total });
+        },
+        onCopySuccess: async (sourceKey, destKey) => {
+          if (!progressReported.has(sourceKey)) {
+            try {
+              const meta = await provider.getMetadata(sourceKey);
+              emit({ type: 'progress', sourceKey, destKey, loaded: meta.size, total: meta.size });
+            } catch {
+              // Metadata fetch failed — skip synthetic progress
+            }
+          }
+          progressReported.delete(sourceKey);
+          emit({ type: 'done', sourceKey, destKey });
+        },
+        onCopyFailed: (sourceKey, destKey, error) => {
+          emit({ type: 'failed', sourceKey, error });
+        },
+        onBeforeDelete: (keys) => {
+          emit({ type: 'status', message: `Deleting ${keys.length} original(s)` });
+        },
+        logger,
+        bucket,
+        deleteOriginals
+      });
+      return { results: result.succeeded, failed: result.failed };
+    },
+    {
+      jobId,
+      operationName,
+      logger,
+      bucket,
+      buildCompletePayload
+    }
+  );
+}
diff --git a/src/lib/server/storage/directory-tree.ts b/src/lib/server/storage/directory-tree.ts
new file mode 100644
index 00000000..80a808c5
--- /dev/null
+++ b/src/lib/server/storage/directory-tree.ts
@@ -0,0 +1,104 @@
+import type { TreemapNode, DirectoryChildItem } from '$lib/storage/details-types.js';
+
+function trieToTreemap(prefix: string, node: TrieNode): TreemapNode {
+  function convert(n: TrieNode, parentPrefix: string, isRoot: boolean): TreemapNode {
+    const result: TreemapNode = {
+      name: n.name,
+      size: n.size
+    };
+    if (n.children.size > 0) {
+      result.children = [...n.children.entries()]
+        .map(([, v]) => convert(v, isRoot ? '' : parentPrefix + n.name + '/', false))
+        .sort((a, b) => b.size - a.size);
+    } else {
+      result.path = parentPrefix || undefined;
+      result.fullKey = prefix + (parentPrefix || '') + n.name;
+    }
+    return result;
+  }
+  return convert(node, '', true);
+}
+
+interface TrieNode {
+  name: string;
+  size: number;
+  children: Map<string, TrieNode>;
+}
+
+export function buildTree(prefix: string, keys: Array<{ key: string; size: number }>): TreemapNode {
+  const rootName = prefix.split('/').filter(Boolean).pop() || '(root)';
+
+  const rootTrie: TrieNode = { name: rootName, size: 0, children: new Map() };
+
+  for (const { key, size } of keys) {
+    const relative = key.slice(prefix.length);
+    const parts = relative.split('/').filter(Boolean);
+    if (parts.length === 0) continue;
+
+    rootTrie.size += size;
+    let current = rootTrie;
+    for (let i = 0; i < parts.length; i++) {
+      // eslint-disable-next-line security/detect-object-injection
+      const part = parts[i];
+      if (!current.children.has(part)) {
+        current.children.set(part, { name: part, size: 0, children: new Map() });
+      }
+      current = current.children.get(part)!;
+      current.size += size;
+    }
+  }
+
+  return trieToTreemap(prefix, rootTrie);
+}
+
+export function buildChildrenByDepth(
+  prefix: string,
+  keys: Array<{ key: string; size: number; lastModified?: Date }>,
+  maxDepth: number
+): Record<number, DirectoryChildItem[]> {
+  const depthMaps: Map<string, { size: number; lastModified: Date | undefined }>[] = [];
+  for (let d = 1; d <= maxDepth; d++) {
+    depthMaps.push(new Map());
+  }
+
+  for (const { key, size, lastModified } of keys) {
+    const relative = key.slice(prefix.length);
+    const parts = relative.split('/').filter(Boolean);
+    if (parts.length === 0) continue;
+
+    for (let d = 1; d <= maxDepth; d++) {
+      if (parts.length < d) continue;
+
+      const nameParts = parts.slice(0, d);
+      const index = d - 1;
+      const isDir = index < parts.length - 1 || relative.endsWith('/');
+      const childName = isDir ? nameParts.join('/') + '/' : nameParts.join('/');
+
+      const map = depthMaps[d - 1];
+      const existing = map.get(childName);
+      if (existing) {
+        existing.size += size;
+        if (lastModified && (!existing.lastModified || lastModified > existing.lastModified)) {
+          existing.lastModified = lastModified;
+        }
+      } else {
+        map.set(childName, { size, lastModified });
+      }
+    }
+  }
+
+  const result: Record<number, DirectoryChildItem[]> = {};
+  for (let d = 1; d <= maxDepth; d++) {
+    // eslint-disable-next-line security/detect-object-injection
+    result[d] = [...depthMaps[d - 1].entries()]
+      .map(([name, entry]) => ({
+        name,
+        size: entry.size,
+        lastModified: entry.lastModified?.toISOString(),
+        isDirectory: name.endsWith('/')
+      }))
+      .sort((a, b) => b.size - a.size);
+  }
+
+  return result;
+}
diff --git a/src/lib/server/storage/operations.ts b/src/lib/server/storage/operations.ts
index 60f0e494..fb870fa3 100644
--- a/src/lib/server/storage/operations.ts
+++ b/src/lib/server/storage/operations.ts
@@ -1,10 +1,38 @@
 import type { StorageProvider } from './provider.js';
+import type pino from 'pino';
 
 export interface DestEntry {
   sourceKey: string;
   baseDestKey: string;
 }
 
+export interface ProcessKeysOptions {
+  onCopySuccess?: (sourceKey: string, destKey: string) => void | Promise<void>;
+  onCopyProgress?: (
+    sourceKey: string,
+    destKey: string,
+    loaded: number,
+    total: number
+  ) => void | Promise<void>;
+  onCopyFailed?: (
+    sourceKey: string,
+    destKey: string,
+    error: string,
+    errorName?: string,
+    stack?: string
+  ) => void | Promise<void>;
+  onBeforeDelete?: (keys: string[]) => void | Promise<void>;
+  onDeleteFailed?: (key: string, error: string) => void | Promise<void>;
+  logger?: pino.Logger;
+  bucket?: string;
+  deleteOriginals?: boolean;
+}
+
+export interface ProcessKeysResult {
+  succeeded: Array<{ sourceKey: string; destKey: string }>;
+  failed: Array<{ sourceKey: string; error: string }>;
+}
+
 /**
  * Compute copy/move destinations for each source key, expanding directories
  * to their full recursive listing while preserving the relative path
@@ -60,6 +88,99 @@ export async function uniqueDestKey(provider: StorageProvider, baseKey: string):
   }
 }
 
+/**
+ * Process a list of source keys sequentially, copying each to a unique
+ * destination under the given prefix. Handles unique-key resolution,
+ * optional progress reporting, failure logging, and originals deletion.
+ *
+ * This is the shared core used by both the non-streaming and streaming
+ * code paths in copy-move operations.
+ */
+export async function processKeysSequentially(
+  provider: StorageProvider,
+  sourceKeys: string[],
+  destinationPrefix: string,
+  options: ProcessKeysOptions = {}
+): Promise<ProcessKeysResult> {
+  const {
+    onCopySuccess,
+    onCopyProgress,
+    onCopyFailed,
+    onBeforeDelete,
+    onDeleteFailed,
+    logger,
+    bucket,
+    deleteOriginals
+  } = options;
+
+  const destinations = await computeDestinations(provider, sourceKeys, destinationPrefix);
+  const succeeded: Array<{ sourceKey: string; destKey: string }> = [];
+  const failed: Array<{ sourceKey: string; error: string }> = [];
+
+  const operationName = deleteOriginals ? 'move' : 'copy';
+  const countKey = deleteOriginals ? 'moved' : 'copied';
+  const failMsg = deleteOriginals ? 'move copy failed for key' : 'copy failed for key';
+
+  for (const { sourceKey, baseDestKey } of destinations) {
+    try {
+      const destKey = await uniqueDestKey(provider, baseDestKey);
+      if (onCopyProgress) {
+        await provider.copyObject(sourceKey, destKey, (loaded, total) => {
+          onCopyProgress(sourceKey, destKey, loaded, total);
+        });
+      } else {
+        await provider.copyObject(sourceKey, destKey);
+      }
+      succeeded.push({ sourceKey, destKey });
+      await onCopySuccess?.(sourceKey, destKey);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      const errorName = err instanceof Error ? err.constructor.name : typeof err;
+      const stack =
+        err instanceof Error ? (err.stack ?? '').split('\n').slice(0, 3).join(' | ') : '';
+      failed.push({ sourceKey, error: message });
+      if (logger) {
+        logger.warn(
+          {
+            bucket,
+            source_key: sourceKey,
+            dest_key: baseDestKey,
+            error: message,
+            error_name: errorName,
+            stack
+          },
+          failMsg
+        );
+      }
+      await onCopyFailed?.(sourceKey, baseDestKey, message, errorName, stack);
+    }
+  }
+
+  if (deleteOriginals && succeeded.length > 0) {
+    const keysToDelete = [...new Set(succeeded.map((s) => s.sourceKey))];
+    if (keysToDelete.length > 0) {
+      await onBeforeDelete?.(keysToDelete);
+      const deleteResult = await provider.deleteObjects(keysToDelete);
+      for (const f of deleteResult.failed) {
+        failed.push({ sourceKey: f.key, error: f.message ?? 'Delete failed' });
+        if (logger) {
+          logger.warn({ bucket, key: f.key }, 'move delete failed for key');
+        }
+        await onDeleteFailed?.(f.key, f.message ?? 'Delete failed');
+      }
+    }
+  }
+
+  if (logger) {
+    logger.info(
+      { bucket, [countKey]: succeeded.length, failed: failed.length },
+      `${operationName} completed`
+    );
+  }
+
+  return { succeeded, failed };
+}
+
 /**
  * Encode a value as a single NDJSON line (newline-delimited JSON).
  */
diff --git a/src/lib/server/storage/preview/csv.ts b/src/lib/server/storage/preview/csv.ts
index 518676f5..4649d3b4 100644
--- a/src/lib/server/storage/preview/csv.ts
+++ b/src/lib/server/storage/preview/csv.ts
@@ -56,6 +56,7 @@ function parseCsvRow(line: string): string[] {
   let current = '';
   let inQuotes = false;
   for (let i = 0; i < line.length; i++) {
+    // eslint-disable-next-line security/detect-object-injection
     const char = line[i];
     if (inQuotes) {
       if (char === '"') {
@@ -119,14 +120,17 @@ async function extendCache(
     }
     for (let i = 1; i < lines.length; i++) {
       entry.lineOffsets.push(bytePos);
+      // eslint-disable-next-line security/detect-object-injection
       bytePos += lines[i].length + 1;
     }
   } else {
     let bytePos = entry.bytesRead;
     for (let i = 0; i < lines.length; i++) {
+      // eslint-disable-next-line security/detect-object-injection
       if (lines[i].length > 0 || i < lines.length - 1) {
         entry.lineOffsets.push(bytePos);
       }
+      // eslint-disable-next-line security/detect-object-injection
       bytePos += lines[i].length + 1;
     }
   }
@@ -143,8 +147,10 @@ async function readRows(
   startOffset: number,
   endOffset: number
 ): Promise<string[][]> {
+  // eslint-disable-next-line security/detect-object-injection
   const startByte = entry.lineOffsets[startOffset];
   const endByte =
+    // eslint-disable-next-line security/detect-object-injection
     endOffset < entry.lineOffsets.length ? entry.lineOffsets[endOffset] - 1 : entry.bytesRead - 1;
 
   if (startByte === undefined || startByte < 0) return [];
diff --git a/src/lib/server/storage/preview/parquet.test.ts b/src/lib/server/storage/preview/parquet.test.ts
index 2598a45b..0db3f3a8 100644
--- a/src/lib/server/storage/preview/parquet.test.ts
+++ b/src/lib/server/storage/preview/parquet.test.ts
@@ -145,7 +145,9 @@ async function readNdjsonResponse(res: Response): Promise<{
           rows.push(new Array(resultHeaders.length).fill(undefined));
         }
         for (let i = 0; i < values.length; i++) {
+          // eslint-disable-next-line security/detect-object-injection
           if (!rows[i]) rows[i] = new Array(resultHeaders.length).fill(undefined);
+          // eslint-disable-next-line security/detect-object-injection
           rows[i][colIdx] = values[i];
         }
       } else if (msg.t === 'e') {
diff --git a/src/lib/server/storage/request-context.ts b/src/lib/server/storage/request-context.ts
new file mode 100644
index 00000000..f854b4ce
--- /dev/null
+++ b/src/lib/server/storage/request-context.ts
@@ -0,0 +1,26 @@
+import { error } from '@sveltejs/kit';
+import type { RequestEvent } from '@sveltejs/kit';
+import { getProvider } from './utils.js';
+import { wrapProvider } from './wrap-provider.js';
+import type { StorageProvider } from './provider.js';
+
+export function requireBucket(event: RequestEvent): string {
+  const bucket = event.url.searchParams.get('bucket')?.trim();
+  if (!bucket) throw error(400, 'Missing required query parameter: bucket');
+  return bucket;
+}
+
+export function requireConfig(event: RequestEvent) {
+  const config = event.locals.storageConfig;
+  if (!config) throw error(401, 'No storage connection configured');
+  return config;
+}
+
+export function createStorageProvider(event: RequestEvent): {
+  provider: StorageProvider;
+  bucket: string;
+} {
+  const config = requireConfig(event);
+  const bucket = requireBucket(event);
+  return { provider: wrapProvider(getProvider(config, bucket)), bucket };
+}
diff --git a/src/lib/server/storage/service.ts b/src/lib/server/storage/service.ts
deleted file mode 100644
index 55a131ec..00000000
--- a/src/lib/server/storage/service.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import { getProvider } from './utils.js';
-import type { ObjectDownload } from './provider.js';
-import type { StorageMetadata } from '$lib/storage/types.js';
-import type { S3ConnectionConfig, StorageConfig } from './types.js';
-
-export async function uploadObject(
-  config: StorageConfig | S3ConnectionConfig,
-  bucket: string,
-  key: string,
-  body: Buffer,
-  contentType: string,
-  contentLength: number
-): Promise<void> {
-  const provider = getProvider(config, bucket);
-  await provider.putObject(key, body, contentType, contentLength);
-}
-
-export async function downloadObject(
-  config: StorageConfig | S3ConnectionConfig,
-  bucket: string,
-  key: string
-): Promise<ObjectDownload> {
-  const provider = getProvider(config, bucket);
-  return provider.getObject(key);
-}
-
-export async function getObjectMetadata(
-  config: StorageConfig | S3ConnectionConfig,
-  bucket: string,
-  key: string
-): Promise<StorageMetadata> {
-  const provider = getProvider(config, bucket);
-  return provider.getMetadata(key);
-}
diff --git a/src/lib/server/storage/wrap-provider.ts b/src/lib/server/storage/wrap-provider.ts
new file mode 100644
index 00000000..d37d471d
--- /dev/null
+++ b/src/lib/server/storage/wrap-provider.ts
@@ -0,0 +1,28 @@
+import { error, isHttpError } from '@sveltejs/kit';
+import type { StorageProvider } from './provider.js';
+
+export function wrapProvider(raw: StorageProvider): StorageProvider {
+  return new Proxy(raw, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (typeof value === 'function') {
+        return (...args: unknown[]) => {
+          try {
+            const result = value.apply(target, args);
+            if (result instanceof Promise) {
+              return result.catch((err: unknown) => {
+                if (isHttpError(err)) throw err;
+                throw error(502, err instanceof Error ? err.message : 'Storage provider error');
+              });
+            }
+            return result;
+          } catch (err) {
+            if (isHttpError(err)) throw err;
+            throw error(502, err instanceof Error ? err.message : 'Storage provider error');
+          }
+        };
+      }
+      return value;
+    }
+  });
+}
diff --git a/src/lib/server/trino/client.ts b/src/lib/server/trino/client.ts
index 13efe456..95287843 100644
--- a/src/lib/server/trino/client.ts
+++ b/src/lib/server/trino/client.ts
@@ -158,6 +158,7 @@ if (trinoConfigured) {
     dispatcher = new Agent({
       connect: {
         rejectUnauthorized: !tlsInsecure,
+        // eslint-disable-next-line security/detect-non-literal-fs-filename
         ...(tlsCaCertPath ? { ca: readFileSync(tlsCaCertPath) } : {})
       }
     });
diff --git a/src/lib/server/trino/queries.ts b/src/lib/server/trino/queries.ts
index 0a717406..46dc300f 100644
--- a/src/lib/server/trino/queries.ts
+++ b/src/lib/server/trino/queries.ts
@@ -255,6 +255,7 @@ export function getAllQuerySummaries(userId: string): Record<string, QuerySnapsh
   const trinoServerUrl = resolveTrinoServerUrl(userId);
   const result: Record<string, QuerySnapshot[]> = {};
   for (const [tabId, queries] of tabMap) {
+    // eslint-disable-next-line security/detect-object-injection
     result[tabId] = queries.map((q) => buildSnapshot(q, trinoServerUrl, true));
   }
   return result;
diff --git a/src/lib/storage/api.spec.ts b/src/lib/storage/api.spec.ts
new file mode 100644
index 00000000..fae3380f
--- /dev/null
+++ b/src/lib/storage/api.spec.ts
@@ -0,0 +1,543 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createFetchStorageApi } from './api.js';
+import { StorageError } from './errors.js';
+import { STORAGE_CONNECTION_ID_HEADER } from './connection-id-header.js';
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function jsonResponse(data: unknown, opts?: { status?: number }): Response {
+  return new Response(JSON.stringify(data), {
+    status: opts?.status ?? 200,
+    headers: { 'Content-Type': 'application/json' }
+  });
+}
+
+function ndjsonResponse(lines: string[]): Response {
+  const encoder = new TextEncoder();
+  const stream = new ReadableStream({
+    start(controller) {
+      controller.enqueue(encoder.encode(lines.join('\n') + '\n'));
+      controller.close();
+    }
+  });
+  return new Response(stream, {
+    status: 200,
+    headers: { 'Content-Type': 'application/x-ndjson' }
+  });
+}
+
+function makeNdjsonLines(data: {
+  results?: Array<{ sourceKey: string; destKey: string }>;
+  moved?: Array<{ sourceKey: string; destKey: string }>;
+  failed?: Array<{ sourceKey: string; error: string }>;
+}): string[] {
+  const items = data.results ?? data.moved ?? [];
+  const lines: string[] = [];
+  for (const r of items) {
+    lines.push(JSON.stringify({ type: 'done', sourceKey: r.sourceKey, destKey: r.destKey }));
+  }
+  for (const f of data.failed ?? []) {
+    lines.push(JSON.stringify({ type: 'failed', sourceKey: f.sourceKey, error: f.error }));
+  }
+  lines.push(
+    JSON.stringify({
+      type: 'complete',
+      results: items,
+      failed: data.failed ?? []
+    })
+  );
+  return lines;
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+beforeEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe('createFetchStorageApi', () => {
+  describe('list', () => {
+    it('fetches objects for a bucket', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const page = {
+        objects: [
+          {
+            key: 'file.txt',
+            size: 100,
+            lastModified: new Date().toISOString(),
+            isDirectory: false,
+            contentType: 'text/plain'
+          }
+        ],
+        hasNextPage: false,
+        currentPage: 1,
+        pageSize: 25
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(page));
+
+      const result = await api.list({ bucket: 'my-bucket' });
+
+      expect(result.objects).toHaveLength(1);
+      expect(result.objects[0].key).toBe('file.txt');
+    });
+
+    it('includes prefix and pageSize in the URL', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        jsonResponse({ objects: [], hasNextPage: false, currentPage: 1, pageSize: 100 })
+      );
+
+      await api.list({ bucket: 'b', prefix: 'docs/', pageSize: 100 });
+
+      const url = vi.mocked(globalThis.fetch).mock.calls[0]![0] as string;
+      expect(url).toContain('bucket=b');
+      expect(url).toContain('prefix=docs%2F');
+      expect(url).toContain('pageSize=100');
+    });
+
+    it('sets the connection ID header', async () => {
+      const api = createFetchStorageApi(() => 'conn-42');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        jsonResponse({ objects: [], hasNextPage: false, currentPage: 1, pageSize: 25 })
+      );
+
+      await api.list({ bucket: 'b' });
+
+      const [, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      const headers = new Headers(init?.headers);
+      expect(headers.get(STORAGE_CONNECTION_ID_HEADER)).toBe('conn-42');
+    });
+
+    it('throws StorageError when disconnected', async () => {
+      const api = createFetchStorageApi(() => null);
+
+      await expect(api.list({ bucket: 'b' })).rejects.toThrow(StorageError);
+      await expect(api.list({ bucket: 'b' })).rejects.toMatchObject({ code: 'not_connected' });
+    });
+
+    it('throws StorageError on server error', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(null, { status: 500 }));
+
+      await expect(api.list({ bucket: 'b' })).rejects.toMatchObject({ code: 'server_error' });
+    });
+  });
+
+  describe('copy', () => {
+    it('sends a POST request with JSON body', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const copyResult = {
+        results: [{ sourceKey: 'a.txt', destKey: 'dest/a.txt' }],
+        failed: []
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(copyResult));
+
+      const result = await api.copy({
+        bucket: 'my-bucket',
+        sourceKeys: ['a.txt'],
+        destinationPrefix: 'dest/'
+      });
+
+      expect(result.results).toHaveLength(1);
+      expect(result.failed).toBe(0);
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/copy');
+      expect(url).toContain('bucket=my-bucket');
+      expect(init?.method).toBe('POST');
+      const body = JSON.parse(init?.body as string);
+      expect(body.sourceKeys).toEqual(['a.txt']);
+      expect(body.destinationPrefix).toBe('dest/');
+    });
+
+    it('uses NDJSON streaming when progress=true', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const lines = makeNdjsonLines({
+        results: [{ sourceKey: 'a.txt', destKey: 'dest/a.txt' }]
+      });
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(ndjsonResponse(lines));
+
+      const result = await api.copy({
+        bucket: 'my-bucket',
+        sourceKeys: ['a.txt'],
+        destinationPrefix: 'dest/',
+        progress: true
+      });
+
+      expect(result.results).toHaveLength(1);
+      expect(result.results[0].sourceKey).toBe('a.txt');
+      expect(result.failed).toBe(0);
+    });
+
+    it('includes jobId in the request body when provided', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ results: [], failed: [] }));
+
+      await api.copy({
+        bucket: 'b',
+        sourceKeys: ['x.txt'],
+        destinationPrefix: 'd/',
+        jobId: 'job-123'
+      });
+
+      const [, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      const body = JSON.parse(init?.body as string);
+      expect(body.jobId).toBe('job-123');
+    });
+
+    it('forwards AbortSignal', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ results: [], failed: [] }));
+      const controller = new AbortController();
+
+      await api.copy({
+        bucket: 'b',
+        sourceKeys: ['x.txt'],
+        destinationPrefix: 'd/',
+        signal: controller.signal
+      });
+
+      const [, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(init?.signal).toBe(controller.signal);
+    });
+  });
+
+  describe('move', () => {
+    it('sends a POST to /api/storage/move', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        jsonResponse({ moved: [{ sourceKey: 'a.txt', destKey: 'dest/a.txt' }], failed: [] })
+      );
+
+      const result = await api.move({
+        bucket: 'b',
+        sourceKeys: ['a.txt'],
+        destinationPrefix: 'dest/'
+      });
+
+      const [url] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/move');
+      expect(result.results).toHaveLength(1);
+      expect(result.results[0].sourceKey).toBe('a.txt');
+    });
+
+    it('uses NDJSON streaming when progress=true', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const lines = makeNdjsonLines({
+        results: [{ sourceKey: 'a.txt', destKey: 'dest/a.txt' }]
+      });
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(ndjsonResponse(lines));
+
+      const result = await api.move({
+        bucket: 'b',
+        sourceKeys: ['a.txt'],
+        destinationPrefix: 'dest/',
+        progress: true
+      });
+
+      expect(result.results).toHaveLength(1);
+      expect(result.failed).toBe(0);
+    });
+
+    it('reports failed items from NDJSON stream', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const lines = makeNdjsonLines({
+        failed: [{ sourceKey: 'bad.txt', error: 'Access denied' }]
+      });
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(ndjsonResponse(lines));
+
+      const result = await api.move({
+        bucket: 'b',
+        sourceKeys: ['bad.txt'],
+        destinationPrefix: 'dest/',
+        progress: true
+      });
+
+      expect(result.results).toHaveLength(0);
+      expect(result.failed).toBe(1);
+    });
+  });
+
+  describe('rename', () => {
+    it('sends a POST with key and newKey', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 200 }));
+
+      await api.rename({ bucket: 'b', key: 'old.txt', newKey: 'new.txt' });
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/rename');
+      expect(url).toContain('bucket=b');
+      expect(init?.method).toBe('POST');
+      const body = JSON.parse(init?.body as string);
+      expect(body).toEqual({ key: 'old.txt', newKey: 'new.txt' });
+    });
+
+    it('throws on non-ok response', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 409 }));
+
+      await expect(api.rename({ bucket: 'b', key: 'a', newKey: 'b' })).rejects.toThrow(
+        StorageError
+      );
+    });
+  });
+
+  describe('delete', () => {
+    it('sends DELETE with keys as repeated query params', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse({ failed: [] }));
+
+      const result = await api.delete({ bucket: 'b', keys: ['a.txt', 'b.txt'] });
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/delete');
+      expect(url).toContain('bucket=b');
+      expect(url).toContain('keys=a.txt');
+      expect(url).toContain('keys=b.txt');
+      expect(init?.method).toBe('DELETE');
+      expect(result.failed).toEqual([]);
+    });
+
+    it('returns failed items from the server response', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        jsonResponse({
+          failed: [{ key: 'locked.txt', code: 'access_denied', message: 'No access' }]
+        })
+      );
+
+      const result = await api.delete({ bucket: 'b', keys: ['locked.txt'] });
+      expect(result.failed).toHaveLength(1);
+      expect(result.failed[0].key).toBe('locked.txt');
+    });
+  });
+
+  describe('create', () => {
+    it('sends POST with bucket and key', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 200 }));
+
+      await api.create({ bucket: 'b', key: 'new-folder/' });
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/create');
+      expect(url).toContain('bucket=b');
+      expect(url).toContain('key=new-folder%2F');
+      expect(init?.method).toBe('POST');
+    });
+  });
+
+  describe('archiveExtract', () => {
+    it('returns raw Response for blob download', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const fakeBody = new ReadableStream();
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(fakeBody, { status: 200 }));
+
+      const res = await api.archiveExtract({ bucket: 'b', key: 'archive.zip', path: 'file.txt' });
+
+      expect(res).toBeInstanceOf(Response);
+      const [url] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/archive/extract');
+      expect(url).toContain('bucket=b');
+      expect(url).toContain('key=archive.zip');
+      expect(url).toContain('path=file.txt');
+    });
+
+    it('includes nestedArchivePath when provided', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 200 }));
+
+      await api.archiveExtract({
+        bucket: 'b',
+        key: 'outer.zip',
+        path: 'inner.zip/file.txt',
+        nestedArchivePath: 'inner.zip'
+      });
+
+      const [url] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('nestedArchivePath=inner.zip');
+    });
+  });
+
+  describe('archiveListing', () => {
+    it('returns parsed archive listing', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const listing = {
+        entries: [
+          { key: 'file.txt', size: 100, lastModified: new Date().toISOString(), isDirectory: false }
+        ],
+        hasMore: false
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(listing));
+
+      const result = await api.archiveListing({ bucket: 'b', key: 'archive.zip' });
+
+      expect(result.entries).toHaveLength(1);
+      expect(result.entries[0].key).toBe('file.txt');
+      expect(result.hasMore).toBe(false);
+    });
+
+    it('includes internalPrefix and nestedArchivePath', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+        jsonResponse({ entries: [], hasMore: false })
+      );
+
+      await api.archiveListing({
+        bucket: 'b',
+        key: 'archive.zip',
+        internalPrefix: 'subdir/',
+        nestedArchivePath: 'inner.zip'
+      });
+
+      const [url] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('internalPrefix=subdir%2F');
+      expect(url).toContain('nestedArchivePath=inner.zip');
+    });
+  });
+
+  describe('pollJob', () => {
+    it('fetches job status by ID', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      const job = {
+        status: 'running',
+        progress: { completedBytes: 1024, currentFileName: 'data.bin' }
+      };
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(jsonResponse(job));
+
+      const result = await api.pollJob('job-abc');
+
+      expect(result.status).toBe('running');
+      expect(result.progress?.completedBytes).toBe(1024);
+      const [url] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/copy/job/job-abc');
+    });
+  });
+
+  describe('checkObjectExists', () => {
+    it('returns true for a successful HEAD request', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 200 }));
+
+      const exists = await api.checkObjectExists({ bucket: 'b', key: 'file.txt' });
+      expect(exists).toBe(true);
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/download');
+      expect(url).toContain('bucket=b');
+      expect(url).toContain('key=file.txt');
+      expect(init?.method).toBe('HEAD');
+    });
+
+    it('returns false for a 404 HEAD response', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 404 }));
+
+      const exists = await api.checkObjectExists({ bucket: 'b', key: 'missing.txt' });
+      expect(exists).toBe(false);
+    });
+
+    it('returns false when disconnected', async () => {
+      const api = createFetchStorageApi(() => null);
+
+      const exists = await api.checkObjectExists({ bucket: 'b', key: 'file.txt' });
+      expect(exists).toBe(false);
+    });
+  });
+});
+
+describe('NDJSON streaming via copy', () => {
+  it('calls onProgress callback during streaming', async () => {
+    const api = createFetchStorageApi(() => 'conn-1');
+    const onProgress = vi.fn();
+    const lines = [
+      JSON.stringify({
+        type: 'progress',
+        sourceKey: 'big.bin',
+        destKey: 'dest/big.bin',
+        loaded: 50,
+        total: 100
+      }),
+      JSON.stringify({
+        type: 'progress',
+        sourceKey: 'big.bin',
+        destKey: 'dest/big.bin',
+        loaded: 100,
+        total: 100
+      }),
+      JSON.stringify({ type: 'done', sourceKey: 'big.bin', destKey: 'dest/big.bin' }),
+      JSON.stringify({
+        type: 'complete',
+        results: [{ sourceKey: 'big.bin', destKey: 'dest/big.bin' }],
+        failed: []
+      })
+    ];
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(ndjsonResponse(lines));
+
+    await api.copy({
+      bucket: 'b',
+      sourceKeys: ['big.bin'],
+      destinationPrefix: 'dest/',
+      progress: true,
+      callbacks: { onProgress }
+    });
+
+    expect(onProgress).toHaveBeenCalledTimes(2);
+    expect(onProgress).toHaveBeenCalledWith('big.bin', 'dest/big.bin', 50, 100);
+    expect(onProgress).toHaveBeenCalledWith('big.bin', 'dest/big.bin', 100, 100);
+  });
+
+  it('calls onDone callback for each completed item', async () => {
+    const api = createFetchStorageApi(() => 'conn-1');
+    const onDone = vi.fn();
+    const lines = [
+      JSON.stringify({ type: 'done', sourceKey: 'a.txt', destKey: 'dest/a.txt' }),
+      JSON.stringify({ type: 'done', sourceKey: 'b.txt', destKey: 'dest/b.txt' }),
+      JSON.stringify({
+        type: 'complete',
+        results: [
+          { sourceKey: 'a.txt', destKey: 'dest/a.txt' },
+          { sourceKey: 'b.txt', destKey: 'dest/b.txt' }
+        ],
+        failed: []
+      })
+    ];
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(ndjsonResponse(lines));
+
+    await api.copy({
+      bucket: 'b',
+      sourceKeys: ['a.txt', 'b.txt'],
+      destinationPrefix: 'dest/',
+      progress: true,
+      callbacks: { onDone }
+    });
+
+    expect(onDone).toHaveBeenCalledTimes(2);
+    expect(onDone).toHaveBeenCalledWith('a.txt', 'dest/a.txt');
+    expect(onDone).toHaveBeenCalledWith('b.txt', 'dest/b.txt');
+  });
+
+  it('calls onComplete with aggregated results', async () => {
+    const api = createFetchStorageApi(() => 'conn-1');
+    const onComplete = vi.fn();
+    const lines = makeNdjsonLines({
+      results: [{ sourceKey: 'a.txt', destKey: 'dest/a.txt' }],
+      failed: [{ sourceKey: 'b.txt', error: 'Permission denied' }]
+    });
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(ndjsonResponse(lines));
+
+    await api.copy({
+      bucket: 'b',
+      sourceKeys: ['a.txt', 'b.txt'],
+      destinationPrefix: 'dest/',
+      progress: true,
+      callbacks: { onComplete }
+    });
+
+    expect(onComplete).toHaveBeenCalledOnce();
+    const [results, failed] = onComplete.mock.calls[0]!;
+    expect(results).toHaveLength(1);
+    expect(failed).toHaveLength(1);
+  });
+});
diff --git a/src/lib/storage/api.test-utils.ts b/src/lib/storage/api.test-utils.ts
new file mode 100644
index 00000000..994fe68b
--- /dev/null
+++ b/src/lib/storage/api.test-utils.ts
@@ -0,0 +1,106 @@
+/**
+ * In-memory StorageApi implementation for unit tests.
+ *
+ * Provides sensible defaults (empty list, no-op mutations) and allows
+ * overriding any method via the `overrides` parameter.
+ *
+ * Usage:
+ *   const api = createMemoryStorageApi({
+ *     list: async () => ({ objects: [mockFile], hasNextPage: false, ... }),
+ *   });
+ */
+
+import type { StorageApi, CopyMoveResult, DeleteResult, JobStatus } from './api.js';
+import type { StoragePage, ArchiveListingResponse } from './types.js';
+import type { FileDetails, DirectoryMetadata, BucketDetails } from './details-types.js';
+
+const emptyPage: StoragePage = {
+  objects: [],
+  hasNextPage: false,
+  currentPage: 1,
+  pageSize: 25
+};
+
+/**
+ * Create an in-memory `StorageApi` backed by sensible defaults.
+ *
+ * Every method returns a safe no-op value by default. Pass an `overrides`
+ * object to replace any subset of methods with custom behaviour.
+ */
+export function createMemoryStorageApi(overrides?: Partial<StorageApi>): StorageApi {
+  const defaults: StorageApi = {
+    async list() {
+      return emptyPage;
+    },
+
+    async copy(): Promise<CopyMoveResult> {
+      return { results: [], failed: 0 };
+    },
+
+    async move(): Promise<CopyMoveResult> {
+      return { results: [], failed: 0 };
+    },
+
+    async rename() {
+      // no-op
+    },
+
+    async delete(): Promise<DeleteResult> {
+      return { failed: [] };
+    },
+
+    async create() {
+      // no-op
+    },
+
+    async archiveExtract() {
+      return new Response(null, { status: 200 });
+    },
+
+    async archiveListing(): Promise<ArchiveListingResponse> {
+      return { entries: [], hasMore: false };
+    },
+
+    async pollJob(): Promise<JobStatus> {
+      return { status: 'done' };
+    },
+
+    async checkObjectExists() {
+      return false;
+    },
+
+    async preview() {
+      return new Response(null, { status: 200 });
+    },
+
+    async saveText() {
+      // no-op
+    },
+
+    async details(): Promise<FileDetails> {
+      return {} as FileDetails;
+    },
+
+    async directoryMetadata(): Promise<DirectoryMetadata> {
+      return {} as DirectoryMetadata;
+    },
+
+    async directorySize() {
+      return new Response(null, { status: 200 });
+    },
+
+    async bucketDetails(): Promise<BucketDetails> {
+      return {} as BucketDetails;
+    },
+
+    async checkBucket() {
+      return { ok: true, status: 200 };
+    },
+
+    async updateConnections() {
+      // no-op
+    }
+  };
+
+  return { ...defaults, ...overrides };
+}
diff --git a/src/lib/storage/api.ts b/src/lib/storage/api.ts
new file mode 100644
index 00000000..8e4caf3a
--- /dev/null
+++ b/src/lib/storage/api.ts
@@ -0,0 +1,326 @@
+/**
+ * Typed StorageApi interface and factory.
+ *
+ * Provides a single entry point for all S3 storage operations, abstracting
+ * the HTTP transport behind a clean interface. This enables:
+ *  - Mocking in tests via `createMemoryStorageApi()`
+ *  - Centralised error handling and connection management
+ *  - Type-safe method signatures matching the server API contract
+ *
+ * Create via:
+ *   const api = createFetchStorageApi(() => connectionStore.activeConnectionId);
+ */
+
+import { STORAGE_CONNECTION_ID_HEADER } from './connection-id-header.js';
+import { createStorageFetch } from './storage-fetch.js';
+import { readNdjsonStream, type NdjsonStreamCallbacks } from './ndjson-stream.js';
+import type { StoragePage, ArchiveListingResponse } from './types.js';
+import type { FileDetails, DirectoryMetadata, BucketDetails } from './details-types.js';
+
+// ── Types ──────────────────────────────────────────────────────────────────
+
+export interface CopyMoveResult {
+  results: Array<{ sourceKey: string; destKey: string }>;
+  failed: number;
+}
+
+export interface DeleteResult {
+  failed: Array<{ key: string; code?: string; message?: string }>;
+}
+
+export interface JobStatus {
+  status: string;
+  progress?: {
+    completedCount?: number;
+    completedBytes?: number;
+    currentFileName?: string;
+  };
+}
+
+// ── Interface ──────────────────────────────────────────────────────────────
+
+export interface StorageApi {
+  list(params: { bucket: string; prefix?: string; pageSize?: number }): Promise<StoragePage>;
+
+  copy(params: {
+    bucket: string;
+    sourceKeys: string[];
+    destinationPrefix: string;
+    progress?: boolean;
+    jobId?: string;
+    signal?: AbortSignal;
+    callbacks?: NdjsonStreamCallbacks;
+  }): Promise<CopyMoveResult>;
+
+  move(params: {
+    bucket: string;
+    sourceKeys: string[];
+    destinationPrefix: string;
+    progress?: boolean;
+    jobId?: string;
+    signal?: AbortSignal;
+    callbacks?: NdjsonStreamCallbacks;
+  }): Promise<CopyMoveResult>;
+
+  rename(params: { bucket: string; key: string; newKey: string }): Promise<void>;
+
+  delete(params: { bucket: string; keys: string[] }): Promise<DeleteResult>;
+
+  create(params: { bucket: string; key: string }): Promise<void>;
+
+  archiveExtract(params: {
+    bucket: string;
+    key: string;
+    path: string;
+    nestedArchivePath?: string;
+  }): Promise<Response>;
+
+  archiveListing(params: {
+    bucket: string;
+    key: string;
+    internalPrefix?: string;
+    nestedArchivePath?: string;
+  }): Promise<ArchiveListingResponse>;
+
+  pollJob(jobId: string): Promise<JobStatus>;
+
+  checkObjectExists(params: { bucket: string; key: string }): Promise<boolean>;
+
+  preview(params: {
+    bucket: string;
+    key: string;
+    offset?: number;
+    limit?: number;
+    data?: boolean;
+  }): Promise<Response>;
+
+  saveText(params: { bucket: string; key: string; body: string }): Promise<void>;
+
+  details(params: { bucket: string; key: string }): Promise<FileDetails>;
+
+  directoryMetadata(params: { bucket: string; prefix: string }): Promise<DirectoryMetadata>;
+
+  directorySize(params: { bucket: string; prefix: string }): Promise<Response>;
+
+  bucketDetails(params: { bucket: string }): Promise<BucketDetails>;
+
+  checkBucket(params: { bucket: string }): Promise<{ ok: boolean; status: number }>;
+
+  updateConnections(params: { bucket: string }): Promise<void>;
+}
+
+// ── Factory ────────────────────────────────────────────────────────────────
+
+/**
+ * Create a `StorageApi` instance backed by real HTTP fetch calls.
+ *
+ * @param getConnectionId  A function returning the active connection ID
+ *                         (or `null` when disconnected).
+ */
+export function createFetchStorageApi(getConnectionId: () => string | null): StorageApi {
+  const fetch_ = createStorageFetch(getConnectionId);
+
+  return {
+    async list({ bucket, prefix = '', pageSize }) {
+      const params = new URLSearchParams({ bucket, prefix: prefix ?? '' });
+      if (pageSize !== undefined) {
+        params.set('pageSize', String(pageSize));
+      }
+      const res = await fetch_(`/api/storage/list?${params}`);
+      return (await res.json()) as StoragePage;
+    },
+
+    async copy({ bucket, sourceKeys, destinationPrefix, progress, jobId, signal, callbacks }) {
+      return copyMoveRequest(fetch_, '/api/storage/copy', {
+        bucket,
+        sourceKeys,
+        destinationPrefix,
+        progress,
+        jobId,
+        signal,
+        callbacks
+      });
+    },
+
+    async move({ bucket, sourceKeys, destinationPrefix, progress, jobId, signal, callbacks }) {
+      return copyMoveRequest(fetch_, '/api/storage/move', {
+        bucket,
+        sourceKeys,
+        destinationPrefix,
+        progress,
+        jobId,
+        signal,
+        callbacks
+      });
+    },
+
+    async rename({ bucket, key, newKey }) {
+      const params = new URLSearchParams({ bucket });
+      await fetch_(`/api/storage/rename?${params}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ key, newKey })
+      });
+    },
+
+    async delete({ bucket, keys }) {
+      const params = new URLSearchParams({ bucket });
+      for (const key of keys) {
+        params.append('keys', key);
+      }
+      const res = await fetch_(`/api/storage/delete?${params}`, {
+        method: 'DELETE'
+      });
+      return (await res.json()) as DeleteResult;
+    },
+
+    async create({ bucket, key }) {
+      const params = new URLSearchParams({ bucket, key });
+      await fetch_(`/api/storage/create?${params}`, {
+        method: 'POST'
+      });
+    },
+
+    async archiveExtract({ bucket, key, path: filePath, nestedArchivePath }) {
+      const params = new URLSearchParams({ bucket, key, path: filePath });
+      if (nestedArchivePath) {
+        params.set('nestedArchivePath', nestedArchivePath);
+      }
+      // Returns raw Response for blob download — caller consumes the body.
+      return fetch_(`/api/storage/archive/extract?${params}`);
+    },
+
+    async archiveListing({ bucket, key, internalPrefix = '', nestedArchivePath }) {
+      const params = new URLSearchParams({ bucket, key, internalPrefix });
+      if (nestedArchivePath) {
+        params.set('nestedArchivePath', nestedArchivePath);
+      }
+      const res = await fetch_(`/api/storage/archive/listing?${params}`);
+      return (await res.json()) as ArchiveListingResponse;
+    },
+
+    async pollJob(jobId) {
+      const res = await fetch_(`/api/storage/copy/job/${jobId}`);
+      return (await res.json()) as JobStatus;
+    },
+
+    async checkObjectExists({ bucket, key }) {
+      const params = new URLSearchParams({ bucket, key });
+      try {
+        const res = await fetch_(`/api/storage/download?${params}`, {
+          method: 'HEAD'
+        });
+        return res.ok;
+      } catch {
+        return false;
+      }
+    },
+
+    async preview({ bucket, key, offset, limit, data }) {
+      const params = new URLSearchParams({ bucket, key });
+      if (offset !== undefined) params.set('offset', String(offset));
+      if (limit !== undefined) params.set('limit', String(limit));
+      if (data) params.set('data', 'true');
+      return fetch_(`/api/storage/preview?${params}`);
+    },
+
+    async saveText({ bucket, key, body }) {
+      const params = new URLSearchParams({ bucket, key });
+      await fetch_(`/api/storage/save-text?${params}`, {
+        method: 'POST',
+        body
+      });
+    },
+
+    async details({ bucket, key }) {
+      const params = new URLSearchParams({ bucket, key });
+      const res = await fetch_(`/api/storage/details?${params}`);
+      return (await res.json()) as FileDetails;
+    },
+
+    async directoryMetadata({ bucket, prefix }) {
+      const params = new URLSearchParams({ bucket, prefix, metadata: 'true' });
+      const res = await fetch_(`/api/storage/directory-metadata?${params}`);
+      return (await res.json()) as DirectoryMetadata;
+    },
+
+    async directorySize({ bucket, prefix }) {
+      const params = new URLSearchParams({ bucket, prefix });
+      return fetch_(`/api/storage/directory-size?${params}`);
+    },
+
+    async bucketDetails({ bucket }) {
+      const params = new URLSearchParams({ bucket, details: 'true' });
+      const res = await fetch_(`/api/storage/buckets?${params}`);
+      return (await res.json()) as BucketDetails;
+    },
+
+    async checkBucket({ bucket }) {
+      const params = new URLSearchParams({ bucket });
+      const res = await fetch(`/api/storage/check-bucket?${params}`, {
+        headers: { [STORAGE_CONNECTION_ID_HEADER]: getConnectionId() ?? '' }
+      });
+      return { ok: res.ok, status: res.status };
+    },
+
+    async updateConnections({ bucket }) {
+      await fetch_(`/api/storage/connections`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ bucket })
+      });
+    }
+  };
+}
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+/**
+ * Shared implementation for copy and move requests.
+ * When `progress=true`, the response is an NDJSON stream.
+ */
+async function copyMoveRequest(
+  fetch_: (path: string, init?: RequestInit) => Promise<Response>,
+  endpoint: string,
+  params: {
+    bucket: string;
+    sourceKeys: string[];
+    destinationPrefix: string;
+    progress?: boolean;
+    jobId?: string;
+    signal?: AbortSignal;
+    callbacks?: NdjsonStreamCallbacks;
+  }
+): Promise<CopyMoveResult> {
+  const urlParams = new URLSearchParams({ bucket: params.bucket });
+  if (params.progress) {
+    urlParams.set('progress', 'true');
+  }
+
+  const res = await fetch_(`${endpoint}?${urlParams}`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      sourceKeys: params.sourceKeys,
+      destinationPrefix: params.destinationPrefix,
+      jobId: params.jobId
+    }),
+    signal: params.signal
+  });
+
+  if (params.progress) {
+    const streamResult = await readNdjsonStream(res.body, params.callbacks);
+    return {
+      results: streamResult.results,
+      failed: streamResult.failed.length
+    };
+  }
+
+  const data = (await res.json()) as {
+    results?: Array<{ sourceKey: string; destKey: string }>;
+    moved?: Array<{ sourceKey: string; destKey: string }>;
+    failed?: Array<unknown>;
+  };
+  const results = data.results ?? data.moved ?? [];
+  return { results, failed: data.failed?.length ?? 0 };
+}
diff --git a/src/lib/storage/archive.svelte.spec.ts b/src/lib/storage/archive.svelte.spec.ts
new file mode 100644
index 00000000..cf8ac553
--- /dev/null
+++ b/src/lib/storage/archive.svelte.spec.ts
@@ -0,0 +1,655 @@
+vi.mock('$app/environment', () => ({ browser: true }));
+vi.mock('$app/navigation', () => ({ invalidateAll: vi.fn() }));
+vi.mock('$lib/stores/toast.svelte.js', () => ({ addToast: vi.fn() }));
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { ArchiveState } from './archive.svelte.js';
+import { addToast } from '$lib/stores/toast.svelte.js';
+import { invalidateAll } from '$app/navigation';
+import type { Mock } from 'vitest';
+import type { StorageApi } from './api.js';
+import type { StoragePage } from './types.js';
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function makeMockApi(): StorageApi {
+  return {
+    list: vi.fn(),
+    copy: vi.fn(),
+    move: vi.fn(),
+    rename: vi.fn(),
+    delete: vi.fn(),
+    create: vi.fn(),
+    archiveExtract: vi.fn(),
+    archiveListing: vi.fn(),
+    pollJob: vi.fn(),
+    checkObjectExists: vi.fn(),
+    preview: vi.fn(),
+    saveText: vi.fn(),
+    details: vi.fn(),
+    directoryMetadata: vi.fn(),
+    directorySize: vi.fn(),
+    bucketDetails: vi.fn(),
+    checkBucket: vi.fn(),
+    updateConnections: vi.fn()
+  } as unknown as StorageApi;
+}
+
+function makeArchive(apiOverrides?: Partial<StorageApi>): {
+  archive: ArchiveState;
+  callbacks: ReturnType<typeof makeCallbacks>;
+  api: StorageApi;
+} {
+  const api = makeMockApi();
+  Object.assign(api, apiOverrides ?? {});
+  const callbacks = makeCallbacks();
+  const archive = new ArchiveState(api, callbacks);
+  return { archive, callbacks, api };
+}
+
+function makeCallbacks() {
+  return {
+    getBucket: vi.fn().mockReturnValue('test-bucket'),
+    getPrefix: vi.fn().mockReturnValue('s3/prefix/'),
+    getPageSize: vi.fn().mockReturnValue(25),
+    setObjects: vi.fn(),
+    setLoading: vi.fn(),
+    setPrefix: vi.fn(),
+    clearPrevTokens: vi.fn(),
+    onExit: vi.fn()
+  };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 1: State basics
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('state basics', () => {
+  it('isInArchive is false when archiveKey is null', () => {
+    const { archive } = makeArchive();
+    expect(archive.isInArchive).toBe(false);
+  });
+
+  it('isInArchive is true when archiveKey is set', () => {
+    const { archive } = makeArchive();
+    archive.archiveKey = 'test.zip';
+    expect(archive.isInArchive).toBe(true);
+  });
+
+  it('isInArchive transitions correctly when archiveKey changes', () => {
+    const { archive } = makeArchive();
+    expect(archive.isInArchive).toBe(false);
+    archive.archiveKey = 'test.zip';
+    expect(archive.isInArchive).toBe(true);
+    archive.archiveKey = null;
+    expect(archive.isInArchive).toBe(false);
+  });
+
+  it('nestedArchivePath getter returns undefined when not set', () => {
+    const { archive } = makeArchive();
+    expect(archive.nestedArchivePath).toBeUndefined();
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 2: isArchiveFile
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('isArchiveFile', () => {
+  it('returns true for .zip files', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('data.zip')).toBe(true);
+  });
+
+  it('returns true for .tar.gz files', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('backup.tar.gz')).toBe(true);
+  });
+
+  it('returns true for .tgz files', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('archive.tgz')).toBe(true);
+  });
+
+  it('returns true for .tar files', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('data.tar')).toBe(true);
+  });
+
+  it('returns true for .rar files', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('data.rar')).toBe(true);
+  });
+
+  it('returns true for .7z files', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('archive.7z')).toBe(true);
+  });
+
+  it('is case-insensitive', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('DATA.ZIP')).toBe(true);
+    expect(archive.isArchiveFile('Archive.Tar.Gz')).toBe(true);
+  });
+
+  it('returns false for non-archive files', () => {
+    const { archive } = makeArchive();
+    expect(archive.isArchiveFile('readme.txt')).toBe(false);
+    expect(archive.isArchiveFile('image.png')).toBe(false);
+    expect(archive.isArchiveFile('script.js')).toBe(false);
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 3: enterArchive
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('enterArchive', () => {
+  it('fetches listing and sets state on success', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    (api.archiveListing as Mock).mockResolvedValue({
+      entries: [
+        { key: 'file.txt', size: 100, lastModified: new Date(), isDirectory: false },
+        { key: 'subdir/', size: 0, lastModified: new Date(), isDirectory: true }
+      ],
+      hasMore: false
+    });
+
+    await archive.enterArchive('archive.zip');
+
+    expect(archive.archiveKey).toBe('archive.zip');
+    expect(archive.archivePrefix).toBe('');
+    expect(archive.isInArchive).toBe(true);
+    expect(api.archiveListing).toHaveBeenCalledWith({
+      bucket: 'test-bucket',
+      key: 'archive.zip',
+      internalPrefix: '',
+      nestedArchivePath: undefined
+    });
+    expect(archive.archiveLoading).toBe(false);
+    expect(callbacks.setObjects).toHaveBeenCalled();
+    const page = callbacks.setObjects.mock.calls[0][0] as StoragePage;
+    expect(page.objects).toHaveLength(2);
+    expect(page.objects[0].key).toBe('file.txt');
+    expect(page.objects[1].key).toBe('subdir/');
+  });
+
+  it('saves previous S3 prefix when entering archive', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    callbacks.getPrefix.mockReturnValue('my/s3/path/');
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    await archive.enterArchive('archive.zip');
+
+    // _previousS3Prefix was set before fetch
+    // We verify indirectly by checking exitArchive uses it
+    archive.exitArchive();
+    expect(callbacks.onExit).toHaveBeenCalledWith('my/s3/path/');
+  });
+
+  it('handles nested archive entry', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'outer.zip';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    await archive.enterArchive('inner.tar');
+
+    expect(archive.archiveKey).toBe('outer.zip'); // unchanged
+    expect(archive.nestedArchivePath).toBe('inner.tar');
+    expect(archive.archivePrefix).toBe('');
+  });
+
+  it('shows toast on error', async () => {
+    const { archive, api } = makeArchive();
+    (api.archiveListing as Mock).mockRejectedValue(new Error('API error'));
+
+    await archive.enterArchive('archive.zip');
+
+    expect(archive.archiveKey).toBeNull();
+    expect(addToast).toHaveBeenCalledWith('error', expect.any(String));
+    expect(archive.archiveLoading).toBe(false);
+  });
+
+  it('handles error during nested archive entry and restores nested path', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'outer.zip';
+    archive.archivePrefix = 'some/path/';
+    (api.archiveListing as Mock).mockRejectedValue(new Error('Nested error'));
+
+    await archive.enterArchive('inner.tar');
+
+    // Should restore nested path to null
+    expect(archive.nestedArchivePath).toBeUndefined();
+    expect(archive.archiveKey).toBe('outer.zip'); // outer archive preserved
+    expect(addToast).toHaveBeenCalledWith('error', expect.any(String));
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 4: navigateInArchive
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('navigateInArchive', () => {
+  it('fetches listing with new prefix', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    await archive.navigateInArchive('subdir/');
+
+    expect(archive.archivePrefix).toBe('subdir/');
+    expect(api.archiveListing).toHaveBeenCalledWith({
+      bucket: 'test-bucket',
+      key: 'archive.zip',
+      internalPrefix: 'subdir/',
+      nestedArchivePath: undefined
+    });
+    expect(archive.archiveLoading).toBe(false);
+    expect(callbacks.clearPrevTokens).toHaveBeenCalled();
+  });
+
+  it('does nothing when no archive is open', async () => {
+    const { archive, api } = makeArchive();
+
+    await archive.navigateInArchive('subdir/');
+
+    expect(api.archiveListing).not.toHaveBeenCalled();
+    expect(archive.archivePrefix).toBe('');
+  });
+
+  it('shows toast on error', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    (api.archiveListing as Mock).mockRejectedValue(new Error('Fail'));
+
+    await archive.navigateInArchive('subdir/');
+
+    expect(addToast).toHaveBeenCalledWith('error', expect.any(String));
+    expect(archive.archiveLoading).toBe(false);
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 5: navigateToOuterArchiveRoot
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('navigateToOuterArchiveRoot', () => {
+  it('clears nested path and fetches root listing', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    archive.archiveKey = 'outer.zip';
+    // Simulate being inside a nested archive
+    // _archiveNestedPath is private, but we can call navigateToOuterArchiveRoot directly
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    // Set nested state via enterArchive
+    archive.archivePrefix = 'subdir/';
+    await archive.enterArchive('inner.tar'); // sets _archiveNestedPath
+    vi.clearAllMocks();
+
+    archive.navigateToOuterArchiveRoot();
+
+    expect(callbacks.clearPrevTokens).toHaveBeenCalled();
+    expect(api.archiveListing).toHaveBeenCalledWith(
+      expect.objectContaining({ internalPrefix: '' })
+    );
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 6: navigateUpFromArchive
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('navigateUpFromArchive', () => {
+  it('goes up one directory level within the archive', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    archive.archivePrefix = 'music/videos/';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    archive.navigateUpFromArchive();
+
+    // Wait for async navigateInArchive
+    await vi.waitFor(() => {
+      expect(archive.archivePrefix).toBe('music/');
+    });
+  });
+
+  it('exits archive when at root without nested path', () => {
+    const { archive, callbacks } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    archive.archivePrefix = '';
+
+    archive.navigateUpFromArchive();
+
+    expect(callbacks.onExit).toHaveBeenCalled();
+    expect(archive.archiveKey).toBeNull();
+  });
+
+  it('goes to outer archive root when at root with nested path', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    archive.archiveKey = 'outer.zip';
+    archive.archivePrefix = '';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+    // Enter nested archive to set _archiveNestedPath
+    await archive.enterArchive('inner.tar');
+    vi.clearAllMocks();
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    archive.navigateUpFromArchive();
+
+    expect(archive.nestedArchivePath).toBeUndefined();
+    expect(api.archiveListing).toHaveBeenCalledWith(
+      expect.objectContaining({ internalPrefix: '' })
+    );
+    expect(callbacks.clearPrevTokens).toHaveBeenCalled();
+  });
+
+  it('goes one level up when not at root', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    archive.archivePrefix = 'a/b/';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    archive.navigateUpFromArchive();
+
+    await vi.waitFor(() => {
+      expect(archive.archivePrefix).toBe('a/');
+    });
+  });
+
+  it('goes to root when at top-level prefix', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    archive.archivePrefix = 'docs/';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    archive.navigateUpFromArchive();
+
+    await vi.waitFor(() => {
+      expect(archive.archivePrefix).toBe('');
+    });
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 7: exitArchive
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('exitArchive', () => {
+  it('clears state and calls onExit with previous S3 prefix', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    // Enter archive first to set _previousS3Prefix from getPrefix callback
+    await archive.enterArchive('archive.zip');
+
+    archive.exitArchive();
+
+    expect(archive.archiveKey).toBeNull();
+    expect(archive.archivePrefix).toBe('');
+    expect(archive.archiveLoading).toBe(false);
+    expect(archive.archiveTooLarge).toBe(false);
+    expect(archive.isInArchive).toBe(false);
+    expect(callbacks.onExit).toHaveBeenCalledWith('s3/prefix/');
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 8: downloadFromArchive
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('downloadFromArchive', () => {
+  it('downloads blob and creates download link', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    const blob = new Blob(['test content']);
+    (api.archiveExtract as Mock).mockResolvedValue(new Response(blob));
+    const createObjectURLSpy = vi.spyOn(URL, 'createObjectURL').mockReturnValue('blob:fake-url');
+
+    await archive.downloadFromArchive('path/to/file.txt');
+
+    expect(api.archiveExtract).toHaveBeenCalledWith({
+      bucket: 'test-bucket',
+      key: 'archive.zip',
+      path: 'path/to/file.txt',
+      nestedArchivePath: undefined
+    });
+    expect(createObjectURLSpy).toHaveBeenCalled();
+    createObjectURLSpy.mockRestore();
+  });
+
+  it('does nothing when no archive is open', async () => {
+    const { archive, api } = makeArchive();
+
+    await archive.downloadFromArchive('path/to/file.txt');
+
+    expect(api.archiveExtract).not.toHaveBeenCalled();
+  });
+
+  it('shows error toast on StorageError', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    (api.archiveExtract as Mock).mockRejectedValue(
+      new (await import('./errors.js')).StorageError('not_found', 'Not found')
+    );
+
+    await archive.downloadFromArchive('missing.txt');
+
+    expect(addToast).toHaveBeenCalledWith('error', expect.any(String));
+  });
+
+  it('shows generic error toast on unknown error', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    (api.archiveExtract as Mock).mockRejectedValue(new Error('Network error'));
+
+    await archive.downloadFromArchive('file.txt');
+
+    expect(addToast).toHaveBeenCalledWith('error', expect.any(String));
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 9: refreshListing
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('refreshListing', () => {
+  it('re-fetches archive listing', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    archive.refreshListing();
+
+    // Wait for the async fetch
+    await vi.waitFor(() => {
+      expect(api.archiveListing).toHaveBeenCalled();
+    });
+    expect(archive.archiveLoading).toBe(false);
+  });
+
+  it('sets loading to false on error', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    (api.archiveListing as Mock).mockRejectedValue(new Error('Fail'));
+
+    archive.refreshListing();
+
+    await vi.waitFor(() => {
+      expect(archive.archiveLoading).toBe(false);
+    });
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 10: reset
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('reset', () => {
+  it('clears all archive state', () => {
+    const { archive } = makeArchive();
+    archive.archiveKey = 'archive.zip';
+    archive.archivePrefix = 'subdir/';
+    archive.archiveLoading = true;
+    archive.archiveTooLarge = true;
+    // Set internal state via enterArchive
+    // (nested path is set internally — we verify reset clears it via exitArchive behavior)
+
+    archive.reset();
+
+    expect(archive.archiveKey).toBeNull();
+    expect(archive.archivePrefix).toBe('');
+    expect(archive.archiveLoading).toBe(false);
+    expect(archive.archiveTooLarge).toBe(false);
+    expect(archive.isInArchive).toBe(false);
+    expect(archive.nestedArchivePath).toBeUndefined();
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 11: _fetchS3Objects (internal)
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('_fetchS3Objects', () => {
+  it('calls setObjects and setLoading on success', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    const mockPage: StoragePage = {
+      objects: [],
+      hasNextPage: false,
+      currentPage: 1,
+      pageSize: 25
+    };
+    (api.list as Mock).mockResolvedValue(mockPage);
+
+    await archive._fetchS3Objects('my-prefix/');
+
+    expect(api.list).toHaveBeenCalledWith({
+      bucket: 'test-bucket',
+      prefix: 'my-prefix/',
+      pageSize: 25
+    });
+    expect(callbacks.setPrefix).toHaveBeenCalledWith('my-prefix/');
+    expect(callbacks.setObjects).toHaveBeenCalledWith(mockPage);
+    expect(callbacks.setLoading).toHaveBeenCalledWith(false);
+  });
+
+  it('falls back to invalidateAll on error', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    (api.list as Mock).mockRejectedValue(new Error('Network error'));
+
+    await archive._fetchS3Objects('prefix/');
+
+    expect(invalidateAll).toHaveBeenCalled();
+    expect(callbacks.setLoading).toHaveBeenCalledWith(false);
+  });
+
+  it('passes empty prefix string when given undefined-like value', async () => {
+    const { archive, api } = makeArchive();
+    (api.list as Mock).mockResolvedValue({
+      objects: [],
+      hasNextPage: false,
+      currentPage: 1,
+      pageSize: 25
+    });
+
+    await archive._fetchS3Objects('');
+
+    expect(api.list).toHaveBeenCalledWith(expect.objectContaining({ prefix: '' }));
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 12: Too-large archives
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('too-large archives', () => {
+  it('sets archiveTooLarge and clears objects when archive listing returns tooLarge', async () => {
+    const { archive, callbacks, api } = makeArchive();
+    (api.archiveListing as Mock).mockResolvedValue({
+      entries: [],
+      hasMore: false,
+      tooLarge: true
+    });
+
+    await archive.enterArchive('huge.zip');
+
+    expect(archive.archiveTooLarge).toBe(true);
+    expect(archive.archiveLoading).toBe(false);
+    expect(callbacks.setObjects).toHaveBeenCalledWith({
+      objects: [],
+      hasNextPage: false,
+      currentPage: 1,
+      pageSize: null
+    });
+  });
+});
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Group 13: Nested archive navigation
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('nested archive navigation', () => {
+  it('entering a nested archive preserves outer archiveKey', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'outer.zip';
+    archive.archivePrefix = 'some/path/';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    await archive.enterArchive('inner.tar');
+
+    expect(archive.archiveKey).toBe('outer.zip');
+    expect(archive.nestedArchivePath).toBe('inner.tar');
+    expect(archive.archivePrefix).toBe('');
+    expect(api.archiveListing).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'outer.zip',
+        nestedArchivePath: 'inner.tar'
+      })
+    );
+  });
+
+  it('navigating within nested archive keeps the nested path', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'outer.zip';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+    await archive.enterArchive('inner.tar');
+    vi.clearAllMocks();
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    await archive.navigateInArchive('subdir/');
+
+    expect(api.archiveListing).toHaveBeenCalledWith(
+      expect.objectContaining({
+        key: 'outer.zip',
+        nestedArchivePath: 'inner.tar',
+        internalPrefix: 'subdir/'
+      })
+    );
+  });
+
+  it('navigateToOuterArchiveRoot exits nested archive', async () => {
+    const { archive, api } = makeArchive();
+    archive.archiveKey = 'outer.zip';
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+    await archive.enterArchive('inner.tar');
+    vi.clearAllMocks();
+    (api.archiveListing as Mock).mockResolvedValue({ entries: [], hasMore: false });
+
+    archive.navigateToOuterArchiveRoot();
+
+    await vi.waitFor(() => {
+      expect(api.archiveListing).toHaveBeenCalledWith(
+        expect.objectContaining({
+          key: 'outer.zip',
+          nestedArchivePath: undefined,
+          internalPrefix: ''
+        })
+      );
+    });
+    expect(archive.nestedArchivePath).toBeUndefined();
+  });
+});
diff --git a/src/lib/storage/archive.svelte.ts b/src/lib/storage/archive.svelte.ts
new file mode 100644
index 00000000..339b908a
--- /dev/null
+++ b/src/lib/storage/archive.svelte.ts
@@ -0,0 +1,288 @@
+import { invalidateAll } from '$app/navigation';
+import * as m from '$lib/paraglide/messages.js';
+import { addToast } from '$lib/stores/toast.svelte.js';
+import { ARCHIVE_EXTENSIONS } from '$lib/storage/types.js';
+import { StorageError, getActionErrorMessage } from './errors.js';
+import type { StoragePage } from '$lib/storage/types.js';
+import type { StorageApi } from './api.js';
+
+// ── ArchiveState ───────────────────────────────────────────────────────────
+
+export class ArchiveState {
+  // ── Reactive state (readable by UI components) ─────────────────────────
+  archiveKey = $state<string | null>(null);
+  /** Virtual path prefix within the archive ('' = root). */
+  archivePrefix = $state('');
+  archiveLoading = $state(false);
+  archiveTooLarge = $state(false);
+  isInArchive = $derived(this.archiveKey !== null);
+
+  /** Internal archive nested path, exposed via getter for access control. */
+  private _archiveNestedPath = $state<string | null>(null);
+
+  get nestedArchivePath(): string | undefined {
+    return this._archiveNestedPath ?? undefined;
+  }
+
+  /**
+   * S3 prefix we were at before entering the archive.
+   * Internal field — read via `archive.archivePrefix` stack.
+   * Set from snapshot by `_restoreFullState`.
+   */
+  _previousS3Prefix = $state('');
+
+  // ── Dependencies ───────────────────────────────────────────────────────
+
+  private _api: StorageApi;
+
+  /** Callbacks to mutate StorageState fields without coupling directly. */
+  private _callbacks: {
+    getBucket: () => string;
+    getPrefix: () => string;
+    getPageSize: () => number;
+    setObjects: (objects: StoragePage) => void;
+    setLoading: (loading: boolean) => void;
+    setPrefix: (prefix: string) => void;
+    clearPrevTokens: () => void;
+    /** Called when the user exits archive — StorageState should navigate to S3. */
+    onExit: (s3Prefix: string) => void;
+  };
+
+  constructor(
+    api: StorageApi,
+    callbacks: {
+      getBucket: () => string;
+      getPrefix: () => string;
+      getPageSize: () => number;
+      setObjects: (objects: StoragePage) => void;
+      setLoading: (loading: boolean) => void;
+      setPrefix: (prefix: string) => void;
+      clearPrevTokens: () => void;
+      onExit: (s3Prefix: string) => void;
+    }
+  ) {
+    this._api = api;
+    this._callbacks = callbacks;
+  }
+
+  // ── Public methods ─────────────────────────────────────────────────────
+
+  /** Check if a filename looks like a navigable archive. */
+  isArchiveFile(key: string): boolean {
+    const lower = key.toLowerCase();
+    return ARCHIVE_EXTENSIONS.some((ext) => lower.endsWith(ext));
+  }
+
+  /** Enter an archive file and show its contents as a virtual folder. */
+  async enterArchive(archiveKey: string): Promise<void> {
+    if (this.isInArchive) {
+      this._archiveNestedPath = archiveKey;
+    } else {
+      this.archiveKey = archiveKey;
+      this._archiveNestedPath = null;
+      this._previousS3Prefix = this._callbacks.getPrefix();
+    }
+    this.archivePrefix = '';
+    this.archiveLoading = true;
+
+    try {
+      await this._fetchArchiveListing();
+    } catch (err) {
+      if (this._archiveNestedPath) {
+        this._archiveNestedPath = null;
+      } else {
+        this.archiveKey = null;
+        this._previousS3Prefix = '';
+      }
+      this.archivePrefix = '';
+      this.archiveLoading = false;
+      addToast('error', err instanceof Error ? err.message : m.storage_archive_open_error());
+    }
+  }
+
+  /** Navigate within the current archive (virtual path). */
+  async navigateInArchive(prefix: string): Promise<void> {
+    if (!this.archiveKey) return;
+    this.archivePrefix = prefix;
+    this.archiveLoading = true;
+    this._callbacks.clearPrevTokens();
+
+    try {
+      await this._fetchArchiveListing();
+    } catch (err) {
+      this.archiveLoading = false;
+      addToast('error', err instanceof Error ? err.message : m.storage_archive_open_error());
+    }
+  }
+
+  /** Navigate to the root of the outermost archive (clears nested archive state). */
+  navigateToOuterArchiveRoot = (): void => {
+    this._archiveNestedPath = null;
+    this.archivePrefix = '';
+    this.archiveLoading = true;
+    this._callbacks.clearPrevTokens();
+    void this._fetchArchiveListing().catch(() => {
+      this.archiveLoading = false;
+    });
+  };
+
+  /** Navigate up within the archive. If at root, exit the archive or go to parent archive. */
+  navigateUpFromArchive = (): void => {
+    if (!this.archivePrefix) {
+      if (this._archiveNestedPath) {
+        // Go back to outer archive root
+        this._archiveNestedPath = null;
+        this.archivePrefix = '';
+        this.archiveLoading = true;
+        this._callbacks.clearPrevTokens();
+        void this._fetchArchiveListing().catch(() => {
+          this.archiveLoading = false;
+        });
+      } else {
+        this.exitArchive();
+      }
+      return;
+    }
+    const withoutTrailing = this.archivePrefix.replace(/\/$/, '');
+    const lastSlash = withoutTrailing.lastIndexOf('/');
+    void this.navigateInArchive(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
+  };
+
+  /** Exit the archive and return to the S3 folder that contains it. */
+  exitArchive = (): void => {
+    const s3Prefix = this._previousS3Prefix;
+    this.reset();
+    this._callbacks.onExit(s3Prefix);
+  };
+
+  /** Download a file from within the current archive. */
+  async downloadFromArchive(internalPath: string): Promise<void> {
+    if (!this.archiveKey) return;
+    try {
+      const res = await this._api.archiveExtract({
+        bucket: this._callbacks.getBucket(),
+        key: this.archiveKey,
+        path: internalPath,
+        nestedArchivePath: this._archiveNestedPath ?? undefined
+      });
+      const blob = await res.blob();
+      const blobUrl = URL.createObjectURL(blob);
+      const filename = internalPath.split('/').filter(Boolean).pop() ?? internalPath;
+      const anchor = document.createElement('a');
+      anchor.href = blobUrl;
+      anchor.download = filename;
+      anchor.style.display = 'none';
+      document.body.appendChild(anchor);
+      anchor.click();
+      document.body.removeChild(anchor);
+      setTimeout(() => URL.revokeObjectURL(blobUrl), 10_000);
+    } catch (err: unknown) {
+      if (err instanceof StorageError) {
+        addToast('error', getActionErrorMessage(err));
+      } else {
+        addToast('error', m.storage_download_error_unknown());
+      }
+    }
+  }
+
+  /** Re-fetch the archive listing. Only call when isInArchive is true. */
+  refreshListing = (): void => {
+    this.archiveLoading = true;
+    void this._fetchArchiveListing().catch(() => {
+      this.archiveLoading = false;
+    });
+  };
+
+  /** Clear all archive state (called from StorageState.syncFromServer). */
+  reset = (): void => {
+    this.archiveKey = null;
+    this.archivePrefix = '';
+    this._archiveNestedPath = null;
+    this._previousS3Prefix = '';
+    this.archiveLoading = false;
+    this.archiveTooLarge = false;
+  };
+
+  // ── Internal methods ──────────────────────────────────────────────────
+
+  /**
+   * Restore full archive state from a tab snapshot. For use by TabsState only.
+   * Directly sets internal fields including private ones.
+   */
+  _restoreFullState(params: {
+    archiveKey: string | null;
+    archivePrefix: string;
+    archiveNestedPath: string | null;
+    previousS3Prefix: string;
+    archiveLoading: boolean;
+    archiveTooLarge: boolean;
+  }): void {
+    this.archiveKey = params.archiveKey;
+    this.archivePrefix = params.archivePrefix;
+    this._archiveNestedPath = params.archiveNestedPath;
+    this._previousS3Prefix = params.previousS3Prefix;
+    this.archiveLoading = params.archiveLoading;
+    this.archiveTooLarge = params.archiveTooLarge;
+  }
+
+  /**
+   * Fetch S3 objects for the given prefix (used when exiting archive).
+   * This is called from StorageState's onExit callback.
+   */
+  async _fetchS3Objects(prefix: string): Promise<void> {
+    try {
+      const objects = await this._api.list({
+        bucket: this._callbacks.getBucket(),
+        prefix: prefix ?? '',
+        pageSize: this._callbacks.getPageSize()
+      });
+      this._callbacks.setPrefix(prefix);
+      this._callbacks.setObjects(objects);
+    } catch {
+      // Fall back to invalidateAll if manual fetch fails
+      void invalidateAll();
+    } finally {
+      this._callbacks.setLoading(false);
+    }
+  }
+
+  /** Fetch archive listing from the server API. */
+  private async _fetchArchiveListing(): Promise<void> {
+    if (!this.archiveKey) {
+      this.archiveLoading = false;
+      return;
+    }
+    const data = await this._api.archiveListing({
+      bucket: this._callbacks.getBucket(),
+      key: this.archiveKey,
+      internalPrefix: this.archivePrefix,
+      nestedArchivePath: this._archiveNestedPath ?? undefined
+    });
+    if (data.tooLarge) {
+      this.archiveTooLarge = true;
+      this.archiveLoading = false;
+      this._callbacks.setObjects({
+        objects: [],
+        hasNextPage: false,
+        currentPage: 1,
+        pageSize: null as never
+      });
+      return;
+    }
+    this.archiveTooLarge = false;
+    const prefix = this.archivePrefix || '';
+    this._callbacks.setObjects({
+      objects: data.entries.map((e) => ({
+        key: prefix + e.key,
+        size: e.size,
+        lastModified: e.lastModified,
+        isDirectory: e.isDirectory,
+        contentType: undefined
+      })),
+      hasNextPage: data.hasMore,
+      currentPage: 1,
+      pageSize: null as never
+    });
+    this.archiveLoading = false;
+  }
+}
diff --git a/src/lib/storage/clipboard.svelte.ts b/src/lib/storage/clipboard.svelte.ts
new file mode 100644
index 00000000..721dde6c
--- /dev/null
+++ b/src/lib/storage/clipboard.svelte.ts
@@ -0,0 +1,991 @@
+import { SvelteMap } from 'svelte/reactivity';
+import { tick } from 'svelte';
+import * as m from '$lib/paraglide/messages.js';
+import { addToast } from '$lib/stores/toast.svelte.js';
+import type { StoragePage, ClipboardData, ModalType } from '$lib/storage/types.js';
+import type { ConflictEntry } from '$lib/components/storage/modals/shared/conflict-types.js';
+import { keyToName } from '$lib/storage/utils.js';
+import { ActionError, getActionErrorMessage } from './errors.js';
+import { pageUnloading } from './operations.svelte.js';
+import { storageMoveEnabled } from '$lib/client/feature-flags.js';
+import { OperationsState } from './operations.svelte.js';
+import type { StorageApi } from './api.js';
+
+// ── Internal types ──────────────────────────────────────────────────────────
+
+type PendingPasteOp = {
+  type: 'paste';
+  keys: string[];
+  sourceBucket: string;
+  destPrefix: string;
+  wasCut: boolean;
+  fileSizes: Record<string, number>;
+  sourcePrefix: string;
+  totalBytes: number;
+};
+
+type PendingMoveOp = {
+  type: 'move';
+  keys: string[];
+  destPrefix: string;
+  items: Array<{ key: string; name: string; isDirectory: boolean; size?: number }>;
+  sourcePrefix: string | null;
+  totalBytes: number;
+};
+
+type PendingConflictOp = PendingPasteOp | PendingMoveOp | null;
+
+// ── Callbacks interface ──────────────────────────────────────────────────────
+
+export interface ClipboardStateCallbacks {
+  getBucket: () => string;
+  getPrefix: () => string;
+  getObjects: () => StoragePage;
+  getSelectedKeys: () => Iterable<string>;
+  openModal: (type: ModalType, payload: unknown) => void;
+  closeModal: () => void;
+  refresh: () => void;
+  invalidateSourceTabs: (prefix: string) => void;
+  recordFileVisit: (bucket: string, key: string, size: number) => void;
+  removeFiles: (bucket: string, keys: string[]) => void;
+  clearSelection: () => void;
+}
+
+// ── ClipboardState ───────────────────────────────────────────────────────────
+
+export class ClipboardState {
+  // ── Reactive state ───────────────────────────────────────────────────────
+
+  /** Current clipboard content (null when empty). */
+  clipboard = $state<ClipboardData | null>(null);
+
+  /** Pending conflict operation awaiting user resolution. */
+  private _pendingConflictOp = $state<PendingConflictOp>(null);
+
+  /** Source prefix for the current pending move operation. */
+  private _pendingSourcePrefix: string | null = null;
+
+  /** Pending move operation (before user confirmation). */
+  private _pendingMove: {
+    keys: string[];
+    destPrefix: string;
+    items: Array<{ key: string; name: string; isDirectory: boolean; size?: number }>;
+    sourcePrefix: string | null;
+  } | null = null;
+
+  // ── Dependencies ──────────────────────────────────────────────────────────
+
+  private _api: StorageApi;
+  private _operations: OperationsState;
+  private _callbacks: ClipboardStateCallbacks;
+
+  constructor(api: StorageApi, operations: OperationsState, callbacks: ClipboardStateCallbacks) {
+    this._api = api;
+    this._operations = operations;
+    this._callbacks = callbacks;
+  }
+
+  // ── Cut / Copy ─────────────────────────────────────────────────────────────
+
+  /**
+   * Returns true when `key` is in the clipboard with action='cut' and the
+   * bucket matches.
+   */
+  isCutKey(key: string, bucket: string): boolean {
+    return (
+      this.clipboard?.action === 'cut' &&
+      this.clipboard.sourceBucket === bucket &&
+      this.clipboard.keys.includes(key)
+    );
+  }
+
+  /**
+   * Set clipboard with cut action.
+   * Caller should check storageCutCopyEnabled before calling.
+   */
+  cut(selectedKeys: string[], objects: StoragePage, bucket: string, prefix: string): void {
+    if (selectedKeys.length === 0) return;
+    const fileSizes: Record<string, number> = {};
+    for (const obj of objects.objects) {
+      if (selectedKeys.includes(obj.key) && !obj.isDirectory) {
+        fileSizes[obj.key] = obj.size;
+      }
+    }
+    this.clipboard = {
+      action: 'cut',
+      keys: selectedKeys,
+      sourceBucket: bucket,
+      sourcePrefix: prefix,
+      fileSizes
+    };
+    addToast('info', m.storage_action_cut_success({ count: selectedKeys.length }));
+  }
+
+  /**
+   * Set clipboard with copy action.
+   * Caller should check storageCutCopyEnabled before calling.
+   */
+  copy(selectedKeys: string[], objects: StoragePage, bucket: string, prefix: string): void {
+    if (selectedKeys.length === 0) return;
+    const fileSizes: Record<string, number> = {};
+    for (const obj of objects.objects) {
+      if (selectedKeys.includes(obj.key) && !obj.isDirectory) {
+        fileSizes[obj.key] = obj.size;
+      }
+    }
+    this.clipboard = {
+      action: 'copy',
+      keys: selectedKeys,
+      sourceBucket: bucket,
+      sourcePrefix: prefix,
+      fileSizes
+    };
+    addToast('info', m.storage_action_copy_success({ count: selectedKeys.length }));
+  }
+
+  // ── Paste ──────────────────────────────────────────────────────────────────
+
+  /**
+   * Execute a paste operation into the given destination prefix.
+   * Caller should check storagePasteEnabled and clipboard non-empty first.
+   */
+  async paste(destPrefix: string): Promise<void> {
+    const bucket = this._callbacks.getBucket();
+    const pasteClipboard = this.clipboard;
+    if (!pasteClipboard) return;
+
+    const wasCut = pasteClipboard.action === 'cut';
+    const pasteKeys = [...pasteClipboard.keys];
+
+    // ── Check for name conflicts at destination ──────────────────────
+    const conflictEntries = await this._checkDestinationConflicts(pasteKeys, destPrefix);
+    const hasConflicts = conflictEntries.some((e) => e.conflict);
+    if (hasConflicts) {
+      // eslint-disable-next-line security/detect-object-injection
+      const totalBytes = pasteKeys.reduce((sum, k) => sum + (pasteClipboard.fileSizes[k] ?? 0), 0);
+      this._pendingConflictOp = {
+        type: 'paste',
+        keys: pasteKeys,
+        sourceBucket: pasteClipboard.sourceBucket,
+        destPrefix,
+        wasCut,
+        fileSizes: pasteClipboard.fileSizes,
+        sourcePrefix: pasteClipboard.sourcePrefix,
+        totalBytes
+      };
+      this._callbacks.openModal('resolve-conflicts', {
+        entries: conflictEntries,
+        bucket,
+        destPrefix,
+        confirmLabel: m.storage_action_paste()
+      });
+      return;
+    }
+
+    const opId = crypto.randomUUID();
+    const abortController = new AbortController();
+    const sourceNames = pasteKeys.map((k) => keyToName(k));
+    const isSinglePaste = sourceNames.length === 1;
+    const pasteLabel = isSinglePaste
+      ? `${m.storage_operation_paste_one({ count: 1 })}: ${sourceNames[0]}`
+      : `${m.storage_operation_paste_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+    // eslint-disable-next-line security/detect-object-injection
+    const totalBytes = pasteKeys.reduce((sum, k) => sum + (pasteClipboard.fileSizes[k] ?? 0), 0);
+    this._operations.startOp(
+      opId,
+      pasteLabel,
+      'paste',
+      pasteKeys.length,
+      abortController,
+      `${bucket}/${destPrefix}`,
+      sourceNames,
+      totalBytes
+    );
+    try {
+      let completedBytes = 0;
+      const fileSizes = pasteClipboard?.fileSizes ?? {};
+      const pasteSourceNames = pasteKeys.map((k) => keyToName(k));
+      const fileJobIdsAccum: string[] = [];
+      const { results, failed } = await this._performPasteSequential(
+        pasteKeys,
+        pasteClipboard.sourceBucket,
+        destPrefix,
+        wasCut,
+        abortController.signal,
+        (index, key) => {
+          // File-level progress: use the known file size from clipboard.
+          // eslint-disable-next-line security/detect-object-injection
+          completedBytes += fileSizes[key] ?? 0;
+          this._operations.updateOpProgress(opId, index, completedBytes, keyToName(key));
+        },
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        (loaded, _total) => {
+          // Byte-level progress during a large file's streaming upload.
+          const prevFiles =
+            this._operations.operations.find((op) => op.id === opId)?.completedCount ?? 0;
+          let prevBytes = 0;
+          for (let j = 0; j < prevFiles && j < pasteKeys.length; j++) {
+            // eslint-disable-next-line security/detect-object-injection
+            prevBytes += fileSizes[pasteKeys[j]] ?? 0;
+          }
+          this._operations.updateOpProgress(
+            opId,
+            prevFiles,
+            prevBytes + loaded,
+            // eslint-disable-next-line security/detect-object-injection
+            pasteSourceNames[prevFiles] ?? ''
+          );
+        },
+        (index, jobId) => {
+          // eslint-disable-next-line security/detect-object-injection
+          fileJobIdsAccum[index] = jobId;
+          this._operations.updateOpJobIds(opId, [...fileJobIdsAccum]);
+        }
+      );
+      await tick();
+      if (results.length === 0) {
+        this._operations.finishOp(opId, 'error');
+        addToast('error', m.storage_action_paste_error_source_not_found());
+        return;
+      }
+      this._operations.finishOp(opId, failed > 0 ? 'error' : 'done');
+      // Record destination files as recent visits
+      const newFileSizes: Record<string, number> = {};
+      for (const r of results) {
+        if (r.destKey.endsWith('/')) continue;
+        const size = pasteClipboard.fileSizes?.[r.sourceKey] ?? 0;
+        newFileSizes[r.destKey] = size;
+        this._callbacks.recordFileVisit(bucket, r.destKey, size);
+      }
+      if (failed > 0) {
+        addToast('warning', m.storage_action_paste_partial({ count: failed }));
+      } else {
+        addToast('success', m.storage_action_paste_success({ count: results.length }));
+      }
+      // After a cut paste (move), update clipboard keys to the destination
+      // keys so subsequent pastes copy from the newly created files.
+      if (wasCut && results.length > 0) {
+        const destKeys = results.map((r) => r.destKey);
+        // Invalidate source tabs so they refetch (items moved out)
+        if (pasteClipboard.sourcePrefix) {
+          this._callbacks.invalidateSourceTabs(pasteClipboard.sourcePrefix);
+        }
+        this.clipboard = {
+          action: 'copy',
+          keys: destKeys,
+          sourceBucket: bucket,
+          sourcePrefix: this._callbacks.getPrefix(),
+          fileSizes: newFileSizes
+        };
+      }
+      this._callbacks.refresh();
+      // Invalidate background tabs viewing the destination
+      this._callbacks.invalidateSourceTabs(destPrefix);
+    } catch (err: unknown) {
+      if (err instanceof DOMException && err.name === 'AbortError') {
+        this._operations.finishOp(opId, 'cancelled');
+        return;
+      }
+      if (pageUnloading) {
+        // Page is unloading — server-side copies continue regardless.
+        return;
+      }
+      this._operations.finishOp(opId, 'error');
+      addToast(
+        'error',
+        err instanceof ActionError ? getActionErrorMessage(err) : m.storage_action_paste_error()
+      );
+    }
+  }
+
+  // ── Move (drag-and-drop) ───────────────────────────────────────────────────
+
+  /** Validate a drag-and-drop move and open the confirmation dialog. */
+  performMove = (destPrefix: string, keys?: string[]): void => {
+    if (!storageMoveEnabled) return;
+    const objects = this._callbacks.getObjects();
+    const moveKeys = keys ?? [...this._callbacks.getSelectedKeys()];
+    if (moveKeys.length === 0) return;
+
+    // Don't move items that are already directly inside destPrefix (no-op).
+    const isAlreadyThere = (key: string): boolean => {
+      if (key.endsWith('/')) return key === destPrefix;
+      const parentPrefix = key.substring(0, key.lastIndexOf('/') + 1);
+      return parentPrefix === destPrefix;
+    };
+    if (moveKeys.every(isAlreadyThere)) return;
+
+    // Don't move a folder into itself
+    for (const k of moveKeys) {
+      if (k.endsWith('/') && destPrefix.startsWith(k)) return;
+    }
+
+    // Collect per-item metadata for the confirmation dialog
+    const items = moveKeys.map((key) => {
+      const obj = objects.objects.find((o) => o.key === key);
+      return {
+        key,
+        name: keyToName(key),
+        isDirectory: key.endsWith('/'),
+        size: obj && !obj.isDirectory ? obj.size : undefined
+      };
+    });
+
+    const sourcePrefix = this._commonPrefix(moveKeys);
+    this._pendingMove = { keys: moveKeys, destPrefix, items, sourcePrefix };
+    this._pendingSourcePrefix = sourcePrefix;
+    this._callbacks.openModal('confirm-move', { keys: moveKeys, destPrefix, items });
+  };
+
+  confirmMove = async (): Promise<void> => {
+    if (!this._pendingMove) return;
+    const { keys: moveKeys, destPrefix, items } = this._pendingMove;
+    this._pendingMove = null;
+    this._callbacks.closeModal();
+
+    const bucket = this._callbacks.getBucket();
+
+    // ── Check for name conflicts at destination ──────────────────────────
+    const conflictEntries = await this._checkDestinationConflicts(moveKeys, destPrefix);
+    const hasConflicts = conflictEntries.some((e) => e.conflict);
+    if (hasConflicts) {
+      const totalBytes = items.reduce((sum, item) => sum + (item.size ?? 0), 0);
+      this._pendingConflictOp = {
+        type: 'move',
+        keys: moveKeys,
+        destPrefix,
+        items,
+        sourcePrefix: this._pendingSourcePrefix,
+        totalBytes
+      };
+      this._callbacks.openModal('resolve-conflicts', {
+        entries: conflictEntries,
+        bucket,
+        destPrefix,
+        confirmLabel: m.storage_action_move()
+      });
+      return;
+    }
+
+    const opId = crypto.randomUUID();
+    const abortController = new AbortController();
+    const sourceNames = moveKeys.map((k) => keyToName(k));
+    const totalBytes = items.reduce((sum, item) => sum + (item.size ?? 0), 0);
+    const isSingleMove = sourceNames.length === 1;
+    const moveLabel = isSingleMove
+      ? `${m.storage_operation_move_one({ count: 1 })}: ${sourceNames[0]}`
+      : `${m.storage_operation_move_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+    this._operations.startOp(
+      opId,
+      moveLabel,
+      'move',
+      moveKeys.length,
+      abortController,
+      `${bucket}/${destPrefix}`,
+      sourceNames,
+      totalBytes
+    );
+
+    try {
+      const results: Array<{ sourceKey: string; destKey: string }> = [];
+      let failed = 0;
+      const fileJobIds: string[] = [];
+
+      for (let i = 0; i < moveKeys.length; i++) {
+        if (abortController.signal.aborted) {
+          throw new DOMException('Aborted', 'AbortError');
+        }
+
+        // eslint-disable-next-line security/detect-object-injection
+        const sourceKey = moveKeys[i];
+        const fileJobId = crypto.randomUUID();
+        fileJobIds.push(fileJobId);
+        this._operations.updateOpJobIds(opId, [...fileJobIds]);
+
+        try {
+          const result = await this._api.move({
+            bucket,
+            sourceKeys: [sourceKey],
+            destinationPrefix: destPrefix,
+            progress: true,
+            jobId: fileJobId,
+            signal: abortController.signal,
+            callbacks: {
+              onProgress: (_sourceKey, _destKey, loaded) => {
+                const prevBytes = results.reduce((sum, r) => {
+                  const item = items.find((it) => it.key === r.sourceKey);
+                  return sum + (item?.size ?? 0);
+                }, 0);
+                this._operations.updateOpProgress(
+                  opId,
+                  i + 1,
+                  prevBytes + loaded,
+                  keyToName(sourceKey)
+                );
+              },
+              onComplete: (finalResults, finalFailed) => {
+                if (finalResults.length > 0) {
+                  results.length = 0;
+                  results.push(...finalResults);
+                }
+                if (finalFailed.length > 0) {
+                  failed = finalFailed.length;
+                }
+              }
+            }
+          });
+          results.push(...result.results);
+          failed += result.failed;
+          const completedBytes = results.reduce((sum, r) => {
+            const item = items.find((it) => it.key === r.sourceKey);
+            return sum + (item?.size ?? 0);
+          }, 0);
+          this._operations.updateOpProgress(opId, i + 1, completedBytes, keyToName(sourceKey));
+        } catch {
+          failed++;
+        }
+      }
+
+      await tick();
+      this._operations.finishOp(opId, failed === 0 ? 'done' : 'error');
+
+      if (results.length > 0) {
+        addToast('success', m.storage_action_move_success({ count: results.length }));
+        const movedKeys = results.map((r) => r.sourceKey).filter((k) => !k.endsWith('/'));
+        if (movedKeys.length > 0) {
+          this._callbacks.removeFiles(bucket, movedKeys);
+        }
+        for (const r of results) {
+          if (!r.destKey.endsWith('/')) {
+            const item = items.find((it) => it.key === r.sourceKey);
+            if (item && item.size) {
+              this._callbacks.recordFileVisit(bucket, r.destKey, item.size);
+            }
+          }
+        }
+      }
+      if (failed > 0) {
+        addToast('warning', m.storage_action_move_partial({ count: failed }));
+      }
+
+      this._callbacks.clearSelection();
+      if (this._pendingSourcePrefix !== null) {
+        this._callbacks.invalidateSourceTabs(this._pendingSourcePrefix);
+        this._pendingSourcePrefix = null;
+      }
+      // Invalidate background tabs viewing the destination
+      this._callbacks.invalidateSourceTabs(destPrefix);
+      this._callbacks.refresh();
+    } catch (err: unknown) {
+      if (err instanceof DOMException && err.name === 'AbortError') {
+        this._operations.finishOp(opId, 'cancelled');
+        this._pendingSourcePrefix = null;
+        return;
+      }
+      if (pageUnloading) {
+        return;
+      }
+      this._operations.finishOp(opId, 'error');
+      this._pendingSourcePrefix = null;
+      addToast('error', m.storage_action_move_error());
+    }
+  };
+
+  cancelMove = (): void => {
+    this._pendingMove = null;
+    this._callbacks.closeModal();
+  };
+
+  // ── Conflict resolution ────────────────────────────────────────────────────
+
+  confirmConflictResolution = async (resolvedEntries: ConflictEntry[]): Promise<void> => {
+    const pending = this._pendingConflictOp;
+    if (!pending) return;
+    this._pendingConflictOp = null;
+    this._callbacks.closeModal();
+
+    if (pending.type === 'paste') {
+      await this._executePasteWithConflicts(pending, resolvedEntries);
+    } else {
+      await this._executeMoveWithConflicts(pending, resolvedEntries);
+    }
+  };
+
+  cancelConflictResolution = (): void => {
+    this._pendingConflictOp = null;
+    this._callbacks.closeModal();
+  };
+
+  // ── Clipboard cleanup ──────────────────────────────────────────────────────
+
+  /**
+   * Remove deleted keys from the clipboard after a delete operation.
+   * Called after performDelete in StorageState.
+   */
+  removeDeletedKeys(bucket: string, keys: string[]): void {
+    if (this.clipboard && this.clipboard.sourceBucket === bucket) {
+      const remainingKeys = this.clipboard.keys.filter((k) => !keys.includes(k));
+      if (remainingKeys.length !== this.clipboard.keys.length) {
+        if (remainingKeys.length === 0) {
+          this.clipboard = null;
+        } else {
+          const remainingSizes: Record<string, number> = {};
+          for (const k of remainingKeys) {
+            // eslint-disable-next-line security/detect-object-injection
+            if (this.clipboard.fileSizes[k] !== undefined) {
+              // eslint-disable-next-line security/detect-object-injection
+              remainingSizes[k] = this.clipboard.fileSizes[k];
+            }
+          }
+          this.clipboard = { ...this.clipboard, keys: remainingKeys, fileSizes: remainingSizes };
+        }
+      }
+    }
+  }
+
+  // ── Private: Paste helpers ─────────────────────────────────────────────────
+
+  private async _performPaste(
+    keys: string[],
+    _sourceBucket: string,
+    destPrefix: string,
+    deleteOriginals = false,
+    signal?: AbortSignal
+  ): Promise<{
+    results: Array<{ sourceKey: string; destKey: string }>;
+    failed: number;
+  }> {
+    if (deleteOriginals) {
+      return this._api.move({
+        bucket: this._callbacks.getBucket(),
+        sourceKeys: keys,
+        destinationPrefix: destPrefix,
+        signal
+      });
+    }
+    return this._api.copy({
+      bucket: this._callbacks.getBucket(),
+      sourceKeys: keys,
+      destinationPrefix: destPrefix,
+      signal
+    });
+  }
+
+  /**
+   * Process paste/move keys one at a time, calling `onFileComplete` after
+   * each file so the caller can update byte-level progress.
+   */
+  private async _performPasteSequential(
+    keys: string[],
+    _sourceBucket: string,
+    destPrefix: string,
+    deleteOriginals = false,
+    signal?: AbortSignal,
+    onFileComplete?: (index: number, key: string) => void,
+    onFileProgress?: (loaded: number, total: number) => void,
+    onFileJobId?: (index: number, jobId: string) => void
+  ): Promise<{
+    results: Array<{ sourceKey: string; destKey: string }>;
+    failed: number;
+    fileJobIds: string[];
+  }> {
+    const results: Array<{ sourceKey: string; destKey: string }> = [];
+    let failed = 0;
+    const fileJobIds: string[] = [];
+    const moveFn = deleteOriginals
+      ? (params: Parameters<StorageApi['move']>[0]) => this._api.move(params)
+      : (params: Parameters<StorageApi['copy']>[0]) => this._api.copy(params);
+
+    for (let i = 0; i < keys.length; i++) {
+      if (signal?.aborted) throw new DOMException('Aborted', 'AbortError');
+
+      // eslint-disable-next-line security/detect-object-injection
+      const sourceKey = keys[i];
+      const fileJobId = crypto.randomUUID();
+      fileJobIds.push(fileJobId);
+      onFileJobId?.(i, fileJobId);
+
+      try {
+        const result = await moveFn({
+          bucket: this._callbacks.getBucket(),
+          sourceKeys: [sourceKey],
+          destinationPrefix: destPrefix,
+          progress: true,
+          jobId: fileJobId,
+          signal,
+          callbacks: {
+            onProgress: onFileProgress
+              ? (_sourceKey, _destKey, loaded, total) => onFileProgress(loaded, total)
+              : undefined
+          }
+        });
+        results.push(...result.results);
+        failed += result.failed;
+      } catch {
+        failed++;
+      }
+      onFileComplete?.(i + 1, sourceKey);
+    }
+
+    return { results, failed, fileJobIds };
+  }
+
+  // ── Private: Conflict resolution ──────────────────────────────────────────
+
+  /**
+   * Check which destination keys already exist, returning ConflictEntry[]
+   * with conflict=true for existing keys.
+   */
+  private async _checkDestinationConflicts(
+    keys: string[],
+    destPrefix: string
+  ): Promise<ConflictEntry[]> {
+    const bucket = this._callbacks.getBucket();
+    const results: ConflictEntry[] = [];
+
+    for (const key of keys) {
+      const origName = keyToName(key);
+      const destKey = destPrefix + origName;
+      let conflict = false;
+      try {
+        conflict = await this._api.checkObjectExists({ bucket, key: destKey });
+      } catch {
+        // If the check fails, assume no conflict and proceed
+      }
+      results.push({
+        id: crypto.randomUUID(),
+        originalName: origName,
+        conflict,
+        resolution: conflict ? null : 'replace',
+        customName: origName,
+        renameState: 'idle',
+        sourceKey: key
+      });
+    }
+
+    return results;
+  }
+
+  /**
+   * Delete conflicting destination files before copy/move to prevent
+   * the server from auto-renaming them with " (2)" suffix.
+   */
+  private async _deleteConflictingDests(
+    destPrefix: string,
+    resolvedEntries: ConflictEntry[]
+  ): Promise<void> {
+    const bucket = this._callbacks.getBucket();
+    const keysToDelete: string[] = [];
+    for (const entry of resolvedEntries) {
+      if (entry.resolution === 'skip' || entry.resolution === 'rename') continue;
+      if (entry.conflict) {
+        keysToDelete.push(destPrefix + entry.originalName);
+      }
+    }
+
+    if (keysToDelete.length === 0) return;
+
+    try {
+      await this._api.delete({ bucket, keys: keysToDelete });
+    } catch {
+      // Best-effort - if deletion fails, the server may auto-rename
+    }
+  }
+
+  /**
+   * Execute a paste operation with conflict resolutions.
+   * Renamed entries are first pasted with their original name, then renamed.
+   */
+  private async _executePasteWithConflicts(
+    pending: PendingPasteOp,
+    resolvedEntries: ConflictEntry[]
+  ): Promise<void> {
+    const bucket = this._callbacks.getBucket();
+    const resolvedMap = new SvelteMap(
+      resolvedEntries.map((e) => [e.sourceKey ?? e.originalName, e])
+    );
+
+    // Split keys by resolution
+    const replaceKeys: string[] = [];
+    const renameKeys: Array<{ sourceKey: string; newName: string }> = [];
+
+    for (const key of pending.keys) {
+      const entry = resolvedMap.get(key) ?? resolvedMap.get(keyToName(key));
+      if (!entry || entry.resolution === 'skip') continue;
+      if (entry.resolution === 'rename') {
+        renameKeys.push({ sourceKey: key, newName: entry.customName.trim() });
+      }
+      replaceKeys.push(key);
+    }
+
+    if (replaceKeys.length === 0 && renameKeys.length === 0) return;
+
+    const opId = crypto.randomUUID();
+    const abortController = new AbortController();
+    const sourceNames = pending.keys.map((k) => keyToName(k));
+    const isSinglePaste = pending.keys.length === 1;
+    const pasteLabel = isSinglePaste
+      ? `${m.storage_operation_paste_one({ count: 1 })}: ${sourceNames[0]}`
+      : `${m.storage_operation_paste_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+
+    this._operations.startOp(
+      opId,
+      pasteLabel,
+      'paste',
+      replaceKeys.length + renameKeys.length,
+      abortController,
+      `${bucket}/${pending.destPrefix}`,
+      sourceNames,
+      pending.totalBytes
+    );
+
+    await this._deleteConflictingDests(pending.destPrefix, resolvedEntries);
+
+    try {
+      const { results, failed } = await this._performPasteSequential(
+        replaceKeys,
+        pending.sourceBucket,
+        pending.destPrefix,
+        pending.wasCut,
+        abortController.signal,
+        (index, key) => {
+          this._operations.updateOpProgress(opId, index, 0, keyToName(key));
+        },
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        (loaded, _total) => {
+          const prevFiles =
+            this._operations.operations.find((op) => op.id === opId)?.completedCount ?? 0;
+          this._operations.updateOpProgress(opId, prevFiles, loaded, '');
+        }
+      );
+
+      // Handle renamed files: rename the already-pasted destination file
+      const destKeyMap = new SvelteMap(results.map((r) => [r.sourceKey, r.destKey]));
+      let renameFailed = 0;
+      for (const rename of renameKeys) {
+        if (abortController.signal.aborted) break;
+        const destKey = destKeyMap.get(rename.sourceKey);
+        if (!destKey) {
+          renameFailed++;
+          continue;
+        }
+        const newKey = pending.destPrefix + rename.newName;
+        try {
+          await this._api.rename({ bucket, key: destKey, newKey });
+          this._operations.updateOpProgress(
+            opId,
+            replaceKeys.length + renameKeys.indexOf(rename) + 1,
+            0,
+            rename.newName
+          );
+        } catch {
+          renameFailed++;
+        }
+      }
+
+      await tick();
+      const totalFailed = failed + renameFailed;
+      this._operations.finishOp(opId, totalFailed > 0 ? 'error' : 'done');
+
+      if (totalFailed > 0) {
+        addToast('warning', m.storage_action_paste_partial({ count: totalFailed }));
+      } else {
+        addToast(
+          'success',
+          m.storage_action_paste_success({ count: replaceKeys.length + renameKeys.length })
+        );
+      }
+      this._callbacks.refresh();
+    } catch (err: unknown) {
+      if (err instanceof DOMException && err.name === 'AbortError') {
+        this._operations.finishOp(opId, 'cancelled');
+        return;
+      }
+      if (pageUnloading) {
+        return;
+      }
+      this._operations.finishOp(opId, 'error');
+      addToast('error', m.storage_action_paste_error());
+    }
+  }
+
+  /**
+   * Execute a move operation with conflict resolutions.
+   * For "replace" entries: delete the conflicting destination first, then move.
+   * For "rename" entries: rename the source at its current location first,
+   * then move the renamed source to the destination — the file never appears
+   * at the original name in the destination.
+   */
+  private async _executeMoveWithConflicts(
+    pending: PendingMoveOp,
+    resolvedEntries: ConflictEntry[]
+  ): Promise<void> {
+    const bucket = this._callbacks.getBucket();
+    const resolvedMap = new SvelteMap(
+      resolvedEntries.map((e) => [e.sourceKey ?? e.originalName, e])
+    );
+
+    // Split keys by resolution — rename entries are NOT added to replaceKeys here.
+    // They will be renamed at source first, then added to replaceKeys before the move loop.
+    const replaceKeys: string[] = [];
+    const renameKeys: Array<{ sourceKey: string; newName: string }> = [];
+
+    for (const key of pending.keys) {
+      const entry = resolvedMap.get(key) ?? resolvedMap.get(keyToName(key));
+      if (!entry || entry.resolution === 'skip') continue;
+      if (entry.resolution === 'rename') {
+        renameKeys.push({ sourceKey: key, newName: entry.customName.trim() });
+      } else {
+        replaceKeys.push(key);
+      }
+    }
+
+    if (replaceKeys.length === 0 && renameKeys.length === 0) return;
+
+    const opId = crypto.randomUUID();
+    const abortController = new AbortController();
+    const sourceNames = pending.keys.map((k) => keyToName(k));
+    const totalCount = replaceKeys.length + renameKeys.length;
+    const isSingleMove = totalCount === 1;
+    const moveLabel = isSingleMove
+      ? `${m.storage_operation_move_one({ count: 1 })}: ${sourceNames[0]}`
+      : `${m.storage_operation_move_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
+
+    this._operations.startOp(
+      opId,
+      moveLabel,
+      'move',
+      totalCount,
+      abortController,
+      `${bucket}/${pending.destPrefix}`,
+      sourceNames,
+      pending.totalBytes
+    );
+
+    // Only delete conflicting destinations for "replace" entries
+    await this._deleteConflictingDests(pending.destPrefix, resolvedEntries);
+
+    try {
+      const results: Array<{ sourceKey: string; destKey: string }> = [];
+      let renameFailed = 0;
+      let failed = 0;
+
+      // ── Pre-processing: rename rename entries at source before moving ─────
+      for (const rename of renameKeys) {
+        if (abortController.signal.aborted) break;
+
+        const parts = rename.sourceKey.split('/');
+        parts.pop();
+        const parentPrefix = parts.length > 0 ? parts.join('/') + '/' : '';
+        const renamedSourceKey =
+          parentPrefix + rename.newName + (rename.sourceKey.endsWith('/') ? '/' : '');
+
+        try {
+          await this._api.rename({
+            bucket,
+            key: rename.sourceKey,
+            newKey: renamedSourceKey
+          });
+          replaceKeys.push(renamedSourceKey);
+        } catch {
+          renameFailed++;
+        }
+      }
+
+      failed = renameFailed;
+
+      // ── Move all entries ────────────────────────────────────────────────────
+
+      for (const key of replaceKeys) {
+        if (abortController.signal.aborted) {
+          throw new DOMException('Aborted', 'AbortError');
+        }
+
+        try {
+          const result = await this._api.move({
+            bucket,
+            sourceKeys: [key],
+            destinationPrefix: pending.destPrefix,
+            progress: true,
+            signal: abortController.signal,
+            callbacks: {
+              onComplete: (finalResults, finalFailed) => {
+                if (finalResults.length > 0) {
+                  results.length = 0;
+                  results.push(...finalResults);
+                }
+                if (finalFailed.length > 0) {
+                  failed = finalFailed.length;
+                }
+              }
+            }
+          });
+          results.push(...result.results);
+          failed += result.failed;
+        } catch {
+          failed++;
+        }
+        this._operations.updateOpProgress(opId, results.length, 0, keyToName(key));
+      }
+
+      await tick();
+      const totalFailed = renameFailed + failed;
+      this._operations.finishOp(opId, totalFailed === 0 ? 'done' : 'error');
+
+      if (results.length > 0) {
+        addToast('success', m.storage_action_move_success({ count: results.length }));
+        const movedKeys = results.map((r) => r.sourceKey).filter((k) => !k.endsWith('/'));
+        if (movedKeys.length > 0) {
+          this._callbacks.removeFiles(bucket, movedKeys);
+        }
+        for (const r of results) {
+          if (!r.destKey.endsWith('/')) {
+            const item = pending.items.find((it) => it.key === r.sourceKey);
+            if (item && item.size) {
+              this._callbacks.recordFileVisit(bucket, r.destKey, item.size);
+            }
+          }
+        }
+      }
+      if (totalFailed > 0) {
+        addToast('warning', m.storage_action_move_partial({ count: totalFailed }));
+      }
+
+      this._callbacks.clearSelection();
+      if (pending.sourcePrefix !== null) {
+        this._callbacks.invalidateSourceTabs(pending.sourcePrefix);
+      }
+      // Invalidate background tabs viewing the destination
+      this._callbacks.invalidateSourceTabs(pending.destPrefix);
+      this._callbacks.refresh();
+    } catch (err: unknown) {
+      if (err instanceof DOMException && err.name === 'AbortError') {
+        this._operations.finishOp(opId, 'cancelled');
+        return;
+      }
+      if (pageUnloading) {
+        return;
+      }
+      this._operations.finishOp(opId, 'error');
+      addToast('error', m.storage_action_move_error());
+    }
+  }
+
+  // ── Private: Helpers ───────────────────────────────────────────────────────
+
+  /** Returns the longest common directory prefix of the given keys. */
+  private _commonPrefix(keys: string[]): string {
+    if (keys.length === 0) return '';
+    const parts = keys[0].split('/');
+    parts.pop(); // remove filename
+    let prefix = parts.join('/') ? parts.join('/') + '/' : '';
+    for (let i = 1; i < keys.length; i++) {
+      // eslint-disable-next-line security/detect-object-injection
+      while (prefix && !keys[i].startsWith(prefix)) {
+        const idx = prefix.lastIndexOf('/', prefix.length - 2);
+        prefix = idx >= 0 ? prefix.substring(0, idx + 1) : '';
+      }
+    }
+    return prefix;
+  }
+}
diff --git a/src/lib/storage/connection-id-header.ts b/src/lib/storage/connection-id-header.ts
index c8c76f55..a7302d1c 100644
--- a/src/lib/storage/connection-id-header.ts
+++ b/src/lib/storage/connection-id-header.ts
@@ -6,3 +6,13 @@
  * authenticated user ID, then decrypts the stored credentials.
  */
 export const STORAGE_CONNECTION_ID_HEADER = 'x-storage-connection-id';
+
+export interface SavedConnection {
+  id: string;
+  name: string;
+  host: string;
+  port: number | null;
+  type: 's3';
+  region: { name: string };
+  credentials?: { accessKey: string; secretKey: string };
+}
diff --git a/src/lib/storage/connection-storage.ts b/src/lib/storage/connection-storage.ts
deleted file mode 100644
index e789643c..00000000
--- a/src/lib/storage/connection-storage.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-export interface SavedConnection {
-  id: string;
-  name: string;
-  host: string;
-  port: number | null;
-  type: 's3';
-  region: { name: string };
-  credentials?: { accessKey: string; secretKey: string };
-}
diff --git a/src/lib/storage/context.ts b/src/lib/storage/context.ts
index 989b4317..4d692899 100644
--- a/src/lib/storage/context.ts
+++ b/src/lib/storage/context.ts
@@ -1,4 +1,6 @@
 import { createContext } from 'svelte';
 import type { StorageState } from './state.svelte.js';
+import type { TabsState } from './tabs.svelte.js';
 
 export const [getStorageState, setStorageState] = createContext<StorageState>();
+export const [getTabsState, setTabsState] = createContext<TabsState>();
diff --git a/src/lib/storage/download.ts b/src/lib/storage/download.ts
index b1f608f2..0a76b951 100644
--- a/src/lib/storage/download.ts
+++ b/src/lib/storage/download.ts
@@ -2,10 +2,8 @@
  * Client-side utility for downloading a single S3 object via the server proxy.
  *
  * Strategy:
- *  1. Fetch the object with the `x-storage-connection-id` header carrying the
- *     active connection UUID from the connection store.
- *  2. On error: throw a `DownloadError` with a typed `code` so the caller can
- *     display a localised message.
+ *  1. Fetch the object via `storageFetch` which injects the connection header
+ *     and maps HTTP errors to `StorageError`.
  *  3. On success: create a Blob URL and trigger a native browser download via a
  *     programmatic anchor click.
  *
@@ -15,36 +13,10 @@
  * proportional browser memory — see TECH_DEBT.md for the long-term fix.
  */
 
-import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+import { createStorageFetch } from '$lib/storage/storage-fetch.js';
+import type { StorageErrorCode } from '$lib/storage/errors.js';
 
-export type DownloadErrorCode =
-  | 'not_connected'
-  | 'access_denied'
-  | 'not_found'
-  | 'server_error'
-  | 'unknown';
-
-export class DownloadError extends Error {
-  constructor(
-    public readonly code: DownloadErrorCode,
-    message: string
-  ) {
-    super(message);
-    this.name = 'DownloadError';
-  }
-}
-
-function buildDownloadUrl(bucket: string, key: string): string {
-  return `/api/storage/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
-}
-
-function mapStatusToCode(status: number): DownloadErrorCode {
-  if (status === 401) return 'not_connected';
-  if (status === 403) return 'access_denied';
-  if (status === 404) return 'not_found';
-  if (status >= 500) return 'server_error';
-  return 'unknown';
-}
+export type DownloadErrorCode = StorageErrorCode;
 
 /**
  * Download a single S3 object.
@@ -52,23 +24,17 @@ function mapStatusToCode(status: number): DownloadErrorCode {
  * Fetches the object with the connection ID header, buffers it as a Blob,
  * then triggers a native browser download via a programmatic anchor click.
  *
- * @throws {DownloadError} when the server returns a non-2xx response.
+ * @throws {StorageError} when the server returns a non-2xx response.
  */
 export async function downloadObject(
   bucket: string,
   key: string,
   connectionId: string
 ): Promise<void> {
-  const url = buildDownloadUrl(bucket, key);
-
-  const response = await fetch(url, {
-    headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-  });
+  const fetch_ = createStorageFetch(() => connectionId);
+  const url = `/api/storage/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
 
-  if (!response.ok) {
-    const code = mapStatusToCode(response.status);
-    throw new DownloadError(code, `Download failed with status ${response.status}`);
-  }
+  const response = await fetch_(url);
 
   const blob = await response.blob();
   const blobUrl = URL.createObjectURL(blob);
diff --git a/src/lib/storage/drag-handlers.ts b/src/lib/storage/drag-handlers.ts
index fa6e7244..4cf2ef76 100644
--- a/src/lib/storage/drag-handlers.ts
+++ b/src/lib/storage/drag-handlers.ts
@@ -11,9 +11,9 @@ import { storageCutCopyEnabled, storageMoveEnabled } from '$lib/client/feature-f
 export function handleRowDragStart(
   e: DragEvent,
   itemKey: string,
-  state: { selectedKeys: Set<string>; isInArchive: boolean }
+  state: { selectedKeys: Set<string>; archive: { isInArchive: boolean } }
 ): void {
-  if (!storageCutCopyEnabled || state.isInArchive) return;
+  if (!storageCutCopyEnabled || state.archive.isInArchive) return;
   if (!state.selectedKeys.has(itemKey)) {
     state.selectedKeys = new SvelteSet<string>([itemKey]);
   }
@@ -38,6 +38,6 @@ export function parseStorageDropKeys(e: DragEvent): string[] | null {
 /**
  * Check whether a storage drag-drop is allowed in the current context.
  */
-export function canStorageDrop(storage: { isInArchive: boolean }): boolean {
-  return storageMoveEnabled && !storage.isInArchive;
+export function canStorageDrop(storage: { archive: { isInArchive: boolean } }): boolean {
+  return storageMoveEnabled && !storage.archive.isInArchive;
 }
diff --git a/src/lib/storage/errors.ts b/src/lib/storage/errors.ts
index a9313a86..275deca1 100644
--- a/src/lib/storage/errors.ts
+++ b/src/lib/storage/errors.ts
@@ -1,20 +1,41 @@
 import * as m from '$lib/paraglide/messages.js';
 
-// ── ActionError ──────────────────────────────────────────────────────────────
+// ── StorageError (unified error hierarchy) ───────────────────────────────────
 
-export class ActionError extends Error {
+export type StorageErrorCode =
+  | 'not_connected'
+  | 'access_denied'
+  | 'not_found'
+  | 'conflict'
+  | 'server_error'
+  | 'no_such_bucket'
+  | 'invalid_part'
+  | 'unknown';
+
+export type ActionErrorCode = StorageErrorCode;
+
+export class StorageError extends Error {
   constructor(
     public readonly code: string,
     message: string
   ) {
     super(message);
+    this.name = 'StorageError';
+  }
+}
+
+// ── ActionError (backward-compatible alias) ──────────────────────────────────
+
+export class ActionError extends StorageError {
+  constructor(code: string, message: string) {
+    super(code, message);
     this.name = 'ActionError';
   }
 }
 
 // ── Error message mapping ────────────────────────────────────────────────────
 
-export function getActionErrorMessage(err: ActionError): string {
+export function getActionErrorMessage(err: StorageError): string {
   switch (err.code) {
     case 'not_connected':
       return m.storage_download_error_not_connected();
@@ -34,5 +55,5 @@ export function getActionErrorMessage(err: ActionError): string {
 }
 
 export function getActionErrorMessageForCode(code: string): string {
-  return getActionErrorMessage(new ActionError(code, ''));
+  return getActionErrorMessage(new StorageError(code, ''));
 }
diff --git a/src/lib/storage/ndjson-stream.ts b/src/lib/storage/ndjson-stream.ts
new file mode 100644
index 00000000..6eb598c4
--- /dev/null
+++ b/src/lib/storage/ndjson-stream.ts
@@ -0,0 +1,136 @@
+/**
+ * Shared NDJSON streaming reader for storage operation progress events.
+ *
+ * The server returns NDJSON (newline-delimited JSON) for copy/move operations
+ * when ?progress=true. Each line is a typed event:
+ *
+ *   {"type":"progress","sourceKey":"...","destKey":"...","loaded":N,"total":N}
+ *   {"type":"done","sourceKey":"...","destKey":"..."}
+ *   {"type":"failed","sourceKey":"...","error":"..."}
+ *   {"type":"complete","results":[...],"failed":[...]}
+ *   {"type":"status","message":"..."}
+ *
+ * This module extracts the buffered-reader + parse + dispatch loop that was
+ * previously duplicated across three places in StorageState.
+ */
+
+export interface NdjsonStreamEvent {
+  type: string;
+  sourceKey?: string;
+  destKey?: string;
+  loaded?: number;
+  total?: number;
+  error?: string;
+  results?: Array<{ sourceKey: string; destKey: string }>;
+  moved?: Array<{ sourceKey: string; destKey: string }>;
+  failed?: Array<{ sourceKey: string; error: string }>;
+  message?: string;
+}
+
+export interface NdjsonStreamCallbacks {
+  onProgress?: (sourceKey: string, destKey: string, loaded: number, total: number) => void;
+  onDone?: (sourceKey: string, destKey: string) => void;
+  onFailed?: (sourceKey: string, error: string) => void;
+  onComplete?: (
+    results: Array<{ sourceKey: string; destKey: string }>,
+    failed: Array<{ sourceKey: string; error: string }>
+  ) => void;
+  onStatus?: (message: string) => void;
+}
+
+export interface NdjsonStreamResult {
+  results: Array<{ sourceKey: string; destKey: string }>;
+  failed: Array<{ sourceKey: string; error: string }>;
+}
+
+/**
+ * Read an NDJSON stream from a fetch Response body, dispatching typed events
+ * to the provided callbacks.
+ *
+ * Returns the aggregated results and failures. The `complete` event (if present)
+ * replaces any results/failures accumulated from individual `done`/`failed`
+ * events, matching the server's convention of sending a final summary line.
+ */
+export async function readNdjsonStream(
+  stream: ReadableStream<Uint8Array> | null,
+  callbacks: NdjsonStreamCallbacks = {}
+): Promise<NdjsonStreamResult> {
+  const results: Array<{ sourceKey: string; destKey: string }> = [];
+  const failed: Array<{ sourceKey: string; error: string }> = [];
+
+  if (!stream) return { results, failed };
+
+  const reader = stream.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+
+      buffer += decoder.decode(value, { stream: true });
+      const lines = buffer.split('\n');
+      buffer = lines.pop() ?? '';
+
+      for (const line of lines) {
+        if (!line.trim()) continue;
+        const event = JSON.parse(line) as NdjsonStreamEvent;
+
+        switch (event.type) {
+          case 'progress':
+            if (event.loaded !== undefined && event.total !== undefined) {
+              callbacks.onProgress?.(
+                event.sourceKey ?? '',
+                event.destKey ?? '',
+                event.loaded,
+                event.total
+              );
+            }
+            break;
+
+          case 'done':
+            if (event.sourceKey && event.destKey) {
+              results.push({ sourceKey: event.sourceKey, destKey: event.destKey });
+              callbacks.onDone?.(event.sourceKey, event.destKey);
+            }
+            break;
+
+          case 'failed':
+            if (event.sourceKey) {
+              failed.push({ sourceKey: event.sourceKey, error: event.error ?? 'Unknown error' });
+              callbacks.onFailed?.(event.sourceKey, event.error ?? 'Unknown error');
+            }
+            break;
+
+          case 'complete': {
+            const finalResults = (event.results ?? event.moved) as
+              | Array<{ sourceKey: string; destKey: string }>
+              | undefined;
+            const finalFailed = event.failed as
+              | Array<{ sourceKey: string; error: string }>
+              | undefined;
+            if (finalResults) {
+              results.length = 0;
+              results.push(...finalResults);
+            }
+            if (finalFailed) {
+              failed.length = 0;
+              failed.push(...finalFailed);
+            }
+            callbacks.onComplete?.(finalResults ?? results, finalFailed ?? failed);
+            break;
+          }
+
+          case 'status':
+            callbacks.onStatus?.(event.message ?? '');
+            break;
+        }
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+
+  return { results, failed };
+}
diff --git a/src/lib/storage/operations.svelte.spec.ts b/src/lib/storage/operations.svelte.spec.ts
new file mode 100644
index 00000000..ac84b7d1
--- /dev/null
+++ b/src/lib/storage/operations.svelte.spec.ts
@@ -0,0 +1,751 @@
+vi.mock('$app/environment', () => ({ browser: true }));
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { OperationsState } from './operations.svelte.js';
+import type { StorageApi } from './api.js';
+import type { StorageOperation } from './types.js';
+
+const OPERATIONS_HISTORY_KEY = 'storage_operations_history';
+
+// ── Fixtures ─────────────────────────────────────────────────────────────────
+
+function makeMockApi(): StorageApi {
+  return {
+    pollJob: vi.fn().mockResolvedValue({ status: 'done' }),
+    list: vi.fn(),
+    copy: vi.fn(),
+    move: vi.fn(),
+    rename: vi.fn(),
+    delete: vi.fn(),
+    create: vi.fn(),
+    archiveExtract: vi.fn(),
+    archiveListing: vi.fn(),
+    checkObjectExists: vi.fn(),
+    preview: vi.fn(),
+    saveText: vi.fn(),
+    details: vi.fn(),
+    directoryMetadata: vi.fn(),
+    directorySize: vi.fn(),
+    bucketDetails: vi.fn(),
+    checkBucket: vi.fn(),
+    updateConnections: vi.fn()
+  } as unknown as StorageApi;
+}
+
+function makeOpts(
+  overrides?: Partial<import('./operations.svelte.js').OperationsStateOpts>
+): import('./operations.svelte.js').OperationsStateOpts {
+  return {
+    getBucket: () => 'test-bucket',
+    getPrefix: () => '',
+    ...overrides
+  };
+}
+
+function makeOp(overrides?: Partial<StorageOperation>): StorageOperation {
+  return {
+    id: 'op-1',
+    label: 'Copy: file.txt',
+    status: 'running',
+    type: 'paste',
+    itemCount: 1,
+    completedCount: 0,
+    startedAt: Date.now(),
+    destPath: 'test-bucket/test/',
+    sourceNames: ['file.txt'],
+    totalBytes: 100,
+    completedBytes: 0,
+    ...overrides
+  };
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  localStorage.clear();
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Group 1: localStorage persistence
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('localStorage persistence', () => {
+  it('constructor reads running ops from localStorage and marks them interrupted', () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([makeOp({ id: 'op-1', status: 'running' })])
+    );
+
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    expect(state.operations).toHaveLength(1);
+    expect(state.operations[0].id).toBe('op-1');
+    expect(state.operations[0].status).toBe('interrupted');
+  });
+
+  it('constructor handles malformed JSON gracefully', () => {
+    localStorage.setItem(OPERATIONS_HISTORY_KEY, 'not-valid-json');
+
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    expect(state.operations).toEqual([]);
+  });
+
+  it('constructor handles non-array JSON gracefully', () => {
+    localStorage.setItem(OPERATIONS_HISTORY_KEY, '{"key": "value"}');
+
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    expect(state.operations).toEqual([]);
+  });
+
+  it('constructor handles missing localStorage key gracefully', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    expect(state.operations).toEqual([]);
+  });
+
+  it('startOp persists a running operation to localStorage', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    state.startOp('op-1', 'Copy: file.txt', 'paste', 1);
+
+    const stored = JSON.parse(localStorage.getItem(OPERATIONS_HISTORY_KEY)!) as StorageOperation[];
+    expect(stored).toHaveLength(1);
+    expect(stored[0].id).toBe('op-1');
+    expect(stored[0].status).toBe('running');
+  });
+
+  it('finishOp updates the operation status in localStorage', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Copy: file.txt', 'paste', 1);
+
+    state.finishOp('op-1', 'done');
+
+    const stored = JSON.parse(localStorage.getItem(OPERATIONS_HISTORY_KEY)!) as StorageOperation[];
+    expect(stored[0].status).toBe('done');
+    expect(stored[0].completedAt).toBeGreaterThan(0);
+  });
+
+  it('updateOpJobIds persists fileJobIds to localStorage', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Copy: file.txt', 'paste', 3);
+
+    state.updateOpJobIds('op-1', ['job-1', 'job-2']);
+
+    const stored = JSON.parse(localStorage.getItem(OPERATIONS_HISTORY_KEY)!) as StorageOperation[];
+    expect(stored[0].fileJobIds).toEqual(['job-1', 'job-2']);
+  });
+
+  it('clearOperationHistory removes non-running ops from localStorage but keeps running ones', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Op 1', 'paste', 1);
+    state.startOp('op-2', 'Op 2', 'move', 1);
+    state.finishOp('op-1', 'done');
+
+    state.clearOperationHistory();
+
+    const stored = JSON.parse(localStorage.getItem(OPERATIONS_HISTORY_KEY)!) as StorageOperation[];
+    expect(stored).toHaveLength(1);
+    expect(stored[0].id).toBe('op-2');
+    expect(stored[0].status).toBe('running');
+  });
+
+  it('keeps completed ops from previous pages in localStorage when saving new ones', () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([makeOp({ id: 'legacy', status: 'done' })])
+    );
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    state.startOp('op-1', 'New op', 'paste', 1);
+
+    const stored = JSON.parse(localStorage.getItem(OPERATIONS_HISTORY_KEY)!) as StorageOperation[];
+    expect(stored.some((o) => o.id === 'legacy')).toBe(true);
+    expect(stored.some((o) => o.id === 'op-1')).toBe(true);
+  });
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Group 2: OperationsState lifecycle
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('OperationsState lifecycle', () => {
+  it('startOp creates operation with correct label, type, itemCount, status=running, totalBytes', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    state.startOp('op-1', 'Copy: file.txt', 'paste', 5, undefined, undefined, undefined, 1024);
+
+    const op = state.operations[0];
+    expect(op.id).toBe('op-1');
+    expect(op.label).toBe('Copy: file.txt');
+    expect(op.type).toBe('paste');
+    expect(op.itemCount).toBe(5);
+    expect(op.status).toBe('running');
+    expect(op.totalBytes).toBe(1024);
+    expect(op.completedCount).toBe(0);
+    expect(op.completedBytes).toBe(0);
+    expect(op.startedAt).toBeGreaterThan(0);
+  });
+
+  it('startOp stores abortController when provided', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    const controller = new AbortController();
+
+    state.startOp('op-1', 'Test', 'paste', 1, controller);
+
+    expect(controller.signal.aborted).toBe(false);
+    state.cancelOp('op-1');
+    expect(controller.signal.aborted).toBe(true);
+  });
+
+  it('updateOpProgress updates completedCount, completedBytes, currentFileName', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Copy: file.txt', 'paste', 3, undefined, undefined, undefined, 500);
+
+    state.updateOpProgress('op-1', 2, 300, 'file2.txt');
+
+    const op = state.operations[0];
+    expect(op.completedCount).toBe(2);
+    expect(op.completedBytes).toBe(300);
+    expect(op.currentFileName).toBe('file2.txt');
+  });
+
+  it('updateOpProgress does NOT update operations with status cancelled', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 3, undefined, undefined, undefined, 500);
+    state.finishOp('op-1', 'cancelled');
+
+    state.updateOpProgress('op-1', 2, 200);
+
+    const op = state.operations[0];
+    expect(op.status).toBe('cancelled');
+    expect(op.completedCount).toBe(0);
+  });
+
+  it('updateOpJobIds sets fileJobIds on the operation', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'move', 2);
+
+    state.updateOpJobIds('op-1', ['job-a', 'job-b']);
+
+    expect(state.operations[0].fileJobIds).toEqual(['job-a', 'job-b']);
+  });
+
+  it('finishOp with done sets status=done and completedAt', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1);
+
+    state.finishOp('op-1', 'done');
+
+    const op = state.operations[0];
+    expect(op.status).toBe('done');
+    expect(op.completedAt).toBeGreaterThan(0);
+  });
+
+  it('finishOp with error sets status=error and errorMessage', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1);
+
+    state.finishOp('op-1', 'error', 'Something went wrong');
+
+    const op = state.operations[0];
+    expect(op.status).toBe('error');
+    expect(op.errorMessage).toBe('Something went wrong');
+    expect(op.completedAt).toBeGreaterThan(0);
+  });
+
+  it('finishOp with cancelled sets status=cancelled', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1);
+
+    state.finishOp('op-1', 'cancelled');
+
+    expect(state.operations[0].status).toBe('cancelled');
+  });
+
+  it('finishOp does NOT override an already-cancelled operation', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1);
+    state.finishOp('op-1', 'cancelled');
+
+    state.finishOp('op-1', 'done');
+
+    expect(state.operations[0].status).toBe('cancelled');
+  });
+
+  it('finishOp does not throw when abort controller was never stored', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1); // No abortController
+
+    // Should not throw even though there's no controller to delete
+    expect(() => state.finishOp('op-1', 'done')).not.toThrow();
+    expect(state.operations[0].status).toBe('done');
+  });
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Group 3: Reactive derived (hasRunningOps)
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('hasRunningOps', () => {
+  it('is true when at least one operation has status=running', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1);
+
+    expect(state.hasRunningOps).toBe(true);
+  });
+
+  it('is false when all operations are done/error/cancelled', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1);
+    state.finishOp('op-1', 'done');
+
+    expect(state.hasRunningOps).toBe(false);
+  });
+
+  it('transitions correctly when a running operation finishes', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1);
+
+    expect(state.hasRunningOps).toBe(true);
+
+    state.finishOp('op-1', 'done');
+
+    expect(state.hasRunningOps).toBe(false);
+  });
+
+  it('is false when all persisted operations have status interrupted', () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({ id: 'op-1', status: 'running' }),
+        makeOp({ id: 'op-2', status: 'running' })
+      ])
+    );
+
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    // Constructor marks them as 'interrupted', not 'running'
+    expect(state.hasRunningOps).toBe(false);
+  });
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Group 4: cancelOp + clearOperationHistory
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('cancelOp', () => {
+  it('aborts the abort controller and sets status=cancelled', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    const controller = new AbortController();
+    state.startOp('op-1', 'Test', 'paste', 1, controller);
+
+    state.cancelOp('op-1');
+
+    expect(controller.signal.aborted).toBe(true);
+    expect(state.operations[0].status).toBe('cancelled');
+  });
+
+  it('stops polling timers', async () => {
+    vi.useFakeTimers();
+    const api = makeMockApi();
+    api.pollJob = vi.fn().mockResolvedValue({
+      status: 'running',
+      progress: { completedBytes: 50 }
+    });
+
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([makeOp({ id: 'op-1', status: 'running', fileJobIds: ['job-1'] })])
+    );
+
+    const state = new OperationsState(api, makeOpts());
+
+    // Flush microtasks so the first poll completes (returns 'running')
+    await Promise.resolve();
+    await Promise.resolve();
+
+    // The op should now be 'running' and a timer is scheduled
+    expect(state.operations[0].status).toBe('running');
+    expect(api.pollJob).toHaveBeenCalledWith('job-1');
+
+    // Cancel — should clear the pending timer
+    state.cancelOp('op-1');
+
+    // Reset mock call tracking
+    vi.clearAllMocks();
+
+    // Advance well past the 2000ms interval
+    vi.advanceTimersByTime(3000);
+
+    expect(api.pollJob).not.toHaveBeenCalled();
+    expect(state.operations[0].status).toBe('cancelled');
+
+    vi.useRealTimers();
+  });
+
+  it('works when no abort controller exists', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Test', 'paste', 1); // No abortController
+
+    expect(() => state.cancelOp('op-1')).not.toThrow();
+    expect(state.operations[0].status).toBe('cancelled');
+  });
+
+  it('works for unknown op id', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    expect(() => state.cancelOp('nonexistent')).not.toThrow();
+  });
+});
+
+describe('clearOperationHistory', () => {
+  it('removes completed/failed/cancelled/interrupted ops, keeps only running', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-running', 'Running', 'paste', 1);
+    state.startOp('op-done', 'Done', 'move', 1);
+    state.finishOp('op-done', 'done');
+    state.startOp('op-error', 'Error', 'rename', 1);
+    state.finishOp('op-error', 'error');
+    state.startOp('op-cancelled', 'Cancelled', 'paste', 1);
+    state.finishOp('op-cancelled', 'cancelled');
+
+    state.clearOperationHistory();
+
+    expect(state.operations).toHaveLength(1);
+    expect(state.operations[0].id).toBe('op-running');
+    expect(state.operations[0].status).toBe('running');
+  });
+
+  it('keeps all operations when all are running', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'Running', 'paste', 1);
+    state.startOp('op-2', 'Also running', 'move', 1);
+
+    state.clearOperationHistory();
+
+    expect(state.operations).toHaveLength(2);
+  });
+
+  it('works with empty operations array', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    expect(() => state.clearOperationHistory()).not.toThrow();
+    expect(state.operations).toEqual([]);
+  });
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Group 5: Job polling (via reconcileInterruptedOps)
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('job polling via reconcileInterruptedOps', () => {
+  it('marks interrupted ops as done when all jobs complete', async () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({ id: 'op-1', status: 'running', fileJobIds: ['job-1', 'job-2'], itemCount: 2 })
+      ])
+    );
+
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    await vi.waitFor(() => {
+      const op = state.operations.find((o) => o.id === 'op-1');
+      expect(op?.status).toBe('done');
+    });
+
+    expect(state.operations[0].completedCount).toBe(2);
+  });
+
+  it('polls again when some jobs are still running', async () => {
+    const pollJob = vi
+      .fn()
+      .mockResolvedValue({ status: 'running', progress: { completedBytes: 50 } });
+
+    const api = makeMockApi();
+    api.pollJob = pollJob;
+
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({ id: 'op-1', status: 'running', fileJobIds: ['job-1'], itemCount: 3 })
+      ])
+    );
+
+    const state = new OperationsState(api, makeOpts());
+
+    await vi.waitFor(() => {
+      const op = state.operations.find((o) => o.id === 'op-1');
+      expect(op?.status).toBe('running');
+    });
+
+    expect(pollJob).toHaveBeenCalledWith('job-1');
+    expect(state.operations[0].completedBytes).toBe(50);
+  });
+
+  it('does not poll when interrupted ops have no fileJobIds', () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([makeOp({ id: 'op-1', status: 'running' })])
+    );
+
+    const api = makeMockApi();
+    const state = new OperationsState(api, makeOpts());
+
+    expect(state.operations[0].status).toBe('interrupted');
+    expect(api.pollJob).not.toHaveBeenCalled();
+  });
+
+  it('does not poll when interrupted ops have empty fileJobIds', () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([makeOp({ id: 'op-1', status: 'running', fileJobIds: [] })])
+    );
+
+    const api = makeMockApi();
+    const state = new OperationsState(api, makeOpts());
+
+    expect(state.operations[0].status).toBe('interrupted');
+    expect(api.pollJob).not.toHaveBeenCalled();
+  });
+
+  it('does not reconcile non-interrupted ops (e.g. done)', () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([makeOp({ id: 'op-1', status: 'done', fileJobIds: ['job-1'] })])
+    );
+
+    const api = makeMockApi();
+    const state = new OperationsState(api, makeOpts());
+
+    expect(state.operations[0].status).toBe('done');
+    expect(api.pollJob).not.toHaveBeenCalled();
+  });
+
+  it('marks op as error when not all jobs completed', async () => {
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({ id: 'op-1', status: 'running', fileJobIds: ['job-1'], itemCount: 5 })
+      ])
+    );
+
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    await vi.waitFor(() => {
+      const op = state.operations.find((o) => o.id === 'op-1');
+      expect(op?.status).toBe('error');
+    });
+
+    expect(state.operations[0].completedCount).toBe(1);
+  });
+
+  it('handles pollJob failures gracefully (marks op as error)', async () => {
+    const api = makeMockApi();
+    api.pollJob = vi.fn().mockRejectedValue(new Error('Network error'));
+
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({ id: 'op-1', status: 'running', fileJobIds: ['job-1'], itemCount: 3 })
+      ])
+    );
+
+    const state = new OperationsState(api, makeOpts());
+
+    await vi.waitFor(() => {
+      const op = state.operations.find((o) => o.id === 'op-1');
+      expect(op?.status).toBe('error');
+    });
+
+    expect(state.operations[0].completedCount).toBe(0);
+    expect(api.pollJob).toHaveBeenCalledWith('job-1');
+  });
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Group 6: Callbacks
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('callbacks', () => {
+  it('onRefresh is called when destPath matches getBucket()/getPrefix()', async () => {
+    const onRefresh = vi.fn();
+    const api = makeMockApi();
+    api.pollJob = vi.fn().mockResolvedValue({ status: 'done' });
+
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({
+          id: 'op-1',
+          status: 'running',
+          fileJobIds: ['job-1'],
+          itemCount: 1,
+          destPath: 'test-bucket/'
+        })
+      ])
+    );
+
+    new OperationsState(api, makeOpts({ onRefresh }));
+
+    await vi.waitFor(() => {
+      expect(onRefresh).toHaveBeenCalled();
+    });
+  });
+
+  it('onRefresh is NOT called when destPath does not match', async () => {
+    const onRefresh = vi.fn();
+    const api = makeMockApi();
+    api.pollJob = vi.fn().mockResolvedValue({ status: 'done' });
+
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({
+          id: 'op-1',
+          status: 'running',
+          fileJobIds: ['job-1'],
+          itemCount: 1,
+          destPath: 'other-bucket/'
+        })
+      ])
+    );
+
+    const state = new OperationsState(api, makeOpts({ onRefresh }));
+
+    await vi.waitFor(() => {
+      const op = state.operations.find((o) => o.id === 'op-1');
+      return op?.status === 'done';
+    });
+
+    expect(onRefresh).not.toHaveBeenCalled();
+  });
+
+  it('onInvalidateTabs is called when destPath is set', async () => {
+    const onInvalidateTabs = vi.fn();
+    const api = makeMockApi();
+    api.pollJob = vi.fn().mockResolvedValue({ status: 'done' });
+
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({
+          id: 'op-1',
+          status: 'running',
+          fileJobIds: ['job-1'],
+          itemCount: 1,
+          destPath: 'test-bucket/some/path/'
+        })
+      ])
+    );
+
+    new OperationsState(api, makeOpts({ onInvalidateTabs }));
+
+    await vi.waitFor(() => {
+      expect(onInvalidateTabs).toHaveBeenCalledWith('some/path/');
+    });
+  });
+
+  it('onInvalidateTabs is NOT called when destPath is undefined', async () => {
+    const onInvalidateTabs = vi.fn();
+    const api = makeMockApi();
+    api.pollJob = vi.fn().mockResolvedValue({ status: 'done' });
+
+    localStorage.setItem(
+      OPERATIONS_HISTORY_KEY,
+      JSON.stringify([
+        makeOp({
+          id: 'op-1',
+          status: 'running',
+          fileJobIds: ['job-1'],
+          itemCount: 1,
+          destPath: undefined
+        })
+      ])
+    );
+
+    const state = new OperationsState(api, makeOpts({ onInvalidateTabs }));
+
+    await vi.waitFor(() => {
+      const op = state.operations.find((o) => o.id === 'op-1');
+      return op?.status === 'done';
+    });
+
+    expect(onInvalidateTabs).not.toHaveBeenCalled();
+  });
+});
+
+// ──────────────────────────────────────────────────────────────────────────────
+// Group 7: Multiple concurrent operations
+// ──────────────────────────────────────────────────────────────────────────────
+
+describe('multiple concurrent operations', () => {
+  it('tracks two operations independently', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+
+    state.startOp('op-1', 'First op', 'paste', 3);
+    state.startOp('op-2', 'Second op', 'move', 5);
+
+    expect(state.operations).toHaveLength(2);
+    expect(state.operations[0].id).toBe('op-1');
+    expect(state.operations[1].id).toBe('op-2');
+  });
+
+  it('updating progress on first op does not affect second', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'First', 'paste', 3, undefined, undefined, undefined, 300);
+    state.startOp('op-2', 'Second', 'move', 5, undefined, undefined, undefined, 500);
+
+    state.updateOpProgress('op-1', 2, 200, 'file.txt');
+
+    const op1 = state.operations.find((o) => o.id === 'op-1')!;
+    const op2 = state.operations.find((o) => o.id === 'op-2')!;
+
+    expect(op1.completedCount).toBe(2);
+    expect(op1.completedBytes).toBe(200);
+    expect(op2.completedCount).toBe(0);
+    expect(op2.completedBytes).toBe(0);
+  });
+
+  it('finishing first op does not affect the second', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'First', 'paste', 3);
+    state.startOp('op-2', 'Second', 'move', 5);
+
+    state.finishOp('op-1', 'done');
+
+    const op1 = state.operations.find((o) => o.id === 'op-1')!;
+    const op2 = state.operations.find((o) => o.id === 'op-2')!;
+
+    expect(op1.status).toBe('done');
+    expect(op2.status).toBe('running');
+    expect(state.hasRunningOps).toBe(true);
+  });
+
+  it('finishing both ops results in hasRunningOps being false', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    state.startOp('op-1', 'First', 'paste', 1);
+    state.startOp('op-2', 'Second', 'move', 1);
+
+    state.finishOp('op-1', 'done');
+    state.finishOp('op-2', 'error');
+
+    expect(state.hasRunningOps).toBe(false);
+  });
+
+  it('cancelling one op does not affect the other', () => {
+    const state = new OperationsState(makeMockApi(), makeOpts());
+    const ctrl1 = new AbortController();
+    const ctrl2 = new AbortController();
+    state.startOp('op-1', 'First', 'paste', 1, ctrl1);
+    state.startOp('op-2', 'Second', 'move', 1, ctrl2);
+
+    state.cancelOp('op-1');
+
+    expect(ctrl1.signal.aborted).toBe(true);
+    expect(ctrl2.signal.aborted).toBe(false);
+    expect(state.operations.find((o) => o.id === 'op-1')!.status).toBe('cancelled');
+    expect(state.operations.find((o) => o.id === 'op-2')!.status).toBe('running');
+  });
+});
diff --git a/src/lib/storage/operations.svelte.ts b/src/lib/storage/operations.svelte.ts
new file mode 100644
index 00000000..44155bb9
--- /dev/null
+++ b/src/lib/storage/operations.svelte.ts
@@ -0,0 +1,239 @@
+import { SvelteMap } from 'svelte/reactivity';
+import { browser } from '$app/environment';
+import type { StorageOperation } from '$lib/storage/types.js';
+import type { StorageApi } from './api.js';
+
+// ── Page-unloading flag ─────────────────────────────────────────────────────
+
+export let pageUnloading = false;
+if (browser) {
+  window.addEventListener('beforeunload', () => {
+    pageUnloading = true;
+  });
+}
+
+// ── Operations history localStorage helpers ───────────────────────────────────
+
+const OPERATIONS_HISTORY_KEY = 'storage_operations_history';
+const MAX_HISTORY_ENTRIES = 30;
+
+function loadPersistedOperations(): StorageOperation[] {
+  if (!browser) return [];
+  try {
+    const raw = localStorage.getItem(OPERATIONS_HISTORY_KEY);
+    if (!raw) return [];
+    const ops = JSON.parse(raw) as StorageOperation[];
+    if (!Array.isArray(ops)) return [];
+    return ops.map((op) =>
+      op.status === 'running'
+        ? { ...op, status: 'interrupted' as const, completedAt: op.completedAt ?? Date.now() }
+        : op
+    );
+  } catch {
+    return [];
+  }
+}
+
+function saveOperationsToStorage(ops: StorageOperation[]): void {
+  if (!browser) return;
+  try {
+    const history = ops.filter((op) => op.status !== 'running').slice(-MAX_HISTORY_ENTRIES);
+    const running = ops.filter((op) => op.status === 'running');
+    const toSave = [...running, ...history].slice(-MAX_HISTORY_ENTRIES);
+    localStorage.setItem(OPERATIONS_HISTORY_KEY, JSON.stringify(toSave));
+  } catch {
+    // Best effort.
+  }
+}
+
+// ── OperationsState ─────────────────────────────────────────────────────────
+
+export interface OperationsStateOpts {
+  getBucket: () => string;
+  getPrefix: () => string;
+  onRefresh?: () => void;
+  onInvalidateTabs?: (prefix: string) => void;
+}
+
+export class OperationsState {
+  operations = $state<StorageOperation[]>([]);
+  hasRunningOps = $derived(this.operations.some((op) => op.status === 'running'));
+
+  private _abortControllers = new SvelteMap<string, AbortController>();
+  private _pollTimers = new SvelteMap<string, ReturnType<typeof setTimeout>>();
+  private _api: StorageApi;
+  private _getBucket: () => string;
+  private _getPrefix: () => string;
+  private _onRefresh?: () => void;
+  private _onInvalidateTabs?: (prefix: string) => void;
+
+  constructor(api: StorageApi, opts: OperationsStateOpts) {
+    this._api = api;
+    this._getBucket = opts.getBucket;
+    this._getPrefix = opts.getPrefix;
+    this._onRefresh = opts.onRefresh;
+    this._onInvalidateTabs = opts.onInvalidateTabs;
+    this.operations = loadPersistedOperations();
+    void this.reconcileInterruptedOps();
+  }
+
+  startOp(
+    id: string,
+    label: string,
+    type: StorageOperation['type'],
+    itemCount: number,
+    abortController?: AbortController,
+    destPath?: string,
+    sourceNames?: string[],
+    totalBytes = 0
+  ): void {
+    this.operations = [
+      ...this.operations,
+      {
+        id,
+        label,
+        status: 'running',
+        type,
+        itemCount,
+        completedCount: 0,
+        startedAt: Date.now(),
+        destPath,
+        sourceNames,
+        totalBytes,
+        completedBytes: 0
+      }
+    ];
+    if (abortController) {
+      this._abortControllers.set(id, abortController);
+    }
+    saveOperationsToStorage(this.operations);
+  }
+
+  updateOpProgress(
+    id: string,
+    completedCount: number,
+    completedBytes: number,
+    currentFileName?: string
+  ): void {
+    this.operations = this.operations.map((op) =>
+      op.id === id && op.status !== 'cancelled'
+        ? { ...op, completedCount, completedBytes, currentFileName }
+        : op
+    );
+  }
+
+  updateOpJobIds(id: string, fileJobIds: string[]): void {
+    this.operations = this.operations.map((op) => (op.id === id ? { ...op, fileJobIds } : op));
+    saveOperationsToStorage(this.operations);
+  }
+
+  finishOp(id: string, status: 'done' | 'error' | 'cancelled', errorMessage?: string): void {
+    this.operations = this.operations.map((op) =>
+      op.id === id && op.status !== 'cancelled'
+        ? { ...op, status, errorMessage, completedAt: Date.now() }
+        : op
+    );
+    this._abortControllers.delete(id);
+    saveOperationsToStorage(this.operations);
+  }
+
+  cancelOp(id: string): void {
+    const controller = this._abortControllers.get(id);
+    if (controller) {
+      controller.abort();
+    }
+    const timer = this._pollTimers.get(id);
+    if (timer) {
+      clearTimeout(timer);
+      this._pollTimers.delete(id);
+    }
+    this.finishOp(id, 'cancelled');
+  }
+
+  clearOperationHistory(): void {
+    this.operations = this.operations.filter((op) => op.status === 'running');
+    saveOperationsToStorage(this.operations);
+  }
+
+  private async reconcileInterruptedOps(): Promise<void> {
+    const interrupted = this.operations.filter(
+      (op) => op.status === 'interrupted' && op.fileJobIds && op.fileJobIds.length > 0
+    );
+    if (interrupted.length === 0) return;
+
+    for (const op of interrupted) {
+      void this._pollJobStatus(op);
+    }
+  }
+
+  private async _pollJobStatus(op: StorageOperation): Promise<void> {
+    if (this.operations.find((o) => o.id === op.id)?.status === 'cancelled') return;
+
+    let completedCount = 0;
+    let completedBytes = 0;
+    let anyRunning = false;
+
+    for (const jobId of op.fileJobIds!) {
+      try {
+        const job = await this._api.pollJob(jobId);
+        if (job.status === 'done') {
+          completedCount++;
+        } else if (job.status === 'running') {
+          anyRunning = true;
+          completedBytes += job.progress?.completedBytes ?? 0;
+        }
+      } catch {
+        // Job may have expired
+      }
+    }
+
+    if (anyRunning) {
+      this.operations = this.operations.map((o) =>
+        o.id === op.id
+          ? {
+              ...o,
+              status: 'running' as const,
+              completedCount,
+              completedBytes,
+              completedAt: undefined
+            }
+          : o
+      );
+      const timer = setTimeout(() => void this._pollJobStatus(op), 2000);
+      this._pollTimers.set(op.id, timer);
+    } else {
+      this.operations = this.operations.map((o) =>
+        o.id === op.id
+          ? {
+              ...o,
+              status: (completedCount === op.itemCount ? 'done' : 'error') as 'done' | 'error',
+              completedCount,
+              completedBytes,
+              completedAt: Date.now()
+            }
+          : o
+      );
+      saveOperationsToStorage(this.operations);
+
+      const existing = this._pollTimers.get(op.id);
+      if (existing) {
+        clearTimeout(existing);
+        this._pollTimers.delete(op.id);
+      }
+
+      const bucket = this._getBucket();
+      const prefix = this._getPrefix();
+      if (op.destPath && `${bucket}/${prefix}`.startsWith(op.destPath)) {
+        this._onRefresh?.();
+      }
+
+      if (op.destPath && this._onInvalidateTabs) {
+        const slashIdx = op.destPath.indexOf('/');
+        if (slashIdx !== -1) {
+          const p = op.destPath.slice(slashIdx + 1);
+          this._onInvalidateTabs(p.endsWith('/') ? p : p + '/');
+        }
+      }
+    }
+  }
+}
diff --git a/src/lib/storage/state.svelte.spec.ts b/src/lib/storage/state.svelte.spec.ts
index 0fa4af2e..f38695c0 100644
--- a/src/lib/storage/state.svelte.spec.ts
+++ b/src/lib/storage/state.svelte.spec.ts
@@ -1,7 +1,3 @@
-vi.mock('$lib/storage/upload.js', () => ({
-  checkObjectExists: vi.fn().mockResolvedValue(false)
-}));
-
 vi.mock('$lib/client/feature-flags.js', () => ({
   storageAutoConnectEnabled: false,
   storageRestoreTabsEnabled: false,
@@ -16,15 +12,6 @@ vi.mock('$lib/client/feature-flags.js', () => ({
   storageMoveEnabled: true
 }));
 
-vi.mock('$lib/storage/connection-storage.js', () => ({
-  STORAGE_CONNECTION_HEADER: 'x-storage-connection',
-  loadConnectionLocally: vi.fn(() => ({ id: 'test-conn', type: 's3' })),
-  getConnectionHeader: vi.fn(() => 'test-conn-header'),
-  saveConnectionLocally: vi.fn(),
-  loadAllConnectionsLocally: vi.fn(() => []),
-  removeConnectionLocally: vi.fn()
-}));
-
 vi.mock('$lib/storage/connection-store.svelte.js', () => ({
   connectionStore: { activeConnectionId: 'test-connection-id' }
 }));
@@ -41,6 +28,9 @@ import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { SvelteSet } from 'svelte/reactivity';
 import { StorageState } from './state.svelte.js';
 import type { StorageObject, StoragePage } from './types.js';
+import type { StorageApi, CopyMoveResult, DeleteResult } from './api.js';
+import type { FileDetails, DirectoryMetadata, BucketDetails } from './details-types.js';
+import { StorageError } from './errors.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
 import { invalidateAll } from '$app/navigation';
 
@@ -86,61 +76,80 @@ function makePage(objects?: StorageObject[]): StoragePage {
   };
 }
 
-function makeState(overrides?: Partial<StorageState>): StorageState {
-  const state = new StorageState({ connected: true, buckets: ['test-bucket'] });
+function makeApi(overrides?: Partial<StorageApi>): StorageApi {
+  const defaults: StorageApi = {
+    async list() {
+      return makePage();
+    },
+    async copy(): Promise<CopyMoveResult> {
+      return { results: [], failed: 0 };
+    },
+    async move(): Promise<CopyMoveResult> {
+      return { results: [], failed: 0 };
+    },
+    async rename() {},
+    async delete(): Promise<DeleteResult> {
+      return { failed: [] };
+    },
+    async create() {},
+    async archiveExtract() {
+      return new Response(null, { status: 200 });
+    },
+    async archiveListing() {
+      return { entries: [], hasMore: false };
+    },
+    async pollJob() {
+      return { status: 'done' };
+    },
+    async checkObjectExists() {
+      return false;
+    },
+    async preview() {
+      return new Response(null, { status: 200 });
+    },
+    async saveText() {
+      // no-op
+    },
+    async details(): Promise<FileDetails> {
+      return {} as FileDetails;
+    },
+    async directoryMetadata(): Promise<DirectoryMetadata> {
+      return {} as DirectoryMetadata;
+    },
+    async directorySize() {
+      return new Response(null, { status: 200 });
+    },
+    async bucketDetails(): Promise<BucketDetails> {
+      return {} as BucketDetails;
+    },
+    async checkBucket() {
+      return { ok: true, status: 200 };
+    },
+    async updateConnections() {
+      // no-op
+    }
+  };
+  return { ...defaults, ...overrides };
+}
+
+function makeState(
+  apiOverrides?: Partial<StorageApi>,
+  stateOverrides?: Partial<StorageState>
+): StorageState {
+  const state = new StorageState({
+    connected: true,
+    buckets: ['test-bucket'],
+    api: makeApi(apiOverrides)
+  });
   state.bucket = 'test-bucket';
   state.prefix = '';
   state.objects = makePage();
-  if (overrides) {
-    Object.assign(state, overrides);
+  if (stateOverrides) {
+    Object.assign(state, stateOverrides);
   }
   return state;
 }
 
-/**
- * Build a mock Response that streams NDJSON events matching what the
- * copy/move endpoints return when `?progress=true` is set.
- */
-function makeNdjsonResponse(
-  data: Record<string, unknown>,
-  opts?: { ok?: boolean; status?: number }
-): Response {
-  const ok = opts?.ok ?? true;
-  const encoder = new TextEncoder();
-  const lines =
-    [
-      // Simulate a synthetic 100% progress event (as the server does for small files)
-      ...((data.results ?? data.moved) as Array<{ sourceKey: string; destKey: string }>).flatMap(
-        (r) => [
-          JSON.stringify({
-            type: 'progress',
-            sourceKey: r.sourceKey,
-            destKey: r.destKey,
-            loaded: 100,
-            total: 100
-          }),
-          JSON.stringify({ type: 'done', sourceKey: r.sourceKey, destKey: r.destKey })
-        ]
-      ),
-      ...((data.failed ?? []) as Array<unknown>).map((f) =>
-        JSON.stringify({ type: 'failed', ...(f as Record<string, unknown>) })
-      ),
-      JSON.stringify({ type: 'complete', ...data })
-    ].join('\n') + '\n';
-
-  const stream = new ReadableStream({
-    start(controller) {
-      controller.enqueue(encoder.encode(lines));
-      controller.close();
-    }
-  });
-
-  return new Response(stream, {
-    status: ok ? 200 : (opts?.status ?? 500),
-    headers: { 'Content-Type': 'application/x-ndjson' }
-  });
-}
-
 beforeEach(() => {
   vi.clearAllMocks();
 });
@@ -231,7 +240,7 @@ describe('executeAction("copy")', () => {
 describe('isCutKey', () => {
   it('returns true when key is in clipboard with cut action and matching bucket', () => {
     const state = makeState();
-    state.clipboard = {
+    state.clipboardState.clipboard = {
       action: 'cut',
       keys: ['file.txt', 'dir/'],
       sourceBucket: 'test-bucket',
@@ -245,7 +254,7 @@ describe('isCutKey', () => {
 
   it('returns false for keys not in clipboard', () => {
     const state = makeState();
-    state.clipboard = {
+    state.clipboardState.clipboard = {
       action: 'cut',
       keys: ['file.txt'],
       sourceBucket: 'test-bucket',
@@ -258,7 +267,7 @@ describe('isCutKey', () => {
 
   it('returns false when clipboard action is copy', () => {
     const state = makeState();
-    state.clipboard = {
+    state.clipboardState.clipboard = {
       action: 'copy',
       keys: ['file.txt'],
       sourceBucket: 'test-bucket',
@@ -271,7 +280,7 @@ describe('isCutKey', () => {
 
   it('returns false when bucket does not match', () => {
     const state = makeState();
-    state.clipboard = {
+    state.clipboardState.clipboard = {
       action: 'cut',
       keys: ['file.txt'],
       sourceBucket: 'other-bucket',
@@ -284,7 +293,7 @@ describe('isCutKey', () => {
 
   it('returns false when clipboard is null', () => {
     const state = makeState();
-    state.clipboard = null;
+    state.clipboardState.clipboard = null;
 
     expect(state.isCutKey('file.txt')).toBe(false);
   });
@@ -297,14 +306,14 @@ describe('isCutKey', () => {
 describe('executeAction("paste")', () => {
   it('shows warning when inside an archive', async () => {
     const state = makeState();
-    state.clipboard = {
+    state.clipboardState.clipboard = {
       action: 'copy',
       keys: ['file.txt'],
       sourceBucket: 'test-bucket',
       sourcePrefix: '',
       fileSizes: {}
     };
-    Object.assign(state, { archiveKey: 'archive.zip' });
+    state.archive.archiveKey = 'archive.zip';
 
     await state.executeAction('paste');
 
@@ -312,29 +321,27 @@ describe('executeAction("paste")', () => {
   });
 
   describe('from copy', () => {
-    it('calls the copy endpoint and shows success', async () => {
-      const state = makeState();
-      state.clipboard = {
+    it('calls the copy API and shows success', async () => {
+      const copySpy = vi.fn().mockResolvedValue({
+        results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+        failed: 0
+      });
+      const state = makeState({ copy: copySpy });
+      state.clipboardState.clipboard = {
         action: 'copy',
         keys: ['file.txt'],
         sourceBucket: 'test-bucket',
         sourcePrefix: '',
         fileSizes: { 'file.txt': 100 }
       };
-      const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-        makeNdjsonResponse({
-          results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
-          failed: []
-        })
-      );
 
       await state.executeAction('paste');
 
-      expect(fetchMock).toHaveBeenCalledWith(
-        expect.stringContaining('/api/storage/copy'),
+      expect(copySpy).toHaveBeenCalledWith(
         expect.objectContaining({
-          method: 'POST',
-          body: expect.stringContaining('"sourceKeys":["file.txt"]')
+          bucket: 'test-bucket',
+          sourceKeys: ['file.txt'],
+          destinationPrefix: ''
         })
       );
       expect(addToast).toHaveBeenCalledWith('success', expect.stringContaining('pasted'));
@@ -342,17 +349,15 @@ describe('executeAction("paste")', () => {
     });
 
     it('shows error toast when all items fail (source not found)', async () => {
-      const state = makeState();
-      state.clipboard = {
+      const copySpy = vi.fn().mockResolvedValue({ results: [], failed: 1 });
+      const state = makeState({ copy: copySpy });
+      state.clipboardState.clipboard = {
         action: 'copy',
         keys: ['file.txt'],
         sourceBucket: 'test-bucket',
         sourcePrefix: '',
         fileSizes: {}
       };
-      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-        makeNdjsonResponse({ results: [], failed: [{ sourceKey: 'file.txt', error: 'Not found' }] })
-      );
 
       await state.executeAction('paste');
 
@@ -364,20 +369,18 @@ describe('executeAction("paste")', () => {
     });
 
     it('shows warning when some items fail', async () => {
-      const state = makeState();
-      state.clipboard = {
+      const copySpy = vi.fn().mockResolvedValue({
+        results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+        failed: 1
+      });
+      const state = makeState({ copy: copySpy });
+      state.clipboardState.clipboard = {
         action: 'copy',
         keys: ['file.txt', 'photo.jpg'],
         sourceBucket: 'test-bucket',
         sourcePrefix: '',
         fileSizes: { 'file.txt': 100, 'photo.jpg': 500 }
       };
-      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-        makeNdjsonResponse({
-          results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
-          failed: [{ sourceKey: 'photo.jpg', error: 'Not found' }]
-        })
-      );
 
       await state.executeAction('paste');
 
@@ -389,27 +392,27 @@ describe('executeAction("paste")', () => {
   });
 
   describe('from cut', () => {
-    it('calls the move endpoint and updates clipboard to destination keys', async () => {
-      const state = makeState();
-      state.clipboard = {
+    it('calls the move API and updates clipboard to destination keys', async () => {
+      const moveSpy = vi.fn().mockResolvedValue({
+        results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+        failed: 0
+      });
+      const state = makeState({ move: moveSpy });
+      state.clipboardState.clipboard = {
         action: 'cut',
         keys: ['file.txt'],
         sourceBucket: 'test-bucket',
         sourcePrefix: '',
         fileSizes: { 'file.txt': 100 }
       };
-      const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-        makeNdjsonResponse({
-          moved: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
-          failed: []
-        })
-      );
 
       await state.executeAction('paste');
 
-      expect(fetchMock).toHaveBeenCalledWith(
-        expect.stringContaining('/api/storage/move'),
-        expect.any(Object)
+      expect(moveSpy).toHaveBeenCalledWith(
+        expect.objectContaining({
+          bucket: 'test-bucket',
+          sourceKeys: ['file.txt']
+        })
       );
       // Clipboard updated to destination keys with action='copy'
       expect(state.clipboard).not.toBeNull();
@@ -419,17 +422,15 @@ describe('executeAction("paste")', () => {
     });
 
     it('keeps original clipboard on failed move (no results)', async () => {
-      const state = makeState();
-      state.clipboard = {
+      const moveSpy = vi.fn().mockResolvedValue({ results: [], failed: 1 });
+      const state = makeState({ move: moveSpy });
+      state.clipboardState.clipboard = {
         action: 'cut',
         keys: ['file.txt'],
         sourceBucket: 'test-bucket',
         sourcePrefix: '',
         fileSizes: { 'file.txt': 100 }
       };
-      vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-        makeNdjsonResponse({ moved: [], failed: [{ sourceKey: 'file.txt', error: 'Not found' }] })
-      );
 
       await state.executeAction('paste');
 
@@ -456,11 +457,12 @@ describe('confirmRename', () => {
     expect(state.renameLoading).toBe(false);
   });
 
-  it('shows inline error on 409 conflict and keeps modal open', async () => {
-    const state = makeState();
+  it('shows inline error on conflict and keeps modal open', async () => {
+    const renameSpy = vi
+      .fn()
+      .mockRejectedValue(new StorageError('conflict', 'Object already exists'));
+    const state = makeState({ rename: renameSpy });
     state.openModal('rename', { key: 'file.txt' });
-    const resp = new Response(null, { status: 409, statusText: 'Conflict' });
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(resp);
 
     await state.confirmRename('file.txt', 'renamed.txt');
 
@@ -469,10 +471,10 @@ describe('confirmRename', () => {
     expect(state.renameLoading).toBe(false);
   });
 
-  it('shows toast on 403 and closes modal', async () => {
-    const state = makeState();
+  it('shows toast on access_denied and closes modal', async () => {
+    const renameSpy = vi.fn().mockRejectedValue(new StorageError('access_denied', 'Access denied'));
+    const state = makeState({ rename: renameSpy });
     state.openModal('rename', { key: 'file.txt' });
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 403 }));
 
     await state.confirmRename('file.txt', 'renamed.txt');
 
@@ -480,10 +482,10 @@ describe('confirmRename', () => {
     expect(addToast).toHaveBeenCalledWith('error', expect.stringContaining('denied'));
   });
 
-  it('shows toast on 404 and closes modal', async () => {
-    const state = makeState();
+  it('shows toast on not_found and closes modal', async () => {
+    const renameSpy = vi.fn().mockRejectedValue(new StorageError('not_found', 'Not found'));
+    const state = makeState({ rename: renameSpy });
     state.openModal('rename', { key: 'file.txt' });
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 404 }));
 
     await state.confirmRename('file.txt', 'renamed.txt');
 
@@ -492,12 +494,9 @@ describe('confirmRename', () => {
   });
 
   it('shows success toast on successful rename and updates recent files', async () => {
-    const state = makeState();
+    const renameSpy = vi.fn().mockResolvedValue(undefined);
+    const state = makeState({ rename: renameSpy });
     state.openModal('rename', { key: 'file.txt' });
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({})
-    } as Response);
     // Seed a recent file entry for the old key
     state.bookmarks.recordFileVisit('test-bucket', 'file.txt', 100);
 
@@ -512,12 +511,9 @@ describe('confirmRename', () => {
   });
 
   it('handles directory rename (trailing slash)', async () => {
-    const state = makeState();
+    const renameSpy = vi.fn().mockResolvedValue(undefined);
+    const state = makeState({ rename: renameSpy });
     state.openModal('rename', { key: 'dir/' });
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({})
-    } as Response);
 
     await state.confirmRename('dir/', 'renamed-dir');
 
@@ -589,25 +585,22 @@ describe('performMove', () => {
 });
 
 describe('confirmMove', () => {
-  it('calls the move endpoint and shows success toast', async () => {
-    const state = makeState();
+  it('calls the move API and shows success toast', async () => {
+    const moveSpy = vi.fn().mockResolvedValue({
+      results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+      failed: 0
+    });
+    const state = makeState({ move: moveSpy });
     state.selectedKeys = new SvelteSet<string>(['file.txt']);
     state.performMove('dest/');
 
-    const fetchMock = vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      makeNdjsonResponse({
-        moved: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
-        failed: []
-      })
-    );
-
     await state.confirmMove();
 
-    expect(fetchMock).toHaveBeenCalledWith(
-      expect.stringContaining('/api/storage/move'),
+    expect(moveSpy).toHaveBeenCalledWith(
       expect.objectContaining({
-        method: 'POST',
-        body: expect.stringContaining('"sourceKeys":["file.txt"]')
+        bucket: 'test-bucket',
+        sourceKeys: ['file.txt'],
+        destinationPrefix: 'dest/'
       })
     );
     expect(addToast).toHaveBeenCalledWith('success', expect.stringContaining('moved'));
@@ -615,32 +608,29 @@ describe('confirmMove', () => {
   });
 
   it('shows warning on partial failures', async () => {
-    const state = makeState();
+    const moveSpy = vi.fn().mockResolvedValue({
+      results: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
+      failed: 1
+    });
+    const state = makeState({ move: moveSpy });
     state.selectedKeys = new SvelteSet<string>(['file.txt', 'photo.jpg']);
     state.performMove('dest/');
 
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      makeNdjsonResponse({
-        moved: [{ sourceKey: 'file.txt', destKey: 'dest/file.txt' }],
-        failed: [{ sourceKey: 'photo.jpg', error: 'Access denied' }]
-      })
-    );
-
     await state.confirmMove();
 
     expect(addToast).toHaveBeenCalledWith('warning', expect.stringContaining('could not be moved'));
   });
 
   it('cancelMove closes the modal without calling API', () => {
-    const state = makeState();
+    const moveSpy = vi.fn();
+    const state = makeState({ move: moveSpy });
     state.selectedKeys = new SvelteSet<string>(['file.txt']);
     state.performMove('dest/');
-    const fetchMock = vi.spyOn(globalThis, 'fetch');
 
     state.cancelMove();
 
     expect(state.activeModal).toBeNull();
-    expect(fetchMock).not.toHaveBeenCalled();
+    expect(moveSpy).not.toHaveBeenCalled();
   });
 });
 
@@ -680,8 +670,12 @@ describe('handleKeydown', () => {
   });
 
   it('Ctrl+V triggers paste when clipboard non-empty', async () => {
-    const state = makeState();
-    state.clipboard = {
+    const copySpy = vi.fn().mockResolvedValue({
+      results: [{ sourceKey: 'file.txt', destKey: 'paste/file.txt' }],
+      failed: 0
+    });
+    const state = makeState({ copy: copySpy });
+    state.clipboardState.clipboard = {
       action: 'copy',
       keys: ['file.txt'],
       sourceBucket: 'test-bucket',
@@ -689,13 +683,6 @@ describe('handleKeydown', () => {
       fileSizes: {}
     };
 
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
-      makeNdjsonResponse({
-        results: [{ sourceKey: 'file.txt', destKey: 'paste/file.txt' }],
-        failed: []
-      })
-    );
-
     await state.executeAction('paste');
 
     expect(addToast).toHaveBeenCalledWith('success', expect.any(String));
@@ -703,7 +690,7 @@ describe('handleKeydown', () => {
 
   it('Ctrl+V does nothing when clipboard is empty', () => {
     const state = makeState();
-    state.clipboard = null;
+    state.clipboardState.clipboard = null;
 
     dispatch(state, 'v', true);
 
@@ -752,8 +739,9 @@ describe('handleKeydown', () => {
 
 describe('performDelete clipboard cleanup', () => {
   it('removes deleted keys from clipboard', async () => {
-    const state = makeState();
-    state.clipboard = {
+    const deleteSpy = vi.fn().mockResolvedValue({ failed: [] });
+    const state = makeState({ delete: deleteSpy });
+    state.clipboardState.clipboard = {
       action: 'cut',
       keys: ['file.txt', 'photo.jpg', 'nested/file.js'],
       sourceBucket: 'test-bucket',
@@ -763,19 +751,15 @@ describe('performDelete clipboard cleanup', () => {
     state.selectedKeys = new SvelteSet<string>(['file.txt', 'photo.jpg']);
     state.openModal('delete', { keys: ['file.txt', 'photo.jpg'] });
 
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({ failed: [] })
-    } as Response);
-
     await state.confirmDelete();
 
     expect(state.clipboard!.keys).toEqual(['nested/file.js']);
   });
 
   it('clears clipboard when all keys are deleted', async () => {
-    const state = makeState();
-    state.clipboard = {
+    const deleteSpy = vi.fn().mockResolvedValue({ failed: [] });
+    const state = makeState({ delete: deleteSpy });
+    state.clipboardState.clipboard = {
       action: 'copy',
       keys: ['file.txt'],
       sourceBucket: 'test-bucket',
@@ -785,19 +769,15 @@ describe('performDelete clipboard cleanup', () => {
     state.selectedKeys = new SvelteSet<string>(['file.txt']);
     state.openModal('delete', { keys: ['file.txt'] });
 
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({ failed: [] })
-    } as Response);
-
     await state.confirmDelete();
 
     expect(state.clipboard).toBeNull();
   });
 
   it('does not affect clipboard when source bucket differs', async () => {
-    const state = makeState();
-    state.clipboard = {
+    const deleteSpy = vi.fn().mockResolvedValue({ failed: [] });
+    const state = makeState({ delete: deleteSpy });
+    state.clipboardState.clipboard = {
       action: 'copy',
       keys: ['file.txt'],
       sourceBucket: 'other-bucket',
@@ -807,11 +787,6 @@ describe('performDelete clipboard cleanup', () => {
     state.selectedKeys = new SvelteSet<string>(['file.txt']);
     state.openModal('delete', { keys: ['file.txt'] });
 
-    vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({ failed: [] })
-    } as Response);
-
     await state.confirmDelete();
 
     expect(state.clipboard).not.toBeNull();
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index dbc1995d..b925e8d1 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -1,6 +1,5 @@
-import { SvelteMap, SvelteSet, SvelteURLSearchParams } from 'svelte/reactivity';
+import { SvelteSet } from 'svelte/reactivity';
 import { tick } from 'svelte';
-import { browser } from '$app/environment';
 import { invalidateAll } from '$app/navigation';
 import * as m from '$lib/paraglide/messages.js';
 import type { StoragePage, StorageObject } from '$lib/storage/types.js';
@@ -11,76 +10,27 @@ import type {
   ContextMenuState,
   NavigateFn,
   ActionName,
-  ClipboardState,
-  ArchiveListingResponse,
-  ArchiveEntry,
   StorageOperation
 } from '$lib/storage/types.js';
-import { ARCHIVE_EXTENSIONS } from '$lib/storage/types.js';
 import { initPageSize, type PageSize } from '$lib/types/pagination.js';
 import {
   defaultPageSize,
   storageCutCopyEnabled,
   storagePasteEnabled,
-  storageRenameEnabled,
-  storageMoveEnabled
+  storageRenameEnabled
 } from '$lib/client/feature-flags.js';
-import { checkObjectExists } from '$lib/storage/upload.js';
-import { downloadObject, DownloadError } from '$lib/storage/download.js';
+import { downloadObject } from '$lib/storage/download.js';
 import type { ConflictEntry } from '$lib/components/storage/modals/shared/conflict-types.js';
 import { addToast } from '$lib/stores/toast.svelte.js';
-import { ActionError, getActionErrorMessage } from './errors.js';
+import { StorageError, getActionErrorMessage } from './errors.js';
 import { BookmarksState } from './bookmarks.svelte.js';
 import { connectionStore } from '$lib/storage/connection-store.svelte.js';
-import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 import { keyToName } from '$lib/storage/utils.js';
-
-// Set to true when the page starts unloading (reload, tab close, navigate away).
-// Used to suppress misleading error toasts for in-flight operations that the
-// browser cancelled — the server-side copies continue regardless.
-let pageUnloading = false;
-if (browser) {
-  window.addEventListener('beforeunload', () => {
-    pageUnloading = true;
-  });
-}
-
-// ── Operations history localStorage helpers ───────────────────────────────────
-
-const OPERATIONS_HISTORY_KEY = 'storage_operations_history';
-const MAX_HISTORY_ENTRIES = 30; // magic number: keep a reasonable number of past operations in localStorage
-
-function loadPersistedOperations(): StorageOperation[] {
-  if (!browser) return [];
-  try {
-    const raw = localStorage.getItem(OPERATIONS_HISTORY_KEY);
-    if (!raw) return [];
-    const ops = JSON.parse(raw) as StorageOperation[];
-    if (!Array.isArray(ops)) return [];
-    // Any operation that was still running when the page was last closed is now interrupted.
-    return ops.map((op) =>
-      op.status === 'running'
-        ? { ...op, status: 'interrupted' as const, completedAt: op.completedAt ?? Date.now() }
-        : op
-    );
-  } catch {
-    return [];
-  }
-}
-
-function saveOperationsToStorage(ops: StorageOperation[]): void {
-  if (!browser) return;
-  try {
-    // Persist only non-running entries (capped); running ones are saved on _startOp.
-    const history = ops.filter((op) => op.status !== 'running').slice(-MAX_HISTORY_ENTRIES);
-    // Merge with any running ops so they appear as interrupted after a refresh.
-    const running = ops.filter((op) => op.status === 'running');
-    const toSave = [...running, ...history].slice(-MAX_HISTORY_ENTRIES);
-    localStorage.setItem(OPERATIONS_HISTORY_KEY, JSON.stringify(toSave));
-  } catch {
-    // Best effort.
-  }
-}
+import type { StorageApi } from './api.js';
+import { createFetchStorageApi } from './api.js';
+import { OperationsState } from './operations.svelte.js';
+import { ArchiveState } from './archive.svelte.js';
+import { ClipboardState } from './clipboard.svelte.js';
 
 export class StorageState {
   // ── Core data (synced from server load) ──
@@ -151,57 +101,33 @@ export class StorageState {
   pageSize = $state<PageSize>(initPageSize('storage_page_size'));
   currentPage = $derived(this.prevTokens.length + 1);
 
-  // ── Archive navigation ──
-  archiveKey = $state<string | null>(null);
-  archivePrefix = $state('');
-  archiveNestedPath = $state<string | null>(null);
-  previousS3Prefix = $state('');
-  archiveLoading = $state(false);
-  archiveTooLarge = $state(false);
-  isInArchive = $derived(this.archiveKey !== null);
-
   // ── Composed sub-state ──
   bookmarks: BookmarksState;
+  archive: ArchiveState;
+  clipboardState: ClipboardState;
 
-  // ── Clipboard (cut / copy) ──
-  clipboard = $state<ClipboardState | null>(null);
-
-  // ── Pending conflict resolution (paste / move) ──
-  _pendingConflictOp = $state<
-    | {
-        type: 'paste';
-        keys: string[];
-        sourceBucket: string;
-        destPrefix: string;
-        wasCut: boolean;
-        fileSizes: Record<string, number>;
-        sourcePrefix: string;
-        totalBytes: number;
-      }
-    | {
-        type: 'move';
-        keys: string[];
-        destPrefix: string;
-        items: Array<{ key: string; name: string; isDirectory: boolean; size?: number }>;
-        sourcePrefix: string | null;
-        totalBytes: number;
-      }
-    | null
-  >(null);
+  /**
+   * Delegated clipboard data getter for backward compatibility.
+   * Components access `storage.clipboard` to read the current clipboard.
+   */
+  get clipboard(): import('$lib/storage/types.js').ClipboardData | null {
+    return this.clipboardState.clipboard;
+  }
 
   // ── Operations (paste / move / rename progress) ──
-  operations = $state<StorageOperation[]>([]);
-  hasRunningOps = $derived(this.operations.some((op) => op.status === 'running'));
-  /** AbortControllers keyed by operation ID, used to cancel in-flight requests. */
-  private _abortControllers = new SvelteMap<string, AbortController>();
+  private operations_: OperationsState;
+
+  get operations(): StorageOperation[] {
+    return this.operations_.operations;
+  }
+
+  get hasRunningOps(): boolean {
+    return this.operations_.hasRunningOps;
+  }
 
-  /** True when `key` is in the clipboard with action='cut' and the bucket matches. */
+  /** Delegated to clipboardState. */
   isCutKey(key: string): boolean {
-    return (
-      this.clipboard?.action === 'cut' &&
-      this.clipboard.sourceBucket === this.bucket &&
-      this.clipboard.keys.includes(key)
-    );
+    return this.clipboardState.isCutKey(key, this.bucket);
   }
 
   // ── Navigation handler (injected by page component) ──
@@ -215,21 +141,72 @@ export class StorageState {
   // Called after file operations to mark source tabs as stale so they refetch
   // when the user switches back to them.
   private _onInvalidateSourceTabs: ((prefix: string) => void) | null = null;
-  private _pendingSourcePrefix: string | null = null;
 
   // ────────────────────────────────────────────────────────────────────────────
   // Constructor
   // ────────────────────────────────────────────────────────────────────────────
 
-  constructor(options?: { connected?: boolean; buckets?: string[]; connectionId?: string | null }) {
+  private _api: StorageApi;
+
+  constructor(options?: {
+    connected?: boolean;
+    buckets?: string[];
+    connectionId?: string | null;
+    api?: StorageApi;
+  }) {
     if (options?.connected !== undefined) this.connected = options.connected;
     if (options?.buckets) this.buckets = options.buckets;
     if (options?.connectionId !== undefined) this.connectionId = options.connectionId;
+    this._api = options?.api ?? createFetchStorageApi(() => connectionStore.activeConnectionId);
     this.bookmarks = new BookmarksState(options?.connectionId ?? '');
-    // Restore persisted operation history (interrupted ops appear from previous sessions).
-    this.operations = loadPersistedOperations();
-    // Reconcile interrupted operations that have a server-side job store entry.
-    void this.reconcileInterruptedOps();
+    this.operations_ = new OperationsState(this._api, {
+      getBucket: () => this.bucket,
+      getPrefix: () => this.prefix,
+      onRefresh: () => this.refresh(),
+      onInvalidateTabs: (prefix) => this._onInvalidateSourceTabs?.(prefix)
+    });
+    this.archive = new ArchiveState(this._api, {
+      getBucket: () => this.bucket,
+      getPrefix: () => this.prefix,
+      getPageSize: () => this.pageSize,
+      setObjects: (objects) => {
+        this.objects = objects;
+      },
+      setLoading: (loading) => {
+        this.loading = loading;
+      },
+      setPrefix: (prefix) => {
+        this.prefix = prefix;
+      },
+      clearPrevTokens: () => {
+        this.prevTokens = [];
+      },
+      onExit: (s3Prefix) => {
+        this.loading = true;
+        this.prevTokens = [];
+        void this.archive._fetchS3Objects(s3Prefix);
+      }
+    });
+    this.clipboardState = new ClipboardState(this._api, this.operations_, {
+      getBucket: () => this.bucket,
+      getPrefix: () => this.prefix,
+      getObjects: () => this.objects,
+      getSelectedKeys: () => this.selectedKeys,
+      openModal: (type, payload) => this.openModal(type as never, payload as never),
+      closeModal: () => this.closeModal(),
+      refresh: () => this.refresh(),
+      invalidateSourceTabs: (prefix) => this._onInvalidateSourceTabs?.(prefix),
+      recordFileVisit: (bucket, key, size) => this.bookmarks.recordFileVisit(bucket, key, size),
+      removeFiles: (bucket, keys) => this.bookmarks.removeFiles(bucket, keys),
+      clearSelection: () => {
+        this.selectedKeys = new SvelteSet<string>();
+        this.selectionMode = false;
+      }
+    });
+  }
+
+  get api(): StorageApi {
+    return this._api;
   }
 
   // ────────────────────────────────────────────────────────────────────────────
@@ -244,12 +221,7 @@ export class StorageState {
     if (bucketChanged) this.prevTokens = [];
     this.loading = false;
     this.selectedKeys = new SvelteSet<string>();
-    this.archiveKey = null;
-    this.archivePrefix = '';
-    this.archiveNestedPath = null;
-    this.previousS3Prefix = '';
-    this.archiveLoading = false;
-    this.archiveTooLarge = false;
+    this.archive.reset();
   }
 
   /** Add a bucket to the in-memory list (no server-side persistence). */
@@ -338,227 +310,9 @@ export class StorageState {
     this._onNavigate(this.prefix, null, this.pageSize);
   };
 
-  // ── Archive navigation ────────────────────────────────────────────────────
-
-  /** Check if a filename looks like a navigable archive. */
-  isArchiveFile = (key: string): boolean => {
-    const lower = key.toLowerCase();
-    return ARCHIVE_EXTENSIONS.some((ext) => lower.endsWith(ext));
-  };
-
-  /** Enter an archive file and show its contents as a virtual folder. */
-  enterArchive = async (archiveKey: string): Promise<void> => {
-    if (this.isInArchive) {
-      this.archiveNestedPath = archiveKey;
-    } else {
-      this.archiveKey = archiveKey;
-      this.archiveNestedPath = null;
-      this.previousS3Prefix = this.prefix;
-    }
-    this.archivePrefix = '';
-    this.archiveLoading = true;
-
-    try {
-      await this._fetchArchiveListing();
-    } catch (err) {
-      if (this.archiveNestedPath) {
-        this.archiveNestedPath = null;
-      } else {
-        this.archiveKey = null;
-        this.previousS3Prefix = '';
-      }
-      this.archivePrefix = '';
-      this.archiveLoading = false;
-      addToast('error', err instanceof Error ? err.message : m.storage_archive_open_error());
-    }
-  };
-
-  /** Navigate within the current archive (virtual path). */
-  navigateInArchive = async (prefix: string): Promise<void> => {
-    if (!this.archiveKey) return;
-    this.archivePrefix = prefix;
-    this.archiveLoading = true;
-    this.prevTokens = [];
-
-    try {
-      await this._fetchArchiveListing();
-    } catch (err) {
-      this.archiveLoading = false;
-      addToast('error', err instanceof Error ? err.message : m.storage_archive_open_error());
-    }
-  };
-
-  /** Navigate to the root of the outermost archive (clears nested archive state). */
-  navigateToOuterArchiveRoot = (): void => {
-    this.archiveNestedPath = null;
-    this.archivePrefix = '';
-    this.archiveLoading = true;
-    this.prevTokens = [];
-    void this._fetchArchiveListing().catch(() => {
-      this.archiveLoading = false;
-    });
-  };
-
-  /** Navigate up within the archive. If at root, exit the archive or go to parent archive. */
-  navigateUpFromArchive = (): void => {
-    if (!this.archivePrefix) {
-      if (this.archiveNestedPath) {
-        // Go back to outer archive root
-        this.archiveNestedPath = null;
-        this.archivePrefix = '';
-        this.archiveLoading = true;
-        void this._fetchArchiveListing().catch(() => {
-          this.archiveLoading = false;
-        });
-      } else {
-        this.exitArchive();
-      }
-      return;
-    }
-    const withoutTrailing = this.archivePrefix.replace(/\/$/, '');
-    const lastSlash = withoutTrailing.lastIndexOf('/');
-    void this.navigateInArchive(lastSlash === -1 ? '' : withoutTrailing.slice(0, lastSlash + 1));
-  };
-
-  /** Exit the archive and return to the S3 folder that contains it. */
-  exitArchive = (): void => {
-    const s3Prefix = this.previousS3Prefix;
-    this.archiveKey = null;
-    this.archivePrefix = '';
-    this.archiveNestedPath = null;
-    this.previousS3Prefix = '';
-    this.archiveLoading = false;
-    this.archiveTooLarge = false;
-    this.loading = true;
-    this.prevTokens = [];
-    void this._fetchS3Objects(s3Prefix);
-  };
-
-  /** Manually fetch S3 objects for the given prefix (used when exiting archive). */
-  private async _fetchS3Objects(prefix: string): Promise<void> {
-    try {
-      const connectionId = connectionStore.activeConnectionId;
-      if (!connectionId) {
-        this.loading = false;
-        return;
-      }
-      const params = new SvelteURLSearchParams({
-        bucket: this.bucket,
-        prefix: prefix ?? '',
-        pageSize: String(this.pageSize)
-      });
-      const res = await fetch(`/api/storage/objects?${params}`, {
-        headers: { 'x-storage-connection-id': connectionId }
-      });
-      if (res.ok) {
-        const objects = (await res.json()) as StoragePage;
-        this.prefix = prefix;
-        this.objects = objects;
-      }
-    } catch {
-      // Fall back to invalidateAll if manual fetch fails
-      void invalidateAll();
-    } finally {
-      this.loading = false;
-    }
-  }
-
-  /** Download a file from within the current archive. */
-  downloadFromArchive = async (internalPath: string): Promise<void> => {
-    if (!this.archiveKey) return;
-    try {
-      const connectionId = connectionStore.activeConnectionId;
-      if (!connectionId) {
-        addToast('error', m.storage_download_error_unknown());
-        return;
-      }
-      const params = new SvelteURLSearchParams({
-        bucket: this.bucket,
-        key: this.archiveKey,
-        path: internalPath
-      });
-      if (this.archiveNestedPath) {
-        params.set('nestedArchivePath', this.archiveNestedPath);
-      }
-      const res = await fetch(`/api/storage/archive/extract?${params}`, {
-        headers: { 'x-storage-connection-id': connectionId }
-      });
-      if (!res.ok) {
-        const code =
-          res.status === 403 ? 'access_denied' : res.status === 404 ? 'not_found' : 'server_error';
-        throw new DownloadError(code, `Extract failed with status ${res.status}`);
-      }
-      const blob = await res.blob();
-      const blobUrl = URL.createObjectURL(blob);
-      const filename = internalPath.split('/').filter(Boolean).pop() ?? internalPath;
-      const anchor = document.createElement('a');
-      anchor.href = blobUrl;
-      anchor.download = filename;
-      anchor.style.display = 'none';
-      document.body.appendChild(anchor);
-      anchor.click();
-      document.body.removeChild(anchor);
-      setTimeout(() => URL.revokeObjectURL(blobUrl), 10_000);
-    } catch (err: unknown) {
-      if (err instanceof DownloadError) {
-        addToast('error', getActionErrorMessage(new ActionError(err.code, err.message)));
-      } else {
-        addToast('error', m.storage_download_error_unknown());
-      }
-    }
-  };
-
-  /** Fetch archive listing from the server API. */
-  private async _fetchArchiveListing(): Promise<void> {
-    const connectionId = connectionStore.activeConnectionId;
-    if (!connectionId || !this.archiveKey) {
-      this.archiveLoading = false;
-      return;
-    }
-    const params = new SvelteURLSearchParams({
-      bucket: this.bucket,
-      key: this.archiveKey,
-      internalPrefix: this.archivePrefix
-    });
-    if (this.archiveNestedPath) {
-      params.set('nestedArchivePath', this.archiveNestedPath);
-    }
-    const res = await fetch(`/api/storage/archive/listing?${params}`, {
-      headers: { 'x-storage-connection-id': connectionId }
-    });
-    if (!res.ok) {
-      throw new Error(m.storage_archive_open_error());
-    }
-    const data = (await res.json()) as ArchiveListingResponse;
-    if (data.tooLarge) {
-      this.archiveTooLarge = true;
-      this.archiveLoading = false;
-      this.objects = { objects: [], hasNextPage: false, currentPage: 1, pageSize: null as never };
-      return;
-    }
-    this.archiveTooLarge = false;
-    const prefix = this.archivePrefix || '';
-    this.objects = {
-      objects: data.entries.map((e: ArchiveEntry) => ({
-        key: prefix + e.key,
-        size: e.size,
-        lastModified: e.lastModified,
-        isDirectory: e.isDirectory,
-        contentType: undefined
-      })),
-      hasNextPage: data.hasMore,
-      currentPage: 1,
-      pageSize: null as never
-    };
-    this.archiveLoading = false;
-  }
-
   refresh = (): void => {
-    if (this.isInArchive) {
-      this.archiveLoading = true;
-      void this._fetchArchiveListing().catch(() => {
-        this.archiveLoading = false;
-      });
+    if (this.archive.isInArchive) {
+      this.archive.refreshListing();
     } else {
       this.loading = true;
       if (this._onRefreshNavigate) {
@@ -644,17 +398,17 @@ export class StorageState {
           addToast('warning', m.storage_action_preview_no_selection());
           return;
         }
-        if (this.isInArchive) {
+        if (this.archive.isInArchive) {
           this.openModal('preview', {
             key,
-            archiveKey: this.archiveKey!,
+            archiveKey: this.archive.archiveKey!,
             archivePath: key,
-            nestedArchivePath: this.archiveNestedPath || undefined
+            nestedArchivePath: this.archive.nestedArchivePath
           });
           return;
         }
-        if (this.isArchiveFile(key)) {
-          void this.enterArchive(key);
+        if (this.archive.isArchiveFile(key)) {
+          void this.archive.enterArchive(key);
           return;
         }
         for (const f of effectiveSelectedFiles) {
@@ -668,8 +422,8 @@ export class StorageState {
           addToast('warning', m.storage_action_download_no_selection());
           return;
         }
-        if (this.isInArchive) {
-          void this.downloadFromArchive(key);
+        if (this.archive.isInArchive) {
+          void this.archive.downloadFromArchive(key);
           return;
         }
         for (const f of effectiveSelectedFiles) {
@@ -683,8 +437,8 @@ export class StorageState {
           }
           await downloadObject(this.bucket, key, connectionId);
         } catch (err: unknown) {
-          if (err instanceof DownloadError) {
-            addToast('error', getActionErrorMessage(new ActionError(err.code, err.message)));
+          if (err instanceof StorageError) {
+            addToast('error', getActionErrorMessage(err));
           } else {
             addToast('error', m.storage_download_error_unknown());
           }
@@ -745,20 +499,7 @@ export class StorageState {
         if (!storageCutCopyEnabled) return;
         const cutKeys = [...this.selectedKeys];
         if (cutKeys.length === 0) return;
-        const fileSizes: Record<string, number> = {};
-        for (const obj of this.objects.objects) {
-          if (cutKeys.includes(obj.key) && !obj.isDirectory) {
-            fileSizes[obj.key] = obj.size;
-          }
-        }
-        this.clipboard = {
-          action: 'cut',
-          keys: cutKeys,
-          sourceBucket: this.bucket,
-          sourcePrefix: this.prefix,
-          fileSizes
-        };
-        addToast('info', m.storage_action_cut_success({ count: cutKeys.length }));
+        this.clipboardState.cut(cutKeys, this.objects, this.bucket, this.prefix);
         return;
       }
 
@@ -766,181 +507,21 @@ export class StorageState {
         if (!storageCutCopyEnabled) return;
         const copyKeys = [...this.selectedKeys];
         if (copyKeys.length === 0) return;
-        const fileSizes: Record<string, number> = {};
-        for (const obj of this.objects.objects) {
-          if (copyKeys.includes(obj.key) && !obj.isDirectory) {
-            fileSizes[obj.key] = obj.size;
-          }
-        }
-        this.clipboard = {
-          action: 'copy',
-          keys: copyKeys,
-          sourceBucket: this.bucket,
-          sourcePrefix: this.prefix,
-          fileSizes
-        };
-        addToast('info', m.storage_action_copy_success({ count: copyKeys.length }));
+        this.clipboardState.copy(copyKeys, this.objects, this.bucket, this.prefix);
         return;
       }
 
       case 'paste': {
         if (!storagePasteEnabled) return;
-        if (!this.clipboard || this.clipboard.keys.length === 0) return;
-        if (this.isInArchive) {
+        if (!this.clipboardState.clipboard || this.clipboardState.clipboard.keys.length === 0)
+          return;
+        if (this.archive.isInArchive) {
           addToast('warning', m.storage_action_paste_archive_error());
           return;
         }
-        const wasCut = this.clipboard.action === 'cut';
-        const pasteKeys = [...this.clipboard.keys];
-        // If the context menu was opened on a folder, paste inside it
+        const ctxKey = this.contextMenu?.key ?? null;
         const destPrefix = ctxKey && ctxKey.endsWith('/') ? ctxKey : this.prefix;
-
-        // ── Check for name conflicts at destination ──────────────────────
-        const conflictEntries = await this._checkDestinationConflicts(pasteKeys, destPrefix);
-        const hasConflicts = conflictEntries.some((e) => e.conflict);
-        if (hasConflicts) {
-          const totalBytes = pasteKeys.reduce(
-            (sum, k) => sum + (this.clipboard!.fileSizes[k] ?? 0),
-            0
-          );
-          this._pendingConflictOp = {
-            type: 'paste',
-            keys: pasteKeys,
-            sourceBucket: this.clipboard.sourceBucket,
-            destPrefix,
-            wasCut,
-            fileSizes: this.clipboard.fileSizes,
-            sourcePrefix: this.clipboard.sourcePrefix,
-            totalBytes
-          };
-          this.openModal('resolve-conflicts', {
-            entries: conflictEntries,
-            bucket: this.bucket,
-            destPrefix,
-            confirmLabel: m.storage_action_paste()
-          });
-          return;
-        }
-
-        const opId = crypto.randomUUID();
-        const abortController = new AbortController();
-        const sourceNames = pasteKeys.map((k) => keyToName(k));
-        const isSinglePaste = sourceNames.length === 1;
-        const pasteLabel = isSinglePaste
-          ? `${m.storage_operation_paste_one({ count: 1 })}: ${sourceNames[0]}`
-          : `${m.storage_operation_paste_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
-        // Sum total bytes from clipboard file sizes
-        const totalBytes = pasteKeys.reduce(
-          (sum, k) => sum + (this.clipboard!.fileSizes[k] ?? 0),
-          0
-        );
-        this._startOp(
-          opId,
-          pasteLabel,
-          'paste',
-          pasteKeys.length,
-          abortController,
-          `${this.bucket}/${destPrefix}`,
-          sourceNames,
-          totalBytes
-        );
-        try {
-          let completedBytes = 0;
-          const fileSizes = this.clipboard?.fileSizes ?? {};
-          const pasteSourceNames = pasteKeys.map((k) => keyToName(k));
-          const fileJobIdsAccum: string[] = [];
-          const { results, failed } = await this.performPasteSequential(
-            pasteKeys,
-            this.clipboard.sourceBucket,
-            destPrefix,
-            wasCut,
-            abortController.signal,
-            (index, key) => {
-              // File-level progress: use the known file size from clipboard.
-              completedBytes += fileSizes[key] ?? 0;
-              this._updateOpProgress(opId, index, completedBytes, keyToName(key));
-            },
-            // eslint-disable-next-line @typescript-eslint/no-unused-vars
-            (loaded, _total) => {
-              // Byte-level progress during a large file's streaming upload.
-              // loaded comes from the server's onUploadProgress for the current
-              // file. We compute the absolute position by adding the sizes of
-              // all previously completed files.
-              const prevFiles = this.operations.find((op) => op.id === opId)?.completedCount ?? 0;
-              let prevBytes = 0;
-              for (let j = 0; j < prevFiles && j < pasteKeys.length; j++) {
-                prevBytes += fileSizes[pasteKeys[j]] ?? 0;
-              }
-              this._updateOpProgress(
-                opId,
-                prevFiles,
-                prevBytes + loaded,
-                pasteSourceNames[prevFiles] ?? ''
-              );
-            },
-            (index, jobId) => {
-              fileJobIdsAccum[index] = jobId;
-              this._updateOpJobIds(opId, [...fileJobIdsAccum]);
-            }
-          );
-          await tick();
-          if (results.length === 0) {
-            this._finishOp(opId, 'error');
-            addToast('error', m.storage_action_paste_error_source_not_found());
-            return;
-          }
-          this._finishOp(opId, failed > 0 ? 'error' : 'done');
-          // Record destination files as recent visits
-          const newFileSizes: Record<string, number> = {};
-          for (const r of results) {
-            if (r.destKey.endsWith('/')) continue;
-            const size = this.clipboard.fileSizes?.[r.sourceKey] ?? 0;
-            newFileSizes[r.destKey] = size;
-            this.bookmarks.recordFileVisit(this.bucket, r.destKey, size);
-          }
-          if (failed > 0) {
-            addToast('warning', m.storage_action_paste_partial({ count: failed }));
-          } else {
-            addToast('success', m.storage_action_paste_success({ count: results.length }));
-          }
-          // After a cut paste (move), update clipboard keys to the destination
-          // keys so subsequent pastes copy from the newly created files.
-          if (wasCut && results.length > 0) {
-            const destKeys = results.map((r) => r.destKey);
-            // Invalidate source tabs so they refetch (items moved out)
-            if (this.clipboard.sourcePrefix && this._onInvalidateSourceTabs) {
-              this._onInvalidateSourceTabs(this.clipboard.sourcePrefix);
-            }
-            this.clipboard = {
-              action: 'copy',
-              keys: destKeys,
-              sourceBucket: this.bucket,
-              sourcePrefix: this.prefix,
-              fileSizes: newFileSizes
-            };
-          }
-          this.refresh();
-          // Invalidate background tabs viewing the destination
-          if (this._onInvalidateSourceTabs) {
-            this._onInvalidateSourceTabs(destPrefix);
-          }
-        } catch (err: unknown) {
-          if (err instanceof DOMException && err.name === 'AbortError') {
-            this._finishOp(opId, 'cancelled');
-            return;
-          }
-          if (pageUnloading) {
-            // Page is unloading — server-side copies continue regardless.
-            // The operation persists as 'running' in localStorage and will
-            // appear as 'interrupted' on the next page load.
-            return;
-          }
-          this._finishOp(opId, 'error');
-          addToast(
-            'error',
-            err instanceof ActionError ? getActionErrorMessage(err) : m.storage_action_paste_error()
-          );
-        }
+        await this.clipboardState.paste(destPrefix);
         return;
       }
 
@@ -972,26 +553,18 @@ export class StorageState {
     this.loading = true;
 
     try {
-      const connectionId = connectionStore.activeConnectionId;
-      const headers: HeadersInit = connectionId
-        ? { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-        : {};
       const isFolder = type === 'folder';
       const parts = sanitized.split('/');
 
       // Create intermediate directory markers
       for (let i = 0; i < parts.length - 1; i++) {
         const dirKey = this.prefix + parts.slice(0, i + 1).join('/') + '/';
-        const params = new SvelteURLSearchParams({ bucket: this.bucket, key: dirKey });
-        const res = await fetch(`/api/storage/create?${params}`, { method: 'POST', headers });
-        if (!res.ok) throw new Error(`Create failed with status ${res.status}`);
+        await this.api.create({ bucket: this.bucket, key: dirKey });
       }
 
       // Create the final object (file or directory)
       const finalKey = this.prefix + sanitized + (isFolder ? '/' : '');
-      const params = new SvelteURLSearchParams({ bucket: this.bucket, key: finalKey });
-      const res = await fetch(`/api/storage/create?${params}`, { method: 'POST', headers });
-      if (!res.ok) throw new Error(`Create failed with status ${res.status}`);
+      await this.api.create({ bucket: this.bucket, key: finalKey });
 
       void invalidateAll();
     } catch {
@@ -1023,7 +596,7 @@ export class StorageState {
     } catch (err: unknown) {
       this.loading = false;
       let msg = m.storage_delete_error_unknown();
-      if (err instanceof ActionError) {
+      if (err instanceof StorageError) {
         if (err.code === 'not_connected') msg = m.storage_delete_error_not_connected();
         else if (err.code === 'access_denied') msg = m.storage_delete_error_access_denied();
         else if (err.code === 'server_error') msg = m.storage_delete_error_server_error();
@@ -1043,174 +616,32 @@ export class StorageState {
     this.refresh();
   };
 
-  // ────────────────────────────────────────────────────────────────────────────
-  // Paste implementation
-  // ────────────────────────────────────────────────────────────────────────────
+  // ── Delegate methods ───────────────────────────────────────────────────────
 
-  private async performPaste(
-    keys: string[],
-    _sourceBucket: string,
-    destPrefix: string,
-    deleteOriginals = false,
-    signal?: AbortSignal
-  ): Promise<{
-    results: Array<{ sourceKey: string; destKey: string }>;
-    failed: number;
-  }> {
-    const connectionId = connectionStore.activeConnectionId;
-    if (!connectionId) throw new ActionError('not_connected', 'No connection');
-
-    const endpoint = deleteOriginals ? '/api/storage/move' : '/api/storage/copy';
-    const params = new SvelteURLSearchParams({ bucket: this.bucket });
-    const res = await fetch(`${endpoint}?${params}`, {
-      method: 'POST',
-      headers: {
-        'Content-Type': 'application/json',
-        [STORAGE_CONNECTION_ID_HEADER]: connectionId
-      },
-      body: JSON.stringify({
-        sourceKeys: keys,
-        destinationPrefix: destPrefix
-      }),
-      signal
-    });
-
-    if (!res.ok) {
-      let code = 'server_error';
-      if (res.status === 401) code = 'not_connected';
-      else if (res.status === 403) code = 'access_denied';
-      throw new ActionError(code, `Paste failed with status ${res.status}`);
-    }
-
-    const data = (await res.json()) as {
-      results?: Array<{ sourceKey: string; destKey: string }>;
-      moved?: Array<{ sourceKey: string; destKey: string }>;
-      failed: Array<unknown>;
-    };
-    const results = data.results ?? data.moved ?? [];
-    return { results, failed: data.failed?.length ?? 0 };
-  }
-
-  /**
-   * Process paste/move keys one at a time, calling `onFileComplete` after
-   * each file so the caller can update byte-level progress.
-   *
-   * Uses `?progress=true` to stream NDJSON progress events from the server,
-   * allowing real-time byte-level updates for large files (> 5 GB) that go
-   * through multipart streaming upload.
-   */
-  private async performPasteSequential(
-    keys: string[],
-    _sourceBucket: string,
-    destPrefix: string,
-    deleteOriginals = false,
-    signal?: AbortSignal,
-    onFileComplete?: (index: number, key: string) => void,
-    onFileProgress?: (loaded: number, total: number) => void,
-    onFileJobId?: (index: number, jobId: string) => void
-  ): Promise<{
-    results: Array<{ sourceKey: string; destKey: string }>;
-    failed: number;
-    fileJobIds: string[];
-  }> {
-    const connectionId = connectionStore.activeConnectionId;
-    if (!connectionId) throw new ActionError('not_connected', 'No connection');
-
-    const endpoint = deleteOriginals ? '/api/storage/move' : '/api/storage/copy';
-    const results: Array<{ sourceKey: string; destKey: string }> = [];
-    let failed = 0;
-    const fileJobIds: string[] = [];
-
-    for (let i = 0; i < keys.length; i++) {
-      if (signal?.aborted) throw new DOMException('Aborted', 'AbortError');
-
-      const sourceKey = keys[i];
-      const fileJobId = crypto.randomUUID();
-      fileJobIds.push(fileJobId);
-      onFileJobId?.(i, fileJobId);
-      const params = new SvelteURLSearchParams({ bucket: this.bucket });
-      params.set('progress', 'true');
-      const res = await fetch(`${endpoint}?${params}`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          [STORAGE_CONNECTION_ID_HEADER]: connectionId
-        },
-        body: JSON.stringify({
-          sourceKeys: [sourceKey],
-          destinationPrefix: destPrefix,
-          jobId: fileJobId
-        }),
-        signal
-      });
-
-      if (!res.ok) {
-        failed++;
-        continue;
-      }
+  /** Delegated to clipboardState. */
+  performMove = (destPrefix: string, keys?: string[]): void => {
+    this.clipboardState.performMove(destPrefix, keys);
+  };
 
-      // Read the NDJSON stream
-      const reader = res.body?.getReader();
-      const decoder = new TextDecoder();
-      let buffer = '';
+  /** Delegated to clipboardState. */
+  confirmMove = (): Promise<void> => {
+    return this.clipboardState.confirmMove();
+  };
 
-      if (reader) {
-        try {
-          while (true) {
-            const { done, value } = await reader.read();
-            if (done) break;
-
-            buffer += decoder.decode(value, { stream: true });
-            const lines = buffer.split('\n');
-            // Keep the last (potentially incomplete) line in the buffer
-            buffer = lines.pop() ?? '';
-
-            for (const line of lines) {
-              if (!line.trim()) continue;
-              const event = JSON.parse(line) as {
-                type: string;
-                sourceKey?: string;
-                destKey?: string;
-                loaded?: number;
-                total?: number;
-                error?: string;
-                results?: Array<{ sourceKey: string; destKey: string }>;
-                moved?: Array<{ sourceKey: string; destKey: string }>;
-                failed?: Array<{ sourceKey: string; error: string }>;
-              };
-
-              if (
-                event.type === 'progress' &&
-                event.loaded !== undefined &&
-                event.total !== undefined
-              ) {
-                onFileProgress?.(event.loaded, event.total);
-              } else if (event.type === 'done' && event.sourceKey && event.destKey) {
-                results.push({ sourceKey: event.sourceKey, destKey: event.destKey });
-              } else if (event.type === 'failed' && event.sourceKey) {
-                failed++;
-              } else if (event.type === 'complete') {
-                // Final summary — use its results/failed as the canonical source
-                if (event.results) {
-                  results.length = 0;
-                  results.push(...event.results);
-                }
-                if (event.failed) {
-                  failed = event.failed.length;
-                }
-              }
-            }
-          }
-        } finally {
-          reader.releaseLock();
-        }
-      }
+  /** Delegated to clipboardState. */
+  cancelMove = (): void => {
+    this.clipboardState.cancelMove();
+  };
 
-      onFileComplete?.(i + 1, sourceKey);
-    }
+  /** Delegated to clipboardState. */
+  confirmConflictResolution = (entries: ConflictEntry[]): Promise<void> => {
+    return this.clipboardState.confirmConflictResolution(entries);
+  };
 
-    return { results, failed, fileJobIds };
-  }
+  /** Delegated to clipboardState. */
+  cancelConflictResolution = (): void => {
+    this.clipboardState.cancelConflictResolution();
+  };
 
   // ────────────────────────────────────────────────────────────────────────────
   // Rename
@@ -1238,7 +669,7 @@ export class StorageState {
 
     const opId = crypto.randomUUID();
     const renameObj = this.files.find((f) => f.key === key);
-    this._startOp(
+    this.operations_.startOp(
       opId,
       `${m.storage_operation_rename()}: ${keyToName(key)} → ${newName}`,
       'rename',
@@ -1250,35 +681,21 @@ export class StorageState {
     );
 
     try {
-      const connectionId = connectionStore.activeConnectionId;
-      if (!connectionId) {
-        this._finishOp(opId, 'error');
-        this.renameLoading = false;
-        addToast('error', m.storage_rename_error_not_connected());
-        return;
-      }
-
-      const renameParams = new SvelteURLSearchParams({ bucket: this.bucket });
-      const res = await fetch(`/api/storage/rename?${renameParams}`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-          [STORAGE_CONNECTION_ID_HEADER]: connectionId
-        },
-        body: JSON.stringify({ key, newKey })
-      });
-
-      if (!res.ok) {
-        this._finishOp(opId, 'error');
+      try {
+        await this.api.rename({ bucket: this.bucket, key, newKey });
+      } catch (err: unknown) {
+        this.operations_.finishOp(opId, 'error');
         this.renameLoading = false;
-        if (res.status === 409) {
+        if (err instanceof StorageError && err.code === 'conflict') {
           this.renameError = m.storage_rename_error_conflict({ name: newName });
           return;
         }
         this.closeModal();
         let msg = m.storage_rename_error({ name: newName });
-        if (res.status === 403) msg = m.storage_rename_error_access_denied();
-        else if (res.status === 404) msg = m.storage_rename_error_not_found();
+        if (err instanceof StorageError && err.code === 'access_denied')
+          msg = m.storage_rename_error_access_denied();
+        else if (err instanceof StorageError && err.code === 'not_found')
+          msg = m.storage_rename_error_not_found();
         addToast('error', msg);
         return;
       }
@@ -1292,742 +709,22 @@ export class StorageState {
         }
       }
 
-      this._updateOpProgress(opId, 1, renameObj?.size ?? 0);
+      this.operations_.updateOpProgress(opId, 1, renameObj?.size ?? 0);
       await tick();
-      this._finishOp(opId, 'done');
+      this.operations_.finishOp(opId, 'done');
       this.renameLoading = false;
       this.closeModal();
       addToast('success', m.storage_rename_success({ name: newName }));
       this.refresh();
     } catch {
-      this._finishOp(opId, 'error');
+      this.operations_.finishOp(opId, 'error');
       this.renameLoading = false;
       this.closeModal();
       addToast('error', m.storage_rename_error({ name: newName }));
     }
   };
 
-  // ────────────────────────────────────────────────────────────────────────────
-  // Move (used by drag-and-drop)
-  // ────────────────────────────────────────────────────────────────────────────
-
-  /** Validate a drag-and-drop move and open the confirmation dialog.
-   *  The actual API call happens in `confirmMove` after the user confirms. */
-  performMove = (destPrefix: string, keys?: string[]): void => {
-    if (!storageMoveEnabled) return;
-    const moveKeys = keys ?? [...this.selectedKeys];
-    if (moveKeys.length === 0) return;
-
-    // Don't move items that are already directly inside destPrefix (no-op).
-    // This is more precise than comparing destPrefix to this.prefix, which
-    // would incorrectly block cross-tab drops onto the destination directory.
-    const isAlreadyThere = (key: string): boolean => {
-      if (key.endsWith('/')) return key === destPrefix;
-      const parentPrefix = key.substring(0, key.lastIndexOf('/') + 1);
-      return parentPrefix === destPrefix;
-    };
-    if (moveKeys.every(isAlreadyThere)) return;
-
-    // Don't move a folder into itself
-    for (const k of moveKeys) {
-      if (k.endsWith('/') && destPrefix.startsWith(k)) return;
-    }
-
-    // Collect per-item metadata for the confirmation dialog
-    const items = moveKeys.map((key) => {
-      const obj = this.objects.objects.find((o) => o.key === key);
-      return {
-        key,
-        name: keyToName(key),
-        isDirectory: key.endsWith('/'),
-        size: obj && !obj.isDirectory ? obj.size : undefined
-      };
-    });
-
-    this.openModal('confirm-move', { keys: moveKeys, destPrefix, items });
-    // Derive source prefix from the keys being moved (common parent directory).
-    // Cannot use this.prefix because after a cross-tab drop the active tab is
-    // already the destination, so this.prefix equals destPrefix.
-    this._pendingSourcePrefix = this._commonPrefix(moveKeys);
-  };
-
-  /** Returns the longest common directory prefix of the given keys. */
-  private _commonPrefix(keys: string[]): string {
-    if (keys.length === 0) return '';
-    const parts = keys[0].split('/');
-    parts.pop(); // remove filename
-    let prefix = parts.join('/') ? parts.join('/') + '/' : '';
-    for (let i = 1; i < keys.length; i++) {
-      while (prefix && !keys[i].startsWith(prefix)) {
-        const idx = prefix.lastIndexOf('/', prefix.length - 2);
-        prefix = idx >= 0 ? prefix.substring(0, idx + 1) : '';
-      }
-    }
-    return prefix;
-  }
-
-  confirmMove = async (): Promise<void> => {
-    const modal = this.activeModal;
-    if (!modal || modal.type !== 'confirm-move') return;
-    const { keys: moveKeys, destPrefix, items } = modal.payload;
-    this.closeModal();
-
-    // ── Check for name conflicts at destination ──────────────────────────
-    const conflictEntries = await this._checkDestinationConflicts(moveKeys, destPrefix);
-    const hasConflicts = conflictEntries.some((e) => e.conflict);
-    if (hasConflicts) {
-      const totalBytes = items.reduce((sum, item) => sum + (item.size ?? 0), 0);
-      this._pendingConflictOp = {
-        type: 'move',
-        keys: moveKeys,
-        destPrefix,
-        items,
-        sourcePrefix: this._pendingSourcePrefix,
-        totalBytes
-      };
-      this.openModal('resolve-conflicts', {
-        entries: conflictEntries,
-        bucket: this.bucket,
-        destPrefix,
-        confirmLabel: m.storage_action_move()
-      });
-      return;
-    }
-
-    const opId = crypto.randomUUID();
-    const abortController = new AbortController();
-    const sourceNames = moveKeys.map((k) => keyToName(k));
-    const totalBytes = items.reduce((sum, item) => sum + (item.size ?? 0), 0);
-    const isSingleMove = sourceNames.length === 1;
-    const moveLabel = isSingleMove
-      ? `${m.storage_operation_move_one({ count: 1 })}: ${sourceNames[0]}`
-      : `${m.storage_operation_move_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
-    this._startOp(
-      opId,
-      moveLabel,
-      'move',
-      moveKeys.length,
-      abortController,
-      `${this.bucket}/${destPrefix}`,
-      sourceNames,
-      totalBytes
-    );
-
-    try {
-      const connectionId = connectionStore.activeConnectionId;
-      if (!connectionId) {
-        this._finishOp(opId, 'error');
-        this._pendingSourcePrefix = null;
-        addToast('error', m.storage_action_move_error_not_connected());
-        return;
-      }
-
-      const endpoint = '/api/storage/move';
-      const results: Array<{ sourceKey: string; destKey: string }> = [];
-      let failed = 0;
-      const fileJobIds: string[] = [];
-
-      for (let i = 0; i < moveKeys.length; i++) {
-        if (abortController.signal.aborted) {
-          throw new DOMException('Aborted', 'AbortError');
-        }
-
-        const sourceKey = moveKeys[i];
-        const fileJobId = crypto.randomUUID();
-        fileJobIds.push(fileJobId);
-        this._updateOpJobIds(opId, [...fileJobIds]);
-        const params = new SvelteURLSearchParams({ bucket: this.bucket });
-        params.set('progress', 'true');
-        const res = await fetch(`${endpoint}?${params}`, {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-            [STORAGE_CONNECTION_ID_HEADER]: connectionId
-          },
-          body: JSON.stringify({
-            sourceKeys: [sourceKey],
-            destinationPrefix: destPrefix,
-            jobId: fileJobId
-          }),
-          signal: abortController.signal
-        });
-
-        if (!res.ok) {
-          failed++;
-          continue;
-        }
-
-        // Read the NDJSON stream
-        const reader = res.body?.getReader();
-        const decoder = new TextDecoder();
-        let buffer = '';
-        let completedBytes = results.reduce((sum, r) => {
-          const item = items.find((it) => it.key === r.sourceKey);
-          return sum + (item?.size ?? 0);
-        }, 0);
-
-        if (reader) {
-          try {
-            while (true) {
-              const { done, value } = await reader.read();
-              if (done) break;
-
-              buffer += decoder.decode(value, { stream: true });
-              const lines = buffer.split('\n');
-              buffer = lines.pop() ?? '';
-
-              for (const line of lines) {
-                if (!line.trim()) continue;
-                const event = JSON.parse(line) as {
-                  type: string;
-                  sourceKey?: string;
-                  destKey?: string;
-                  loaded?: number;
-                  total?: number;
-                  error?: string;
-                  moved?: Array<{ sourceKey: string; destKey: string }>;
-                  failed?: Array<{ sourceKey: string; error: string }>;
-                };
-
-                if (
-                  event.type === 'progress' &&
-                  event.loaded !== undefined &&
-                  event.total !== undefined
-                ) {
-                  // Byte-level progress during large file streaming
-                  const prevBytes = results.reduce((sum, r) => {
-                    const item = items.find((it) => it.key === r.sourceKey);
-                    return sum + (item?.size ?? 0);
-                  }, 0);
-                  this._updateOpProgress(
-                    opId,
-                    i + 1,
-                    prevBytes + event.loaded,
-                    keyToName(sourceKey)
-                  );
-                } else if (event.type === 'done' && event.sourceKey && event.destKey) {
-                  results.push({ sourceKey: event.sourceKey, destKey: event.destKey });
-                  completedBytes = results.reduce((sum, r) => {
-                    const item = items.find((it) => it.key === r.sourceKey);
-                    return sum + (item?.size ?? 0);
-                  }, 0);
-                  this._updateOpProgress(opId, i + 1, completedBytes, keyToName(sourceKey));
-                } else if (event.type === 'failed' && event.sourceKey) {
-                  failed++;
-                } else if (event.type === 'complete') {
-                  if (event.moved) {
-                    results.length = 0;
-                    results.push(...event.moved);
-                  }
-                  if (event.failed) {
-                    failed = event.failed.length;
-                  }
-                }
-              }
-            }
-          } finally {
-            reader.releaseLock();
-          }
-        }
-      }
-
-      await tick();
-      this._finishOp(opId, failed === 0 ? 'done' : 'error');
-
-      if (results.length > 0) {
-        addToast('success', m.storage_action_move_success({ count: results.length }));
-        const movedKeys = results.map((r) => r.sourceKey).filter((k) => !k.endsWith('/'));
-        if (movedKeys.length > 0) {
-          this.bookmarks.removeFiles(this.bucket, movedKeys);
-        }
-        for (const r of results) {
-          if (!r.destKey.endsWith('/')) {
-            const obj = this.files.find((f) => f.key === r.sourceKey);
-            if (obj) {
-              this.bookmarks.recordFileVisit(this.bucket, r.destKey, obj.size);
-            }
-          }
-        }
-      }
-      if (failed > 0) {
-        addToast('warning', m.storage_action_move_partial({ count: failed }));
-      }
-
-      this.selectedKeys = new SvelteSet<string>();
-      this.selectionMode = false;
-      if (this._pendingSourcePrefix !== null && this._onInvalidateSourceTabs) {
-        this._onInvalidateSourceTabs(this._pendingSourcePrefix);
-        this._pendingSourcePrefix = null;
-      }
-      // Invalidate background tabs viewing the destination
-      if (this._onInvalidateSourceTabs) {
-        this._onInvalidateSourceTabs(destPrefix);
-      }
-      this.refresh();
-    } catch (err: unknown) {
-      if (err instanceof DOMException && err.name === 'AbortError') {
-        this._finishOp(opId, 'cancelled');
-        this._pendingSourcePrefix = null;
-        return;
-      }
-      if (pageUnloading) {
-        return;
-      }
-      this._finishOp(opId, 'error');
-      this._pendingSourcePrefix = null;
-      addToast('error', m.storage_action_move_error());
-    }
-  };
-
-  cancelMove = (): void => {
-    this.closeModal();
-  };
-
-  // ────────────────────────────────────────────────────────────────────────────
-  // Conflict resolution (paste / move)
-  // ────────────────────────────────────────────────────────────────────────────
-
-  /**
-   * Check which destination keys already exist, returning ConflictEntry[]
-   * with conflict=true for existing keys.
-   */
-  private async _checkDestinationConflicts(
-    keys: string[],
-    destPrefix: string
-  ): Promise<ConflictEntry[]> {
-    const connectionId = connectionStore.activeConnectionId ?? '';
-    const results: ConflictEntry[] = [];
-
-    for (const key of keys) {
-      const origName = keyToName(key);
-      const destKey = destPrefix + origName;
-      let conflict = false;
-      try {
-        conflict = await checkObjectExists(this.bucket, destKey, connectionId);
-      } catch {
-        // If the check fails, assume no conflict and proceed
-      }
-      results.push({
-        id: crypto.randomUUID(),
-        originalName: origName,
-        conflict,
-        resolution: conflict ? null : 'replace',
-        customName: origName,
-        renameState: 'idle',
-        sourceKey: key
-      });
-    }
-
-    return results;
-  }
-
-  confirmConflictResolution = async (resolvedEntries: ConflictEntry[]): Promise<void> => {
-    const pending = this._pendingConflictOp;
-    if (!pending) return;
-    this._pendingConflictOp = null;
-    this.closeModal();
-
-    if (pending.type === 'paste') {
-      await this._executePasteWithConflicts(pending, resolvedEntries);
-    } else {
-      await this._executeMoveWithConflicts(pending, resolvedEntries);
-    }
-  };
-
-  cancelConflictResolution = (): void => {
-    this._pendingConflictOp = null;
-    this.closeModal();
-  };
-
-  /**
-   * Delete conflicting destination files before copy/move to prevent
-   * the server from auto-renaming them with " (2)" suffix.
-   */
-  private async _deleteConflictingDests(
-    destPrefix: string,
-    resolvedEntries: ConflictEntry[]
-  ): Promise<void> {
-    const connectionId = connectionStore.activeConnectionId;
-    if (!connectionId) return;
-
-    const keysToDelete: string[] = [];
-    for (const entry of resolvedEntries) {
-      if (entry.resolution === 'skip' || entry.resolution === 'rename') continue;
-      if (entry.conflict) {
-        keysToDelete.push(destPrefix + entry.originalName);
-      }
-    }
-
-    if (keysToDelete.length === 0) return;
-
-    const params = new SvelteURLSearchParams({ bucket: this.bucket });
-    for (const key of keysToDelete) {
-      params.append('keys', key);
-    }
-
-    try {
-      await fetch(`/api/storage/delete?${params}`, {
-        method: 'DELETE',
-        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-      });
-    } catch {
-      // Best-effort - if deletion fails, the server may auto-rename
-    }
-  }
-
-  /**
-   * Execute a paste operation with conflict resolutions.
-   * Renamed entries are first pasted with their original name, then renamed.
-   */
-  private async _executePasteWithConflicts(
-    pending: {
-      keys: string[];
-      sourceBucket: string;
-      destPrefix: string;
-      wasCut: boolean;
-      fileSizes: Record<string, number>;
-      sourcePrefix: string;
-      totalBytes: number;
-    },
-    resolvedEntries: ConflictEntry[]
-  ): Promise<void> {
-    const resolvedMap = new SvelteMap(
-      resolvedEntries.map((e) => [e.sourceKey ?? e.originalName, e])
-    );
-
-    // Split keys by resolution
-    const replaceKeys: string[] = [];
-    const renameKeys: Array<{ sourceKey: string; newName: string }> = [];
-
-    for (const key of pending.keys) {
-      const entry = resolvedMap.get(key) ?? resolvedMap.get(keyToName(key));
-      if (!entry || entry.resolution === 'skip') continue;
-      if (entry.resolution === 'rename') {
-        renameKeys.push({ sourceKey: key, newName: entry.customName.trim() });
-      }
-      replaceKeys.push(key);
-    }
-
-    if (replaceKeys.length === 0 && renameKeys.length === 0) return;
-
-    const opId = crypto.randomUUID();
-    const abortController = new AbortController();
-    const sourceNames = pending.keys.map((k) => keyToName(k));
-    const isSinglePaste = pending.keys.length === 1;
-    const pasteLabel = isSinglePaste
-      ? `${m.storage_operation_paste_one({ count: 1 })}: ${sourceNames[0]}`
-      : `${m.storage_operation_paste_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
-
-    this._startOp(
-      opId,
-      pasteLabel,
-      'paste',
-      replaceKeys.length + renameKeys.length,
-      abortController,
-      `${this.bucket}/${pending.destPrefix}`,
-      sourceNames,
-      pending.totalBytes
-    );
-
-    await this._deleteConflictingDests(pending.destPrefix, resolvedEntries);
-
-    try {
-      const { results, failed } = await this.performPasteSequential(
-        replaceKeys,
-        pending.sourceBucket,
-        pending.destPrefix,
-        pending.wasCut,
-        abortController.signal,
-        (index, key) => {
-          this._updateOpProgress(opId, index, 0, keyToName(key));
-        },
-        // eslint-disable-next-line @typescript-eslint/no-unused-vars
-        (loaded, _total) => {
-          const prevFiles = this.operations.find((op) => op.id === opId)?.completedCount ?? 0;
-          this._updateOpProgress(opId, prevFiles, loaded, '');
-        }
-      );
-
-      // Handle renamed files: rename the already-pasted destination file
-      const destKeyMap = new SvelteMap(results.map((r) => [r.sourceKey, r.destKey]));
-      let renameFailed = 0;
-      for (const rename of renameKeys) {
-        if (abortController.signal.aborted) break;
-        const destKey = destKeyMap.get(rename.sourceKey);
-        if (!destKey) {
-          renameFailed++;
-          continue;
-        }
-        const connectionId = connectionStore.activeConnectionId;
-        if (!connectionId) {
-          renameFailed++;
-          continue;
-        }
-        const newKey = pending.destPrefix + rename.newName;
-        const renameParams = new SvelteURLSearchParams({ bucket: this.bucket });
-        try {
-          const res = await fetch(`/api/storage/rename?${renameParams}`, {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-              [STORAGE_CONNECTION_ID_HEADER]: connectionId
-            },
-            body: JSON.stringify({ key: destKey, newKey })
-          });
-          if (!res.ok) renameFailed++;
-          this._updateOpProgress(
-            opId,
-            replaceKeys.length + renameKeys.indexOf(rename) + 1,
-            0,
-            rename.newName
-          );
-        } catch {
-          renameFailed++;
-        }
-      }
-
-      await tick();
-      const totalFailed = failed + renameFailed;
-      this._finishOp(opId, totalFailed > 0 ? 'error' : 'done');
-
-      if (totalFailed > 0) {
-        addToast('warning', m.storage_action_paste_partial({ count: totalFailed }));
-      } else {
-        addToast(
-          'success',
-          m.storage_action_paste_success({ count: replaceKeys.length + renameKeys.length })
-        );
-      }
-      this.refresh();
-    } catch (err: unknown) {
-      if (err instanceof DOMException && err.name === 'AbortError') {
-        this._finishOp(opId, 'cancelled');
-        return;
-      }
-      if (pageUnloading) {
-        return;
-      }
-      this._finishOp(opId, 'error');
-      addToast('error', m.storage_action_paste_error());
-    }
-  }
-
-  /**
-   * Execute a move operation with conflict resolutions.
-   * For "replace" entries: delete the conflicting destination first, then move.
-   * For "rename" entries: rename the source at its current location first,
-   * then move the renamed source to the destination — the file never appears
-   * at the original name in the destination.
-   */
-  private async _executeMoveWithConflicts(
-    pending: {
-      keys: string[];
-      destPrefix: string;
-      items: Array<{ key: string; name: string; isDirectory: boolean; size?: number }>;
-      sourcePrefix: string | null;
-      totalBytes: number;
-    },
-    resolvedEntries: ConflictEntry[]
-  ): Promise<void> {
-    const resolvedMap = new SvelteMap(
-      resolvedEntries.map((e) => [e.sourceKey ?? e.originalName, e])
-    );
-
-    // Split keys by resolution — rename entries are NOT added to replaceKeys here.
-    // They will be renamed at source first, then added to replaceKeys before the move loop.
-    const replaceKeys: string[] = [];
-    const renameKeys: Array<{ sourceKey: string; newName: string }> = [];
-
-    for (const key of pending.keys) {
-      const entry = resolvedMap.get(key) ?? resolvedMap.get(keyToName(key));
-      if (!entry || entry.resolution === 'skip') continue;
-      if (entry.resolution === 'rename') {
-        renameKeys.push({ sourceKey: key, newName: entry.customName.trim() });
-      } else {
-        replaceKeys.push(key);
-      }
-    }
-
-    if (replaceKeys.length === 0 && renameKeys.length === 0) return;
-
-    const opId = crypto.randomUUID();
-    const abortController = new AbortController();
-    const sourceNames = pending.keys.map((k) => keyToName(k));
-    const totalCount = replaceKeys.length + renameKeys.length;
-    const isSingleMove = totalCount === 1;
-    const moveLabel = isSingleMove
-      ? `${m.storage_operation_move_one({ count: 1 })}: ${sourceNames[0]}`
-      : `${m.storage_operation_move_other({ count: sourceNames.length })}: ${sourceNames[0]} + ${sourceNames.length - 1} more`;
-
-    this._startOp(
-      opId,
-      moveLabel,
-      'move',
-      totalCount,
-      abortController,
-      `${this.bucket}/${pending.destPrefix}`,
-      sourceNames,
-      pending.totalBytes
-    );
-
-    const connectionId = connectionStore.activeConnectionId;
-    if (!connectionId) {
-      this._finishOp(opId, 'error');
-      addToast('error', m.storage_action_move_error_not_connected());
-      return;
-    }
-
-    // Only delete conflicting destinations for "replace" entries
-    await this._deleteConflictingDests(pending.destPrefix, resolvedEntries);
-
-    try {
-      const results: Array<{ sourceKey: string; destKey: string }> = [];
-      let renameFailed = 0;
-      let failed = 0;
-
-      // ── Pre-processing: rename rename entries at source before moving ─────
-      for (const rename of renameKeys) {
-        if (abortController.signal.aborted) break;
-
-        const parts = rename.sourceKey.split('/');
-        parts.pop();
-        const parentPrefix = parts.length > 0 ? parts.join('/') + '/' : '';
-        const renamedSourceKey =
-          parentPrefix + rename.newName + (rename.sourceKey.endsWith('/') ? '/' : '');
-
-        const renameParams = new SvelteURLSearchParams({ bucket: this.bucket });
-        try {
-          const renameRes = await fetch(`/api/storage/rename?${renameParams}`, {
-            method: 'POST',
-            headers: {
-              'Content-Type': 'application/json',
-              [STORAGE_CONNECTION_ID_HEADER]: connectionId
-            },
-            body: JSON.stringify({ key: rename.sourceKey, newKey: renamedSourceKey })
-          });
-          if (renameRes.ok) {
-            replaceKeys.push(renamedSourceKey);
-          } else {
-            renameFailed++;
-          }
-        } catch {
-          renameFailed++;
-        }
-      }
-
-      failed = renameFailed;
-
-      // ── Move all entries ────────────────────────────────────────────────────
-      const endpoint = '/api/storage/move';
-
-      for (const key of replaceKeys) {
-        if (abortController.signal.aborted) {
-          throw new DOMException('Aborted', 'AbortError');
-        }
-
-        const params = new SvelteURLSearchParams({ bucket: this.bucket });
-        params.set('progress', 'true');
-        const res = await fetch(`${endpoint}?${params}`, {
-          method: 'POST',
-          headers: {
-            'Content-Type': 'application/json',
-            [STORAGE_CONNECTION_ID_HEADER]: connectionId
-          },
-          body: JSON.stringify({
-            sourceKeys: [key],
-            destinationPrefix: pending.destPrefix
-          }),
-          signal: abortController.signal
-        });
-
-        if (!res.ok) {
-          failed++;
-          continue;
-        }
-
-        // Read the NDJSON stream (the endpoint returns NDJSON when progress=true)
-        const reader = res.body?.getReader();
-        const decoder = new TextDecoder();
-        let buffer = '';
-
-        if (reader) {
-          try {
-            while (true) {
-              const { done, value } = await reader.read();
-              if (done) break;
-              buffer += decoder.decode(value, { stream: true });
-              const lines = buffer.split('\n');
-              buffer = lines.pop() ?? '';
-              for (const line of lines) {
-                if (!line.trim()) continue;
-                const event = JSON.parse(line) as {
-                  type: string;
-                  sourceKey?: string;
-                  destKey?: string;
-                  loaded?: number;
-                  total?: number;
-                  moved?: Array<{ sourceKey: string; destKey: string }>;
-                  failed?: Array<{ sourceKey: string; error: string }>;
-                };
-                if (event.type === 'done' && event.sourceKey && event.destKey) {
-                  results.push({ sourceKey: event.sourceKey, destKey: event.destKey });
-                } else if (event.type === 'failed' && event.sourceKey) {
-                  failed++;
-                } else if (event.type === 'complete') {
-                  if (event.moved) {
-                    results.length = 0;
-                    results.push(...event.moved);
-                  }
-                  if (event.failed) {
-                    failed = event.failed.length;
-                  }
-                }
-              }
-            }
-          } finally {
-            reader.releaseLock();
-          }
-        }
-        this._updateOpProgress(opId, results.length, 0, keyToName(key));
-      }
-
-      await tick();
-      const totalFailed = renameFailed + failed;
-      this._finishOp(opId, totalFailed === 0 ? 'done' : 'error');
-
-      if (results.length > 0) {
-        addToast('success', m.storage_action_move_success({ count: results.length }));
-        const movedKeys = results.map((r) => r.sourceKey).filter((k) => !k.endsWith('/'));
-        if (movedKeys.length > 0) {
-          this.bookmarks.removeFiles(this.bucket, movedKeys);
-        }
-      }
-      if (totalFailed > 0) {
-        addToast('warning', m.storage_action_move_partial({ count: totalFailed }));
-      }
-
-      this.selectedKeys = new SvelteSet<string>();
-      this.selectionMode = false;
-      if (pending.sourcePrefix !== null && this._onInvalidateSourceTabs) {
-        this._onInvalidateSourceTabs(pending.sourcePrefix);
-      }
-      // Invalidate background tabs viewing the destination
-      if (this._onInvalidateSourceTabs) {
-        this._onInvalidateSourceTabs(pending.destPrefix);
-      }
-      this.refresh();
-    } catch (err: unknown) {
-      if (err instanceof DOMException && err.name === 'AbortError') {
-        this._finishOp(opId, 'cancelled');
-        return;
-      }
-      if (pageUnloading) {
-        return;
-      }
-      this._finishOp(opId, 'error');
-      addToast('error', m.storage_action_move_error());
-    }
-  }
+  // ── (Move and conflict resolution moved to ClipboardState) ──
 
   // ────────────────────────────────────────────────────────────────────────────
   // Keyboard shortcuts
@@ -2035,7 +732,7 @@ export class StorageState {
 
   handleKeydown = (e: KeyboardEvent): void => {
     if (this.activeModal?.type === 'delete') return;
-    if (this.isInArchive && e.key !== 'Escape') return;
+    if (this.archive.isInArchive && e.key !== 'Escape') return;
 
     const isCtrl = e.ctrlKey || e.metaKey;
 
@@ -2052,219 +749,32 @@ export class StorageState {
       }
     } else if (isCtrl && e.key === 'x') {
       e.preventDefault();
-      if (!this.isInArchive && this.selectedKeys.size > 0) {
+      if (!this.archive.isInArchive && this.selectedKeys.size > 0) {
         void this.executeAction('cut');
       }
     } else if (isCtrl && e.key === 'c') {
       e.preventDefault();
-      if (!this.isInArchive && this.selectedKeys.size > 0) {
+      if (!this.archive.isInArchive && this.selectedKeys.size > 0) {
         void this.executeAction('copy');
       }
     } else if (isCtrl && e.key === 'v') {
       e.preventDefault();
-      if (!this.isInArchive && this.clipboard) {
+      if (!this.archive.isInArchive && this.clipboard) {
         void this.executeAction('paste');
       }
     } else if (e.key === 'F2') {
-      if (!this.isInArchive && this.selectedKeys.size === 1) {
+      if (!this.archive.isInArchive && this.selectedKeys.size === 1) {
         void this.executeAction('rename');
       }
     }
   };
 
-  // ────────────────────────────────────────────────────────────────────────────
-  // Private: Operations tracking helpers
-  // ────────────────────────────────────────────────────────────────────────────
-
-  private _startOp(
-    id: string,
-    label: string,
-    type: StorageOperation['type'],
-    itemCount: number,
-    abortController?: AbortController,
-    destPath?: string,
-    sourceNames?: string[],
-    totalBytes = 0
-  ): void {
-    this.operations = [
-      ...this.operations,
-      {
-        id,
-        label,
-        status: 'running',
-        type,
-        itemCount,
-        completedCount: 0,
-        startedAt: Date.now(),
-        destPath,
-        sourceNames,
-        totalBytes,
-        completedBytes: 0
-      }
-    ];
-    if (abortController) {
-      this._abortControllers.set(id, abortController);
-    }
-    // Persist immediately so a refresh shows the op as interrupted.
-    saveOperationsToStorage(this.operations);
-  }
-
-  private _updateOpProgress(
-    id: string,
-    completedCount: number,
-    completedBytes: number,
-    currentFileName?: string
-  ): void {
-    this.operations = this.operations.map((op) =>
-      op.id === id && op.status !== 'cancelled'
-        ? { ...op, completedCount, completedBytes, currentFileName }
-        : op
-    );
-  }
-
-  private _updateOpJobIds(id: string, fileJobIds: string[]): void {
-    this.operations = this.operations.map((op) => (op.id === id ? { ...op, fileJobIds } : op));
-    saveOperationsToStorage(this.operations);
-  }
-
-  private _finishOp(
-    id: string,
-    status: 'done' | 'error' | 'cancelled',
-    errorMessage?: string
-  ): void {
-    this.operations = this.operations.map((op) =>
-      op.id === id && op.status !== 'cancelled'
-        ? { ...op, status, errorMessage, completedAt: Date.now() }
-        : op
-    );
-    this._abortControllers.delete(id);
-    saveOperationsToStorage(this.operations);
-  }
-
-  /**
-   * For interrupted operations that have fileJobIds, poll the server job store
-   * to recover actual results. Updates operations in place.
-   * For jobs still running, polls periodically to show live progress.
-   */
-  private async reconcileInterruptedOps(): Promise<void> {
-    const interrupted = this.operations.filter(
-      (op) => op.status === 'interrupted' && op.fileJobIds && op.fileJobIds.length > 0
-    );
-    if (interrupted.length === 0) return;
-
-    for (const op of interrupted) {
-      void this._pollJobStatus(op);
-    }
-  }
-
-  /**
-   * Poll the server job store for a single operation's status.
-   * Updates the operation's progress and status in real-time.
-   */
-  private _pollTimers = new SvelteMap<string, ReturnType<typeof setTimeout>>();
-
-  private async _pollJobStatus(op: StorageOperation): Promise<void> {
-    // If the operation was cancelled while we were waiting to poll, stop.
-    if (this.operations.find((o) => o.id === op.id)?.status === 'cancelled') return;
-
-    let completedCount = 0;
-    let completedBytes = 0;
-    let anyRunning = false;
-
-    for (const jobId of op.fileJobIds!) {
-      try {
-        const res = await fetch(`/api/storage/copy/job/${jobId}`);
-        if (!res.ok) continue;
-        const job = (await res.json()) as {
-          status: string;
-          progress?: { completedCount?: number; completedBytes?: number; currentFileName?: string };
-        };
-        if (job.status === 'done') {
-          completedCount++;
-        } else if (job.status === 'running') {
-          anyRunning = true;
-          completedBytes += job.progress?.completedBytes ?? 0;
-        }
-      } catch {
-        // Job may have expired
-      }
-    }
-
-    // Update the operation — switch to 'running' if still in progress so the
-    // progress display shows live data instead of a static "interrupted" message.
-    if (anyRunning) {
-      this.operations = this.operations.map((o) =>
-        o.id === op.id
-          ? {
-              ...o,
-              status: 'running' as const,
-              completedCount,
-              completedBytes,
-              completedAt: undefined
-            }
-          : o
-      );
-      // Poll again in 2 seconds
-      const timer = setTimeout(() => void this._pollJobStatus(op), 2000);
-      this._pollTimers.set(op.id, timer);
-    } else {
-      // All jobs resolved — mark operation as done (or partially failed)
-      this.operations = this.operations.map((o) =>
-        o.id === op.id
-          ? {
-              ...o,
-              status: (completedCount === op.itemCount ? 'done' : 'error') as 'done' | 'error',
-              completedCount,
-              completedBytes,
-              completedAt: Date.now()
-            }
-          : o
-      );
-      saveOperationsToStorage(this.operations);
-
-      // Clean up any lingering timer
-      const existing = this._pollTimers.get(op.id);
-      if (existing) {
-        clearTimeout(existing);
-        this._pollTimers.delete(op.id);
-      }
-
-      // Refresh the current view if the operation was writing to the
-      // directory the user is currently browsing (or a parent of it).
-      if (op.destPath && `${this.bucket}/${this.prefix}`.startsWith(op.destPath)) {
-        this.refresh();
-      }
-
-      // Invalidate background tabs whose prefix matches the destination
-      if (op.destPath && this._onInvalidateSourceTabs) {
-        const slashIdx = op.destPath.indexOf('/');
-        if (slashIdx !== -1) {
-          const prefix = op.destPath.slice(slashIdx + 1);
-          this._onInvalidateSourceTabs(prefix.endsWith('/') ? prefix : prefix + '/');
-        }
-      }
-    }
-  }
-
-  /** Remove all completed/failed/cancelled/interrupted operations from history. */
-  clearOperationHistory = (): void => {
-    this.operations = this.operations.filter((op) => op.status === 'running');
-    saveOperationsToStorage(this.operations);
+  cancelOp = (id: string): void => {
+    this.operations_.cancelOp(id);
   };
 
-  cancelOp = (id: string): void => {
-    const controller = this._abortControllers.get(id);
-    if (controller) {
-      controller.abort();
-    }
-    // Stop polling for re-acquired operations (restored from localStorage
-    // after a page refresh — these have no AbortController to cancel).
-    const timer = this._pollTimers.get(id);
-    if (timer) {
-      clearTimeout(timer);
-      this._pollTimers.delete(id);
-    }
-    this._finishOp(id, 'cancelled');
+  clearOperationHistory = (): void => {
+    this.operations_.clearOperationHistory();
   };
 
   // ────────────────────────────────────────────────────────────────────────────
@@ -2275,25 +785,7 @@ export class StorageState {
     bucket: string,
     keys: string[]
   ): Promise<{ failed: Array<{ key: string; code?: string; message?: string }> }> {
-    const params = new SvelteURLSearchParams({ bucket });
-    for (const key of keys) params.append('keys', key);
-
-    const connectionId = connectionStore.activeConnectionId;
-    const headers: HeadersInit = connectionId ? { 'x-storage-connection-id': connectionId } : {};
-
-    const res = await fetch(`/api/storage/delete?${params}`, { method: 'DELETE', headers });
-    if (!res.ok) {
-      let code: string;
-      if (res.status === 401) code = 'not_connected';
-      else if (res.status === 403) code = 'access_denied';
-      else if (res.status >= 500) code = 'server_error';
-      else code = 'unknown';
-      throw new ActionError(code, `Delete failed with status ${res.status}`);
-    }
-
-    const result = (await res.json()) as {
-      failed: Array<{ key: string; code?: string; message?: string }>;
-    };
+    const result = await this.api.delete({ bucket, keys });
 
     // Clean up pinned locations and recent items for deleted paths
     const dirPrefixes = keys.filter((k) => k.endsWith('/'));
@@ -2307,22 +799,7 @@ export class StorageState {
     }
 
     // Remove deleted keys from clipboard if they match the current bucket
-    if (this.clipboard && this.clipboard.sourceBucket === bucket) {
-      const remainingKeys = this.clipboard.keys.filter((k) => !keys.includes(k));
-      if (remainingKeys.length !== this.clipboard.keys.length) {
-        if (remainingKeys.length === 0) {
-          this.clipboard = null;
-        } else {
-          const remainingSizes: Record<string, number> = {};
-          for (const k of remainingKeys) {
-            if (this.clipboard.fileSizes[k] !== undefined) {
-              remainingSizes[k] = this.clipboard.fileSizes[k];
-            }
-          }
-          this.clipboard = { ...this.clipboard, keys: remainingKeys, fileSizes: remainingSizes };
-        }
-      }
-    }
+    this.clipboardState.removeDeletedKeys(bucket, keys);
 
     return result;
   }
diff --git a/src/lib/storage/storage-fetch.spec.ts b/src/lib/storage/storage-fetch.spec.ts
new file mode 100644
index 00000000..632868be
--- /dev/null
+++ b/src/lib/storage/storage-fetch.spec.ts
@@ -0,0 +1,198 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { createStorageFetch, mapStatusToCode } from './storage-fetch.js';
+import { StorageError } from './errors.js';
+import { STORAGE_CONNECTION_ID_HEADER } from './connection-id-header.js';
+
+// ── Helpers ────────────────────────────────────────────────────────────────
+
+function makeResponse(opts?: { status?: number; body?: string }): Response {
+  return new Response(opts?.body ?? null, {
+    status: opts?.status ?? 200
+  });
+}
+
+// ── Tests ──────────────────────────────────────────────────────────────────
+
+beforeEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe('mapStatusToCode', () => {
+  it('maps 401 → not_connected', () => {
+    expect(mapStatusToCode(401)).toBe('not_connected');
+  });
+
+  it('maps 403 → access_denied', () => {
+    expect(mapStatusToCode(403)).toBe('access_denied');
+  });
+
+  it('maps 404 → not_found', () => {
+    expect(mapStatusToCode(404)).toBe('not_found');
+  });
+
+  it('maps 500 → server_error', () => {
+    expect(mapStatusToCode(500)).toBe('server_error');
+  });
+
+  it('maps 502 → server_error', () => {
+    expect(mapStatusToCode(502)).toBe('server_error');
+  });
+
+  it('maps 503 → server_error', () => {
+    expect(mapStatusToCode(503)).toBe('server_error');
+  });
+
+  it('maps 200 → unknown', () => {
+    expect(mapStatusToCode(200)).toBe('unknown');
+  });
+
+  it('maps 400 → unknown', () => {
+    expect(mapStatusToCode(400)).toBe('unknown');
+  });
+});
+
+describe('createStorageFetch', () => {
+  it('throws StorageError with not_connected when getConnectionId returns null', async () => {
+    const storageFetch = createStorageFetch(() => null);
+
+    await expect(storageFetch('/api/test')).rejects.toThrow(StorageError);
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'not_connected'
+    });
+  });
+
+  it('throws StorageError with not_connected when getConnectionId returns undefined', async () => {
+    const storageFetch = createStorageFetch(() => undefined as unknown as string | null);
+
+    await expect(storageFetch('/api/test')).rejects.toThrow(StorageError);
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'not_connected'
+    });
+  });
+
+  it('sets the connection ID header on the request', async () => {
+    const storageFetch = createStorageFetch(() => 'test-conn-id');
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse());
+
+    await storageFetch('/api/storage/list?bucket=test');
+
+    expect(fetchSpy).toHaveBeenCalledOnce();
+    const [, init] = fetchSpy.mock.calls[0]!;
+    const headers = new Headers(init?.headers);
+    expect(headers.get(STORAGE_CONNECTION_ID_HEADER)).toBe('test-conn-id');
+  });
+
+  it('preserves custom headers from the caller', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse());
+
+    await storageFetch('/api/test', {
+      headers: { 'X-Custom': 'value' },
+      method: 'POST'
+    });
+
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.method).toBe('POST');
+    const headers = new Headers(init?.headers);
+    expect(headers.get('X-Custom')).toBe('value');
+    expect(headers.get(STORAGE_CONNECTION_ID_HEADER)).toBe('conn-1');
+  });
+
+  it('returns the response on success', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    const body = JSON.stringify({ ok: true });
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse({ body }));
+
+    const res = await storageFetch('/api/test');
+    expect(res.ok).toBe(true);
+    expect(await res.json()).toEqual({ ok: true });
+  });
+
+  it('throws StorageError on 403 with access_denied code', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse({ status: 403 }));
+
+    await expect(storageFetch('/api/test')).rejects.toThrow(StorageError);
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'access_denied'
+    });
+  });
+
+  it('throws StorageError on 404 with not_found code', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse({ status: 404 }));
+
+    await expect(storageFetch('/api/test')).rejects.toThrow(StorageError);
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'not_found'
+    });
+  });
+
+  it('throws StorageError on 500 with server_error code', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse({ status: 500 }));
+
+    await expect(storageFetch('/api/test')).rejects.toThrow(StorageError);
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'server_error'
+    });
+  });
+
+  it('throws StorageError on 401 with not_connected code', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse({ status: 401 }));
+
+    await expect(storageFetch('/api/test')).rejects.toThrow(StorageError);
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'not_connected'
+    });
+  });
+
+  it('throws StorageError on 400 with unknown code', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse({ status: 400 }));
+
+    await expect(storageFetch('/api/test')).rejects.toMatchObject({
+      code: 'unknown'
+    });
+  });
+
+  it('calls fetch with the correct path', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse());
+
+    await storageFetch('/api/storage/list?bucket=my-bucket&prefix=foo/');
+
+    expect(fetchSpy).toHaveBeenCalledWith(
+      '/api/storage/list?bucket=my-bucket&prefix=foo/',
+      expect.objectContaining({ headers: expect.any(Headers) })
+    );
+  });
+
+  it('forwards body and method from init', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse());
+    const body = JSON.stringify({ sourceKeys: ['a.txt'], destinationPrefix: 'dest/' });
+
+    await storageFetch('/api/storage/copy?bucket=b', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body
+    });
+
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.method).toBe('POST');
+    expect(init?.body).toBe(body);
+  });
+
+  it('forwards AbortSignal', async () => {
+    const storageFetch = createStorageFetch(() => 'conn-1');
+    const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue(makeResponse());
+    const controller = new AbortController();
+
+    await storageFetch('/api/test', { signal: controller.signal });
+
+    const [, init] = fetchSpy.mock.calls[0]!;
+    expect(init?.signal).toBe(controller.signal);
+  });
+});
diff --git a/src/lib/storage/storage-fetch.ts b/src/lib/storage/storage-fetch.ts
new file mode 100644
index 00000000..af8954e3
--- /dev/null
+++ b/src/lib/storage/storage-fetch.ts
@@ -0,0 +1,62 @@
+/**
+ * Centralised fetch wrapper for all storage API calls.
+ *
+ * Every storage endpoint requires the `x-storage-connection-id` header.
+ * This module eliminates the repeated pattern of:
+ *   1. Reading the connection ID from the store
+ *   2. Setting the header
+ *   3. Calling fetch
+ *   4. Mapping HTTP status to a StorageErrorCode
+ *
+ * Usage via the factory:
+ *   const fetch_ = createStorageFetch(() => connectionStore.activeConnectionId);
+ */
+
+import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+import { StorageError } from '$lib/storage/errors.js';
+
+/**
+ * Map an HTTP status code to a StorageError code.
+ *
+ * This consolidates the duplicated mapping that previously appeared in
+ * `state.svelte.ts`, `download.ts`, and `upload.ts`.
+ */
+export function mapStatusToCode(status: number): string {
+  if (status === 401) return 'not_connected';
+  if (status === 403) return 'access_denied';
+  if (status === 404) return 'not_found';
+  if (status === 409) return 'conflict';
+  if (status >= 500) return 'server_error';
+  return 'unknown';
+}
+
+/**
+ * Create a `storageFetch` function bound to a connection-ID getter.
+ *
+ * @param getConnectionId  A function that returns the active connection ID,
+ *                         or `null` when no connection is active.
+ * @returns A fetch-like function that automatically injects the connection
+ *          header and throws `StorageError` on failure.
+ */
+export function createStorageFetch(
+  getConnectionId: () => string | null
+): (path: string, init?: RequestInit) => Promise<Response> {
+  return async function storageFetch(path: string, init?: RequestInit): Promise<Response> {
+    const connectionId = getConnectionId();
+    if (!connectionId) {
+      throw new StorageError('not_connected', 'No active storage connection');
+    }
+
+    const headers = new Headers(init?.headers);
+    headers.set(STORAGE_CONNECTION_ID_HEADER, connectionId);
+
+    const response = await fetch(path, { ...init, headers });
+
+    if (!response.ok) {
+      const code = mapStatusToCode(response.status);
+      throw new StorageError(code, `Request failed with status ${response.status}`);
+    }
+
+    return response;
+  };
+}
diff --git a/src/lib/storage/tabs-context.ts b/src/lib/storage/tabs-context.ts
deleted file mode 100644
index 6dfeb939..00000000
--- a/src/lib/storage/tabs-context.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-import { createContext } from 'svelte';
-import type { TabsState } from './tabs.svelte.js';
-
-export const [getTabsState, setTabsState] = createContext<TabsState>();
diff --git a/src/lib/storage/tabs.svelte.ts b/src/lib/storage/tabs.svelte.ts
index 84b94651..0a00888e 100644
--- a/src/lib/storage/tabs.svelte.ts
+++ b/src/lib/storage/tabs.svelte.ts
@@ -109,22 +109,22 @@ export class TabsState {
       objects: this.storage.objects,
       prevTokens: [...this.storage.prevTokens],
       pageSize: this.storage.pageSize,
-      archiveKey: this.storage.archiveKey,
-      archivePrefix: this.storage.archivePrefix,
-      archiveNestedPath: this.storage.archiveNestedPath,
-      previousS3Prefix: this.storage.previousS3Prefix,
-      archiveLoading: this.storage.archiveLoading,
-      archiveTooLarge: this.storage.archiveTooLarge,
+      archiveKey: this.storage.archive.archiveKey,
+      archivePrefix: this.storage.archive.archivePrefix,
+      archiveNestedPath: this.storage.archive.nestedArchivePath ?? null,
+      previousS3Prefix: this.storage.archive._previousS3Prefix,
+      archiveLoading: this.storage.archive.archiveLoading,
+      archiveTooLarge: this.storage.archive.archiveTooLarge,
       autoLabel: this.computeAutoLabel()
     };
   }
 
   private computeAutoLabel(): string {
-    if (this.storage.isInArchive && this.storage.archiveKey) {
+    if (this.storage.archive.isInArchive && this.storage.archive.archiveKey) {
       return this.archiveLabelFrom(
-        this.storage.archiveKey,
-        this.storage.archivePrefix,
-        this.storage.archiveNestedPath
+        this.storage.archive.archiveKey,
+        this.storage.archive.archivePrefix,
+        this.storage.archive.nestedArchivePath ?? null
       );
     }
     return this.buildLabel(this.storage.bucket, this.storage.prefix);
@@ -136,12 +136,14 @@ export class TabsState {
     this.storage.objects = snapshot.objects;
     this.storage.prevTokens = [...snapshot.prevTokens];
     this.storage.pageSize = snapshot.pageSize;
-    this.storage.archiveKey = snapshot.archiveKey;
-    this.storage.archivePrefix = snapshot.archivePrefix;
-    this.storage.archiveNestedPath = snapshot.archiveNestedPath;
-    this.storage.previousS3Prefix = snapshot.previousS3Prefix;
-    this.storage.archiveLoading = snapshot.archiveLoading;
-    this.storage.archiveTooLarge = snapshot.archiveTooLarge;
+    this.storage.archive._restoreFullState({
+      archiveKey: snapshot.archiveKey,
+      archivePrefix: snapshot.archivePrefix,
+      archiveNestedPath: snapshot.archiveNestedPath,
+      previousS3Prefix: snapshot.previousS3Prefix,
+      archiveLoading: snapshot.archiveLoading,
+      archiveTooLarge: snapshot.archiveTooLarge
+    });
     this.storage.loading = false;
     this.storage.clearSelection();
     this.replaceLocationUrl?.(snapshot.bucket, snapshot.prefix);
@@ -214,6 +216,7 @@ export class TabsState {
       }
     }));
 
+    // eslint-disable-next-line security/detect-object-injection
     const mappedActiveId = activeIdx >= 0 ? this.tabs[activeIdx].id : this.tabs[0].id;
     this.activeTabId = mappedActiveId;
 
@@ -269,6 +272,7 @@ export class TabsState {
     if (!this.activeTabId) return;
     const idx = this.tabs.findIndex((t) => t.id === this.activeTabId);
     if (idx === -1) return;
+    // eslint-disable-next-line security/detect-object-injection
     const tab = this.tabs[idx];
     if (!tab.stub) return;
     this.tabs = [
@@ -283,6 +287,7 @@ export class TabsState {
     if (!this.activeTabId) return;
     const idx = this.tabs.findIndex((t) => t.id === this.activeTabId);
     if (idx === -1) return;
+    // eslint-disable-next-line security/detect-object-injection
     const tab = this.tabs[idx];
     const updatedTab: Tab = {
       ...tab,
@@ -332,6 +337,7 @@ export class TabsState {
 
     if (id === this.activeTabId) {
       const newIdx = Math.min(idx, newTabs.length - 1);
+      // eslint-disable-next-line security/detect-object-injection
       const nextTab = newTabs[newIdx];
       this.activeTabId = nextTab.id;
       if (nextTab.stub && this.navigateToLocation) {
@@ -348,6 +354,7 @@ export class TabsState {
   renameTab(id: string, newLabel: string): void {
     const idx = this.tabs.findIndex((t) => t.id === id);
     if (idx === -1) return;
+    // eslint-disable-next-line security/detect-object-injection
     const tab = this.tabs[idx];
     this.tabs = [
       ...this.tabs.slice(0, idx),
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index b22dd911..800ca560 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -94,7 +94,7 @@ export type ActionName =
 // ── Clipboard state (cut / copy) ────────────────────────────────────────────
 
 /** Tracks items stored in the virtual clipboard for cut/copy + paste operations. */
-export interface ClipboardState {
+export interface ClipboardData {
   /** 'cut' items are rendered shaded; 'copy' items are not. */
   action: 'cut' | 'copy';
   /** S3 keys of the items in the clipboard. */
diff --git a/src/lib/storage/upload.ts b/src/lib/storage/upload.ts
index 719da4e5..ff349560 100644
--- a/src/lib/storage/upload.ts
+++ b/src/lib/storage/upload.ts
@@ -13,41 +13,10 @@
  */
 
 import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+import { StorageError, type StorageErrorCode } from '$lib/storage/errors.js';
+import { createStorageFetch, mapStatusToCode } from '$lib/storage/storage-fetch.js';
 
-export type UploadErrorCode =
-  | 'not_connected'
-  | 'access_denied'
-  | 'no_such_bucket'
-  | 'invalid_part'
-  | 'server_error'
-  | 'unknown';
-
-export class UploadError extends Error {
-  constructor(
-    public readonly code: UploadErrorCode,
-    message: string
-  ) {
-    super(message);
-    this.name = 'UploadError';
-  }
-}
-
-function buildUploadUrl(bucket: string, key: string): string {
-  return `/api/storage/upload?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
-}
-
-function buildDownloadUrl(bucket: string, key: string): string {
-  return `/api/storage/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
-}
-
-function mapStatusToUploadCode(status: number): UploadErrorCode {
-  if (status === 403) return 'access_denied';
-  if (status === 404) return 'no_such_bucket';
-  if (status === 400) return 'invalid_part';
-  if (status === 401) return 'not_connected';
-  if (status >= 500) return 'server_error';
-  return 'unknown';
-}
+export type UploadErrorCode = StorageErrorCode;
 
 /**
  * Check whether an object with the given key already exists in the bucket.
@@ -61,16 +30,18 @@ export async function checkObjectExists(
   key: string,
   connectionId: string
 ): Promise<boolean> {
-  const url = buildDownloadUrl(bucket, key);
-  const res = await fetch(url, {
-    method: 'HEAD',
-    headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-  });
-  if (res.status === 200) return true;
-  if (res.status === 404) return false;
-  if (res.status === 401) throw new UploadError('not_connected', 'Not connected');
-  if (res.status === 403) throw new UploadError('access_denied', 'Access denied');
-  throw new UploadError('server_error', `Unexpected status ${res.status}`);
+  const fetch_ = createStorageFetch(() => connectionId);
+  try {
+    const res = await fetch_(
+      `/api/storage/download?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`,
+      {
+        method: 'HEAD'
+      }
+    );
+    return res.ok;
+  } catch {
+    return false;
+  }
 }
 
 /**
@@ -92,7 +63,7 @@ export function uploadFile(
 ): Promise<void> {
   return new Promise((resolve, reject) => {
     const xhr = new XMLHttpRequest();
-    const url = buildUploadUrl(bucket, key);
+    const url = `/api/storage/upload?bucket=${encodeURIComponent(bucket)}&key=${encodeURIComponent(key)}`;
 
     xhr.upload.addEventListener('progress', (e) => {
       if (e.lengthComputable) {
@@ -106,16 +77,16 @@ export function uploadFile(
         resolve();
         return;
       }
-      const code = mapStatusToUploadCode(xhr.status);
-      reject(new UploadError(code, `Upload failed with status ${xhr.status}`));
+      const code = mapStatusToCode(xhr.status);
+      reject(new StorageError(code, `Upload failed with status ${xhr.status}`));
     });
 
     xhr.addEventListener('error', () => {
-      reject(new UploadError('server_error', 'Network error during upload'));
+      reject(new StorageError('server_error', 'Network error during upload'));
     });
 
     xhr.addEventListener('abort', () => {
-      reject(new UploadError('unknown', 'Upload aborted'));
+      reject(new StorageError('unknown', 'Upload aborted'));
     });
 
     xhr.open('POST', url);
diff --git a/src/lib/stores/tab-store.svelte.ts b/src/lib/stores/tab-store.svelte.ts
index 68edbbda..d941e550 100644
--- a/src/lib/stores/tab-store.svelte.ts
+++ b/src/lib/stores/tab-store.svelte.ts
@@ -201,6 +201,7 @@ function createTabStore() {
 
     if (activeTabId === id) {
       const newIndex = Math.min(index, tabs.length - 1);
+      // eslint-disable-next-line security/detect-object-injection
       activeTabId = tabs[newIndex].id;
     }
     saveIndex();
diff --git a/src/routes/(app)/api/storage/archive/extract/+server.ts b/src/routes/(app)/api/storage/archive/extract/+server.ts
index 835b5819..4fdbae58 100644
--- a/src/routes/(app)/api/storage/archive/extract/+server.ts
+++ b/src/routes/(app)/api/storage/archive/extract/+server.ts
@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import { extractArchiveEntry, getArchiveFormat } from '$lib/server/storage/archive.js';
-import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
+import { getProvider } from '$lib/server/storage/utils.js';
 import { archivePreviewMaxBytes } from '$lib/server/feature-flags.js';
 import type { RequestHandler } from './$types';
 
@@ -38,14 +38,21 @@ export const GET: RequestHandler = async ({ locals, url }) => {
     throw error(400, `Unsupported archive format: ${key}`);
   }
 
+  const config = locals.storageConfig;
+  if (!config) {
+    throw error(401, 'No storage connection configured');
+  }
+
   locals.logger.debug(
     { bucket, key, internal_path: internalPath, nested_archive_path: nestedArchivePath, format },
     'extracting archive entry'
   );
 
   const downloadFn = (k: string) =>
-    downloadObject(locals.storageConfig!, bucket, k).then((d) => d.stream);
-  const metadataFn = (k: string) => getObjectMetadata(locals.storageConfig!, bucket, k);
+    getProvider(config, bucket)
+      .getObject(k)
+      .then((d) => d.stream);
+  const metadataFn = (k: string) => getProvider(config, bucket).getMetadata(k);
 
   const data = await extractArchiveEntry(
     bucket,
@@ -74,30 +81,30 @@ export const GET: RequestHandler = async ({ locals, url }) => {
 
 function guessContentType(path: string): string {
   const ext = path.split('.').pop()?.toLowerCase() ?? '';
-  const mime: Record<string, string> = {
-    txt: 'text/plain',
-    csv: 'text/csv',
-    json: 'application/json',
-    xml: 'application/xml',
-    html: 'text/html',
-    css: 'text/css',
-    js: 'application/javascript',
-    md: 'text/markdown',
-    yaml: 'application/x-yaml',
-    yml: 'application/x-yaml',
-    parquet: 'application/octet-stream',
-    pdf: 'application/pdf',
-    png: 'image/png',
-    jpg: 'image/jpeg',
-    jpeg: 'image/jpeg',
-    gif: 'image/gif',
-    svg: 'image/svg+xml',
-    webp: 'image/webp',
-    log: 'text/plain',
-    py: 'text/plain',
-    java: 'text/plain',
-    ts: 'text/plain',
-    sql: 'text/plain'
-  };
-  return mime[ext] ?? 'application/octet-stream';
+  const mime = new Map<string, string>([
+    ['txt', 'text/plain'],
+    ['csv', 'text/csv'],
+    ['json', 'application/json'],
+    ['xml', 'application/xml'],
+    ['html', 'text/html'],
+    ['css', 'text/css'],
+    ['js', 'application/javascript'],
+    ['md', 'text/markdown'],
+    ['yaml', 'application/x-yaml'],
+    ['yml', 'application/x-yaml'],
+    ['parquet', 'application/octet-stream'],
+    ['pdf', 'application/pdf'],
+    ['png', 'image/png'],
+    ['jpg', 'image/jpeg'],
+    ['jpeg', 'image/jpeg'],
+    ['gif', 'image/gif'],
+    ['svg', 'image/svg+xml'],
+    ['webp', 'image/webp'],
+    ['log', 'text/plain'],
+    ['py', 'text/plain'],
+    ['java', 'text/plain'],
+    ['ts', 'text/plain'],
+    ['sql', 'text/plain']
+  ]);
+  return mime.get(ext) ?? 'application/octet-stream';
 }
diff --git a/src/routes/(app)/api/storage/archive/listing/+server.ts b/src/routes/(app)/api/storage/archive/listing/+server.ts
index 5a6fcae0..2a05a37d 100644
--- a/src/routes/(app)/api/storage/archive/listing/+server.ts
+++ b/src/routes/(app)/api/storage/archive/listing/+server.ts
@@ -1,6 +1,6 @@
 import { error } from '@sveltejs/kit';
 import { listArchiveContents } from '$lib/server/storage/archive.js';
-import { downloadObject, getObjectMetadata } from '$lib/server/storage/service.js';
+import { getProvider } from '$lib/server/storage/utils.js';
 import { archivePreviewMaxBytes } from '$lib/server/feature-flags.js';
 import type { RequestHandler } from './$types';
 
@@ -28,14 +28,21 @@ export const GET: RequestHandler = async ({ locals, url }) => {
   const internalPrefix = url.searchParams.get('internalPrefix') ?? '';
   const nestedArchivePath = url.searchParams.get('nestedArchivePath')?.trim() || undefined;
 
+  const config = locals.storageConfig;
+  if (!config) {
+    throw error(401, 'No storage connection configured');
+  }
+
   locals.logger.debug(
     { bucket, key, internal_prefix: internalPrefix, nested_archive_path: nestedArchivePath },
     'listing archive contents'
   );
 
   const downloadFn = (k: string) =>
-    downloadObject(locals.storageConfig!, bucket, k).then((d) => d.stream);
-  const metadataFn = (k: string) => getObjectMetadata(locals.storageConfig!, bucket, k);
+    getProvider(config, bucket)
+      .getObject(k)
+      .then((d) => d.stream);
+  const metadataFn = (k: string) => getProvider(config, bucket).getMetadata(k);
 
   const listing = await listArchiveContents(
     bucket,
diff --git a/src/routes/(app)/api/storage/bucket-details/+server.ts b/src/routes/(app)/api/storage/bucket-details/+server.ts
deleted file mode 100644
index fa1736cd..00000000
--- a/src/routes/(app)/api/storage/bucket-details/+server.ts
+++ /dev/null
@@ -1,29 +0,0 @@
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
-import type { BucketDetails } from '$lib/storage/details-types.js';
-import type { RequestHandler } from './$types';
-
-export const GET: RequestHandler = async ({ url, locals }) => {
-  const bucket = requireBucket(url);
-
-  locals.logger.debug({ bucket }, 'fetching bucket details');
-
-  const provider = getProvider(locals.storageConfig!, bucket);
-
-  const [versioning, lifecycleRules, tags, acl] = await Promise.all([
-    provider.getBucketVersioning(),
-    provider.getBucketLifecycleRules(),
-    provider.getBucketTags(),
-    provider.getBucketAcl()
-  ]);
-
-  const details: BucketDetails = {
-    name: bucket,
-    versioning: versioning as 'Enabled' | 'Suspended' | 'Disabled',
-    lifecycleRules,
-    tags,
-    acl
-  };
-
-  return Response.json(details);
-};
diff --git a/src/routes/(app)/api/storage/bucket-details/server.test.ts b/src/routes/(app)/api/storage/bucket-details/server.test.ts
deleted file mode 100644
index cd679f8e..00000000
--- a/src/routes/(app)/api/storage/bucket-details/server.test.ts
+++ /dev/null
@@ -1,112 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-
-const mockGetBucketVersioning = vi.fn();
-const mockGetBucketLifecycleRules = vi.fn();
-const mockGetBucketTags = vi.fn();
-const mockGetBucketAcl = vi.fn();
-const mockProvider = {
-  getBucketVersioning: mockGetBucketVersioning,
-  getBucketLifecycleRules: mockGetBucketLifecycleRules,
-  getBucketTags: mockGetBucketTags,
-  getBucketAcl: mockGetBucketAcl
-};
-vi.mock('$lib/server/storage/utils.js', () => ({
-  getProvider: () => mockProvider
-}));
-
-import { GET } from './+server.js';
-
-const CONNECTION_HEADER = {
-  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
-};
-
-function mockEvent(searchParams: Record<string, string>) {
-  const url = new URL('http://localhost/api/storage/bucket-details');
-  for (const [k, v] of Object.entries(searchParams)) {
-    url.searchParams.set(k, v);
-  }
-  return {
-    url,
-    request: { headers: new Headers(CONNECTION_HEADER) },
-    locals: {
-      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
-      user: { id: 'test-user' },
-      storageConfig: { type: 's3', region: 'us-east-1' }
-    }
-  } as unknown as Parameters<typeof GET>[0];
-}
-
-describe('GET /api/storage/bucket-details', () => {
-  beforeEach(() => vi.clearAllMocks());
-
-  it('throws 400 when bucket is missing', async () => {
-    await expect(GET(mockEvent({}))).rejects.toThrow(expect.objectContaining({ status: 400 }));
-  });
-
-  it('returns bucket details with Enabled versioning', async () => {
-    mockGetBucketVersioning.mockResolvedValue('Enabled');
-    mockGetBucketLifecycleRules.mockResolvedValue([]);
-    mockGetBucketTags.mockResolvedValue({ env: 'prod' });
-    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
-
-    const response = await GET(mockEvent({ bucket: 'b1' }));
-    const body = await response.json();
-    expect(body).toMatchObject({
-      name: 'b1',
-      versioning: 'Enabled',
-      tags: { env: 'prod' },
-      acl: { owner: 'admin', grants: [] },
-      lifecycleRules: []
-    });
-  });
-
-  it('preserves Suspended versioning state', async () => {
-    mockGetBucketVersioning.mockResolvedValue('Suspended');
-    mockGetBucketLifecycleRules.mockResolvedValue([]);
-    mockGetBucketTags.mockResolvedValue({});
-    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
-
-    const response = await GET(mockEvent({ bucket: 'b1' }));
-    const body = await response.json();
-    expect(body.versioning).toBe('Suspended');
-  });
-
-  it('returns Disabled versioning as default', async () => {
-    mockGetBucketVersioning.mockResolvedValue('Disabled');
-    mockGetBucketLifecycleRules.mockResolvedValue([]);
-    mockGetBucketTags.mockResolvedValue({});
-    mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
-
-    const response = await GET(mockEvent({ bucket: 'b1' }));
-    const body = await response.json();
-    expect(body.versioning).toBe('Disabled');
-  });
-
-  it('includes lifecycle rules and ACL grants', async () => {
-    const rules = [
-      {
-        id: 'rule-1',
-        status: 'Enabled',
-        filter: { prefix: 'logs/' },
-        transitions: [],
-        expirations: [{ days: 30 }],
-        noncurrentVersionTransitions: [],
-        noncurrentVersionExpirations: [],
-        abortIncompleteMultipartUploads: []
-      }
-    ];
-    const acl = {
-      owner: 'owner',
-      grants: [{ grantee: 'user1', permission: 'FULL_CONTROL' }]
-    };
-    mockGetBucketVersioning.mockResolvedValue('Enabled');
-    mockGetBucketLifecycleRules.mockResolvedValue(rules);
-    mockGetBucketTags.mockResolvedValue({});
-    mockGetBucketAcl.mockResolvedValue(acl);
-
-    const response = await GET(mockEvent({ bucket: 'b1' }));
-    const body = await response.json();
-    expect(body.lifecycleRules).toEqual(rules);
-    expect(body.acl).toEqual(acl);
-  });
-});
diff --git a/src/routes/(app)/api/storage/buckets/+server.ts b/src/routes/(app)/api/storage/buckets/+server.ts
index 5e81a6e5..7d3a3b6c 100644
--- a/src/routes/(app)/api/storage/buckets/+server.ts
+++ b/src/routes/(app)/api/storage/buckets/+server.ts
@@ -1,22 +1,48 @@
-import { getConnectionProvider } from '$lib/server/storage/utils.js';
+import { json, error } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
+import type { BucketDetails } from '$lib/storage/details-types.js';
+import { getConnectionProvider } from '$lib/server/storage/utils.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
+
+export const GET: RequestHandler = async (event) => {
+  const detailsParam = event.url.searchParams.get('details');
+  const prefix = event.url.searchParams.get('prefix');
+
+  if (detailsParam === 'true') {
+    const { provider, bucket } = createStorageProvider(event);
+
+    event.locals.logger.debug({ bucket }, 'fetching bucket details');
+
+    const [versioning, lifecycleRules, tags, acl] = await Promise.all([
+      provider.getBucketVersioning(),
+      provider.getBucketLifecycleRules(),
+      provider.getBucketTags(),
+      provider.getBucketAcl()
+    ]);
+
+    const details: BucketDetails = {
+      name: bucket,
+      versioning: versioning as 'Enabled' | 'Suspended' | 'Disabled',
+      lifecycleRules,
+      tags,
+      acl
+    };
+
+    return json(details);
+  }
+
+  if (!prefix) {
+    const config = event.locals.storageConfig;
+    if (!config) {
+      throw error(401, 'No storage connection configured');
+    }
+
+    const listedBuckets = await getConnectionProvider(config).listContainers();
+    const additional = config.additionalBuckets ?? [];
+    const allBuckets = [...new Set([...listedBuckets, ...additional])];
+    event.locals.logger.debug({ bucket_count: allBuckets.length }, 'bucket list returned');
+    return json(allBuckets);
+  }
 
-/**
- * GET /api/storage/buckets
- *
- * Returns the list of buckets accessible with the connection config supplied in
- * the `x-storage-connection-id` request header. The config is resolved and
- * decrypted by the `handleStorageConnection` middleware in hooks.server.ts
- * before this handler runs.
- *
- * Additional buckets stored with the connection (not returned by ListBuckets)
- * are merged into the response.
- */
-export const GET: RequestHandler = async ({ locals }) => {
-  const config = locals.storageConfig!;
-  const listedBuckets = await getConnectionProvider(config).listContainers();
-  const additional = config.additionalBuckets ?? [];
-  const allBuckets = [...new Set([...listedBuckets, ...additional])];
-  locals.logger.debug({ bucket_count: allBuckets.length }, 'bucket list returned');
-  return Response.json(allBuckets);
+  return json([]);
 };
diff --git a/src/routes/(app)/api/storage/buckets/server.test.ts b/src/routes/(app)/api/storage/buckets/server.test.ts
new file mode 100644
index 00000000..7e1bb924
--- /dev/null
+++ b/src/routes/(app)/api/storage/buckets/server.test.ts
@@ -0,0 +1,158 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockGetBucketVersioning = vi.fn();
+const mockGetBucketLifecycleRules = vi.fn();
+const mockGetBucketTags = vi.fn();
+const mockGetBucketAcl = vi.fn();
+const mockListContainers = vi.fn();
+const mockProvider = {
+  getBucketVersioning: mockGetBucketVersioning,
+  getBucketLifecycleRules: mockGetBucketLifecycleRules,
+  getBucketTags: mockGetBucketTags,
+  getBucketAcl: mockGetBucketAcl
+};
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider,
+  getConnectionProvider: () => ({ listContainers: mockListContainers })
+}));
+
+import { GET } from './+server.js';
+
+function mockEvent(searchParams: Record<string, string>) {
+  const url = new URL('http://localhost/api/storage/buckets');
+  for (const [k, v] of Object.entries(searchParams)) {
+    url.searchParams.set(k, v);
+  }
+  return {
+    url,
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: {
+        type: 's3',
+        host: 'localhost',
+        accessStyle: 'Path' as const,
+        region: { name: 'us-east-1' }
+      }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /api/storage/buckets', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  describe('bucket listing (no details param)', () => {
+    it('returns buckets from provider plus additional buckets', async () => {
+      mockListContainers.mockResolvedValue(['alpha', 'beta']);
+
+      const event = mockEvent({});
+      event.locals.storageConfig = {
+        type: 's3',
+        host: 'localhost',
+        accessStyle: 'Path' as const,
+        region: { name: 'us-east-1' },
+        additionalBuckets: ['gamma']
+      };
+      const response = await GET(event);
+      const body = await response.json();
+      expect(body).toEqual(['alpha', 'beta', 'gamma']);
+    });
+
+    it('deduplicates overlapping provider and additional buckets', async () => {
+      mockListContainers.mockResolvedValue(['alpha', 'beta']);
+
+      const event = mockEvent({});
+      event.locals.storageConfig = {
+        type: 's3',
+        host: 'localhost',
+        accessStyle: 'Path' as const,
+        region: { name: 'us-east-1' },
+        additionalBuckets: ['beta']
+      };
+      const response = await GET(event);
+      const body = await response.json();
+      expect(body).toEqual(['alpha', 'beta']);
+    });
+
+    it('returns empty array when prefix is set without details', async () => {
+      const response = await GET(mockEvent({ prefix: 'some/prefix/' }));
+      const body = await response.json();
+      expect(body).toEqual([]);
+    });
+  });
+
+  describe('bucket details (details=true)', () => {
+    it('throws 400 when bucket is missing', async () => {
+      await expect(GET(mockEvent({ details: 'true' }))).rejects.toThrow(
+        expect.objectContaining({ status: 400 })
+      );
+    });
+
+    it('returns bucket details with Enabled versioning', async () => {
+      mockGetBucketVersioning.mockResolvedValue('Enabled');
+      mockGetBucketLifecycleRules.mockResolvedValue([]);
+      mockGetBucketTags.mockResolvedValue({ env: 'prod' });
+      mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+
+      const response = await GET(mockEvent({ details: 'true', bucket: 'b1' }));
+      const body = await response.json();
+      expect(body).toMatchObject({
+        name: 'b1',
+        versioning: 'Enabled',
+        tags: { env: 'prod' },
+        acl: { owner: 'admin', grants: [] },
+        lifecycleRules: []
+      });
+    });
+
+    it('preserves Suspended versioning state', async () => {
+      mockGetBucketVersioning.mockResolvedValue('Suspended');
+      mockGetBucketLifecycleRules.mockResolvedValue([]);
+      mockGetBucketTags.mockResolvedValue({});
+      mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+
+      const response = await GET(mockEvent({ details: 'true', bucket: 'b1' }));
+      const body = await response.json();
+      expect(body.versioning).toBe('Suspended');
+    });
+
+    it('returns Disabled versioning as default', async () => {
+      mockGetBucketVersioning.mockResolvedValue('Disabled');
+      mockGetBucketLifecycleRules.mockResolvedValue([]);
+      mockGetBucketTags.mockResolvedValue({});
+      mockGetBucketAcl.mockResolvedValue({ owner: 'admin', grants: [] });
+
+      const response = await GET(mockEvent({ details: 'true', bucket: 'b1' }));
+      const body = await response.json();
+      expect(body.versioning).toBe('Disabled');
+    });
+
+    it('includes lifecycle rules and ACL grants', async () => {
+      const rules = [
+        {
+          id: 'rule-1',
+          status: 'Enabled',
+          filter: { prefix: 'logs/' },
+          transitions: [],
+          expirations: [{ days: 30 }],
+          noncurrentVersionTransitions: [],
+          noncurrentVersionExpirations: [],
+          abortIncompleteMultipartUploads: []
+        }
+      ];
+      const acl = {
+        owner: 'owner',
+        grants: [{ grantee: 'user1', permission: 'FULL_CONTROL' }]
+      };
+      mockGetBucketVersioning.mockResolvedValue('Enabled');
+      mockGetBucketLifecycleRules.mockResolvedValue(rules);
+      mockGetBucketTags.mockResolvedValue({});
+      mockGetBucketAcl.mockResolvedValue(acl);
+
+      const response = await GET(mockEvent({ details: 'true', bucket: 'b1' }));
+      const body = await response.json();
+      expect(body.lifecycleRules).toEqual(rules);
+      expect(body.acl).toEqual(acl);
+    });
+  });
+});
diff --git a/src/routes/(app)/api/storage/check-bucket/+server.ts b/src/routes/(app)/api/storage/check-bucket/+server.ts
index 3d5202b2..6c2ed987 100644
--- a/src/routes/(app)/api/storage/check-bucket/+server.ts
+++ b/src/routes/(app)/api/storage/check-bucket/+server.ts
@@ -1,22 +1,23 @@
 import { error, isHttpError } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 import type { RequestHandler } from './$types';
 
-export const GET: RequestHandler = async ({ url, locals }) => {
-  const log = locals.logger;
-  const bucket = requireBucket(url);
+/**
+ * GET /api/storage/check-bucket?bucket=<bucket>
+ *
+ * Verifies that the configured bucket is reachable and accessible.
+ * Returns 204 on success, 502 if the bucket cannot be reached.
+ */
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
 
   try {
-    await getProvider(locals.storageConfig!, bucket).listObjects('', 1);
-    log.debug({ bucket }, 'bucket access check passed');
+    await provider.listObjects('', 1);
+    event.locals.logger.debug({ bucket }, 'bucket access check passed');
     return new Response(null, { status: 204 });
   } catch (err) {
-    if (isHttpError(err)) {
-      log.info({ bucket, status: err.status }, 'bucket access check failed');
-      throw err;
-    }
-    log.warn({ err, bucket }, 'unexpected error during bucket access check');
+    if (isHttpError(err)) throw err;
+    event.locals.logger.warn({ err, bucket }, 'unexpected error during bucket access check');
     throw error(502, 'Could not reach bucket');
   }
 };
diff --git a/src/routes/(app)/api/storage/check-bucket/server.test.ts b/src/routes/(app)/api/storage/check-bucket/server.test.ts
index c68988e6..815ce61c 100644
--- a/src/routes/(app)/api/storage/check-bucket/server.test.ts
+++ b/src/routes/(app)/api/storage/check-bucket/server.test.ts
@@ -15,7 +15,12 @@ function mockEvent(params: string) {
     url,
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
-      storageConfig: { type: 's3', host: 'localhost' }
+      storageConfig: {
+        type: 's3',
+        host: 'localhost',
+        accessStyle: 'Path' as const,
+        region: { name: 'us-east-1' }
+      }
     }
   } as unknown as Parameters<typeof GET>[0];
 }
diff --git a/src/routes/(app)/api/storage/copy/+server.ts b/src/routes/(app)/api/storage/copy/+server.ts
index e19b28fd..d283a42c 100644
--- a/src/routes/(app)/api/storage/copy/+server.ts
+++ b/src/routes/(app)/api/storage/copy/+server.ts
@@ -1,14 +1,12 @@
 import type { RequestHandler } from './$types';
-import { error, json } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
-import { computeDestinations, uniqueDestKey } from '$lib/server/storage/operations.js';
-import { createProgressStream } from '$lib/server/storage/streaming.js';
-import { createJob } from '$lib/server/storage/job-store.js';
+import { error } from '@sveltejs/kit';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
+import { performCopyOrMove } from '$lib/server/storage/copy-move.js';
 
-export const POST: RequestHandler = async ({ locals, request, url }) => {
-  const bucket = requireBucket(url);
-  const streamProgress = url.searchParams.get('progress') === 'true';
+export const POST: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const streamProgress = event.url.searchParams.get('progress') === 'true';
+  const { locals, request } = event;
 
   const body = (await request.json()) as {
     sourceKeys: string[];
@@ -32,114 +30,14 @@ export const POST: RequestHandler = async ({ locals, request, url }) => {
     'copy request received'
   );
 
-  const provider = getProvider(locals.storageConfig!, bucket);
-
-  if (!streamProgress) {
-    const destinations = await computeDestinations(
-      provider,
-      body.sourceKeys,
-      body.destinationPrefix
-    );
-    const results: Array<{ sourceKey: string; destKey: string }> = [];
-    const failed: Array<{ sourceKey: string; error: string }> = [];
-
-    for (const { sourceKey, baseDestKey } of destinations) {
-      try {
-        const destKey = await uniqueDestKey(provider, baseDestKey);
-        await provider.copyObject(sourceKey, destKey);
-        results.push({ sourceKey, destKey });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : 'Unknown error';
-        failed.push({ sourceKey, error: message });
-        locals.logger.warn(
-          { bucket, source_key: sourceKey, dest_key: baseDestKey, error: message },
-          'copy failed for key'
-        );
-      }
-    }
-
-    locals.logger.info({ bucket, copied: results.length, failed: failed.length }, 'copy completed');
-    return json({ results, failed });
-  }
-
-  if (body.jobId) {
-    createJob(body.jobId);
-  }
-
-  return createProgressStream(
-    (emit) => {
-      const run = async () => {
-        const destinations = await computeDestinations(
-          provider,
-          body.sourceKeys,
-          body.destinationPrefix
-        );
-        const results: Array<{ sourceKey: string; destKey: string }> = [];
-        const failed: Array<{ sourceKey: string; error: string }> = [];
-
-        for (const { sourceKey, baseDestKey } of destinations) {
-          try {
-            const destKey = await uniqueDestKey(provider, baseDestKey);
-
-            let reportedAnyProgress = false;
-            await provider.copyObject(sourceKey, destKey, (loaded, total) => {
-              reportedAnyProgress = true;
-              emit({ type: 'progress', sourceKey, destKey, loaded, total });
-            });
-
-            if (!reportedAnyProgress) {
-              try {
-                const meta = await provider.getMetadata(sourceKey);
-                emit({
-                  type: 'progress',
-                  sourceKey,
-                  destKey,
-                  loaded: meta.size,
-                  total: meta.size
-                });
-              } catch {
-                // Metadata fetch failed
-              }
-            }
-
-            results.push({ sourceKey, destKey });
-            emit({ type: 'done', sourceKey, destKey });
-          } catch (err) {
-            const message = err instanceof Error ? err.message : 'Unknown error';
-            const errorName = err instanceof Error ? err.constructor.name : typeof err;
-            const stack =
-              err instanceof Error ? (err.stack ?? '').split('\n').slice(0, 3).join(' | ') : '';
-            failed.push({ sourceKey, error: message });
-            locals.logger.warn(
-              {
-                bucket,
-                source_key: sourceKey,
-                dest_key: baseDestKey,
-                error: message,
-                error_name: errorName,
-                stack
-              },
-              'copy failed for key'
-            );
-            emit({ type: 'failed', sourceKey, error: message });
-          }
-        }
-
-        locals.logger.info(
-          { bucket, copied: results.length, failed: failed.length },
-          'copy completed'
-        );
-
-        return { results, failed };
-      };
-
-      return run();
-    },
-    {
-      jobId: body.jobId,
-      operationName: 'copy',
-      logger: locals.logger,
-      bucket
-    }
-  );
+  return performCopyOrMove({
+    provider,
+    sourceKeys: body.sourceKeys,
+    destinationPrefix: body.destinationPrefix,
+    streamProgress,
+    logger: locals.logger,
+    bucket,
+    jobId: body.jobId,
+    deleteOriginals: false
+  });
 };
diff --git a/src/routes/(app)/api/storage/create/+server.ts b/src/routes/(app)/api/storage/create/+server.ts
index 58f07f00..b35fc93b 100644
--- a/src/routes/(app)/api/storage/create/+server.ts
+++ b/src/routes/(app)/api/storage/create/+server.ts
@@ -1,25 +1,25 @@
-import { uploadObject } from '$lib/server/storage/service.js';
-import type { RequestHandler } from '@sveltejs/kit';
-import { requireBucketKey } from '../params.js';
+import { error } from '@sveltejs/kit';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
+import type { RequestHandler } from './$types';
 
 /**
  * POST /api/storage/create?bucket=<bucket>&key=<object-key>
  *
- * Creates an empty object (zero bytes) at the given key.
- * If the key ends with '/', it creates a directory marker.
- *
+ * Creates an empty object (or directory marker when the key ends with `/`).
  * The connection config is parsed and validated by the `handleStorageConnection`
  * middleware in hooks.server.ts before this handler runs.
  */
-export const POST: RequestHandler = async ({ locals, url }) => {
-  const log = locals.logger;
-  const { bucket, key } = requireBucketKey(url);
-
-  log.debug({ bucket, key }, 'creating object');
+export const POST: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const key = event.url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
+  const log = event.locals.logger;
 
   const contentType = key.endsWith('/') ? 'application/x-directory' : 'text/plain';
 
-  await uploadObject(locals.storageConfig!, bucket, key, Buffer.alloc(0), contentType, 0);
+  log.debug({ bucket, key }, 'creating object');
+
+  await provider.putObject(key, Buffer.alloc(0), contentType, 0);
 
   log.info({ bucket, key, content_type: contentType }, 'object created');
 
diff --git a/src/routes/(app)/api/storage/create/server.test.ts b/src/routes/(app)/api/storage/create/server.test.ts
new file mode 100644
index 00000000..4272a470
--- /dev/null
+++ b/src/routes/(app)/api/storage/create/server.test.ts
@@ -0,0 +1,71 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockProvider = { putObject: vi.fn() };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+import { POST } from './+server.js';
+
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
+function mockEvent(params: string) {
+  const url = new URL(`http://localhost/api/storage/create?${params}`);
+  return {
+    url,
+    request: { headers: new Headers(CONNECTION_HEADER) },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
+    }
+  } as unknown as Parameters<typeof POST>[0];
+}
+
+describe('POST /api/storage/create', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('creates a directory marker when key ends with /', async () => {
+    mockProvider.putObject.mockResolvedValue(undefined);
+
+    const res = await POST(mockEvent('bucket=b1&key=folder/subfolder/'));
+
+    expect(res.status).toBe(201);
+    expect(mockProvider.putObject).toHaveBeenCalledWith(
+      'folder/subfolder/',
+      expect.any(Buffer),
+      'application/x-directory',
+      0
+    );
+  });
+
+  it('creates a plain text object for non-directory keys', async () => {
+    mockProvider.putObject.mockResolvedValue(undefined);
+
+    const res = await POST(mockEvent('bucket=b1&key=my-file.txt'));
+
+    expect(res.status).toBe(201);
+    expect(mockProvider.putObject).toHaveBeenCalledWith(
+      'my-file.txt',
+      expect.any(Buffer),
+      'text/plain',
+      0
+    );
+  });
+
+  it('returns 400 when key is missing', async () => {
+    await expect(POST(mockEvent('bucket=b1'))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('propagates provider errors as 502', async () => {
+    mockProvider.putObject.mockRejectedValue(new Error('S3 connection refused'));
+
+    await expect(POST(mockEvent('bucket=b1&key=fail.txt'))).rejects.toThrow(
+      expect.objectContaining({ status: 502 })
+    );
+  });
+});
diff --git a/src/routes/(app)/api/storage/delete/+server.ts b/src/routes/(app)/api/storage/delete/+server.ts
index 1a1aef4c..63677f65 100644
--- a/src/routes/(app)/api/storage/delete/+server.ts
+++ b/src/routes/(app)/api/storage/delete/+server.ts
@@ -1,30 +1,26 @@
-import type { RequestHandler } from './$types';
 import { error } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
+import type { RequestHandler } from './$types';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 
 /**
- * DELETE /api/storage/delete?bucket=<bucket>&keys=<key1>&keys=<key2>&...
- *
- * Deletes one or more S3 objects from the given bucket.
- * Authentication is enforced by the app-level auth guard in hooks.server.ts.
+ * DELETE /api/storage/delete?bucket=<bucket>&keys=<key1>&keys=<key2>
  *
- * The connection config is parsed and validated by the `handleStorageConnection`
- * middleware in hooks.server.ts before this handler runs.
+ * Deletes one or more objects from the storage bucket. Each key is passed as a
+ * repeated `keys` query parameter. Returns the deletion result including any
+ * failures.
  */
-export const DELETE: RequestHandler = async ({ locals, url }) => {
-  const bucket = requireBucket(url);
+export const DELETE: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const keys = event.url.searchParams.getAll('keys');
+  const log = event.locals.logger;
 
-  const keys = url.searchParams.getAll('keys');
-  if (!keys.length) {
-    throw error(400, 'Missing required query parameter: keys');
-  }
+  if (!keys.length) throw error(400, 'Missing required parameter: keys');
 
-  locals.logger.debug({ bucket, key_count: keys.length }, 'delete request received');
+  log.debug({ bucket, key_count: keys.length }, 'delete request received');
 
-  const result = await getProvider(locals.storageConfig!, bucket).deleteObjects(keys);
+  const result = await provider.deleteObjects(keys);
 
-  locals.logger.info(
+  log.info(
     { bucket, key_count: keys.length, failed_count: result.failed.length },
     'objects delete completed'
   );
diff --git a/src/routes/(app)/api/storage/delete/server.test.ts b/src/routes/(app)/api/storage/delete/server.test.ts
index 58bc8f46..bee71962 100644
--- a/src/routes/(app)/api/storage/delete/server.test.ts
+++ b/src/routes/(app)/api/storage/delete/server.test.ts
@@ -27,7 +27,7 @@ function mockEvent(searchParams: Record<string, string | string[]>) {
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
       user: { id: 'test-user' },
-      storageConfig: { type: 's3', region: 'us-east-1' }
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
     }
   } as unknown as Parameters<typeof DELETE>[0];
 }
diff --git a/src/routes/(app)/api/storage/details/+server.ts b/src/routes/(app)/api/storage/details/+server.ts
index edd8afc9..cc118667 100644
--- a/src/routes/(app)/api/storage/details/+server.ts
+++ b/src/routes/(app)/api/storage/details/+server.ts
@@ -1,14 +1,20 @@
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucketKey } from '../params.js';
+import { error } from '@sveltejs/kit';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 import type { FileDetails } from '$lib/storage/details-types.js';
 import type { RequestHandler } from './$types';
 
-export const GET: RequestHandler = async ({ url, locals }) => {
-  const { bucket, key } = requireBucketKey(url);
+/**
+ * GET /api/storage/details?bucket=<bucket>&key=<object-key>
+ *
+ * Returns the full metadata for a single storage object.
+ */
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const key = event.url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
 
-  locals.logger.debug({ bucket, key }, 'fetching object details');
+  event.locals.logger.debug({ bucket, key }, 'fetching object details');
 
-  const provider = getProvider(locals.storageConfig!, bucket);
   const meta = await provider.getMetadata(key);
 
   const details: FileDetails = {
diff --git a/src/routes/(app)/api/storage/details/server.test.ts b/src/routes/(app)/api/storage/details/server.test.ts
index 60cfdd81..33a00485 100644
--- a/src/routes/(app)/api/storage/details/server.test.ts
+++ b/src/routes/(app)/api/storage/details/server.test.ts
@@ -23,7 +23,7 @@ function mockEvent(searchParams: Record<string, string>) {
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
       user: { id: 'test-user' },
-      storageConfig: { type: 's3', region: 'us-east-1' }
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
     }
   } as unknown as Parameters<typeof GET>[0];
 }
diff --git a/src/routes/(app)/api/storage/directory-metadata/+server.ts b/src/routes/(app)/api/storage/directory-metadata/+server.ts
index 2480363d..53679984 100644
--- a/src/routes/(app)/api/storage/directory-metadata/+server.ts
+++ b/src/routes/(app)/api/storage/directory-metadata/+server.ts
@@ -1,20 +1,20 @@
 import { error } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 import type { DirectoryMetadata } from '$lib/storage/details-types.js';
 import type { RequestHandler } from './$types';
 
-export const GET: RequestHandler = async ({ url, locals }) => {
-  const bucket = requireBucket(url);
-  const prefix = url.searchParams.get('prefix')?.trim();
+/**
+ * GET /api/storage/directory-metadata?bucket=<bucket>&prefix=<prefix>
+ *
+ * Returns metadata for a directory, including the bucket ACL and, if present,
+ * the directory marker object's metadata.
+ */
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const prefix = event.url.searchParams.get('prefix')?.trim();
+  if (!prefix) throw error(400, 'Missing required query parameter: prefix');
 
-  if (!prefix) {
-    throw error(400, 'Missing required query parameter: prefix');
-  }
-
-  locals.logger.debug({ bucket, prefix }, 'fetching directory metadata');
-
-  const provider = getProvider(locals.storageConfig!, bucket);
+  event.locals.logger.debug({ bucket, prefix }, 'fetching directory metadata');
 
   const acl = await provider.getBucketAcl();
   const result: DirectoryMetadata = {
@@ -38,7 +38,5 @@ export const GET: RequestHandler = async ({ url, locals }) => {
     // No directory marker object — that's fine
   }
 
-  return new Response(JSON.stringify(result), {
-    headers: { 'Content-Type': 'application/json' }
-  });
+  return Response.json(result);
 };
diff --git a/src/routes/(app)/api/storage/directory-metadata/server.test.ts b/src/routes/(app)/api/storage/directory-metadata/server.test.ts
index b7ee6ea9..c01369ed 100644
--- a/src/routes/(app)/api/storage/directory-metadata/server.test.ts
+++ b/src/routes/(app)/api/storage/directory-metadata/server.test.ts
@@ -27,7 +27,7 @@ function mockEvent(searchParams: Record<string, string>) {
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
       user: { id: 'test-user' },
-      storageConfig: { type: 's3', region: 'us-east-1' }
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
     }
   } as unknown as Parameters<typeof GET>[0];
 }
diff --git a/src/routes/(app)/api/storage/directory-size/+server.ts b/src/routes/(app)/api/storage/directory-size/+server.ts
index 6da04de1..f362e98b 100644
--- a/src/routes/(app)/api/storage/directory-size/+server.ts
+++ b/src/routes/(app)/api/storage/directory-size/+server.ts
@@ -1,125 +1,17 @@
 import { error } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
-import type {
-  DirectorySizeEvent,
-  DirectoryChildItem,
-  TreemapNode
-} from '$lib/storage/details-types.js';
+import type { DirectorySizeEvent } from '$lib/storage/details-types.js';
+import { buildTree, buildChildrenByDepth } from '$lib/server/storage/directory-tree.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 import type { RequestHandler } from './$types';
 
-function buildTree(prefix: string, keys: Array<{ key: string; size: number }>): TreemapNode {
-  const rootName = prefix.split('/').filter(Boolean).pop() || '(root)';
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const prefix = event.url.searchParams.get('prefix')?.trim();
 
-  interface TrieNode {
-    name: string;
-    size: number;
-    children: Map<string, TrieNode>;
-  }
+  if (!prefix) throw error(400, 'Missing required query parameter: prefix');
 
-  const rootTrie: TrieNode = { name: rootName, size: 0, children: new Map() };
+  event.locals.logger.debug({ bucket, prefix }, 'calculating directory size');
 
-  for (const { key, size } of keys) {
-    const relative = key.slice(prefix.length);
-    const parts = relative.split('/').filter(Boolean);
-    if (parts.length === 0) continue;
-
-    rootTrie.size += size;
-    let current = rootTrie;
-    for (let i = 0; i < parts.length; i++) {
-      const part = parts[i];
-      if (!current.children.has(part)) {
-        current.children.set(part, { name: part, size: 0, children: new Map() });
-      }
-      current = current.children.get(part)!;
-      current.size += size;
-    }
-  }
-
-  function trieToTreemap(node: TrieNode): TreemapNode {
-    function convert(n: TrieNode, parentPrefix: string, isRoot: boolean): TreemapNode {
-      const result: TreemapNode = {
-        name: n.name,
-        size: n.size
-      };
-      if (n.children.size > 0) {
-        result.children = [...n.children.entries()]
-          .map(([, v]) => convert(v, isRoot ? '' : parentPrefix + n.name + '/', false))
-          .sort((a, b) => b.size - a.size);
-      } else {
-        result.path = parentPrefix || undefined;
-        result.fullKey = prefix + (parentPrefix || '') + n.name;
-      }
-      return result;
-    }
-    return convert(node, '', true);
-  }
-
-  return trieToTreemap(rootTrie);
-}
-
-function buildChildrenByDepth(
-  prefix: string,
-  keys: Array<{ key: string; size: number; lastModified?: Date }>,
-  maxDepth: number
-): Record<number, DirectoryChildItem[]> {
-  const depthMaps: Map<string, { size: number; lastModified: Date | undefined }>[] = [];
-  for (let d = 1; d <= maxDepth; d++) {
-    depthMaps.push(new Map());
-  }
-
-  for (const { key, size, lastModified } of keys) {
-    const relative = key.slice(prefix.length);
-    const parts = relative.split('/').filter(Boolean);
-    if (parts.length === 0) continue;
-
-    for (let d = 1; d <= maxDepth; d++) {
-      if (parts.length < d) continue;
-
-      const nameParts = parts.slice(0, d);
-      const index = d - 1;
-      const isDir = index < parts.length - 1 || relative.endsWith('/');
-      const childName = isDir ? nameParts.join('/') + '/' : nameParts.join('/');
-
-      const map = depthMaps[d - 1];
-      const existing = map.get(childName);
-      if (existing) {
-        existing.size += size;
-        if (lastModified && (!existing.lastModified || lastModified > existing.lastModified)) {
-          existing.lastModified = lastModified;
-        }
-      } else {
-        map.set(childName, { size, lastModified });
-      }
-    }
-  }
-
-  const result: Record<number, DirectoryChildItem[]> = {};
-  for (let d = 1; d <= maxDepth; d++) {
-    result[d] = [...depthMaps[d - 1].entries()]
-      .map(([name, entry]) => ({
-        name,
-        size: entry.size,
-        lastModified: entry.lastModified?.toISOString(),
-        isDirectory: name.endsWith('/')
-      }))
-      .sort((a, b) => b.size - a.size);
-  }
-
-  return result;
-}
-
-export const GET: RequestHandler = async ({ url, locals }) => {
-  const bucket = requireBucket(url);
-  const prefix = url.searchParams.get('prefix') ?? '';
-
-  if (!prefix) {
-    throw error(400, 'Missing required query parameter: prefix');
-  }
-
-  locals.logger.debug({ bucket, prefix }, 'calculating directory size');
-
-  const provider = getProvider(locals.storageConfig!, bucket);
   const allKeys: Array<{ key: string; size: number; lastModified?: Date }> = [];
   const startTime = Date.now();
   const encoder = new TextEncoder();
@@ -154,11 +46,8 @@ export const GET: RequestHandler = async ({ url, locals }) => {
         let totalFiles = 0;
         let totalDirectories = 0;
         for (const { key } of allKeys) {
-          if (key.endsWith('/')) {
-            totalDirectories++;
-          } else {
-            totalFiles++;
-          }
+          if (key.endsWith('/')) totalDirectories++;
+          else totalFiles++;
         }
 
         const result: DirectorySizeEvent = {
diff --git a/src/routes/(app)/api/storage/download/+server.ts b/src/routes/(app)/api/storage/download/+server.ts
index 41e1b2e8..7fc6f0f0 100644
--- a/src/routes/(app)/api/storage/download/+server.ts
+++ b/src/routes/(app)/api/storage/download/+server.ts
@@ -1,7 +1,6 @@
 import type { RequestHandler } from './$types';
 import { error } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucketKey } from '../params.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 
 /** Derive the bare filename from a (possibly path-prefixed) object key. */
 function filenameFromKey(key: string): string {
@@ -20,18 +19,15 @@ function filenameFromKey(key: string): string {
  * by the handleStorageConnection middleware using the x-storage-connection-id
  * header and a database lookup.
  */
-export const GET: RequestHandler = async ({ locals, request, url }) => {
-  const { bucket, key } = requireBucketKey(url);
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const key = event.url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
+  const { locals, request } = event;
 
   locals.logger.debug({ bucket, key }, 'download request received');
 
-  const config = locals.storageConfig;
-
-  if (!config) {
-    throw error(401, 'No storage connection configured');
-  }
-
-  const download = await getProvider(config, bucket).getObject(key);
+  const download = await provider.getObject(key);
 
   // When the client cancels the download (closes the connection), abort the S3
   // stream proactively so the backend stops fetching data from S3.
@@ -84,12 +80,14 @@ export const GET: RequestHandler = async ({ locals, request, url }) => {
  * The connection config is parsed and validated by the `handleStorageConnection`
  * middleware in hooks.server.ts before this handler runs.
  */
-export const HEAD: RequestHandler = async ({ locals, url }) => {
-  const { bucket, key } = requireBucketKey(url);
+export const HEAD: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const key = event.url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
 
-  locals.logger.debug({ bucket, key }, 'download pre-flight check');
+  event.locals.logger.debug({ bucket, key }, 'download pre-flight check');
 
-  const meta = await getProvider(locals.storageConfig!, bucket).getMetadata(key);
+  const meta = await provider.getMetadata(key);
 
   return new Response(null, {
     status: 200,
diff --git a/src/routes/(app)/api/storage/download/server.test.ts b/src/routes/(app)/api/storage/download/server.test.ts
index 2098e0dd..d5b0bd74 100644
--- a/src/routes/(app)/api/storage/download/server.test.ts
+++ b/src/routes/(app)/api/storage/download/server.test.ts
@@ -19,7 +19,7 @@ function mockEvent(params: string) {
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
       user: { id: 'test-user' },
-      storageConfig: { type: 's3', region: 'us-east-1' }
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
     }
   } as unknown as Parameters<typeof GET>[0];
 }
diff --git a/src/routes/(app)/api/storage/list/+server.ts b/src/routes/(app)/api/storage/list/+server.ts
new file mode 100644
index 00000000..0250d6a7
--- /dev/null
+++ b/src/routes/(app)/api/storage/list/+server.ts
@@ -0,0 +1,31 @@
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
+import type { RequestHandler } from './$types';
+
+/**
+ * GET /api/storage/list?bucket=<bucket>&prefix=<prefix>&pageSize=<n>&continuationToken=<token>
+ *
+ * Lists objects in a bucket with cursor-based pagination. Returns the S3
+ * list objects response directly.
+ */
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const prefix = event.url.searchParams.get('prefix')?.trim() ?? undefined;
+  const rawPageSize = event.url.searchParams.get('pageSize');
+  const pageSize = rawPageSize ? parseInt(rawPageSize, 10) : 25;
+  const continuationToken = event.url.searchParams.get('continuationToken') || undefined;
+  const log = event.locals.logger;
+
+  log.debug(
+    {
+      bucket,
+      prefix: prefix ?? '',
+      continuation_token: continuationToken,
+      page_size: pageSize
+    },
+    'listing objects'
+  );
+
+  const page = await provider.listObjects(prefix ?? '', pageSize, continuationToken);
+
+  return Response.json(page);
+};
diff --git a/src/routes/(app)/api/storage/list/server.test.ts b/src/routes/(app)/api/storage/list/server.test.ts
new file mode 100644
index 00000000..15ccff46
--- /dev/null
+++ b/src/routes/(app)/api/storage/list/server.test.ts
@@ -0,0 +1,82 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockProvider = { listObjects: vi.fn() };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+import { GET } from './+server.js';
+
+function mockEvent(params: string) {
+  const url = new URL(`http://localhost/api/storage/list?${params}`);
+  return {
+    url,
+    request: { headers: new Headers() },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
+    }
+  } as unknown as Parameters<typeof GET>[0];
+}
+
+describe('GET /api/storage/list', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('returns paginated object listing', async () => {
+    const lastModified = new Date('2024-06-15T12:00:00Z');
+    const page = {
+      contents: [{ key: 'a.txt', size: 10, lastModified }],
+      continuationToken: 'next-page',
+      isTruncated: true
+    };
+    mockProvider.listObjects.mockResolvedValue(page);
+
+    const res = await GET(mockEvent('bucket=b1'));
+    const body = await res.json();
+
+    expect(res.status).toBe(200);
+    expect(body.contents).toHaveLength(1);
+    expect(body.contents[0].key).toBe('a.txt');
+    expect(body.continuationToken).toBe('next-page');
+    expect(body.isTruncated).toBe(true);
+    expect(mockProvider.listObjects).toHaveBeenCalledWith('', 25, undefined);
+  });
+
+  it('passes prefix and pageSize to provider', async () => {
+    mockProvider.listObjects.mockResolvedValue({
+      contents: [],
+      continuationToken: null,
+      isTruncated: false
+    });
+
+    await GET(mockEvent('bucket=b1&prefix=data/&pageSize=10'));
+
+    expect(mockProvider.listObjects).toHaveBeenCalledWith('data/', 10, undefined);
+  });
+
+  it('passes continuationToken to provider', async () => {
+    mockProvider.listObjects.mockResolvedValue({
+      contents: [],
+      continuationToken: null,
+      isTruncated: false
+    });
+
+    await GET(mockEvent('bucket=b1&continuationToken=abc123'));
+
+    expect(mockProvider.listObjects).toHaveBeenCalledWith('', 25, 'abc123');
+  });
+
+  it('throws when bucket is missing', async () => {
+    const url = new URL('http://localhost/api/storage/list');
+    const event = {
+      url,
+      request: { headers: new Headers() },
+      locals: {
+        logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+        storageConfig: { type: 's3', region: { name: 'us-east-1' } }
+      }
+    } as unknown as Parameters<typeof GET>[0];
+
+    await expect(GET(event)).rejects.toThrow();
+  });
+});
diff --git a/src/routes/(app)/api/storage/move/+server.ts b/src/routes/(app)/api/storage/move/+server.ts
index 4ace6d11..dd88d08a 100644
--- a/src/routes/(app)/api/storage/move/+server.ts
+++ b/src/routes/(app)/api/storage/move/+server.ts
@@ -1,14 +1,12 @@
 import type { RequestHandler } from './$types';
-import { error, json } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
-import { computeDestinations, uniqueDestKey } from '$lib/server/storage/operations.js';
-import { createProgressStream } from '$lib/server/storage/streaming.js';
-import { createJob } from '$lib/server/storage/job-store.js';
+import { error } from '@sveltejs/kit';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
+import { performCopyOrMove } from '$lib/server/storage/copy-move.js';
 
-export const POST: RequestHandler = async ({ locals, request, url }) => {
-  const bucket = requireBucket(url);
-  const streamProgress = url.searchParams.get('progress') === 'true';
+export const POST: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const streamProgress = event.url.searchParams.get('progress') === 'true';
+  const { locals, request } = event;
 
   const body = (await request.json()) as {
     sourceKeys: string[];
@@ -32,127 +30,14 @@ export const POST: RequestHandler = async ({ locals, request, url }) => {
     'move request received'
   );
 
-  const provider = getProvider(locals.storageConfig!, bucket);
-
-  if (!streamProgress) {
-    const destinations = await computeDestinations(
-      provider,
-      body.sourceKeys,
-      body.destinationPrefix
-    );
-    const moved: Array<{ sourceKey: string; destKey: string }> = [];
-    const failed: Array<{ sourceKey: string; error: string }> = [];
-
-    for (const { sourceKey, baseDestKey } of destinations) {
-      try {
-        const destKey = await uniqueDestKey(provider, baseDestKey);
-        await provider.copyObject(sourceKey, destKey);
-        moved.push({ sourceKey, destKey });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : 'Unknown error';
-        failed.push({ sourceKey, error: message });
-        locals.logger.warn(
-          { bucket, source_key: sourceKey, dest_key: baseDestKey, error: message },
-          'move copy failed for key'
-        );
-      }
-    }
-
-    const keysToDelete = [...new Set(moved.map((m) => m.sourceKey))];
-    if (keysToDelete.length > 0) {
-      const deleteResult = await provider.deleteObjects(keysToDelete);
-      for (const f of deleteResult.failed) {
-        failed.push({ sourceKey: f.key, error: f.message ?? 'Delete failed' });
-        locals.logger.warn({ bucket, key: f.key }, 'move delete failed for key');
-      }
-    }
-
-    locals.logger.info({ bucket, moved: moved.length, failed: failed.length }, 'move completed');
-    return json({ moved, failed });
-  }
-
-  if (body.jobId) {
-    createJob(body.jobId);
-  }
-
-  return createProgressStream(
-    (emit) => {
-      const run = async () => {
-        const destinations = await computeDestinations(
-          provider,
-          body.sourceKeys,
-          body.destinationPrefix
-        );
-        const moved: Array<{ sourceKey: string; destKey: string }> = [];
-        const failed: Array<{ sourceKey: string; error: string }> = [];
-
-        for (const { sourceKey, baseDestKey } of destinations) {
-          try {
-            const destKey = await uniqueDestKey(provider, baseDestKey);
-            let reportedAnyProgress = false;
-            await provider.copyObject(sourceKey, destKey, (loaded, total) => {
-              reportedAnyProgress = true;
-              emit({ type: 'progress', sourceKey, destKey, loaded, total });
-            });
-
-            if (!reportedAnyProgress) {
-              try {
-                const meta = await provider.getMetadata(sourceKey);
-                emit({
-                  type: 'progress',
-                  sourceKey,
-                  destKey,
-                  loaded: meta.size,
-                  total: meta.size
-                });
-              } catch {
-                // Metadata fetch failed
-              }
-            }
-
-            moved.push({ sourceKey, destKey });
-            emit({ type: 'done', sourceKey, destKey });
-          } catch (err) {
-            const message = err instanceof Error ? err.message : 'Unknown error';
-            failed.push({ sourceKey, error: message });
-            locals.logger.warn(
-              { bucket, source_key: sourceKey, dest_key: baseDestKey, error: message },
-              'move copy failed for key'
-            );
-            emit({ type: 'failed', sourceKey, error: message });
-          }
-        }
-
-        const keysToDelete = [...new Set(moved.map((m) => m.sourceKey))];
-        if (keysToDelete.length > 0) {
-          emit({ type: 'status', message: `Deleting ${keysToDelete.length} original(s)` });
-          const deleteResult = await provider.deleteObjects(keysToDelete);
-          for (const f of deleteResult.failed) {
-            failed.push({ sourceKey: f.key, error: f.message ?? 'Delete failed' });
-            locals.logger.warn({ bucket, key: f.key }, 'move delete failed for key');
-          }
-        }
-
-        locals.logger.info(
-          { bucket, moved: moved.length, failed: failed.length },
-          'move completed'
-        );
-
-        return { results: moved, failed };
-      };
-
-      return run();
-    },
-    {
-      jobId: body.jobId,
-      operationName: 'move',
-      logger: locals.logger,
-      bucket,
-      buildCompletePayload: (result) => ({
-        type: 'complete',
-        moved: result.results,
-        failed: result.failed
-      })
-    }
-  );
+  return performCopyOrMove({
+    provider,
+    sourceKeys: body.sourceKeys,
+    destinationPrefix: body.destinationPrefix,
+    streamProgress,
+    logger: locals.logger,
+    bucket,
+    jobId: body.jobId,
+    deleteOriginals: true
+  });
 };
diff --git a/src/routes/(app)/api/storage/objects/+server.ts b/src/routes/(app)/api/storage/objects/+server.ts
deleted file mode 100644
index 60fa7820..00000000
--- a/src/routes/(app)/api/storage/objects/+server.ts
+++ /dev/null
@@ -1,35 +0,0 @@
-import { error } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { allowedPageSizes } from '$lib/client/feature-flags.js';
-import type { RequestHandler } from './$types';
-
-/**
- * GET /api/storage/objects?bucket=<bucket>&prefix=<prefix>&pageSize=<n>&continuationToken=<token>
- *
- * Returns a page of objects in the given bucket/prefix using the connection
- * config supplied in the `X-Storage-Connection` request header.
- * The config is parsed and validated by the `handleStorageConnection` middleware
- * in hooks.server.ts before this handler runs.
- */
-export const GET: RequestHandler = async ({ url, locals }) => {
-  const bucket = url.searchParams.get('bucket')?.trim();
-  if (!bucket) throw error(400, 'Missing required query parameter: bucket');
-
-  const prefix = url.searchParams.get('prefix') ?? '';
-  const continuationToken = url.searchParams.get('continuationToken');
-  const pageSizeParam = url.searchParams.get('pageSize');
-  const parsed = pageSizeParam ? parseInt(pageSizeParam, 10) : NaN;
-  const pageSize = allowedPageSizes.includes(parsed) ? parsed : allowedPageSizes[0];
-
-  locals.logger.debug(
-    { bucket, prefix, continuation_token: continuationToken, page_size: pageSize },
-    'listing objects'
-  );
-
-  const page = await getProvider(locals.storageConfig!, bucket).listObjects(
-    prefix,
-    pageSize,
-    continuationToken ?? undefined
-  );
-  return Response.json(page);
-};
diff --git a/src/routes/(app)/api/storage/params.test.ts b/src/routes/(app)/api/storage/params.test.ts
deleted file mode 100644
index bb045aac..00000000
--- a/src/routes/(app)/api/storage/params.test.ts
+++ /dev/null
@@ -1,48 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { requireBucket, requireBucketKey } from './params.js';
-
-describe('requireBucket', () => {
-  it('throws 400 when bucket param is missing', () => {
-    const url = new URL('http://localhost/api/storage/test');
-    expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
-  });
-
-  it('throws 400 when bucket param is empty', () => {
-    const url = new URL('http://localhost/api/storage/test?bucket=');
-    expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
-  });
-
-  it('throws 400 when bucket param is whitespace only', () => {
-    const url = new URL('http://localhost/api/storage/test?bucket=%20%20');
-    expect(() => requireBucket(url)).toThrow(expect.objectContaining({ status: 400 }));
-  });
-
-  it('returns trimmed bucket name', () => {
-    const url = new URL('http://localhost/api/storage/test?bucket=%20my-bucket%20');
-    expect(requireBucket(url)).toBe('my-bucket');
-  });
-});
-
-describe('requireBucketKey', () => {
-  it('throws 400 when bucket is missing', () => {
-    const url = new URL('http://localhost/api/storage/test?key=file.txt');
-    expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
-  });
-
-  it('throws 400 when key is missing', () => {
-    const url = new URL('http://localhost/api/storage/test?bucket=my-bucket');
-    expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
-  });
-
-  it('throws 400 when key is empty', () => {
-    const url = new URL('http://localhost/api/storage/test?bucket=my-bucket&key=');
-    expect(() => requireBucketKey(url)).toThrow(expect.objectContaining({ status: 400 }));
-  });
-
-  it('returns both bucket and key trimmed', () => {
-    const url = new URL(
-      'http://localhost/api/storage/test?bucket=%20b1%20&key=%20path/file.txt%20'
-    );
-    expect(requireBucketKey(url)).toEqual({ bucket: 'b1', key: 'path/file.txt' });
-  });
-});
diff --git a/src/routes/(app)/api/storage/params.ts b/src/routes/(app)/api/storage/params.ts
deleted file mode 100644
index 3d6cbd53..00000000
--- a/src/routes/(app)/api/storage/params.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { error } from '@sveltejs/kit';
-
-/**
- * Extracts and validates the `bucket` query parameter from a storage API
- * request URL. Throws a 400 error if absent or blank.
- */
-export function requireBucket(url: URL): string {
-  const bucket = url.searchParams.get('bucket')?.trim();
-  if (!bucket) {
-    throw error(400, 'Missing required query parameter: bucket');
-  }
-  return bucket;
-}
-
-/**
- * Extracts and validates the `bucket` and `key` query parameters from a
- * storage API request URL. Throws a 400 error if either is absent or blank.
- */
-export function requireBucketKey(url: URL): { bucket: string; key: string } {
-  const bucket = requireBucket(url);
-
-  const key = url.searchParams.get('key')?.trim();
-  if (!key) {
-    throw error(400, 'Missing required query parameter: key');
-  }
-
-  return { bucket, key };
-}
diff --git a/src/routes/(app)/api/storage/preview/+server.ts b/src/routes/(app)/api/storage/preview/+server.ts
index 6d5b0084..7bcdcfd5 100644
--- a/src/routes/(app)/api/storage/preview/+server.ts
+++ b/src/routes/(app)/api/storage/preview/+server.ts
@@ -1,11 +1,11 @@
+import { error } from '@sveltejs/kit';
 import { S3ServiceException } from '@aws-sdk/client-s3';
 import { mapS3ErrorToHttp } from '$lib/server/storage/s3-errors.js';
-import { getProvider } from '$lib/server/storage/utils.js';
 import { getParquetPreview } from '$lib/server/storage/preview/parquet';
 import { getCsvPreview } from '$lib/server/storage/preview/csv';
 import { binaryPreview, KNOWN_BINARY_TYPES } from '$lib/server/storage/preview/binary.js';
 import { streamPreview } from '$lib/server/storage/preview/stream.js';
-import { requireBucketKey } from '../params.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 import { infiniteScrollEnabled, filePreviewRows } from '$lib/server/feature-flags';
 import type { RequestHandler } from './$types';
 
@@ -15,11 +15,12 @@ import type { RequestHandler } from './$types';
  * The connection config is parsed and validated by the `handleStorageConnection`
  * middleware in hooks.server.ts before this handler runs.
  */
-export const GET: RequestHandler = async ({ url, locals }) => {
+export const GET: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const key = event.url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
+  const { url, locals } = event;
   const log = locals.logger;
-  const { bucket, key } = requireBucketKey(url);
-
-  const provider = getProvider(locals.storageConfig!, bucket);
 
   try {
     const metadata = await provider.getMetadata(key);
diff --git a/src/routes/(app)/api/storage/preview/server.test.ts b/src/routes/(app)/api/storage/preview/server.test.ts
index 4a785ef9..015d1d0b 100644
--- a/src/routes/(app)/api/storage/preview/server.test.ts
+++ b/src/routes/(app)/api/storage/preview/server.test.ts
@@ -6,6 +6,10 @@ vi.mock('$lib/server/storage/utils.js', () => ({
   getProvider: vi.fn(() => ({ getMetadata: mockGetMetadata }))
 }));
 
+vi.mock('$lib/server/storage/wrap-provider.js', () => ({
+  wrapProvider: (p: unknown) => p
+}));
+
 vi.mock('$lib/server/storage/preview/binary.js', () => ({
   KNOWN_BINARY_TYPES: new Set(['application/zip']),
   binaryPreview: vi.fn(() => new Response(null, { headers: { 'X-Preview-Renderable': 'false' } }))
@@ -72,7 +76,7 @@ function mockEvent(params: string) {
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
       user: { id: 'test-user' },
-      storageConfig: { type: 's3', region: 'us-east-1' }
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
     }
   } as unknown as Parameters<typeof GET>[0];
 }
diff --git a/src/routes/(app)/api/storage/rename/+server.ts b/src/routes/(app)/api/storage/rename/+server.ts
index d7de6d75..ccdd2725 100644
--- a/src/routes/(app)/api/storage/rename/+server.ts
+++ b/src/routes/(app)/api/storage/rename/+server.ts
@@ -1,78 +1,76 @@
-import type { RequestHandler } from './$types';
 import { error, json } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucket } from '../params.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
+import type { RequestHandler } from './$types';
 
-export const POST: RequestHandler = async ({ locals, request, url }) => {
-  const bucket = requireBucket(url);
+/**
+ * POST /api/storage/rename?bucket=<bucket>
+ *
+ * Renames (moves) a storage object from `key` to `newKey`.
+ * The request body must be JSON: `{ key: string, newKey: string }`.
+ * Directory renames copy the marker and all children, then delete the originals.
+ *
+ * The connection config is parsed and validated by the `handleStorageConnection`
+ * middleware in hooks.server.ts before this handler runs.
+ */
+export const POST: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const log = event.locals.logger;
 
-  const body = (await request.json()) as { key: string; newKey: string };
-  if (!body.key) {
-    throw error(400, 'Missing required body field: key');
-  }
-  if (!body.newKey) {
-    throw error(400, 'Missing required body field: newKey');
-  }
+  const body = (await event.request.json()) as { key?: string; newKey?: string };
 
-  locals.logger.debug(
-    { bucket, source_key: body.key, dest_key: body.newKey },
-    'rename request received'
-  );
+  if (!body.key) throw error(400, 'Missing required body field: key');
+  if (!body.newKey) throw error(400, 'Missing required body field: newKey');
 
-  const provider = getProvider(locals.storageConfig!, bucket);
+  const key = body.key;
+  const newKey = body.newKey;
 
-  // Conflict check: reject if destination already exists
-  const exists = await provider.exists(body.newKey);
-  if (exists) {
-    throw error(409, `Destination "${body.newKey}" already exists`);
-  }
+  log.debug({ bucket, source_key: key, dest_key: newKey }, 'rename request received');
 
-  // If renaming a directory (key ends with /), we need to rename all children
-  if (body.key.endsWith('/')) {
-    const children = await provider.listAllKeys(body.key);
-    // Rename the directory marker itself
+  const exists = await provider.exists(newKey);
+  if (exists) throw error(409, `Destination "${newKey}" already exists`);
+
+  if (key.endsWith('/')) {
+    const children = await provider.listAllKeys(key);
     try {
-      await provider.copyObject(body.key, body.newKey);
+      await provider.copyObject(key, newKey);
     } catch (err) {
-      const message = err instanceof Error ? err.message : 'Unknown error';
-      throw error(502, `Rename failed for directory marker: ${message}`);
+      throw error(
+        502,
+        `Rename failed for directory marker: ${err instanceof Error ? err.message : 'Unknown error'}`
+      );
     }
-    // Rename each child
     for (const child of children) {
-      const destChild = body.newKey + child.slice(body.key.length);
+      const destChild = newKey + child.slice(key.length);
       try {
         await provider.copyObject(child, destChild);
       } catch (err) {
-        const message = err instanceof Error ? err.message : 'Unknown error';
-        throw error(502, `Rename failed for child "${child}": ${message}`);
+        throw error(
+          502,
+          `Rename failed for child "${child}": ${err instanceof Error ? err.message : 'Unknown error'}`
+        );
       }
     }
-    // Delete old paths
-    const allOld = [body.key, ...children];
-    const deleteResult = await provider.deleteObjects(allOld);
+    const deleteResult = await provider.deleteObjects([key, ...children]);
     if (deleteResult.failed.length > 0) {
-      locals.logger.warn(
-        { bucket, failed_count: deleteResult.failed.length },
-        'rename delete had failures'
-      );
+      log.warn({ bucket, failed_count: deleteResult.failed.length }, 'rename delete had failures');
     }
   } else {
-    // Single file rename: copy + delete
     try {
-      await provider.copyObject(body.key, body.newKey);
+      await provider.copyObject(key, newKey);
     } catch (err) {
-      const message = err instanceof Error ? err.message : 'Unknown error';
-      throw error(502, `Rename failed: ${message}`);
+      throw error(502, `Rename failed: ${err instanceof Error ? err.message : 'Unknown error'}`);
     }
     try {
-      await provider.deleteObjects([body.key]);
+      await provider.deleteObjects([key]);
     } catch (err) {
-      const message = err instanceof Error ? err.message : 'Unknown error';
-      throw error(502, `Rename delete failed: ${message}`);
+      throw error(
+        502,
+        `Rename delete failed: ${err instanceof Error ? err.message : 'Unknown error'}`
+      );
     }
   }
 
-  locals.logger.info({ bucket, source_key: body.key, dest_key: body.newKey }, 'rename completed');
+  log.info({ bucket, source_key: key, dest_key: newKey }, 'rename completed');
 
   return json({ success: true });
 };
diff --git a/src/routes/(app)/api/storage/rename/server.test.ts b/src/routes/(app)/api/storage/rename/server.test.ts
new file mode 100644
index 00000000..573d5517
--- /dev/null
+++ b/src/routes/(app)/api/storage/rename/server.test.ts
@@ -0,0 +1,105 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockProvider = {
+  exists: vi.fn(),
+  copyObject: vi.fn(),
+  deleteObjects: vi.fn(),
+  listAllKeys: vi.fn()
+};
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+import { POST } from './+server.js';
+
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
+function mockEvent(body: Record<string, string>) {
+  const url = new URL('http://localhost/api/storage/rename?bucket=b1');
+  return {
+    url,
+    request: {
+      headers: new Headers(CONNECTION_HEADER),
+      json: () => Promise.resolve(body)
+    },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
+    }
+  } as unknown as Parameters<typeof POST>[0];
+}
+
+describe('POST /api/storage/rename', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('renames a single file via copy and delete', async () => {
+    mockProvider.exists.mockResolvedValue(false);
+    mockProvider.copyObject.mockResolvedValue(undefined);
+    mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
+
+    const res = await POST(mockEvent({ key: 'old.txt', newKey: 'new.txt' }));
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body).toEqual({ success: true });
+    expect(mockProvider.copyObject).toHaveBeenCalledWith('old.txt', 'new.txt');
+    expect(mockProvider.deleteObjects).toHaveBeenCalledWith(['old.txt']);
+  });
+
+  it('renames a directory and all children', async () => {
+    mockProvider.exists.mockResolvedValue(false);
+    mockProvider.listAllKeys.mockResolvedValue(['dir/a.txt', 'dir/b.txt']);
+    mockProvider.copyObject.mockResolvedValue(undefined);
+    mockProvider.deleteObjects.mockResolvedValue({ failed: [] });
+
+    const res = await POST(mockEvent({ key: 'dir/', newKey: 'renamed/' }));
+
+    expect(res.status).toBe(200);
+    expect(mockProvider.copyObject).toHaveBeenCalledTimes(3);
+    expect(mockProvider.copyObject).toHaveBeenCalledWith('dir/', 'renamed/');
+    expect(mockProvider.copyObject).toHaveBeenCalledWith('dir/a.txt', 'renamed/a.txt');
+    expect(mockProvider.copyObject).toHaveBeenCalledWith('dir/b.txt', 'renamed/b.txt');
+    expect(mockProvider.deleteObjects).toHaveBeenCalledWith(['dir/', 'dir/a.txt', 'dir/b.txt']);
+  });
+
+  it('returns 400 when key is missing from body', async () => {
+    await expect(POST(mockEvent({ newKey: 'new.txt' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns 400 when newKey is missing from body', async () => {
+    await expect(POST(mockEvent({ key: 'old.txt' }))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns 409 when destination already exists', async () => {
+    mockProvider.exists.mockResolvedValue(true);
+
+    await expect(POST(mockEvent({ key: 'old.txt', newKey: 'existing.txt' }))).rejects.toThrow(
+      expect.objectContaining({ status: 409 })
+    );
+  });
+
+  it('returns 502 when copy fails', async () => {
+    mockProvider.exists.mockResolvedValue(false);
+    mockProvider.copyObject.mockRejectedValue(new Error('Access denied'));
+
+    await expect(POST(mockEvent({ key: 'old.txt', newKey: 'new.txt' }))).rejects.toThrow();
+  });
+
+  it('warns when directory delete has failures', async () => {
+    mockProvider.exists.mockResolvedValue(false);
+    mockProvider.listAllKeys.mockResolvedValue(['dir/a.txt']);
+    mockProvider.copyObject.mockResolvedValue(undefined);
+    mockProvider.deleteObjects.mockResolvedValue({ failed: ['dir/a.txt'] });
+
+    const res = await POST(mockEvent({ key: 'dir/', newKey: 'new-dir/' }));
+
+    expect(res.status).toBe(200);
+  });
+});
diff --git a/src/routes/(app)/api/storage/save-text/+server.ts b/src/routes/(app)/api/storage/save-text/+server.ts
index c92cbb3a..39ce43a0 100644
--- a/src/routes/(app)/api/storage/save-text/+server.ts
+++ b/src/routes/(app)/api/storage/save-text/+server.ts
@@ -1,46 +1,48 @@
 import { error } from '@sveltejs/kit';
-import { uploadObject } from '$lib/server/storage/service.js';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucketKey } from '../params.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 import { maxEditableFileSize } from '$lib/server/feature-flags.js';
-import type { RequestHandler } from '@sveltejs/kit';
+import type { RequestHandler } from './$types';
 
 /**
- * POST /api/storage/save-text?bucket=<bucket>&key=<key>&contentType=<type>&originalSize=<number>&previewBytes=<number>
+ * POST /api/storage/save-text?bucket=<bucket>&key=<object-key>&originalSize=<n>&previewBytes=<n>&contentType=<type>
  *
- * Saves edited text content back to S3. When the original file was truncated
- * during preview (previewBytes < originalSize), the endpoint fetches the
- * unseen tail of the original file, concatenates it with the edited text, and
- * uploads the combined result. This preserves the portion of the file that
- * was not visible in the editor.
+ * Saves edited text content for a storage object. The request body is the raw
+ * text to save. When `previewBytes < originalSize`, the tail of the original
+ * file is fetched and merged with the edited portion so only the beginning of
+ * the file was transmitted to the client for editing.
  *
  * The connection config is parsed and validated by the `handleStorageConnection`
  * middleware in hooks.server.ts before this handler runs.
  */
-export const POST: RequestHandler = async ({ locals, url, request }) => {
-  const log = locals.logger;
-  const { bucket, key } = requireBucketKey(url);
+export const POST: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const key = event.url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
+  const log = event.locals.logger;
+
+  const contentType = event.url.searchParams.get('contentType')?.trim() || 'text/plain';
+  const rawOriginalSize = event.url.searchParams.get('originalSize');
+  const rawPreviewBytes = event.url.searchParams.get('previewBytes');
+  const originalSize = rawOriginalSize ? parseInt(rawOriginalSize, 10) : NaN;
+  const previewBytes = rawPreviewBytes ? parseInt(rawPreviewBytes, 10) : originalSize;
 
-  const contentType = url.searchParams.get('contentType')?.trim() || 'text/plain';
-  const rawOriginalSize = url.searchParams.get('originalSize');
-  const rawPreviewBytes = url.searchParams.get('previewBytes');
-
-  const originalSize = parseInt(rawOriginalSize ?? '0', 10);
   if (!Number.isFinite(originalSize) || originalSize < 0) {
     throw error(400, 'Invalid originalSize: must be a non-negative integer');
   }
-  const previewBytes = parseInt(rawPreviewBytes ?? String(originalSize), 10);
   if (!Number.isFinite(previewBytes) || previewBytes < 0) {
     throw error(400, 'Invalid previewBytes: must be a non-negative integer');
   }
 
-  if (!request.body) {
-    throw error(400, 'Missing request body');
-  }
+  if (!event.request.body) throw error(400, 'Missing request body');
 
   if (originalSize > maxEditableFileSize) {
     log.warn(
-      { bucket, key, original_size: originalSize, max_editable_size: maxEditableFileSize },
+      {
+        bucket,
+        key,
+        original_size: originalSize,
+        max_editable_size: maxEditableFileSize
+      },
       'save-text rejected: file exceeds max editable size (read-only)'
     );
     throw error(413, 'File exceeds the maximum editable size and is read-only');
@@ -60,8 +62,7 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     'save-text request received'
   );
 
-  // Read the entire edited text body into a buffer
-  const editReader = request.body.getReader();
+  const editReader = event.request.body.getReader();
   const editChunks: Uint8Array[] = [];
   let totalEditBytes = 0;
   while (true) {
@@ -79,9 +80,6 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
   let totalLength: number;
 
   if (truncated) {
-    const provider = getProvider(locals.storageConfig!, bucket);
-
-    // Fetch the unseen tail of the original file
     const tailStream = await provider.getObjectRange(key, previewBytes, originalSize - 1);
     const tailReader = tailStream.getReader();
     const tailChunks: Uint8Array[] = [];
@@ -93,7 +91,6 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
       totalTailBytes += value.length;
     }
 
-    // Concatenate edited text + original tail
     const merged = new Uint8Array(totalEditBytes + totalTailBytes);
     let offset = 0;
     for (const chunk of editChunks) {
@@ -119,7 +116,6 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
       'saving truncated file with tail merge'
     );
   } else {
-    // Not truncated — concatenate chunks into a single buffer
     const merged = new Uint8Array(totalEditBytes);
     let offset = 0;
     for (const chunk of editChunks) {
@@ -130,7 +126,7 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     totalLength = totalEditBytes;
   }
 
-  await uploadObject(locals.storageConfig!, bucket, key, mergedBuffer, contentType, totalLength);
+  await provider.putObject(key, mergedBuffer, contentType, totalLength);
 
   log.info({ bucket, key }, 'save-text completed');
 
diff --git a/src/routes/(app)/api/storage/save-text/server.test.ts b/src/routes/(app)/api/storage/save-text/server.test.ts
new file mode 100644
index 00000000..8d0b7897
--- /dev/null
+++ b/src/routes/(app)/api/storage/save-text/server.test.ts
@@ -0,0 +1,143 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+
+const mockProvider = { putObject: vi.fn(), getObjectRange: vi.fn() };
+vi.mock('$lib/server/storage/utils.js', () => ({
+  getProvider: () => mockProvider
+}));
+
+vi.mock('$lib/server/feature-flags.js', () => ({
+  maxEditableFileSize: 5242880
+}));
+
+import { POST } from './+server.js';
+
+const CONNECTION_HEADER = {
+  'x-storage-connection': btoa(JSON.stringify({ type: 's3', region: 'us-east-1' }))
+};
+
+function mockEvent(params: string, body?: ReadableStream | null) {
+  const url = new URL(`http://localhost/api/storage/save-text?${params}`);
+  return {
+    url,
+    request: {
+      headers: new Headers(CONNECTION_HEADER),
+      body: body ?? null
+    },
+    locals: {
+      logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
+      user: { id: 'test-user' },
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
+    }
+  } as unknown as Parameters<typeof POST>[0];
+}
+
+function textBody(text: string): ReadableStream {
+  const encoder = new TextEncoder();
+  const bytes = encoder.encode(text);
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(bytes);
+      controller.close();
+    }
+  });
+}
+
+describe('POST /api/storage/save-text', () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it('saves text body without truncation', async () => {
+    mockProvider.putObject.mockResolvedValue(undefined);
+    const body = textBody('hello world');
+
+    const res = await POST(
+      mockEvent('bucket=b1&key=file.txt&originalSize=11&previewBytes=11', body)
+    );
+
+    expect(res.status).toBe(200);
+    expect(mockProvider.putObject).toHaveBeenCalledWith(
+      'file.txt',
+      expect.anything(),
+      'text/plain',
+      11
+    );
+    expect(mockProvider.getObjectRange).not.toHaveBeenCalled();
+  });
+
+  it('merges edit tail when truncated', async () => {
+    const tailBytes = new TextEncoder().encode('...tail');
+    const tailStream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(tailBytes);
+        controller.close();
+      }
+    });
+    mockProvider.getObjectRange.mockResolvedValue(tailStream);
+    mockProvider.putObject.mockResolvedValue(undefined);
+
+    const body = textBody('edited');
+
+    const res = await POST(
+      mockEvent('bucket=b1&key=file.txt&originalSize=100&previewBytes=10', body)
+    );
+
+    expect(res.status).toBe(200);
+    expect(mockProvider.getObjectRange).toHaveBeenCalledWith('file.txt', 10, 99);
+    expect(mockProvider.putObject).toHaveBeenCalledWith(
+      'file.txt',
+      expect.anything(),
+      'text/plain',
+      13 // 6 ("edited") + 7 ("...tail")
+    );
+  });
+
+  it('returns 400 when key is missing', async () => {
+    await expect(POST(mockEvent('bucket=b1&originalSize=10'))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns 400 when originalSize is invalid', async () => {
+    await expect(POST(mockEvent('bucket=b1&key=file.txt&originalSize=abc'))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns 400 when request body is missing', async () => {
+    await expect(POST(mockEvent('bucket=b1&key=file.txt&originalSize=10'))).rejects.toThrow(
+      expect.objectContaining({ status: 400 })
+    );
+  });
+
+  it('returns 413 when file exceeds max editable size', async () => {
+    const body = textBody('content');
+
+    await expect(
+      POST(mockEvent('bucket=b1&key=file.txt&originalSize=6000000', body))
+    ).rejects.toThrow(expect.objectContaining({ status: 413 }));
+  });
+
+  it('cancels read when body exceeds max size mid-stream', async () => {
+    mockProvider.putObject.mockResolvedValue(undefined);
+
+    const largeChunk = new Uint8Array(3_000_000);
+    const smallChunk = new Uint8Array(3_000_000);
+    let callCount = 0;
+    const body = new ReadableStream({
+      pull(controller) {
+        if (callCount === 0) {
+          controller.enqueue(largeChunk);
+          callCount++;
+        } else if (callCount === 1) {
+          controller.enqueue(smallChunk);
+          callCount++;
+        } else {
+          controller.close();
+        }
+      }
+    });
+
+    await expect(
+      POST(mockEvent('bucket=b1&key=file.txt&originalSize=7000000', body))
+    ).rejects.toThrow(expect.objectContaining({ status: 413 }));
+  });
+});
diff --git a/src/routes/(app)/api/storage/upload/+server.ts b/src/routes/(app)/api/storage/upload/+server.ts
index 6e61c798..e7214bde 100644
--- a/src/routes/(app)/api/storage/upload/+server.ts
+++ b/src/routes/(app)/api/storage/upload/+server.ts
@@ -1,6 +1,5 @@
 import { error } from '@sveltejs/kit';
-import { getProvider } from '$lib/server/storage/utils.js';
-import { requireBucketKey } from '../params.js';
+import { createStorageProvider } from '$lib/server/storage/request-context.js';
 import type { RequestHandler } from './$types';
 
 /**
@@ -13,9 +12,12 @@ import type { RequestHandler } from './$types';
  * The connection config is parsed and validated by the `handleStorageConnection`
  * middleware in hooks.server.ts before this handler runs.
  */
-export const POST: RequestHandler = async ({ locals, url, request }) => {
+export const POST: RequestHandler = async (event) => {
+  const { provider, bucket } = createStorageProvider(event);
+  const key = event.url.searchParams.get('key')?.trim();
+  if (!key) throw error(400, 'Missing required query parameter: key');
+  const { locals, request } = event;
   const log = locals.logger;
-  const { bucket, key } = requireBucketKey(url);
 
   if (!request.body) {
     throw error(400, 'Missing request body');
@@ -33,12 +35,7 @@ export const POST: RequestHandler = async ({ locals, url, request }) => {
     'upload request received'
   );
 
-  await getProvider(locals.storageConfig!, bucket).putObject(
-    key,
-    request.body,
-    contentType,
-    contentLength
-  );
+  await provider.putObject(key, request.body, contentType, contentLength);
 
   log.info(
     { bucket, key, content_type: contentType, content_length: contentLength },
diff --git a/src/routes/(app)/api/storage/upload/server.test.ts b/src/routes/(app)/api/storage/upload/server.test.ts
index 316f2d78..c98045d9 100644
--- a/src/routes/(app)/api/storage/upload/server.test.ts
+++ b/src/routes/(app)/api/storage/upload/server.test.ts
@@ -29,7 +29,7 @@ function mockEvent(opts: {
     locals: {
       logger: { debug: vi.fn(), info: vi.fn(), warn: vi.fn() },
       user: { id: 'test-user' },
-      storageConfig: { type: 's3', region: 'us-east-1' }
+      storageConfig: { type: 's3', region: { name: 'us-east-1' } }
     }
   } as unknown as Parameters<typeof POST>[0];
 }
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 9ff1dc5d..d73630cc 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -6,15 +6,19 @@
   import { setStorageState } from '$lib/storage/context.js';
   import StorageModals from '$lib/components/storage/modals/StorageModals.svelte';
   import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { createFetchStorageApi } from '$lib/storage/api.js';
 
   let { children, data } = $props();
 
+  const storageApi = createFetchStorageApi(() => connectionStore.activeConnectionId);
+
   const storage = untrack(
     () =>
       new StorageState({
         connected: data.connected,
         buckets: data.buckets,
-        connectionId: connectionStore.activeConnectionId
+        connectionId: connectionStore.activeConnectionId,
+        api: storageApi
       })
   );
   setStorageState(storage);
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
index 5b58d35f..c0778da5 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
@@ -9,5 +9,5 @@ export const load: PageServerLoad = async ({ params, locals }) => {
 
   const prefix = params.prefix ? params.prefix + '/' : '';
   const bucket = params.bucket;
-  return { bucket, prefix };
+  return { bucket, prefix, activeConnectionId: activeId };
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
index 8de2148e..559b6cad 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -23,7 +23,7 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
 
   if (!browser) return { bucket, prefix, objects: EMPTY_PAGE };
 
-  const connectionId = connectionStore.activeConnectionId;
+  const connectionId = connectionStore.activeConnectionId ?? data.activeConnectionId;
   if (!connectionId) throw redirect(303, '/storage');
 
   const continuationToken = url.searchParams.get('continuationToken');
@@ -33,7 +33,7 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
   if (continuationToken) query.set('continuationToken', continuationToken);
   if (pageSizeParam) query.set('pageSize', pageSizeParam);
 
-  const res = await fetch(`/api/storage/objects?${query}`, {
+  const res = await fetch(`/api/storage/list?${query}`, {
     headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
   });
 
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
index 25ca2d66..a498c540 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
@@ -30,7 +30,7 @@ function mockEvent(
 describe('bucket page server load', () => {
   it('returns bucket and prefix when an active connection exists', async () => {
     const result = await load(mockEvent({ activeConnectionId: 'conn-123' }));
-    expect(result).toEqual({ bucket: 'my-bucket', prefix: '' });
+    expect(result).toEqual({ bucket: 'my-bucket', prefix: '', activeConnectionId: 'conn-123' });
   });
 
   it('redirects to /storage when no active connection', async () => {
@@ -47,13 +47,17 @@ describe('bucket page server load', () => {
 
   it('adds trailing slash to prefix', async () => {
     const result = await load(mockEvent({ prefix: 'data/2024', activeConnectionId: 'conn-123' }));
-    expect(result).toEqual({ bucket: 'my-bucket', prefix: 'data/2024/' });
+    expect(result).toEqual({
+      bucket: 'my-bucket',
+      prefix: 'data/2024/',
+      activeConnectionId: 'conn-123'
+    });
   });
 
   it('handles empty prefix', async () => {
     const result = await load(
       mockEvent({ bucket: 'test-bucket', prefix: '', activeConnectionId: 'conn-123' })
     );
-    expect(result).toEqual({ bucket: 'test-bucket', prefix: '' });
+    expect(result).toEqual({ bucket: 'test-bucket', prefix: '', activeConnectionId: 'conn-123' });
   });
 });
diff --git a/src/routes/(app)/storage/connections/+page.svelte b/src/routes/(app)/storage/connections/+page.svelte
index c7bd6ded..1c156539 100644
--- a/src/routes/(app)/storage/connections/+page.svelte
+++ b/src/routes/(app)/storage/connections/+page.svelte
@@ -9,7 +9,7 @@
   import * as m from '$lib/paraglide/messages.js';
   import type { ConnectionListItem } from '$lib/storage/connection-store.svelte.js';
   import DeleteConnectionModal from '$lib/components/storage/modals/DeleteConnectionModal.svelte';
-  import type { SavedConnection } from '$lib/storage/connection-storage.js';
+  import type { SavedConnection } from '$lib/storage/connection-id-header.js';
 
   const connections = $derived<ConnectionListItem[]>(page.data.connections ?? []);
 
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
index 3a0fd521..4095a547 100644
--- a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
+++ b/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
@@ -1,7 +1,7 @@
 <script lang="ts">
   import { onMount } from 'svelte';
   import { goto, beforeNavigate } from '$app/navigation';
-  import { resolve } from '$app/paths';
+  import { resolve, resolveRoute } from '$app/paths';
   import { superForm } from 'sveltekit-superforms';
   import { zod4 as zod } from 'sveltekit-superforms/adapters';
   import { untrack } from 'svelte';
@@ -74,7 +74,8 @@
     confirmLeaveOpen = false;
     pendingNavigation = null;
     bypassDirtyCheck = true;
-    goto(dest);
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    goto(resolveRoute(dest as any));
   }
 
   function cancelLeave() {
@@ -145,7 +146,7 @@
         id="{uid}-name"
         name="name"
         type="text"
-        class="input-bordered input w-full"
+        class="input w-full"
         placeholder={m.storage_connection_edit_name_placeholder()}
         bind:value={$form.name}
       />
@@ -163,7 +164,7 @@
         id="{uid}-host"
         name="host"
         type="text"
-        class={['input-bordered input w-full', $errors?.host && 'input-error']}
+        class={['input w-full', $errors?.host && 'input-error']}
         placeholder={m.storage_connect_host_placeholder()}
         bind:value={$form.host}
         onblur={parseHostInput}
@@ -184,7 +185,7 @@
         type="number"
         min="1"
         max="65535"
-        class={['input-bordered input w-full', $errors?.port && 'input-error']}
+        class={['input w-full', $errors?.port && 'input-error']}
         placeholder={m.storage_connect_port_placeholder()}
         bind:value={$form.port}
       />
@@ -243,7 +244,7 @@
       <select
         id="{uid}-access-style"
         name="accessStyle"
-        class="select-bordered select w-full"
+        class="select w-full"
         bind:value={$form.accessStyle}
       >
         <option value="Path">{m.storage_connect_access_style_path()}</option>
@@ -260,7 +261,7 @@
         id="{uid}-region"
         name="region.name"
         type="text"
-        class={['input-bordered input w-full', $errors?.region?.name && 'input-error']}
+        class={['input w-full', $errors?.region?.name && 'input-error']}
         bind:value={$form.region.name}
       />
       {#if $errors?.region?.name}
@@ -277,7 +278,7 @@
         id="{uid}-access-key"
         name="credentials.accessKey"
         type="text"
-        class={['input-bordered input w-full', $errors?.credentials?.accessKey && 'input-error']}
+        class={['input w-full', $errors?.credentials?.accessKey && 'input-error']}
         autocomplete="username"
         bind:value={$form.credentials.accessKey}
       />
@@ -295,7 +296,7 @@
         id="{uid}-secret-key"
         name="credentials.secretKey"
         type="password"
-        class={['input-bordered input w-full', $errors?.credentials?.secretKey && 'input-error']}
+        class={['input w-full', $errors?.credentials?.secretKey && 'input-error']}
         autocomplete="current-password"
         bind:value={$form.credentials.secretKey}
       />
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 97f85c82..960a0d49 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -780,7 +780,7 @@
               <button
                 type="button"
                 class="
-                  rounded-btn hover:bg-primary-content/20 cursor-pointer px-3 py-1.5
+                  hover:bg-primary-content/20 cursor-pointer rounded-md px-3 py-1.5
                   text-left
                   {runMode === 'cursor' ? 'bg-primary-content/15' : ''}"
                 onclick={() => selectRunMode('cursor')}
@@ -790,7 +790,7 @@
               <button
                 type="button"
                 class="
-                  rounded-btn hover:bg-primary-content/20 cursor-pointer px-3 py-1.5
+                  hover:bg-primary-content/20 cursor-pointer rounded-md px-3 py-1.5
                   text-left
                   {runMode === 'all' ? 'bg-primary-content/15' : ''}"
                 onclick={() => selectRunMode('all')}
@@ -868,12 +868,14 @@
             </span>
           {/if}
           {#if runner.currentTrinoQueryUrl}
+            <!-- eslint-disable svelte/no-navigation-without-resolve -->
             <a
               href={runner.currentTrinoQueryUrl}
               target="_blank"
               rel="noopener noreferrer"
               class="btn btn-ghost btn-xs"
             >
+              <!-- eslint-enable svelte/no-navigation-without-resolve -->
               {m.trino_view_in_trino()}
               <svg
                 xmlns="http://www.w3.org/2000/svg"
diff --git a/src/routes/(app)/trino/query-runner.svelte.ts b/src/routes/(app)/trino/query-runner.svelte.ts
index af6da899..d37c2358 100644
--- a/src/routes/(app)/trino/query-runner.svelte.ts
+++ b/src/routes/(app)/trino/query-runner.svelte.ts
@@ -122,6 +122,7 @@ function createQueryRunner(tabId: string): QueryRunner {
             isTerminal(s.state) &&
             s.rows.length === 0 &&
             s.columns.length === 0 &&
+            // eslint-disable-next-line security/detect-object-injection
             (!results[i] || !isTerminal(results[i].state) || results[i].rows.length === 0)
         );
         if (hasNewlyCompleted) {

From 9f1956333828f0b98c1e15d732d71ce9d645cb3f Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Wed, 22 Jul 2026 11:23:45 +0200
Subject: [PATCH 114/136] refactor: modularize dev setup script and improve
 logging (#246)

- Split setup script into multiple modules for better organization and maintainability.
- Introduced logging functions for consistent output.
- Added Kubernetes helper functions for deployment and service management.
- Enhanced environment variable handling and configuration writing.
- Improved error handling and user feedback during setup process.
---
 dev/lib/k8s.sh               |  45 ++++
 dev/lib/logging.sh           |  17 ++
 dev/lib/probe.sh             |  25 ++
 dev/modules/env.sh           |  90 +++++++
 dev/modules/garage.sh        |  38 +++
 dev/modules/keycloak.sh      |  97 ++++++++
 dev/modules/postgresql.sh    |  28 +++
 dev/modules/prerequisites.sh |  17 ++
 dev/modules/secret.sh        |   8 +
 dev/modules/summary.sh       |  36 +++
 dev/modules/trino.sh         |  25 ++
 dev/setup.sh                 | 468 +++++------------------------------
 12 files changed, 482 insertions(+), 412 deletions(-)
 create mode 100644 dev/lib/k8s.sh
 create mode 100644 dev/lib/logging.sh
 create mode 100644 dev/lib/probe.sh
 create mode 100644 dev/modules/env.sh
 create mode 100644 dev/modules/garage.sh
 create mode 100644 dev/modules/keycloak.sh
 create mode 100644 dev/modules/postgresql.sh
 create mode 100644 dev/modules/prerequisites.sh
 create mode 100644 dev/modules/secret.sh
 create mode 100644 dev/modules/summary.sh
 create mode 100644 dev/modules/trino.sh

diff --git a/dev/lib/k8s.sh b/dev/lib/k8s.sh
new file mode 100644
index 00000000..d659ebd6
--- /dev/null
+++ b/dev/lib/k8s.sh
@@ -0,0 +1,45 @@
+# shellcheck shell=bash
+k8s::node_ip() {
+  local ip
+  ip=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
+  if [ -z "$ip" ]; then
+    log::error "Could not detect kind node IP."
+  fi
+  echo "$ip"
+}
+
+k8s::wait_for_deployment() {
+  local name=$1 timeout=${2:-120}
+  kubectl wait --for=condition=available "deployment/$name" --timeout="${timeout}s"
+}
+
+k8s::wait_for_statefulset() {
+  local name=$1 timeout=${2:-300}
+  kubectl rollout status "statefulset/$name" --timeout="${timeout}s"
+}
+
+k8s::wait_for_pod() {
+  local label=$1 timeout=${2:-60}
+  kubectl wait --for=condition=ready pod -l "$label" --timeout="${timeout}s"
+}
+
+k8s::get_pod_name() {
+  local label=$1
+  kubectl get pod -l "$label" -o jsonpath='{.items[0].metadata.name}'
+}
+
+k8s::get_node_port() {
+  local service=$1
+  kubectl get svc "$service" -o jsonpath='{.spec.ports[0].nodePort}'
+}
+
+k8s::template_and_apply() {
+  local file=$1
+  shift
+  local sed_exprs=()
+  for pair in "$@"; do
+    local key="${pair%%=*}" val="${pair#*=}"
+    sed_exprs+=(-e "s/\${${key}}/${val}/g")
+  done
+  sed "${sed_exprs[@]}" "$file" | kubectl apply -f -
+}
diff --git a/dev/lib/logging.sh b/dev/lib/logging.sh
new file mode 100644
index 00000000..69627eb6
--- /dev/null
+++ b/dev/lib/logging.sh
@@ -0,0 +1,17 @@
+# shellcheck shell=bash
+log::info() {
+  echo "  [INFO] $*"
+}
+
+log::warn() {
+  echo "  [WARN] $*" >&2
+}
+
+log::error() {
+  echo "  [ERROR] $*" >&2
+  exit 1
+}
+
+log::ok() {
+  echo "  [OK] $*"
+}
diff --git a/dev/lib/probe.sh b/dev/lib/probe.sh
new file mode 100644
index 00000000..48679416
--- /dev/null
+++ b/dev/lib/probe.sh
@@ -0,0 +1,25 @@
+# shellcheck shell=bash
+probe::url() {
+  local port=$1 path=$2
+  local scheme=${3:-http}
+  local timeout=${4:-120}
+  shift 4
+
+  local deadline url candidate
+  deadline=$(( $(date +%s) + timeout ))
+  url=""
+  while [ -z "$url" ] && [ "$(date +%s)" -lt "$deadline" ]; do
+    for candidate in "${scheme}://${NODE_IP}:${port}" "${scheme}://127.0.0.1:${port}" "${scheme}://localhost:${port}"; do
+      if curl -sf --max-time 2 "$@" "${candidate}${path}" >/dev/null 2>&1; then
+        url="$candidate"
+        break
+      fi
+    done
+    [ -z "$url" ] && sleep 2
+  done
+
+  if [ -z "$url" ]; then
+    return 1
+  fi
+  echo "$url"
+}
diff --git a/dev/modules/env.sh b/dev/modules/env.sh
new file mode 100644
index 00000000..28f22f8e
--- /dev/null
+++ b/dev/modules/env.sh
@@ -0,0 +1,90 @@
+# shellcheck shell=bash
+env::write() {
+  log::info "Writing .env.development..."
+
+  local session_secret encryption_key
+  session_secret=$(openssl rand -hex 32)
+  encryption_key=$(openssl rand -hex 32)
+
+  if [ -f "$ENV_FILE" ]; then
+    log::info "Backing up existing .env.development to .env.development.bak"
+    cp "$ENV_FILE" "$ENV_FILE.bak"
+  fi
+
+  if [[ "$SKIP_TRINO" == false ]]; then
+    cat > "$ENV_FILE" <<EOF
+STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
+STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
+STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
+STACKABLE_COCKPIT_SESSION_SECRET=${session_secret}
+STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
+STACKABLE_COCKPIT_TRINO_URL=${TRINO_BASE_URL}
+STACKABLE_COCKPIT_TRINO_AUTH_TYPE=basic
+STACKABLE_COCKPIT_TRINO_AUTH_USERNAME=stackable-cockpit
+STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD=stackable-cockpit-dev
+STACKABLE_COCKPIT_TRINO_TLS_INSECURE=true
+STORAGE_ENCRYPTION_KEY=${encryption_key}
+STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
+STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
+STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
+STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50
+STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB=100
+STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
+PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
+PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
+PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
+PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
+DATABASE_HOST=localhost
+DATABASE_PORT=31432
+DATABASE_NAME=cockpit
+DATABASE_USER=cockpit
+DATABASE_PASSWORD=cockpit-dev-password
+EOF
+  else
+    cat > "$ENV_FILE" <<EOF
+STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
+STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
+STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
+STACKABLE_COCKPIT_SESSION_SECRET=${session_secret}
+STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
+STORAGE_ENCRYPTION_KEY=${encryption_key}
+STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
+STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
+STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
+STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
+STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
+STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
+PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
+PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
+PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
+PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
+PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
+PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
+PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
+PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
+DATABASE_HOST=localhost
+DATABASE_PORT=31432
+DATABASE_NAME=cockpit
+DATABASE_USER=cockpit
+DATABASE_PASSWORD=cockpit-dev-password
+EOF
+  fi
+
+  log::ok "Wrote $ENV_FILE"
+}
diff --git a/dev/modules/garage.sh b/dev/modules/garage.sh
new file mode 100644
index 00000000..fa87991f
--- /dev/null
+++ b/dev/modules/garage.sh
@@ -0,0 +1,38 @@
+# shellcheck shell=bash
+garage::deploy() {
+  [[ "$SKIP_GARAGE" == true ]] && return 0
+
+  log::info "Deploying Garage S3..."
+  helm upgrade --install garage "$SCRIPT_DIR/garage" \
+    --namespace default \
+    --wait \
+    --timeout 60s
+}
+
+garage::init() {
+  [[ "$SKIP_GARAGE" == true ]] && return 0
+
+  log::info "Initialising Garage S3..."
+
+  local garage_admin_port=30902 garage_s3_port=30900
+  local garage_base_url
+
+  if ! garage_base_url=$(probe::url "$garage_admin_port" /v2/ListBuckets http 60 \
+    -H "Authorization: Bearer stackable-cockpit-e2e-admin-token"); then
+    log::error "Could not reach Garage admin API via NodePort ${garage_admin_port} within 60s."
+  fi
+
+  local garage_host
+  garage_host=$(echo "$garage_base_url" | sed 's|http://||; s|:[0-9]*$||')
+  GARAGE_S3_URL="http://${garage_host}:${garage_s3_port}"
+  GARAGE_ADMIN_URL="$garage_base_url"
+
+  S3_SECRET_ACCESS_KEY=$(openssl rand -hex 32) \
+    GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token \
+    S3_ENDPOINT="$GARAGE_S3_URL" \
+    GARAGE_ADMIN_URL="$GARAGE_ADMIN_URL" \
+    S3_CONFIG_PATH="$PROJECT_DIR/s3-config.json" \
+    "$SCRIPT_DIR/../e2e/init-garage-s3.sh"
+
+  log::info "Wrote s3-config.json (S3 endpoint: ${GARAGE_S3_URL})"
+}
diff --git a/dev/modules/keycloak.sh b/dev/modules/keycloak.sh
new file mode 100644
index 00000000..2669eaac
--- /dev/null
+++ b/dev/modules/keycloak.sh
@@ -0,0 +1,97 @@
+# shellcheck shell=bash
+keycloak::deploy() {
+  log::info "Deploying Keycloak..."
+  kubectl apply -f "$SCRIPT_DIR/keycloak.yaml"
+  k8s::wait_for_deployment keycloak 120
+}
+
+keycloak::configure() {
+  log::info "Configuring Keycloak..."
+
+  local pod
+  pod=$(k8s::get_pod_name app=keycloak)
+
+  local keycloak_url
+  if ! keycloak_url=$(probe::url 30080 /realms/master); then
+    log::error "Could not reach Keycloak via NodePort 30080 within 120s."
+  fi
+  KEYCLOAK_BASE_URL="$keycloak_url"
+  log::info "Keycloak URL: ${KEYCLOAK_BASE_URL}"
+
+  log::info "Waiting for Keycloak to accept connections..."
+  until curl -sf "${KEYCLOAK_BASE_URL}/realms/master" >/dev/null 2>&1; do
+    sleep 2
+  done
+
+  kcadm() {
+    kubectl exec "$pod" -- /opt/keycloak/bin/kcadm.sh "$@"
+  }
+
+  if kcadm get realms/stackable --fields realm 2>/dev/null | grep -q '"stackable"'; then
+    log::info "Realm 'stackable' already exists, skipping Keycloak configuration."
+    local client_uuid
+    client_uuid=$(kcadm get clients -r stackable --fields id,clientId \
+      | grep -B1 '"stackable-cockpit"' | grep '"id"' | sed 's/.*: *"\(.*\)".*/\1/')
+    local client_secret
+    client_secret=$(kcadm get clients/"$client_uuid"/client-secret -r stackable --fields value \
+      | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
+    export OIDC_CLIENT_SECRET="$client_secret"
+    return
+  fi
+
+  log::info "Logging into Keycloak admin CLI..."
+  kcadm config credentials \
+    --server http://localhost:8080 \
+    --realm master \
+    --user admin \
+    --password admin
+
+  log::info "Creating realm 'stackable'..."
+  kcadm create realms -s realm=stackable -s enabled=true
+
+  log::info "Creating client 'stackable-cockpit'..."
+  local client_uuid
+  client_uuid=$(kcadm create clients -r stackable \
+    -s clientId=stackable-cockpit \
+    -s enabled=true \
+    -s protocol=openid-connect \
+    -s publicClient=false \
+    -s standardFlowEnabled=true \
+    -s directAccessGrantsEnabled=false \
+    -s 'redirectUris=["*"]' \
+    -s 'webOrigins=["*"]' \
+    -i)
+
+  log::info "Creating client 'trino'..."
+  kcadm create clients -r stackable \
+    -s clientId=trino \
+    -s enabled=true \
+    -s protocol=openid-connect \
+    -s publicClient=false \
+    -s standardFlowEnabled=true \
+    -s directAccessGrantsEnabled=false \
+    -s secret=trino-oidc-dev \
+    -s 'redirectUris=["*"]' \
+    -s 'webOrigins=["*"]'
+
+  __keycloak_create_user alice alicealice Alice Example
+  __keycloak_create_user bob bobbob Bob Example
+
+  log::info "Fetching client secret..."
+  local client_secret
+  client_secret=$(kcadm get clients/"$client_uuid"/client-secret -r stackable --fields value \
+    | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
+  export OIDC_CLIENT_SECRET="$client_secret"
+}
+
+__keycloak_create_user() {
+  local username=$1 password=$2 first=$3 last=$4
+  log::info "Creating user '$username'..."
+  kcadm create users -r stackable \
+    -s username="$username" \
+    -s email="$username@example.com" \
+    -s firstName="$first" \
+    -s lastName="$last" \
+    -s enabled=true
+  kcadm set-password -r stackable --username "$username" --new-password "$password"
+}
diff --git a/dev/modules/postgresql.sh b/dev/modules/postgresql.sh
new file mode 100644
index 00000000..be80b1ef
--- /dev/null
+++ b/dev/modules/postgresql.sh
@@ -0,0 +1,28 @@
+# shellcheck shell=bash
+postgresql::deploy() {
+  [[ "$SKIP_POSTGRESQL" == true ]] && return 0
+
+  log::info "Deploying PostgreSQL 18..."
+  helm upgrade --install postgresql "$SCRIPT_DIR/postgresql" \
+    --namespace default \
+    --wait \
+    --timeout 60s
+}
+
+postgresql::migrate() {
+  [[ "$SKIP_POSTGRESQL" == true ]] && return 0
+
+  log::info "Waiting for PostgreSQL to be ready..."
+  k8s::wait_for_pod app=postgresql 60
+
+  log::info "Running database migrations..."
+  (
+    cd "$PROJECT_DIR" &&
+    DATABASE_HOST=localhost \
+      DATABASE_PORT=31432 \
+      DATABASE_NAME=cockpit \
+      DATABASE_USER=cockpit \
+      DATABASE_PASSWORD=cockpit-dev-password \
+      npx tsx src/lib/server/migrate.ts
+  )
+}
diff --git a/dev/modules/prerequisites.sh b/dev/modules/prerequisites.sh
new file mode 100644
index 00000000..a6a73053
--- /dev/null
+++ b/dev/modules/prerequisites.sh
@@ -0,0 +1,17 @@
+# shellcheck shell=bash
+prerequisites::run() {
+  if [ ! -d "$PROJECT_DIR/node_modules" ]; then
+    log::info "Installing npm dependencies..."
+    (cd "$PROJECT_DIR" && npm install)
+  else
+    log::info "npm dependencies already installed, skipping."
+  fi
+
+  if [[ "$SKIP_TRINO" == true ]]; then
+    log::info "Installing Stackable operators (commons, listener, secret)..."
+    stackablectl operator install commons listener secret
+  else
+    log::info "Installing Stackable operators (commons, listener, secret, trino)..."
+    stackablectl operator install commons listener secret trino
+  fi
+}
diff --git a/dev/modules/secret.sh b/dev/modules/secret.sh
new file mode 100644
index 00000000..714fa6af
--- /dev/null
+++ b/dev/modules/secret.sh
@@ -0,0 +1,8 @@
+# shellcheck shell=bash
+secret::create() {
+  log::info "Creating stackable-cockpit-credentials Secret..."
+  kubectl delete secret stackable-cockpit-credentials --ignore-not-found
+  kubectl create secret generic stackable-cockpit-credentials \
+    --from-literal=oidc-client-secret="$OIDC_CLIENT_SECRET" \
+    --from-literal=trino-auth-password=stackable-cockpit-dev
+}
diff --git a/dev/modules/summary.sh b/dev/modules/summary.sh
new file mode 100644
index 00000000..8c64364a
--- /dev/null
+++ b/dev/modules/summary.sh
@@ -0,0 +1,36 @@
+# shellcheck shell=bash
+summary::print() {
+  echo ""
+  log::ok "Setup complete"
+  echo ""
+  echo "Start the dev server with:  npm run dev"
+  echo ""
+  echo "Keycloak:       http://${NODE_IP}:30080"
+  echo "  Admin:        admin / admin"
+  echo ""
+  if [[ "$SKIP_TRINO" == false ]]; then
+    echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
+    echo ""
+    echo "Trino connection is pre-configured via STACKABLE_COCKPIT_TRINO_* env vars."
+    echo ""
+  else
+    echo "Trino was skipped. Add STACKABLE_COCKPIT_TRINO_* vars to $ENV_FILE manually when ready."
+    echo ""
+  fi
+  if [[ "$SKIP_GARAGE" == false ]]; then
+    echo "Garage S3:      http://${NODE_IP}:30900  (admin: http://${NODE_IP}:30902)"
+    echo "  Credentials written to s3-config.json for E2E tests."
+    echo ""
+  fi
+  if [[ "$SKIP_POSTGRESQL" == false ]]; then
+    echo "PostgreSQL:     localhost:31432"
+    echo "  Database:     cockpit"
+    echo "  User:         cockpit"
+    echo "  Password:     cockpit-dev-password"
+    echo "  Environment:  DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD"
+    echo ""
+  fi
+  echo "Test users (OIDC):"
+  echo "  alice / alicealice"
+  echo "  bob   / bobbob"
+}
diff --git a/dev/modules/trino.sh b/dev/modules/trino.sh
new file mode 100644
index 00000000..03ff0f2a
--- /dev/null
+++ b/dev/modules/trino.sh
@@ -0,0 +1,25 @@
+# shellcheck shell=bash
+trino::deploy() {
+  [[ "$SKIP_TRINO" == true ]] && return 0
+
+  log::info "Deploying Trino..."
+  k8s::template_and_apply "$SCRIPT_DIR/trino.yaml" "NODE_IP=$NODE_IP"
+}
+
+trino::probe() {
+  [[ "$SKIP_TRINO" == true ]] && return 0
+
+  TRINO_PORT=$(k8s::get_node_port trino-coordinator)
+
+  local trino_url
+  trino_url=$(probe::url "$TRINO_PORT" /v1/info https 30 -sk || true)
+  export TRINO_BASE_URL="${trino_url:-https://${NODE_IP}:${TRINO_PORT}}"
+}
+
+trino::wait_for_ready() {
+  [[ "$SKIP_TRINO" == true ]] && return 0
+
+  log::info "Waiting for Trino to be ready..."
+  k8s::wait_for_statefulset trino-coordinator-default 300
+  log::info "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
+}
diff --git a/dev/setup.sh b/dev/setup.sh
index a8f746f8..4f1897e5 100755
--- a/dev/setup.sh
+++ b/dev/setup.sh
@@ -3,9 +3,35 @@
 # Assumes: kind cluster is running, kubectl context points to it.
 set -euo pipefail
 
-SKIP_TRINO=false
-SKIP_GARAGE=false
-SKIP_POSTGRESQL=false
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+ENV_FILE="$PROJECT_DIR/.env.development"
+export ENV_FILE
+
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/logging.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/k8s.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/lib/probe.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/prerequisites.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/keycloak.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/trino.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/garage.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/postgresql.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/env.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/secret.sh"
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/modules/summary.sh"
+
+SKIP_TRINO=false; SKIP_GARAGE=false; SKIP_POSTGRESQL=false
 for arg in "$@"; do
   case "$arg" in
     --skip-trino) SKIP_TRINO=true ;;
@@ -14,415 +40,33 @@ for arg in "$@"; do
     *) echo "Unknown argument: $arg"; echo "Usage: $0 [--skip-trino] [--skip-garage] [--skip-postgresql]"; exit 1 ;;
   esac
 done
+export SKIP_TRINO SKIP_GARAGE SKIP_POSTGRESQL
 
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
-ENV_FILE="$PROJECT_DIR/.env.development"
-
-echo "=== Stackable Cockpit dev environment setup ==="
-if [[ "$SKIP_TRINO" == true ]]; then
-  echo "(Trino deployment skipped via --skip-trino)"
-fi
-if [[ "$SKIP_GARAGE" == true ]]; then
-  echo "(Garage deployment skipped via --skip-garage)"
-fi
-if [[ "$SKIP_POSTGRESQL" == true ]]; then
-  echo "(PostgreSQL deployment skipped via --skip-postgresql)"
-fi
-echo ""
-
-# ------------------------------------------------------------------
-# 1. Install npm dependencies if needed
-# ------------------------------------------------------------------
-if [ ! -d "$PROJECT_DIR/node_modules" ]; then
-  echo "Installing npm dependencies..."
-  (cd "$PROJECT_DIR" && npm install)
-else
-  echo "npm dependencies already installed, skipping."
-fi
-
-# ------------------------------------------------------------------
-# 2. Install Stackable operators
-# ------------------------------------------------------------------
-echo ""
-if [[ "$SKIP_TRINO" == true ]]; then
-  echo "Installing Stackable operators (commons, listener, secret)..."
-  stackablectl operator install commons listener secret
-else
-  echo "Installing Stackable operators (commons, listener, secret, trino)..."
-  stackablectl operator install commons listener secret trino
-fi
-
-# ------------------------------------------------------------------
-# 3. Deploy Keycloak
-# ------------------------------------------------------------------
-echo ""
-echo "Deploying Keycloak..."
-kubectl apply -f "$SCRIPT_DIR/keycloak.yaml"
-
-# ------------------------------------------------------------------
-# 4. Wait for Keycloak and configure realm/client/users
-# ------------------------------------------------------------------
-echo ""
-echo "Waiting for Keycloak deployment to be available..."
-kubectl wait --for=condition=available deployment/keycloak --timeout=120s
-
-POD=$(kubectl get pod -l app=keycloak -o jsonpath='{.items[0].metadata.name}')
-NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
-if [ -z "$NODE_IP" ]; then
-  echo "ERROR: Could not detect kind node IP."
-  exit 1
-fi
-echo "Node IP: $NODE_IP"
-
-# ------------------------------------------------------------------
-# 5. Deploy Trino (after node IP is known, trino.yaml is a template)
-# ------------------------------------------------------------------
-if [[ "$SKIP_TRINO" == false ]]; then
-  echo ""
-  echo "Deploying Trino..."
-  sed "s/\${NODE_IP}/$NODE_IP/g" "$SCRIPT_DIR/trino.yaml" | kubectl apply -f -
-fi
-
-# ------------------------------------------------------------------
-# 5b. Deploy Garage S3 (via Helm)
-# ------------------------------------------------------------------
-if [[ "$SKIP_GARAGE" == false ]]; then
-  echo ""
-  echo "Deploying Garage S3..."
-  helm upgrade --install garage "$SCRIPT_DIR/garage" \
-    --namespace default \
-    --wait \
-    --timeout 60s
-fi
-
-# ------------------------------------------------------------------
-# 5c. Deploy PostgreSQL 18 (via Helm)
-# ------------------------------------------------------------------
-if [[ "$SKIP_POSTGRESQL" == false ]]; then
-  echo ""
-  echo "Deploying PostgreSQL 18..."
-  helm upgrade --install postgresql "$SCRIPT_DIR/postgresql" \
-    --namespace default \
-    --wait \
-    --timeout 60s
-fi
-
-# On some local Kubernetes distributions (e.g. Rancher Desktop k3s), the node's
-# InternalIP is not reachable from the host network, but NodePorts are exposed
-# on localhost. Probe both and use the first reachable URL.
-KEYCLOAK_BASE_URL=""
-deadline=$(( $(date +%s) + 120 ))
-while [ -z "$KEYCLOAK_BASE_URL" ] && [ "$(date +%s)" -lt "$deadline" ]; do
-  for base in "http://${NODE_IP}:30080" "http://127.0.0.1:30080" "http://localhost:30080"; do
-    if curl -sf --max-time 2 "${base}/realms/master" >/dev/null 2>&1; then
-      KEYCLOAK_BASE_URL="$base"
-      break
-    fi
-  done
-  [ -z "$KEYCLOAK_BASE_URL" ] && sleep 2
-done
-
-if [ -z "$KEYCLOAK_BASE_URL" ]; then
-  echo "ERROR: Could not reach Keycloak via NodePort 30080 within 120s."
-  echo "Tried: http://${NODE_IP}:30080, http://127.0.0.1:30080, http://localhost:30080"
-  exit 1
-fi
-echo "Keycloak URL: ${KEYCLOAK_BASE_URL}"
-
-echo "Waiting for Keycloak to accept connections"
-until curl -sf "${KEYCLOAK_BASE_URL}/realms/master" >/dev/null 2>&1; do
-  sleep 2
-done
-
-kcadm() {
-  kubectl exec "$POD" -- /opt/keycloak/bin/kcadm.sh "$@"
-}
-
-# Check if realm already exists
-if kcadm get realms/stackable --fields realm 2>/dev/null | grep -q '"stackable"'; then
-  echo "Realm 'stackable' already exists, skipping Keycloak configuration."
-  # Still need to fetch the client secret
-  CLIENT_UUID=$(kcadm get clients -r stackable --fields id,clientId \
-    | grep -B1 '"stackable-cockpit"' | grep '"id"' | sed 's/.*: *"\(.*\)".*/\1/')
-  SECRET=$(kcadm get clients/"$CLIENT_UUID"/client-secret -r stackable --fields value \
-    | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
-else
-  echo "Logging into Keycloak admin CLI..."
-  kcadm config credentials \
-    --server http://localhost:8080 \
-    --realm master \
-    --user admin \
-    --password admin
-
-  echo "Creating realm 'stackable'..."
-  kcadm create realms \
-    -s realm=stackable \
-    -s enabled=true
-
-  echo "Creating client 'stackable-cockpit'..."
-  CLIENT_UUID=$(kcadm create clients \
-    -r stackable \
-    -s clientId=stackable-cockpit \
-    -s enabled=true \
-    -s protocol=openid-connect \
-    -s publicClient=false \
-    -s standardFlowEnabled=true \
-    -s directAccessGrantsEnabled=false \
-    -s 'redirectUris=["*"]' \
-    -s 'webOrigins=["*"]' \
-    -i)
-
-  echo "Creating client 'trino'..."
-  kcadm create clients \
-    -r stackable \
-    -s clientId=trino \
-    -s enabled=true \
-    -s protocol=openid-connect \
-    -s publicClient=false \
-    -s standardFlowEnabled=true \
-    -s directAccessGrantsEnabled=false \
-    -s secret=trino-oidc-dev \
-    -s 'redirectUris=["*"]' \
-    -s 'webOrigins=["*"]'
-
-  create_user() {
-    local username=$1 password=$2 first=$3 last=$4
-    echo "Creating user '$username'..."
-    kcadm create users \
-      -r stackable \
-      -s username="$username" \
-      -s email="$username@example.com" \
-      -s firstName="$first" \
-      -s lastName="$last" \
-      -s enabled=true
-    kcadm set-password \
-      -r stackable \
-      --username "$username" \
-      --new-password "$password"
-  }
-
-  create_user alice alicealice Alice Example
-  create_user bob   bobbob    Bob   Example
-
-  echo "Fetching client secret..."
-  SECRET=$(kcadm get clients/"$CLIENT_UUID"/client-secret -r stackable --fields value \
-    | grep '"value"' | sed 's/.*: *"\(.*\)".*/\1/')
-fi
-
-# ------------------------------------------------------------------
-# 7. Initialise Garage S3 (create bucket + access key, write s3-config.json)
-# ------------------------------------------------------------------
-if [[ "$SKIP_GARAGE" == false ]]; then
-  echo ""
-  echo "Initialising Garage S3..."
-
-  GARAGE_ADMIN_PORT=30902
-  GARAGE_S3_PORT=30900
-  GARAGE_BASE_URL=""
-  deadline=$(( $(date +%s) + 60 ))
-  while [ -z "$GARAGE_BASE_URL" ] && [ "$(date +%s)" -lt "$deadline" ]; do
-    for base in "http://${NODE_IP}:${GARAGE_ADMIN_PORT}" "http://127.0.0.1:${GARAGE_ADMIN_PORT}" "http://localhost:${GARAGE_ADMIN_PORT}"; do
-      if curl -sf --max-time 2 -H "Authorization: Bearer stackable-cockpit-e2e-admin-token" "${base}/v2/ListBuckets" >/dev/null 2>&1; then
-        GARAGE_BASE_URL="$base"
-        break
-      fi
-    done
-    [ -z "$GARAGE_BASE_URL" ] && sleep 2
-  done
-
-  if [ -z "$GARAGE_BASE_URL" ]; then
-    echo "ERROR: Could not reach Garage admin API via NodePort ${GARAGE_ADMIN_PORT} within 60s."
-    echo "Tried: http://${NODE_IP}:${GARAGE_ADMIN_PORT}, http://127.0.0.1:${GARAGE_ADMIN_PORT}, http://localhost:${GARAGE_ADMIN_PORT}"
-    exit 1
-  fi
-
-  # Derive the matching S3 base URL from the same host
-  GARAGE_HOST=$(echo "$GARAGE_BASE_URL" | sed 's|http://||; s|:[0-9]*$||')
-  GARAGE_S3_URL="http://${GARAGE_HOST}:${GARAGE_S3_PORT}"
-
-  S3_SECRET_ACCESS_KEY=$(openssl rand -hex 32) \
-    GARAGE_ADMIN_TOKEN=stackable-cockpit-e2e-admin-token \
-    S3_ENDPOINT="$GARAGE_S3_URL" \
-    GARAGE_ADMIN_URL="$GARAGE_BASE_URL" \
-    S3_CONFIG_PATH="$PROJECT_DIR/s3-config.json" \
-    "$SCRIPT_DIR/../e2e/init-garage-s3.sh"
-
-  echo "Wrote s3-config.json (S3 endpoint: ${GARAGE_S3_URL})"
-fi
-
-# ------------------------------------------------------------------
-# 8. Write .env.development
-# ------------------------------------------------------------------
+log::info "Stackable Cockpit dev environment setup"
+[[ "$SKIP_TRINO" == true ]] && echo "  (Trino deployment skipped)"
+[[ "$SKIP_GARAGE" == true ]] && echo "  (Garage deployment skipped)"
+[[ "$SKIP_POSTGRESQL" == true ]] && echo "  (PostgreSQL deployment skipped)"
 echo ""
-SESSION_SECRET=$(openssl rand -hex 32)
-STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)
-
-if [ -f "$ENV_FILE" ]; then
-  echo "Backing up existing .env.development to .env.development.bak"
-  cp "$ENV_FILE" "$ENV_FILE.bak"
-fi
-
-if [[ "$SKIP_POSTGRESQL" == false ]]; then
-  echo ""
-  echo "Waiting for PostgreSQL to be ready..."
-  kubectl wait --for=condition=ready pod -l app=postgresql --timeout=60s
 
-  echo "Running database migrations..."
-  DATABASE_HOST=localhost \
-    DATABASE_PORT=31432 \
-    DATABASE_NAME=cockpit \
-    DATABASE_USER=cockpit \
-    DATABASE_PASSWORD=cockpit-dev-password \
-    npx tsx src/lib/server/migrate.ts
-fi
-
-if [[ "$SKIP_TRINO" == false ]]; then
-  TRINO_PORT=$(kubectl get svc trino-coordinator -o jsonpath='{.spec.ports[0].nodePort}')
-
-  # Probe Trino reachability the same way we did for Keycloak.
-  TRINO_BASE_URL=""
-  for base in "https://${NODE_IP}:${TRINO_PORT}" "https://127.0.0.1:${TRINO_PORT}" "https://localhost:${TRINO_PORT}"; do
-    if curl -sfk --max-time 2 "${base}/v1/info" >/dev/null 2>&1; then
-      TRINO_BASE_URL="$base"
-      break
-    fi
-  done
-  # Fall back to NODE_IP if none respond yet (Trino may still be starting).
-  TRINO_BASE_URL="${TRINO_BASE_URL:-https://${NODE_IP}:${TRINO_PORT}}"
-fi
-
-if [[ "$SKIP_TRINO" == false ]]; then
-  cat > "$ENV_FILE" <<EOF
-STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
-STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
-STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=${SECRET}
-STACKABLE_COCKPIT_SESSION_SECRET=${SESSION_SECRET}
-STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
-STACKABLE_COCKPIT_TRINO_URL=${TRINO_BASE_URL}
-STACKABLE_COCKPIT_TRINO_AUTH_TYPE=basic
-STACKABLE_COCKPIT_TRINO_AUTH_USERNAME=stackable-cockpit
-STACKABLE_COCKPIT_TRINO_AUTH_PASSWORD=stackable-cockpit-dev
-STACKABLE_COCKPIT_TRINO_TLS_INSECURE=true
-STORAGE_ENCRYPTION_KEY=${STORAGE_ENCRYPTION_KEY}
-STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
-STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
-STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
-STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
-STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
-STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50
-STACKABLE_COCKPIT_ARCHIVE_PREVIEW_MAX_MB=100
-STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
-PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
-PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
-PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
-PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
-PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
-PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
-PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
-PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
-DATABASE_HOST=localhost
-DATABASE_PORT=31432
-DATABASE_NAME=cockpit
-DATABASE_USER=cockpit
-DATABASE_PASSWORD=cockpit-dev-password
-EOF
-else
-  cat > "$ENV_FILE" <<EOF
-STACKABLE_COCKPIT_OIDC_DISCOVERY_URL=${KEYCLOAK_BASE_URL}/realms/stackable/.well-known/openid-configuration
-STACKABLE_COCKPIT_OIDC_CLIENT_ID=stackable-cockpit
-STACKABLE_COCKPIT_OIDC_CLIENT_SECRET=${SECRET}
-STACKABLE_COCKPIT_SESSION_SECRET=${SESSION_SECRET}
-STACKABLE_COCKPIT_BASE_URL=http://localhost:5173
-STORAGE_ENCRYPTION_KEY=${STORAGE_ENCRYPTION_KEY}
-STACKABLE_COCKPIT_STORAGE_BROWSER_ENABLED=true
-STACKABLE_COCKPIT_TEXT_PREVIEW_BYTES=262144
-STACKABLE_COCKPIT_IMAGE_PREVIEW_BYTES=5242880
-STACKABLE_COCKPIT_PDF_PREVIEW_BYTES=26214400
-STACKABLE_COCKPIT_FILE_PREVIEW_ROWS=250
-STACKABLE_COCKPIT_FILE_PREVIEW_COLUMNS=50
-STACKABLE_COCKPIT_PARQUET_PREVIEW_DISALLOWED_COMPRESSION_TYPES=gzip-no_offset
-PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_RESTORE_TABS=true
-PUBLIC_STACKABLE_COCKPIT_PAGE_SIZES=25,50,100
-PUBLIC_STACKABLE_COCKPIT_DEFAULT_PAGE_SIZE=25
-PUBLIC_STACKABLE_COCKPIT_MAX_RECENT_FILES=15
-PUBLIC_STACKABLE_COCKPIT_STORAGE_AUTO_CONNECT_TIMEOUT_MS=15000
-PUBLIC_STACKABLE_COCKPIT_MAX_EDITABLE_FILE_SIZE=5242880
-PUBLIC_STACKABLE_COCKPIT_UPLOAD_CONCURRENCY=3
-PUBLIC_STACKABLE_COCKPIT_INFINITE_SCROLL_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_CUT_COPY_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_PASTE_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_RENAME_ENABLED=true
-PUBLIC_STACKABLE_COCKPIT_STORAGE_MOVE_ENABLED=true
-DATABASE_HOST=localhost
-DATABASE_PORT=31432
-DATABASE_NAME=cockpit
-DATABASE_USER=cockpit
-DATABASE_PASSWORD=cockpit-dev-password
-EOF
-fi
-
-echo "Wrote $ENV_FILE"
-
-# 9. Create Kubernetes Secret for the Helm chart
-# ------------------------------------------------------------------
-echo ""
-echo "Creating stackable-cockpit-credentials Secret..."
-kubectl delete secret stackable-cockpit-credentials --ignore-not-found
-kubectl create secret generic stackable-cockpit-credentials \
-  --from-literal=oidc-client-secret="$SECRET" \
-  --from-literal=trino-auth-password=stackable-cockpit-dev
-
-# ------------------------------------------------------------------
-# 10. Wait for Trino to be ready
-# ------------------------------------------------------------------
-if [[ "$SKIP_TRINO" == false ]]; then
-  echo ""
-  echo "Waiting for Trino to be ready..."
-  kubectl rollout status statefulset/trino-coordinator-default --timeout=300s
-
-  echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
-fi
-
-# ------------------------------------------------------------------
-# Done
-# ------------------------------------------------------------------
-echo ""
-echo "=== Setup complete ==="
-echo ""
-echo "Start the dev server with:  npm run dev"
-echo ""
-echo "Keycloak:       http://${NODE_IP}:30080"
-echo "  Admin:        admin / admin"
-echo ""
-if [[ "$SKIP_TRINO" == false ]]; then
-  echo "Trino endpoint: https://${NODE_IP}:${TRINO_PORT}"
-  echo ""
-  echo "Trino connection is pre-configured via STACKABLE_COCKPIT_TRINO_* env vars."
-  echo ""
-else
-  echo "Trino was skipped. Add STACKABLE_COCKPIT_TRINO_* vars to $ENV_FILE manually when ready."
-  echo ""
-fi
-if [[ "$SKIP_GARAGE" == false ]]; then
-  echo "Garage S3:      http://${NODE_IP}:30900  (admin: http://${NODE_IP}:30902)"
-  echo "  Credentials written to s3-config.json for E2E tests."
-  echo ""
-fi
-if [[ "$SKIP_POSTGRESQL" == false ]]; then
-  echo "PostgreSQL:     localhost:31432"
-  echo "  Database:     cockpit"
-  echo "  User:         cockpit"
-  echo "  Password:     cockpit-dev-password"
-  echo "  Environment:  DATABASE_HOST, DATABASE_PORT, DATABASE_NAME, DATABASE_USER, DATABASE_PASSWORD"
-  echo ""
-fi
-echo "Test users (OIDC):"
-echo "  alice / alicealice"
-echo "  bob   / bobbob"
+# ── Phase 1: Bootstrap ──
+prerequisites::run
+NODE_IP=$(k8s::node_ip)
+export NODE_IP
+
+# ── Phase 2: Deploy services ──
+keycloak::deploy
+trino::deploy
+garage::deploy
+postgresql::deploy
+
+# ── Phase 3: Configure services ──
+keycloak::configure
+garage::init
+postgresql::migrate
+trino::probe
+
+# ── Phase 4: Finalise ──
+env::write
+secret::create
+trino::wait_for_ready
+summary::print

From 747be6c9dc35bf76b22fdabf52ead236f23a6ce2 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 24 Jul 2026 10:40:47 +0200
Subject: [PATCH 115/136] Update Tests to current Feature Set (#256)

* add e2e and unit tests to reach full feature coverage

* add e2e and unit tests to reach full feature coverage 2

* add e2e and unit tests to reach full feature coverage 3

* add e2e and unit tests to reach full feature coverage 4
---
 e2e/storage/create.spec.ts                    |  82 ++++++
 e2e/storage/delete.spec.ts                    |  31 +++
 e2e/storage/file-operations.spec.ts           |  10 +-
 e2e/storage/toast.spec.ts                     |  57 ++++
 e2e/storage/tooltip.spec.ts                   |  38 +++
 e2e/trino/trino-tabs.spec.ts                  |  24 ++
 src/lib/client/feature-flags.spec.ts          |  40 +++
 src/lib/client/feature-flags.ts               |   2 +-
 src/lib/components/Modal.svelte.spec.ts       |  36 +++
 src/lib/components/ToastHost.svelte.spec.ts   |  50 ++++
 src/lib/components/Tooltip.svelte.spec.ts     |  64 +++++
 .../storage/explorer/ObjectTable.svelte       |   1 +
 .../storage/explorer/StorageBreadcrumb.svelte |   1 -
 .../storage/modals/MoveConfirmModal.svelte    |   2 +-
 src/lib/server/auth-utils.test.ts             |  19 ++
 src/lib/server/feature-flags.test.ts          |  53 ++++
 src/lib/server/feature-flags.ts               |   2 +-
 src/lib/storage/connection-id-header.spec.ts  |  37 +++
 .../storage/connection-store.svelte.spec.ts   |  59 ++++
 src/lib/storage/display-helpers.spec.ts       | 182 ++++++++++++
 src/lib/storage/errors.spec.ts                |  83 ++++++
 src/lib/storage/ndjson-stream.spec.ts         | 194 +++++++++++++
 src/lib/storage/schemas.spec.ts               | 220 +++++++++++++++
 src/lib/storage/utils.spec.ts                 |  98 +++++++
 src/lib/stores/tab-store.svelte.spec.ts       | 260 ++++++++++++++++++
 src/lib/stores/toast.svelte.spec.ts           |  72 +++++
 26 files changed, 1712 insertions(+), 5 deletions(-)
 create mode 100644 e2e/storage/create.spec.ts
 create mode 100644 e2e/storage/toast.spec.ts
 create mode 100644 e2e/storage/tooltip.spec.ts
 create mode 100644 src/lib/client/feature-flags.spec.ts
 create mode 100644 src/lib/components/Modal.svelte.spec.ts
 create mode 100644 src/lib/components/ToastHost.svelte.spec.ts
 create mode 100644 src/lib/components/Tooltip.svelte.spec.ts
 create mode 100644 src/lib/server/auth-utils.test.ts
 create mode 100644 src/lib/server/feature-flags.test.ts
 create mode 100644 src/lib/storage/connection-id-header.spec.ts
 create mode 100644 src/lib/storage/connection-store.svelte.spec.ts
 create mode 100644 src/lib/storage/display-helpers.spec.ts
 create mode 100644 src/lib/storage/errors.spec.ts
 create mode 100644 src/lib/storage/ndjson-stream.spec.ts
 create mode 100644 src/lib/storage/schemas.spec.ts
 create mode 100644 src/lib/storage/utils.spec.ts
 create mode 100644 src/lib/stores/tab-store.svelte.spec.ts
 create mode 100644 src/lib/stores/toast.svelte.spec.ts

diff --git a/e2e/storage/create.spec.ts b/e2e/storage/create.spec.ts
new file mode 100644
index 00000000..7c374f0a
--- /dev/null
+++ b/e2e/storage/create.spec.ts
@@ -0,0 +1,82 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import { connectAndOpenPrefix, deleteKnownKeys, objectExists, uniquePrefix } from './helpers.js';
+
+test.describe('Storage S3 — Create via context menu', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('creates a text file via empty-space right-click context menu', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'create-file');
+    const newFile = `${prefix}hello.txt`;
+    const cleanupKeys = [newFile];
+
+    try {
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Right-click on the empty-state row to trigger the empty-space context menu
+      await page.getByText('This bucket is empty').click({ button: 'right' });
+      await expect(page.getByRole('menu')).toBeVisible();
+
+      await page.getByRole('menuitem', { name: 'New text file' }).click();
+
+      // The create modal appears with the name pre-filled
+      const input = page.locator('.modal-box input');
+      await expect(input).toBeVisible();
+      await input.fill('hello.txt');
+
+      await page.getByRole('dialog').getByRole('button', { name: 'Create' }).click();
+
+      // Wait for the file to appear in the listing
+      await page.waitForTimeout(1500);
+
+      expect(await objectExists(client, credentials.bucket, newFile)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+
+  test('creates a folder via empty-space right-click context menu', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'create-folder');
+    const newFolder = `${prefix}my-folder/`;
+    const cleanupKeys = [newFolder];
+
+    try {
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      await page.getByText('This bucket is empty').click({ button: 'right' });
+      await expect(page.getByRole('menu')).toBeVisible();
+
+      await page.getByRole('menuitem', { name: 'New directory' }).click();
+
+      const input = page.locator('.modal-box input');
+      await expect(input).toBeVisible();
+      await input.fill('my-folder');
+
+      await page.getByRole('dialog').getByRole('button', { name: 'Create' }).click();
+
+      // Wait for the folder to appear in the listing
+      await page.waitForTimeout(1500);
+
+      expect(await objectExists(client, credentials.bucket, newFolder)).toBe(true);
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/delete.spec.ts b/e2e/storage/delete.spec.ts
index d647838f..a4ed22ba 100644
--- a/e2e/storage/delete.spec.ts
+++ b/e2e/storage/delete.spec.ts
@@ -119,4 +119,35 @@ test.describe('Storage S3 — Delete & Selection', () => {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
   });
+
+  test('Delete keyboard shortcut opens the delete confirmation modal', async ({
+    page
+  }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'kb-delete');
+    const cleanupKeys = [`${prefix}delete-me.txt`];
+
+    try {
+      await putTextObject(client, credentials.bucket, `${prefix}delete-me.txt`, 'delete me');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Select the file by clicking on the row
+      await rowByName(page, 'delete-me.txt').click();
+
+      // Press Delete key
+      await page.keyboard.press('Delete');
+
+      // Delete confirmation modal should appear
+      await expect(page.getByRole('heading', { name: /Delete.*delete-me.txt/i })).toBeVisible();
+      await expect(page.getByText('This action cannot be undone.')).toBeVisible();
+
+      // Cancel the delete
+      await page.getByRole('button', { name: 'Cancel' }).click();
+      await expect(page.getByRole('heading', { name: /Delete.*delete-me.txt/i })).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
 });
diff --git a/e2e/storage/file-operations.spec.ts b/e2e/storage/file-operations.spec.ts
index 4223595a..383bbc8d 100644
--- a/e2e/storage/file-operations.spec.ts
+++ b/e2e/storage/file-operations.spec.ts
@@ -133,7 +133,15 @@ test.describe('Storage S3 — File Operations', () => {
       await page.waitForTimeout(1000);
 
       // Should show error toast about source not found
-      await expect(page.getByText(/could not paste|source.*deleted/i)).toBeVisible();
+      const errorMsg = page.getByText(/could not paste|source.*deleted/i);
+      await expect(errorMsg).toBeVisible();
+
+      // The toast also has a Dismiss button
+      const toast = page.getByRole('alert').filter({ hasText: /could not paste|source.*deleted/i });
+      const dismissBtn = toast.getByRole('button', { name: 'Dismiss' });
+      await expect(dismissBtn).toBeVisible();
+      await dismissBtn.click();
+      await expect(toast).not.toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
diff --git a/e2e/storage/toast.spec.ts b/e2e/storage/toast.spec.ts
new file mode 100644
index 00000000..86c76b10
--- /dev/null
+++ b/e2e/storage/toast.spec.ts
@@ -0,0 +1,57 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import {
+  connectAndOpenPrefix,
+  deleteKnownKeys,
+  putTextObject,
+  rowByName,
+  uniquePrefix
+} from './helpers.js';
+
+test.describe('Storage S3 — Toast notifications', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  test('copying a file shows a success toast with a dismiss button', async ({ page }, testInfo) => {
+    const credentials = requireGarageCredentials();
+    const client = createS3Client(credentials);
+    const prefix = uniquePrefix(testInfo, 'toast-copy');
+    const srcFile = `${prefix}toast-test.txt`;
+    const cleanupKeys = [srcFile];
+
+    try {
+      await putTextObject(client, credentials.bucket, srcFile, 'toast test content');
+
+      await connectAndOpenPrefix(page, credentials, prefix);
+
+      // Copy the file via context menu — triggers a success toast
+      await rowByName(page, 'toast-test.txt').click({ button: 'right' });
+      await page.getByRole('menuitem', { name: 'Copy', exact: true }).click();
+      await page.waitForTimeout(500);
+
+      // Verify the success toast appears with the correct role
+      const toast = page.getByRole('alert').filter({ hasText: /copied/i });
+      await expect(toast).toBeVisible();
+
+      // Verify the toast has a Dismiss button
+      const dismissBtn = toast.getByRole('button', { name: 'Dismiss' });
+      await expect(dismissBtn).toBeVisible();
+
+      // Click Dismiss and verify the toast disappears
+      await dismissBtn.click();
+      await expect(toast).not.toBeVisible();
+    } finally {
+      await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
+    }
+  });
+});
diff --git a/e2e/storage/tooltip.spec.ts b/e2e/storage/tooltip.spec.ts
new file mode 100644
index 00000000..ebf6673f
--- /dev/null
+++ b/e2e/storage/tooltip.spec.ts
@@ -0,0 +1,38 @@
+import { test, expect } from '@playwright/test';
+import {
+  createS3Client,
+  hasGarageCredentials,
+  requireGarageCredentials
+} from '../support/garage.js';
+import { connectAndOpenPrefix } from './helpers.js';
+
+test.describe('Storage S3 — Tooltips', () => {
+  test.use({ locale: 'en-US' });
+
+  test.beforeEach(() => {
+    test.skip(
+      !hasGarageCredentials(),
+      'Skipped: no s3-config.json found (requires a running Garage instance)'
+    );
+  });
+
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  test('hovering over a sidebar bucket name shows a tooltip', async ({ page }, _testInfo) => {
+    const credentials = requireGarageCredentials();
+    createS3Client(credentials);
+
+    await connectAndOpenPrefix(page, credentials, '');
+
+    // Find the sidebar bucket link for the configured bucket
+    const bucketLink = page.locator('nav a').filter({ hasText: credentials.bucket }).first();
+    await expect(bucketLink).toBeVisible();
+
+    // Hover over the bucket link to trigger onmouseenter → showTooltip
+    await bucketLink.hover();
+
+    // Verify a tooltip element appears with the bucket name
+    const tooltip = page.getByRole('tooltip');
+    await expect(tooltip).toBeVisible();
+    await expect(tooltip).toContainText(credentials.bucket);
+  });
+});
diff --git a/e2e/trino/trino-tabs.spec.ts b/e2e/trino/trino-tabs.spec.ts
index 9e890af6..6adb1f71 100644
--- a/e2e/trino/trino-tabs.spec.ts
+++ b/e2e/trino/trino-tabs.spec.ts
@@ -59,6 +59,30 @@ test.describe('Trino editor tabs', () => {
     await expect(tabs).toHaveCount(1);
   });
 
+  test('close non-active tab removes it and preserves active tab', async ({ page }) => {
+    await setTabState(page, [{ sql: 'SELECT 1' }, { sql: 'SELECT 2' }]);
+    await page.goto('/trino');
+    await waitForHydration(page);
+
+    const tabs = page.locator('[role="tab"]');
+    await expect(tabs).toHaveCount(2);
+
+    // Switch to the second tab to make it active
+    await tabs.nth(1).click();
+    await expect(tabs.nth(1)).toHaveAttribute('aria-selected', 'true');
+
+    // Close the first (non-active) tab
+    const closeBtn = tabs
+      .nth(0)
+      .locator('..')
+      .getByRole('button', { name: /Close tab/ });
+    await closeBtn.click();
+
+    // Only one tab remains with default label — it should still be active
+    await expect(page.locator('[role="tab"]')).toHaveCount(1);
+    await expect(page.locator('[role="tab"]').nth(0)).toHaveAttribute('aria-selected', 'true');
+  });
+
   test('cannot close last remaining tab', async ({ page }) => {
     // With only one tab, close button should not be visible.
     const tabs = page.locator('[role="tab"]');
diff --git a/src/lib/client/feature-flags.spec.ts b/src/lib/client/feature-flags.spec.ts
new file mode 100644
index 00000000..1411143a
--- /dev/null
+++ b/src/lib/client/feature-flags.spec.ts
@@ -0,0 +1,40 @@
+import { describe, it, expect } from 'vitest';
+import { parsePageSizes } from './feature-flags.js';
+
+describe('parsePageSizes', () => {
+  it('defaults to [25, 50, 100] when raw is undefined', () => {
+    expect(parsePageSizes(undefined)).toEqual([25, 50, 100]);
+  });
+
+  it('defaults to [25, 50, 100] when raw is empty string', () => {
+    expect(parsePageSizes('')).toEqual([25, 50, 100]);
+  });
+
+  it('parses comma-separated values', () => {
+    expect(parsePageSizes('10,20,50')).toEqual([10, 20, 50]);
+  });
+
+  it('deduplicates values', () => {
+    expect(parsePageSizes('25,50,25,100,50')).toEqual([25, 50, 100]);
+  });
+
+  it('sorts ascending', () => {
+    expect(parsePageSizes('100,25,50')).toEqual([25, 50, 100]);
+  });
+
+  it('filters out non-positive integers', () => {
+    expect(parsePageSizes('0,-5,10,abc,25')).toEqual([10, 25]);
+  });
+
+  it('trims whitespace around values', () => {
+    expect(parsePageSizes(' 10 , 25 , 50 ')).toEqual([10, 25, 50]);
+  });
+
+  it('falls back when all values are filtered out', () => {
+    expect(parsePageSizes('0,-1,abc')).toEqual([25, 50, 100]);
+  });
+
+  it('handles single value', () => {
+    expect(parsePageSizes('42')).toEqual([42]);
+  });
+});
diff --git a/src/lib/client/feature-flags.ts b/src/lib/client/feature-flags.ts
index 43e34c03..004349a7 100644
--- a/src/lib/client/feature-flags.ts
+++ b/src/lib/client/feature-flags.ts
@@ -42,7 +42,7 @@ export const infiniteScrollEnabled =
 /** Parse a comma-separated page-sizes string into a deduplicated, sorted list
  *  of positive integers. Falls back to [25, 50, 100] when the value is absent
  *  or produces no valid entries. */
-function parsePageSizes(raw: string | undefined): readonly number[] {
+export function parsePageSizes(raw: string | undefined): readonly number[] {
   if (raw) {
     const parsed = raw
       .split(',')
diff --git a/src/lib/components/Modal.svelte.spec.ts b/src/lib/components/Modal.svelte.spec.ts
new file mode 100644
index 00000000..c96176d4
--- /dev/null
+++ b/src/lib/components/Modal.svelte.spec.ts
@@ -0,0 +1,36 @@
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import Modal from './Modal.svelte';
+import type { Snippet } from 'svelte';
+
+function textSnippet(text: string): Snippet {
+  return (() => text) as unknown as Snippet;
+}
+
+describe('Modal', () => {
+  it('does not open the dialog when open is false', () => {
+    render(Modal, { open: false, children: textSnippet('Content') });
+    const dialog = document.querySelector('dialog');
+    expect(dialog?.open).toBe(false);
+  });
+
+  it('opens the dialog when open is true', () => {
+    render(Modal, { open: true, children: textSnippet('Content') });
+    const dialog = document.querySelector('dialog');
+    // showModal() does not set the open attribute in the spec, but
+    // the native <dialog> open property reflects the open state.
+    expect(dialog?.open).toBe(true);
+  });
+
+  it('renders the dialog element', () => {
+    render(Modal, { open: true, children: textSnippet('Content') });
+    const dialog = document.querySelector('dialog');
+    expect(dialog).not.toBeNull();
+  });
+
+  it('applies custom class', () => {
+    render(Modal, { open: true, class: 'my-custom-class', children: textSnippet('Content') });
+    const dialog = document.querySelector('dialog');
+    expect(dialog?.className).toContain('my-custom-class');
+  });
+});
diff --git a/src/lib/components/ToastHost.svelte.spec.ts b/src/lib/components/ToastHost.svelte.spec.ts
new file mode 100644
index 00000000..114dc574
--- /dev/null
+++ b/src/lib/components/ToastHost.svelte.spec.ts
@@ -0,0 +1,50 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it, beforeEach } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import ToastHost from './ToastHost.svelte';
+import { toasts, addToast } from '$lib/stores/toast.svelte.js';
+
+beforeEach(() => {
+  toasts.length = 0;
+});
+
+describe('ToastHost', () => {
+  it('renders nothing when there are no toasts', () => {
+    render(ToastHost);
+    expect(page.getByRole('alert').query()).toBeNull();
+  });
+
+  it('renders a toast added before render', () => {
+    addToast('info', 'Pre-existing toast');
+    render(ToastHost);
+    expect(page.getByText('Pre-existing toast').query()).not.toBeNull();
+  });
+
+  it('labels the dismiss button', () => {
+    addToast('info', 'Hello');
+    render(ToastHost);
+    const dismissBtn = page.getByRole('button', { name: 'Dismiss' });
+    expect(dismissBtn.query()).not.toBeNull();
+  });
+
+  it('renders multiple pre-existing toasts', () => {
+    addToast('info', 'First');
+    addToast('success', 'Second');
+    render(ToastHost);
+    const alerts = document.querySelectorAll('[role="alert"]');
+    expect(alerts.length).toBe(2);
+  });
+
+  it('renders action buttons when toast has actions', () => {
+    addToast('warning', 'With action', 5000, [{ label: 'Undo', onClick: () => {} }]);
+    render(ToastHost);
+    const undoBtn = page.getByText('Undo');
+    expect(undoBtn.query()).not.toBeNull();
+  });
+
+  it('has aria-live="polite" for screen reader announcements', () => {
+    render(ToastHost);
+    const container = document.querySelector('[aria-live="polite"]');
+    expect(container).not.toBeNull();
+  });
+});
diff --git a/src/lib/components/Tooltip.svelte.spec.ts b/src/lib/components/Tooltip.svelte.spec.ts
new file mode 100644
index 00000000..0ec9535a
--- /dev/null
+++ b/src/lib/components/Tooltip.svelte.spec.ts
@@ -0,0 +1,64 @@
+import { page } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import Tooltip from './Tooltip.svelte';
+
+describe('Tooltip', () => {
+  it('renders tooltip text', async () => {
+    render(Tooltip, { text: 'Helpful info', x: 100, y: 200 });
+    const tooltip = page.getByText('Helpful info');
+    await expect.element(tooltip).toBeInTheDocument();
+  });
+
+  it('has role="tooltip"', async () => {
+    render(Tooltip, { text: 'Info', x: 0, y: 0 });
+    const tooltip = page.getByRole('tooltip');
+    await expect.element(tooltip).toBeInTheDocument();
+  });
+
+  it('does not render when text is null', () => {
+    render(Tooltip, { text: null, x: 100, y: 200 });
+    expect(page.getByRole('tooltip').query()).toBeNull();
+  });
+
+  it('does not render when text is empty string', () => {
+    render(Tooltip, { text: '', x: 100, y: 200 });
+    expect(page.getByRole('tooltip').query()).toBeNull();
+  });
+
+  it('positions based on right orientation (default)', async () => {
+    render(Tooltip, { text: 'Right', x: 50, y: 100 });
+    const tooltip = page.getByRole('tooltip');
+    const el = await tooltip.element();
+    const style = el.getAttribute('style');
+    expect(style).toContain('left: 56px');
+    expect(style).toContain('top: 100px');
+  });
+
+  it('positions based on left orientation', async () => {
+    render(Tooltip, { text: 'Left', x: 50, y: 100, orientation: 'left' });
+    const tooltip = page.getByRole('tooltip');
+    const el = await tooltip.element();
+    const style = el.getAttribute('style');
+    expect(style).toContain('left: 44px');
+    expect(style).toContain('top: 100px');
+  });
+
+  it('positions based on up orientation', async () => {
+    render(Tooltip, { text: 'Up', x: 50, y: 100, orientation: 'up' });
+    const tooltip = page.getByRole('tooltip');
+    const el = await tooltip.element();
+    const style = el.getAttribute('style');
+    expect(style).toContain('left: 50px');
+    expect(style).toContain('top: 94px');
+  });
+
+  it('positions based on down orientation', async () => {
+    render(Tooltip, { text: 'Down', x: 50, y: 100, orientation: 'down' });
+    const tooltip = page.getByRole('tooltip');
+    const el = await tooltip.element();
+    const style = el.getAttribute('style');
+    expect(style).toContain('left: 50px');
+    expect(style).toContain('top: 106px');
+  });
+});
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 42fd6b3d..6768e094 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -180,6 +180,7 @@
 
 <div
   bind:this={scrollContainer}
+  role="region"
   class="h-full overflow-x-auto overflow-y-auto {tableDragOver
     ? 'outline-primary/40 outline -outline-offset-2 outline-dashed'
     : ''}"
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 3e820cfd..e91e4766 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -616,7 +616,6 @@
           <input
             id="create-name-input"
             class="input input-sm w-full"
-            autofocus
             value={createName}
             placeholder={m.storage_create_placeholder()}
             oninput={(e) => {
diff --git a/src/lib/components/storage/modals/MoveConfirmModal.svelte b/src/lib/components/storage/modals/MoveConfirmModal.svelte
index d028b073..9f188fcc 100644
--- a/src/lib/components/storage/modals/MoveConfirmModal.svelte
+++ b/src/lib/components/storage/modals/MoveConfirmModal.svelte
@@ -87,7 +87,7 @@
       <button class="btn btn-ghost btn-sm" onclick={onCancel}>
         {m.storage_move_confirm_cancel()}
       </button>
-      <button class="btn btn-primary btn-sm" onclick={onConfirm} autofocus>
+      <button class="btn btn-primary btn-sm" onclick={onConfirm}>
         {m.storage_move_confirm_label()}
       </button>
     </div>
diff --git a/src/lib/server/auth-utils.test.ts b/src/lib/server/auth-utils.test.ts
new file mode 100644
index 00000000..38f63988
--- /dev/null
+++ b/src/lib/server/auth-utils.test.ts
@@ -0,0 +1,19 @@
+import { describe, it, expect } from 'vitest';
+import { getUserId } from './auth-utils.js';
+
+describe('getUserId', () => {
+  it('returns the user ID when user is present', () => {
+    const locals = { user: { id: 'user-abc-123' } } as App.Locals;
+    expect(getUserId(locals)).toBe('user-abc-123');
+  });
+
+  it('returns "anonymous" when user is undefined', () => {
+    const locals = {} as App.Locals;
+    expect(getUserId(locals)).toBe('anonymous');
+  });
+
+  it('returns "anonymous" when user has no id', () => {
+    const locals = { user: {} } as App.Locals;
+    expect(getUserId(locals)).toBe('anonymous');
+  });
+});
diff --git a/src/lib/server/feature-flags.test.ts b/src/lib/server/feature-flags.test.ts
new file mode 100644
index 00000000..1a9cdbbc
--- /dev/null
+++ b/src/lib/server/feature-flags.test.ts
@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest';
+import { parseParquetDisallowed } from './feature-flags.js';
+
+describe('parseParquetDisallowed', () => {
+  it('defaults to GZIP with requireOffsetIndex when value is undefined', () => {
+    expect(parseParquetDisallowed(undefined)).toEqual([
+      { codec: 'GZIP', requireOffsetIndex: true }
+    ]);
+  });
+
+  it('defaults to GZIP with requireOffsetIndex when value is empty string', () => {
+    expect(parseParquetDisallowed('')).toEqual([{ codec: 'GZIP', requireOffsetIndex: true }]);
+  });
+
+  it('parses a single codec without suffix', () => {
+    expect(parseParquetDisallowed('zstd')).toEqual([{ codec: 'ZSTD', requireOffsetIndex: false }]);
+  });
+
+  it('parses a codec with -no_offset suffix', () => {
+    expect(parseParquetDisallowed('gzip-no_offset')).toEqual([
+      { codec: 'GZIP', requireOffsetIndex: true }
+    ]);
+  });
+
+  it('parses comma-separated list with mixed suffixes', () => {
+    expect(parseParquetDisallowed('gzip-no_offset,zstd,snappy-no_offset')).toEqual([
+      { codec: 'GZIP', requireOffsetIndex: true },
+      { codec: 'ZSTD', requireOffsetIndex: false },
+      { codec: 'SNAPPY', requireOffsetIndex: true }
+    ]);
+  });
+
+  it('converts codec names to uppercase', () => {
+    expect(parseParquetDisallowed('Gzip,Zstd')).toEqual([
+      { codec: 'GZIP', requireOffsetIndex: false },
+      { codec: 'ZSTD', requireOffsetIndex: false }
+    ]);
+  });
+
+  it('filters out empty entries', () => {
+    expect(parseParquetDisallowed('gzip,,zstd')).toEqual([
+      { codec: 'GZIP', requireOffsetIndex: false },
+      { codec: 'ZSTD', requireOffsetIndex: false }
+    ]);
+  });
+
+  it('trims whitespace', () => {
+    expect(parseParquetDisallowed(' gzip , zstd ')).toEqual([
+      { codec: 'GZIP', requireOffsetIndex: false },
+      { codec: 'ZSTD', requireOffsetIndex: false }
+    ]);
+  });
+});
diff --git a/src/lib/server/feature-flags.ts b/src/lib/server/feature-flags.ts
index b9a95e9d..6289074f 100644
--- a/src/lib/server/feature-flags.ts
+++ b/src/lib/server/feature-flags.ts
@@ -81,7 +81,7 @@ export interface ParquetDisallowedCompression {
   requireOffsetIndex: boolean;
 }
 
-function parseParquetDisallowed(value: string | undefined): ParquetDisallowedCompression[] {
+export function parseParquetDisallowed(value: string | undefined): ParquetDisallowedCompression[] {
   if (!value) return [{ codec: 'GZIP', requireOffsetIndex: true }];
   return value
     .split(',')
diff --git a/src/lib/storage/connection-id-header.spec.ts b/src/lib/storage/connection-id-header.spec.ts
new file mode 100644
index 00000000..5773b94d
--- /dev/null
+++ b/src/lib/storage/connection-id-header.spec.ts
@@ -0,0 +1,37 @@
+import { describe, it, expect } from 'vitest';
+import { STORAGE_CONNECTION_ID_HEADER, type SavedConnection } from './connection-id-header.js';
+
+describe('STORAGE_CONNECTION_ID_HEADER', () => {
+  it('exports the expected header name', () => {
+    expect(STORAGE_CONNECTION_ID_HEADER).toBe('x-storage-connection-id');
+  });
+});
+
+describe('SavedConnection type', () => {
+  it('is structurally compatible with a valid connection object', () => {
+    const conn: SavedConnection = {
+      id: '550e8400-e29b-41d4-a716-446655440000',
+      name: 'My S3',
+      host: 's3.example.com',
+      port: 443,
+      type: 's3',
+      region: { name: 'us-east-1' },
+      credentials: { accessKey: 'AKID', secretKey: 'secret' }
+    };
+    expect(conn.id).toBe('550e8400-e29b-41d4-a716-446655440000');
+    expect(conn.type).toBe('s3');
+  });
+
+  it('allows optional port and credentials', () => {
+    const conn: SavedConnection = {
+      id: '550e8400-e29b-41d4-a716-446655440001',
+      name: 'Minimal',
+      host: 'minio.example.com',
+      port: null,
+      type: 's3',
+      region: { name: 'eu-central-1' }
+    };
+    expect(conn.host).toBe('minio.example.com');
+    expect(conn.port).toBeNull();
+  });
+});
diff --git a/src/lib/storage/connection-store.svelte.spec.ts b/src/lib/storage/connection-store.svelte.spec.ts
new file mode 100644
index 00000000..e52b1782
--- /dev/null
+++ b/src/lib/storage/connection-store.svelte.spec.ts
@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { connectionStore, type ConnectionListItem } from './connection-store.svelte.js';
+
+describe('connectionStore', () => {
+  it('starts with null activeConnectionId', () => {
+    expect(connectionStore.activeConnectionId).toBeNull();
+  });
+
+  it('starts with empty connections', () => {
+    expect(connectionStore.connections).toEqual([]);
+  });
+
+  it('activeConnection returns null when no connection is active', () => {
+    expect(connectionStore.activeConnection).toBeNull();
+  });
+
+  it('activeConnection returns null when activeConnectionId does not match any connection', () => {
+    connectionStore.activeConnectionId = 'non-existent';
+    expect(connectionStore.activeConnection).toBeNull();
+  });
+
+  it('activeConnection returns matching connection', () => {
+    const conn: ConnectionListItem = {
+      id: 'conn-1',
+      name: 'My S3',
+      endpoint: 's3.example.com',
+      additionalBuckets: [],
+      createdAt: '2024-01-01',
+      updatedAt: '2024-01-02'
+    };
+    connectionStore.connections.push(conn);
+    connectionStore.activeConnectionId = 'conn-1';
+    expect(connectionStore.activeConnection).toEqual(conn);
+  });
+
+  it('handles switching activeConnectionId', () => {
+    const conn1: ConnectionListItem = {
+      id: 'c1',
+      name: 'First',
+      endpoint: null,
+      additionalBuckets: [],
+      createdAt: '',
+      updatedAt: ''
+    };
+    const conn2: ConnectionListItem = {
+      id: 'c2',
+      name: 'Second',
+      endpoint: null,
+      additionalBuckets: [],
+      createdAt: '',
+      updatedAt: ''
+    };
+    connectionStore.connections.push(conn1, conn2);
+    connectionStore.activeConnectionId = 'c1';
+    expect(connectionStore.activeConnection?.name).toBe('First');
+    connectionStore.activeConnectionId = 'c2';
+    expect(connectionStore.activeConnection?.name).toBe('Second');
+  });
+});
diff --git a/src/lib/storage/display-helpers.spec.ts b/src/lib/storage/display-helpers.spec.ts
new file mode 100644
index 00000000..769091e4
--- /dev/null
+++ b/src/lib/storage/display-helpers.spec.ts
@@ -0,0 +1,182 @@
+import { describe, it, expect, vi } from 'vitest';
+import {
+  storageHref,
+  pinnedLabel,
+  pinnedHref,
+  fileName,
+  fileLocation,
+  fileHref,
+  locationName,
+  locationPath,
+  locationHref
+} from './display-helpers.js';
+import type { PinnedLocation, RecentFile, RecentLocation } from './types.js';
+
+vi.mock('$app/paths', () => ({
+  resolve: (_route: string, params: Record<string, string>) => {
+    const bucket = params.bucket ?? '';
+    const prefix = params.prefix ?? '';
+    return `/storage/${bucket}${prefix ? '/' + prefix : ''}` as never;
+  }
+}));
+
+describe('storageHref', () => {
+  it('generates href for bucket root', () => {
+    expect(storageHref('my-bucket', '')).toBe('/storage/my-bucket');
+  });
+
+  it('generates href with prefix', () => {
+    expect(storageHref('my-bucket', 'some/path')).toBe('/storage/my-bucket/some/path');
+  });
+
+  it('encodes special characters in bucket', () => {
+    expect(storageHref('my bucket', '')).toBe('/storage/my%20bucket');
+  });
+
+  it('encodes special characters in prefix segments', () => {
+    expect(storageHref('bucket', 'path/with spaces/file.txt')).toBe(
+      '/storage/bucket/path/with%20spaces/file.txt'
+    );
+  });
+});
+
+describe('pinnedLabel', () => {
+  it('returns bucket name when no prefix', () => {
+    const pin: PinnedLocation = { connectionId: 'c1', bucket: 'my-bucket', prefix: '' };
+    expect(pinnedLabel(pin)).toBe('my-bucket');
+  });
+
+  it('returns last segment of prefix', () => {
+    const pin: PinnedLocation = {
+      connectionId: 'c1',
+      bucket: 'my-bucket',
+      prefix: 'a/b/deep-path'
+    };
+    expect(pinnedLabel(pin)).toBe('deep-path');
+  });
+});
+
+describe('pinnedHref', () => {
+  it('generates href from pinned location', () => {
+    const pin: PinnedLocation = { connectionId: 'c1', bucket: 'my-bucket', prefix: 'some/path' };
+    expect(pinnedHref(pin)).toBe('/storage/my-bucket/some/path');
+  });
+});
+
+describe('fileName', () => {
+  it('extracts filename from key', () => {
+    expect(fileName('path/to/file.txt')).toBe('file.txt');
+  });
+
+  it('handles root-level key', () => {
+    expect(fileName('file.txt')).toBe('file.txt');
+  });
+
+  it('handles trailing slash', () => {
+    expect(fileName('path/to/dir/')).toBe('dir');
+  });
+});
+
+describe('fileLocation', () => {
+  it('returns bucket name for root-level file', () => {
+    const file: RecentFile = {
+      key: 'file.txt',
+      bucket: 'my-bucket',
+      size: 100,
+      visitedAt: '2024-01-01',
+      connectionId: 'c1'
+    };
+    expect(fileLocation(file)).toBe('my-bucket');
+  });
+
+  it('returns bucket with path segments for nested file', () => {
+    const file: RecentFile = {
+      key: 'a/b/c/file.txt',
+      bucket: 'my-bucket',
+      size: 100,
+      visitedAt: '2024-01-01',
+      connectionId: 'c1'
+    };
+    expect(fileLocation(file)).toBe('my-bucket / a / b / c');
+  });
+});
+
+describe('fileHref', () => {
+  it('generates href to parent directory of the file', () => {
+    const file: RecentFile = {
+      key: 'a/b/file.txt',
+      bucket: 'my-bucket',
+      size: 100,
+      visitedAt: '2024-01-01',
+      connectionId: 'c1'
+    };
+    expect(fileHref(file)).toBe('/storage/my-bucket/a/b');
+  });
+
+  it('generates href to bucket root for top-level file', () => {
+    const file: RecentFile = {
+      key: 'file.txt',
+      bucket: 'my-bucket',
+      size: 100,
+      visitedAt: '2024-01-01',
+      connectionId: 'c1'
+    };
+    expect(fileHref(file)).toBe('/storage/my-bucket');
+  });
+});
+
+describe('locationName', () => {
+  it('returns bucket name when no prefix', () => {
+    const loc: RecentLocation = {
+      bucket: 'my-bucket',
+      prefix: '',
+      visitedAt: '',
+      connectionId: 'c1'
+    };
+    expect(locationName(loc)).toBe('my-bucket');
+  });
+
+  it('returns last prefix segment', () => {
+    const loc: RecentLocation = {
+      bucket: 'my-bucket',
+      prefix: 'a/b/c',
+      visitedAt: '',
+      connectionId: 'c1'
+    };
+    expect(locationName(loc)).toBe('c');
+  });
+});
+
+describe('locationPath', () => {
+  it('returns bucket name when no prefix', () => {
+    const loc: RecentLocation = {
+      bucket: 'my-bucket',
+      prefix: '',
+      visitedAt: '',
+      connectionId: 'c1'
+    };
+    expect(locationPath(loc)).toBe('my-bucket');
+  });
+
+  it('returns bucket / prefix path', () => {
+    const loc: RecentLocation = {
+      bucket: 'my-bucket',
+      prefix: 'a/b/c',
+      visitedAt: '',
+      connectionId: 'c1'
+    };
+    expect(locationPath(loc)).toBe('my-bucket / a / b / c');
+  });
+});
+
+describe('locationHref', () => {
+  it('generates href from recent location', () => {
+    const loc: RecentLocation = {
+      bucket: 'my-bucket',
+      prefix: 'some/path',
+      visitedAt: '',
+      connectionId: 'c1'
+    };
+    expect(locationHref(loc)).toBe('/storage/my-bucket/some/path');
+  });
+});
diff --git a/src/lib/storage/errors.spec.ts b/src/lib/storage/errors.spec.ts
new file mode 100644
index 00000000..25a626b6
--- /dev/null
+++ b/src/lib/storage/errors.spec.ts
@@ -0,0 +1,83 @@
+import { describe, it, expect, vi } from 'vitest';
+import {
+  StorageError,
+  ActionError,
+  getActionErrorMessage,
+  getActionErrorMessageForCode
+} from './errors.js';
+
+const mockMessages = vi.hoisted(() => ({
+  storage_download_error_not_connected: () => 'No storage connection configured',
+  storage_download_error_access_denied: () => 'Access denied',
+  storage_download_error_not_found: () => 'File not found',
+  storage_download_error_server_error: () => 'Server error',
+  storage_upload_error_no_such_bucket: () => 'Bucket not found',
+  storage_upload_error_invalid_part: () => 'Invalid part',
+  storage_download_error_unknown: () => 'Unknown error'
+}));
+
+vi.mock('$lib/paraglide/messages.js', () => mockMessages);
+
+describe('StorageError', () => {
+  it('creates an error with code and message', () => {
+    const err = new StorageError('not_found', 'File was not found');
+    expect(err).toBeInstanceOf(Error);
+    expect(err.name).toBe('StorageError');
+    expect(err.code).toBe('not_found');
+    expect(err.message).toBe('File was not found');
+  });
+});
+
+describe('ActionError', () => {
+  it('extends StorageError with ActionError name', () => {
+    const err = new ActionError('access_denied', 'No access');
+    expect(err).toBeInstanceOf(StorageError);
+    expect(err).toBeInstanceOf(Error);
+    expect(err.name).toBe('ActionError');
+    expect(err.code).toBe('access_denied');
+    expect(err.message).toBe('No access');
+  });
+});
+
+describe('getActionErrorMessage', () => {
+  it('maps not_connected code', () => {
+    expect(getActionErrorMessage(new StorageError('not_connected', ''))).toBe(
+      'No storage connection configured'
+    );
+  });
+
+  it('maps access_denied code', () => {
+    expect(getActionErrorMessage(new StorageError('access_denied', ''))).toBe('Access denied');
+  });
+
+  it('maps not_found code', () => {
+    expect(getActionErrorMessage(new StorageError('not_found', ''))).toBe('File not found');
+  });
+
+  it('maps server_error code', () => {
+    expect(getActionErrorMessage(new StorageError('server_error', ''))).toBe('Server error');
+  });
+
+  it('maps no_such_bucket code', () => {
+    expect(getActionErrorMessage(new StorageError('no_such_bucket', ''))).toBe('Bucket not found');
+  });
+
+  it('maps invalid_part code', () => {
+    expect(getActionErrorMessage(new StorageError('invalid_part', ''))).toBe('Invalid part');
+  });
+
+  it('maps unknown code to unknown error message', () => {
+    expect(getActionErrorMessage(new StorageError('unknown', ''))).toBe('Unknown error');
+  });
+
+  it('maps any unrecognised code to unknown error message', () => {
+    expect(getActionErrorMessage(new StorageError('some_weird_code', ''))).toBe('Unknown error');
+  });
+});
+
+describe('getActionErrorMessageForCode', () => {
+  it('forwards to getActionErrorMessage with a StorageError', () => {
+    expect(getActionErrorMessageForCode('not_found')).toBe('File not found');
+    expect(getActionErrorMessageForCode('unknown')).toBe('Unknown error');
+  });
+});
diff --git a/src/lib/storage/ndjson-stream.spec.ts b/src/lib/storage/ndjson-stream.spec.ts
new file mode 100644
index 00000000..3b1b9f87
--- /dev/null
+++ b/src/lib/storage/ndjson-stream.spec.ts
@@ -0,0 +1,194 @@
+import { describe, it, expect, vi } from 'vitest';
+import { readNdjsonStream } from './ndjson-stream.js';
+
+function createStream(lines: string[]): ReadableStream<Uint8Array> {
+  const encoder = new TextEncoder();
+  return new ReadableStream({
+    start(controller) {
+      for (const line of lines) {
+        controller.enqueue(encoder.encode(line + '\n'));
+      }
+      controller.close();
+    }
+  });
+}
+
+describe('readNdjsonStream', () => {
+  it('returns empty results for null stream', async () => {
+    const result = await readNdjsonStream(null);
+    expect(result).toEqual({ results: [], failed: [] });
+  });
+
+  it('parses progress events and calls onProgress', async () => {
+    const onProgress = vi.fn();
+    const stream = createStream([
+      JSON.stringify({
+        type: 'progress',
+        sourceKey: 'a.txt',
+        destKey: 'b.txt',
+        loaded: 50,
+        total: 100
+      })
+    ]);
+
+    const result = await readNdjsonStream(stream, { onProgress });
+
+    expect(onProgress).toHaveBeenCalledWith('a.txt', 'b.txt', 50, 100);
+    expect(result.results).toEqual([]);
+    expect(result.failed).toEqual([]);
+  });
+
+  it('parses done events and accumulates results', async () => {
+    const onDone = vi.fn();
+    const stream = createStream([
+      JSON.stringify({ type: 'done', sourceKey: 'a.txt', destKey: 'b.txt' }),
+      JSON.stringify({ type: 'done', sourceKey: 'c.txt', destKey: 'd.txt' })
+    ]);
+
+    const result = await readNdjsonStream(stream, { onDone });
+
+    expect(result.results).toEqual([
+      { sourceKey: 'a.txt', destKey: 'b.txt' },
+      { sourceKey: 'c.txt', destKey: 'd.txt' }
+    ]);
+    expect(onDone).toHaveBeenCalledTimes(2);
+  });
+
+  it('ignores done events missing sourceKey or destKey', async () => {
+    const stream = createStream([
+      JSON.stringify({ type: 'done', sourceKey: '', destKey: 'b.txt' })
+    ]);
+
+    const result = await readNdjsonStream(stream);
+
+    expect(result.results).toEqual([]);
+  });
+
+  it('parses failed events and accumulates failures', async () => {
+    const onFailed = vi.fn();
+    const stream = createStream([
+      JSON.stringify({ type: 'failed', sourceKey: 'a.txt', error: 'Access denied' })
+    ]);
+
+    const result = await readNdjsonStream(stream, { onFailed });
+
+    expect(result.failed).toEqual([{ sourceKey: 'a.txt', error: 'Access denied' }]);
+    expect(onFailed).toHaveBeenCalledWith('a.txt', 'Access denied');
+  });
+
+  it('uses default error message when error field is missing', async () => {
+    const stream = createStream([JSON.stringify({ type: 'failed', sourceKey: 'a.txt' })]);
+
+    const result = await readNdjsonStream(stream);
+
+    expect(result.failed).toEqual([{ sourceKey: 'a.txt', error: 'Unknown error' }]);
+  });
+
+  it('ignores failed events missing sourceKey', async () => {
+    const stream = createStream([JSON.stringify({ type: 'failed', error: 'err' })]);
+
+    const result = await readNdjsonStream(stream);
+
+    expect(result.failed).toEqual([]);
+  });
+
+  it('handles complete event with results and failed', async () => {
+    const onComplete = vi.fn();
+    const stream = createStream([
+      JSON.stringify({
+        type: 'complete',
+        results: [{ sourceKey: 'a.txt', destKey: 'b.txt' }],
+        failed: [{ sourceKey: 'c.txt', error: 'err' }]
+      })
+    ]);
+
+    const result = await readNdjsonStream(stream, { onComplete });
+
+    expect(result.results).toEqual([{ sourceKey: 'a.txt', destKey: 'b.txt' }]);
+    expect(result.failed).toEqual([{ sourceKey: 'c.txt', error: 'err' }]);
+    expect(onComplete).toHaveBeenCalledWith(
+      [{ sourceKey: 'a.txt', destKey: 'b.txt' }],
+      [{ sourceKey: 'c.txt', error: 'err' }]
+    );
+  });
+
+  it('complete event replaces previously accumulated results', async () => {
+    const stream = createStream([
+      JSON.stringify({ type: 'done', sourceKey: 'old.txt', destKey: 'old2.txt' }),
+      JSON.stringify({ type: 'failed', sourceKey: 'old3.txt', error: 'err' }),
+      JSON.stringify({
+        type: 'complete',
+        results: [{ sourceKey: 'a.txt', destKey: 'b.txt' }],
+        failed: [{ sourceKey: 'c.txt', error: 'err2' }]
+      })
+    ]);
+
+    const result = await readNdjsonStream(stream);
+
+    expect(result.results).toEqual([{ sourceKey: 'a.txt', destKey: 'b.txt' }]);
+    expect(result.failed).toEqual([{ sourceKey: 'c.txt', error: 'err2' }]);
+  });
+
+  it('complete event with moved key (backward compat)', async () => {
+    const stream = createStream([
+      JSON.stringify({
+        type: 'complete',
+        moved: [{ sourceKey: 'a.txt', destKey: 'b.txt' }],
+        failed: []
+      })
+    ]);
+
+    const result = await readNdjsonStream(stream);
+
+    expect(result.results).toEqual([{ sourceKey: 'a.txt', destKey: 'b.txt' }]);
+  });
+
+  it('calls onStatus with message', async () => {
+    const onStatus = vi.fn();
+    const stream = createStream([JSON.stringify({ type: 'status', message: 'Processing...' })]);
+
+    await readNdjsonStream(stream, { onStatus });
+
+    expect(onStatus).toHaveBeenCalledWith('Processing...');
+  });
+
+  it('handles empty lines gracefully', async () => {
+    const stream = createStream([
+      '',
+      '  ',
+      JSON.stringify({ type: 'done', sourceKey: 'a.txt', destKey: 'b.txt' })
+    ]);
+
+    const result = await readNdjsonStream(stream);
+
+    expect(result.results).toEqual([{ sourceKey: 'a.txt', destKey: 'b.txt' }]);
+  });
+
+  it('handles chunked decoding across buffer boundaries', async () => {
+    const encoder = new TextEncoder();
+    const data = JSON.stringify({ type: 'done', sourceKey: 'a.txt', destKey: 'b.txt' }) + '\n';
+    const mid = Math.floor(data.length / 2);
+
+    const stream = new ReadableStream({
+      start(controller) {
+        controller.enqueue(encoder.encode(data.slice(0, mid)));
+        controller.enqueue(encoder.encode(data.slice(mid)));
+        controller.close();
+      }
+    });
+
+    const result = await readNdjsonStream(stream);
+
+    expect(result.results).toEqual([{ sourceKey: 'a.txt', destKey: 'b.txt' }]);
+  });
+
+  it('releases reader lock on completion', async () => {
+    const stream = createStream([
+      JSON.stringify({ type: 'done', sourceKey: 'a.txt', destKey: 'b.txt' })
+    ]);
+
+    await readNdjsonStream(stream);
+
+    expect(() => stream.getReader()).not.toThrow();
+  });
+});
diff --git a/src/lib/storage/schemas.spec.ts b/src/lib/storage/schemas.spec.ts
new file mode 100644
index 00000000..a4cf3508
--- /dev/null
+++ b/src/lib/storage/schemas.spec.ts
@@ -0,0 +1,220 @@
+import { describe, it, expect } from 'vitest';
+import {
+  StorageConnectionSchema,
+  EditStorageConnectionSchema,
+  ConnectionIdSchema
+} from './schemas.js';
+
+describe('StorageConnectionSchema', () => {
+  it('accepts a minimal valid connection', () => {
+    const result = StorageConnectionSchema.safeParse({ host: 's3.example.com' });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.host).toBe('s3.example.com');
+      expect(result.data.type).toBe('s3');
+      expect(result.data.accessStyle).toBe('VirtualHosted');
+      expect(result.data.region).toEqual({ name: 'us-east-1' });
+      expect(result.data.credentials).toEqual({ accessKey: '', secretKey: '' });
+    }
+  });
+
+  it('rejects missing host', () => {
+    const result = StorageConnectionSchema.safeParse({});
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects empty host', () => {
+    const result = StorageConnectionSchema.safeParse({ host: '' });
+    expect(result.success).toBe(false);
+  });
+
+  it('strips scheme from host when URL is provided', () => {
+    const result = StorageConnectionSchema.safeParse({ host: 'https://s3.example.com:9000' });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.host).toBe('s3.example.com');
+    }
+  });
+
+  it('strips scheme and path from complex URL', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 'http://storage.example.com/some/path'
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.host).toBe('storage.example.com');
+    }
+  });
+
+  it('accepts port', () => {
+    const result = StorageConnectionSchema.safeParse({ host: 's3.example.com', port: 9000 });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.port).toBe(9000);
+    }
+  });
+
+  it('rejects port out of range', () => {
+    const result = StorageConnectionSchema.safeParse({ host: 's3.example.com', port: 99999 });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts empty string port as undefined', () => {
+    const result = StorageConnectionSchema.safeParse({ host: 's3.example.com', port: '' });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.port).toBeUndefined();
+    }
+  });
+
+  it('accepts tls verification', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      tls: { verification: 'None' }
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.tls).toEqual({ verification: 'None' });
+    }
+  });
+
+  it('rejects tls with invalid verification value', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      tls: { verification: 'Invalid' }
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts accessStyle', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      accessStyle: 'Path'
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.accessStyle).toBe('Path');
+    }
+  });
+
+  it('accepts region override', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      region: { name: 'eu-west-1' }
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.region.name).toBe('eu-west-1');
+    }
+  });
+
+  it('rejects empty region name', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      region: { name: '' }
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts full credentials', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      credentials: { accessKey: 'AKID', secretKey: 'secret' }
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects accessKey without secretKey', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      credentials: { accessKey: 'AKID', secretKey: '' }
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some((i) => i.path.includes('secretKey'))).toBe(true);
+    }
+  });
+
+  it('rejects secretKey without accessKey', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      credentials: { accessKey: '', secretKey: 'secret' }
+    });
+    expect(result.success).toBe(false);
+    if (!result.success) {
+      expect(result.error.issues.some((i) => i.path.includes('accessKey'))).toBe(true);
+    }
+  });
+
+  it('accepts uuid id', () => {
+    const result = StorageConnectionSchema.safeParse({
+      id: '550e8400-e29b-41d4-a716-446655440000',
+      host: 's3.example.com'
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects non-uuid id', () => {
+    const result = StorageConnectionSchema.safeParse({
+      id: 'not-a-uuid',
+      host: 's3.example.com'
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts optional name', () => {
+    const result = StorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      name: 'My Connection'
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.name).toBe('My Connection');
+    }
+  });
+});
+
+describe('EditStorageConnectionSchema', () => {
+  it('accepts accessKey without secretKey', () => {
+    const result = EditStorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      credentials: { accessKey: 'AKID', secretKey: '' }
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('still rejects secretKey without accessKey', () => {
+    const result = EditStorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      credentials: { accessKey: '', secretKey: 'secret' }
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it('accepts both keys as before', () => {
+    const result = EditStorageConnectionSchema.safeParse({
+      host: 's3.example.com',
+      credentials: { accessKey: 'AKID', secretKey: 'secret' }
+    });
+    expect(result.success).toBe(true);
+  });
+});
+
+describe('ConnectionIdSchema', () => {
+  it('accepts a valid UUID', () => {
+    const result = ConnectionIdSchema.safeParse({
+      connectionId: '550e8400-e29b-41d4-a716-446655440000'
+    });
+    expect(result.success).toBe(true);
+  });
+
+  it('rejects non-UUID string', () => {
+    const result = ConnectionIdSchema.safeParse({ connectionId: 'not-a-uuid' });
+    expect(result.success).toBe(false);
+  });
+
+  it('rejects missing connectionId', () => {
+    const result = ConnectionIdSchema.safeParse({});
+    expect(result.success).toBe(false);
+  });
+});
diff --git a/src/lib/storage/utils.spec.ts b/src/lib/storage/utils.spec.ts
new file mode 100644
index 00000000..537db12c
--- /dev/null
+++ b/src/lib/storage/utils.spec.ts
@@ -0,0 +1,98 @@
+import { describe, it, expect, vi } from 'vitest';
+import { fileIconKind, keyToName, formatDate, isArchiveExtension } from './utils.js';
+
+vi.mock('$lib/paraglide/runtime.js', () => ({
+  getLocale: () => 'en-GB'
+}));
+
+describe('fileIconKind', () => {
+  it('returns "document" for undefined content type', () => {
+    expect(fileIconKind(undefined)).toBe('document');
+  });
+
+  it('returns "image" for image types', () => {
+    expect(fileIconKind('image/png')).toBe('image');
+    expect(fileIconKind('image/jpeg')).toBe('image');
+    expect(fileIconKind('image/svg+xml')).toBe('image');
+  });
+
+  it('returns "pdf" for application/pdf', () => {
+    expect(fileIconKind('application/pdf')).toBe('pdf');
+  });
+
+  it('returns "code" for code types', () => {
+    expect(fileIconKind('application/json')).toBe('code');
+    expect(fileIconKind('text/html')).toBe('code');
+    expect(fileIconKind('text/css')).toBe('code');
+    expect(fileIconKind('application/javascript')).toBe('code');
+    expect(fileIconKind('text/javascript')).toBe('code');
+    expect(fileIconKind('text/markdown')).toBe('code');
+  });
+
+  it('returns "archive" for archive types', () => {
+    expect(fileIconKind('application/zip')).toBe('archive');
+    expect(fileIconKind('application/gzip')).toBe('archive');
+    expect(fileIconKind('application/x-tar')).toBe('archive');
+    expect(fileIconKind('application/x-gzip')).toBe('archive');
+  });
+
+  it('returns "text" for text types', () => {
+    expect(fileIconKind('text/plain')).toBe('text');
+    expect(fileIconKind('text/csv')).toBe('text');
+  });
+
+  it('returns "document" for unknown types', () => {
+    expect(fileIconKind('application/octet-stream')).toBe('document');
+    expect(fileIconKind('video/mp4')).toBe('document');
+  });
+});
+
+describe('keyToName', () => {
+  it('extracts filename from a key', () => {
+    expect(keyToName('path/to/file.txt')).toBe('file.txt');
+  });
+
+  it('handles single segment', () => {
+    expect(keyToName('file.txt')).toBe('file.txt');
+  });
+
+  it('strips trailing slash for directory keys', () => {
+    expect(keyToName('path/to/dir/')).toBe('dir');
+  });
+
+  it('returns the key itself for root-level keys', () => {
+    expect(keyToName('rootfile')).toBe('rootfile');
+  });
+});
+
+describe('formatDate', () => {
+  it('formats a date in en-GB short format', () => {
+    const date = new Date('2024-03-15T10:00:00Z');
+    expect(formatDate(date)).toBe('15 Mar 2024');
+  });
+});
+
+describe('isArchiveExtension', () => {
+  it('returns true for known archive extensions', () => {
+    expect(isArchiveExtension('file.zip')).toBe(true);
+    expect(isArchiveExtension('file.tar.gz')).toBe(true);
+    expect(isArchiveExtension('file.tgz')).toBe(true);
+    expect(isArchiveExtension('file.tar')).toBe(true);
+    expect(isArchiveExtension('file.rar')).toBe(true);
+    expect(isArchiveExtension('file.7z')).toBe(true);
+  });
+
+  it('is case-insensitive', () => {
+    expect(isArchiveExtension('file.ZIP')).toBe(true);
+    expect(isArchiveExtension('file.TAR.GZ')).toBe(true);
+  });
+
+  it('returns false for non-archive extensions', () => {
+    expect(isArchiveExtension('file.txt')).toBe(false);
+    expect(isArchiveExtension('file.pdf')).toBe(false);
+  });
+
+  it('returns false for empty string', () => {
+    expect(isArchiveExtension('')).toBe(false);
+  });
+});
diff --git a/src/lib/stores/tab-store.svelte.spec.ts b/src/lib/stores/tab-store.svelte.spec.ts
new file mode 100644
index 00000000..b55340f2
--- /dev/null
+++ b/src/lib/stores/tab-store.svelte.spec.ts
@@ -0,0 +1,260 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import type { TabState } from './tab-store.svelte.js';
+
+vi.mock('$app/environment', () => ({ browser: true }));
+vi.mock('$lib/paraglide/messages.js', () => ({ trino_tab_default_name: () => 'Query' }));
+
+interface TabStoreApi {
+  tabs: TabState[];
+  activeTabId: string;
+  activeTab: TabState;
+  maxTabs: number;
+  persistError: boolean;
+  createTab: () => TabState | null;
+  closeTab: (id: string) => void;
+  switchTab: (id: string) => void;
+  reorderTabs: (fromIndex: number, toIndex: number) => void;
+  updateSql: (id: string, sql: string) => void;
+  renameTab: (id: string, label: string | null) => void;
+  getTabLabel: (tab: TabState) => string;
+}
+
+let store: TabStoreApi;
+let uuidCounter = 0;
+
+function resetStore() {
+  localStorage.clear();
+  while (store.tabs.length > 1) {
+    store.closeTab(store.tabs[store.tabs.length - 1].id);
+  }
+  if (store.tabs.length === 1) {
+    store.updateSql(store.tabs[0].id, 'SELECT 1');
+    store.renameTab(store.tabs[0].id, null);
+  }
+}
+
+function makeCryptoStub() {
+  return { randomUUID: () => `uuid-${++uuidCounter}` };
+}
+
+beforeEach(async () => {
+  vi.stubGlobal('crypto', makeCryptoStub());
+
+  if (!store) {
+    vi.resetModules();
+    const mod = await import('./tab-store.svelte.js');
+    store = mod.tabStore as unknown as TabStoreApi;
+  } else {
+    resetStore();
+  }
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+  // Clean up after tests that create 8 tabs (maxTabs).
+  while (store.tabs.length > 1) {
+    store.closeTab(store.tabs[store.tabs.length - 1].id);
+  }
+});
+
+describe('tab-store', () => {
+  it('creates a default tab with SELECT 1', () => {
+    expect(store.tabs.length).toBe(1);
+    expect(store.tabs[0].sql).toBe('SELECT 1');
+    expect(store.tabs[0].label).toBeNull();
+  });
+
+  it('sets activeTabId to the default tab', () => {
+    expect(store.activeTabId).toBe(store.tabs[0].id);
+  });
+
+  it('derives activeTab from activeTabId', () => {
+    expect(store.activeTab).toBe(store.tabs[0]);
+  });
+
+  it('createTab adds a new tab and switches to it', () => {
+    const tab = store.createTab();
+    expect(tab).not.toBeNull();
+    expect(store.tabs.length).toBe(2);
+    expect(store.activeTabId).toBe(tab!.id);
+  });
+
+  it('createTab returns null when max tabs reached', () => {
+    for (let i = 1; i < store.maxTabs; i++) {
+      store.createTab();
+    }
+    expect(store.createTab()).toBeNull();
+    expect(store.tabs.length).toBe(store.maxTabs);
+    // Clean up to 1 tab so subsequent tests don't inherit max state.
+    while (store.tabs.length > 1) {
+      store.closeTab(store.tabs[store.tabs.length - 1].id);
+    }
+  });
+
+  it('closeTab removes a non-active tab without switching', () => {
+    expect(store.tabs.length).toBe(1);
+    const originalId = store.tabs[0].id;
+    store.createTab();
+    expect(store.tabs.length).toBe(2);
+    const activeBefore = store.activeTabId;
+    store.closeTab(originalId);
+    expect(store.tabs.find((t) => t.id === originalId)).toBeUndefined();
+    expect(store.activeTabId).toBe(activeBefore);
+  });
+
+  it('closeTab switches to adjacent tab when closing active', () => {
+    store.createTab();
+    store.createTab();
+    store.switchTab(store.tabs[1].id);
+    store.closeTab(store.tabs[1].id);
+    expect(store.tabs.length).toBe(2);
+    expect(store.tabs.some((t) => t.id === store.activeTabId)).toBe(true);
+  });
+
+  it('does not close the last remaining tab', () => {
+    const tabId = store.tabs[0].id;
+    store.closeTab(tabId);
+    expect(store.tabs.length).toBe(1);
+    expect(store.tabs[0].id).toBe(tabId);
+  });
+
+  it('closeTab with unknown id is a no-op', () => {
+    store.closeTab('non-existent');
+    expect(store.tabs.length).toBe(1);
+  });
+
+  it('switchTab changes active tab', () => {
+    store.createTab();
+    store.createTab();
+    const targetId = store.tabs[0].id;
+    store.switchTab(targetId);
+    expect(store.activeTabId).toBe(targetId);
+  });
+
+  it('switchTab ignores unknown id', () => {
+    const current = store.activeTabId;
+    store.switchTab('non-existent');
+    expect(store.activeTabId).toBe(current);
+  });
+
+  it('reorderTabs moves a tab backward', () => {
+    store.createTab();
+    store.createTab();
+    const idsBefore = store.tabs.map((t) => t.id);
+    store.reorderTabs(0, 2);
+    const idsAfter = store.tabs.map((t) => t.id);
+    expect(idsAfter[0]).toBe(idsBefore[1]);
+    expect(idsAfter[1]).toBe(idsBefore[2]);
+    expect(idsAfter[2]).toBe(idsBefore[0]);
+  });
+
+  it('reorderTabs moves a tab forward', () => {
+    store.createTab();
+    store.createTab();
+    const idsBefore = store.tabs.map((t) => t.id);
+    store.reorderTabs(2, 0);
+    const idsAfter = store.tabs.map((t) => t.id);
+    expect(idsAfter[0]).toBe(idsBefore[2]);
+    expect(idsAfter[1]).toBe(idsBefore[0]);
+    expect(idsAfter[2]).toBe(idsBefore[1]);
+  });
+
+  it('reorderTabs same index is no-op', () => {
+    store.createTab();
+    const idsBefore = store.tabs.map((t) => t.id);
+    store.reorderTabs(1, 1);
+    expect(store.tabs.map((t) => t.id)).toEqual(idsBefore);
+  });
+
+  it('reorderTabs out of bounds is no-op', () => {
+    const idsBefore = store.tabs.map((t) => t.id);
+    store.reorderTabs(-1, 0);
+    expect(store.tabs.map((t) => t.id)).toEqual(idsBefore);
+  });
+
+  it('updateSql updates sql immediately', () => {
+    store.updateSql(store.tabs[0].id, 'SELECT 2');
+    expect(store.tabs[0].sql).toBe('SELECT 2');
+  });
+
+  it('updateSql clamps to MAX_SQL_LENGTH', () => {
+    const longSql = 'x'.repeat(300_000);
+    store.updateSql(store.tabs[0].id, longSql);
+    expect(store.tabs[0].sql.length).toBe(250_000);
+  });
+
+  it('updateSql ignores unknown tab id', () => {
+    store.updateSql('non-existent', 'SELECT 2');
+    expect(store.tabs[0].sql).toBe('SELECT 1');
+  });
+
+  it('renameTab sets a custom label', () => {
+    store.renameTab(store.tabs[0].id, 'My Query');
+    expect(store.tabs[0].label).toBe('My Query');
+  });
+
+  it('renameTab with empty string clears label to null', () => {
+    store.renameTab(store.tabs[0].id, 'My Query');
+    store.renameTab(store.tabs[0].id, '');
+    expect(store.tabs[0].label).toBeNull();
+  });
+
+  it('renameTab with whitespace clears label to null', () => {
+    store.renameTab(store.tabs[0].id, '  ');
+    expect(store.tabs[0].label).toBeNull();
+  });
+
+  it('getTabLabel returns custom label when set', () => {
+    store.renameTab(store.tabs[0].id, 'Custom');
+    expect(store.getTabLabel(store.tabs[0])).toBe('Custom');
+  });
+
+  it('getTabLabel returns paraglide default when label is null', () => {
+    expect(store.getTabLabel(store.tabs[0])).toBe('Query');
+  });
+
+  it('persistError is false after normal operations', () => {
+    store.createTab();
+    store.updateSql(store.tabs[0].id, 'SELECT 2');
+    expect(store.persistError).toBe(false);
+  });
+
+  it('persists tabs index to localStorage on create', () => {
+    store.createTab();
+    const raw = localStorage.getItem('trino_tabs_index');
+    expect(raw).not.toBeNull();
+    const index = JSON.parse(raw!);
+    expect(Array.isArray(index.tabs)).toBe(true);
+    expect(index.tabs.length).toBe(2);
+  });
+
+  it('persists tab SQL to localStorage after debounce', async () => {
+    const key = `trino_tab_${store.tabs[0].id}`;
+    store.updateSql(store.tabs[0].id, 'SELECT 999');
+    await new Promise((r) => setTimeout(r, 600));
+    expect(localStorage.getItem(key)).toBe('SELECT 999');
+  });
+
+  it('stores a complete index entry in localStorage after operations', () => {
+    const tab = store.createTab()!;
+    const raw = localStorage.getItem('trino_tabs_index');
+    expect(raw).not.toBeNull();
+    const index = JSON.parse(raw!);
+    expect(Array.isArray(index.tabs)).toBe(true);
+    expect(index.tabs.length).toBe(2);
+    expect(index.tabs.some((t: { id: string }) => t.id === tab.id)).toBe(true);
+  });
+
+  it('handles multiple closeTab and createTab cycles', () => {
+    store.createTab();
+    store.createTab();
+    expect(store.tabs.length).toBe(3);
+
+    store.closeTab(store.tabs[1].id);
+    store.closeTab(store.tabs[1].id);
+    expect(store.tabs.length).toBe(1);
+
+    store.createTab();
+    expect(store.tabs.length).toBe(2);
+  });
+});
diff --git a/src/lib/stores/toast.svelte.spec.ts b/src/lib/stores/toast.svelte.spec.ts
new file mode 100644
index 00000000..333db902
--- /dev/null
+++ b/src/lib/stores/toast.svelte.spec.ts
@@ -0,0 +1,72 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { toasts, addToast, removeToast } from './toast.svelte.js';
+
+beforeEach(() => {
+  toasts.length = 0;
+});
+
+describe('addToast', () => {
+  it('adds a toast with the given properties', () => {
+    addToast('info', 'Hello world');
+    expect(toasts).toHaveLength(1);
+    expect(toasts[0]).toMatchObject({ type: 'info', message: 'Hello world' });
+    expect(typeof toasts[0].id).toBe('string');
+  });
+
+  it('returns a unique id', () => {
+    const id1 = addToast('info', 'First');
+    const id2 = addToast('success', 'Second');
+    expect(id1).not.toBe(id2);
+  });
+
+  it('removes toast after duration', async () => {
+    vi.useFakeTimers();
+    addToast('info', 'Timed', 100);
+    expect(toasts).toHaveLength(1);
+    vi.advanceTimersByTime(100);
+    expect(toasts).toHaveLength(0);
+    vi.useRealTimers();
+  });
+
+  it('does not auto-remove when duration is 0', async () => {
+    vi.useFakeTimers();
+    addToast('info', 'Persistent', 0);
+    vi.advanceTimersByTime(999999);
+    expect(toasts).toHaveLength(1);
+    vi.useRealTimers();
+  });
+
+  it('stores actions when provided', () => {
+    const action = { label: 'Undo', onClick: () => {} };
+    addToast('warning', 'With action', 5000, [action]);
+    expect(toasts[0].actions).toEqual([action]);
+  });
+});
+
+describe('removeToast', () => {
+  it('removes a toast by id', () => {
+    const id = addToast('error', 'Remove me');
+    expect(toasts).toHaveLength(1);
+    removeToast(id);
+    expect(toasts).toHaveLength(0);
+  });
+
+  it('does nothing when id does not exist', () => {
+    addToast('info', 'Stay');
+    removeToast('non-existent-id');
+    expect(toasts).toHaveLength(1);
+  });
+});
+
+describe('toasts reactivity', () => {
+  it('starts empty', () => {
+    expect(toasts).toEqual([]);
+  });
+
+  it('toast order is LIFO (push order)', () => {
+    addToast('info', 'First');
+    addToast('success', 'Second');
+    expect(toasts[0].message).toBe('First');
+    expect(toasts[1].message).toBe('Second');
+  });
+});

From b195deb3f59b946ca22f1c25432c5c66668956ae Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 24 Jul 2026 12:40:24 +0200
Subject: [PATCH 116/136] #223 add copy name and path actions to tab and
 breadcrumb context menu (#257)

* #223 add copy name and path actions to tab and breadcrumb context menu

* fix unit test

* fix e2e test
---
 messages/de.json                              |   3 +
 messages/en.json                              |   3 +
 .../storage/explorer/ContextMenu.svelte       | 263 +++++++++---------
 .../storage/explorer/FileExplorer.svelte      | 177 +++++++++++-
 .../storage/explorer/StorageBreadcrumb.svelte |  98 ++++---
 .../components/storage/explorer/TabBar.svelte |  96 ++++---
 .../__tests__/ContextMenu.svelte.spec.ts      |   2 +-
 .../__tests__/ContextMenuWrapper.svelte       |   5 +-
 .../StorageBreadcrumb.svelte.spec.ts          |   4 +-
 src/lib/storage/state.svelte.ts               |  60 ++--
 src/lib/storage/types.ts                      |  11 +
 11 files changed, 495 insertions(+), 227 deletions(-)

diff --git a/messages/de.json b/messages/de.json
index 077e9220..515c7f0e 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -267,6 +267,9 @@
   "storage_action_copy_filename": "Dateiname kopieren",
   "storage_action_copy_filename_success": "Dateiname in die Zwischenablage kopiert.",
   "storage_action_copy_filename_error": "Dateiname konnte nicht in die Zwischenablage kopiert werden.",
+  "storage_action_copy_directory_name": "Verzeichnisnamen kopieren",
+  "storage_action_copy_directory_name_success": "Verzeichnisname in die Zwischenablage kopiert.",
+  "storage_action_copy_directory_name_error": "Verzeichnisname konnte nicht in die Zwischenablage kopiert werden.",
   "storage_action_copy_path": "Pfad kopieren",
   "storage_action_copy_path_success": "Pfad in die Zwischenablage kopiert.",
   "storage_action_copy_path_error": "Pfad konnte nicht in die Zwischenablage kopiert werden.",
diff --git a/messages/en.json b/messages/en.json
index 5f6e6c8f..7281cc25 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -267,6 +267,9 @@
   "storage_action_copy_filename": "Copy filename",
   "storage_action_copy_filename_success": "Filename copied to clipboard.",
   "storage_action_copy_filename_error": "Could not copy filename to clipboard.",
+  "storage_action_copy_directory_name": "Copy directory name",
+  "storage_action_copy_directory_name_success": "Directory name copied to clipboard.",
+  "storage_action_copy_directory_name_error": "Could not copy directory name to clipboard.",
   "storage_action_copy_path": "Copy path",
   "storage_action_copy_path_success": "Path copied to clipboard.",
   "storage_action_copy_path_error": "Could not copy path to clipboard.",
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index ad2300d9..a511f6a8 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -18,19 +18,43 @@
   import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
-  import type { ActionName } from '$lib/storage/types.js';
+  import type { ContextMenuAction, ActionName } from '$lib/storage/types.js';
   import {
     storageCutCopyEnabled,
     storagePasteEnabled,
     storageRenameEnabled
   } from '$lib/client/feature-flags.js';
 
+  interface Props {
+    /** When provided, the component is fully prop-driven (no storage dependency). */
+    actions?: ContextMenuAction[];
+    onaction?: (key: string) => void;
+    x?: number;
+    y?: number;
+    onclose?: () => void;
+    open?: boolean;
+    title?: string;
+  }
+
+  let {
+    actions: propActions,
+    onaction: propOnAction,
+    x: propX,
+    y: propY,
+    onclose: propOnClose,
+    open: propOpen,
+    title
+  }: Props = $props();
+
+  // ── Dual-mode: prop-driven or storage-driven ────────────────────────────
   const storage = getStorageState();
+  const isPropDriven = $derived(propActions !== undefined && propOnAction !== undefined);
 
-  // Position and derived state from context
-  const x = $derived(storage.contextMenu?.x ?? 0);
-  const y = $derived(storage.contextMenu?.y ?? 0);
-  const selectionCount = $derived(storage.selectedKeys.size);
+  const x = $derived(propX ?? storage.contextMenu?.x ?? 0);
+  const y = $derived(propY ?? storage.contextMenu?.y ?? 0);
+  const open = $derived(propOpen ?? !!storage.contextMenu);
+
+  // ── Storage-based action building (legacy fallback) ─────────────────────
   const hasCtxKey = $derived(!!storage.contextMenu?.key);
   const canPreview = $derived(
     (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0) ||
@@ -41,58 +65,11 @@
     storage.contextMenu !== null ||
       (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0)
   );
+  const selectionCount = $derived(storage.selectedKeys.size);
 
-  let menuEl = $state<HTMLUListElement | null>(null);
-
-  // Adjust position so menu stays within viewport
-  const adjustedPos = $derived.by(() => {
-    if (!menuEl) return { left: x, top: y };
-    const rect = menuEl.getBoundingClientRect();
-    return {
-      left: x + rect.width > window.innerWidth ? x - rect.width : x,
-      top: y + rect.height > window.innerHeight ? y - rect.height : y
-    };
-  });
-
-  function emit(action: string) {
-    storage.executeAction(action as ActionName);
-    storage.contextMenu = null;
-  }
-
-  function handleKeydown(e: KeyboardEvent) {
-    if (e.key === 'Escape') storage.closeContextMenu();
-  }
-
-  function handleOutsideClick(e: MouseEvent) {
-    if (menuEl && !menuEl.contains(e.target as Node)) storage.closeContextMenu();
-  }
-
-  onMount(() => {
-    menuEl?.focus();
-    document.addEventListener('click', handleOutsideClick, true);
-    return () => document.removeEventListener('click', handleOutsideClick, true);
-  });
-
-  const actions = $derived.by<
-    Array<{
-      key: ActionName;
-      icon: Component;
-      label: string;
-      disabled: boolean;
-      hidden: boolean;
-      class?: string;
-    }>
-  >(() => {
-    const items: Array<{
-      key: ActionName;
-      icon: Component;
-      label: string;
-      disabled: boolean;
-      hidden: boolean;
-      class?: string;
-    }> = [];
+  const storedActions = $derived.by<ContextMenuAction[]>(() => {
+    const items: ContextMenuAction[] = [];
 
-    // Empty-space: show create options and paste
     if (!hasCtxKey) {
       items.push(
         {
@@ -120,7 +97,6 @@
       return items;
     }
 
-    // Item-specific actions
     items.push(
       {
         key: 'preview' as ActionName,
@@ -201,84 +177,119 @@
       }
     );
 
+    if (!storage.archive.isInArchive && hasCtxKey) {
+      items.push({
+        key: 'delete' as ActionName,
+        icon: IconDelete as Component,
+        label: m.storage_action_delete(),
+        disabled: selectionCount === 0,
+        class: 'text-error'
+      });
+    }
+
     return items;
   });
 
-  const dangerActions = $derived(
-    storage.archive.isInArchive || !hasCtxKey
-      ? []
-      : [
-          {
-            key: 'delete' as ActionName,
-            icon: IconDelete as Component,
-            label: m.storage_action_delete(),
-            disabled: selectionCount === 0,
-            class: 'text-error'
-          }
-        ]
-  );
+  const actions = $derived(propActions ?? storedActions);
+
+  function emit(key: string) {
+    if (isPropDriven) {
+      propOnAction!(key);
+    } else {
+      storage.executeAction(key as ActionName);
+      storage.contextMenu = null;
+    }
+  }
+
+  function close() {
+    if (isPropDriven) {
+      propOnClose?.();
+    } else {
+      storage.closeContextMenu();
+    }
+  }
+
+  function handleKeydown(e: KeyboardEvent) {
+    if (e.key === 'Escape') close();
+  }
+
+  function handleBackdropClick(e: MouseEvent) {
+    if (menuEl && !menuEl.contains(e.target as Node)) close();
+  }
+
+  let menuEl = $state<HTMLUListElement | null>(null);
+
+  const adjustedPos = $derived.by(() => {
+    if (!menuEl) return { left: x, top: y };
+    const rect = menuEl.getBoundingClientRect();
+    return {
+      left: x + rect.width > window.innerWidth ? x - rect.width : x,
+      top: y + rect.height > window.innerHeight ? y - rect.height : y
+    };
+  });
+
+  onMount(() => {
+    menuEl?.focus();
+  });
 </script>
 
 <svelte:window onkeydown={handleKeydown} />
 
-<ul
-  bind:this={menuEl}
-  class="
-    menu menu-sm border-base-300 bg-base-100 fixed z-70 w-48 rounded-lg
-    border p-1 shadow-lg
-  "
-  role="menu"
-  tabindex="-1"
-  style="left: {adjustedPos.left}px; top: {adjustedPos.top}px;"
->
-  <li class="menu-title p-0" role="none">
-    <div class="menu-title flex items-center justify-between py-1 pr-0 pl-2">
-      <span class="text-base-content/70 text-xs font-medium">
-        {m.storage_context_menu_actions()}
-      </span>
-
-      <button
-        type="button"
-        role="menuitem"
-        class="btn btn-ghost btn-xs"
-        aria-label="Close"
-        onclick={() => storage.closeContextMenu()}
-      >
-        <IconClose class="size-4" aria-hidden="true" />
-      </button>
-    </div>
-  </li>
+{#if open}
+  <!-- svelte-ignore a11y_no_static_element_interactions -->
+  <div
+    class="fixed inset-0 z-40"
+    onmousedown={handleBackdropClick}
+    oncontextmenu={(e) => {
+      e.preventDefault();
+      close();
+    }}
+  ></div>
 
-  {#each actions as act (act.key)}
-    {#if !act.hidden}
-      {@const ActIcon = act.icon}
-      <li role="none" class:menu-disabled={act.disabled}>
-        <button
-          role="menuitem"
-          class="justify-start"
-          onclick={() => emit(act.key)}
-          disabled={act.disabled}
-          aria-disabled={act.disabled}
-        >
-          <ActIcon class="mr-2 size-4 shrink-0" aria-hidden="true" />
-          {act.label}
-        </button>
+  <ul
+    bind:this={menuEl}
+    class="menu menu-sm border-base-300 bg-base-100 fixed z-60 w-48 rounded-lg border p-1 shadow-lg"
+    role="menu"
+    tabindex="-1"
+    aria-label={title}
+    style="left: {adjustedPos.left}px; top: {adjustedPos.top}px;"
+  >
+    {#if title}
+      <li class="menu-title p-0" role="none">
+        <div class="menu-title flex items-center justify-between py-1 pr-0 pl-2">
+          <span class="text-base-content/70 text-xs font-medium">{title}</span>
+          <button
+            type="button"
+            role="menuitem"
+            class="btn btn-ghost btn-xs"
+            aria-label="Close"
+            onclick={close}
+          >
+            <IconClose class="size-4" aria-hidden="true" />
+          </button>
+        </div>
       </li>
     {/if}
-  {/each}
 
-  {#each dangerActions as act (act.key)}
-    {@const ActIcon = act.icon}
-    <li role="none">
-      <button
-        role="menuitem"
-        class={'justify-start ' + (act.class ?? '')}
-        onclick={() => emit(act.key)}
-        disabled={act.disabled}
-      >
-        <ActIcon class={'mr-2 h-4 w-4 shrink-0 ' + (act.class ?? '')} aria-hidden="true" />
-        {act.label}
-      </button>
-    </li>
-  {/each}
-</ul>
+    {#each actions as act (act.key)}
+      {#if !act.hidden}
+        {@const ActIcon = act.icon}
+        <li role="none" class:menu-disabled={act.disabled}>
+          <button
+            role="menuitem"
+            class={'justify-start ' + (act.class ?? '')}
+            onclick={() => {
+              emit(act.key);
+              close();
+            }}
+            disabled={act.disabled}
+            aria-disabled={act.disabled}
+          >
+            <ActIcon class={'mr-2 size-4 shrink-0 ' + (act.class ?? '')} aria-hidden="true" />
+            {act.label}
+          </button>
+        </li>
+      {/if}
+    {/each}
+  </ul>
+{/if}
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 16ea6699..67e9655a 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -7,7 +7,28 @@
   import { getStorageState } from '$lib/storage/context.js';
   import { TabsState } from '$lib/storage/tabs.svelte.js';
   import { setTabsState } from '$lib/storage/context.js';
-  import { storageRestoreTabsEnabled } from '$lib/client/feature-flags.js';
+  import {
+    storageCutCopyEnabled,
+    storagePasteEnabled,
+    storageRenameEnabled,
+    storageRestoreTabsEnabled
+  } from '$lib/client/feature-flags.js';
+  import type { ContextMenuAction } from '$lib/storage/types.js';
+  import type { ActionName } from '$lib/storage/types.js';
+  import IconVisibility from 'virtual:icons/material-symbols/visibility';
+  import IconDownload from 'virtual:icons/material-symbols/download';
+  import IconInfo from 'virtual:icons/material-symbols/info';
+  import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
+  import IconPushPin from 'virtual:icons/material-symbols/push-pin';
+  import IconDelete from 'virtual:icons/material-symbols/delete';
+  import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconFileCopy from 'virtual:icons/material-symbols/file-copy-outline';
+  import IconCut from 'virtual:icons/material-symbols/content-cut';
+  import IconCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconPaste from 'virtual:icons/material-symbols/content-paste';
+  import IconDriveFileRenameOutline from 'virtual:icons/material-symbols/drive-file-rename-outline';
+  import IconDescriptionOutline from 'virtual:icons/material-symbols/description-outline';
+  import IconFolderOutline from 'virtual:icons/material-symbols/folder-outline';
   import StorageBreadcrumb from './StorageBreadcrumb.svelte';
   import TabBar from './TabBar.svelte';
   import ObjectTable from './ObjectTable.svelte';
@@ -83,6 +104,148 @@
     if (b) untrack(() => storage.bookmarks.recordLocationVisit(b, p));
   });
 
+  // ── Context menu actions ─────────────────────────────────────────────────
+
+  const hasCtxKey = $derived(!!storage.contextMenu?.key);
+  const canPreview = $derived(
+    (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0) ||
+      (storage.contextMenu !== null && storage.ctxIsFile)
+  );
+  const canDownload = $derived(storage.selectedFiles.length > 0 || storage.ctxIsFile);
+  const canShowDetails = $derived(
+    storage.contextMenu !== null ||
+      (storage.selectedFiles.length === 1 && storage.selectedFolders.length === 0)
+  );
+  const selectionCount = $derived(storage.selectedKeys.size);
+
+  const contextMenuActions = $derived.by<ContextMenuAction[]>(() => {
+    if (!hasCtxKey) {
+      return [
+        {
+          key: 'create-file' as ActionName,
+          icon: IconDescriptionOutline,
+          label: m.storage_create_file(),
+          disabled: false,
+          hidden: storage.archive.isInArchive
+        },
+        {
+          key: 'create-folder' as ActionName,
+          icon: IconFolderOutline,
+          label: m.storage_create_folder(),
+          disabled: false,
+          hidden: storage.archive.isInArchive
+        },
+        {
+          key: 'paste' as ActionName,
+          icon: IconPaste,
+          label: m.storage_action_paste(),
+          disabled: storage.clipboard === null || storage.archive.isInArchive,
+          hidden: !storagePasteEnabled || storage.archive.isInArchive
+        }
+      ];
+    }
+
+    const items: ContextMenuAction[] = [
+      {
+        key: 'preview' as ActionName,
+        icon: IconVisibility,
+        label: m.storage_action_preview(),
+        disabled: !canPreview,
+        hidden: false
+      },
+      {
+        key: 'download' as ActionName,
+        icon: IconDownload,
+        label: m.storage_action_download(),
+        disabled: !canDownload,
+        hidden: false
+      },
+      {
+        key: 'details' as ActionName,
+        icon: IconInfo,
+        label: m.storage_action_details(),
+        disabled: !canShowDetails,
+        hidden: false
+      },
+      {
+        key: 'cut' as ActionName,
+        icon: IconCut,
+        label: m.storage_action_cut(),
+        disabled: selectionCount === 0 || storage.archive.isInArchive,
+        hidden: !storageCutCopyEnabled || storage.archive.isInArchive
+      },
+      {
+        key: 'copy' as ActionName,
+        icon: IconCopy,
+        label: m.storage_action_copy(),
+        disabled: selectionCount === 0 || storage.archive.isInArchive,
+        hidden: !storageCutCopyEnabled || storage.archive.isInArchive
+      },
+      {
+        key: 'paste' as ActionName,
+        icon: IconPaste,
+        label: m.storage_action_paste(),
+        disabled: storage.clipboard === null || storage.archive.isInArchive,
+        hidden: !storagePasteEnabled || storage.archive.isInArchive
+      },
+      {
+        key: 'rename' as ActionName,
+        icon: IconDriveFileRenameOutline,
+        label: m.storage_action_rename(),
+        disabled: selectionCount !== 1 || storage.archive.isInArchive,
+        hidden: !storageRenameEnabled || storage.archive.isInArchive
+      },
+      {
+        key: 'copy-filename' as ActionName,
+        icon: IconFileCopy,
+        label:
+          hasCtxKey && !storage.ctxIsFile
+            ? m.storage_action_copy_directory_name()
+            : m.storage_action_copy_filename(),
+        disabled: !hasCtxKey,
+        hidden: false
+      },
+      {
+        key: 'copy-path' as ActionName,
+        icon: IconContentCopy,
+        label: m.storage_action_copy_path(),
+        disabled: !hasCtxKey,
+        hidden: false
+      },
+      {
+        key: 'pin' as ActionName,
+        icon: IconPushPinOutline,
+        label: m.storage_action_pin(),
+        disabled: !storage.canPin || storage.archive.isInArchive,
+        hidden: !storage.canPin || storage.ctxIsPinned || storage.archive.isInArchive
+      },
+      {
+        key: 'unpin' as ActionName,
+        icon: IconPushPin,
+        label: m.storage_action_unpin(),
+        disabled: !storage.ctxIsPinned || storage.archive.isInArchive,
+        hidden: !storage.ctxIsPinned || storage.archive.isInArchive
+      }
+    ];
+
+    if (!storage.archive.isInArchive && hasCtxKey) {
+      items.push({
+        key: 'delete' as ActionName,
+        icon: IconDelete,
+        label: m.storage_action_delete(),
+        disabled: selectionCount === 0,
+        class: 'text-error'
+      });
+    }
+
+    return items;
+  });
+
+  function handleContextMenuAction(key: string) {
+    storage.executeAction(key as ActionName);
+    storage.contextMenu = null;
+  }
+
   // Clicking anywhere inside the object-list container that is not a table row
   // clears the current selection (left-click) or opens the empty-space context
   // menu (right-click). Keyboard users already have Escape via the svelte:window
@@ -146,6 +309,12 @@
 </div>
 
 <!-- Context menu -->
-{#if storage.contextMenu}
-  <ContextMenu />
-{/if}
+<ContextMenu
+  x={storage.contextMenu?.x ?? 0}
+  y={storage.contextMenu?.y ?? 0}
+  open={!!storage.contextMenu}
+  onclose={() => storage.closeContextMenu()}
+  onaction={handleContextMenuAction}
+  actions={contextMenuActions}
+  title={m.storage_context_menu_actions()}
+/>
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index e91e4766..883812f4 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -13,6 +13,8 @@
   import IconFolderZip from 'virtual:icons/material-symbols/folder-zip';
   import IconTab from 'virtual:icons/material-symbols/tab';
   import IconAdd from 'virtual:icons/material-symbols/add';
+  import IconFileCopy from 'virtual:icons/material-symbols/file-copy-outline';
+  import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import { getTabsState } from '$lib/storage/context.js';
@@ -22,6 +24,8 @@
   import { storageMoveEnabled } from '$lib/client/feature-flags.js';
   import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
   import OperationsButton from './OperationsButton.svelte';
+  import ContextMenu from './ContextMenu.svelte';
+  import type { ContextMenuAction } from '$lib/storage/types.js';
 
   const storage = getStorageState();
   const tabsState = getTabsState();
@@ -154,6 +158,52 @@
     breadcrumbCtx = null;
   }
 
+  const breadcrumbMenuActions = $derived.by<ContextMenuAction[]>(() => {
+    const ctx = breadcrumbCtx;
+    if (!ctx) return [];
+    const isPinned = storage.bookmarks.isPinned(ctx.bucket, ctx.prefix);
+    return [
+      {
+        key: 'copy-filename',
+        icon: IconFileCopy,
+        label: m.storage_action_copy_directory_name(),
+        disabled: false,
+        hidden: false
+      },
+      {
+        key: 'copy-path',
+        icon: IconContentCopy,
+        label: m.storage_action_copy_path(),
+        disabled: false,
+        hidden: false
+      },
+      {
+        key: 'pin-toggle',
+        icon: isPinned ? IconPushPin : IconPushPinOutline,
+        label: isPinned ? m.storage_action_unpin() : m.storage_action_pin(),
+        disabled: false,
+        hidden: false,
+        class: isPinned ? 'text-error' : ''
+      }
+    ];
+  });
+
+  function handleBreadcrumbAction(key: string) {
+    const ctx = breadcrumbCtx;
+    if (!ctx) return;
+    if (key === 'copy-filename') {
+      storage.copyFilename(ctx.prefix);
+    } else if (key === 'copy-path') {
+      storage.copyPath(ctx.bucket, ctx.prefix);
+    } else if (key === 'pin-toggle') {
+      if (storage.bookmarks.isPinned(ctx.bucket, ctx.prefix)) {
+        storage.bookmarks.unpin(ctx.bucket, ctx.prefix);
+      } else {
+        storage.bookmarks.pin(ctx.bucket, ctx.prefix);
+      }
+    }
+  }
+
   /** Navigate to an S3 prefix, clearing archive state first. */
   function navigateS3(prefix: string) {
     if (storage.archive.isInArchive) {
@@ -195,46 +245,14 @@
   }
 </script>
 
-{#if breadcrumbCtx}
-  {@const breadcrumbIsPinned = storage.bookmarks.isPinned(
-    breadcrumbCtx.bucket,
-    breadcrumbCtx.prefix
-  )}
-  {@const BreadcrumbPinIcon = breadcrumbIsPinned ? IconPushPin : IconPushPinOutline}
-  <!-- svelte-ignore a11y_no_static_element_interactions -->
-  <div
-    class="fixed inset-0 z-40"
-    onmousedown={closeBreadcrumbCtx}
-    onkeydown={(e) => e.key === 'Escape' && closeBreadcrumbCtx()}
-  ></div>
-  <ul
-    class="
-      menu menu-sm border-base-300 bg-base-100 fixed z-60 w-48 rounded-lg
-      border p-1 shadow-lg
-    "
-    role="menu"
-    style="left: {breadcrumbCtx.x}px; bottom: calc(100vh - {breadcrumbCtx.y}px);"
-  >
-    <li role="none">
-      <button
-        role="menuitem"
-        class="justify-start {breadcrumbIsPinned ? 'text-error' : ''}"
-        title={breadcrumbIsPinned ? m.storage_action_unpin() : m.storage_action_pin()}
-        onclick={() => {
-          if (storage.bookmarks.isPinned(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix)) {
-            storage.bookmarks.unpin(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
-          } else {
-            storage.bookmarks.pin(breadcrumbCtx!.bucket, breadcrumbCtx!.prefix);
-          }
-          closeBreadcrumbCtx();
-        }}
-      >
-        <BreadcrumbPinIcon class="size-4 shrink-0" aria-hidden="true" />
-        {breadcrumbIsPinned ? m.storage_action_unpin() : m.storage_action_pin()}
-      </button>
-    </li>
-  </ul>
-{/if}
+<ContextMenu
+  x={breadcrumbCtx?.x ?? 0}
+  y={breadcrumbCtx?.y ?? 0}
+  open={!!breadcrumbCtx}
+  onclose={closeBreadcrumbCtx}
+  onaction={handleBreadcrumbAction}
+  actions={breadcrumbMenuActions}
+/>
 
 {#snippet pinButton(bucket: string, prefix: string)}
   {@const pinned = storage.bookmarks.isPinned(bucket, prefix)}
diff --git a/src/lib/components/storage/explorer/TabBar.svelte b/src/lib/components/storage/explorer/TabBar.svelte
index bb12c456..deaae23f 100644
--- a/src/lib/components/storage/explorer/TabBar.svelte
+++ b/src/lib/components/storage/explorer/TabBar.svelte
@@ -1,10 +1,15 @@
 <script lang="ts">
   import IconAdd from 'virtual:icons/material-symbols/add';
   import IconClose from 'virtual:icons/material-symbols/close';
+  import IconFileCopy from 'virtual:icons/material-symbols/file-copy-outline';
+  import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
+  import IconDriveFileRenameOutline from 'virtual:icons/material-symbols/drive-file-rename-outline';
   import * as m from '$lib/paraglide/messages.js';
   import type { TabsState } from '$lib/storage/tabs.svelte.js';
+  import type { ContextMenuAction } from '$lib/storage/types.js';
   import { getStorageState } from '$lib/storage/context.js';
   import { storageMoveEnabled } from '$lib/client/feature-flags.js';
+  import ContextMenu from './ContextMenu.svelte';
 
   interface Props {
     tabsState: TabsState;
@@ -91,6 +96,56 @@
     ctxMenu = null;
   }
 
+  const tabMenuActions = $derived.by<ContextMenuAction[]>(() => {
+    if (!ctxMenu) return [];
+    return [
+      {
+        key: 'rename',
+        icon: IconDriveFileRenameOutline,
+        label: m.storage_tab_rename(),
+        disabled: false,
+        hidden: false
+      },
+      {
+        key: 'copy-filename',
+        icon: IconFileCopy,
+        label: m.storage_action_copy_directory_name(),
+        disabled: false,
+        hidden: false
+      },
+      {
+        key: 'copy-path',
+        icon: IconContentCopy,
+        label: m.storage_action_copy_path(),
+        disabled: false,
+        hidden: false
+      },
+      {
+        key: 'close',
+        icon: IconClose,
+        label: m.storage_tab_close(),
+        disabled: false,
+        hidden: false,
+        class: 'text-error'
+      }
+    ];
+  });
+
+  function handleTabAction(key: string) {
+    if (!ctxMenu) return;
+    if (key === 'rename') {
+      startRename(ctxMenu.tabId);
+    } else if (key === 'close') {
+      tabsState.closeTab(ctxMenu.tabId);
+    } else if (key === 'copy-filename') {
+      const tab = tabsState.tabs.find((t) => t.id === ctxMenu!.tabId);
+      if (tab) storage.copyFilename(tab.snapshot.prefix);
+    } else if (key === 'copy-path') {
+      const tab = tabsState.tabs.find((t) => t.id === ctxMenu!.tabId);
+      if (tab) storage.copyPath(tab.snapshot.bucket, tab.snapshot.prefix);
+    }
+  }
+
   function startRename(tabId: string) {
     const tab = tabsState.tabs.find((t) => t.id === tabId);
     if (!tab) return;
@@ -210,38 +265,15 @@
   }
 </script>
 
-{#if ctxMenu}
-  <!-- svelte-ignore a11y_no_static_element_interactions -->
-  <div class="fixed inset-0 z-40" onmousedown={closeCtxMenu}></div>
-  <ul
-    class="menu menu-sm border-base-300 bg-base-100 fixed z-60 w-44 rounded-lg border p-1 shadow-lg"
-    role="menu"
-    aria-label={m.storage_tab_context_menu()}
-    style="left: {ctxMenu.x}px; top: {ctxMenu.y}px;"
-  >
-    <li role="none">
-      <button
-        role="menuitem"
-        class="justify-start text-sm"
-        onclick={() => startRename(ctxMenu!.tabId)}
-      >
-        {m.storage_tab_rename()}
-      </button>
-    </li>
-    <li role="none">
-      <button
-        role="menuitem"
-        class="text-error justify-start text-sm"
-        onclick={() => {
-          tabsState.closeTab(ctxMenu!.tabId);
-          closeCtxMenu();
-        }}
-      >
-        {m.storage_tab_close()}
-      </button>
-    </li>
-  </ul>
-{/if}
+<ContextMenu
+  x={ctxMenu?.x ?? 0}
+  y={ctxMenu?.y ?? 0}
+  open={!!ctxMenu}
+  onclose={closeCtxMenu}
+  onaction={handleTabAction}
+  actions={tabMenuActions}
+  title={m.storage_tab_context_menu()}
+/>
 
 {#if tabsState.hasTabs}
   <div class="bg-base-200/60 relative flex items-end pt-1.5 pl-2">
diff --git a/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
index 2e86509d..6f823e49 100644
--- a/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/ContextMenu.svelte.spec.ts
@@ -113,7 +113,7 @@ describe('ContextMenu', () => {
       selectedKeys: ['test.txt']
     });
     const spy = vi.spyOn(state, 'closeContextMenu');
-    render(ContextMenuWrapper, { state });
+    render(ContextMenuWrapper, { state, title: 'Menu' });
 
     await page.getByRole('menuitem', { name: 'Close' }).click();
     expect(spy).toHaveBeenCalled();
diff --git a/src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte b/src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte
index 8307de87..5defe339 100644
--- a/src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte
+++ b/src/lib/components/storage/explorer/__tests__/ContextMenuWrapper.svelte
@@ -6,10 +6,11 @@
 
   interface Props {
     state: StorageState;
+    title?: string;
   }
 
-  let { state }: Props = $props();
+  let { state, title }: Props = $props();
   untrack(() => setStorageState(state));
 </script>
 
-<ContextMenu />
+<ContextMenu {title} />
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
index 6725bd6c..ba70c727 100644
--- a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
@@ -352,7 +352,7 @@ describe('StorageBreadcrumb', () => {
       const bucketEl = nav.getByText('test-bucket');
       await bucketEl.click({ button: 'right' });
 
-      const menuItem = page.getByRole('menuitem');
+      const menuItem = page.getByRole('menuitem', { name: /pin/i });
       await menuItem.first().click();
       expect(spy).toHaveBeenCalledWith('test-bucket', '');
     });
@@ -369,7 +369,7 @@ describe('StorageBreadcrumb', () => {
       const bucketEl = nav.getByText('test-bucket');
       await bucketEl.click({ button: 'right' });
 
-      const menuItem = page.getByRole('menuitem');
+      const menuItem = page.getByRole('menuitem', { name: /unpin/i });
       await menuItem.first().click();
       expect(spy).toHaveBeenCalledWith('test-bucket', '');
     });
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index b925e8d1..6cb7c641 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -456,12 +456,14 @@ export class StorageState {
       case 'copy-filename': {
         const nameKey = ctxKey ?? this.selectedFiles[0]?.key;
         if (!nameKey) return;
-        try {
-          await navigator.clipboard.writeText(keyToName(nameKey));
-          addToast('success', m.storage_action_copy_filename_success());
-        } catch {
-          addToast('error', m.storage_action_copy_filename_error());
-        }
+        await this.copyFilename(nameKey);
+        return;
+      }
+
+      case 'copy-path': {
+        const pathKey = ctxKey ?? this.selectedFiles[0]?.key;
+        if (!pathKey) return;
+        await this.copyPath(this.bucket, pathKey);
         return;
       }
 
@@ -481,20 +483,6 @@ export class StorageState {
         return;
       }
 
-      case 'copy-path': {
-        const pathKey = ctxKey ?? this.selectedFiles[0]?.key;
-        if (!pathKey) return;
-        // Strip trailing slash for folders so the URI is canonical.
-        const cleanKey = pathKey.endsWith('/') ? pathKey.slice(0, -1) : pathKey;
-        try {
-          await navigator.clipboard.writeText(`s3://${this.bucket}/${cleanKey}`);
-          addToast('success', m.storage_action_copy_path_success());
-        } catch {
-          addToast('error', m.storage_action_copy_path_error());
-        }
-        return;
-      }
-
       case 'cut': {
         if (!storageCutCopyEnabled) return;
         const cutKeys = [...this.selectedKeys];
@@ -545,6 +533,38 @@ export class StorageState {
     }
   };
 
+  copyFilename = async (key: string): Promise<void> => {
+    try {
+      const name = key ? keyToName(key) : this.bucket;
+      await navigator.clipboard.writeText(name);
+      const isDir = !key || key.endsWith('/');
+      addToast(
+        'success',
+        isDir
+          ? m.storage_action_copy_directory_name_success()
+          : m.storage_action_copy_filename_success()
+      );
+    } catch {
+      const isDir = !key || key.endsWith('/');
+      addToast(
+        'error',
+        isDir
+          ? m.storage_action_copy_directory_name_error()
+          : m.storage_action_copy_filename_error()
+      );
+    }
+  };
+
+  copyPath = async (bucket: string, key: string): Promise<void> => {
+    const cleanKey = key.endsWith('/') ? key.slice(0, -1) : key;
+    try {
+      await navigator.clipboard.writeText(`s3://${bucket}/${cleanKey}`);
+      addToast('success', m.storage_action_copy_path_success());
+    } catch {
+      addToast('error', m.storage_action_copy_path_error());
+    }
+  };
+
   confirmCreate = async (name: string, type: 'file' | 'folder'): Promise<void> => {
     const sanitized = name.trim();
     if (!sanitized || sanitized === '.' || sanitized === '..') return;
diff --git a/src/lib/storage/types.ts b/src/lib/storage/types.ts
index 800ca560..44116d12 100644
--- a/src/lib/storage/types.ts
+++ b/src/lib/storage/types.ts
@@ -1,3 +1,5 @@
+import type { Component } from 'svelte';
+
 // ── Modal types ─────────────────────────────────────────────────────────────
 
 export type ModalType =
@@ -57,6 +59,15 @@ export type ActiveModal = {
 
 // ── Context menu ─────────────────────────────────────────────────────────────
 
+export interface ContextMenuAction {
+  key: string;
+  icon: Component;
+  label: string;
+  disabled?: boolean;
+  hidden?: boolean;
+  class?: string;
+}
+
 export interface ContextMenuState {
   x: number;
   y: number;

From 4cec1c968b67183901314170851e7a64a5462b4b Mon Sep 17 00:00:00 2001
From: dklOrdix <dkl@ordix.de>
Date: Mon, 27 Jul 2026 10:37:03 +0200
Subject: [PATCH 117/136] Fix loading error states in storage UI (#259)

* Fix loading error states in storage UI

- Show skeleton placeholders/spinners during hydration to prevent
  flash-of-empty-state on page reload
- Persist sidebar width via CSS custom property for FOUC-free restore
- Render 403 errors through the proper +error.svelte boundary with
  breadcrumbs by running the universal load on SSR
- Add loading prop to BucketGrid and RecentItems for skeleton states

* fix loading during hydration

---------

Co-authored-by: F3l1x1vo <fli@ordix.de>
---
 src/app.html                                  |  10 +-
 .../storage/explorer/ObjectTable.svelte       |  14 +-
 .../storage/landing/BucketGrid.svelte         |  25 +-
 .../storage/landing/RecentItems.svelte        |  63 +++-
 .../storage/sidebar/BucketList.svelte         | 312 +++++++++---------
 .../storage/sidebar/resizable-panel.svelte.ts |   1 +
 src/routes/(app)/storage/+error.svelte        |  98 ++++--
 src/routes/(app)/storage/+layout.svelte       |   2 +-
 src/routes/(app)/storage/+layout.ts           |  46 ++-
 src/routes/(app)/storage/+page.svelte         |  10 +-
 .../storage/[bucket]/[...prefix]/+page.svelte |  98 ++----
 .../storage/[bucket]/[...prefix]/+page.ts     |  44 ++-
 12 files changed, 441 insertions(+), 282 deletions(-)

diff --git a/src/app.html b/src/app.html
index 023799df..ea0df32a 100644
--- a/src/app.html
+++ b/src/app.html
@@ -6,10 +6,18 @@
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <script>
       (function () {
-        const theme =
+        var theme =
           localStorage.getItem('theme') ||
           (window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light');
         document.documentElement.setAttribute('data-theme', theme);
+
+        var savedWidth = localStorage.getItem('storage_sidebar_width');
+        if (savedWidth) {
+          var w = parseInt(savedWidth, 10);
+          if (!isNaN(w) && w >= 120 && w <= 480) {
+            document.documentElement.style.setProperty('--storage-sidebar-width', w + 'px');
+          }
+        }
       })();
     </script>
     %sveltekit.head%
diff --git a/src/lib/components/storage/explorer/ObjectTable.svelte b/src/lib/components/storage/explorer/ObjectTable.svelte
index 6768e094..d728cfda 100644
--- a/src/lib/components/storage/explorer/ObjectTable.svelte
+++ b/src/lib/components/storage/explorer/ObjectTable.svelte
@@ -243,6 +243,18 @@
         </tr>
       {/if}
 
+      {#if storage.loading && storage.folders.length === 0 && storage.files.length === 0}
+        {#each [75, 60, 85, 45, 90] as width, i (i)}
+          <tr>
+            <td class="pr-0"><div class="skeleton h-4 w-4 animate-pulse rounded"></div></td>
+            <td><div class="skeleton h-4 animate-pulse rounded" style="width: {width}%"></div></td>
+            <td><div class="skeleton ml-auto h-4 w-16 animate-pulse rounded"></div></td>
+            <td><div class="skeleton h-4 w-24 animate-pulse rounded"></div></td>
+            <td></td>
+          </tr>
+        {/each}
+      {/if}
+
       {#if storage.archive.archiveTooLarge}
         <!-- Archive too large fallback -->
         <tr>
@@ -263,7 +275,7 @@
         {/each}
 
         <!-- Empty folder -->
-        {#if storage.folders.length === 0 && storage.files.length === 0}
+        {#if !storage.loading && storage.folders.length === 0 && storage.files.length === 0}
           <tr
             class={emptyDragOver
               ? 'bg-primary/20 outline-primary/50 outline -outline-offset-2'
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte b/src/lib/components/storage/landing/BucketGrid.svelte
index 01a29245..ca397000 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte
+++ b/src/lib/components/storage/landing/BucketGrid.svelte
@@ -9,9 +9,10 @@
 
   interface Props {
     buckets?: string[];
+    loading?: boolean;
   }
 
-  let { buckets = [] }: Props = $props();
+  let { buckets = [], loading = false }: Props = $props();
 
   let tooltipText = $state<string | null>(null);
   let tooltipX = $state(0);
@@ -51,7 +52,27 @@
   </button>
 </FloatingMenu>
 
-{#if buckets.length > 0}
+{#if loading}
+  <div
+    class="
+      grid grid-cols-2 gap-3
+      sm:grid-cols-3
+      md:grid-cols-4
+      lg:grid-cols-6
+    "
+    aria-label={m.storage_loading()}
+  >
+    <!-- eslint-disable-next-line @typescript-eslint/no-unused-vars -->
+    {#each [1, 2, 3, 4, 5, 6] as _, i (i)}
+      <div
+        class="border-base-300 bg-base-100 flex flex-col items-center gap-2 rounded-xl border p-4"
+      >
+        <div class="skeleton size-10 animate-pulse rounded-full" aria-hidden="true"></div>
+        <div class="skeleton h-4 w-16 animate-pulse rounded" aria-hidden="true"></div>
+      </div>
+    {/each}
+  </div>
+{:else if buckets.length > 0}
   <div
     class="
       grid grid-cols-2 gap-3
diff --git a/src/lib/components/storage/landing/RecentItems.svelte b/src/lib/components/storage/landing/RecentItems.svelte
index a58f3808..44e5e073 100644
--- a/src/lib/components/storage/landing/RecentItems.svelte
+++ b/src/lib/components/storage/landing/RecentItems.svelte
@@ -21,6 +21,12 @@
   import PreviewModal from '$lib/components/storage/modals/PreviewModal.svelte';
   import TimestampDisplay from '$lib/components/storage/shared/TimestampDisplay.svelte';
 
+  interface Props {
+    loading?: boolean;
+  }
+
+  let { loading = false }: Props = $props();
+
   const storage = getStorageState();
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const rr = (p: string) => resolveRoute(p as any);
@@ -39,8 +45,63 @@
   }
 </script>
 
+{#snippet skeletonRows()}
+  <table class="table-sm table w-full">
+    <thead>
+      <tr>
+        {#if activeTab === 'files'}
+          <th>{m.storage_recent_col_name()}</th>
+          <th>{m.storage_recent_col_location()}</th>
+          <th>{m.storage_recent_col_size()}</th>
+          <th>{m.storage_recent_col_visited()}</th>
+          <th class="w-16">{m.storage_recent_col_actions()}</th>
+        {:else}
+          <th>{m.storage_recent_col_name()}</th>
+          <th>{m.storage_recent_col_path()}</th>
+          <th>{m.storage_recent_col_visited()}</th>
+          <th class="w-16">{m.storage_recent_col_actions()}</th>
+        {/if}
+      </tr>
+    </thead>
+    <tbody>
+      <!-- eslint-disable-next-line @typescript-eslint/no-unused-vars -->
+      {#each [1, 2, 3, 4] as _, i (i)}
+        <tr>
+          <td>
+            <div class="flex items-center gap-2">
+              <div class="skeleton size-4 animate-pulse rounded" aria-hidden="true"></div>
+              <div class="skeleton h-4 w-32 animate-pulse rounded" aria-hidden="true"></div>
+            </div>
+          </td>
+          <td>
+            <div class="skeleton h-4 w-48 animate-pulse rounded" aria-hidden="true"></div>
+          </td>
+          {#if activeTab === 'files'}
+            <td>
+              <div class="skeleton h-4 w-16 animate-pulse rounded" aria-hidden="true"></div>
+            </td>
+          {/if}
+          <td>
+            <div class="skeleton h-4 w-24 animate-pulse rounded" aria-hidden="true"></div>
+          </td>
+          <td>
+            <div class="flex items-center gap-1">
+              <div class="skeleton size-6 animate-pulse rounded" aria-hidden="true"></div>
+              <div class="skeleton size-6 animate-pulse rounded" aria-hidden="true"></div>
+            </div>
+          </td>
+        </tr>
+      {/each}
+    </tbody>
+  </table>
+{/snippet}
+
 {#snippet tabPanel(isEmpty: boolean, emptyMessage: string, tableContent: Snippet)}
-  {#if isEmpty}
+  {#if loading}
+    <div class="overflow-x-auto" aria-label={m.storage_loading()}>
+      {@render skeletonRows()}
+    </div>
+  {:else if isEmpty}
     <p class="text-base-content/40 px-4 py-8 text-center text-sm">{emptyMessage}</p>
   {:else}
     <div class="overflow-x-auto">
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index be79dc0d..c661efaa 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -202,182 +202,188 @@
     border-base-300 bg-base-100 relative flex shrink-0 flex-col
     rounded-lg border
   "
-  style="width: {resize.width}px"
+  style="width: var(--storage-sidebar-width, {resize.width}px)"
   aria-label={m.storage_buckets_label()}
 >
-  <!-- Pinned Access section -->
-  {#if storage.bookmarks.pinnedLocations.length > 0}
-    <div class="border-base-300 max-h-1/2 overflow-y-auto border-b">
-      <div class="flex items-center px-3 py-2">
-        <span class="text-base-content/50 text-xs font-semibold tracking-wide uppercase">
-          {m.storage_pinned_label()}
-        </span>
-      </div>
-      <ul class="py-1" role="list">
-        {#each storage.bookmarks.pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
-          {@const active = isPinnedActive(pin)}
-          <li role="none" class="group relative">
-            <!-- eslint-disable svelte/no-navigation-without-resolve -->
-            <a
-              href={pinnedHref(pin)}
-              data-sveltekit-preload-data="off"
-              class="
+  {#if !storage.connected}
+    <div class="flex flex-1 items-center justify-center">
+      <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
+    </div>
+  {:else}
+    <!-- Pinned Access section -->
+    {#if storage.bookmarks.pinnedLocations.length > 0}
+      <div class="border-base-300 max-h-1/2 overflow-y-auto border-b">
+        <div class="flex items-center px-3 py-2">
+          <span class="text-base-content/50 text-xs font-semibold tracking-wide uppercase">
+            {m.storage_pinned_label()}
+          </span>
+        </div>
+        <ul class="py-1" role="list">
+          {#each storage.bookmarks.pinnedLocations as pin (pin.bucket + '::' + pin.prefix)}
+            {@const active = isPinnedActive(pin)}
+            <li role="none" class="group relative">
+              <!-- eslint-disable svelte/no-navigation-without-resolve -->
+              <a
+                href={pinnedHref(pin)}
+                data-sveltekit-preload-data="off"
+                class="
                 hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
                 pr-7 text-sm
                 {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}
                 {dropSidebarTarget === pin.prefix ? 'bg-primary/20' : ''}"
-              aria-current={active ? 'page' : undefined}
-              onmouseenter={(e) => showTooltip(e, pinnedLabel(pin))}
-              onmouseleave={hideTooltip}
-              onfocus={(e) => showTooltip(e, pinnedLabel(pin))}
-              onblur={hideTooltip}
-              ondragover={(e) => handleSidebarDragOver(e, pin.prefix)}
-              ondragleave={handleSidebarDragLeave}
-              ondrop={(e) => handleSidebarDrop(e, pin.bucket, pin.prefix)}
-            >
-              <!-- eslint-enable svelte/no-navigation-without-resolve -->
-              {#if pin.prefix === ''}
-                <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-              {:else}
-                <IconFolderOutline class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-              {/if}
-              <span class="truncate">{pinnedLabel(pin)}</span>
-            </a>
-            <button
-              class="
+                aria-current={active ? 'page' : undefined}
+                onmouseenter={(e) => showTooltip(e, pinnedLabel(pin))}
+                onmouseleave={hideTooltip}
+                onfocus={(e) => showTooltip(e, pinnedLabel(pin))}
+                onblur={hideTooltip}
+                ondragover={(e) => handleSidebarDragOver(e, pin.prefix)}
+                ondragleave={handleSidebarDragLeave}
+                ondrop={(e) => handleSidebarDrop(e, pin.bucket, pin.prefix)}
+              >
+                <!-- eslint-enable svelte/no-navigation-without-resolve -->
+                {#if pin.prefix === ''}
+                  <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+                {:else}
+                  <IconFolderOutline class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+                {/if}
+                <span class="truncate">{pinnedLabel(pin)}</span>
+              </a>
+              <button
+                class="
                 btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
                 p-0 opacity-0 transition-opacity
                 group-hover:opacity-100 focus:opacity-100
               "
-              onclick={(e) => openUnpinMenuFromButton(e, pin)}
-              aria-label={m.storage_more_options()}
-              title={m.storage_more_options()}
-            >
-              <IconMoreHoriz class="size-3.5" aria-hidden="true" />
-            </button>
-          </li>
-        {/each}
-      </ul>
-    </div>
-  {/if}
+                onclick={(e) => openUnpinMenuFromButton(e, pin)}
+                aria-label={m.storage_more_options()}
+                title={m.storage_more_options()}
+              >
+                <IconMoreHoriz class="size-3.5" aria-hidden="true" />
+              </button>
+            </li>
+          {/each}
+        </ul>
+      </div>
+    {/if}
 
-  <div
-    class="
+    <div
+      class="
       border-base-300 flex items-center justify-between border-b px-3 py-2
     "
-  >
-    <span
-      class="
+    >
+      <span
+        class="
         text-base-content/50 text-xs font-semibold tracking-wide uppercase
       "
-    >
-      {m.storage_buckets_label()}
-    </span>
-    <a
-      href={resolve('/storage')}
-      data-sveltekit-preload-data="off"
-      class="btn btn-ghost btn-xs group tooltip tooltip-right z-150 before:z-200"
-      title={m.storage_view_all_buckets()}
-      data-tip={m.storage_view_all_buckets()}
-    >
-      <IconGridView
-        class="group-hover:text-primary size-3.5 transition-colors"
-        aria-hidden="true"
-      />
-    </a>
-  </div>
-
-  <div class="min-h-0 flex-1 overflow-y-auto">
-    <ul class="py-1" role="list">
-      {#if storage.buckets.length === 0}
-        <li class="text-base-content/40 px-3 py-4 text-center text-xs">
-          {m.storage_buckets_empty()}
-        </li>
-      {:else}
-        {#each storage.buckets as bucket (bucket)}
-          <li role="none">
-            <a
-              href={resolve('/(app)/storage/[bucket]/[...prefix]', {
-                bucket: encodeURIComponent(bucket),
-                prefix: ''
-              })}
-              data-sveltekit-preload-data="off"
-              class="
+      >
+        {m.storage_buckets_label()}
+      </span>
+      <a
+        href={resolve('/storage')}
+        data-sveltekit-preload-data="off"
+        class="btn btn-ghost btn-xs group tooltip tooltip-right z-150 before:z-200"
+        title={m.storage_view_all_buckets()}
+        data-tip={m.storage_view_all_buckets()}
+      >
+        <IconGridView
+          class="group-hover:text-primary size-3.5 transition-colors"
+          aria-hidden="true"
+        />
+      </a>
+    </div>
+
+    <div class="min-h-0 flex-1 overflow-y-auto">
+      <ul class="py-1" role="list">
+        {#if storage.buckets.length === 0}
+          <li class="text-base-content/40 px-3 py-4 text-center text-xs">
+            {m.storage_buckets_empty()}
+          </li>
+        {:else}
+          {#each storage.buckets as bucket (bucket)}
+            <li role="none">
+              <a
+                href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+                  bucket: encodeURIComponent(bucket),
+                  prefix: ''
+                })}
+                data-sveltekit-preload-data="off"
+                class="
                   hover:bg-base-200 flex items-center gap-2
                   px-3 py-1.5 text-sm
                   {activeBucket === bucket
-                ? 'bg-primary/10 text-primary font-medium'
-                : 'text-base-content'}
+                  ? 'bg-primary/10 text-primary font-medium'
+                  : 'text-base-content'}
                   {dropSidebarTarget === '' && activeBucket === bucket ? 'bg-primary/20' : ''}"
-              aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
-              onmouseenter={(e) => showTooltip(e, bucket)}
-              onmouseleave={hideTooltip}
-              onfocus={(e) => showTooltip(e, bucket)}
-              onblur={hideTooltip}
-              oncontextmenu={(e) => openBucketContextMenu(e, bucket)}
-              ondragover={(e) => handleSidebarDragOver(e, '')}
-              ondragleave={handleSidebarDragLeave}
-              ondrop={(e) => handleSidebarDrop(e, bucket, '')}
-            >
-              <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-              <span class="truncate">{bucket}</span>
-            </a>
-          </li>
-        {/each}
-      {/if}
-    </ul>
-  </div>
-
-  <!-- Disconnect button -->
-  <div class="border-base-300 border-t p-2">
-    <form bind:this={disconnectForm} method="POST" action="/storage?/disconnect">
+                aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
+                onmouseenter={(e) => showTooltip(e, bucket)}
+                onmouseleave={hideTooltip}
+                onfocus={(e) => showTooltip(e, bucket)}
+                onblur={hideTooltip}
+                oncontextmenu={(e) => openBucketContextMenu(e, bucket)}
+                ondragover={(e) => handleSidebarDragOver(e, '')}
+                ondragleave={handleSidebarDragLeave}
+                ondrop={(e) => handleSidebarDrop(e, bucket, '')}
+              >
+                <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+                <span class="truncate">{bucket}</span>
+              </a>
+            </li>
+          {/each}
+        {/if}
+      </ul>
+    </div>
+
+    <!-- Disconnect button -->
+    <div class="border-base-300 border-t p-2">
+      <form bind:this={disconnectForm} method="POST" action="/storage?/disconnect">
+        <button
+          type="button"
+          class="btn text-base-content/60 btn-ghost btn-xs hover:text-error w-full"
+          onclick={() => (disconnectConfirmOpen = true)}
+        >
+          {m.storage_disconnect()}
+        </button>
+      </form>
+    </div>
+
+    <FloatingMenu
+      x={bucketCtx?.x ?? 0}
+      y={bucketCtx?.y ?? 0}
+      open={bucketCtx !== null}
+      onclose={closeBucketContextMenu}
+    >
       <button
-        type="button"
-        class="btn text-base-content/60 btn-ghost btn-xs hover:text-error w-full"
-        onclick={() => (disconnectConfirmOpen = true)}
+        role="menuitem"
+        class="btn btn-ghost btn-sm w-full justify-start gap-2"
+        onclick={openBucketDetails}
       >
-        {m.storage_disconnect()}
+        <IconInfo class="size-4" aria-hidden="true" />
+        {m.storage_action_details()}
       </button>
-    </form>
-  </div>
-
-  <FloatingMenu
-    x={bucketCtx?.x ?? 0}
-    y={bucketCtx?.y ?? 0}
-    open={bucketCtx !== null}
-    onclose={closeBucketContextMenu}
-  >
-    <button
-      role="menuitem"
-      class="btn btn-ghost btn-sm w-full justify-start gap-2"
-      onclick={openBucketDetails}
-    >
-      <IconInfo class="size-4" aria-hidden="true" />
-      {m.storage_action_details()}
-    </button>
-  </FloatingMenu>
-
-  <!-- Disconnect confirmation modal -->
-  <Modal bind:open={disconnectConfirmOpen} class="modal">
-    <div class="modal-box max-w-sm">
-      <h3 class="mb-3 flex items-center gap-2 text-lg font-bold">
-        <IconPowerOff class="text-error size-5 shrink-0" aria-hidden="true" />
-        {m.storage_disconnect_confirm_title()}
-      </h3>
-      <p class="text-base-content/80 text-sm">
-        {m.storage_disconnect_confirm_message()}
-      </p>
-      <div class="modal-action mt-6">
-        <button class="btn btn-ghost" onclick={() => (disconnectConfirmOpen = false)}>
-          {m.storage_disconnect_cancel()}
-        </button>
-        <button class="btn btn-outline btn-error" onclick={confirmDisconnect}>
-          <IconPowerOff class="size-4" aria-hidden="true" />
-          {m.storage_disconnect_confirm_button()}
-        </button>
+    </FloatingMenu>
+
+    <!-- Disconnect confirmation modal -->
+    <Modal bind:open={disconnectConfirmOpen} class="modal">
+      <div class="modal-box max-w-sm">
+        <h3 class="mb-3 flex items-center gap-2 text-lg font-bold">
+          <IconPowerOff class="text-error size-5 shrink-0" aria-hidden="true" />
+          {m.storage_disconnect_confirm_title()}
+        </h3>
+        <p class="text-base-content/80 text-sm">
+          {m.storage_disconnect_confirm_message()}
+        </p>
+        <div class="modal-action mt-6">
+          <button class="btn btn-ghost" onclick={() => (disconnectConfirmOpen = false)}>
+            {m.storage_disconnect_cancel()}
+          </button>
+          <button class="btn btn-outline btn-error" onclick={confirmDisconnect}>
+            <IconPowerOff class="size-4" aria-hidden="true" />
+            {m.storage_disconnect_confirm_button()}
+          </button>
+        </div>
       </div>
-    </div>
-  </Modal>
+    </Modal>
+  {/if}
 
   <ResizeHandle panel={resize} />
 </nav>
diff --git a/src/lib/components/storage/sidebar/resizable-panel.svelte.ts b/src/lib/components/storage/sidebar/resizable-panel.svelte.ts
index 80af2e0e..79aca024 100644
--- a/src/lib/components/storage/sidebar/resizable-panel.svelte.ts
+++ b/src/lib/components/storage/sidebar/resizable-panel.svelte.ts
@@ -36,6 +36,7 @@ export function createResizablePanel({
   function saveWidth(w: number) {
     try {
       localStorage.setItem(storageKey, String(w));
+      document.documentElement.style.setProperty('--storage-sidebar-width', w + 'px');
     } catch {
       /* ignore storage errors */
     }
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
index bcc2ce6a..1b9b49f3 100644
--- a/src/routes/(app)/storage/+error.svelte
+++ b/src/routes/(app)/storage/+error.svelte
@@ -2,17 +2,24 @@
   import { page } from '$app/state';
   import { resolve } from '$app/paths';
   import IconWarning from 'virtual:icons/material-symbols/warning';
+  import IconStorage from 'virtual:icons/material-symbols/storage';
+  import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
   import * as m from '$lib/paraglide/messages.js';
+  import { getStorageState } from '$lib/storage/context.js';
+
+  const storage = getStorageState();
+  storage.loading = false;
 
-  // page.params.bucket may be absent when a client-side universal load throws an
-  // error (the error boundary sits at the parent /storage level, and SvelteKit
-  // may not populate child-route params on the page store in that case).
-  // Fall back to parsing the bucket segment directly from the URL path.
   const bucket = $derived(
     page.params.bucket ||
       decodeURIComponent(page.url?.pathname?.split('/').filter(Boolean)[1] ?? '')
   );
 
+  const prefixParts = $derived.by(() => {
+    const segments = page.url?.pathname?.split('/').filter(Boolean) ?? [];
+    return decodeURIComponent(segments.slice(2).join('/') || '');
+  });
+
   function bucketErrorMessage(status: number, name: string): string | null {
     if (!name) return null;
     if (status === 403) return m.storage_error_access_denied({ bucket: name });
@@ -24,43 +31,66 @@
   const errorMessage = $derived(bucketErrorMessage(page.status, bucket));
 </script>
 
-<div
-  class="
-    flex flex-1 flex-col items-center justify-center gap-6 p-8 text-center
-  "
->
+<div class="bg-base-100 flex flex-1 flex-col overflow-hidden">
+  <div class="border-base-300 flex items-center gap-3 border-b px-6 py-3">
+    <nav aria-label="breadcrumb" class="flex min-w-0 flex-1 items-center gap-1 text-sm">
+      <span class="flex shrink-0 items-center gap-1">
+        <a
+          href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+            bucket: encodeURIComponent(bucket),
+            prefix: ''
+          })}
+          class="text-base-content/70 hover:bg-base-200 hover:text-base-content flex items-center gap-1.5 rounded-sm px-1.5 py-0.5 transition-colors"
+        >
+          <IconStorage class="size-4" aria-hidden="true" />
+          {bucket}
+        </a>
+      </span>
+      {#if prefixParts}
+        <IconChevronRight class="text-base-content/30 size-4 shrink-0" aria-hidden="true" />
+        <span class="text-base-content/50 min-w-0 truncate">{prefixParts}</span>
+      {/if}
+    </nav>
+  </div>
+
   <div
     class="
-      bg-error/10 text-error flex size-20 items-center justify-center
-      rounded-full
+      flex flex-1 flex-col items-center justify-center gap-6 p-8 text-center
     "
-    aria-hidden="true"
   >
-    <IconWarning class="size-10" aria-hidden="true" />
-  </div>
-
-  <div>
-    <p
+    <div
       class="
-        text-base-content/50 mb-1 text-sm font-medium tracking-widest uppercase
+        bg-error/10 text-error flex size-20 items-center justify-center
+        rounded-full
       "
+      aria-hidden="true"
     >
-      {m.storage_error_title()}
-    </p>
-    <h1 class="text-base-content text-3xl font-bold">
-      {page.status}
-    </h1>
-    <p class="text-base-content/70 mt-2 max-w-sm text-sm">
-      {errorMessage ?? page.error?.message ?? ''}
-    </p>
-  </div>
+      <IconWarning class="size-10" aria-hidden="true" />
+    </div>
+
+    <div>
+      <p
+        class="
+          text-base-content/50 mb-1 text-sm font-medium tracking-widest uppercase
+        "
+      >
+        {m.storage_error_title()}
+      </p>
+      <h1 class="text-base-content text-3xl font-bold">
+        {page.status}
+      </h1>
+      <p class="text-base-content/70 mt-2 max-w-sm text-sm">
+        {errorMessage ?? page.error?.message ?? ''}
+      </p>
+    </div>
 
-  <div class="flex flex-wrap items-center justify-center gap-3">
-    <a href={resolve('/storage')} class="btn btn-sm btn-primary">
-      {m.storage_error_back_to_storage()}
-    </a>
-    <button type="button" class="btn btn-ghost btn-sm" onclick={() => history.back()}>
-      {m.storage_error_go_back()}
-    </button>
+    <div class="flex flex-wrap items-center justify-center gap-3">
+      <a href="/storage" class="btn btn-sm btn-primary">
+        {m.storage_error_back_to_storage()}
+      </a>
+      <button type="button" class="btn btn-ghost btn-sm" onclick={() => history.back()}>
+        {m.storage_error_go_back()}
+      </button>
+    </div>
   </div>
 </div>
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index d73630cc..96374f74 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -38,7 +38,7 @@
   const isConnectionsRoute = $derived(page.url.pathname.startsWith('/storage/connections'));
 </script>
 
-{#if data.connected && !isConnectionsRoute}
+{#if !isConnectionsRoute && (data.connected || (data.hydrating && data.hasActiveConnection))}
   <div class="flex h-full min-h-0 gap-4">
     <BucketList />
     <div class="flex min-w-0 flex-1 flex-col">
diff --git a/src/routes/(app)/storage/+layout.ts b/src/routes/(app)/storage/+layout.ts
index a8593f9a..c82d37b4 100644
--- a/src/routes/(app)/storage/+layout.ts
+++ b/src/routes/(app)/storage/+layout.ts
@@ -19,7 +19,12 @@ const DISCONNECTED = {
  */
 export const load: LayoutLoad = async ({ fetch, data }) => {
   if (!browser) {
-    return { ...DISCONNECTED, connections: data.connections ?? [] };
+    return {
+      ...DISCONNECTED,
+      connections: data.connections ?? [],
+      hydrating: true as const,
+      hasActiveConnection: data.activeConnectionId != null
+    };
   }
 
   const connections = data.connections ?? [];
@@ -30,14 +35,24 @@ export const load: LayoutLoad = async ({ fetch, data }) => {
   const targetId = data.activeConnectionId ?? null;
   if (!targetId) {
     connectionStore.activeConnectionId = null;
-    return { ...DISCONNECTED, connections };
+    return {
+      ...DISCONNECTED,
+      connections,
+      hydrating: false as const,
+      hasActiveConnection: false as const
+    };
   }
 
   const target = connections.find((c) => c.id === targetId);
   if (!target) {
     // Session refers to a connection that has since been deleted.
     connectionStore.activeConnectionId = null;
-    return { ...DISCONNECTED, connections };
+    return {
+      ...DISCONNECTED,
+      connections,
+      hydrating: false as const,
+      hasActiveConnection: false as const
+    };
   }
 
   connectionStore.activeConnectionId = target.id;
@@ -47,11 +62,30 @@ export const load: LayoutLoad = async ({ fetch, data }) => {
       headers: { [STORAGE_CONNECTION_ID_HEADER]: target.id }
     });
 
-    if (!res.ok) return { ...DISCONNECTED, connections };
+    if (!res.ok) {
+      return {
+        ...DISCONNECTED,
+        connections,
+        hydrating: false as const,
+        hasActiveConnection: false as const
+      };
+    }
 
     const buckets = (await res.json()) as string[];
-    return { connected: true, buckets, connectionType: 's3', connections };
+    return {
+      connected: true,
+      buckets,
+      connectionType: 's3',
+      connections,
+      hydrating: false as const,
+      hasActiveConnection: true as const
+    };
   } catch {
-    return { ...DISCONNECTED, connections };
+    return {
+      ...DISCONNECTED,
+      connections,
+      hydrating: false as const,
+      hasActiveConnection: false as const
+    };
   }
 };
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index f8b86659..7758cab0 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -78,7 +78,7 @@
   });
 </script>
 
-{#if data.connected}
+{#if data.connected || (data.hydrating && data.hasActiveConnection)}
   <div class="relative flex h-full min-h-0 flex-col overflow-x-hidden overflow-y-auto p-2">
     {#if navigating?.to?.url.pathname.startsWith('/storage/')}
       <div
@@ -126,12 +126,16 @@
       </div>
       <p class="text-base-content/60 text-sm">{m.storage_buckets_subtitle()}</p>
     </div>
-    <BucketGrid buckets={storage.buckets} />
+    <BucketGrid buckets={storage.buckets} loading={data.hydrating} />
   </div>
   <div class="relative flex h-full min-h-0 flex-col overflow-y-auto p-2">
-    <RecentItems />
+    <RecentItems loading={data.hydrating} />
   </div>
   <AddBucketModal bind:open={addBucketOpen} />
+{:else if data.hydrating && !data.hasActiveConnection}
+  <div class="flex h-full items-center justify-center">
+    <span class="loading loading-lg loading-spinner text-primary" aria-hidden="true"></span>
+  </div>
 {:else if mounted}
   <StorageConnectForm
     connectionForm={data.connectionForm}
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
index e0da52cd..8efa9929 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
@@ -1,25 +1,38 @@
 <script lang="ts">
+  import { browser } from '$app/environment';
   import { goto, invalidateAll } from '$app/navigation';
   import { resolve } from '$app/paths';
   import { page } from '$app/state';
   import { getStorageState } from '$lib/storage/context.js';
   import FileExplorer from '$lib/components/storage/explorer/FileExplorer.svelte';
-  import IconWarning from 'virtual:icons/material-symbols/warning';
-  import * as m from '$lib/paraglide/messages.js';
 
   let { data } = $props();
   const storage = getStorageState();
 
-  // Inject navigation handler — page owns URL construction.
-  // Uses storage.bucket (not data.bucket) so that after a tab switch via
-  // snapshot restore the handler still builds URLs for the active tab's bucket.
+  // Set bucket/prefix immediately so breadcrumb renders correctly during SSR
+  // ($effect doesn't run on the server, but data is available from the load function)
+  // svelte-ignore state_referenced_locally
+  storage.bucket = data.bucket;
+  // svelte-ignore state_referenced_locally
+  storage.prefix = data.prefix;
+
+  // During SSR, $effect doesn't run, so storage.loading stays false and the
+  // empty state renders instead of the loading overlay. Setting loading here
+  // when hydrating ensures the loading spinner is present in the SSR HTML,
+  // preventing a flash of empty state on F5 reload before the client load completes.
+  // svelte-ignore state_referenced_locally
+  if (data.hydrating) storage.loading = true;
+
+  let hydrated = false;
+
+  // Inject navigation handler — page owns URL construction
   storage.setNavigationHandler((prefix, continuationToken, pageSize) => {
     const encodedPrefix = prefix
       ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';
 
     const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
-      bucket: encodeURIComponent(storage.bucket),
+      bucket: encodeURIComponent(data.bucket),
       prefix: encodedPrefix
     });
 
@@ -33,8 +46,6 @@
 
   // Inject refresh handler — navigates to the current bucket/prefix using
   // replaceState so that a refresh does not add a browser history entry.
-  // Reads storage.bucket/prefix at call time so it always reflects the active
-  // tab's location, even after a snapshot restore via history.replaceState.
   storage.setRefreshHandler(() => {
     const encodedPrefix = storage.prefix
       ? storage.prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
@@ -48,70 +59,31 @@
     const url = new URL(basePath, location.origin);
     if (storage.pageSize) url.searchParams.set('pageSize', String(storage.pageSize));
 
-    // If SvelteKit's internal route already points at the correct location,
-    // goto() would be a no-op (same URL) and loading would never clear.
-    // Use invalidateAll() instead — the route params are already correct.
     if (page.url.pathname === basePath) {
       void invalidateAll();
     } else {
-      // eslint-disable-next-line svelte/no-navigation-without-resolve -- base path is built with resolve(); URL object is needed to append query params
+      // eslint-disable-next-line svelte/no-navigation-without-resolve
       void goto(url, { replaceState: true });
     }
   });
 
-  // Sync server data into state whenever SvelteKit load runs
+  // Sync server data into state whenever SvelteKit load runs.
+  // On first client render (hydration) with SSR empty data, set loading=true
+  // so the spinner shows while the client-side load re-runs. Subsequent renders
+  // from client navigation call syncFromServer normally.
   $effect(() => {
-    // eslint-disable-next-line @typescript-eslint/no-unused-expressions
-    page.url.href;
+    if (!hydrated) {
+      hydrated = true;
+      // First client render — SSR data has hydrating:true. Set loading so the
+      // spinner appears while the universal load re-fetches on the client.
+      // Don't call syncFromServer yet — that would set loading=false with stale data.
+      if (browser && data.hydrating) {
+        storage.loading = true;
+        return;
+      }
+    }
     storage.syncFromServer(data.bucket, data.prefix, data.objects);
   });
 </script>
 
-{#if data.accessDenied}
-  <!--
-    403 is rendered inline rather than via +error.svelte because throwing from a
-    universal load during initial hydration (when data.connected=true causes
-    BucketList to mount) can escape the storage error boundary and fall through
-    to the root fallback. Rendering inline keeps the sidebar visible.
-  -->
-  <div
-    class="
-      flex flex-1 flex-col items-center justify-center gap-6 p-8 text-center
-    "
-  >
-    <div
-      class="
-        bg-error/10 text-error flex size-20 items-center justify-center
-        rounded-full
-      "
-      aria-hidden="true"
-    >
-      <IconWarning class="size-10" aria-hidden="true" />
-    </div>
-
-    <div>
-      <p
-        class="
-          text-base-content/50 mb-1 text-sm font-medium tracking-widest uppercase
-        "
-      >
-        {m.storage_error_title()}
-      </p>
-      <h1 class="text-base-content text-3xl font-bold">403</h1>
-      <p class="text-base-content/70 mt-2 max-w-sm text-sm">
-        {m.storage_error_access_denied({ bucket: data.bucket })}
-      </p>
-    </div>
-
-    <div class="flex flex-wrap items-center justify-center gap-3">
-      <a href={resolve('/storage')} class="btn btn-sm btn-primary">
-        {m.storage_error_back_to_storage()}
-      </a>
-      <button type="button" class="btn btn-ghost btn-sm" onclick={() => history.back()}>
-        {m.storage_error_go_back()}
-      </button>
-    </div>
-  </div>
-{:else}
-  <FileExplorer />
-{/if}
+<FileExplorer />
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
index 559b6cad..a30bf87d 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
@@ -2,6 +2,7 @@ import { browser } from '$app/environment';
 import { error, redirect } from '@sveltejs/kit';
 import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
+import * as m from '$lib/paraglide/messages.js';
 import type { PageLoad } from './$types';
 import type { StoragePage } from '$lib/storage/types.js';
 
@@ -13,23 +14,40 @@ const EMPTY_PAGE: StoragePage = {
 };
 
 /**
- * Client-side load: fetches the object list from the server using the connection
- * config from localStorage. Redirects to /storage if no connection is available.
- * During SSR this returns an empty page — the load re-runs on the client.
+ * Universal load: fetches the object list from the API.
+ *
+ * During SSR the fetch runs server-side so that permission errors (403) are
+ * caught by the SSR error boundary — this ensures our custom +error.svelte
+ * renders the full error page (breadcrumbs, icon, message, action buttons).
+ * On success during SSR we still return hydrating data; the client re-fetches
+ * and updates the page after hydration.
  */
 export const load: PageLoad = async ({ fetch, url, data }) => {
-  // Always pass server data through so PageData includes bucket/prefix.
   const { bucket, prefix } = data;
 
-  if (!browser) return { bucket, prefix, objects: EMPTY_PAGE };
-
   const connectionId = connectionStore.activeConnectionId ?? data.activeConnectionId;
   if (!connectionId) throw redirect(303, '/storage');
 
+  const query = new URLSearchParams({ bucket, prefix: prefix ?? '' });
+
+  if (!browser) {
+    const res = await fetch(`/api/storage/list?${query}`, {
+      headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+    });
+
+    if (!res.ok) {
+      if (res.status === 401) throw redirect(303, '/storage');
+      if (res.status === 403) throw error(403, m.storage_error_access_denied({ bucket }));
+      const body = (await res.json().catch(() => ({}))) as { message?: string };
+      throw error(res.status, body.message ?? 'Failed to load objects');
+    }
+
+    return { bucket, prefix, objects: EMPTY_PAGE, hydrating: true };
+  }
+
   const continuationToken = url.searchParams.get('continuationToken');
   const pageSizeParam = url.searchParams.get('pageSize');
 
-  const query = new URLSearchParams({ bucket, prefix: prefix ?? '' });
   if (continuationToken) query.set('continuationToken', continuationToken);
   if (pageSizeParam) query.set('pageSize', pageSizeParam);
 
@@ -39,19 +57,11 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
 
   if (!res.ok) {
     if (res.status === 401) throw redirect(303, '/storage');
-    // For 403 we return an accessDenied flag rather than throwing error().
-    // Throwing from a universal load during initial hydration (e.g. after
-    // page.goto) can bypass the +error.svelte boundary and fall through to the
-    // root fallback when data.connected=true causes BucketList to mount — a
-    // hydration-state mismatch that SvelteKit cannot safely recover from.
-    // Handling 403 inline in +page.svelte avoids the boundary entirely and
-    // keeps the sidebar visible so the user can navigate away.
-    if (res.status === 403)
-      return { bucket, prefix, objects: EMPTY_PAGE, accessDenied: true as const };
+    if (res.status === 403) throw error(403, m.storage_error_access_denied({ bucket }));
     const body = (await res.json().catch(() => ({}))) as { message?: string };
     throw error(res.status, body.message ?? 'Failed to load objects');
   }
 
   const objects = (await res.json()) as StoragePage;
-  return { bucket, prefix, objects };
+  return { bucket, prefix, objects, hydrating: false };
 };

From 785f2537955ae6115616cfbd1377c051423556da Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 27 Jul 2026 10:48:36 +0200
Subject: [PATCH 118/136] Keep tabs after page reload (#258)

* keep tabs after page reload

* fix e2e test
---
 src/lib/storage/tabs.svelte.spec.ts   | 22 +++++-----------
 src/lib/storage/tabs.svelte.ts        | 38 +++++++++++++--------------
 src/routes/(app)/storage/+page.svelte | 23 ++++++++++++++--
 3 files changed, 46 insertions(+), 37 deletions(-)

diff --git a/src/lib/storage/tabs.svelte.spec.ts b/src/lib/storage/tabs.svelte.spec.ts
index 6f39d943..9ec83f76 100644
--- a/src/lib/storage/tabs.svelte.spec.ts
+++ b/src/lib/storage/tabs.svelte.spec.ts
@@ -1,9 +1,5 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest';
-import {
-  TabsState,
-  requestTabsRestore,
-  type PersistedTabsState
-} from '$lib/storage/tabs.svelte.js';
+import { TabsState, type PersistedTabsState } from '$lib/storage/tabs.svelte.js';
 import { StorageState } from '$lib/storage/state.svelte.js';
 import { LS_TABS } from '$lib/storage/persistence.js';
 
@@ -535,8 +531,6 @@ describe('TabsState', () => {
       };
       localStorage.setItem(LS_TABS, JSON.stringify(saved));
 
-      requestTabsRestore();
-
       const storage = makeStorage('b1', '');
       const { ts } = makeTabs(storage, { persistEnabled: true });
       ts.ensureInitialTab();
@@ -545,7 +539,7 @@ describe('TabsState', () => {
       expect(ts.tabs.length).toBe(2);
     });
 
-    it('flag is consumed after ensureInitialTab so subsequent calls start fresh', () => {
+    it('restores from localStorage on every ensureInitialTab when persistEnabled', () => {
       const saved: PersistedTabsState = {
         tabs: [
           { id: 'a', label: 'A', bucket: 'b1', prefix: '' },
@@ -555,22 +549,18 @@ describe('TabsState', () => {
       };
       localStorage.setItem(LS_TABS, JSON.stringify(saved));
 
-      requestTabsRestore();
-
-      // First TabsState consumes the flag
+      // First TabsState restores from localStorage
       const storage1 = makeStorage('b1', '');
       const { ts: ts1 } = makeTabs(storage1, { persistEnabled: true });
       ts1.ensureInitialTab();
       expect(ts1.tabs.length).toBe(2);
 
-      // Reset localStorage to simulate a fresh session
-      localStorage.setItem(LS_TABS, JSON.stringify(saved));
-
-      // Second TabsState — flag is already consumed, starts fresh
+      // Second TabsState — persistence is still enabled and data exists,
+      // so it restores from localStorage again (handles page reloads)
       const storage2 = makeStorage('b1', '');
       const { ts: ts2 } = makeTabs(storage2, { persistEnabled: true });
       ts2.ensureInitialTab();
-      expect(ts2.tabs.length).toBe(1);
+      expect(ts2.tabs.length).toBe(2);
     });
   });
 });
diff --git a/src/lib/storage/tabs.svelte.ts b/src/lib/storage/tabs.svelte.ts
index 0a00888e..bbf7d9ea 100644
--- a/src/lib/storage/tabs.svelte.ts
+++ b/src/lib/storage/tabs.svelte.ts
@@ -52,18 +52,6 @@ export interface PersistedTabsState {
   connectionId?: string;
 }
 
-// ── Module-level restore request flag ────────────────────────────────────────
-// Set by the /storage banner when the user clicks "Restore tabs". Consumed
-// once by the next ensureInitialTab() call so the FileExplorer knows to
-// restore rather than start fresh. A module-level variable works here because
-// the banner navigates via SvelteKit (SPA navigation — no full page reload).
-
-let restoreRequestedOnNextMount = false;
-
-export function requestTabsRestore(): void {
-  restoreRequestedOnNextMount = true;
-}
-
 // ── Internal helpers ──────────────────────────────────────────────────────────
 
 const EMPTY_PAGE: StoragePage = { objects: [], hasNextPage: false, currentPage: 1, pageSize: 25 };
@@ -245,18 +233,30 @@ export class TabsState {
 
   // ── Tab operations ───────────────────────────────────────────────────────
 
-  /** Initialises tabs from the current storage state. If a restore was
-   *  requested via requestTabsRestore(), restores persisted tabs instead of
-   *  starting fresh. */
+  /** Initialises tabs from the current storage state. If persistence is
+   *  enabled, restores tabs from localStorage (handles both SPA navigation
+   *  via the /storage banner flag and full page reloads).
+   *
+   *  Tabs are only restored when the current storage bucket/prefix matches
+   *  the saved active tab's location — otherwise the user navigated to a
+   *  different location directly and stale tabs should not override it. */
   ensureInitialTab(): void {
     if (this.tabs.length > 0) return;
 
-    if (restoreRequestedOnNextMount && this.persistEnabled) {
-      restoreRequestedOnNextMount = false;
+    if (this.persistEnabled) {
       const saved = this.peekPersistedTabs();
       if (saved && saved.tabs.length > 0) {
-        this.restorePersistedTabs(saved);
-        return;
+        const activeIdx = saved.tabs.findIndex((pt) => pt.id === saved.activeTabId);
+        const activeTab = activeIdx >= 0 ? saved.tabs[activeIdx] : saved.tabs[0];
+        if (
+          activeTab &&
+          this.storage.bucket === activeTab.bucket &&
+          this.storage.prefix === activeTab.prefix
+        ) {
+          this.restorePersistedTabs(saved);
+          return;
+        }
+        this.clearPersistedTabs();
       }
     }
 
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 7758cab0..b90b99c4 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -8,7 +8,7 @@
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import { storageRestoreTabsEnabled } from '$lib/client/feature-flags.js';
-  import { requestTabsRestore, type PersistedTabsState } from '$lib/storage/tabs.svelte.js';
+  import { type PersistedTabsState } from '$lib/storage/tabs.svelte.js';
   import { LS_TABS } from '$lib/storage/persistence.js';
   import IconTabOutline from 'virtual:icons/material-symbols/tab-outline';
   import IconClose from 'virtual:icons/material-symbols/close';
@@ -49,10 +49,29 @@
     }
   });
 
+  // ── Track whether the user explicitly clicked "Restore tabs" ──
+  // When navigating from the landing page to a bucket, we need to know
+  // if the restore button was clicked or if the user just clicked a bucket
+  // directly. In the latter case, persisted tabs should be cleared so the
+  // FileExplorer starts fresh rather than auto-restoring.
+  let restoreClicked = $state(false);
+
+  $effect(() => {
+    if (!browser || !storageRestoreTabsEnabled) return;
+    const to = navigating?.to?.url.pathname;
+    if (!to || !to.startsWith('/storage/') || to === '/storage') return;
+    // Navigation to a bucket sub-path is starting — if the user did not
+    // explicitly click "Restore tabs", clear persisted tabs so that
+    // ensureInitialTab creates a fresh single tab.
+    if (!restoreClicked) {
+      localStorage.removeItem(LS_TABS);
+    }
+  });
+
   function handleRestore() {
     if (!savedTabs) return;
 
-    requestTabsRestore();
+    restoreClicked = true;
 
     const active = savedTabs.tabs.find((t) => t.id === savedTabs!.activeTabId) ?? savedTabs.tabs[0];
     const encodedPrefix = active.prefix

From 86f9fcb65769a9d7576e004924778902b285b5b9 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 29 Jul 2026 07:10:58 +0200
Subject: [PATCH 119/136] #220 #236 bind keys to font size inside code editor,
 add select all files keybinding (#265)

---
 src/lib/components/editor/MonacoEditor.svelte | 79 +++++++++++++++++++
 src/lib/components/editor/TextEditor.svelte   | 79 +++++++++++++++++++
 src/lib/storage/state.svelte.ts               |  3 +
 3 files changed, 161 insertions(+)

diff --git a/src/lib/components/editor/MonacoEditor.svelte b/src/lib/components/editor/MonacoEditor.svelte
index 7a378508..64b64d75 100644
--- a/src/lib/components/editor/MonacoEditor.svelte
+++ b/src/lib/components/editor/MonacoEditor.svelte
@@ -143,6 +143,8 @@
     monaco?.editor.setTheme(toMonacoTheme(theme.current));
   });
 
+  const cleanups: (() => void)[] = [];
+
   onMount(async () => {
     // Load Monaco's NLS bundle for the active locale. Static import strings are
     // required — Vite cannot bundle bare-specifier template literals at build time.
@@ -234,9 +236,86 @@
         run: onExecuteAll
       });
     }
+
+    // Ctrl+Mouse Wheel — zoom via built-in command (capture phase on document,
+    // because Monaco's internal handler calls stopPropagation on wheel events,
+    // so a container-level listener never fires)
+    const onWheel = (e: WheelEvent) => {
+      if ((e.ctrlKey || e.metaKey) && container.contains(e.target as Node)) {
+        e.preventDefault();
+        editor?.trigger(
+          'keyboard',
+          e.deltaY < 0 ? 'editor.action.fontZoomIn' : 'editor.action.fontZoomOut',
+          {}
+        );
+      }
+    };
+    document.addEventListener('wheel', onWheel, { capture: true, passive: false });
+    cleanups.push(() => document.removeEventListener('wheel', onWheel, { capture: true }));
+
+    // Prevent browser zoom & invoke font zoom for any keys Monaco doesn't handle
+    const handleZoomKeys = (e: KeyboardEvent) => {
+      if (!editor?.hasTextFocus()) return;
+      if (!(e.ctrlKey || e.metaKey)) return;
+      let command: string | null = null;
+      if (e.key === '=' || e.key === '+' || e.code === 'NumpadAdd') {
+        command = 'editor.action.fontZoomIn';
+      } else if (e.key === '-' || e.code === 'NumpadSubtract') {
+        command = 'editor.action.fontZoomOut';
+      } else if (e.key === '0' || e.code === 'Numpad0') {
+        command = 'editor.action.fontZoomReset';
+      }
+      if (command) {
+        if (!e.defaultPrevented) editor?.trigger('keyboard', command, {});
+        e.preventDefault();
+      }
+    };
+    document.addEventListener('keydown', handleZoomKeys);
+    cleanups.push(() => document.removeEventListener('keydown', handleZoomKeys));
+
+    // Bind keyboard shortcuts to the built-in font zoom commands
+    const zoomDisposable = monaco!.editor.addKeybindingRules([
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Equal,
+        command: 'editor.action.fontZoomIn',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyMod.Shift | monaco!.KeyCode.Equal,
+        command: 'editor.action.fontZoomIn',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.NumpadAdd,
+        command: 'editor.action.fontZoomIn',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Minus,
+        command: 'editor.action.fontZoomOut',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.NumpadSubtract,
+        command: 'editor.action.fontZoomOut',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Digit0,
+        command: 'editor.action.fontZoomReset',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Numpad0,
+        command: 'editor.action.fontZoomReset',
+        when: 'editorFocus'
+      }
+    ]);
+    cleanups.push(() => zoomDisposable.dispose());
   });
 
   onDestroy(() => {
+    cleanups.forEach((fn) => fn());
     editor?.dispose();
   });
 </script>
diff --git a/src/lib/components/editor/TextEditor.svelte b/src/lib/components/editor/TextEditor.svelte
index 8645301f..db870cf3 100644
--- a/src/lib/components/editor/TextEditor.svelte
+++ b/src/lib/components/editor/TextEditor.svelte
@@ -148,6 +148,8 @@
     monaco?.editor.setTheme(toMonacoTheme(theme.current));
   });
 
+  const cleanups: (() => void)[] = [];
+
   onMount(async () => {
     if (!browser) return;
 
@@ -202,10 +204,87 @@
       });
     }
 
+    // Ctrl+Mouse Wheel — zoom via built-in command (capture phase on document,
+    // because Monaco's internal handler calls stopPropagation on wheel events,
+    // so a container-level listener never fires)
+    const onWheel = (e: WheelEvent) => {
+      if ((e.ctrlKey || e.metaKey) && container.contains(e.target as Node)) {
+        e.preventDefault();
+        editor?.trigger(
+          'keyboard',
+          e.deltaY < 0 ? 'editor.action.fontZoomIn' : 'editor.action.fontZoomOut',
+          {}
+        );
+      }
+    };
+    document.addEventListener('wheel', onWheel, { capture: true, passive: false });
+    cleanups.push(() => document.removeEventListener('wheel', onWheel, { capture: true }));
+
+    // Prevent browser zoom & invoke font zoom for any keys Monaco doesn't handle
+    const handleZoomKeys = (e: KeyboardEvent) => {
+      if (!editor?.hasTextFocus()) return;
+      if (!(e.ctrlKey || e.metaKey)) return;
+      let command: string | null = null;
+      if (e.key === '=' || e.key === '+' || e.code === 'NumpadAdd') {
+        command = 'editor.action.fontZoomIn';
+      } else if (e.key === '-' || e.code === 'NumpadSubtract') {
+        command = 'editor.action.fontZoomOut';
+      } else if (e.key === '0' || e.code === 'Numpad0') {
+        command = 'editor.action.fontZoomReset';
+      }
+      if (command) {
+        if (!e.defaultPrevented) editor?.trigger('keyboard', command, {});
+        e.preventDefault();
+      }
+    };
+    document.addEventListener('keydown', handleZoomKeys);
+    cleanups.push(() => document.removeEventListener('keydown', handleZoomKeys));
+
+    // Bind keyboard shortcuts to the built-in font zoom commands
+    const zoomDisposable = monaco!.editor.addKeybindingRules([
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Equal,
+        command: 'editor.action.fontZoomIn',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyMod.Shift | monaco!.KeyCode.Equal,
+        command: 'editor.action.fontZoomIn',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.NumpadAdd,
+        command: 'editor.action.fontZoomIn',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Minus,
+        command: 'editor.action.fontZoomOut',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.NumpadSubtract,
+        command: 'editor.action.fontZoomOut',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Digit0,
+        command: 'editor.action.fontZoomReset',
+        when: 'editorFocus'
+      },
+      {
+        keybinding: monaco!.KeyMod.CtrlCmd | monaco!.KeyCode.Numpad0,
+        command: 'editor.action.fontZoomReset',
+        when: 'editorFocus'
+      }
+    ]);
+    cleanups.push(() => zoomDisposable.dispose());
+
     ready = true;
   });
 
   onDestroy(() => {
+    cleanups.forEach((fn) => fn());
     editor?.dispose();
   });
 </script>
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 6cb7c641..ce216bd2 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -782,6 +782,9 @@ export class StorageState {
       if (!this.archive.isInArchive && this.clipboard) {
         void this.executeAction('paste');
       }
+    } else if (isCtrl && e.key === 'a') {
+      e.preventDefault();
+      this.selectAll(!this.allSelected);
     } else if (e.key === 'F2') {
       if (!this.archive.isInArchive && this.selectedKeys.size === 1) {
         void this.executeAction('rename');

From df8629edb3a78ba3e0234b6395858aff92bdf9d1 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 29 Jul 2026 09:48:07 +0200
Subject: [PATCH 120/136] CSV column horizontal scrolling (#261)

* add sliding window horizontal scrolling to CSV preview, fix paraglide pluralization, fix shortcuts not being disabled in modal

* fix csv download

* #238 fix newline on file end, fix phantom rows, improve row count label

* fix e2e tests

* fix lint

* #238 add label for already showing all rows
---
 messages/de.json                              |  89 +++++-
 messages/en.json                              |  89 +++++-
 .../PreviewModal.complex.svelte.spec.ts       |  10 +-
 .../storage/modals/PreviewModal.svelte        |  15 +-
 .../storage/modals/preview/CsvPreview.svelte  | 136 +++++++--
 .../modals/preview/ParquetPreview.svelte      |  14 +-
 src/lib/server/storage/preview/csv.test.ts    | 273 ++++++++++++++++++
 src/lib/server/storage/preview/csv.ts         |  39 ++-
 src/lib/storage/api.test-utils.ts             |   4 +
 src/lib/storage/api.ts                        |   7 +
 src/lib/storage/state.svelte.spec.ts          |   3 +
 src/lib/storage/state.svelte.ts               |   2 +-
 12 files changed, 618 insertions(+), 63 deletions(-)
 create mode 100644 src/lib/server/storage/preview/csv.test.ts

diff --git a/messages/de.json b/messages/de.json
index 515c7f0e..711ca4d3 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -352,6 +352,7 @@
   "storage_preview_image_alt": "Vorschau von {name}",
   "storage_preview_csv_columns": "{count} weitere Spalten",
   "storage_preview_csv_rows": "Erste {count} Zeilen werden angezeigt",
+  "storage_preview_csv_rows_complete": "Alle {count} Zeilen werden angezeigt",
   "storage_preview_parquet_rows": "Erste {count} von {total} Zeilen werden angezeigt (Parquet)",
   "storage_preview_infinite_scroll_disabled": "Dies ist das Ende der Vorschau. Laden Sie die vollständige Datei herunter oder bitten Sie den Administrator, das unendliche Scrollen zu aktivieren, um weitere Zeilen in dieser Vorschau zu laden.",
   "storage_preview_pdf_too_large": "PDF ist zu groß für die Inline-Vorschau.",
@@ -428,7 +429,16 @@
   "storage_tab_rename": "Tab umbenennen",
   "storage_tab_list": "Explorer-Tabs",
   "storage_tab_context_menu": "Tab-Optionen",
-  "storage_restore_tabs_message": "Sie haben {count} gespeicherte(n) Tab(s) aus Ihrer letzten Sitzung.",
+  "storage_restore_tabs_message": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "Sie haben 1 gespeicherten Tab aus Ihrer letzten Sitzung.",
+        "countPlural=other": "Sie haben {count} gespeicherte Tabs aus Ihrer letzten Sitzung."
+      }
+    }
+  ],
   "storage_restore_tabs_action": "Tabs wiederherstellen",
   "storage_preview_parquet_tab_aria": "Parquet-Vorschau-Registerkarten",
   "storage_preview_parquet_tab_metadata": "Metadaten",
@@ -545,20 +555,83 @@
   "storage_details_object_lock": "Objektsperre",
   "storage_details_object_lock_mode": "Sperrmodus",
   "storage_details_object_lock_until": "Aufbewahren bis",
-  "storage_action_cut_success": "{count} Element(e) ausgeschnitten",
-  "storage_action_copy_success": "{count} Element(e) kopiert",
-  "storage_action_paste_success": "{count} Element(e) eingefügt",
+  "storage_action_cut_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element ausgeschnitten",
+        "countPlural=other": "{count} Elemente ausgeschnitten"
+      }
+    }
+  ],
+  "storage_action_copy_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element kopiert",
+        "countPlural=other": "{count} Elemente kopiert"
+      }
+    }
+  ],
+  "storage_action_paste_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element eingefügt",
+        "countPlural=other": "{count} Elemente eingefügt"
+      }
+    }
+  ],
   "storage_action_paste_error": "Elemente konnten nicht eingefügt werden. Bitte versuchen Sie es erneut.",
-  "storage_action_paste_partial": "{count} Element(e) konnten nicht eingefügt werden.",
+  "storage_action_paste_partial": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element konnte nicht eingefügt werden.",
+        "countPlural=other": "{count} Elemente konnten nicht eingefügt werden."
+      }
+    }
+  ],
   "storage_action_paste_error_source_not_found": "Einfügen fehlgeschlagen — die Quell-Elemente wurden möglicherweise gelöscht oder verschoben.",
   "storage_action_paste_archive_error": "Einfügen innerhalb eines Archivs nicht möglich.",
-  "storage_action_move_success": "{count} Element(e) verschoben",
-  "storage_action_move_partial": "{count} Element(e) konnten nicht verschoben werden.",
+  "storage_action_move_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element verschoben",
+        "countPlural=other": "{count} Elemente verschoben"
+      }
+    }
+  ],
+  "storage_action_move_partial": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element konnte nicht verschoben werden.",
+        "countPlural=other": "{count} Elemente konnten nicht verschoben werden."
+      }
+    }
+  ],
   "storage_action_move_error": "Elemente konnten nicht verschoben werden. Bitte versuchen Sie es erneut.",
   "storage_action_move_error_not_connected": "Keine Speicherverbindung konfiguriert. Bitte verbinden Sie sich zuerst.",
   "storage_action_move_error_access_denied": "Zugriff verweigert. Sie haben keine Berechtigung zum Verschieben.",
   "storage_move_confirm_title": "Elemente verschieben",
-  "storage_move_confirm_body": "{count} Element(e) nach \"{destination}\" verschieben?",
+  "storage_move_confirm_body": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 Element nach \"{destination}\" verschieben?",
+        "countPlural=other": "{count} Elemente nach \"{destination}\" verschieben?"
+      }
+    }
+  ],
   "storage_move_confirm_label": "Verschieben",
   "storage_move_confirm_cancel": "Abbrechen",
   "storage_move_confirm_more": "+{count} mehr",
diff --git a/messages/en.json b/messages/en.json
index 7281cc25..35ccd15c 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -352,6 +352,7 @@
   "storage_preview_image_alt": "Preview of {name}",
   "storage_preview_csv_columns": "{count} more columns",
   "storage_preview_csv_rows": "Showing first {count} rows",
+  "storage_preview_csv_rows_complete": "Showing all {count} rows",
   "storage_preview_parquet_rows": "Showing first {count} of {total} rows (parquet)",
   "storage_preview_infinite_scroll_disabled": "This is the end of the preview. Download the full file or ask the administrator to enable infinite scrolling to load more rows in this preview.",
   "storage_preview_pdf_too_large": "PDF is too large to preview inline.",
@@ -428,7 +429,16 @@
   "storage_tab_rename": "Rename tab",
   "storage_tab_list": "Explorer tabs",
   "storage_tab_context_menu": "Tab options",
-  "storage_restore_tabs_message": "You have {count} saved tab(s) from your last session.",
+  "storage_restore_tabs_message": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "You have 1 saved tab from your last session.",
+        "countPlural=other": "You have {count} saved tabs from your last session."
+      }
+    }
+  ],
   "storage_restore_tabs_action": "Restore tabs",
   "storage_preview_parquet_tab_aria": "Parquet preview tabs",
   "storage_preview_parquet_tab_metadata": "Metadata",
@@ -545,20 +555,83 @@
   "storage_details_object_lock": "Object lock",
   "storage_details_object_lock_mode": "Lock mode",
   "storage_details_object_lock_until": "Retain until",
-  "storage_action_cut_success": "{count} item(s) cut",
-  "storage_action_copy_success": "{count} item(s) copied",
-  "storage_action_paste_success": "{count} item(s) pasted",
+  "storage_action_cut_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 item cut",
+        "countPlural=other": "{count} items cut"
+      }
+    }
+  ],
+  "storage_action_copy_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 item copied",
+        "countPlural=other": "{count} items copied"
+      }
+    }
+  ],
+  "storage_action_paste_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 item pasted",
+        "countPlural=other": "{count} items pasted"
+      }
+    }
+  ],
   "storage_action_paste_error": "Could not paste items. Please try again.",
-  "storage_action_paste_partial": "{count} item(s) could not be pasted.",
+  "storage_action_paste_partial": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 item could not be pasted.",
+        "countPlural=other": "{count} items could not be pasted."
+      }
+    }
+  ],
   "storage_action_paste_error_source_not_found": "Could not paste — the source items may have been deleted or moved.",
   "storage_action_paste_archive_error": "Cannot paste inside an archive.",
-  "storage_action_move_success": "{count} item(s) moved",
-  "storage_action_move_partial": "{count} item(s) could not be moved.",
+  "storage_action_move_success": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 item moved",
+        "countPlural=other": "{count} items moved"
+      }
+    }
+  ],
+  "storage_action_move_partial": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "1 item could not be moved.",
+        "countPlural=other": "{count} items could not be moved."
+      }
+    }
+  ],
   "storage_action_move_error": "Could not move items. Please try again.",
   "storage_action_move_error_not_connected": "No storage connection configured. Please connect first.",
   "storage_action_move_error_access_denied": "Access denied. You do not have permission to move items.",
   "storage_move_confirm_title": "Move items",
-  "storage_move_confirm_body": "Move {count} item(s) to \"{destination}\"?",
+  "storage_move_confirm_body": [
+    {
+      "declarations": ["input count", "local countPlural = count: plural"],
+      "selectors": ["countPlural"],
+      "match": {
+        "countPlural=one": "Move 1 item to \"{destination}\"?",
+        "countPlural=other": "Move {count} items to \"{destination}\"?"
+      }
+    }
+  ],
   "storage_move_confirm_label": "Move",
   "storage_move_confirm_cancel": "Cancel",
   "storage_move_confirm_more": "+{count} more",
diff --git a/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts b/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
index 836f3165..980d240c 100644
--- a/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
+++ b/src/lib/components/storage/modals/PreviewModal.complex.svelte.spec.ts
@@ -124,10 +124,12 @@ describe('PreviewModal complex previews', () => {
       render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
       await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
       await expect.element(page.getByText('val1')).toBeInTheDocument();
-      await expect.element(page.getByText(/showing first 250 of 10,000 rows/i)).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('paragraph'))
+        .toHaveTextContent(/showing first 1 of 10,000 rows/i);
     });
 
-    it('should show row count badge when parquet is truncated', async () => {
+    it('should show row count badge when parquet is truncated with previewRows header', async () => {
       fetchMock.mockResolvedValue(
         mockFetchResponse(parquetNdjson(['col1', 'col2'], [['val1', 'val2']], 10000), {
           contentType: 'application/json',
@@ -141,7 +143,9 @@ describe('PreviewModal complex previews', () => {
       render(PreviewModal, { ...defaultProps, objectKey: 'data/file.parquet' });
       await expect.element(page.getByText('file.parquet')).toBeInTheDocument();
       await expect.element(page.getByText('val1')).toBeInTheDocument();
-      await expect.element(page.getByText(/showing first 250 of 10,000 rows/i)).toBeInTheDocument();
+      await expect
+        .element(page.getByRole('paragraph'))
+        .toHaveTextContent(/showing first 1 of 10,000 rows/i);
     });
   });
 
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index d02092f5..68ad50e9 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -570,7 +570,7 @@
     if (!objectKey) return;
 
     try {
-      const res = await storage.api.preview({ bucket, key: objectKey });
+      const res = await storage.api.download({ bucket, key: objectKey });
       if (!res.ok) {
         addToast('error', m.storage_download_error_unknown());
         return;
@@ -796,12 +796,15 @@
             <span class="badge badge-neutral badge-sm font-mono"
               >{formatFileSize(preview.totalSize)}</span
             >
-            {#if preview.truncated}
+            {#if csvShowingRowsCount > 0}
               <span class="badge badge-soft badge-warning badge-sm">
-                {m.storage_preview_parquet_rows({
-                  count: csvShowingRowsCount.toLocaleString(getLocale()),
-                  total: preview.totalRows.toLocaleString(getLocale())
-                })}
+                {csvTotalRows === csvShowingRowsCount
+                  ? m.storage_preview_csv_rows_complete({
+                      count: csvShowingRowsCount.toLocaleString(getLocale())
+                    })
+                  : m.storage_preview_csv_rows({
+                      count: csvShowingRowsCount.toLocaleString(getLocale())
+                    })}
               </span>
             {/if}
           </div>
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index fdb1a939..397c2400 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -61,6 +61,8 @@
   let loadingChunks = $state<Set<number>>(new Set());
 
   let columnWidths = $state<number[]>([]);
+  let containerWidth = $state(800);
+  let scrollLeft = $state(0);
 
   function textWidth(text: string): number {
     if (typeof document === 'undefined') return text.length * 7;
@@ -91,6 +93,64 @@
     }
   }
 
+  const LINE_NUM_WIDTH = 40;
+  const COL_BUFFER = 3;
+
+  function sumColWidths(from: number, to: number): number {
+    if (columnWidths.length === 0) {
+      const clampedFrom = Math.max(0, Math.min(from, headers.length));
+      const clampedTo = Math.max(clampedFrom, Math.min(to, headers.length));
+      return (clampedTo - clampedFrom) * 120;
+    }
+    let s = 0;
+    for (let i = from; i < to && i < columnWidths.length; i++) {
+      s += columnWidths[i] || 80;
+    }
+    return s;
+  }
+
+  function findDataColIndex(scrollPos: number): number {
+    if (scrollPos <= LINE_NUM_WIDTH) return 0;
+    if (columnWidths.length === 0) {
+      return Math.max(0, Math.floor((scrollPos - LINE_NUM_WIDTH) / 120));
+    }
+    let offset = LINE_NUM_WIDTH;
+    for (let i = 0; i < columnWidths.length; i++) {
+      const w = columnWidths[i] || 80;
+      if (scrollPos < offset + w) return i;
+      offset += w;
+    }
+    return columnWidths.length;
+  }
+
+  let totalTableWidth = $derived(
+    isLegacyMode || isSimpleMode ? 0 : LINE_NUM_WIDTH + sumColWidths(0, headers.length)
+  );
+
+  let colStartIndex = $derived.by(() => {
+    if (isLegacyMode || isSimpleMode) return 0;
+    const idx = findDataColIndex(scrollLeft);
+    return Math.max(0, Math.min(idx - COL_BUFFER, headers.length - 1));
+  });
+
+  let colEndIndex = $derived.by(() => {
+    if (isLegacyMode || isSimpleMode) return headers.length;
+    const idx = findDataColIndex(scrollLeft + containerWidth);
+    return Math.min(headers.length, idx + 1 + COL_BUFFER);
+  });
+
+  let leftPadWidth = $derived(isLegacyMode || isSimpleMode ? 0 : sumColWidths(0, colStartIndex));
+
+  let rightPadWidth = $derived(
+    isLegacyMode || isSimpleMode ? 0 : sumColWidths(colEndIndex, headers.length)
+  );
+
+  let totalCellCount = $derived(
+    isLegacyMode || isSimpleMode
+      ? headers.length + 1
+      : 1 + (colEndIndex - colStartIndex) + (leftPadWidth > 0 ? 1 : 0) + (rightPadWidth > 0 ? 1 : 0)
+  );
+
   onMount(() => {
     if (!isLegacyMode && !isSimpleMode) populateChunk0();
   });
@@ -110,10 +170,15 @@
     if (keys.length === 0) return 0;
     return Math.max(...keys);
   });
+  let loadedRowsCount = $derived(
+    isLegacyMode || isSimpleMode
+      ? 0
+      : Object.values(loadedChunks).reduce((sum, chunk) => sum + chunk.length, 0)
+  );
   let virtualTotalRows = $derived(
     isLegacyMode || isSimpleMode
       ? 0
-      : Math.min(totalRows, (highestLoadedChunk + 1) * CHUNK_SIZE + 10)
+      : Math.min(totalRows, Math.max(loadedRowsCount, (highestLoadedChunk + 1) * CHUNK_SIZE + 10))
   );
 
   let startIndex = $derived(
@@ -171,9 +236,6 @@
     });
   });
 
-  const loadedRowsCount = $derived(
-    isLegacyMode || isSimpleMode ? 0 : Object.keys(loadedChunks).length * CHUNK_SIZE
-  );
   const isTruncated = $derived(
     isLegacyMode
       ? textTruncated
@@ -182,7 +244,6 @@
         : totalRows > loadedRowsCount
   );
   const formattedLoadedRowsCount = $derived(loadedRowsCount.toLocaleString(getLocale()));
-  const formattedTotalRows = $derived(totalRows.toLocaleString(getLocale()));
 
   $effect(() => {
     if (!isLegacyMode && !isSimpleMode) {
@@ -223,7 +284,7 @@
       </table>
       {#if textTruncated}
         <p class="text-base-content/50 px-4 py-2 text-xs italic">
-          {m.storage_preview_csv_rows({ count: textRows.length })}
+          {m.storage_preview_csv_rows({ count: textRows.length.toLocaleString(getLocale()) })}
         </p>
       {/if}
     {/if}
@@ -274,27 +335,47 @@
     {#if headers.length === 0}
       <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
     {:else}
+      <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
       <div
         class="min-h-0 w-full flex-1 overflow-auto"
+        tabindex="0"
+        role="region"
+        aria-label="CSV preview"
         bind:clientHeight={containerHeight}
-        onscroll={(e) => (scrollTop = e.currentTarget.scrollTop)}
+        bind:clientWidth={containerWidth}
+        onscroll={(e) => {
+          scrollTop = e.currentTarget.scrollTop;
+          scrollLeft = e.currentTarget.scrollLeft;
+        }}
       >
-        <table class="table-xs table table-fixed" aria-label="CSV preview">
+        <table
+          class="table-xs table table-fixed"
+          style={totalTableWidth > 0 ? `width: ${totalTableWidth}px` : ''}
+          aria-label="CSV preview"
+        >
           <thead class="bg-base-200 text-base-content/60 sticky top-0 z-10 text-xs shadow-sm">
             <tr>
               <th class="text-base-content/30 w-10 text-right font-normal"></th>
-              {#each headers as header, j (header)}
+              {#if leftPadWidth > 0}
+                <th style="width: {leftPadWidth}px" class="border-0 p-0"></th>
+              {/if}
+              {#each headers.slice(colStartIndex, colEndIndex) as header, j (colStartIndex + j)}
                 <th
                   class="truncate font-semibold"
-                  style={columnWidths.length > 0 ? `width: ${columnWidths[j]}px` : ''}>{header}</th
+                  style={columnWidths.length > 0 && columnWidths[colStartIndex + j] !== undefined
+                    ? `width: ${columnWidths[colStartIndex + j]}px`
+                    : 'width: 120px'}>{header}</th
                 >
               {/each}
+              {#if rightPadWidth > 0}
+                <th style="width: {rightPadWidth}px" class="border-0 p-0"></th>
+              {/if}
             </tr>
           </thead>
           <tbody>
             {#if startIndex > 0}
               <tr style="height: {startIndex * ROW_HEIGHT}px;">
-                <td colspan={headers.length + 1} class="border-0 p-0"></td>
+                <td colspan={totalCellCount} class="border-0 p-0"></td>
               </tr>
             {/if}
             {#each visibleRows as row (row.index)}
@@ -302,12 +383,23 @@
                 <td class="text-base-content/30 w-10 pr-1 text-right text-xs select-none"
                   >{(row.index + 1).toLocaleString(getLocale())}</td
                 >
+                {#if leftPadWidth > 0}
+                  <td style="width: {leftPadWidth}px" class="border-0 p-0"></td>
+                {/if}
                 {#if row.data !== null && row.data !== undefined}
                   <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
-                  {#each headers as _h, j (j)}
-                    {#if row.data[j] !== undefined}
-                      <td class="text-base-content/80 truncate text-xs">
-                        {row.data[j] !== null ? String(row.data[j]) : ''}
+                  {#each headers.slice(colStartIndex, colEndIndex) as _h, j (colStartIndex + j)}
+                    {#if row.data[colStartIndex + j] !== undefined}
+                      <td
+                        class="text-base-content/80 truncate text-xs"
+                        style={columnWidths.length > 0 &&
+                        columnWidths[colStartIndex + j] !== undefined
+                          ? `width: ${columnWidths[colStartIndex + j]}px`
+                          : 'width: 120px'}
+                      >
+                        {row.data[colStartIndex + j] !== null
+                          ? String(row.data[colStartIndex + j])
+                          : ''}
                       </td>
                     {:else}
                       <td class="p-1">
@@ -317,17 +409,20 @@
                   {/each}
                 {:else}
                   <!--eslint-disable-next-line @typescript-eslint/no-unused-vars-->
-                  {#each headers as _h, j (j)}
+                  {#each headers.slice(colStartIndex, colEndIndex) as _h, j (colStartIndex + j)}
                     <td class="p-1">
                       <div class="bg-base-300/40 h-4 w-full animate-pulse rounded"></div>
                     </td>
                   {/each}
                 {/if}
+                {#if rightPadWidth > 0}
+                  <td style="width: {rightPadWidth}px" class="border-0 p-0"></td>
+                {/if}
               </tr>
             {/each}
             {#if endIndex < virtualTotalRows}
               <tr style="height: {(virtualTotalRows - endIndex) * ROW_HEIGHT}px;">
-                <td colspan={headers.length + 1} class="border-0 p-0"></td>
+                <td colspan={totalCellCount} class="border-0 p-0"></td>
               </tr>
             {/if}
           </tbody>
@@ -335,12 +430,7 @@
       </div>
       {#if isTruncated}
         <p class="text-base-content/50 px-4 py-2 text-xs italic">
-          {m.storage_preview_parquet_rows
-            ? m.storage_preview_parquet_rows({
-                count: formattedLoadedRowsCount,
-                total: formattedTotalRows
-              })
-            : `Showing ${formattedLoadedRowsCount} of ${formattedTotalRows} rows. Scroll to load more.`}
+          {m.storage_preview_csv_rows({ count: formattedLoadedRowsCount })}
         </p>
       {/if}
     {/if}
diff --git a/src/lib/components/storage/modals/preview/ParquetPreview.svelte b/src/lib/components/storage/modals/preview/ParquetPreview.svelte
index 3948c3bd..70eb9b76 100644
--- a/src/lib/components/storage/modals/preview/ParquetPreview.svelte
+++ b/src/lib/components/storage/modals/preview/ParquetPreview.svelte
@@ -90,8 +90,13 @@
     if (keys.length === 0) return 0;
     return Math.max(...keys);
   });
+  let loadedRowsCount = $derived(
+    isSimpleMode ? 0 : Object.values(loadedChunks).reduce((sum, chunk) => sum + chunk.length, 0)
+  );
   let virtualTotalRows = $derived(
-    isSimpleMode ? 0 : Math.min(totalRows, (highestLoadedChunk + 1) * CHUNK_SIZE + 10)
+    isSimpleMode
+      ? 0
+      : Math.min(totalRows, Math.max(loadedRowsCount, (highestLoadedChunk + 1) * CHUNK_SIZE + 10))
   );
 
   let startIndex = $derived(isSimpleMode ? 0 : Math.max(0, Math.floor(scrollTop / ROW_HEIGHT) - 5));
@@ -173,9 +178,6 @@
     });
   });
 
-  const loadedRowsCount = $derived(
-    isSimpleMode ? 0 : Object.keys(loadedChunks).length * CHUNK_SIZE
-  );
   const isTruncated = $derived(
     isSimpleMode ? totalRows > initialRows.length : totalRows > loadedRowsCount
   );
@@ -241,8 +243,12 @@
     {#if headers.length === 0}
       <p class="text-base-content/50 p-4 text-sm italic">{m.storage_bucket_empty()}</p>
     {:else}
+      <!-- svelte-ignore a11y_no_noninteractive_tabindex -->
       <div
         class="min-h-0 w-full flex-1 overflow-auto"
+        tabindex="0"
+        role="region"
+        aria-label="Parquet preview"
         bind:clientHeight={containerHeight}
         onscroll={(e) => (scrollTop = e.currentTarget.scrollTop)}
       >
diff --git a/src/lib/server/storage/preview/csv.test.ts b/src/lib/server/storage/preview/csv.test.ts
new file mode 100644
index 00000000..b8cfb493
--- /dev/null
+++ b/src/lib/server/storage/preview/csv.test.ts
@@ -0,0 +1,273 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type pino from 'pino';
+import type { StorageProvider } from '$lib/server/storage/provider.js';
+
+vi.mock('$lib/server/logging', () => ({
+  logger: {
+    child: () => ({
+      info: vi.fn(),
+      debug: vi.fn(),
+      warn: vi.fn(),
+      error: vi.fn(),
+      trace: vi.fn(),
+      child: vi.fn()
+    })
+  }
+}));
+
+// Use a small textPreviewBytes to force predictable chunk boundaries
+vi.mock('$lib/server/feature-flags', () => ({
+  textPreviewBytes: 11,
+  infiniteScrollEnabled: true
+}));
+
+import { getCsvPreview } from './csv.js';
+
+const mockLog = {
+  info: vi.fn(),
+  debug: vi.fn(),
+  warn: vi.fn(),
+  error: vi.fn(),
+  trace: vi.fn(),
+  child: vi.fn(() => mockLog)
+} as unknown as pino.Logger;
+
+function makeProvider(
+  getObjectRangeImpl: (key: string, start: number, end: number) => Promise<ReadableStream>
+): StorageProvider {
+  return {
+    getObjectRange: vi.fn(getObjectRangeImpl),
+    getObject: vi.fn(),
+    getMetadata: vi.fn(),
+    listContainers: vi.fn(),
+    listObjects: vi.fn(),
+    exists: vi.fn(),
+    putObject: vi.fn(),
+    deleteObjects: vi.fn(),
+    listAllKeys: vi.fn(),
+    listAllKeysProgressively: vi.fn(),
+    getBucketVersioning: vi.fn(),
+    getBucketLifecycleRules: vi.fn(),
+    getBucketTags: vi.fn(),
+    getBucketAcl: vi.fn(),
+    copyObject: vi.fn()
+  } as unknown as StorageProvider;
+}
+
+async function readNdjsonResponse(
+  res: Response
+): Promise<{ headers: string[]; rows: string[][]; totalRows: number }> {
+  const reader = res.body!.getReader();
+  const decoder = new TextDecoder();
+  let buffer = '';
+  const result: { headers: string[]; rows: string[][]; totalRows: number } = {
+    headers: [],
+    rows: [],
+    totalRows: 0
+  };
+
+  while (true) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    buffer += decoder.decode(value, { stream: true });
+    const lines = buffer.split('\n');
+    buffer = lines.pop() || '';
+    for (const line of lines) {
+      if (!line.trim()) continue;
+      const msg = JSON.parse(line);
+      if (msg.t === 'h') {
+        result.headers = msg.h;
+        result.totalRows = msg.tr;
+      } else if (msg.t === 'r') {
+        result.rows = msg.v;
+      }
+    }
+  }
+  return result;
+}
+
+function sliceProvider(content: string) {
+  const enc = new TextEncoder();
+  return makeProvider(async (_key: string, start: number, end: number) => {
+    const slice = content.slice(start, end + 1);
+    return new ReadableStream({
+      start(controller) {
+        controller.enqueue(enc.encode(slice));
+        controller.close();
+      }
+    });
+  });
+}
+
+describe('getCsvPreview', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('returns rows when the whole file fits in one chunk', async () => {
+    const fileContent = 'h\na\nb\nc\n';
+    const provider = sliceProvider(fileContent);
+
+    const res = await getCsvPreview(
+      provider,
+      'small',
+      0,
+      250,
+      'text/csv',
+      fileContent.length,
+      mockLog,
+      true
+    );
+
+    expect(res.headers.get('X-Preview-Total-Rows')).toBe('3');
+    const body = await readNdjsonResponse(res);
+    expect(body.rows).toEqual([['a'], ['b'], ['c']]);
+    expect(body.totalRows).toBe(3);
+  });
+
+  it('does not create phantom rows at chunk boundary mid-line', async () => {
+    // Bytes: h(0) \n(1) a(2) b(3) c(4) \n(5) d(6) e(7) f(8) \n(9) g(10) h(11) i(12)
+    //        \n(13) j(14) k(15) l(16) \n(17) m(18) n(19) o(20) \n(21)
+    // textPreviewBytes=11, range 0..10 = "h\nabc\ndef\ng" (ends mid-line "g")
+    const fileContent = 'h\nabc\ndef\nghi\njkl\nmno\n';
+    const fileSize = fileContent.length; // 22
+    const provider = sliceProvider(fileContent);
+
+    // First call loads chunk 1 (bytes 0..10) → rows "abc", "def". (Incomplete "g" deferred.)
+    const res1 = await getCsvPreview(
+      provider,
+      'boundary',
+      0,
+      250,
+      'text/csv',
+      fileSize,
+      mockLog,
+      true
+    );
+    expect(res1.headers.get('X-Preview-Total-Rows')).toBe('2');
+
+    // Second call triggers chunk 2 (bytes 10..20) → rows "ghi", "jkl". (Incomplete "mno" deferred.)
+    const res2 = await getCsvPreview(
+      provider,
+      'boundary',
+      2,
+      250,
+      'text/csv',
+      fileSize,
+      mockLog,
+      true
+    );
+    expect(res2.headers.get('X-Preview-Total-Rows')).toBe('4');
+
+    // Third call triggers chunk 3 (bytes 18..21) → row "mno"
+    const res3 = await getCsvPreview(
+      provider,
+      'boundary',
+      4,
+      250,
+      'text/csv',
+      fileSize,
+      mockLog,
+      true
+    );
+    expect(res3.headers.get('X-Preview-Total-Rows')).toBe('5');
+
+    // Now read the last page - should get 'mno' as complete row, not split
+    const body3 = await readNdjsonResponse(res3);
+    expect(body3.rows).toEqual([['mno']]);
+    expect(body3.totalRows).toBe(5);
+  });
+
+  it('readRows returns correct rows across a chunk boundary', async () => {
+    // Same file as above
+    const fileContent = 'h\nabc\ndef\nghi\njkl\nmno\n';
+    const fileSize = fileContent.length;
+    const provider = sliceProvider(fileContent);
+
+    // Load cache with first call
+    await getCsvPreview(provider, 'read-test', 0, 250, 'text/csv', fileSize, mockLog, false);
+
+    // Request data that straddles the chunk boundary (after chunk 1 loaded "abc","def")
+    // chunk 2 needs to be triggered, which loads "ghi","jkl" (and defers "mno")
+    const res = await getCsvPreview(
+      provider,
+      'read-test',
+      1,
+      3,
+      'text/csv',
+      fileSize,
+      mockLog,
+      true
+    );
+    const body = await readNdjsonResponse(res);
+    // Should get "def" (index 1), "ghi" (index 2), "jkl" (index 3)
+    expect(body.rows).toEqual([['def'], ['ghi'], ['jkl']]);
+  });
+
+  it('does not create phantom rows across multiple chunk boundaries', async () => {
+    // File with 10 rows, each row 5 bytes ("rowN\n"), plus header "h\n" = 2 bytes
+    // Total: 2 + 10*5 = 52 bytes. With textPreviewBytes=11, need ~6 extendCache calls.
+    const fileContent = 'h\nrow0\nrow1\nrow2\nrow3\nrow4\nrow5\nrow6\nrow7\nrow8\nrow9\n';
+    const fileSize = fileContent.length;
+    const provider = sliceProvider(fileContent);
+
+    // Load all data by making enough requests with increasing offsets
+    // Each call triggers one chunk read. We load header first, then progressively
+    // request data at higher offsets to force more chunks.
+    for (let offset = 0; offset < 15; offset += 3) {
+      await getCsvPreview(
+        provider,
+        'multi-boundary',
+        offset,
+        250,
+        'text/csv',
+        fileSize,
+        mockLog,
+        false
+      );
+    }
+
+    // Now request all data
+    const res = await getCsvPreview(
+      provider,
+      'multi-boundary',
+      0,
+      250,
+      'text/csv',
+      fileSize,
+      mockLog,
+      true
+    );
+    const body = await readNdjsonResponse(res);
+    expect(body.totalRows).toBe(10);
+    expect(body.rows).toHaveLength(10);
+    expect(body.rows[0]).toEqual(['row0']);
+    expect(body.rows[9]).toEqual(['row9']);
+    // Verify no row is garbled (e.g. "w1" from a split "row1")
+    expect(body.rows[1]).toEqual(['row1']);
+    expect(body.rows[2]).toEqual(['row2']);
+  });
+
+  it('includes the last line when the file has no trailing newline', async () => {
+    // E2E scenario: file without trailing \n on the last line.
+    // The last line MUST be included even though text doesn't end with \n.
+    const fileContent = 'h\na\nb'; // 5 bytes, fits in one chunk (textPreviewBytes=11)
+    const provider = sliceProvider(fileContent);
+
+    const res = await getCsvPreview(
+      provider,
+      'no-trailing-newline',
+      0,
+      250,
+      'text/csv',
+      fileContent.length,
+      mockLog,
+      true
+    );
+
+    expect(res.headers.get('X-Preview-Total-Rows')).toBe('2');
+    const body = await readNdjsonResponse(res);
+    expect(body.rows).toHaveLength(2);
+    expect(body.rows).toEqual([['a'], ['b']]);
+  });
+});
diff --git a/src/lib/server/storage/preview/csv.ts b/src/lib/server/storage/preview/csv.ts
index 4649d3b4..96034799 100644
--- a/src/lib/server/storage/preview/csv.ts
+++ b/src/lib/server/storage/preview/csv.ts
@@ -108,6 +108,8 @@ async function extendCache(
   const buffer = await streamToArrayBuffer(stream);
   const text = new TextDecoder('utf-8', { fatal: false }).decode(buffer);
 
+  const textEndsWithNewline = text.endsWith('\n');
+  const isLastByte = entry.bytesRead + bytesToRead >= entry.totalSize;
   const lines = text.split('\n');
 
   if (entry.headers.length === 0) {
@@ -115,27 +117,44 @@ async function extendCache(
       entry.headers = parseCsvRow(lines[0].replace(/\r$/, ''));
     }
     let bytePos = entry.bytesRead;
-    for (let i = 0; i < lines[0].length + 1; i++) {
+    // Advance past header + its \n (if \n is in this chunk)
+    const headerComplete = lines.length > 1;
+    for (let i = 0; i < lines[0].length + (headerComplete ? 1 : 0); i++) {
       bytePos++;
     }
     for (let i = 1; i < lines.length; i++) {
-      entry.lineOffsets.push(bytePos);
-      // eslint-disable-next-line security/detect-object-injection
-      bytePos += lines[i].length + 1;
+      // Defer the last line only if the chunk boundary falls mid-line
+      // (not when we've reached the end of the file)
+      const isLastElement = i === lines.length - 1;
+      const isIncomplete = !textEndsWithNewline && isLastElement && !isLastByte;
+      const hasOwnNewline = textEndsWithNewline || !isLastElement;
+      if (!isIncomplete && (lines[i].length > 0 || i < lines.length - 1)) {
+        entry.lineOffsets.push(bytePos);
+      }
+      if (!isIncomplete) {
+        // eslint-disable-next-line security/detect-object-injection
+        bytePos += lines[i].length + (hasOwnNewline ? 1 : 0);
+      }
     }
+    entry.bytesRead = bytePos;
   } else {
     let bytePos = entry.bytesRead;
     for (let i = 0; i < lines.length; i++) {
-      // eslint-disable-next-line security/detect-object-injection
-      if (lines[i].length > 0 || i < lines.length - 1) {
+      // Defer the last line only if the chunk boundary falls mid-line
+      // (not when we've reached the end of the file)
+      const isLastElement = i === lines.length - 1;
+      const isIncomplete = !textEndsWithNewline && isLastElement && !isLastByte;
+      const hasOwnNewline = textEndsWithNewline || !isLastElement;
+      if (!isIncomplete && (lines[i].length > 0 || i < lines.length - 1)) {
         entry.lineOffsets.push(bytePos);
       }
-      // eslint-disable-next-line security/detect-object-injection
-      bytePos += lines[i].length + 1;
+      if (!isIncomplete) {
+        // eslint-disable-next-line security/detect-object-injection
+        bytePos += lines[i].length + (hasOwnNewline ? 1 : 0);
+      }
     }
+    entry.bytesRead = bytePos;
   }
-
-  entry.bytesRead = entry.bytesRead + bytesToRead;
   return entry;
 }
 
diff --git a/src/lib/storage/api.test-utils.ts b/src/lib/storage/api.test-utils.ts
index 994fe68b..dc968887 100644
--- a/src/lib/storage/api.test-utils.ts
+++ b/src/lib/storage/api.test-utils.ts
@@ -69,6 +69,10 @@ export function createMemoryStorageApi(overrides?: Partial<StorageApi>): Storage
       return false;
     },
 
+    async download() {
+      return new Response(null, { status: 200 });
+    },
+
     async preview() {
       return new Response(null, { status: 200 });
     },
diff --git a/src/lib/storage/api.ts b/src/lib/storage/api.ts
index 8e4caf3a..0cce9613 100644
--- a/src/lib/storage/api.ts
+++ b/src/lib/storage/api.ts
@@ -86,6 +86,8 @@ export interface StorageApi {
 
   checkObjectExists(params: { bucket: string; key: string }): Promise<boolean>;
 
+  download(params: { bucket: string; key: string }): Promise<Response>;
+
   preview(params: {
     bucket: string;
     key: string;
@@ -216,6 +218,11 @@ export function createFetchStorageApi(getConnectionId: () => string | null): Sto
       }
     },
 
+    async download({ bucket, key }) {
+      const params = new URLSearchParams({ bucket, key });
+      return fetch_(`/api/storage/download?${params}`);
+    },
+
     async preview({ bucket, key, offset, limit, data }) {
       const params = new URLSearchParams({ bucket, key });
       if (offset !== undefined) params.set('offset', String(offset));
diff --git a/src/lib/storage/state.svelte.spec.ts b/src/lib/storage/state.svelte.spec.ts
index f38695c0..264f304e 100644
--- a/src/lib/storage/state.svelte.spec.ts
+++ b/src/lib/storage/state.svelte.spec.ts
@@ -104,6 +104,9 @@ function makeApi(overrides?: Partial<StorageApi>): StorageApi {
     async checkObjectExists() {
       return false;
     },
+    async download() {
+      return new Response(null, { status: 200 });
+    },
     async preview() {
       return new Response(null, { status: 200 });
     },
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index ce216bd2..401f3931 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -751,7 +751,7 @@ export class StorageState {
   // ────────────────────────────────────────────────────────────────────────────
 
   handleKeydown = (e: KeyboardEvent): void => {
-    if (this.activeModal?.type === 'delete') return;
+    if (this.activeModal) return;
     if (this.archive.isInArchive && e.key !== 'Escape') return;
 
     const isCtrl = e.ctrlKey || e.metaKey;

From fcf7bdece9aa20c38d6d20f7b1deb7fe5cae8749 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Fri, 31 Jul 2026 09:16:56 +0200
Subject: [PATCH 121/136] fix unicode quotes

---
 messages/de.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/messages/de.json b/messages/de.json
index 711ca4d3..dc80be1d 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -185,7 +185,7 @@
   "storage_connections_empty": "Noch keine gespeicherten Verbindungen.",
   "storage_connections_edit": "Bearbeiten",
   "storage_connections_delete": "Löschen",
-  "storage_connections_delete_confirm": "\u201e{label}\u201c aus den gespeicherten Verbindungen entfernen? Dies kann nicht rückgängig gemacht werden.",
+  "storage_connections_delete_confirm": "\"{label}\" aus den gespeicherten Verbindungen entfernen? Dies kann nicht rückgängig gemacht werden.",
   "storage_connections_delete_cancel": "Abbrechen",
   "storage_connections_delete_confirm_button": "Löschen",
   "storage_connection_edit_title": "Verbindung bearbeiten",

From 208310edd2dfc8c5fdcfd357fbc25847d8fafb9f Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Tue, 4 Aug 2026 09:48:55 +0200
Subject: [PATCH 122/136] Fitness Function (updated) (#267)

* add archunitts as fitness function for ai agents

* split fitness function into multiple files, add fitness to pre commit

* run lint:fix on local pre commit

* fix naming convention rule for unit tests

* fix static aria label
---
 .github/workflows/pr_checks.yaml              |   2 +-
 .pre-commit-config.yaml                       |  28 +-
 AGENTS.md                                     |  31 +
 TECH_DEBT.md                                  |  74 ++
 messages/de.json                              |   1 +
 messages/en.json                              |   1 +
 package-lock.json                             | 745 ++++++++++++++++++
 package.json                                  |   7 +-
 .../circular-dependencies.spec.ts             |  50 ++
 src/architecture/code-size-limits.spec.ts     |  66 ++
 src/architecture/helpers.ts                   |  61 ++
 src/architecture/i18n-compliance.spec.ts      |  61 ++
 src/architecture/naming-conventions.spec.ts   |  46 ++
 src/architecture/report-generation.spec.ts    |  50 ++
 .../server-client-boundary.spec.ts            |  93 +++
 src/architecture/server-logging.spec.ts       |  68 ++
 .../ui-pattern-enforcement.spec.ts            | 100 +++
 src/routes/(app)/storage/+error.svelte        |   5 +-
 vite.config.ts                                |   4 +-
 vitest.arch.config.ts                         |  24 +
 20 files changed, 1506 insertions(+), 11 deletions(-)
 create mode 100644 src/architecture/circular-dependencies.spec.ts
 create mode 100644 src/architecture/code-size-limits.spec.ts
 create mode 100644 src/architecture/helpers.ts
 create mode 100644 src/architecture/i18n-compliance.spec.ts
 create mode 100644 src/architecture/naming-conventions.spec.ts
 create mode 100644 src/architecture/report-generation.spec.ts
 create mode 100644 src/architecture/server-client-boundary.spec.ts
 create mode 100644 src/architecture/server-logging.spec.ts
 create mode 100644 src/architecture/ui-pattern-enforcement.spec.ts
 create mode 100644 vitest.arch.config.ts

diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/pr_checks.yaml
index 23753c49..399cd25d 100644
--- a/.github/workflows/pr_checks.yaml
+++ b/.github/workflows/pr_checks.yaml
@@ -59,7 +59,7 @@ jobs:
         run: python -m pip install pre-commit
 
       - name: Run pre-commit
-        run: pre-commit run --all-files --show-diff-on-failure --color=always
+        run: pre-commit run --all-files --hook-stage manual --show-diff-on-failure --color=always
 
   unit-tests:
     name: Unit Tests
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 8d68075c..eb449fe9 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -45,27 +45,45 @@ repos:
 
   - repo: local
     hooks:
+      # ── Fix variant (runs locally on commit — auto-fixes where possible) ──
+      - id: npm-lint-fix
+        name: npm lint with --fix (prettier + eslint)
+        language: system
+        entry: npm run lint:fix
+        stages: [pre-commit, pre-merge-commit]
+        pass_filenames: false
+        files: \.(svelte|ts|js|css|html|json|md)$
+
+      # ── Check-only variant (runs in CI — no auto-fix) ──
       - id: npm-lint
-        name: npm lint (prettier + eslint)
+        name: npm lint check only (prettier + eslint)
         language: system
         entry: npm run lint
-        stages: [pre-commit, pre-merge-commit]
+        stages: [manual]
         pass_filenames: false
         files: \.(svelte|ts|js|css|html|json|md)$
 
+      # ── Shared hooks (same behaviour locally and in CI) ──
       - id: npm-check
         name: npm check (svelte-check)
         language: system
         entry: npm run check
-        stages: [pre-commit, pre-merge-commit]
+        stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
         files: \.(svelte|ts|js)$
 
+      - id: npm-arch-test
+        name: npm arch test (fitness functions)
+        language: system
+        entry: npm run test:arch
+        stages: [pre-commit, pre-merge-commit, manual]
+        pass_filenames: false
+
       - id: helm-lint
         name: helm lint
         language: system
         entry: helm lint deploy/helm/cockpit
-        stages: [pre-commit, pre-merge-commit]
+        stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
         files: ^deploy/helm/
 
@@ -78,6 +96,6 @@ repos:
           --set auth.oidc.discoveryUrl=https://stub
           --set auth.oidc.clientId=stub
           --set auth.oidc.clientSecret.secretKeyRef.name=stub > /dev/null'
-        stages: [pre-commit, pre-merge-commit]
+        stages: [pre-commit, pre-merge-commit, manual]
         pass_filenames: false
         files: ^deploy/helm/
diff --git a/AGENTS.md b/AGENTS.md
index c6b6ddbc..e461beda 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -225,6 +225,37 @@ pre-commit run --all-files   # Run all checks: lint (prettier + eslint), type ch
                              # markdownlint, yamllint, shellcheck, actionlint, hadolint, helm lint
 ```
 
+### Architecture Fitness Functions
+
+```bash
+npm run test:arch            # Run all architecture fitness function tests (~5 s)
+npm run test:arch:report     # Same, plus generate HTML dependency/metrics reports in /reports/
+```
+
+Architecture tests live in `src/architecture/*.spec.ts` and use [ArchUnitTS](https://github.com/LukasNiessen/ArchUnitTS) together with plain Node.js `fs` checks. They run in CI and must remain **green at all times**.
+
+**Run `npm run test:arch` whenever you:**
+
+- Add a new file to `src/lib/server/` (verify it doesn't break client-boundary rules)
+- Add a new Svelte component (PascalCase naming, no raw `<dialog>`, no hardcoded colours)
+- Add or remove message keys in `messages/en.json` (both locale files must stay in sync)
+- Refactor the Trino sub-layer (circular-dependency rules)
+
+**What the fitness functions enforce:**
+
+| Category                 | What is checked                                                                                                                                                |
+| ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Server / Client Boundary | `src/lib/client`, `stores`, `storage`, `editor`, `types` must not import `src/lib/server/**`                                                                   |
+| No Circular Dependencies | `src/lib/**` (excluding Trino, see TECH_DEBT.md) and `src/routes/**` must be cycle-free                                                                        |
+| Naming Conventions       | Stores → `*.svelte.ts`; lib components → PascalCase `.svelte`; server files → no `.svelte.ts` extension                                                        |
+| Code Size Limits         | `.ts` files < 2 400 LOC; `.svelte` files < 1 100 LOC; test files < 1 000 LOC                                                                                   |
+| UI Pattern Enforcement   | No hardcoded Tailwind colours; no raw `<dialog>`; no native date inputs; `<img>` must have `alt`; no `<div onclick>` (known violations listed in TECH_DEBT.md) |
+| Server Logging           | Server files must use pino logger, not `console.*`                                                                                                             |
+| i18n Compliance          | `messages/en.json` and `messages/de.json` must have the same keys; no static `aria-label="English text"` (known violations listed in TECH_DEBT.md)             |
+
+**Extending the fitness functions:**
+When you add a new architectural rule (e.g., a new layer, a new naming convention), add a new `.spec.ts` file in `src/architecture/` following the existing patterns. Use archunit for TypeScript dependency/cycle rules and plain Node.js `fs` for content checks on Svelte files.
+
 ### E2E Testing
 
 ```bash
diff --git a/TECH_DEBT.md b/TECH_DEBT.md
index 2077fbe2..f85c17cc 100644
--- a/TECH_DEBT.md
+++ b/TECH_DEBT.md
@@ -217,3 +217,77 @@ The upload endpoint imposes no maximum file size. S3's 5 TB single-object limit
 **File:** `src/routes/healthz/+server.ts`, `deploy/helm/cockpit/values.yaml`
 
 Both `livenessProbe` and `readinessProbe` point at `/healthz`, which always returns 200. There is currently nothing meaningful to gate readiness on (better-auth uses an in-memory session store, OIDC discovery is fetched lazily on first auth call), so a separate `/readyz` would just be a placeholder. Once one of these lands — a real session store / DB, eager OIDC discovery, or a startup-time cache warm — split into `/healthz` (liveness, trivial) and `/readyz` (readiness, checking the new dependency), and update the helm probes accordingly.
+
+---
+
+## Architecture (Tracked by fitness functions in src/architecture/\*.spec.ts)
+
+### Circular imports in the Trino server layer
+
+**Files:** `src/lib/server/trino/client.ts` ↔ `src/lib/server/trino/user-clients.ts` and `src/lib/server/trino/queries.ts` ↔ `src/lib/server/trino/result-collector.ts`
+
+Two pairs of circular imports exist in the Trino sub-layer. They cause unpredictable module initialisation order and block reliable tree-shaking. The fitness function `KNOWN VIOLATION — Trino layer has circular imports` documents this and will fail the moment the cycle count drops to zero (prompting removal of the exception).
+
+**Fix:** Extract shared interfaces (`TrinoQuery`, `QueryState`, etc.) into `src/lib/server/trino/types.ts`. Neither `client.ts` nor `user-clients.ts` should import from each other — both should import types from the new file.
+
+---
+
+### `state.svelte.ts` is too large (2 331 LOC)
+
+**File:** `src/lib/storage/state.svelte.ts`
+
+This single file contains the entire client-side storage state machine, all reactive derived values, and all event handlers. It is the primary obstacle to the 600-line LOC fitness function threshold. The fitness function currently allows up to 2 400 lines.
+
+**Fix:** Split into focused modules:
+
+- `state/selection.svelte.ts` — selected items, range-selection logic
+- `state/upload.svelte.ts` — upload job tracking
+- `state/navigation.svelte.ts` — current path, history
+- `state/operations.svelte.ts` — copy/move/delete operation state
+- `state/index.svelte.ts` — re-exports and glue
+
+---
+
+### `PreviewModal.svelte` is too large (1 065 LOC)
+
+**File:** `src/lib/components/storage/modals/PreviewModal.svelte`
+
+This Svelte component mixes routing logic, multiple preview renderers, and toolbar state in one file. The fitness function currently allows up to 1 100 lines.
+
+**Fix:** Extract preview renderers into separate child components (`CsvRenderer.svelte`, `ParquetRenderer.svelte`, `TextRenderer.svelte`, etc.) and pass the selected object as a prop.
+
+---
+
+### Pre-existing `<div onclick>` patterns (BITV 2.0 violation)
+
+**Files:**
+
+- `src/lib/components/catalog/CatalogTree.svelte` — tree node rows
+- `src/lib/components/storage/explorer/OperationsButton.svelte` — operation rows
+- `src/lib/components/storage/explorer/TabBar.svelte` — tab items
+- `src/lib/components/storage/shared/FloatingMenu.svelte` — portal overlay
+- `src/lib/components/trino/StatementResult.svelte` — result rows
+
+Using `<div onclick>` instead of `<button>` breaks keyboard navigation and screen reader support (BITV 2.0). Each of these is listed in the fitness function `KNOWN_VIOLATIONS` list for the `clickable div/span elements must not replace <button>` rule. **When a file is fixed, remove it from that list.** New files with the same pattern will fail the test immediately.
+
+**Fix:** Replace interactive `<div>` elements with `<button type="button">` or an appropriate semantic element (`<li role="option">` for list items in a listbox, etc.).
+
+---
+
+### Pre-existing hardcoded `aria-label` strings (i18n violation)
+
+**Files:** `ToastHost.svelte`, `TextEditor.svelte`, `ContextMenu.svelte`, `FileRow.svelte`, `FolderRow.svelte`, `ObjectTable.svelte`, `StorageBreadcrumb.svelte`, `CsvPreview.svelte`, `ParquetPreview.svelte`, `TextPreview.svelte`
+
+Ten components use static `aria-label="English text"` attributes instead of Paraglide i18n message functions. Screen reader users on the German locale receive English text. Each is listed in the `KNOWN_VIOLATIONS` list in the `aria-label` fitness function. **When a file is fixed, remove it from that list.**
+
+**Fix:** Add corresponding message keys to `messages/en.json` and `messages/de.json`, import `* as m from '$lib/paraglide/messages.js'`, and replace `aria-label="..."` with `aria-label={m.key_name()}`.
+
+---
+
+### Shared storage types live in `src/lib/server/storage/types.ts` instead of `src/lib/types/`
+
+**Files:** `src/lib/components/storage/landing/StorageConnectForm.svelte`, `src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte`
+
+These Svelte components use `import type { ConnectionMetadata }` from the server layer. TypeScript erases `import type` at compile time so there is no runtime bundle risk, but it establishes an unexpected dependency arrow from the component layer to the server layer that is invisible to ArchUnitTS (which does not scan `.svelte` files).
+
+**Fix:** Move `ConnectionMetadata` and other shared types from `src/lib/server/storage/types.ts` into `src/lib/types/storage.ts` so the types live in the layer that both server and client code can freely import.
diff --git a/messages/de.json b/messages/de.json
index dc80be1d..f9e38d66 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -292,6 +292,7 @@
   "storage_parent_dir": "Übergeordnetes Verzeichnis",
   "storage_loading": "Wird geladen…",
   "storage_breadcrumb_more": "Weitere Ordner",
+  "storage_error_breadcrumb": "Brotkrumen-Navigation",
   "storage_error_title": "Speicherfehler",
   "storage_error_access_denied": "Sie haben keine Berechtigung, auf den Bucket „{bucket}“ zuzugreifen.",
   "storage_error_not_found": "Der Bucket „{bucket}“ existiert nicht.",
diff --git a/messages/en.json b/messages/en.json
index 35ccd15c..3be2ce03 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -292,6 +292,7 @@
   "storage_parent_dir": "Parent directory",
   "storage_loading": "Loading…",
   "storage_breadcrumb_more": "More folders",
+  "storage_error_breadcrumb": "breadcrumb",
   "storage_error_title": "Storage error",
   "storage_error_access_denied": "You do not have permission to access the bucket “{bucket}”.",
   "storage_error_not_found": "The bucket “{bucket}” does not exist.",
diff --git a/package-lock.json b/package-lock.json
index 07412493..042815d3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -54,6 +54,7 @@
         "@vitest/browser-playwright": "^4.0.18",
         "@vitest/coverage-v8": "^4.0.18",
         "antlr-ng": "^1.0.10",
+        "archunit": "^2.3.3",
         "daisyui": "^5.5.19",
         "drizzle-kit": "^0.31.10",
         "eslint": "^9.39.2",
@@ -2272,6 +2273,44 @@
       ],
       "license": "MIT"
     },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/@npmcli/agent": {
       "version": "3.0.0",
       "dev": true,
@@ -4102,6 +4141,19 @@
         "url": "https://opencollective.com/vitest"
       }
     },
+    "node_modules/@zerollup/ts-helpers": {
+      "version": "1.7.18",
+      "resolved": "https://registry.npmjs.org/@zerollup/ts-helpers/-/ts-helpers-1.7.18.tgz",
+      "integrity": "sha512-S9zN+y+i5yN/evfWquzSO3lubqPXIsPQf6p9OiPMpRxDx/0totPLF39XoRw48Dav5dSvbIE8D2eAPpXXJxvKwg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "resolve": "^1.12.0"
+      },
+      "peerDependencies": {
+        "typescript": ">=3.7.2"
+      }
+    },
     "node_modules/abbrev": {
       "version": "3.0.1",
       "dev": true,
@@ -4411,6 +4463,62 @@
         "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
       }
     },
+    "node_modules/archunit": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/archunit/-/archunit-2.3.3.tgz",
+      "integrity": "sha512-dc2fCA1PqqHjofrWHk/cLaCVYTvIYtiDB2aQ62L1+LB/4Fw2J8zJRlyjoqVHC4b+MrXIzdq2uAFGNBfqDZrWuQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@zerollup/ts-helpers": "^1.7.18",
+        "minimatch": "^10.0.1",
+        "plantuml-parser": "^0.4.0",
+        "typescript": "^5.9.3"
+      },
+      "engines": {
+        "node": ">=14.0.0",
+        "npm": ">=6.0.0"
+      }
+    },
+    "node_modules/archunit/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/archunit/node_modules/brace-expansion": {
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/archunit/node_modules/minimatch": {
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.5"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/argparse": {
       "version": "2.0.1",
       "dev": true,
@@ -4827,6 +4935,19 @@
         "concat-map": "0.0.1"
       }
     },
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/buffer": {
       "version": "5.6.0",
       "license": "MIT",
@@ -5665,6 +5786,42 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/duplexer2": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/duplexer2/-/duplexer2-0.1.4.tgz",
+      "integrity": "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "readable-stream": "^2.0.2"
+      }
+    },
+    "node_modules/duplexer2/node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/duplexer2/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
     "node_modules/eastasianwidth": {
       "version": "0.2.0",
       "dev": true,
@@ -6270,6 +6427,36 @@
       "version": "1.3.2",
       "license": "MIT"
     },
+    "node_modules/fast-glob": {
+      "version": "3.3.3",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
+      "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.8"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-glob/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/fast-json-stable-stringify": {
       "version": "2.1.0",
       "dev": true,
@@ -6342,6 +6529,16 @@
         "fxparser": "src/cli/cli.js"
       }
     },
+    "node_modules/fastq": {
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
+      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
     "node_modules/fdir": {
       "version": "6.5.0",
       "devOptional": true,
@@ -6375,6 +6572,19 @@
       "license": "MIT",
       "optional": true
     },
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/finalhandler": {
       "version": "2.1.1",
       "dev": true,
@@ -6557,6 +6767,19 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/get-stdin": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/get-stdin/-/get-stdin-8.0.0.tgz",
+      "integrity": "sha512-sY22aA6xchAzprjyqmSEQv4UbAAzRN0L2dQB0NlN5acTTK9Don6nhoc3eAbUnpZiCANAMfd/+40kVdKfFygohg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/get-tsconfig": {
       "version": "4.14.0",
       "devOptional": true,
@@ -6941,6 +7164,16 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
     "node_modules/is-plain-obj": {
       "version": "4.1.0",
       "dev": true,
@@ -7095,6 +7328,95 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/json-colorizer": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/json-colorizer/-/json-colorizer-2.2.2.tgz",
+      "integrity": "sha512-56oZtwV1piXrQnRNTtJeqRv+B9Y/dXAYLqBBaYl/COcUdoZxgLBLAO88+CnkbT6MxNs0c5E9mPBIb2sFcNz3vw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "chalk": "^2.4.1",
+        "lodash.get": "^4.4.2"
+      }
+    },
+    "node_modules/json-colorizer/node_modules/ansi-styles": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^1.9.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/json-colorizer/node_modules/chalk": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^3.2.1",
+        "escape-string-regexp": "^1.0.5",
+        "supports-color": "^5.3.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/json-colorizer/node_modules/color-convert": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "1.1.3"
+      }
+    },
+    "node_modules/json-colorizer/node_modules/color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/json-colorizer/node_modules/escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/json-colorizer/node_modules/has-flag": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/json-colorizer/node_modules/supports-color": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
     "node_modules/json-schema-to-ts": {
       "version": "3.1.1",
       "dev": true,
@@ -7523,6 +7845,14 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/lodash.get": {
+      "version": "4.4.2",
+      "resolved": "https://registry.npmjs.org/lodash.get/-/lodash.get-4.4.2.tgz",
+      "integrity": "sha512-z+Uw/vLuy6gQe8cfaFWD7p0wVv8fJl3mbzXh33RS+0oW2wvUqiRXiQ69gLWSLpgB5/6sU+r6BlQR0MBILadqTQ==",
+      "deprecated": "This package is deprecated. Use the optional chaining (?.) operator instead.",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "dev": true,
@@ -7647,6 +7977,43 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "braces": "^3.0.3",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/micromatch/node_modules/picomatch": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.2.tgz",
+      "integrity": "sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/mime-db": {
       "version": "1.54.0",
       "dev": true,
@@ -8065,6 +8432,59 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
+    "node_modules/node-stream": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/node-stream/-/node-stream-1.7.0.tgz",
+      "integrity": "sha512-AB1qHzJWjAuxpDvTr/n1wvKVOg8c9BjAHV21QXq+q9yEUNr7wSqfHmAhAzvpQWSbf8mQQle3fjsnu3R14jrElA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "lodash": "^4.17.2",
+        "readable-stream": "^2.3.3",
+        "split2": "^2.1.0",
+        "stream-combiner2": "^1.1.1",
+        "through2": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=0.12"
+      }
+    },
+    "node_modules/node-stream/node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/node-stream/node_modules/split2": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/split2/-/split2-2.2.0.tgz",
+      "integrity": "sha512-RAb22TG39LhI31MbreBgIuKiIKhVsawfTgEGqKHTK87aG+ul/PB8Sqoi3I7kVdRWiCfrKxK3uo4/YUkpNvhPbw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "through2": "^2.0.2"
+      }
+    },
+    "node_modules/node-stream/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
     "node_modules/nopt": {
       "version": "8.1.0",
       "dev": true,
@@ -8349,6 +8769,13 @@
       "devOptional": true,
       "license": "MIT"
     },
+    "node_modules/pegjs-backtrace": {
+      "version": "0.2.1",
+      "resolved": "https://registry.npmjs.org/pegjs-backtrace/-/pegjs-backtrace-0.2.1.tgz",
+      "integrity": "sha512-rnVQiHyTE1wZG14Vl3Xk33ecrF7ZJ7ZW7jSgSlw4LdzBuhbyGVQ+oVApQ6tRi4QsII/xHgByHb6Ax68K6SPLhw==",
+      "dev": true,
+      "license": "ISC"
+    },
     "node_modules/pg": {
       "version": "8.21.0",
       "license": "MIT",
@@ -8524,6 +8951,131 @@
         "pathe": "^2.0.3"
       }
     },
+    "node_modules/plantuml-parser": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/plantuml-parser/-/plantuml-parser-0.4.0.tgz",
+      "integrity": "sha512-IwbkQNgQK/kvXbSYxZWZpcAItk46ECZm6QFA66+smFZqSIjdglXGNTFniO2VLPpgt8uY8EE0uLOsGgvBrerU5Q==",
+      "dev": true,
+      "license": " Apache-2.0",
+      "dependencies": {
+        "async": "^3.2.0",
+        "fast-glob": "^3.2.4",
+        "get-stdin": "^8.0.0",
+        "json-colorizer": "^2.2.2",
+        "pegjs-backtrace": "^0.2.0",
+        "read-vinyl-file-stream": "^2.0.3",
+        "require-dir": "^1.2.0",
+        "serialize-error": "^7.0.1",
+        "yargs": "^16.0.3"
+      },
+      "bin": {
+        "plantuml-parser": "dist/bin/cli.js"
+      }
+    },
+    "node_modules/plantuml-parser/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/plantuml-parser/node_modules/cliui": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz",
+      "integrity": "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.0",
+        "wrap-ansi": "^7.0.0"
+      }
+    },
+    "node_modules/plantuml-parser/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/plantuml-parser/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/plantuml-parser/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/plantuml-parser/node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/plantuml-parser/node_modules/yargs": {
+      "version": "16.2.2",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.2.tgz",
+      "integrity": "sha512-Nt9ZJjXTv5R8MHbqby/wXQ6Gi0Bb3TcYZkR1bzuL4yB2OxWPkXknz513gEF0GoA6tn00UpbPvERW8rzCuWCA6w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cliui": "^7.0.2",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.0",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^20.2.2"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/plantuml-parser/node_modules/yargs-parser": {
+      "version": "20.2.9",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.9.tgz",
+      "integrity": "sha512-y11nGElTIV+CT3Zv9t7VKl+Q3hTQoT9a1Qzezhhl6Rp21gJ/IVTW7Z3y9EWXhuUBC2Shnf+DX0antecpAwSP8w==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/playwright": {
       "version": "1.58.2",
       "devOptional": true,
@@ -9054,6 +9606,27 @@
       ],
       "license": "MIT"
     },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/quick-format-unescaped": {
       "version": "4.0.4",
       "license": "MIT"
@@ -9123,6 +9696,17 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/read-vinyl-file-stream": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/read-vinyl-file-stream/-/read-vinyl-file-stream-2.0.3.tgz",
+      "integrity": "sha512-ZbtobBf+n/va3eRcIkMDYsp7DCnnjh46YFOOdj42aCiWFirp9T/+YGMCTfVpEFIuiH3c5Kp13jpn3i5DoygxLw==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "node-stream": "^1.5.0",
+        "through2": "^2.0.1"
+      }
+    },
     "node_modules/readable-stream": {
       "version": "3.6.2",
       "license": "MIT",
@@ -9189,6 +9773,16 @@
         "regexp-tree": "bin/regexp-tree"
       }
     },
+    "node_modules/require-dir": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/require-dir/-/require-dir-1.2.0.tgz",
+      "integrity": "sha512-LY85DTSu+heYgDqq/mK+7zFHWkttVNRXC9NKcKGyuGLdlsfbjEPrIEYdCVrx6hqnJb+xSu3Lzaoo8VnmOhhjNA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/require-directory": {
       "version": "2.1.1",
       "dev": true,
@@ -9258,6 +9852,17 @@
         "node": ">= 4"
       }
     },
+    "node_modules/reusify": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+      "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/rollup": {
       "version": "4.57.1",
       "devOptional": true,
@@ -9322,6 +9927,30 @@
         "node": ">= 18"
       }
     },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
     "node_modules/sade": {
       "version": "1.8.1",
       "dev": true,
@@ -9418,6 +10047,35 @@
         "url": "https://opencollective.com/express"
       }
     },
+    "node_modules/serialize-error": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/serialize-error/-/serialize-error-7.0.1.tgz",
+      "integrity": "sha512-8I8TjW5KMOKsZQTvoxjuSIa7foAwPWGOts+6o7sgjz41/qMD9VQHEDxi6PBvK2l0MXUmqZyNpUK+T2tQaaElvw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "type-fest": "^0.13.1"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/serialize-error/node_modules/type-fest": {
+      "version": "0.13.1",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.13.1.tgz",
+      "integrity": "sha512-34R7HTnG0XIJcBSn5XhDd7nNFPRcXYRZrBB2O2jdKqYODldSzBAqzsWoZYYvduky73toYS/ESqxPvkDf/F0XMg==",
+      "dev": true,
+      "license": "(MIT OR CC0-1.0)",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/serve-static": {
       "version": "2.2.1",
       "dev": true,
@@ -9816,6 +10474,43 @@
         "readable-stream": "^3.5.0"
       }
     },
+    "node_modules/stream-combiner2": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/stream-combiner2/-/stream-combiner2-1.1.1.tgz",
+      "integrity": "sha512-3PnJbYgS56AeWgtKF5jtJRT6uFJe56Z0Hc5Ngg/6sI6rIt8iiMBTa9cvdyFfpMQjaVHr8dusbNeFGIIonxOvKw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "duplexer2": "~0.1.0",
+        "readable-stream": "^2.0.2"
+      }
+    },
+    "node_modules/stream-combiner2/node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/stream-combiner2/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
     "node_modules/streamx": {
       "version": "2.27.0",
       "license": "MIT",
@@ -10368,6 +11063,43 @@
         "node": ">=20"
       }
     },
+    "node_modules/through2": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/through2/-/through2-2.0.5.tgz",
+      "integrity": "sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "readable-stream": "~2.3.6",
+        "xtend": "~4.0.1"
+      }
+    },
+    "node_modules/through2/node_modules/readable-stream": {
+      "version": "2.3.8",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "core-util-is": "~1.0.0",
+        "inherits": "~2.0.3",
+        "isarray": "~1.0.0",
+        "process-nextick-args": "~2.0.0",
+        "safe-buffer": "~5.1.1",
+        "string_decoder": "~1.1.1",
+        "util-deprecate": "~1.0.1"
+      }
+    },
+    "node_modules/through2/node_modules/string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
     "node_modules/tiny-case": {
       "version": "1.0.3",
       "dev": true,
@@ -10423,6 +11155,19 @@
         "node": ">=14.14"
       }
     },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
     "node_modules/toidentifier": {
       "version": "1.0.1",
       "dev": true,
diff --git a/package.json b/package.json
index ed81f820..aa72cf0c 100644
--- a/package.json
+++ b/package.json
@@ -15,6 +15,8 @@
     "lint": "prettier --check --ignore-path .prettierignore . && eslint . && npm run check",
     "lint:fix": "prettier --write --ignore-path .prettierignore . && eslint . --fix && npm run check",
     "test:unit": "vitest run",
+    "test:arch": "vitest run --config vitest.arch.config.ts",
+    "test:arch:report": "ARCH_REPORT=1 vitest run --config vitest.arch.config.ts",
     "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && npx tsx e2e/support/run-e2e.ts",
     "test:e2e:desktop": "node --env-file=.env.test node_modules/.bin/vite build && npx tsx e2e/support/run-e2e.ts --project=chromium --project=firefox",
     "test:e2e:ui": "playwright test --ui",
@@ -29,10 +31,10 @@
     "@eslint/compat": "^2.0.2",
     "@eslint/js": "^9.39.2",
     "@faker-js/faker": "^10.4.0",
+    "@iconify-json/lsicon": "^1.2.5",
+    "@iconify-json/material-icon-theme": "^1.2.67",
     "@iconify-json/material-symbols": "^1.2.74",
     "@iconify-json/vscode-icons": "^1.2.55",
-    "@iconify-json/material-icon-theme": "^1.2.67",
-    "@iconify-json/lsicon": "^1.2.5",
     "@inlang/paraglide-js": "^2.12.0",
     "@playwright/test": "^1.58.2",
     "@sveltejs/adapter-node": "^5.5.3",
@@ -48,6 +50,7 @@
     "@vitest/browser-playwright": "^4.0.18",
     "@vitest/coverage-v8": "^4.0.18",
     "antlr-ng": "^1.0.10",
+    "archunit": "^2.3.3",
     "daisyui": "^5.5.19",
     "drizzle-kit": "^0.31.10",
     "eslint": "^9.39.2",
diff --git a/src/architecture/circular-dependencies.spec.ts b/src/architecture/circular-dependencies.spec.ts
new file mode 100644
index 00000000..44ddad1e
--- /dev/null
+++ b/src/architecture/circular-dependencies.spec.ts
@@ -0,0 +1,50 @@
+/**
+ * No Circular Dependencies
+ *
+ * Import cycles cause unpredictable initialisation order, make tree-shaking
+ * less effective and are a strong signal of coupled, hard-to-refactor code.
+ *
+ * Known violations (see TECH_DEBT.md — "Circular imports in Trino layer"):
+ *   • src/lib/server/trino/client.ts  ↔  src/lib/server/trino/user-clients.ts
+ *   • src/lib/server/trino/queries.ts ↔  src/lib/server/trino/result-collector.ts
+ *
+ * These are excluded from the cycle check below until the Trino layer is
+ * refactored to extract shared types into a separate file.
+ */
+
+import { projectFiles } from 'archunit';
+import { describe, expect, it } from 'vitest';
+import { defaultOptions } from './helpers';
+
+describe('No Circular Dependencies', () => {
+  it('src/lib must be free of import cycles (excluding generated and known-cyclic Trino files)', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/**/*.ts', {
+        except: {
+          inPath: 'src/lib/editor/generated/**'
+        }
+      })
+      .inPath('src/lib/**/*.ts', {
+        except: {
+          inPath: 'src/lib/server/trino/**'
+        }
+      })
+      .should()
+      .haveNoCycles();
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('SvelteKit routes must be free of import cycles', async () => {
+    const rule = projectFiles().inPath('src/routes/**/*.ts').should().haveNoCycles();
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('KNOWN VIOLATION — Trino layer has circular imports (see TECH_DEBT.md)', async () => {
+    const rule = projectFiles().inPath('src/lib/server/trino/**/*.ts').should().haveNoCycles();
+
+    const violations = await rule.check();
+    expect(violations.length).toBeGreaterThan(0);
+  });
+});
diff --git a/src/architecture/code-size-limits.spec.ts b/src/architecture/code-size-limits.spec.ts
new file mode 100644
index 00000000..c0a1111a
--- /dev/null
+++ b/src/architecture/code-size-limits.spec.ts
@@ -0,0 +1,66 @@
+/**
+ * Code Size Limits
+ *
+ * Very large files are a leading indicator of insufficient separation of
+ * concerns and increase cognitive load for both humans and AI coding assistants.
+ *
+ * Thresholds are set above current maximums to pass today but act as guardrails
+ * against further growth. Tighten them as large files are split during normal
+ * refactoring cycles.
+ *
+ * Current maximums (non-generated):
+ *   src/lib/storage/state.svelte.ts              ~2 331 LOC  ← split candidate
+ *   src/lib/server/storage/archive.ts              ~919 LOC
+ *   src/lib/components/storage/modals/PreviewModal.svelte ~1 065 LOC
+ */
+
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+import { findFiles } from './helpers';
+
+describe('Code Size Limits', () => {
+  it('TypeScript source files must not exceed 2 400 lines of code', () => {
+    const MAX_LOC = 2400;
+    const violations: string[] = [];
+
+    const files = findFiles('src', /\.ts$/, [/editor\/generated/, /paraglide/]);
+    for (const file of files) {
+      const lines = readFileSync(file, 'utf-8').split('\n').length;
+      if (lines >= MAX_LOC) {
+        violations.push(`${file} (${lines} lines, max ${MAX_LOC})`);
+      }
+    }
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('Svelte component files must not exceed 1 100 lines', () => {
+    const MAX_LOC = 1100;
+    const violations: string[] = [];
+
+    const files = findFiles('src', /\.svelte$/);
+    for (const file of files) {
+      const lines = readFileSync(file, 'utf-8').split('\n').length;
+      if (lines >= MAX_LOC) {
+        violations.push(`${file} (${lines} lines, max ${MAX_LOC})`);
+      }
+    }
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('individual test files must not exceed 1 000 lines of code', () => {
+    const MAX_LOC = 1000;
+    const violations: string[] = [];
+
+    const files = findFiles('src', /\.(test|spec)\.ts$/, [/editor\/generated/]);
+    for (const file of files) {
+      const lines = readFileSync(file, 'utf-8').split('\n').length;
+      if (lines >= MAX_LOC) {
+        violations.push(`${file} (${lines} lines, max ${MAX_LOC})`);
+      }
+    }
+
+    expect(violations).toStrictEqual([]);
+  });
+});
diff --git a/src/architecture/helpers.ts b/src/architecture/helpers.ts
new file mode 100644
index 00000000..6dba29e7
--- /dev/null
+++ b/src/architecture/helpers.ts
@@ -0,0 +1,61 @@
+/**
+ * Shared helpers for architecture fitness tests.
+ *
+ * ArchUnitTS only scans TypeScript (.ts) source files. Svelte (.svelte) and
+ * JSON files are invisible to its file graph. Rules that need to inspect
+ * .svelte file content therefore use plain Node.js fs helpers instead.
+ */
+
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+/** Standard options: suppress verbose logs, fail on empty patterns. */
+export const defaultOptions = {
+  logging: { enabled: false, level: 'warn' as const }
+};
+
+/**
+ * Recursively collect all files under `dir` whose names match `filenamePattern`.
+ * Hidden directories (starting with `.`) are skipped automatically.
+ */
+export function findFiles(
+  dir: string,
+  filenamePattern: RegExp,
+  excludeDirs: RegExp[] = []
+): string[] {
+  const results: string[] = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return results;
+  }
+  for (const entry of entries) {
+    const fullPath = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (entry.name.startsWith('.')) continue;
+      if (excludeDirs.some((p) => p.test(fullPath))) continue;
+      results.push(...findFiles(fullPath, filenamePattern, excludeDirs));
+    } else if (entry.isFile() && filenamePattern.test(entry.name)) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+
+/**
+ * Check every file returned by `findFiles` against `predicate`.
+ * Returns a list of `{ file, reason }` violation objects.
+ */
+export function checkFiles(
+  files: string[],
+  predicate: (content: string) => boolean,
+  reason: string
+): Array<{ file: string; reason: string }> {
+  return files
+    .filter((file) => {
+      const content = readFileSync(file, 'utf-8');
+      return !predicate(content);
+    })
+    .map((file) => ({ file, reason }));
+}
diff --git a/src/architecture/i18n-compliance.spec.ts b/src/architecture/i18n-compliance.spec.ts
new file mode 100644
index 00000000..8a1b7de3
--- /dev/null
+++ b/src/architecture/i18n-compliance.spec.ts
@@ -0,0 +1,61 @@
+/**
+ * i18n Compliance
+ *
+ * All user-visible strings must be served through Paraglide-JS message
+ * functions so that the application renders correctly in both English (en)
+ * and German (de).
+ *
+ * Rules:
+ *   a) Both locale files (messages/en.json, messages/de.json) must have the
+ *      same top-level keys — missing translations break the German locale.
+ *   b) Svelte components must not use hardcoded English strings in static
+ *      aria-label="..." attributes (dynamic bindings are allowed).
+ */
+
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+import { findFiles } from './helpers';
+
+describe('i18n Compliance', () => {
+  it('messages/en.json and messages/de.json must have the same top-level keys', () => {
+    const en: Record<string, unknown> = JSON.parse(readFileSync('messages/en.json', 'utf-8'));
+    const de: Record<string, unknown> = JSON.parse(readFileSync('messages/de.json', 'utf-8'));
+
+    const enKeys = Object.keys(en).sort();
+    const deKeys = Object.keys(de).sort();
+
+    const missingInDe = enKeys.filter((k) => !deKeys.includes(k));
+    const missingInEn = deKeys.filter((k) => !enKeys.includes(k));
+
+    expect(missingInDe).toStrictEqual([]);
+    expect(missingInEn).toStrictEqual([]);
+  });
+
+  it('Svelte components must not use static English strings in aria-label attributes', () => {
+    const KNOWN_VIOLATIONS = [
+      'ToastHost.svelte',
+      'TextEditor.svelte',
+      'ContextMenu.svelte',
+      'FileRow.svelte',
+      'FolderRow.svelte',
+      'ObjectTable.svelte',
+      'StorageBreadcrumb.svelte',
+      'CsvPreview.svelte',
+      'ParquetPreview.svelte',
+      'TextPreview.svelte'
+    ];
+
+    const STATIC_ARIA_RE = /aria-label="[A-Za-z][^"]{2,}"/;
+
+    const files = findFiles('src', /\.svelte$/);
+    const allViolations = files.filter((file) => {
+      const content = readFileSync(file, 'utf-8');
+      return STATIC_ARIA_RE.test(content);
+    });
+
+    const newViolations = allViolations.filter(
+      (f) => !KNOWN_VIOLATIONS.some((kv) => f.endsWith(kv))
+    );
+    expect(newViolations).toStrictEqual([]);
+  });
+});
diff --git a/src/architecture/naming-conventions.spec.ts b/src/architecture/naming-conventions.spec.ts
new file mode 100644
index 00000000..b83b8123
--- /dev/null
+++ b/src/architecture/naming-conventions.spec.ts
@@ -0,0 +1,46 @@
+/**
+ * Naming Conventions
+ *
+ * Consistent naming makes the codebase predictable and allows tooling
+ * (SvelteKit, Vitest, ESLint) to apply the correct transforms automatically.
+ *
+ * Rules derived from AGENTS.md:
+ *   • Svelte 5 rune-based stores use the `.svelte.ts` extension so that
+ *     Svelte's compiler processes the rune syntax ($state, $derived, etc.)
+ *   • Svelte components in src/lib/components/ are PascalCase (checked via fs
+ *     because archunit does not scan .svelte files)
+ */
+
+import { describe, expect, it } from 'vitest';
+import { findFiles } from './helpers';
+
+describe('Naming Conventions', () => {
+  it('files in src/lib/stores/ must use the .svelte.ts extension', () => {
+    // Svelte 5 rune-based reactive state ($state, $derived) only compiles
+    // correctly when the file extension is .svelte.ts.
+    // Spec files (*.spec.ts) are excluded from this check.
+    const violations = findFiles('src/lib/stores', /\.ts$/, [/__tests__/]).filter((f) => {
+      const name = f.split('/').at(-1) ?? '';
+      return !name.endsWith('.svelte.ts') && !name.endsWith('.spec.ts');
+    });
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('Svelte components in src/lib/components/ must be PascalCase', () => {
+    const PASCAL_CASE = /^[A-Z][a-zA-Z0-9]*\.svelte$/;
+    const svelteFiles = findFiles('src/lib/components', /\.svelte$/, [/__tests__/, /\.spec\./]);
+
+    const violations = svelteFiles.filter((f) => {
+      const name = f.split('/').at(-1) ?? '';
+      return !PASCAL_CASE.test(name);
+    });
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('src/lib/server/ files must not use .svelte.ts extension', () => {
+    const violations = findFiles('src/lib/server', /\.svelte\.ts$/);
+    expect(violations).toStrictEqual([]);
+  });
+});
diff --git a/src/architecture/report-generation.spec.ts b/src/architecture/report-generation.spec.ts
new file mode 100644
index 00000000..66ced76e
--- /dev/null
+++ b/src/architecture/report-generation.spec.ts
@@ -0,0 +1,50 @@
+/**
+ * Architecture Reports
+ *
+ * Run `npm run test:arch:report` to generate HTML dashboards in /reports/.
+ * These can be committed as CI artefacts for architecture review.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+describe('Architecture Reports (run manually with test:arch:report)', () => {
+  it('should export dependency graph for src/lib', async () => {
+    if (!process.env.ARCH_REPORT) {
+      expect(true).toBe(true);
+      return;
+    }
+
+    const { projectGraph } = await import('archunit');
+    await projectGraph()
+      .titled('Stackable Cockpit — src/lib Dependency Graph')
+      .focusOn('src/lib/**', 2)
+      .exportAsHTML('reports/lib-dependency-graph.html');
+
+    await projectGraph()
+      .titled('Stackable Cockpit — Full Source Graph')
+      .collapseToFolderDepth(3)
+      .exportAsMermaid('reports/source-graph.mmd');
+
+    expect(true).toBe(true);
+  });
+
+  it('should export code metrics report', async () => {
+    if (!process.env.ARCH_REPORT) {
+      expect(true).toBe(true);
+      return;
+    }
+
+    const { metrics } = await import('archunit');
+    await metrics()
+      .inPath('src/**/*.ts', {
+        except: { inPath: 'src/lib/editor/generated/**' }
+      })
+      .count()
+      .exportAsHTML('reports/count-metrics.html', {
+        title: 'Stackable Cockpit — Count Metrics',
+        includeTimestamp: true
+      });
+
+    expect(true).toBe(true);
+  });
+});
diff --git a/src/architecture/server-client-boundary.spec.ts b/src/architecture/server-client-boundary.spec.ts
new file mode 100644
index 00000000..bd116ccf
--- /dev/null
+++ b/src/architecture/server-client-boundary.spec.ts
@@ -0,0 +1,93 @@
+/**
+ * Server / Client Boundary
+ *
+ * The server layer (src/lib/server/**) contains database access, auth tokens,
+ * storage credentials, pino loggers and Prometheus metrics that must NEVER be
+ * bundled into the client. Any import of server code from client-side files is
+ * a security and build risk.
+ *
+ * Known legitimate cross-boundary pattern:
+ *   • Svelte component files (.svelte) may use `import type { … }` from server
+ *     type files. TypeScript erases these at compile time so there is no runtime
+ *     dependency. ArchUnitTS cannot distinguish type-only imports in .ts files,
+ *     but since it does not scan .svelte files anyway, this is not an issue here.
+ *     Long-term fix: move shared types to src/lib/types/ — see TECH_DEBT.md.
+ */
+
+import { projectFiles } from 'archunit';
+import { describe, expect, it } from 'vitest';
+import { defaultOptions } from './helpers';
+
+describe('Server / Client Boundary', () => {
+  it('client-only utilities (src/lib/client) must not import server code', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/client/**/*.ts')
+      .shouldNot()
+      .dependOnFiles()
+      .inPath('src/lib/server/**');
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('Svelte reactive stores (src/lib/stores) must not import server code', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/stores/**/*.ts')
+      .shouldNot()
+      .dependOnFiles()
+      .inPath('src/lib/server/**');
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('shared storage utilities (src/lib/storage) must not import server code', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/storage/**/*.ts')
+      .shouldNot()
+      .dependOnFiles()
+      .inPath('src/lib/server/**');
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('Monaco/ANTLR editor code must not import server code', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/editor/**/*.ts', {
+        except: { inPath: 'src/lib/editor/generated/**' }
+      })
+      .shouldNot()
+      .dependOnFiles()
+      .inPath('src/lib/server/**');
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('shared type definitions (src/lib/types) must not import server code', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/types/**/*.ts')
+      .shouldNot()
+      .dependOnFiles()
+      .inPath('src/lib/server/**');
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('server code must not import client-only utilities', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/server/**/*.ts')
+      .shouldNot()
+      .dependOnFiles()
+      .inPath('src/lib/client/**');
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+
+  it('server code must not import Svelte reactive stores', async () => {
+    const rule = projectFiles()
+      .inPath('src/lib/server/**/*.ts')
+      .shouldNot()
+      .dependOnFiles()
+      .inPath('src/lib/stores/**');
+
+    await expect(rule).toPassAsync(defaultOptions);
+  });
+});
diff --git a/src/architecture/server-logging.spec.ts b/src/architecture/server-logging.spec.ts
new file mode 100644
index 00000000..186f27a7
--- /dev/null
+++ b/src/architecture/server-logging.spec.ts
@@ -0,0 +1,68 @@
+/**
+ * Server-Side Logging Standards
+ *
+ * All server-side code must use pino (via $lib/server/logging) instead of
+ * console.* so that logs are structured JSON, include request correlation IDs,
+ * and can be filtered/routed by log level in production.
+ *
+ * Exceptions:
+ *   • src/lib/server/migrate.ts — standalone CLI migration runner that executes
+ *     before the application server and pino logger are initialised.
+ */
+
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+import { findFiles } from './helpers';
+
+describe('Server-Side Logging Standards', () => {
+  it('server lib files must not call console.log/warn/error/info/debug', () => {
+    const CONSOLE_CALL_RE = /\bconsole\.(log|warn|error|info|debug)\s*\(/;
+    const COMMENT_LINE_RE = /^\s*(\/\/|\/\*|\*)/;
+
+    const files = findFiles('src/lib/server', /\.ts$/).filter(
+      (f) => !f.endsWith('migrate.ts') && !f.includes('.test.') && !f.includes('.spec.')
+    );
+
+    const violations: string[] = [];
+
+    for (const file of files) {
+      const lines = readFileSync(file, 'utf-8').split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (COMMENT_LINE_RE.test(line)) continue;
+        if (!CONSOLE_CALL_RE.test(line)) continue;
+        const matchIdx = line.search(CONSOLE_CALL_RE);
+        const before = line.substring(0, matchIdx);
+        const openDoubleQuotes = (before.match(/(?<!\\)"/g) ?? []).length;
+        if (openDoubleQuotes % 2 !== 0) continue;
+        const openSingleQuotes = (before.match(/(?<!\\)'/g) ?? []).length;
+        if (openSingleQuotes % 2 !== 0) continue;
+        if (line.includes('//') && line.indexOf('//') < matchIdx) continue;
+        violations.push(`${file}:${i + 1}: ${line.trim()}`);
+      }
+    }
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('SvelteKit server route files must not call console.* directly', () => {
+    const CONSOLE_CALL_RE = /\bconsole\.(log|warn|error|info|debug)\s*\(/;
+    const COMMENT_OR_STRING_RE = /^\s*(\/\/|\/\*|\*)/;
+
+    const files = findFiles('src/routes', /\.server\.ts$/);
+    const violations: string[] = [];
+
+    for (const file of files) {
+      const lines = readFileSync(file, 'utf-8').split('\n');
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (COMMENT_OR_STRING_RE.test(line)) continue;
+        if (CONSOLE_CALL_RE.test(line) && !line.includes('//')) {
+          violations.push(`${file}:${i + 1}: ${line.trim()}`);
+        }
+      }
+    }
+
+    expect(violations).toStrictEqual([]);
+  });
+});
diff --git a/src/architecture/ui-pattern-enforcement.spec.ts b/src/architecture/ui-pattern-enforcement.spec.ts
new file mode 100644
index 00000000..7b571855
--- /dev/null
+++ b/src/architecture/ui-pattern-enforcement.spec.ts
@@ -0,0 +1,100 @@
+/**
+ * UI Pattern Enforcement
+ *
+ * These rules enforce the coding standards from AGENTS.md that apply to Svelte
+ * component files. They inspect raw file content via Node.js fs since ArchUnitTS
+ * does not scan .svelte files.
+ *
+ * Rules:
+ *   a) No hardcoded Tailwind colour utilities — use DaisyUI semantic classes
+ *      so that light/dark theme switching works automatically.
+ *   b) No raw <dialog> elements outside Modal.svelte — always use the shared
+ *      <Modal> component which handles focus trapping, Escape, and backdrop.
+ *   c) No native <input type="date"> / <input type="datetime-local"> — always
+ *      use the shared <DateTimePicker> component.
+ *   d) No <img> without an alt attribute — BITV 2.0 / WCAG 2.1 AA compliance.
+ *   e) No <div onclick> / <span onclick> — use <button> for clickable elements.
+ */
+
+import { readFileSync } from 'node:fs';
+import { describe, expect, it } from 'vitest';
+import { checkFiles, findFiles } from './helpers';
+
+describe('UI Pattern Enforcement', () => {
+  const HARDCODED_COLOUR_RE =
+    /\b(bg-white|bg-black(?!\/)|text-gray-\d|text-slate-\d|bg-gray-\d|bg-slate-\d|border-gray-\d|border-slate-\d|text-zinc-\d|bg-zinc-\d)\b/;
+
+  it('Svelte components must not use hardcoded Tailwind colour utilities', () => {
+    const SIDEBAR_RE = /src\/lib\/components\/layout\/sidebar\//;
+
+    const files = findFiles('src/lib/components', /\.svelte$/, [/__tests__/]);
+    const violations: string[] = [];
+
+    for (const file of files) {
+      if (SIDEBAR_RE.test(file)) continue;
+      const content = readFileSync(file, 'utf-8');
+      if (HARDCODED_COLOUR_RE.test(content)) {
+        violations.push(file);
+      }
+    }
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('Svelte components must not use raw <dialog> elements (use <Modal> instead)', () => {
+    const violations = findFiles('src/lib/components', /\.svelte$/).filter((file) => {
+      if (file.endsWith('Modal.svelte')) return false;
+      const raw = readFileSync(file, 'utf-8');
+      const stripped = raw
+        .replace(/<!--[\s\S]*?-->/g, '')
+        .split('\n')
+        .filter((l) => !l.trim().startsWith('//'))
+        .join('\n');
+      return /<dialog[\s>]/.test(stripped);
+    });
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('Svelte components must not use native date/time inputs (use <DateTimePicker>)', () => {
+    const files = findFiles('src', /\.svelte$/);
+    const violations = checkFiles(
+      files,
+      (content) => !/type="date"|type="datetime-local"/.test(content),
+      'must not use native date/datetime-local inputs — use <DateTimePicker> instead'
+    );
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('img elements in Svelte components must have an alt attribute (BITV 2.0)', () => {
+    const files = findFiles('src', /\.svelte$/);
+    const violations = files.filter((file) => {
+      const content = readFileSync(file, 'utf-8');
+      return /<img(?![^>]*\balt=)[^>]*>/.test(content);
+    });
+
+    expect(violations).toStrictEqual([]);
+  });
+
+  it('clickable div/span elements must not replace <button> (BITV 2.0 keyboard nav)', () => {
+    const KNOWN_VIOLATIONS = [
+      'CatalogTree.svelte',
+      'OperationsButton.svelte',
+      'TabBar.svelte',
+      'FloatingMenu.svelte',
+      'StatementResult.svelte'
+    ];
+
+    const files = findFiles('src', /\.svelte$/);
+    const allViolations = files.filter((file) => {
+      const content = readFileSync(file, 'utf-8');
+      return /<(div|span)[^>]+(on:click|onclick)=/.test(content);
+    });
+
+    const newViolations = allViolations.filter(
+      (f) => !KNOWN_VIOLATIONS.some((kv) => f.endsWith(kv))
+    );
+    expect(newViolations).toStrictEqual([]);
+  });
+});
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
index 1b9b49f3..a61dccf7 100644
--- a/src/routes/(app)/storage/+error.svelte
+++ b/src/routes/(app)/storage/+error.svelte
@@ -33,7 +33,10 @@
 
 <div class="bg-base-100 flex flex-1 flex-col overflow-hidden">
   <div class="border-base-300 flex items-center gap-3 border-b px-6 py-3">
-    <nav aria-label="breadcrumb" class="flex min-w-0 flex-1 items-center gap-1 text-sm">
+    <nav
+      aria-label={m.storage_error_breadcrumb()}
+      class="flex min-w-0 flex-1 items-center gap-1 text-sm"
+    >
       <span class="flex shrink-0 items-center gap-1">
         <a
           href={resolve('/(app)/storage/[bucket]/[...prefix]', {
diff --git a/vite.config.ts b/vite.config.ts
index b0a399a2..e4c97a1e 100644
--- a/vite.config.ts
+++ b/vite.config.ts
@@ -38,7 +38,7 @@ export default defineConfig({
             instances: [{ browser: 'chromium', headless: true }]
           },
           include: ['src/**/*.svelte.{test,spec}.{js,ts}'],
-          exclude: ['src/lib/server/**'],
+          exclude: ['src/lib/server/**', 'src/architecture/**'],
           setupFiles: ['src/test/setup-client.ts']
         }
       },
@@ -49,7 +49,7 @@ export default defineConfig({
           name: 'server',
           environment: 'node',
           include: ['src/**/*.{test,spec}.{js,ts}'],
-          exclude: ['src/**/*.svelte.{test,spec}.{js,ts}']
+          exclude: ['src/**/*.svelte.{test,spec}.{js,ts}', 'src/architecture/**']
         }
       }
     ]
diff --git a/vitest.arch.config.ts b/vitest.arch.config.ts
new file mode 100644
index 00000000..5a8fb6dd
--- /dev/null
+++ b/vitest.arch.config.ts
@@ -0,0 +1,24 @@
+/**
+ * Vitest configuration for architecture fitness functions.
+ *
+ * This is a separate configuration from the main vite.config.ts because
+ * ArchUnitTS requires `globals: true` to enable the `toPassAsync()` matcher.
+ * Enabling globals project-wide would mask missing imports in application code,
+ * so we keep this isolated.
+ *
+ * Run with: npm run test:arch
+ */
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    globals: true,
+    environment: 'node',
+    include: ['src/architecture/**/*.spec.ts'],
+    reporters: ['verbose'],
+    // archunit's first run builds the entire file dependency graph from scratch.
+    // Subsequent tests use the cached graph and run in <10ms each.
+    // 30 seconds is generous even for large codebases.
+    testTimeout: 30000
+  }
+});

From c4d043b2845a1aa272213999e481414605c67f04 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 10 Aug 2026 14:18:54 +0200
Subject: [PATCH 123/136] fix saving newly created files

---
 .../storage/modals/PreviewModal.svelte        |  9 ++++++-
 src/lib/storage/api.spec.ts                   | 26 +++++++++++++++++++
 src/lib/storage/api.ts                        | 19 +++++++++++---
 .../api/storage/save-text/server.test.ts      | 16 ++++++++++++
 4 files changed, 66 insertions(+), 4 deletions(-)

diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 68ad50e9..f67dfd03 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -605,7 +605,14 @@
 
     saving = true;
     try {
-      await storage.api.saveText({ bucket, key: objectKey, body: editorText });
+      await storage.api.saveText({
+        bucket,
+        key: objectKey,
+        body: editorText,
+        originalSize: preview.totalSize,
+        previewBytes: preview.previewBytes,
+        contentType: preview.contentType
+      });
 
       originalText = editorText;
       addToast('success', m.storage_editor_saved());
diff --git a/src/lib/storage/api.spec.ts b/src/lib/storage/api.spec.ts
index fae3380f..95ab05ac 100644
--- a/src/lib/storage/api.spec.ts
+++ b/src/lib/storage/api.spec.ts
@@ -445,6 +445,32 @@ describe('createFetchStorageApi', () => {
       expect(exists).toBe(false);
     });
   });
+
+  describe('saveText', () => {
+    it('includes preview metadata required by the save endpoint', async () => {
+      const api = createFetchStorageApi(() => 'conn-1');
+      vi.spyOn(globalThis, 'fetch').mockResolvedValue(new Response(null, { status: 200 }));
+
+      await api.saveText({
+        bucket: 'b',
+        key: 'new file.txt',
+        body: 'new text',
+        originalSize: 0,
+        previewBytes: 0,
+        contentType: 'text/plain'
+      });
+
+      const [url, init] = vi.mocked(globalThis.fetch).mock.calls[0]!;
+      expect(url).toContain('/api/storage/save-text');
+      expect(url).toContain('bucket=b');
+      expect(url).toContain('key=new+file.txt');
+      expect(url).toContain('originalSize=0');
+      expect(url).toContain('previewBytes=0');
+      expect(url).toContain('contentType=text%2Fplain');
+      expect(init?.method).toBe('POST');
+      expect(init?.body).toBe('new text');
+    });
+  });
 });
 
 describe('NDJSON streaming via copy', () => {
diff --git a/src/lib/storage/api.ts b/src/lib/storage/api.ts
index 0cce9613..f8bbf2bf 100644
--- a/src/lib/storage/api.ts
+++ b/src/lib/storage/api.ts
@@ -96,7 +96,14 @@ export interface StorageApi {
     data?: boolean;
   }): Promise<Response>;
 
-  saveText(params: { bucket: string; key: string; body: string }): Promise<void>;
+  saveText(params: {
+    bucket: string;
+    key: string;
+    body: string;
+    originalSize: number;
+    previewBytes: number;
+    contentType: string;
+  }): Promise<void>;
 
   details(params: { bucket: string; key: string }): Promise<FileDetails>;
 
@@ -231,8 +238,14 @@ export function createFetchStorageApi(getConnectionId: () => string | null): Sto
       return fetch_(`/api/storage/preview?${params}`);
     },
 
-    async saveText({ bucket, key, body }) {
-      const params = new URLSearchParams({ bucket, key });
+    async saveText({ bucket, key, body, originalSize, previewBytes, contentType }) {
+      const params = new URLSearchParams({
+        bucket,
+        key,
+        originalSize: String(originalSize),
+        previewBytes: String(previewBytes),
+        contentType
+      });
       await fetch_(`/api/storage/save-text?${params}`, {
         method: 'POST',
         body
diff --git a/src/routes/(app)/api/storage/save-text/server.test.ts b/src/routes/(app)/api/storage/save-text/server.test.ts
index 8d0b7897..ec5e1a64 100644
--- a/src/routes/(app)/api/storage/save-text/server.test.ts
+++ b/src/routes/(app)/api/storage/save-text/server.test.ts
@@ -63,6 +63,22 @@ describe('POST /api/storage/save-text', () => {
     expect(mockProvider.getObjectRange).not.toHaveBeenCalled();
   });
 
+  it('saves newly created empty files', async () => {
+    mockProvider.putObject.mockResolvedValue(undefined);
+
+    const res = await POST(
+      mockEvent('bucket=b1&key=file.txt&originalSize=0&previewBytes=0', textBody('new text'))
+    );
+
+    expect(res.status).toBe(200);
+    expect(mockProvider.putObject).toHaveBeenCalledWith(
+      'file.txt',
+      expect.anything(),
+      'text/plain',
+      8
+    );
+  });
+
   it('merges edit tail when truncated', async () => {
     const tailBytes = new TextEncoder().encode('...tail');
     const tailStream = new ReadableStream({

From 286a7fb10c02a892c9ed1592bcd889f2dfcfbf50 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 10 Aug 2026 14:23:06 +0200
Subject: [PATCH 124/136] open connection options on right click as well as
 button

---
 .../sidebar/StorageConnectionSidebar.svelte      | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
index 36f60f7f..62fbae99 100644
--- a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -77,8 +77,16 @@
   function openContextMenu(e: MouseEvent, conn: ConnectionMetadata) {
     e.preventDefault();
     e.stopPropagation();
-    const btnRect = (e.currentTarget as HTMLElement).getBoundingClientRect();
-    menuRawPos = { left: btnRect.right, top: btnRect.bottom };
+    menuRawPos = { left: e.clientX, top: e.clientY };
+    menuConn = conn;
+  }
+
+  function handleConnectionKeydown(e: KeyboardEvent, conn: ConnectionMetadata) {
+    if (e.key !== 'ContextMenu' && !(e.shiftKey && e.key === 'F10')) return;
+
+    const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
+    e.preventDefault();
+    menuRawPos = { left: rect.left, top: rect.bottom };
     menuConn = conn;
   }
 
@@ -287,6 +295,8 @@
                 onmouseleave={hideTooltip}
                 onfocus={(e) => showTooltip(e, connectionLabel(conn))}
                 onblur={hideTooltip}
+                oncontextmenu={(e) => openContextMenu(e, conn)}
+                onkeydown={(e) => handleConnectionKeydown(e, conn)}
               >
                 <IconStorage
                   class="text-primary size-3.5 shrink-0 {activeId === conn.id ? '' : 'opacity-60'}"
@@ -310,6 +320,8 @@
                   onmouseleave={hideTooltip}
                   onfocus={(e) => showTooltip(e, connectionLabel(conn))}
                   onblur={hideTooltip}
+                  oncontextmenu={(e) => openContextMenu(e, conn)}
+                  onkeydown={(e) => handleConnectionKeydown(e, conn)}
                 >
                   <IconStorage
                     class="text-primary size-3.5 shrink-0 {activeId === conn.id

From db0dceacecb9d2c245454e17927aa72db657b47e Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 13 Aug 2026 08:30:59 +0200
Subject: [PATCH 125/136] Add loading bar, use prefetch on main navigation
 (#285)

* add loading bar, use prefetch on main navigation

* show loading bar on navigation only between apps
---
 e2e/navigation.spec.ts                        | 79 +++++++++++++++++++
 messages/de.json                              |  1 +
 messages/en.json                              |  1 +
 src/app.css                                   |  9 +++
 .../layout/NavigationProgress.svelte          | 40 ++++++++++
 .../components/layout/sidebar/Sidebar.svelte  |  1 +
 src/routes/+layout.svelte                     |  3 +
 7 files changed, 134 insertions(+)
 create mode 100644 e2e/navigation.spec.ts
 create mode 100644 src/lib/components/layout/NavigationProgress.svelte

diff --git a/e2e/navigation.spec.ts b/e2e/navigation.spec.ts
new file mode 100644
index 00000000..2f1a59ca
--- /dev/null
+++ b/e2e/navigation.spec.ts
@@ -0,0 +1,79 @@
+import { test, expect } from '@playwright/test';
+import { waitForHydration } from './support/helpers';
+
+test.describe('App navigation', () => {
+  test.use({ locale: 'en-US' });
+
+  test('navigating between apps shows a loading indicator until the page is ready', async ({
+    page
+  }) => {
+    await page.goto('/');
+    await waitForHydration(page);
+
+    // Delay the Trino route's data fetch so the loading indicator stays on
+    // screen long enough to assert on it.
+    await page.route('**/trino/__data.json*', async (route) => {
+      await new Promise((resolve) => setTimeout(resolve, 1500));
+      await route.continue();
+    });
+
+    await page.getByRole('link', { name: 'Trino', exact: true }).click();
+
+    const progress = page.locator('[data-navigation-progress]');
+    await expect(progress).toBeVisible();
+    await expect(progress.getByText('Loading…')).toBeVisible();
+
+    await expect(page.getByRole('heading', { name: 'Trino', exact: true })).toBeVisible();
+    await expect(progress).toBeHidden();
+  });
+
+  test('navigating within an app does not show the global loading bar', async ({ page }) => {
+    await page.goto('/storage');
+    await waitForHydration(page);
+
+    // Delay the connections page's data fetch. Even while it is in flight the
+    // global progress bar must stay hidden: it only appears between apps.
+    await page.route('**/storage/connections/__data.json*', async (route) => {
+      await new Promise((resolve) => setTimeout(resolve, 1500));
+      await route.continue();
+    });
+
+    await page.getByRole('link', { name: 'Manage connections' }).click();
+
+    const progress = page.locator('[data-navigation-progress]');
+    await expect(progress).toBeHidden();
+    // Wait out the artificial delay while the intra-app navigation is in flight.
+    await page.waitForTimeout(2000);
+    await expect(progress).toHaveCount(0);
+
+    await expect(page.getByRole('heading', { name: 'Manage connections' })).toBeVisible();
+  });
+
+  test('sidebar highlights the active app when switching between dashboard, Trino and storage', async ({
+    page
+  }) => {
+    await page.goto('/');
+    await waitForHydration(page);
+
+    const dashboardLink = page.getByRole('link', { name: 'Dashboard' });
+    const trinoLink = page.getByRole('link', { name: 'Trino', exact: true });
+    const storageLink = page.getByRole('link', { name: 'Storage' });
+
+    await expect(dashboardLink).toHaveAttribute('aria-current', 'page');
+
+    await trinoLink.click();
+    await expect(page.getByRole('heading', { name: 'Trino', exact: true })).toBeVisible();
+    await expect(trinoLink).toHaveAttribute('aria-current', 'page');
+    await expect(dashboardLink).not.toHaveAttribute('aria-current', 'page');
+
+    await storageLink.click();
+    await expect(page.getByRole('heading', { name: 'Storage', exact: true })).toBeVisible();
+    await expect(storageLink).toHaveAttribute('aria-current', 'page');
+    await expect(trinoLink).not.toHaveAttribute('aria-current', 'page');
+
+    await dashboardLink.click();
+    await expect(page.getByRole('heading', { name: 'Dashboard', exact: true })).toBeVisible();
+    await expect(dashboardLink).toHaveAttribute('aria-current', 'page');
+    await expect(storageLink).not.toHaveAttribute('aria-current', 'page');
+  });
+});
diff --git a/messages/de.json b/messages/de.json
index f9e38d66..1c24ab32 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -21,6 +21,7 @@
   "nav_badge_soon": "Bald",
   "sidebar_label": "Seitenleiste",
   "sidebar_nav_label": "Hauptnavigation",
+  "navigation_loading": "Wird geladen…",
   "sidebar_close_nav": "Navigation schließen",
   "sidebar_expand": "Seitenleiste ausklappen",
   "sidebar_collapse": "Seitenleiste einklappen",
diff --git a/messages/en.json b/messages/en.json
index 3be2ce03..98769950 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -21,6 +21,7 @@
   "nav_badge_soon": "Soon",
   "sidebar_label": "Sidebar",
   "sidebar_nav_label": "Main navigation",
+  "navigation_loading": "Loading…",
   "sidebar_close_nav": "Close navigation",
   "sidebar_expand": "Expand sidebar",
   "sidebar_collapse": "Collapse sidebar",
diff --git a/src/app.css b/src/app.css
index f95457a3..cda5b74d 100644
--- a/src/app.css
+++ b/src/app.css
@@ -60,3 +60,12 @@ progress.progress.progress-smooth::-moz-progress-bar {
 .preview-scroll::-webkit-scrollbar-thumb:hover {
   background-color: color-mix(in oklch, currentColor 50%, transparent);
 }
+
+@keyframes nav-progress-slide {
+  0% {
+    transform: translateX(-110%);
+  }
+  100% {
+    transform: translateX(350%);
+  }
+}
diff --git a/src/lib/components/layout/NavigationProgress.svelte b/src/lib/components/layout/NavigationProgress.svelte
new file mode 100644
index 00000000..bbee383d
--- /dev/null
+++ b/src/lib/components/layout/NavigationProgress.svelte
@@ -0,0 +1,40 @@
+<script lang="ts">
+  import { navigating } from '$app/state';
+  import { getNavSections } from '$lib/components/layout/sidebar/nav-items.js';
+  import * as m from '$lib/paraglide/messages.js';
+
+  // Show navigation progress bar when navigating between different app roots.
+  // Otherwise, add exceptions to this if you want navigation progress inside a specific app.
+  const appRoots = $derived(
+    getNavSections({ storageBrowserEnabled: true }).flatMap((section) =>
+      section.items.map((item) => item.href)
+    )
+  );
+
+  function appRootOf(pathname: string | null): string | null {
+    if (!pathname) return null;
+    const sub = appRoots.find((root) => root !== '/' && pathname.startsWith(root));
+    if (sub) return sub;
+    return pathname === '/' ? '/' : null;
+  }
+
+  const fromRoot = $derived(appRootOf(navigating.from?.url.pathname ?? null));
+  const toRoot = $derived(appRootOf(navigating.to?.url.pathname ?? null));
+
+  const active = $derived(fromRoot !== null && toRoot !== null && fromRoot !== toRoot);
+</script>
+
+{#if active}
+  <div
+    class="bg-primary/25 pointer-events-none fixed inset-x-0 top-0 z-100 h-[3px] overflow-hidden"
+    role="status"
+    aria-live="polite"
+    data-navigation-progress
+  >
+    <div
+      class="bg-primary h-full w-[40%] animate-[nav-progress-slide_1.1s_ease-in-out_infinite] rounded-full motion-reduce:w-full motion-reduce:animate-none"
+      aria-hidden="true"
+    ></div>
+    <span class="sr-only">{m.navigation_loading()}</span>
+  </div>
+{/if}
diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index 15e8877e..bcd9721a 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -103,6 +103,7 @@
             <!-- eslint-disable @typescript-eslint/no-explicit-any, svelte/no-navigation-without-resolve -->
             <a
               href={resolveRoute(item.href as any)}
+              data-sveltekit-preload-data="hover"
               onclick={(e) => handleNavClick(e, item)}
               onkeydown={(e) => handleNavKeydown(e, item)}
               title={collapsed ? item.label : undefined}
diff --git a/src/routes/+layout.svelte b/src/routes/+layout.svelte
index 3b77780c..c6c0411b 100644
--- a/src/routes/+layout.svelte
+++ b/src/routes/+layout.svelte
@@ -2,6 +2,7 @@
   import '../app.css';
   import { onMount } from 'svelte';
   import { theme } from '$lib/theme.svelte';
+  import NavigationProgress from '$lib/components/layout/NavigationProgress.svelte';
 
   let { children } = $props();
 
@@ -19,4 +20,6 @@
   });
 </script>
 
+<NavigationProgress />
+
 {@render children()}

From 4ac24e7872a8e36f72345208fd63708e5fbbac4e Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 13 Aug 2026 10:29:56 +0200
Subject: [PATCH 126/136] #224 add tooltips to many locations (#286)

* #224 add tooltips to many locations

* convert toast to portal

* fix merge conflict
---
 messages/de.json                              |   3 +
 messages/en.json                              |   3 +
 src/lib/components/Pagination.svelte          | 140 ++++++++-------
 src/lib/components/TabBar.svelte              |  79 +++++----
 src/lib/components/ToastHost.svelte           |  42 ++++-
 src/lib/components/Tooltip.svelte             |  21 ++-
 src/lib/components/TooltipTrigger.svelte      | 118 +++++++++++++
 .../components/TooltipTrigger.svelte.spec.ts  |  74 ++++++++
 .../TooltipTriggerDialogWrapper.svelte        |  18 ++
 .../__tests__/TooltipTriggerWrapper.svelte    |  13 ++
 .../components/catalog/CatalogBrowser.svelte  |  41 ++---
 .../layout/header/LanguageSwitcher.svelte     |  35 ++--
 .../layout/header/ThemeToggle.svelte          |  25 +--
 .../components/layout/sidebar/Sidebar.svelte  |  85 ++++-----
 .../storage/explorer/ContextMenu.svelte       |  20 ++-
 .../storage/explorer/FileRow.svelte           |  18 +-
 .../storage/explorer/FolderRow.svelte         |  18 +-
 .../storage/explorer/OperationsButton.svelte  |  70 ++++----
 .../storage/explorer/StorageBreadcrumb.svelte |  83 +++++----
 .../components/storage/explorer/TabBar.svelte |  53 +++---
 .../storage/landing/BucketGrid.svelte         |  41 ++---
 .../modals/DeleteConnectionModal.svelte       |  32 ++--
 .../storage/modals/DetailsModal.svelte        |  42 +++--
 .../storage/modals/PreviewModal.svelte        |  44 +++--
 .../storage/modals/upload/UploadModal.svelte  |  16 +-
 .../storage/sidebar/BucketList.svelte         | 165 ++++++++----------
 .../sidebar/StorageConnectionSidebar.svelte   | 111 +++++-------
 src/routes/(app)/storage/+page.svelte         |  16 +-
 .../(app)/storage/connections/+page.svelte    |  19 +-
 src/routes/(app)/trino/+page.svelte           |   3 +-
 30 files changed, 871 insertions(+), 577 deletions(-)
 create mode 100644 src/lib/components/TooltipTrigger.svelte
 create mode 100644 src/lib/components/TooltipTrigger.svelte.spec.ts
 create mode 100644 src/lib/components/__tests__/TooltipTriggerDialogWrapper.svelte
 create mode 100644 src/lib/components/__tests__/TooltipTriggerWrapper.svelte

diff --git a/messages/de.json b/messages/de.json
index 1c24ab32..26b678a7 100644
--- a/messages/de.json
+++ b/messages/de.json
@@ -1,5 +1,7 @@
 {
   "$schema": "https://inlang.com/schema/inlang-message-format",
+  "action_close": "Schließen",
+  "action_dismiss": "Schließen",
   "dashboard_welcome": "Willkommen zurück",
   "dashboard_subtitle": "Stackable Unified Data Platform – Übersicht",
   "dashboard_services": "Dienste",
@@ -252,6 +254,7 @@
   "storage_paste_plural": "{count} Elemente einfügen",
   "storage_selected": "{count} ausgewählt",
   "storage_action_preview": "Vorschau",
+  "storage_action_actions_for": "Aktionen für {name}",
   "storage_action_refresh": "Aktualisieren",
   "storage_action_preview_no_selection": "Keine Datei für die Vorschau ausgewählt.",
   "storage_action_download_no_selection": "Keine Datei für den Download ausgewählt.",
diff --git a/messages/en.json b/messages/en.json
index 98769950..9f0592c9 100644
--- a/messages/en.json
+++ b/messages/en.json
@@ -1,5 +1,7 @@
 {
   "$schema": "https://inlang.com/schema/inlang-message-format",
+  "action_close": "Close",
+  "action_dismiss": "Dismiss",
   "dashboard_welcome": "Welcome back",
   "dashboard_subtitle": "Stackable Unified Data Platform overview",
   "dashboard_services": "Services",
@@ -252,6 +254,7 @@
   "storage_paste_plural": "Paste {count} items",
   "storage_selected": "{count} selected",
   "storage_action_preview": "Preview",
+  "storage_action_actions_for": "Actions for {name}",
   "storage_action_refresh": "Refresh",
   "storage_action_preview_no_selection": "No file selected for preview.",
   "storage_action_download_no_selection": "No file selected for download.",
diff --git a/src/lib/components/Pagination.svelte b/src/lib/components/Pagination.svelte
index 6aad8534..280d36c1 100644
--- a/src/lib/components/Pagination.svelte
+++ b/src/lib/components/Pagination.svelte
@@ -106,43 +106,47 @@
     <div class="flex items-center gap-3">
       {#if showNavButtons}
         <nav class="flex items-center" aria-label={m.pagination_nav()}>
-          <button
-            class="btn btn-ghost btn-xs"
-            onclick={onfirst}
-            disabled={!canGoFirst}
-            aria-label={m.pagination_first_page()}
-            title={m.pagination_first_page()}
-          >
-            <IconFirstPage class="size-4 {canGoFirst ? '' : 'opacity-40'}" aria-hidden="true" />
-          </button>
-          <button
-            class="btn btn-ghost btn-xs"
-            onclick={onprev}
-            disabled={!canGoPrev}
-            aria-label={m.pagination_prev_page()}
-            title={m.pagination_prev_page()}
-          >
-            <IconChevronLeft class="size-4 {canGoPrev ? '' : 'opacity-40'}" aria-hidden="true" />
-          </button>
-          <button
-            class="btn btn-ghost btn-xs"
-            onclick={onnext}
-            disabled={!canGoNext}
-            aria-label={m.pagination_next_page()}
-            title={m.pagination_next_page()}
-          >
-            <IconChevronRight class="size-4 {canGoNext ? '' : 'opacity-40'}" aria-hidden="true" />
-          </button>
-          {#if showLast}
+          <div class="tooltip tooltip-top" data-tip={m.pagination_first_page()}>
+            <button
+              class="btn btn-ghost btn-xs"
+              onclick={onfirst}
+              disabled={!canGoFirst}
+              aria-label={m.pagination_first_page()}
+            >
+              <IconFirstPage class="size-4 {canGoFirst ? '' : 'opacity-40'}" aria-hidden="true" />
+            </button>
+          </div>
+          <div class="tooltip tooltip-top" data-tip={m.pagination_prev_page()}>
+            <button
+              class="btn btn-ghost btn-xs"
+              onclick={onprev}
+              disabled={!canGoPrev}
+              aria-label={m.pagination_prev_page()}
+            >
+              <IconChevronLeft class="size-4 {canGoPrev ? '' : 'opacity-40'}" aria-hidden="true" />
+            </button>
+          </div>
+          <div class="tooltip tooltip-top" data-tip={m.pagination_next_page()}>
             <button
               class="btn btn-ghost btn-xs"
-              onclick={onlast}
-              disabled={!canGoLast}
-              aria-label={m.pagination_last_page()}
-              title={m.pagination_last_page()}
+              onclick={onnext}
+              disabled={!canGoNext}
+              aria-label={m.pagination_next_page()}
             >
-              <IconLastPage class="size-4 {canGoLast ? '' : 'opacity-40'}" aria-hidden="true" />
+              <IconChevronRight class="size-4 {canGoNext ? '' : 'opacity-40'}" aria-hidden="true" />
             </button>
+          </div>
+          {#if showLast}
+            <div class="tooltip tooltip-top" data-tip={m.pagination_last_page()}>
+              <button
+                class="btn btn-ghost btn-xs"
+                onclick={onlast}
+                disabled={!canGoLast}
+                aria-label={m.pagination_last_page()}
+              >
+                <IconLastPage class="size-4 {canGoLast ? '' : 'opacity-40'}" aria-hidden="true" />
+              </button>
+            </div>
           {/if}
         </nav>
       {/if}
@@ -162,43 +166,47 @@
       <span class="text-base-content/60 mr-1 text-xs">{infoLabel}</span>
     {/if}
     <nav class="flex items-center gap-1" aria-label={m.pagination_nav()}>
-      <button
-        class="btn btn-ghost btn-sm"
-        onclick={onfirst}
-        disabled={!canGoFirst}
-        aria-label={m.pagination_first_page()}
-        title={m.pagination_first_page()}
-      >
-        <IconFirstPage class="size-4 {canGoFirst ? '' : 'opacity-40'}" aria-hidden="true" />
-      </button>
-      <button
-        class="btn btn-ghost btn-sm"
-        onclick={onprev}
-        disabled={!canGoPrev}
-        aria-label={m.pagination_prev_page()}
-        title={m.pagination_prev_page()}
-      >
-        <IconChevronLeft class="size-4 {canGoPrev ? '' : 'opacity-40'}" aria-hidden="true" />
-      </button>
-      <button
-        class="btn btn-ghost btn-sm"
-        onclick={onnext}
-        disabled={!canGoNext}
-        aria-label={m.pagination_next_page()}
-        title={m.pagination_next_page()}
-      >
-        <IconChevronRight class="size-4 {canGoNext ? '' : 'opacity-40'}" aria-hidden="true" />
-      </button>
-      {#if showLast}
+      <div class="tooltip tooltip-top" data-tip={m.pagination_first_page()}>
+        <button
+          class="btn btn-ghost btn-sm"
+          onclick={onfirst}
+          disabled={!canGoFirst}
+          aria-label={m.pagination_first_page()}
+        >
+          <IconFirstPage class="size-4 {canGoFirst ? '' : 'opacity-40'}" aria-hidden="true" />
+        </button>
+      </div>
+      <div class="tooltip tooltip-top" data-tip={m.pagination_prev_page()}>
         <button
           class="btn btn-ghost btn-sm"
-          onclick={onlast}
-          disabled={!canGoLast}
-          aria-label={m.pagination_last_page()}
-          title={m.pagination_last_page()}
+          onclick={onprev}
+          disabled={!canGoPrev}
+          aria-label={m.pagination_prev_page()}
         >
-          <IconLastPage class="size-4 {canGoLast ? '' : 'opacity-40'}" aria-hidden="true" />
+          <IconChevronLeft class="size-4 {canGoPrev ? '' : 'opacity-40'}" aria-hidden="true" />
         </button>
+      </div>
+      <div class="tooltip tooltip-top" data-tip={m.pagination_next_page()}>
+        <button
+          class="btn btn-ghost btn-sm"
+          onclick={onnext}
+          disabled={!canGoNext}
+          aria-label={m.pagination_next_page()}
+        >
+          <IconChevronRight class="size-4 {canGoNext ? '' : 'opacity-40'}" aria-hidden="true" />
+        </button>
+      </div>
+      {#if showLast}
+        <div class="tooltip tooltip-top" data-tip={m.pagination_last_page()}>
+          <button
+            class="btn btn-ghost btn-sm"
+            onclick={onlast}
+            disabled={!canGoLast}
+            aria-label={m.pagination_last_page()}
+          >
+            <IconLastPage class="size-4 {canGoLast ? '' : 'opacity-40'}" aria-hidden="true" />
+          </button>
+        </div>
       {/if}
     </nav>
   </div>
diff --git a/src/lib/components/TabBar.svelte b/src/lib/components/TabBar.svelte
index 53586b2c..01187a23 100644
--- a/src/lib/components/TabBar.svelte
+++ b/src/lib/components/TabBar.svelte
@@ -1,5 +1,6 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
 
   interface TabItem {
     id: string;
@@ -168,49 +169,53 @@
       </button>
 
       {#if showClose && item.closable !== false}
-        <button
-          type="button"
-          class="btn btn-ghost btn-xs mr-1 h-5 min-h-0 w-5 p-0 opacity-0 group-hover:opacity-100 focus-visible:opacity-100
-            {isActive ? 'opacity-60' : ''}"
-          tabindex={isActive ? 0 : -1}
-          aria-label={m.trino_tab_close({ name: item.label })}
-          onclick={() => onClose?.(item.id)}
-        >
-          <svg
-            class="h-3 w-3"
-            aria-hidden="true"
-            viewBox="0 0 24 24"
-            fill="none"
-            stroke="currentColor"
-            stroke-width="2"
-            stroke-linecap="round"
-            stroke-linejoin="round"><path d="M18 6 6 18" /><path d="m6 6 12 12" /></svg
+        <TooltipTrigger text={m.trino_tab_close({ name: item.label })} orientation="down">
+          <button
+            type="button"
+            class="btn btn-ghost btn-xs mr-1 h-5 min-h-0 w-5 p-0 opacity-0 group-hover:opacity-100 focus-visible:opacity-100
+              {isActive ? 'opacity-60' : ''}"
+            tabindex={isActive ? 0 : -1}
+            aria-label={m.trino_tab_close({ name: item.label })}
+            onclick={() => onClose?.(item.id)}
           >
-        </button>
+            <svg
+              class="h-3 w-3"
+              aria-hidden="true"
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              stroke-width="2"
+              stroke-linecap="round"
+              stroke-linejoin="round"><path d="M18 6 6 18" /><path d="m6 6 12 12" /></svg
+            >
+          </button>
+        </TooltipTrigger>
       {/if}
     </div>
   {/each}
 
   {#if onAdd && showAdd}
-    <button
-      type="button"
-      class="btn btn-ghost btn-xs mb-0.5 h-7 min-h-0 px-2"
-      aria-label={m.trino_tab_new()}
-      onclick={() => {
-        onAdd!();
-        requestAnimationFrame(() => focusTab(activeId));
-      }}
-    >
-      <svg
-        class="h-4 w-4"
-        aria-hidden="true"
-        viewBox="0 0 24 24"
-        fill="none"
-        stroke="currentColor"
-        stroke-width="2"
-        stroke-linecap="round"
-        stroke-linejoin="round"><path d="M12 5v14" /><path d="M5 12h14" /></svg
+    <TooltipTrigger text={m.trino_tab_new()} orientation="down">
+      <button
+        type="button"
+        class="btn btn-ghost btn-xs mb-0.5 h-7 min-h-0 px-2"
+        aria-label={m.trino_tab_new()}
+        onclick={() => {
+          onAdd!();
+          requestAnimationFrame(() => focusTab(activeId));
+        }}
       >
-    </button>
+        <svg
+          class="h-4 w-4"
+          aria-hidden="true"
+          viewBox="0 0 24 24"
+          fill="none"
+          stroke="currentColor"
+          stroke-width="2"
+          stroke-linecap="round"
+          stroke-linejoin="round"><path d="M12 5v14" /><path d="M5 12h14" /></svg
+        >
+      </button>
+    </TooltipTrigger>
   {/if}
 </div>
diff --git a/src/lib/components/ToastHost.svelte b/src/lib/components/ToastHost.svelte
index 6f0cced4..de9b2ceb 100644
--- a/src/lib/components/ToastHost.svelte
+++ b/src/lib/components/ToastHost.svelte
@@ -6,6 +6,7 @@
   import IconError from 'virtual:icons/material-symbols/error';
   import IconClose from 'virtual:icons/material-symbols/close';
   import { toasts, removeToast, type ToastType } from '$lib/stores/toast.svelte.js';
+  import * as m from '$lib/paraglide/messages.js';
 
   const iconMap: Record<ToastType, Component> = {
     info: IconInfo,
@@ -20,10 +21,45 @@
     warning: 'alert-warning',
     error: 'alert-error'
   };
+
+  // Native dialogs render in the browser's top layer, above any element
+  // attached to <body>. Keep toasts in the active dialog so their controls
+  // remain clickable while an editor modal is open.
+  function portalToActiveDialog(node: HTMLElement) {
+    if (typeof document === 'undefined') return {};
+
+    let target: HTMLElement | null = null;
+    const move = () => {
+      const dialogs = document.querySelectorAll<HTMLDialogElement>('dialog[open]');
+      const nextTarget = dialogs[dialogs.length - 1] ?? document.body;
+      if (nextTarget === target) return;
+      nextTarget.appendChild(node);
+      target = nextTarget;
+    };
+
+    move();
+    const observer = new MutationObserver(move);
+    observer.observe(document.body, {
+      childList: true,
+      subtree: true,
+      attributes: true,
+      attributeFilter: ['open']
+    });
+
+    return {
+      destroy() {
+        observer.disconnect();
+      }
+    };
+  }
 </script>
 
-<!-- Positioned fixed at the bottom-end corner, above everything -->
-<div class="toast toast-end toast-bottom z-100 gap-2" aria-live="polite" aria-atomic="false">
+<div
+  use:portalToActiveDialog
+  class="toast toast-end toast-bottom z-[10001] gap-2"
+  aria-live="polite"
+  aria-atomic="false"
+>
   {#each toasts as toast (toast.id)}
     {@const ToastIcon = iconMap[toast.type]}
     <div
@@ -35,7 +71,7 @@
         <span class="flex-1 text-sm">{toast.message}</span>
         <button
           class="btn btn-ghost btn-xs ml-1 shrink-0"
-          aria-label="Dismiss"
+          aria-label={m.action_dismiss()}
           onclick={() => removeToast(toast.id)}
         >
           <IconClose class="h-4 w-4" aria-hidden="true" />
diff --git a/src/lib/components/Tooltip.svelte b/src/lib/components/Tooltip.svelte
index 815826ac..e61d773e 100644
--- a/src/lib/components/Tooltip.svelte
+++ b/src/lib/components/Tooltip.svelte
@@ -9,14 +9,19 @@
   }
   let { text, x, y, orientation = 'right' }: Props = $props();
 
+  // The critical behaviour (fixed positioning, no pointer interception, high
+  // z-index) is applied inline so the tooltip behaves identically even when
+  // utility classes are unavailable (e.g. in component tests that render
+  // without the global stylesheet).
   const contentStyle = $derived(
-    orientation === 'right'
-      ? `left:${x + GAP}px;top:${y}px;transform:translateY(-50%)`
-      : orientation === 'left'
-        ? `left:${x - GAP}px;top:${y}px;transform:translate(-100%,-50%)`
-        : orientation === 'up'
-          ? `left:${x}px;top:${y - GAP}px;transform:translate(-50%,-100%)`
-          : `left:${x}px;top:${y + GAP}px;transform:translate(-50%,0)`
+    `position:fixed;pointer-events:none;z-index:150;` +
+      (orientation === 'right'
+        ? `left:${x + GAP}px;top:${y}px;transform:translateY(-50%)`
+        : orientation === 'left'
+          ? `left:${x - GAP}px;top:${y}px;transform:translate(-100%,-50%)`
+          : orientation === 'up'
+            ? `left:${x}px;top:${y - GAP}px;transform:translate(-50%,-100%)`
+            : `left:${x}px;top:${y + GAP}px;transform:translate(-50%,0)`)
   );
 
   const arrowClasses = $derived(
@@ -31,7 +36,7 @@
 </script>
 
 {#if text}
-  <div class="pointer-events-none fixed z-150" role="tooltip" style={contentStyle}>
+  <div role="tooltip" style={contentStyle}>
     <div
       class="bg-neutral text-neutral-content relative rounded-md px-2 py-1 text-sm whitespace-nowrap shadow-lg"
     >
diff --git a/src/lib/components/TooltipTrigger.svelte b/src/lib/components/TooltipTrigger.svelte
new file mode 100644
index 00000000..d1bf1a51
--- /dev/null
+++ b/src/lib/components/TooltipTrigger.svelte
@@ -0,0 +1,118 @@
+<script lang="ts">
+  import { mount, unmount, untrack } from 'svelte';
+  import type { Snippet } from 'svelte';
+  import Tooltip from './Tooltip.svelte';
+
+  export type TooltipOrientation = 'right' | 'left' | 'up' | 'down';
+
+  interface Props {
+    text: string | null;
+    children: Snippet;
+    orientation?: TooltipOrientation;
+  }
+  let { text, children, orientation = 'right' }: Props = $props();
+
+  // The wrapper uses `display: contents` so it never interferes with the
+  // layout of the trigger (flex items, table cells, etc.). It only exists to
+  // observe hover/focus on the trigger and to position the popup.
+  let trigger = $state<HTMLElement | null>(null);
+  let visible = $state(false);
+  let x = $state(0);
+  let y = $state(0);
+
+  function show() {
+    if (!trigger) return;
+    const el = (trigger.firstElementChild ?? trigger) as HTMLElement | null;
+    if (!el) return;
+    const rect = el.getBoundingClientRect();
+    if (orientation === 'right') {
+      x = rect.right;
+      y = rect.top + rect.height / 2;
+    } else if (orientation === 'left') {
+      x = rect.left;
+      y = rect.top + rect.height / 2;
+    } else if (orientation === 'up') {
+      x = rect.left + rect.width / 2;
+      y = rect.top;
+    } else {
+      x = rect.left + rect.width / 2;
+      y = rect.bottom;
+    }
+    portalTarget = findPortalTarget();
+    visible = true;
+  }
+
+  function hide() {
+    visible = false;
+  }
+
+  // ── Portal ──────────────────────────────────────────────────────────────
+  // The popup is rendered into a portal instead of inline because a popup
+  // rendered inside the trigger's subtree can be trapped by its ancestors:
+  //  - a `transform`/`translate`/`scale`/`filter` ancestor (e.g. daisyUI's
+  //    `.modal-box`) becomes the containing block for `position: fixed`
+  //    descendants, which offsets the popup and clips it inside the parent;
+  //  - a low z-index ancestor (e.g. the sidebar, which sits below the main
+  //    content) lets sibling content cover the popup no matter how high the
+  //    popup's own z-index is.
+  // When the trigger lives inside a <dialog> (rendered in the browser's top
+  // layer), the portal is attached to that dialog so the popup stays above
+  // the modal content; otherwise it is attached to <body> with a z-index
+  // above all app content.
+  type TooltipState = {
+    text: string | null;
+    x: number;
+    y: number;
+    orientation: TooltipOrientation;
+  };
+  let portalTarget: HTMLElement | undefined;
+  let portalHost: HTMLDivElement | undefined;
+  let tooltipState: TooltipState | undefined;
+
+  function findPortalTarget(): HTMLElement {
+    let el: HTMLElement | null = trigger;
+    while (el && el.tagName !== 'DIALOG') {
+      el = el.parentElement;
+    }
+    return (el ?? document.body) as HTMLElement;
+  }
+
+  $effect(() => {
+    if (!visible) return;
+    portalHost = document.createElement('div');
+    portalHost.style.cssText = 'position:fixed;inset:0;pointer-events:none;z-index:10000;';
+    portalTarget?.appendChild(portalHost);
+    const state = mount(Tooltip, {
+      target: portalHost,
+      props: untrack(() => ({ text, x, y, orientation }))
+    }) as TooltipState;
+    tooltipState = state;
+
+    return () => {
+      unmount(state);
+      portalHost?.remove();
+      portalHost = undefined;
+      tooltipState = undefined;
+    };
+  });
+
+  $effect(() => {
+    if (!visible || !tooltipState) return;
+    tooltipState.text = text;
+    tooltipState.x = x;
+    tooltipState.y = y;
+    tooltipState.orientation = orientation;
+  });
+</script>
+
+<span
+  class="contents"
+  role="presentation"
+  bind:this={trigger}
+  onmouseenter={show}
+  onmouseleave={hide}
+  onfocusin={show}
+  onfocusout={hide}
+>
+  {@render children()}
+</span>
diff --git a/src/lib/components/TooltipTrigger.svelte.spec.ts b/src/lib/components/TooltipTrigger.svelte.spec.ts
new file mode 100644
index 00000000..62025d03
--- /dev/null
+++ b/src/lib/components/TooltipTrigger.svelte.spec.ts
@@ -0,0 +1,74 @@
+import { page, userEvent } from 'vitest/browser';
+import { describe, expect, it } from 'vitest';
+import { render } from 'vitest-browser-svelte';
+import TooltipTriggerWrapper from './__tests__/TooltipTriggerWrapper.svelte';
+import TooltipTriggerDialogWrapper from './__tests__/TooltipTriggerDialogWrapper.svelte';
+
+describe('TooltipTrigger', () => {
+  it('renders the trigger content without a tooltip', async () => {
+    render(TooltipTriggerWrapper, { text: 'Delete' });
+    await expect.element(page.getByRole('button', { name: 'Trigger' })).toBeInTheDocument();
+    expect(page.getByRole('tooltip').query()).toBeNull();
+  });
+
+  it('shows the tooltip when the trigger is hovered', async () => {
+    render(TooltipTriggerWrapper, { text: 'Delete' });
+    await page.getByRole('button', { name: 'Trigger' }).hover();
+    const tooltip = page.getByRole('tooltip');
+    await expect.element(tooltip).toBeInTheDocument();
+    await expect.element(tooltip).toHaveTextContent('Delete');
+  });
+
+  it('hides the tooltip when the pointer leaves the trigger', async () => {
+    render(TooltipTriggerWrapper, { text: 'Delete' });
+    await page.getByRole('button', { name: 'Trigger' }).hover();
+    await expect.element(page.getByRole('tooltip')).toBeInTheDocument();
+    await userEvent.unhover(await page.getByRole('button', { name: 'Trigger' }).element());
+    await expect.element(page.getByRole('tooltip')).not.toBeInTheDocument();
+  });
+
+  it('shows the tooltip when the trigger receives focus', async () => {
+    render(TooltipTriggerWrapper, { text: 'Delete' });
+    const button = page.getByRole('button', { name: 'Trigger' });
+    (await button.element()).focus();
+    await expect.element(page.getByRole('tooltip')).toBeInTheDocument();
+  });
+
+  it('hides the tooltip when the trigger loses focus', async () => {
+    render(TooltipTriggerWrapper, { text: 'Delete' });
+    const button = page.getByRole('button', { name: 'Trigger' });
+    (await button.element()).focus();
+    await expect.element(page.getByRole('tooltip')).toBeInTheDocument();
+    (await button.element()).blur();
+    await expect.element(page.getByRole('tooltip')).not.toBeInTheDocument();
+  });
+
+  it('does not show a tooltip when text is null', async () => {
+    render(TooltipTriggerWrapper, { text: null });
+    await page.getByRole('button', { name: 'Trigger' }).hover();
+    expect(page.getByRole('tooltip').query()).toBeNull();
+  });
+
+  it('renders the tooltip in a portal attached to <body>, not inline in the trigger', async () => {
+    render(TooltipTriggerWrapper, { text: 'Delete' });
+    await page.getByRole('button', { name: 'Trigger' }).hover();
+    const tooltipEl = (await page.getByRole('tooltip').element()) as HTMLElement;
+    const triggerEl = (await page
+      .getByRole('button', { name: 'Trigger' })
+      .element()) as HTMLElement;
+    // The popup is portaled: it must not be a descendant of the trigger wrapper.
+    expect(triggerEl.contains(tooltipEl)).toBe(false);
+    // It is mounted into a host div that is a direct child of <body>.
+    expect(tooltipEl.parentElement?.parentElement).toBe(document.body);
+  });
+
+  it('portals the tooltip into a <dialog> ancestor so it escapes the modal', async () => {
+    render(TooltipTriggerDialogWrapper, { text: 'Delete' });
+    const dialogEl = document.querySelector('dialog');
+    expect(dialogEl).not.toBeNull();
+    await page.getByRole('button', { name: 'Trigger' }).hover();
+    const tooltipEl = (await page.getByRole('tooltip').element()) as HTMLElement;
+    // The popup must be inside the dialog (top layer), not attached to <body>.
+    expect(dialogEl!.contains(tooltipEl)).toBe(true);
+  });
+});
diff --git a/src/lib/components/__tests__/TooltipTriggerDialogWrapper.svelte b/src/lib/components/__tests__/TooltipTriggerDialogWrapper.svelte
new file mode 100644
index 00000000..3086e3e4
--- /dev/null
+++ b/src/lib/components/__tests__/TooltipTriggerDialogWrapper.svelte
@@ -0,0 +1,18 @@
+<script lang="ts">
+  import Modal from '../Modal.svelte';
+  import TooltipTrigger from '../TooltipTrigger.svelte';
+
+  interface Props {
+    text: string | null;
+    orientation?: 'right' | 'left' | 'up' | 'down';
+  }
+  let { text, orientation = 'down' }: Props = $props();
+
+  let open = $state(true);
+</script>
+
+<Modal bind:open>
+  <TooltipTrigger {text} {orientation}>
+    <button type="button">Trigger</button>
+  </TooltipTrigger>
+</Modal>
diff --git a/src/lib/components/__tests__/TooltipTriggerWrapper.svelte b/src/lib/components/__tests__/TooltipTriggerWrapper.svelte
new file mode 100644
index 00000000..83ad42c6
--- /dev/null
+++ b/src/lib/components/__tests__/TooltipTriggerWrapper.svelte
@@ -0,0 +1,13 @@
+<script lang="ts">
+  import TooltipTrigger from '../TooltipTrigger.svelte';
+
+  interface Props {
+    text: string | null;
+    orientation?: 'right' | 'left' | 'up' | 'down';
+  }
+  let { text, orientation = 'down' }: Props = $props();
+</script>
+
+<TooltipTrigger {text} {orientation}>
+  <button type="button">Trigger</button>
+</TooltipTrigger>
diff --git a/src/lib/components/catalog/CatalogBrowser.svelte b/src/lib/components/catalog/CatalogBrowser.svelte
index f73931d8..fd86d18a 100644
--- a/src/lib/components/catalog/CatalogBrowser.svelte
+++ b/src/lib/components/catalog/CatalogBrowser.svelte
@@ -254,27 +254,28 @@
   <!-- Tree view -->
   <div class="border-base-300 flex items-center justify-between border-b px-3 py-1">
     <span class="text-base-content/60 text-xs font-medium">{m.trino_catalog_browser()}</span>
-    <button
-      class="btn btn-ghost btn-xs"
-      aria-label={m.trino_catalog_refresh()}
-      title={m.trino_catalog_refresh()}
-      onclick={handleRefresh}
-      disabled={catalogsLoading}
-    >
-      <svg
-        class="h-3.5 w-3.5"
-        aria-hidden="true"
-        viewBox="0 0 24 24"
-        fill="none"
-        stroke="currentColor"
-        stroke-width="2"
-        stroke-linecap="round"
-        stroke-linejoin="round"
+    <div class="tooltip tooltip-bottom" data-tip={m.trino_catalog_refresh()}>
+      <button
+        class="btn btn-ghost btn-xs"
+        aria-label={m.trino_catalog_refresh()}
+        onclick={handleRefresh}
+        disabled={catalogsLoading}
       >
-        <path d="M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8" />
-        <path d="M21 3v5h-5" />
-      </svg>
-    </button>
+        <svg
+          class="h-3.5 w-3.5"
+          aria-hidden="true"
+          viewBox="0 0 24 24"
+          fill="none"
+          stroke="currentColor"
+          stroke-width="2"
+          stroke-linecap="round"
+          stroke-linejoin="round"
+        >
+          <path d="M21 12a9 9 0 1 1-9-9c2.52 0 4.93 1 6.74 2.74L21 8" />
+          <path d="M21 3v5h-5" />
+        </svg>
+      </button>
+    </div>
   </div>
   <div class="min-h-0 flex-1 overflow-auto p-2">
     {#if catalogsLoading}
diff --git a/src/lib/components/layout/header/LanguageSwitcher.svelte b/src/lib/components/layout/header/LanguageSwitcher.svelte
index 445e0044..4288d1f1 100644
--- a/src/lib/components/layout/header/LanguageSwitcher.svelte
+++ b/src/lib/components/layout/header/LanguageSwitcher.svelte
@@ -26,22 +26,27 @@
   }
 </script>
 
-<button
-  class={`
-    btn btn-ghost btn-sm
-    ${showLabel ? 'gap-2' : 'btn-square'}
-  `}
-  popovertarget="lang-switcher"
-  style="anchor-name:--lang-switcher"
-  aria-label={showLabel
-    ? `${m.language_label()}: ${currentLocaleMeta.label()}`
-    : m.language_label()}
+<div
+  class={showLabel ? '' : 'tooltip tooltip-bottom z-150 before:z-200'}
+  data-tip={showLabel ? undefined : m.language_label()}
 >
-  <IconLanguage class="h-5 w-5" aria-hidden="true" />
-  {#if showLabel}
-    <span class="text-sm font-medium">{currentLocaleMeta.label()}</span>
-  {/if}
-</button>
+  <button
+    class={`
+      btn btn-ghost btn-sm
+      ${showLabel ? 'gap-2' : 'btn-square'}
+    `}
+    popovertarget="lang-switcher"
+    style="anchor-name:--lang-switcher"
+    aria-label={showLabel
+      ? `${m.language_label()}: ${currentLocaleMeta.label()}`
+      : m.language_label()}
+  >
+    <IconLanguage class="h-5 w-5" aria-hidden="true" />
+    {#if showLabel}
+      <span class="text-sm font-medium">{currentLocaleMeta.label()}</span>
+    {/if}
+  </button>
+</div>
 <ul
   class="
     menu dropdown dropdown-end border-base-300 bg-base-100 w-40 rounded-lg
diff --git a/src/lib/components/layout/header/ThemeToggle.svelte b/src/lib/components/layout/header/ThemeToggle.svelte
index 9286d392..15231f0f 100644
--- a/src/lib/components/layout/header/ThemeToggle.svelte
+++ b/src/lib/components/layout/header/ThemeToggle.svelte
@@ -21,14 +21,19 @@
   });
 </script>
 
-<button
-  onclick={() => (dark = !dark)}
-  class="btn btn-ghost btn-sm btn-square"
-  aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
+<div
+  class="tooltip tooltip-bottom z-150 before:z-200"
+  data-tip={dark ? m.theme_switch_light() : m.theme_switch_dark()}
 >
-  {#if dark}
-    <IconLightMode class="h-5 w-5" aria-hidden="true" />
-  {:else}
-    <IconDarkMode class="h-5 w-5" aria-hidden="true" />
-  {/if}
-</button>
+  <button
+    onclick={() => (dark = !dark)}
+    class="btn btn-ghost btn-sm btn-square"
+    aria-label={dark ? m.theme_switch_light() : m.theme_switch_dark()}
+  >
+    {#if dark}
+      <IconLightMode class="h-5 w-5" aria-hidden="true" />
+    {:else}
+      <IconDarkMode class="h-5 w-5" aria-hidden="true" />
+    {/if}
+  </button>
+</div>
diff --git a/src/lib/components/layout/sidebar/Sidebar.svelte b/src/lib/components/layout/sidebar/Sidebar.svelte
index bcd9721a..1027186e 100644
--- a/src/lib/components/layout/sidebar/Sidebar.svelte
+++ b/src/lib/components/layout/sidebar/Sidebar.svelte
@@ -7,6 +7,7 @@
   import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
   import type { NavItem } from '$lib/types/navigation.js';
   import { getNavSections } from './nav-items.js';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
 
   let {
     collapsed = $bindable(false),
@@ -101,33 +102,35 @@
           {@const active = isActive(item.href)}
           <li>
             <!-- eslint-disable @typescript-eslint/no-explicit-any, svelte/no-navigation-without-resolve -->
-            <a
-              href={resolveRoute(item.href as any)}
-              data-sveltekit-preload-data="hover"
-              onclick={(e) => handleNavClick(e, item)}
-              onkeydown={(e) => handleNavKeydown(e, item)}
-              title={collapsed ? item.label : undefined}
-              class="flex min-h-[44px] items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium transition-colors
-                {active
-                ? 'bg-primary/10 text-primary'
-                : 'text-base-content/70 hover:bg-base-content/5 hover:text-base-content'}
-                {item.disabled ? 'opacity-40' : ''}
-                {collapsed ? 'justify-center' : ''}"
-              aria-current={active ? 'page' : undefined}
-              aria-disabled={item.disabled ? 'true' : undefined}
-            >
-              {@render navIcon(item.icon)}
-              {#if !collapsed}
-                <span class="truncate">{item.label}</span>
-                {#if item.badge}
-                  <span
-                    class="bg-base-300 text-base-content/60 ml-auto rounded-md px-1.5 py-0.5 text-xs font-semibold tracking-wider uppercase"
-                  >
-                    {item.badge}
-                  </span>
+            <TooltipTrigger text={collapsed ? item.label : null} orientation="right">
+              <a
+                href={resolveRoute(item.href as any)}
+                data-sveltekit-preload-data="hover"
+                onclick={(e) => handleNavClick(e, item)}
+                onkeydown={(e) => handleNavKeydown(e, item)}
+                aria-label={collapsed ? item.label : undefined}
+                class="flex min-h-[44px] items-center gap-3 rounded-lg px-3 py-2 text-sm font-medium transition-colors
+                  {active
+                  ? 'bg-primary/10 text-primary'
+                  : 'text-base-content/70 hover:bg-base-content/5 hover:text-base-content'}
+                  {item.disabled ? 'opacity-40' : ''}
+                  {collapsed ? 'justify-center' : ''}"
+                aria-current={active ? 'page' : undefined}
+                aria-disabled={item.disabled ? 'true' : undefined}
+              >
+                {@render navIcon(item.icon)}
+                {#if !collapsed}
+                  <span class="truncate">{item.label}</span>
+                  {#if item.badge}
+                    <span
+                      class="bg-base-300 text-base-content/60 ml-auto rounded-md px-1.5 py-0.5 text-xs font-semibold tracking-wider uppercase"
+                    >
+                      {item.badge}
+                    </span>
+                  {/if}
                 {/if}
-              {/if}
-            </a>
+              </a>
+            </TooltipTrigger>
             <!-- eslint-enable @typescript-eslint/no-explicit-any, svelte/no-navigation-without-resolve -->
           </li>
         {/each}
@@ -137,19 +140,21 @@
 
   <!-- Footer: collapse toggle (desktop only) -->
   <div class="border-base-300 hidden shrink-0 border-t p-3 lg:block">
-    <button
-      onclick={() => (collapsed = !collapsed)}
-      class="text-base-content/60 hover:bg-base-content/5 hover:text-base-content flex w-full items-center gap-3 rounded-lg px-3 py-2
-        text-sm font-medium transition-colors hover:cursor-pointer
-        {collapsed ? 'justify-center' : ''}"
-      aria-label={collapsed ? m.sidebar_expand() : m.sidebar_collapse()}
-    >
-      {#if collapsed}
-        <IconChevronRight class="h-4 w-4 shrink-0" aria-hidden="true" />
-      {:else}
-        <IconChevronLeft class="h-4 w-4 shrink-0" aria-hidden="true" />
-        <span>{m.sidebar_collapse_label()}</span>
-      {/if}
-    </button>
+    <TooltipTrigger text={collapsed ? m.sidebar_expand() : null} orientation="right">
+      <button
+        onclick={() => (collapsed = !collapsed)}
+        class="text-base-content/60 hover:bg-base-content/5 hover:text-base-content flex w-full items-center gap-3 rounded-lg px-3 py-2
+          text-sm font-medium transition-colors hover:cursor-pointer
+          {collapsed ? 'justify-center' : ''}"
+        aria-label={collapsed ? m.sidebar_expand() : m.sidebar_collapse()}
+      >
+        {#if collapsed}
+          <IconChevronRight class="h-4 w-4 shrink-0" aria-hidden="true" />
+        {:else}
+          <IconChevronLeft class="h-4 w-4 shrink-0" aria-hidden="true" />
+          <span>{m.sidebar_collapse_label()}</span>
+        {/if}
+      </button>
+    </TooltipTrigger>
   </div>
 </aside>
diff --git a/src/lib/components/storage/explorer/ContextMenu.svelte b/src/lib/components/storage/explorer/ContextMenu.svelte
index a511f6a8..1552ee8a 100644
--- a/src/lib/components/storage/explorer/ContextMenu.svelte
+++ b/src/lib/components/storage/explorer/ContextMenu.svelte
@@ -258,15 +258,17 @@
       <li class="menu-title p-0" role="none">
         <div class="menu-title flex items-center justify-between py-1 pr-0 pl-2">
           <span class="text-base-content/70 text-xs font-medium">{title}</span>
-          <button
-            type="button"
-            role="menuitem"
-            class="btn btn-ghost btn-xs"
-            aria-label="Close"
-            onclick={close}
-          >
-            <IconClose class="size-4" aria-hidden="true" />
-          </button>
+          <div class="tooltip tooltip-left" data-tip={m.action_close()}>
+            <button
+              type="button"
+              role="menuitem"
+              class="btn btn-ghost btn-xs"
+              aria-label={m.action_close()}
+              onclick={close}
+            >
+              <IconClose class="size-4" aria-hidden="true" />
+            </button>
+          </div>
         </div>
       </li>
     {/if}
diff --git a/src/lib/components/storage/explorer/FileRow.svelte b/src/lib/components/storage/explorer/FileRow.svelte
index 2e2aedf2..ae2d022b 100644
--- a/src/lib/components/storage/explorer/FileRow.svelte
+++ b/src/lib/components/storage/explorer/FileRow.svelte
@@ -7,6 +7,7 @@
   import { getStorageState } from '$lib/storage/context.js';
   import { storageCutCopyEnabled } from '$lib/client/feature-flags.js';
   import { handleRowDragStart } from '$lib/storage/drag-handlers.js';
+  import * as m from '$lib/paraglide/messages.js';
 
   interface Props {
     file: StorageObject;
@@ -66,13 +67,14 @@
     ><TimestampDisplay date={file.lastModified} relative /></td
   >
   <td class="w-10 py-0 pr-2 text-right">
-    <button
-      class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
-      title="Actions"
-      aria-label="Actions for {keyToName(file.key)}"
-      onclick={(e) => storage.openContextMenu(e, file.key)}
-    >
-      <IconMoreHoriz class="size-4" aria-hidden="true" />
-    </button>
+    <div class="tooltip tooltip-left" data-tip={m.storage_context_menu_actions()}>
+      <button
+        class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
+        aria-label={m.storage_action_actions_for({ name: keyToName(file.key) })}
+        onclick={(e) => storage.openContextMenu(e, file.key)}
+      >
+        <IconMoreHoriz class="size-4" aria-hidden="true" />
+      </button>
+    </div>
   </td>
 </tr>
diff --git a/src/lib/components/storage/explorer/FolderRow.svelte b/src/lib/components/storage/explorer/FolderRow.svelte
index 9c60dc3b..83d00d8a 100644
--- a/src/lib/components/storage/explorer/FolderRow.svelte
+++ b/src/lib/components/storage/explorer/FolderRow.svelte
@@ -10,6 +10,7 @@
     parseStorageDropKeys,
     canStorageDrop
   } from '$lib/storage/drag-handlers.js';
+  import * as m from '$lib/paraglide/messages.js';
 
   interface Props {
     folder: StorageObject;
@@ -112,13 +113,14 @@
   <td class="text-base-content/30 text-right">—</td>
   <td class="text-base-content/30">—</td>
   <td class="w-10 py-0 pr-2 text-right">
-    <button
-      class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
-      title="Actions"
-      aria-label="Actions for {keyToName(folder.key)}"
-      onclick={(e) => storage.openContextMenu(e, folder.key)}
-    >
-      <IconMoreHoriz class="size-4" aria-hidden="true" />
-    </button>
+    <div class="tooltip tooltip-left" data-tip={m.storage_context_menu_actions()}>
+      <button
+        class="btn btn-ghost btn-xs opacity-0 group-hover:opacity-100"
+        aria-label={m.storage_action_actions_for({ name: keyToName(folder.key) })}
+        onclick={(e) => storage.openContextMenu(e, folder.key)}
+      >
+        <IconMoreHoriz class="size-4" aria-hidden="true" />
+      </button>
+    </div>
   </td>
 </tr>
diff --git a/src/lib/components/storage/explorer/OperationsButton.svelte b/src/lib/components/storage/explorer/OperationsButton.svelte
index 522eda89..4d30d248 100644
--- a/src/lib/components/storage/explorer/OperationsButton.svelte
+++ b/src/lib/components/storage/explorer/OperationsButton.svelte
@@ -222,33 +222,34 @@
   {/if}
   <div bind:this={dropdownEl} class="relative z-50 inline-flex">
     <!-- Trigger button -->
-    <button
-      class="
-        btn btn-ghost btn-xs relative size-7 rounded-full p-0
-        {storage.hasRunningOps ? 'text-primary' : hasError ? 'text-error' : 'text-success'}
-      "
-      title={m.storage_operations_label()}
-      aria-label={m.storage_operations_label()}
-      aria-expanded={dropdownOpen}
-      aria-haspopup="menu"
-      onclick={toggleDropdown}
-    >
-      {#if storage.hasRunningOps}
-        <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
-        {#if activeOps.length > 1}
-          <span
-            class="badge badge-primary badge-xs absolute -top-1 -right-1 min-w-4 px-0.5 text-[9px]"
-            aria-hidden="true"
-          >
-            {activeOps.length}
-          </span>
+    <div class="tooltip tooltip-top" data-tip={m.storage_operations_label()}>
+      <button
+        class="
+          btn btn-ghost btn-xs relative size-7 rounded-full p-0
+          {storage.hasRunningOps ? 'text-primary' : hasError ? 'text-error' : 'text-success'}
+        "
+        aria-label={m.storage_operations_label()}
+        aria-expanded={dropdownOpen}
+        aria-haspopup="menu"
+        onclick={toggleDropdown}
+      >
+        {#if storage.hasRunningOps}
+          <span class="loading loading-spinner loading-xs" aria-hidden="true"></span>
+          {#if activeOps.length > 1}
+            <span
+              class="badge badge-primary badge-xs absolute -top-1 -right-1 min-w-4 px-0.5 text-[9px]"
+              aria-hidden="true"
+            >
+              {activeOps.length}
+            </span>
+          {/if}
+        {:else if hasError}
+          <IconError class="size-4" aria-hidden="true" />
+        {:else}
+          <IconCheckCircle class="size-4" aria-hidden="true" />
         {/if}
-      {:else if hasError}
-        <IconError class="size-4" aria-hidden="true" />
-      {:else}
-        <IconCheckCircle class="size-4" aria-hidden="true" />
-      {/if}
-    </button>
+      </button>
+    </div>
 
     <!-- Dropdown panel -->
     {#if dropdownOpen}
@@ -309,14 +310,15 @@
                     </div>
 
                     <!-- Cancel -->
-                    <button
-                      class="btn btn-ghost btn-xs text-error/70 hover:text-error size-5 shrink-0 p-0"
-                      title={m.storage_operations_cancel()}
-                      aria-label={m.storage_operations_cancel()}
-                      onclick={() => storage.cancelOp(op.id)}
-                    >
-                      <IconClose class="size-3" aria-hidden="true" />
-                    </button>
+                    <div class="tooltip tooltip-left" data-tip={m.storage_operations_cancel()}>
+                      <button
+                        class="btn btn-ghost btn-xs text-error/70 hover:text-error size-5 shrink-0 p-0"
+                        aria-label={m.storage_operations_cancel()}
+                        onclick={() => storage.cancelOp(op.id)}
+                      >
+                        <IconClose class="size-3" aria-hidden="true" />
+                      </button>
+                    </div>
                   </div>
 
                   <!-- Expanded detail -->
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 883812f4..2258e345 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -25,6 +25,7 @@
   import { parseStorageDropKeys, canStorageDrop } from '$lib/storage/drag-handlers.js';
   import OperationsButton from './OperationsButton.svelte';
   import ContextMenu from './ContextMenu.svelte';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
   import type { ContextMenuAction } from '$lib/storage/types.js';
 
   const storage = getStorageState();
@@ -265,34 +266,38 @@
       motion-safe:transition-[width] motion-safe:duration-150 motion-safe:group-hover:delay-700
     "
   >
-    <button
-      class="
-          btn btn-ghost btn-xs group/pin z-60 size-5 p-0
-          {pinned ? 'hover:text-error' : 'hover:text-white'}
-        "
-      title={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
-      aria-label={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
-      onclick={() => {
-        if (pinned) {
-          storage.bookmarks.unpin(bucket, prefix);
-        } else {
-          storage.bookmarks.pin(bucket, prefix);
-        }
-      }}
+    <TooltipTrigger
+      text={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
+      orientation="down"
     >
-      <span class="relative inline-flex size-3.5">
-        <span
-          class="absolute inset-0 flex items-center justify-center transition-opacity duration-150 group-hover/pin:opacity-0"
-        >
-          <PinIcon class="size-3.5" aria-hidden="true" />
-        </span>
-        <span
-          class="absolute inset-0 flex items-center justify-center opacity-0 transition-opacity duration-150 group-hover/pin:opacity-100"
-        >
-          <UnpinIcon class="size-3.5" aria-hidden="true" />
+      <button
+        class="
+            btn btn-ghost btn-xs group/pin z-60 size-5 p-0
+            {pinned ? 'hover:text-error' : 'hover:text-white'}
+          "
+        aria-label={pinned ? m.storage_action_unpin() : m.storage_action_pin()}
+        onclick={() => {
+          if (pinned) {
+            storage.bookmarks.unpin(bucket, prefix);
+          } else {
+            storage.bookmarks.pin(bucket, prefix);
+          }
+        }}
+      >
+        <span class="relative inline-flex size-3.5">
+          <span
+            class="absolute inset-0 flex items-center justify-center transition-opacity duration-150 group-hover/pin:opacity-0"
+          >
+            <PinIcon class="size-3.5" aria-hidden="true" />
+          </span>
+          <span
+            class="absolute inset-0 flex items-center justify-center opacity-0 transition-opacity duration-150 group-hover/pin:opacity-100"
+          >
+            <UnpinIcon class="size-3.5" aria-hidden="true" />
+          </span>
         </span>
-      </span>
-    </button>
+      </button>
+    </TooltipTrigger>
   </span>
 {/snippet}
 
@@ -376,18 +381,20 @@
           collapsedDropdownOpen = false;
         }}
       >
-        <button
-          tabindex="0"
-          class="
-            hover:bg-base-200 hover:text-base-content flex items-center rounded-sm px-1.5
-            py-0.5 transition-colors hover:cursor-pointer
-            focus-visible:outline
-          "
-          aria-label={m.storage_breadcrumb_more()}
-          aria-haspopup="listbox"
-        >
-          <IconMoreHoriz class="size-4" aria-hidden="true" />
-        </button>
+        <div class="tooltip tooltip-bottom" data-tip={m.storage_breadcrumb_more()}>
+          <button
+            tabindex="0"
+            class="
+              hover:bg-base-200 hover:text-base-content flex items-center rounded-sm px-1.5
+              py-0.5 transition-colors hover:cursor-pointer
+              focus-visible:outline
+            "
+            aria-label={m.storage_breadcrumb_more()}
+            aria-haspopup="listbox"
+          >
+            <IconMoreHoriz class="size-4" aria-hidden="true" />
+          </button>
+        </div>
         <ul
           tabindex="0"
           role="listbox"
diff --git a/src/lib/components/storage/explorer/TabBar.svelte b/src/lib/components/storage/explorer/TabBar.svelte
index deaae23f..60b74c87 100644
--- a/src/lib/components/storage/explorer/TabBar.svelte
+++ b/src/lib/components/storage/explorer/TabBar.svelte
@@ -10,6 +10,7 @@
   import { getStorageState } from '$lib/storage/context.js';
   import { storageMoveEnabled } from '$lib/client/feature-flags.js';
   import ContextMenu from './ContextMenu.svelte';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
 
   interface Props {
     tabsState: TabsState;
@@ -335,39 +336,41 @@
           >
             <span class="truncate">{tab.label}</span>
             {#if tabsState.tabs.length > 1}
-              <span
-                class="text-base-content/40 hover:text-error shrink-0 rounded-full p-0.5 opacity-0 transition-opacity group-hover:opacity-100"
-                title={m.storage_tab_close()}
-                role="button"
-                tabindex="-1"
-                aria-label={m.storage_tab_close()}
-                onclick={(e) => {
-                  e.stopPropagation();
-                  tabsState.closeTab(tab.id);
-                }}
-                onkeydown={(e) => {
-                  if (e.key === 'Enter' || e.key === ' ') {
+              <TooltipTrigger text={m.storage_tab_close()} orientation="down">
+                <span
+                  class="text-base-content/40 hover:text-error shrink-0 rounded-full p-0.5 opacity-0 transition-opacity group-hover:opacity-100"
+                  role="button"
+                  tabindex="-1"
+                  aria-label={m.storage_tab_close()}
+                  onclick={(e) => {
                     e.stopPropagation();
                     tabsState.closeTab(tab.id);
-                  }
-                }}
-              >
-                <IconClose class="size-3" aria-hidden="true" />
-              </span>
+                  }}
+                  onkeydown={(e) => {
+                    if (e.key === 'Enter' || e.key === ' ') {
+                      e.stopPropagation();
+                      tabsState.closeTab(tab.id);
+                    }
+                  }}
+                >
+                  <IconClose class="size-3" aria-hidden="true" />
+                </span>
+              </TooltipTrigger>
             {/if}
           </button>
         {/if}
       {/each}
 
       <!-- Plus button — sits inline next to the last tab -->
-      <button
-        class="btn btn-ghost btn-xs z-20 ml-2 shrink-0"
-        title={m.storage_tab_new()}
-        aria-label={m.storage_tab_new()}
-        onclick={() => tabsState.addTab()}
-      >
-        <IconAdd class="size-3.5" aria-hidden="true" />
-      </button>
+      <TooltipTrigger text={m.storage_tab_new()} orientation="down">
+        <button
+          class="btn btn-ghost btn-xs z-20 ml-2 shrink-0"
+          aria-label={m.storage_tab_new()}
+          onclick={() => tabsState.addTab()}
+        >
+          <IconAdd class="size-3.5" aria-hidden="true" />
+        </button>
+      </TooltipTrigger>
     </div>
 
     <!-- Fade-out gradient indicating more tabs to the left -->
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte b/src/lib/components/storage/landing/BucketGrid.svelte
index ca397000..498e9381 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte
+++ b/src/lib/components/storage/landing/BucketGrid.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import IconBucket from '../shared/BucketIcon.svelte';
-  import Tooltip from '$lib/components/Tooltip.svelte';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
   import IconInfo from 'virtual:icons/material-symbols/info';
   import * as m from '$lib/paraglide/messages.js';
   import { resolve } from '$app/paths';
@@ -14,9 +14,6 @@
 
   let { buckets = [], loading = false }: Props = $props();
 
-  let tooltipText = $state<string | null>(null);
-  let tooltipX = $state(0);
-  let tooltipY = $state(0);
   const storage = getStorageState();
 
   let ctxMenu = $state<{ x: number; y: number; bucket: string } | null>(null);
@@ -82,34 +79,26 @@
     "
   >
     {#each buckets as bucket (bucket)}
-      <a
-        href={resolve('/(app)/storage/[bucket]/[...prefix]', {
-          bucket: encodeURIComponent(bucket),
-          prefix: ''
-        })}
-        data-sveltekit-preload-data="off"
-        class="
+      <TooltipTrigger text={bucket} orientation="down">
+        <a
+          href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+            bucket: encodeURIComponent(bucket),
+            prefix: ''
+          })}
+          data-sveltekit-preload-data="off"
+          class="
             border-base-300 bg-base-100 hover:border-primary hover:bg-primary/5 flex flex-col items-center
             gap-2 rounded-xl border p-4
             text-center transition-colors
           "
-        oncontextmenu={(e) => handleContextMenu(e, bucket)}
-        onmouseenter={(e) => {
-          const rect = (e.currentTarget as HTMLElement).getBoundingClientRect();
-          tooltipText = bucket;
-          tooltipX = rect.left + rect.width / 2;
-          tooltipY = rect.bottom;
-        }}
-        onmouseleave={() => {
-          tooltipText = null;
-        }}
-      >
-        <IconBucket class="text-warning size-10" aria-hidden="true" />
-        <span class="w-full truncate text-sm font-medium">{bucket}</span>
-      </a>
+          oncontextmenu={(e) => handleContextMenu(e, bucket)}
+        >
+          <IconBucket class="text-warning size-10" aria-hidden="true" />
+          <span class="w-full truncate text-sm font-medium">{bucket}</span>
+        </a>
+      </TooltipTrigger>
     {/each}
   </div>
-  <Tooltip text={tooltipText} x={tooltipX} y={tooltipY} orientation="down" />
 {:else}
   <p class="text-base-content/50 text-sm">{m.storage_buckets_empty()}</p>
 {/if}
diff --git a/src/lib/components/storage/modals/DeleteConnectionModal.svelte b/src/lib/components/storage/modals/DeleteConnectionModal.svelte
index 27a192db..5829c280 100644
--- a/src/lib/components/storage/modals/DeleteConnectionModal.svelte
+++ b/src/lib/components/storage/modals/DeleteConnectionModal.svelte
@@ -2,6 +2,7 @@
   import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
   import IconCheck from 'virtual:icons/material-symbols/check';
   import Modal from '$lib/components/Modal.svelte';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
   import * as m from '$lib/paraglide/messages.js';
   import type { SavedConnection } from '$lib/storage/connection-id-header.js';
 
@@ -53,20 +54,25 @@
         <table class="table-sm table">
           <tbody>
             {#snippet copyBtn(value: string, field: string)}
-              <button
-                type="button"
-                class="btn btn-ghost btn-xs btn-square"
-                aria-label={copiedField === field
-                  ? m.storage_connect_copied()
-                  : m.storage_connect_copy()}
-                onclick={() => copyField(value, field)}
+              <TooltipTrigger
+                text={copiedField === field ? m.storage_connect_copied() : m.storage_connect_copy()}
+                orientation="left"
               >
-                {#if copiedField === field}
-                  <IconCheck class="text-success h-4 w-4" />
-                {:else}
-                  <IconContentCopy class="h-4 w-4" />
-                {/if}
-              </button>
+                <button
+                  type="button"
+                  class="btn btn-ghost btn-xs btn-square"
+                  aria-label={copiedField === field
+                    ? m.storage_connect_copied()
+                    : m.storage_connect_copy()}
+                  onclick={() => copyField(value, field)}
+                >
+                  {#if copiedField === field}
+                    <IconCheck class="text-success h-4 w-4" />
+                  {:else}
+                    <IconContentCopy class="h-4 w-4" />
+                  {/if}
+                </button>
+              </TooltipTrigger>
             {/snippet}
             <tr>
               <th>{m.storage_connect_host()}</th>
diff --git a/src/lib/components/storage/modals/DetailsModal.svelte b/src/lib/components/storage/modals/DetailsModal.svelte
index c83e6258..3c0385fb 100644
--- a/src/lib/components/storage/modals/DetailsModal.svelte
+++ b/src/lib/components/storage/modals/DetailsModal.svelte
@@ -96,25 +96,31 @@
         </div>
       </div>
       <div class="flex shrink-0 items-center gap-1">
-        <button
-          class="btn btn-ghost btn-sm btn-square"
-          onclick={() => (maximized = !maximized)}
-          aria-label={maximized ? m.storage_details_restore() : m.storage_details_maximise()}
-          title={maximized ? m.storage_details_restore() : m.storage_details_maximise()}
+        <div
+          class="tooltip tooltip-bottom"
+          data-tip={maximized ? m.storage_details_restore() : m.storage_details_maximise()}
         >
-          {#if maximized}
-            <IconCloseFullscreen class="size-4" aria-hidden="true" />
-          {:else}
-            <IconOpenInFull class="size-4" aria-hidden="true" />
-          {/if}
-        </button>
-        <button
-          class="btn btn-ghost btn-sm btn-square"
-          onclick={() => (open = false)}
-          aria-label={m.storage_details_close()}
-        >
-          <IconClose class="size-4" aria-hidden="true" />
-        </button>
+          <button
+            class="btn btn-ghost btn-sm btn-square"
+            onclick={() => (maximized = !maximized)}
+            aria-label={maximized ? m.storage_details_restore() : m.storage_details_maximise()}
+          >
+            {#if maximized}
+              <IconCloseFullscreen class="size-4" aria-hidden="true" />
+            {:else}
+              <IconOpenInFull class="size-4" aria-hidden="true" />
+            {/if}
+          </button>
+        </div>
+        <div class="tooltip tooltip-bottom" data-tip={m.storage_details_close()}>
+          <button
+            class="btn btn-ghost btn-sm btn-square"
+            onclick={() => (open = false)}
+            aria-label={m.storage_details_close()}
+          >
+            <IconClose class="size-4" aria-hidden="true" />
+          </button>
+        </div>
       </div>
     </div>
 
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index f67dfd03..e783af63 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -848,30 +848,36 @@
       </div>
 
       {#if maximized}
-        <button
-          class="btn btn-ghost btn-sm btn-square"
-          onclick={toggleMaximized}
-          aria-label={m.storage_preview_restore()}
-        >
-          <IconCloseFullscreen class="size-4" aria-hidden="true" />
-        </button>
+        <div class="tooltip tooltip-bottom" data-tip={m.storage_preview_restore()}>
+          <button
+            class="btn btn-ghost btn-sm btn-square"
+            onclick={toggleMaximized}
+            aria-label={m.storage_preview_restore()}
+          >
+            <IconCloseFullscreen class="size-4" aria-hidden="true" />
+          </button>
+        </div>
       {:else}
+        <div class="tooltip tooltip-bottom" data-tip={m.storage_preview_maximise()}>
+          <button
+            class="btn btn-ghost btn-sm btn-square"
+            onclick={toggleMaximized}
+            aria-label={m.storage_preview_maximise()}
+          >
+            <IconOpenInFull class="size-4" aria-hidden="true" />
+          </button>
+        </div>
+      {/if}
+
+      <div class="tooltip tooltip-bottom" data-tip={m.storage_preview_close()}>
         <button
           class="btn btn-ghost btn-sm btn-square"
-          onclick={toggleMaximized}
-          aria-label={m.storage_preview_maximise()}
+          onclick={handleCloseClick}
+          aria-label={m.storage_preview_close()}
         >
-          <IconOpenInFull class="size-4" aria-hidden="true" />
+          <IconClose class="size-5" aria-hidden="true" />
         </button>
-      {/if}
-
-      <button
-        class="btn btn-ghost btn-sm btn-square"
-        onclick={handleCloseClick}
-        aria-label={m.storage_preview_close()}
-      >
-        <IconClose class="size-5" aria-hidden="true" />
-      </button>
+      </div>
     </div>
 
     {#if preview.kind === 'parquet'}
diff --git a/src/lib/components/storage/modals/upload/UploadModal.svelte b/src/lib/components/storage/modals/upload/UploadModal.svelte
index 26a8ae19..244d6c74 100644
--- a/src/lib/components/storage/modals/upload/UploadModal.svelte
+++ b/src/lib/components/storage/modals/upload/UploadModal.svelte
@@ -332,13 +332,15 @@
       <h2 class="text-base-content text-lg font-semibold">
         {m.storage_upload_title()}
       </h2>
-      <button
-        class="btn btn-ghost btn-sm btn-square"
-        onclick={handleCancel}
-        aria-label={m.storage_upload_close()}
-      >
-        <IconClose class="size-5" aria-hidden="true" />
-      </button>
+      <div class="tooltip tooltip-bottom" data-tip={m.storage_upload_close()}>
+        <button
+          class="btn btn-ghost btn-sm btn-square"
+          onclick={handleCancel}
+          aria-label={m.storage_upload_close()}
+        >
+          <IconClose class="size-5" aria-hidden="true" />
+        </button>
+      </div>
     </div>
 
     <!-- Target prefix info -->
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index c661efaa..05e784c1 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -11,7 +11,7 @@
   import IconGridView from 'virtual:icons/material-symbols/grid-view';
   import IconPowerOff from 'virtual:icons/material-symbols/power-settings-new';
   import Modal from '$lib/components/Modal.svelte';
-  import Tooltip from '$lib/components/Tooltip.svelte';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
   import FloatingMenu from '../shared/FloatingMenu.svelte';
@@ -114,24 +114,6 @@
     }
   }
 
-  // ── Fixed tooltip (avoids overflow clipping that breaks DaisyUI tooltips) ──
-  // TODO: This is a temporary solution until it's fixed in daisyUI 5.6: https://github.com/saadeghi/daisyui/issues/3346#issuecomment-4544975800
-  let tooltipText = $state<string | null>(null);
-  let tooltipX = $state(0);
-  let tooltipY = $state(0);
-
-  function showTooltip(e: MouseEvent | FocusEvent, text: string) {
-    const el = e.currentTarget as HTMLElement;
-    const rect = el.getBoundingClientRect();
-    tooltipX = rect.right;
-    tooltipY = rect.top + rect.height / 2;
-    tooltipText = text;
-  }
-
-  function hideTooltip() {
-    tooltipText = null;
-  }
-
   // ── Drag-drop targets for sidebar items ────────────────────────────────
   let dropSidebarTarget = $state<string | null>(null);
 
@@ -177,15 +159,17 @@
         <span class="text-base-content/70 text-xs font-medium">
           {m.storage_context_menu_actions()}
         </span>
-        <button
-          type="button"
-          role="menuitem"
-          class="btn btn-ghost btn-xs"
-          aria-label={m.storage_preview_close()}
-          onclick={closeUnpinMenu}
-        >
-          <IconClose class="size-4" aria-hidden="true" />
-        </button>
+        <div class="tooltip tooltip-left" data-tip={m.action_close()}>
+          <button
+            type="button"
+            role="menuitem"
+            class="btn btn-ghost btn-xs"
+            aria-label={m.action_close()}
+            onclick={closeUnpinMenu}
+          >
+            <IconClose class="size-4" aria-hidden="true" />
+          </button>
+        </div>
       </div>
     </li>
     <li role="none">
@@ -223,43 +207,42 @@
             {@const active = isPinnedActive(pin)}
             <li role="none" class="group relative">
               <!-- eslint-disable svelte/no-navigation-without-resolve -->
-              <a
-                href={pinnedHref(pin)}
-                data-sveltekit-preload-data="off"
-                class="
-                hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
-                pr-7 text-sm
-                {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}
-                {dropSidebarTarget === pin.prefix ? 'bg-primary/20' : ''}"
-                aria-current={active ? 'page' : undefined}
-                onmouseenter={(e) => showTooltip(e, pinnedLabel(pin))}
-                onmouseleave={hideTooltip}
-                onfocus={(e) => showTooltip(e, pinnedLabel(pin))}
-                onblur={hideTooltip}
-                ondragover={(e) => handleSidebarDragOver(e, pin.prefix)}
-                ondragleave={handleSidebarDragLeave}
-                ondrop={(e) => handleSidebarDrop(e, pin.bucket, pin.prefix)}
-              >
-                <!-- eslint-enable svelte/no-navigation-without-resolve -->
-                {#if pin.prefix === ''}
-                  <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-                {:else}
-                  <IconFolderOutline class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-                {/if}
-                <span class="truncate">{pinnedLabel(pin)}</span>
-              </a>
-              <button
-                class="
-                btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
-                p-0 opacity-0 transition-opacity
-                group-hover:opacity-100 focus:opacity-100
-              "
-                onclick={(e) => openUnpinMenuFromButton(e, pin)}
-                aria-label={m.storage_more_options()}
-                title={m.storage_more_options()}
-              >
-                <IconMoreHoriz class="size-3.5" aria-hidden="true" />
-              </button>
+              <TooltipTrigger text={pinnedLabel(pin)} orientation="right">
+                <a
+                  href={pinnedHref(pin)}
+                  data-sveltekit-preload-data="off"
+                  class="
+                    hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                    pr-7 text-sm
+                    {active ? 'bg-primary/10 text-primary font-medium' : 'text-base-content'}
+                    {dropSidebarTarget === pin.prefix ? 'bg-primary/20' : ''}"
+                  aria-current={active ? 'page' : undefined}
+                  ondragover={(e) => handleSidebarDragOver(e, pin.prefix)}
+                  ondragleave={handleSidebarDragLeave}
+                  ondrop={(e) => handleSidebarDrop(e, pin.bucket, pin.prefix)}
+                >
+                  <!-- eslint-enable svelte/no-navigation-without-resolve -->
+                  {#if pin.prefix === ''}
+                    <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+                  {:else}
+                    <IconFolderOutline class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+                  {/if}
+                  <span class="truncate">{pinnedLabel(pin)}</span>
+                </a>
+              </TooltipTrigger>
+              <TooltipTrigger text={m.storage_more_options()} orientation="right">
+                <button
+                  class="
+                    btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
+                    p-0 opacity-0 transition-opacity
+                    group-hover:opacity-100 focus:opacity-100
+                  "
+                  onclick={(e) => openUnpinMenuFromButton(e, pin)}
+                  aria-label={m.storage_more_options()}
+                >
+                  <IconMoreHoriz class="size-3.5" aria-hidden="true" />
+                </button>
+              </TooltipTrigger>
             </li>
           {/each}
         </ul>
@@ -301,32 +284,30 @@
         {:else}
           {#each storage.buckets as bucket (bucket)}
             <li role="none">
-              <a
-                href={resolve('/(app)/storage/[bucket]/[...prefix]', {
-                  bucket: encodeURIComponent(bucket),
-                  prefix: ''
-                })}
-                data-sveltekit-preload-data="off"
-                class="
-                  hover:bg-base-200 flex items-center gap-2
-                  px-3 py-1.5 text-sm
-                  {activeBucket === bucket
-                  ? 'bg-primary/10 text-primary font-medium'
-                  : 'text-base-content'}
-                  {dropSidebarTarget === '' && activeBucket === bucket ? 'bg-primary/20' : ''}"
-                aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
-                onmouseenter={(e) => showTooltip(e, bucket)}
-                onmouseleave={hideTooltip}
-                onfocus={(e) => showTooltip(e, bucket)}
-                onblur={hideTooltip}
-                oncontextmenu={(e) => openBucketContextMenu(e, bucket)}
-                ondragover={(e) => handleSidebarDragOver(e, '')}
-                ondragleave={handleSidebarDragLeave}
-                ondrop={(e) => handleSidebarDrop(e, bucket, '')}
-              >
-                <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
-                <span class="truncate">{bucket}</span>
-              </a>
+              <TooltipTrigger text={bucket} orientation="right">
+                <a
+                  href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+                    bucket: encodeURIComponent(bucket),
+                    prefix: ''
+                  })}
+                  data-sveltekit-preload-data="off"
+                  class="
+                    hover:bg-base-200 flex items-center gap-2
+                    px-3 py-1.5 text-sm
+                    {activeBucket === bucket
+                    ? 'bg-primary/10 text-primary font-medium'
+                    : 'text-base-content'}
+                    {dropSidebarTarget === '' && activeBucket === bucket ? 'bg-primary/20' : ''}"
+                  aria-current={activeBucket === bucket && !page.params.prefix ? 'page' : undefined}
+                  oncontextmenu={(e) => openBucketContextMenu(e, bucket)}
+                  ondragover={(e) => handleSidebarDragOver(e, '')}
+                  ondragleave={handleSidebarDragLeave}
+                  ondrop={(e) => handleSidebarDrop(e, bucket, '')}
+                >
+                  <IconBucket class="size-3.5 shrink-0 opacity-60" aria-hidden="true" />
+                  <span class="truncate">{bucket}</span>
+                </a>
+              </TooltipTrigger>
             </li>
           {/each}
         {/if}
@@ -387,5 +368,3 @@
 
   <ResizeHandle panel={resize} />
 </nav>
-
-<Tooltip text={tooltipText} x={tooltipX} y={tooltipY} orientation="right" />
diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
index 62fbae99..d325a48a 100644
--- a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -3,7 +3,7 @@
   import IconMoreHoriz from 'virtual:icons/material-symbols/more-horiz';
   import IconEdit from 'virtual:icons/material-symbols/edit';
   import IconClose from 'virtual:icons/material-symbols/close';
-  import Tooltip from '$lib/components/Tooltip.svelte';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
   import { createResizablePanel } from './resizable-panel.svelte.js';
   import ResizeHandle from './ResizeHandle.svelte';
   import { resolve } from '$app/paths';
@@ -54,22 +54,6 @@
   });
 
   // ── Tooltip ──────────────────────────────────────────────────────────────
-  let tooltipText = $state<string | null>(null);
-  let tooltipX = $state(0);
-  let tooltipY = $state(0);
-
-  function showTooltip(e: MouseEvent | FocusEvent, text: string) {
-    const el = e.currentTarget as HTMLElement;
-    const rect = el.getBoundingClientRect();
-    tooltipX = rect.right;
-    tooltipY = rect.top + rect.height / 2;
-    tooltipText = text;
-  }
-
-  function hideTooltip() {
-    tooltipText = null;
-  }
-
   function connectionLabel(conn: ConnectionMetadata): string {
     return conn.name || conn.endpoint || 'S3';
   }
@@ -281,45 +265,17 @@
         <li class="group relative">
           <div class="relative z-150 w-full">
             {#if onselect}
-              <button
-                type="button"
-                onclick={() => onselect(conn)}
-                class="
-                  hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
-                  pr-7 text-sm
-                  {activeId === conn.id
-                  ? 'bg-primary/10 text-primary font-medium'
-                  : 'text-base-content'}
-                "
-                onmouseenter={(e) => showTooltip(e, connectionLabel(conn))}
-                onmouseleave={hideTooltip}
-                onfocus={(e) => showTooltip(e, connectionLabel(conn))}
-                onblur={hideTooltip}
-                oncontextmenu={(e) => openContextMenu(e, conn)}
-                onkeydown={(e) => handleConnectionKeydown(e, conn)}
-              >
-                <IconStorage
-                  class="text-primary size-3.5 shrink-0 {activeId === conn.id ? '' : 'opacity-60'}"
-                  aria-hidden="true"
-                />
-                <span class="truncate">{connectionLabel(conn)}</span>
-              </button>
-            {:else}
-              <form method="POST" action="?/use">
-                <input type="hidden" name="connectionId" value={conn.id} />
+              <TooltipTrigger text={connectionLabel(conn)} orientation="right">
                 <button
-                  type="submit"
+                  type="button"
+                  onclick={() => onselect(conn)}
                   class="
                     hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
                     pr-7 text-sm
-                    {activeId === conn.id
+                  {activeId === conn.id
                     ? 'bg-primary/10 text-primary font-medium'
                     : 'text-base-content'}
-                  "
-                  onmouseenter={(e) => showTooltip(e, connectionLabel(conn))}
-                  onmouseleave={hideTooltip}
-                  onfocus={(e) => showTooltip(e, connectionLabel(conn))}
-                  onblur={hideTooltip}
+                "
                   oncontextmenu={(e) => openContextMenu(e, conn)}
                   onkeydown={(e) => handleConnectionKeydown(e, conn)}
                 >
@@ -331,23 +287,50 @@
                   />
                   <span class="truncate">{connectionLabel(conn)}</span>
                 </button>
+              </TooltipTrigger>
+            {:else}
+              <form method="POST" action="?/use">
+                <input type="hidden" name="connectionId" value={conn.id} />
+                <TooltipTrigger text={connectionLabel(conn)} orientation="right">
+                  <button
+                    type="submit"
+                    class="
+                      hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
+                      pr-7 text-sm
+                      {activeId === conn.id
+                      ? 'bg-primary/10 text-primary font-medium'
+                      : 'text-base-content'}
+                    "
+                    oncontextmenu={(e) => openContextMenu(e, conn)}
+                    onkeydown={(e) => handleConnectionKeydown(e, conn)}
+                  >
+                    <IconStorage
+                      class="text-primary size-3.5 shrink-0 {activeId === conn.id
+                        ? ''
+                        : 'opacity-60'}"
+                      aria-hidden="true"
+                    />
+                    <span class="truncate">{connectionLabel(conn)}</span>
+                  </button>
+                </TooltipTrigger>
               </form>
             {/if}
           </div>
 
-          <button
-            type="button"
-            onclick={(e) => openContextMenu(e, conn)}
-            class="
-              btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
-              p-0 opacity-0 transition-opacity
-              group-hover:opacity-100 focus:opacity-100
-            "
-            aria-label={m.storage_more_options()}
-            title={m.storage_more_options()}
-          >
-            <IconMoreHoriz class="size-3.5" aria-hidden="true" />
-          </button>
+          <TooltipTrigger text={m.storage_more_options()} orientation="right">
+            <button
+              type="button"
+              onclick={(e) => openContextMenu(e, conn)}
+              class="
+                btn btn-ghost btn-xs absolute top-1/2 right-1 z-150 -translate-y-1/2
+                p-0 opacity-0 transition-opacity
+                group-hover:opacity-100 focus:opacity-100
+              "
+              aria-label={m.storage_more_options()}
+            >
+              <IconMoreHoriz class="size-3.5" aria-hidden="true" />
+            </button>
+          </TooltipTrigger>
         </li>
       {/each}
     {/if}
@@ -364,5 +347,3 @@
 
   <ResizeHandle panel={resize} />
 </aside>
-
-<Tooltip text={tooltipText} x={tooltipX} y={tooltipY} orientation="right" />
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index b90b99c4..0a4d8f45 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -120,13 +120,15 @@
         <button class="btn btn-sm btn-neutral shrink-0" onclick={handleRestore}>
           {m.storage_restore_tabs_action()}
         </button>
-        <button
-          class="btn btn-ghost btn-sm btn-square shrink-0"
-          aria-label={m.storage_download_dismiss()}
-          onclick={handleDismiss}
-        >
-          <IconClose class="size-4" aria-hidden="true" />
-        </button>
+        <div class="tooltip tooltip-bottom" data-tip={m.storage_download_dismiss()}>
+          <button
+            class="btn btn-ghost btn-sm btn-square shrink-0"
+            aria-label={m.storage_download_dismiss()}
+            onclick={handleDismiss}
+          >
+            <IconClose class="size-4" aria-hidden="true" />
+          </button>
+        </div>
       </div>
     {/if}
 
diff --git a/src/routes/(app)/storage/connections/+page.svelte b/src/routes/(app)/storage/connections/+page.svelte
index 1c156539..5ad4d356 100644
--- a/src/routes/(app)/storage/connections/+page.svelte
+++ b/src/routes/(app)/storage/connections/+page.svelte
@@ -124,14 +124,19 @@
               </td>
               <td class="text-base-content/60 text-xs uppercase">s3</td>
               <td>
-                <button
-                  type="button"
-                  class="btn btn-ghost btn-xs btn-square opacity-0 group-hover:opacity-100"
-                  aria-label={m.storage_connections_options({ label: connectionLabel(conn) })}
-                  onclick={(e) => openContextMenu(e, conn)}
+                <div
+                  class="tooltip tooltip-left"
+                  data-tip={m.storage_connections_options({ label: connectionLabel(conn) })}
                 >
-                  <IconMoreHoriz class="size-4" aria-hidden="true" />
-                </button>
+                  <button
+                    type="button"
+                    class="btn btn-ghost btn-xs btn-square opacity-0 group-hover:opacity-100"
+                    aria-label={m.storage_connections_options({ label: connectionLabel(conn) })}
+                    onclick={(e) => openContextMenu(e, conn)}
+                  >
+                    <IconMoreHoriz class="size-4" aria-hidden="true" />
+                  </button>
+                </div>
               </td>
             </tr>
           {/each}
diff --git a/src/routes/(app)/trino/+page.svelte b/src/routes/(app)/trino/+page.svelte
index 960a0d49..230fb01d 100644
--- a/src/routes/(app)/trino/+page.svelte
+++ b/src/routes/(app)/trino/+page.svelte
@@ -756,8 +756,9 @@
                 type="button"
                 class="
                   btn join-item border-l-primary-content/20 btn-primary
-                  self-stretch border-l px-2
+                  tooltip tooltip-bottom z-150 self-stretch border-l px-2 before:z-200
                 "
+                data-tip={m.trino_run_mode_select()}
                 class:pointer-events-none={isActive}
                 aria-haspopup="true"
                 aria-label={m.trino_run_mode_select()}

From ea867b663c8b71fa3b6cfdd1012570b29c4cdefc Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 31 Aug 2026 07:47:35 +0200
Subject: [PATCH 127/136] #208 fix actions tooltip, show parquet line number
 only on data tab

---
 src/lib/components/storage/explorer/OperationsButton.svelte | 2 +-
 src/lib/components/storage/modals/PreviewModal.svelte       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/lib/components/storage/explorer/OperationsButton.svelte b/src/lib/components/storage/explorer/OperationsButton.svelte
index 4d30d248..110821e7 100644
--- a/src/lib/components/storage/explorer/OperationsButton.svelte
+++ b/src/lib/components/storage/explorer/OperationsButton.svelte
@@ -222,7 +222,7 @@
   {/if}
   <div bind:this={dropdownEl} class="relative z-50 inline-flex">
     <!-- Trigger button -->
-    <div class="tooltip tooltip-top" data-tip={m.storage_operations_label()}>
+    <div class="tooltip tooltip-bottom" data-tip={m.storage_operations_label()}>
       <button
         class="
           btn btn-ghost btn-xs relative size-7 rounded-full p-0
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index e783af63..21a89886 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -824,7 +824,7 @@
               <span class="badge badge-soft badge-warning badge-sm">
                 {m.storage_preview_parquet_blocked_title()}
               </span>
-            {:else if preview.truncated}
+            {:else if preview.truncated && parquetTab === 'data'}
               <span class="badge badge-soft badge-warning badge-sm">
                 {m.storage_preview_parquet_rows({
                   count: parquetShowingRowsCount.toLocaleString(getLocale()),

From 416e78cc5d805c09ab920f3e687b17ed49c9cceb Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 31 Aug 2026 09:49:36 +0200
Subject: [PATCH 128/136] use tabs by default, fix tooltips, rename storage
 routes, operations history now overflows, fix TSV preview

---
 e2e/navigation.spec.ts                        |   2 +-
 e2e/storage/add-bucket.spec.ts                |   8 +-
 e2e/storage/archive.spec.ts                   |   6 +-
 e2e/storage/connection.spec.ts                |   4 +-
 e2e/storage/connections-management.spec.ts    |  34 +++---
 e2e/storage/helpers.ts                        |  13 +-
 e2e/storage/permissions.spec.ts               |   4 +-
 e2e/storage/recent-items.spec.ts              |  10 +-
 e2e/storage/tabs.spec.ts                      | 111 ++++++------------
 .../storage/explorer/FileExplorer.svelte      |  44 +------
 .../storage/explorer/OperationsButton.svelte  |   6 +-
 .../storage/explorer/StorageBreadcrumb.svelte |  70 -----------
 .../storage/landing/AddBucketModal.svelte     |   3 +-
 .../storage/landing/BucketGrid.svelte         |   5 +-
 .../storage/landing/BucketGrid.svelte.spec.ts |   1 +
 .../storage/landing/RecentItems.svelte        |  10 +-
 .../storage/modals/PreviewModal.svelte        |  44 +++----
 .../storage/modals/preview/CsvPreview.svelte  |   2 +-
 .../modals/preview/CsvPreview.svelte.spec.ts  |   8 ++
 .../storage/sidebar/BucketList.svelte         |  10 +-
 .../sidebar/StorageConnectionSidebar.svelte   |   6 +-
 .../storage/connection-store.svelte.spec.ts   |  11 +-
 src/lib/storage/connection-store.svelte.ts    |  12 ++
 src/lib/storage/display-helpers.spec.ts       |  31 +++--
 src/lib/storage/display-helpers.ts            |  21 ++--
 src/lib/storage/state.svelte.ts               |   1 +
 src/lib/storage/tabs.svelte.spec.ts           |  25 +++-
 src/lib/storage/tabs.svelte.ts                |  37 ++++--
 .../(app)/api/storage/preview/+server.ts      |  11 +-
 .../(app)/api/storage/preview/server.test.ts  |  28 ++---
 .../connections/+page.server.ts               |   2 +-
 .../connections/+page.svelte                  |   2 +-
 .../connections/[id]/+layout.svelte           |   2 +-
 .../connections/[id]/edit/+page.server.ts     |   2 +-
 .../connections/[id]/edit/+page.svelte        |   4 +-
 src/routes/(app)/storage/+error.svelte        |  10 +-
 src/routes/(app)/storage/+layout.svelte       |  31 ++++-
 src/routes/(app)/storage/+page.svelte         |   9 +-
 .../[bucket]/[...prefix]/+page.server.ts      |   3 +-
 .../[bucket]/[...prefix]/+page.svelte         |  28 ++++-
 .../[bucket]/[...prefix]/+page.ts             |  11 +-
 .../[bucket]/[...prefix]/page.server.test.ts  |  22 +++-
 42 files changed, 355 insertions(+), 349 deletions(-)
 rename src/routes/(app)/{storage => settings}/connections/+page.server.ts (96%)
 rename src/routes/(app)/{storage => settings}/connections/+page.svelte (98%)
 rename src/routes/(app)/{storage => settings}/connections/[id]/+layout.svelte (93%)
 rename src/routes/(app)/{storage => settings}/connections/[id]/edit/+page.server.ts (99%)
 rename src/routes/(app)/{storage => settings}/connections/[id]/edit/+page.svelte (98%)
 rename src/routes/(app)/storage/{ => browse/[connection]}/[bucket]/[...prefix]/+page.server.ts (77%)
 rename src/routes/(app)/storage/{ => browse/[connection]}/[bucket]/[...prefix]/+page.svelte (75%)
 rename src/routes/(app)/storage/{ => browse/[connection]}/[bucket]/[...prefix]/+page.ts (85%)
 rename src/routes/(app)/storage/{ => browse/[connection]}/[bucket]/[...prefix]/page.server.test.ts (77%)

diff --git a/e2e/navigation.spec.ts b/e2e/navigation.spec.ts
index 2f1a59ca..cbf4c096 100644
--- a/e2e/navigation.spec.ts
+++ b/e2e/navigation.spec.ts
@@ -33,7 +33,7 @@ test.describe('App navigation', () => {
 
     // Delay the connections page's data fetch. Even while it is in flight the
     // global progress bar must stay hidden: it only appears between apps.
-    await page.route('**/storage/connections/__data.json*', async (route) => {
+    await page.route('**/settings/connections/__data.json*', async (route) => {
       await new Promise((resolve) => setTimeout(resolve, 1500));
       await route.continue();
     });
diff --git a/e2e/storage/add-bucket.spec.ts b/e2e/storage/add-bucket.spec.ts
index cdfe2a80..9643c391 100644
--- a/e2e/storage/add-bucket.spec.ts
+++ b/e2e/storage/add-bucket.spec.ts
@@ -52,7 +52,9 @@ test.describe('Storage S3 — Add bucket manually', () => {
     await modalBox(page).getByLabel('Bucket name').fill(credentials.bucket);
     await modalBox(page).getByRole('button', { name: 'Connect' }).click();
 
-    await expect(page).toHaveURL(`/storage/${encodeURIComponent(credentials.bucket)}`);
+    await expect(page).toHaveURL(
+      `/storage/browse/${encodeURIComponent(new URL(credentials.endpoint).hostname)}/${encodeURIComponent(credentials.bucket)}`
+    );
   });
 
   test('bucket appears in the bucket grid after successful connection', async ({
@@ -90,7 +92,9 @@ test.describe('Storage S3 — Add bucket manually', () => {
     await modalBox(page).getByRole('button', { name: 'Connect' }).click();
 
     // Should navigate into the bucket
-    await expect(page).toHaveURL(`/storage/${encodeURIComponent(extraBucketName)}`);
+    await expect(page).toHaveURL(
+      `/storage/browse/${encodeURIComponent(new URL(baseCredentials.endpoint).hostname)}/${encodeURIComponent(extraBucketName)}`
+    );
 
     // Go back to the bucket grid and confirm the bucket is now shown
     await page.goto('/storage');
diff --git a/e2e/storage/archive.spec.ts b/e2e/storage/archive.spec.ts
index a363c469..9bc34feb 100644
--- a/e2e/storage/archive.spec.ts
+++ b/e2e/storage/archive.spec.ts
@@ -170,7 +170,11 @@ test.describe('Storage S3 — Archive preview', () => {
 
       // Should be at the bucket root (archive exited)
       // eslint-disable-next-line security/detect-non-literal-regexp
-      await expect(page).toHaveURL(new RegExp(`/storage/${credentials.bucket}(\\?|$)`));
+      await expect(page).toHaveURL(
+        new RegExp(
+          `/storage/browse/${new URL(credentials.endpoint).hostname}/${credentials.bucket}(\\?|$)`
+        )
+      );
       await expect(page.getByText('archive.zip')).not.toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
diff --git a/e2e/storage/connection.spec.ts b/e2e/storage/connection.spec.ts
index 52d071a6..9a3b441c 100644
--- a/e2e/storage/connection.spec.ts
+++ b/e2e/storage/connection.spec.ts
@@ -124,7 +124,9 @@ test.describe('Storage S3 — Connection', () => {
     await expect(bucketLink).toBeVisible();
     await bucketLink.click();
 
-    await expect(page).toHaveURL(bucketRoute(credentials.bucket));
+    await expect(page).toHaveURL(
+      bucketRoute(new URL(credentials.endpoint).hostname, credentials.bucket)
+    );
     await expect(page.locator('nav[aria-label="breadcrumb"] [aria-current="page"]')).toContainText(
       credentials.bucket
     );
diff --git a/e2e/storage/connections-management.spec.ts b/e2e/storage/connections-management.spec.ts
index 391d7cd2..0d9ef3f0 100644
--- a/e2e/storage/connections-management.spec.ts
+++ b/e2e/storage/connections-management.spec.ts
@@ -34,7 +34,7 @@ test.describe('Storage — Connections management', () => {
     await expect(page.getByRole('link', { name: 'Manage connections' })).toBeVisible();
   });
 
-  test('navigates to /storage/connections from the manage link', async ({ page }) => {
+  test('navigates to /settings/connections from the manage link', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
     await openConnectForm(page);
@@ -42,14 +42,14 @@ test.describe('Storage — Connections management', () => {
     await page.getByRole('link', { name: 'Manage connections' }).click();
 
     await waitForHydration(page);
-    await expect(page).toHaveURL('/storage/connections');
+    await expect(page).toHaveURL('/settings/connections');
     await expect(page.getByRole('heading', { name: 'Manage connections' })).toBeVisible();
   });
 
   test('lists saved connections on the management page', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     // Connections are displayed in a table; at least one data row should be visible.
@@ -59,7 +59,7 @@ test.describe('Storage — Connections management', () => {
   test('Edit link on management page navigates to edit page', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -70,7 +70,7 @@ test.describe('Storage — Connections management', () => {
   test('edit page pre-fills with current connection values', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -87,7 +87,7 @@ test.describe('Storage — Connections management', () => {
   }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -95,14 +95,14 @@ test.describe('Storage — Connections management', () => {
     await page.getByRole('button', { name: 'Save changes' }).click();
 
     await waitForHydration(page);
-    await expect(page).toHaveURL('/storage/connections');
+    await expect(page).toHaveURL('/settings/connections');
     await expect(page.getByRole('heading', { name: 'Manage connections' })).toBeVisible();
   });
 
   test('edit page shows error for invalid credentials', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -118,7 +118,7 @@ test.describe('Storage — Connections management', () => {
   }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     // Connections are displayed in a table; count data rows (excluding header).
@@ -137,11 +137,11 @@ test.describe('Storage — Connections management', () => {
     await expect(dataRows).toHaveCount(initialItems - 1);
   });
 
-  test('redirects to /storage/connections when editing a non-existent id', async ({ page }) => {
-    await page.goto('/storage/connections/00000000-0000-0000-0000-000000000000/edit');
+  test('redirects to /settings/connections when editing a non-existent id', async ({ page }) => {
+    await page.goto('/settings/connections/00000000-0000-0000-0000-000000000000/edit');
     await waitForHydration(page);
 
-    await expect(page).toHaveURL('/storage/connections');
+    await expect(page).toHaveURL('/settings/connections');
   });
 
   test('edit page shows active connection notice when editing current connection', async ({
@@ -149,7 +149,7 @@ test.describe('Storage — Connections management', () => {
   }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -162,7 +162,7 @@ test.describe('Storage — Connections management', () => {
   }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -181,7 +181,7 @@ test.describe('Storage — Connections management', () => {
   test('unsaved-changes modal: Stay keeps user on edit page', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -198,7 +198,7 @@ test.describe('Storage — Connections management', () => {
   test('unsaved-changes modal: Leave navigates away', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectToStorage(page, credentials);
-    await page.goto('/storage/connections');
+    await page.goto('/settings/connections');
     await waitForHydration(page);
 
     await openFirstConnectionEditPage(page);
@@ -209,6 +209,6 @@ test.describe('Storage — Connections management', () => {
     await page.getByRole('dialog').getByRole('button', { name: 'Leave' }).click();
 
     await waitForHydration(page);
-    await expect(page).toHaveURL('/storage/connections');
+    await expect(page).toHaveURL('/settings/connections');
   });
 });
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 8856219f..0feb1a15 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -25,9 +25,9 @@ export function uniqueBucketName(testInfo: TestInfo, scope: string): string {
   return `garage-${slug}-${testInfo.project.name.toLowerCase()}-${crypto.randomUUID().slice(0, 8)}`;
 }
 
-export function bucketRoute(bucket: string, prefix = ''): string {
+export function bucketRoute(connection: string, bucket: string, prefix = ''): string {
   if (!prefix) {
-    return `/storage/${encodeURIComponent(bucket)}`;
+    return `/storage/browse/${encodeURIComponent(connection)}/${encodeURIComponent(bucket)}`;
   }
 
   const trimmed = prefix.replace(/\/$/, '');
@@ -37,7 +37,7 @@ export function bucketRoute(bucket: string, prefix = ''): string {
     .map((segment) => encodeURIComponent(segment))
     .join('/');
 
-  return `/storage/${encodeURIComponent(bucket)}/${encoded}`;
+  return `/storage/browse/${encodeURIComponent(connection)}/${encodeURIComponent(bucket)}/${encoded}`;
 }
 
 export async function clearSavedConnections(page: Page) {
@@ -138,13 +138,14 @@ export async function connectAndOpenPrefix(
   prefix = ''
 ) {
   await connectToStorage(page, credentials);
-  await page.goto(bucketRoute(credentials.bucket, prefix));
+  const connection = new URL(credentials.endpoint).hostname;
+  await page.goto(bucketRoute(connection, credentials.bucket, prefix));
   // If a parallel worker's disconnect raced with this navigation the page will
   // have been redirected back to /storage.  Detect that and reconnect once.
   await waitForHydration(page);
   if (!page.url().includes(encodeURIComponent(credentials.bucket))) {
     await connectToStorage(page, credentials);
-    await page.goto(bucketRoute(credentials.bucket, prefix));
+    await page.goto(bucketRoute(connection, credentials.bucket, prefix));
   }
   await waitForObjectsLoaded(page);
 }
@@ -267,7 +268,7 @@ export { expect };
 export async function seedStorageTabsState(
   page: Page,
   state: {
-    tabs: Array<{ id: string; label: string; bucket: string; prefix: string }>;
+    tabs: Array<{ id: string; label: string; bucket: string; prefix: string; connection?: string }>;
     activeTabId: string;
   }
 ): Promise<void> {
diff --git a/e2e/storage/permissions.spec.ts b/e2e/storage/permissions.spec.ts
index b9b2f467..f7852447 100644
--- a/e2e/storage/permissions.spec.ts
+++ b/e2e/storage/permissions.spec.ts
@@ -104,7 +104,7 @@ test.describe('Storage S3 — Permissions', () => {
     await connectToStorage(page, writeonlyCredentials);
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
-    await page.goto(bucketRoute(writeonlyBucket));
+    await page.goto(bucketRoute(new URL(credentials.endpoint).hostname, writeonlyBucket));
 
     await expect(page.getByText('403')).toBeVisible();
     await expect(page.getByText('You do not have permission to access the bucket')).toBeVisible();
@@ -128,7 +128,7 @@ test.describe('Storage S3 — Permissions', () => {
 
     await connectToStorage(page, noAccessCredentials);
     await expect(page).toHaveURL('/storage');
-    await page.goto(bucketRoute(noAccessBucket));
+    await page.goto(bucketRoute(new URL(credentials.endpoint).hostname, noAccessBucket));
 
     await expect(page.getByText('403')).toBeVisible();
     await expect(page.getByText('You do not have permission to access the bucket')).toBeVisible();
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index 0b721d4b..ee7229e0 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -38,7 +38,7 @@ test.describe('Storage S3 — Recent Items', () => {
 
     await connectToStorage(page, credentials);
     await expect(page).toHaveURL('/storage');
-    await page.goto(bucketRoute(credentials.bucket));
+    await page.goto(bucketRoute(new URL(credentials.endpoint).hostname, credentials.bucket));
     await waitForObjectsLoaded(page);
 
     await page.goto('/storage');
@@ -94,7 +94,9 @@ test.describe('Storage S3 — Recent Items', () => {
       await expect(page.locator('tbody').getByText('to-delete.txt')).toBeVisible();
 
       // Delete the file via the UI
-      await page.goto(bucketRoute(credentials.bucket, prefix));
+      await page.goto(
+        bucketRoute(new URL(credentials.endpoint).hostname, credentials.bucket, prefix)
+      );
       await waitForObjectsLoaded(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select to-delete.txt').check();
@@ -137,7 +139,9 @@ test.describe('Storage S3 — Recent Items', () => {
       await expect(page.locator('tbody').getByText('sub', { exact: true })).toBeVisible();
 
       // Delete the parent directory via the UI
-      await page.goto(bucketRoute(credentials.bucket, prefix));
+      await page.goto(
+        bucketRoute(new URL(credentials.endpoint).hostname, credentials.bucket, prefix)
+      );
       await waitForObjectsLoaded(page);
       await page.getByRole('button', { name: 'Toggle selection mode' }).click();
       await page.getByLabel('Select sub').check();
diff --git a/e2e/storage/tabs.spec.ts b/e2e/storage/tabs.spec.ts
index fa9e5881..723665fc 100644
--- a/e2e/storage/tabs.spec.ts
+++ b/e2e/storage/tabs.spec.ts
@@ -20,22 +20,18 @@ test.describe('Storage — Explorer tab bar', () => {
     );
   });
 
-  test('tab bar is hidden when there is only one tab', async ({ page }) => {
+  test('tab bar is visible when there is only one tab', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await expect(page.getByRole('tablist', { name: 'Explorer tabs' })).not.toBeVisible();
+    await expect(page.getByRole('tablist', { name: 'Explorer tabs' })).toBeVisible();
   });
 
   test('add tab via + button shows the tab bar with two tabs', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     await expect(tablist).toBeVisible();
@@ -48,11 +44,7 @@ test.describe('Storage — Explorer tab bar', () => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     const tabs = tablist.getByRole('tab');
@@ -63,15 +55,26 @@ test.describe('Storage — Explorer tab bar', () => {
     await expect(tabs.nth(1)).toHaveAttribute('aria-selected', 'false');
   });
 
-  test('closing a tab removes it and hides the tab bar when only one remains', async ({ page }) => {
+  test('tabs retain separate bucket locations', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
+    const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
+    await page.getByRole('button', { name: 'New Tab' }).click();
+    await page.getByRole('link', { name: credentials.bucket, exact: true }).last().click();
+
+    await expect(tablist.getByRole('tab').nth(1)).toHaveAttribute('title', credentials.bucket);
+    await tablist.getByRole('tab').nth(0).click();
+    await expect(page).toHaveURL(
+      bucketRoute(new URL(credentials.endpoint).hostname, credentials.bucket)
+    );
+  });
+
+  test('closing a tab leaves the tab bar visible when one remains', async ({ page }) => {
+    const credentials = requireGarageCredentials();
+    await connectAndOpenPrefix(page, credentials);
 
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     await expect(tablist.getByRole('tab')).toHaveCount(2);
@@ -81,7 +84,8 @@ test.describe('Storage — Explorer tab bar', () => {
     await firstTab.hover();
     await firstTab.getByRole('button', { name: 'Close tab' }).click();
 
-    await expect(tablist).not.toBeVisible();
+    await expect(tablist).toBeVisible();
+    await expect(tablist.getByRole('tab')).toHaveCount(1);
   });
 
   test('close button is absent when only one tab exists', async ({ page }) => {
@@ -95,29 +99,21 @@ test.describe('Storage — Explorer tab bar', () => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     await expect(tablist.getByRole('tab')).toHaveCount(2);
 
     await tablist.getByRole('tab').nth(1).click({ button: 'middle' });
 
-    await expect(tablist).not.toBeVisible();
+    await expect(tablist).toBeVisible();
   });
 
   test('double-click on a tab starts inline rename', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     await tablist.getByRole('tab').nth(0).dblclick();
@@ -135,11 +131,7 @@ test.describe('Storage — Explorer tab bar', () => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     const firstTab = tablist.getByRole('tab').nth(0);
@@ -160,11 +152,7 @@ test.describe('Storage — Explorer tab bar', () => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     await tablist.getByRole('tab').nth(0).click({ button: 'right' });
@@ -179,11 +167,7 @@ test.describe('Storage — Explorer tab bar', () => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     await tablist.getByRole('tab').nth(0).click({ button: 'right' });
@@ -201,11 +185,7 @@ test.describe('Storage — Explorer tab bar', () => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
     await expect(tablist.getByRole('tab')).toHaveCount(2);
@@ -213,24 +193,15 @@ test.describe('Storage — Explorer tab bar', () => {
     await tablist.getByRole('tab').nth(0).click({ button: 'right' });
     await page.getByRole('menuitem', { name: 'Close tab' }).click();
 
-    // Closing down to one tab hides the tablist (hasTabs is false when only one tab remains)
-    await expect(tablist).not.toBeVisible();
+    await expect(tablist).toBeVisible();
+    await expect(tablist.getByRole('tab')).toHaveCount(1);
   });
 
-  test('New Tab via breadcrumb More Options adds a tab and closes the dropdown', async ({
-    page
-  }) => {
+  test('New Tab button adds a tab', async ({ page }) => {
     const credentials = requireGarageCredentials();
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
-
-    // Dropdown must close after the click
-    await expect(menu).not.toBeVisible();
+    await page.getByRole('button', { name: 'New Tab' }).click();
 
     // Tab bar must appear with 2 tabs
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
@@ -328,11 +299,7 @@ test.describe('Storage — Restore tabs banner', () => {
     // Step 1: navigate to bucket and add a second tab via natural interaction
     await connectAndOpenPrefix(page, credentials);
 
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
     await expect(page.getByRole('tablist', { name: 'Explorer tabs' }).getByRole('tab')).toHaveCount(
       2
     );
@@ -362,11 +329,7 @@ test.describe('Storage — Restore tabs banner', () => {
 
     // Step 1: navigate to bucket and add a second tab via natural interaction
     await connectAndOpenPrefix(page, credentials);
-    await page.getByRole('button', { name: 'More options' }).click();
-
-    const menu = page.getByRole('menu');
-    await expect(menu).toBeVisible();
-    await menu.getByRole('menuitem', { name: 'New Tab' }).click();
+    await page.getByRole('button', { name: 'New Tab' }).click();
     await expect(page.getByRole('tablist', { name: 'Explorer tabs' }).getByRole('tab')).toHaveCount(
       2
     );
@@ -380,7 +343,9 @@ test.describe('Storage — Restore tabs banner', () => {
     await page.getByRole('button', { name: 'Restore tabs' }).click();
 
     // Should navigate to the bucket route
-    await expect(page).toHaveURL(bucketRoute(credentials.bucket));
+    await expect(page).toHaveURL(
+      bucketRoute(new URL(credentials.endpoint).hostname, credentials.bucket)
+    );
 
     // Step 4: tab bar must render with 2 restored tabs
     const tablist = page.getByRole('tablist', { name: 'Explorer tabs' });
diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 67e9655a..915b6069 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -1,17 +1,13 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import { untrack } from 'svelte';
-  import { goto } from '$app/navigation';
-  import { resolve } from '$app/paths';
   import { navigating } from '$app/state';
   import { getStorageState } from '$lib/storage/context.js';
-  import { TabsState } from '$lib/storage/tabs.svelte.js';
-  import { setTabsState } from '$lib/storage/context.js';
+  import { getTabsState } from '$lib/storage/context.js';
   import {
     storageCutCopyEnabled,
     storagePasteEnabled,
-    storageRenameEnabled,
-    storageRestoreTabsEnabled
+    storageRenameEnabled
   } from '$lib/client/feature-flags.js';
   import type { ContextMenuAction } from '$lib/storage/types.js';
   import type { ActionName } from '$lib/storage/types.js';
@@ -37,41 +33,7 @@
 
   const storage = getStorageState();
 
-  function navigateToLocation(bucket: string, prefix: string): void {
-    const encodedPrefix = prefix
-      ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
-      : '';
-    const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
-      bucket: encodeURIComponent(bucket),
-      prefix: encodedPrefix
-    });
-    const url = new URL(basePath, location.origin);
-    if (storage.pageSize) url.searchParams.set('pageSize', String(storage.pageSize));
-    // eslint-disable-next-line svelte/no-navigation-without-resolve -- base path is built with resolve(); URL object is needed to append query params
-    goto(url, { replaceState: false });
-  }
-
-  /** Updates the browser URL bar to reflect the active tab's location without
-   *  triggering a SvelteKit navigation or server refetch. Used when restoring
-   *  an in-memory snapshot on tab switch. */
-  function replaceLocationUrl(bucket: string, prefix: string): void {
-    const encodedPrefix = prefix
-      ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
-      : '';
-    const newPath = resolve('/(app)/storage/[bucket]/[...prefix]', {
-      bucket: encodeURIComponent(bucket),
-      prefix: encodedPrefix
-    });
-    history.replaceState(history.state, '', newPath);
-  }
-
-  const tabsState = new TabsState(storage, {
-    persistEnabled: storageRestoreTabsEnabled,
-    connectionId: storage.connectionId,
-    navigateToLocation,
-    replaceLocationUrl
-  });
-  setTabsState(tabsState);
+  const tabsState = getTabsState();
 
   // Wire up source-tab invalidation so that after a move, source tabs refetch.
   storage.setTabsInvalidationHandler((prefix: string) => {
diff --git a/src/lib/components/storage/explorer/OperationsButton.svelte b/src/lib/components/storage/explorer/OperationsButton.svelte
index 110821e7..4056c44b 100644
--- a/src/lib/components/storage/explorer/OperationsButton.svelte
+++ b/src/lib/components/storage/explorer/OperationsButton.svelte
@@ -256,7 +256,7 @@
       <div
         role="menu"
         aria-label={m.storage_operations_label()}
-        class="rounded-box border-base-300 bg-base-100 absolute right-0 z-60 mt-2 w-96 origin-top-right border shadow-xl"
+        class="rounded-box border-base-300 bg-base-100 absolute right-0 z-60 mt-2 flex max-h-[calc(100dvh-8rem)] w-96 flex-col overflow-hidden border shadow-xl"
       >
         <!-- Active operations section -->
         {#if activeOps.length > 0}
@@ -410,7 +410,7 @@
 
         <!-- History section -->
         {#if hasHistory}
-          <div class="px-3 pt-2.5 pb-2">
+          <div class="flex min-h-0 flex-1 flex-col px-3 pt-2.5 pb-2">
             <div class="mb-2 flex items-center justify-between">
               <p class="text-base-content/50 text-[10px] font-semibold tracking-widest uppercase">
                 {m.storage_operations_history()}
@@ -424,7 +424,7 @@
                 {m.storage_operations_clear_history()}
               </button>
             </div>
-            <ul class="flex flex-col gap-1">
+            <ul class="mb-10 min-h-0 flex-1 space-y-1 overflow-y-auto">
               {#each historyOps as op (op.id)}
                 {@const TypeIcon = typeIconMap[op.type]}
                 <li role="none" class="rounded-md px-2.5 py-2 {statusBgColor(op)}">
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index 2258e345..c2a75803 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -7,11 +7,9 @@
   import IconCheckBox from 'virtual:icons/material-symbols/check-box';
   import IconCheckBoxOutlineBlank from 'virtual:icons/material-symbols/check-box-outline-blank';
   import IconUpload from 'virtual:icons/material-symbols/upload';
-  import IconMoreVert from 'virtual:icons/material-symbols/more-vert';
   import IconPushPin from 'virtual:icons/material-symbols/push-pin';
   import IconPushPinOutline from 'virtual:icons/material-symbols/push-pin-outline';
   import IconFolderZip from 'virtual:icons/material-symbols/folder-zip';
-  import IconTab from 'virtual:icons/material-symbols/tab';
   import IconAdd from 'virtual:icons/material-symbols/add';
   import IconFileCopy from 'virtual:icons/material-symbols/file-copy-outline';
   import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
@@ -75,8 +73,6 @@
     breadcrumbParts.length > MAX_TAIL ? breadcrumbParts.slice(-MAX_TAIL) : breadcrumbParts
   );
 
-  const currentIsPinned = $derived(storage.bookmarks.isPinned(storage.bucket, storage.prefix));
-
   // ── Create menu (inline dropdown) ─────────────────────────────────────
   let createOpen = $state(false);
   let createType = $state<'file' | 'folder'>('file');
@@ -685,70 +681,4 @@
 
   <!-- Operations progress indicator -->
   <OperationsButton />
-
-  <!-- More options (pin current location) — hidden in archive mode -->
-  <div class="dropdown dropdown-end">
-    <button
-      tabindex="0"
-      class="btn btn-ghost btn-xs"
-      title={m.storage_more_options()}
-      aria-label={m.storage_more_options()}
-      aria-haspopup="menu"
-    >
-      <IconMoreVert class="size-3.5" aria-hidden="true" />
-    </button>
-    <ul
-      tabindex="0"
-      role="menu"
-      class="
-        dropdown-content menu rounded-box border-base-300 bg-base-100 z-30 w-52
-        border p-1 shadow-lg
-      "
-    >
-      <li role="none">
-        <button
-          role="menuitem"
-          class="justify-start text-sm"
-          onclick={() => {
-            tabsState.addTab();
-            (document.activeElement as HTMLElement | null)?.blur();
-          }}
-        >
-          <IconTab class="size-4 shrink-0" aria-hidden="true" />
-          {m.storage_tab_new()}
-        </button>
-      </li>
-      {#if !storage.archive.isInArchive}
-        <li role="none">
-          {#if currentIsPinned}
-            {@const PinIcon2 = IconPushPin}
-            <button
-              role="menuitem"
-              class="justify-start text-sm"
-              title={m.storage_action_unpin()}
-              onclick={() => {
-                storage.bookmarks.unpin(storage.bucket, storage.prefix);
-              }}
-            >
-              <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
-              {m.storage_action_unpin()}
-            </button>
-          {:else}
-            {@const PinIcon2 = IconPushPinOutline}
-            <button
-              role="menuitem"
-              class="justify-start text-sm"
-              title={m.storage_action_pin()}
-              onclick={() => {
-                storage.bookmarks.pin(storage.bucket, storage.prefix);
-              }}
-            >
-              <PinIcon2 class="size-4 shrink-0" aria-hidden="true" />
-              {m.storage_action_pin()}
-            </button>
-          {/if}
-        </li>
-      {/if}
-    </ul>
-  </div>
 </div>
diff --git a/src/lib/components/storage/landing/AddBucketModal.svelte b/src/lib/components/storage/landing/AddBucketModal.svelte
index 6102dec6..e3fbba16 100644
--- a/src/lib/components/storage/landing/AddBucketModal.svelte
+++ b/src/lib/components/storage/landing/AddBucketModal.svelte
@@ -67,7 +67,8 @@
         open = false;
         reset();
         await goto(
-          resolve('/(app)/storage/[bucket]/[...prefix]', {
+          resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+            connection: encodeURIComponent(storage.connectionHostname),
             bucket: encodeURIComponent(name),
             prefix: ''
           })
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte b/src/lib/components/storage/landing/BucketGrid.svelte
index 498e9381..f30f7706 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte
+++ b/src/lib/components/storage/landing/BucketGrid.svelte
@@ -49,7 +49,7 @@
   </button>
 </FloatingMenu>
 
-{#if loading}
+{#if loading || !storage.connectionHostname}
   <div
     class="
       grid grid-cols-2 gap-3
@@ -81,7 +81,8 @@
     {#each buckets as bucket (bucket)}
       <TooltipTrigger text={bucket} orientation="down">
         <a
-          href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+          href={resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+            connection: encodeURIComponent(storage.connectionHostname),
             bucket: encodeURIComponent(bucket),
             prefix: ''
           })}
diff --git a/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
index edaf0240..f15b2d46 100644
--- a/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
+++ b/src/lib/components/storage/landing/BucketGrid.svelte.spec.ts
@@ -9,6 +9,7 @@ function createState(): StorageState {
   const state = new StorageState({ connected: true, buckets: [] });
   state.bucket = '';
   state.prefix = '';
+  state.connectionHostname = 's3.example.com';
   return state;
 }
 
diff --git a/src/lib/components/storage/landing/RecentItems.svelte b/src/lib/components/storage/landing/RecentItems.svelte
index 44e5e073..7beab9ab 100644
--- a/src/lib/components/storage/landing/RecentItems.svelte
+++ b/src/lib/components/storage/landing/RecentItems.svelte
@@ -132,7 +132,7 @@
           </td>
           <td>
             <a
-              href={rr(fileHref(file))}
+              href={rr(fileHref(storage.connectionHostname, file))}
               data-sveltekit-preload-data="off"
               class="text-base-content/60 hover:text-primary truncate text-xs"
             >
@@ -158,7 +158,7 @@
               </div>
               <div class="tooltip tooltip-left" data-tip={m.storage_recent_open_folder()}>
                 <a
-                  href={rr(fileHref(file))}
+                  href={rr(fileHref(storage.connectionHostname, file))}
                   data-sveltekit-preload-data="off"
                   class="btn btn-ghost btn-xs"
                   aria-label="{m.storage_recent_open_folder()} — {fileName(file.key)}"
@@ -195,7 +195,7 @@
                 <IconFolderOutline class="text-warning size-4 shrink-0" aria-hidden="true" />
               {/if}
               <a
-                href={rr(locationHref(loc))}
+                href={rr(locationHref(storage.connectionHostname, loc))}
                 data-sveltekit-preload-data="off"
                 class="hover:text-primary font-medium">{locationName(loc)}</a
               >
@@ -203,7 +203,7 @@
           </td>
           <td>
             <a
-              href={rr(locationHref(loc))}
+              href={rr(locationHref(storage.connectionHostname, loc))}
               data-sveltekit-preload-data="off"
               class="text-base-content/60 hover:text-primary truncate text-xs"
             >
@@ -216,7 +216,7 @@
           <td>
             <div class="tooltip tooltip-left" data-tip={m.storage_recent_go_to_location()}>
               <a
-                href={rr(locationHref(loc))}
+                href={rr(locationHref(storage.connectionHostname, loc))}
                 data-sveltekit-preload-data="off"
                 class="btn btn-ghost btn-xs"
                 aria-label="{m.storage_recent_go_to_location()} — {locationName(loc)}"
diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index 21a89886..a9fc5f52 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -11,6 +11,7 @@
   import * as m from '$lib/paraglide/messages.js';
   import { getLocale } from '$lib/paraglide/runtime.js';
   import Modal from '$lib/components/Modal.svelte';
+  import TooltipTrigger from '$lib/components/TooltipTrigger.svelte';
   import TextEditor from '$lib/components/editor/TextEditor.svelte';
   import UnsavedConfirmDialog from './UnsavedConfirmDialog.svelte';
   import CsvPreview from './preview/CsvPreview.svelte';
@@ -33,7 +34,6 @@
     archivePath?: string;
     nestedArchivePath?: string;
   }
-
   interface ColumnStats {
     nullCount: number | null;
     distinctCount: number | null;
@@ -115,19 +115,16 @@
   }: Props = $props();
 
   const storage = getStorageState();
-
-  let preview: PreviewKind = $state({ kind: 'idle' });
-  let blobUrls: string[] = [];
+  let preview: PreviewKind = $state({ kind: 'idle' }),
+    blobUrls: string[] = [];
   let maximized = $state(false);
-  let imageNaturalWidth = $state(0);
-  let imageNaturalHeight = $state(0);
-  let parquetShowingRowsCount = $state(0);
-  let csvShowingRowsCount = $state(0);
+  let imageNaturalWidth = $state(0),
+    imageNaturalHeight = $state(0);
+  let parquetShowingRowsCount = $state(0),
+    csvShowingRowsCount = $state(0);
   let csvTotalRows = $state(0);
-  let parquetTab: 'metadata' | 'data' = $state('metadata');
-  let parquetDataLoading = $state(false);
-
-  // ── Text editor state ──
+  let parquetTab: 'metadata' | 'data' = $state('metadata'),
+    parquetDataLoading = $state(false);
   let editorText = $state('');
   let originalText = $state('');
   let saving = $state(false);
@@ -136,7 +133,6 @@
 
   const dirty = $derived(editorText !== originalText);
 
-  // Prevent accidental browser tab/window close when there are unsaved changes.
   $effect(() => {
     if (!dirty) return;
 
@@ -149,7 +145,6 @@
   });
 
   const filename = $derived(objectKey ? keyToName(objectKey) : '');
-
   function isTooLargeToEdit(): boolean {
     if (preview.kind !== 'text') return false;
     return preview.totalSize > maxEditableFileSize;
@@ -848,7 +843,7 @@
       </div>
 
       {#if maximized}
-        <div class="tooltip tooltip-bottom" data-tip={m.storage_preview_restore()}>
+        <TooltipTrigger text={m.storage_preview_restore()} orientation="down">
           <button
             class="btn btn-ghost btn-sm btn-square"
             onclick={toggleMaximized}
@@ -856,9 +851,9 @@
           >
             <IconCloseFullscreen class="size-4" aria-hidden="true" />
           </button>
-        </div>
+        </TooltipTrigger>
       {:else}
-        <div class="tooltip tooltip-bottom" data-tip={m.storage_preview_maximise()}>
+        <TooltipTrigger text={m.storage_preview_maximise()} orientation="down">
           <button
             class="btn btn-ghost btn-sm btn-square"
             onclick={toggleMaximized}
@@ -866,10 +861,10 @@
           >
             <IconOpenInFull class="size-4" aria-hidden="true" />
           </button>
-        </div>
+        </TooltipTrigger>
       {/if}
 
-      <div class="tooltip tooltip-bottom" data-tip={m.storage_preview_close()}>
+      <TooltipTrigger text={m.storage_preview_close()} orientation="down">
         <button
           class="btn btn-ghost btn-sm btn-square"
           onclick={handleCloseClick}
@@ -877,7 +872,7 @@
         >
           <IconClose class="size-5" aria-hidden="true" />
         </button>
-      </div>
+      </TooltipTrigger>
     </div>
 
     {#if preview.kind === 'parquet'}
@@ -1076,6 +1071,15 @@
               {m.storage_editor_save()}
             {/if}
           </button>
+          <button
+            type="button"
+            class="btn btn-primary btn-sm gap-1.5"
+            onclick={handleSaveAndClose}
+            disabled={!dirty || saving}
+          >
+            <IconSave class="size-4" aria-hidden="true" />
+            {m.storage_editor_save_and_close()}
+          </button>
         {/if}
         <button class="btn btn-ghost btn-sm" onclick={handleCloseClick}>
           {m.storage_preview_close()}
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte b/src/lib/components/storage/modals/preview/CsvPreview.svelte
index 397c2400..e96fbfb9 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte
@@ -349,7 +349,7 @@
         }}
       >
         <table
-          class="table-xs table table-fixed"
+          class="table-xs table"
           style={totalTableWidth > 0 ? `width: ${totalTableWidth}px` : ''}
           aria-label="CSV preview"
         >
diff --git a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
index 4847a190..d85f060b 100644
--- a/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
+++ b/src/lib/components/storage/modals/preview/CsvPreview.svelte.spec.ts
@@ -50,6 +50,14 @@ describe('CsvPreview', () => {
     await expect.element(page.getByRole('cell', { name: '95' })).toBeInTheDocument();
   });
 
+  it('keeps TSV columns wide enough for their content', async () => {
+    const tsv = 'name\tdescription\nAlice\tA description that needs horizontal space';
+    const { container } = render(CsvPreview, { text: tsv });
+
+    const table = container.querySelector('table');
+    expect(table?.className).toContain('min-w-max');
+  });
+
   it('should handle CSV with quoted fields containing commas', async () => {
     const csv =
       'name,address,country\n"Smith, John","123 Main St, Apt 4",Germany\n"Doe, Jane","456 Oak Ave",Austria';
diff --git a/src/lib/components/storage/sidebar/BucketList.svelte b/src/lib/components/storage/sidebar/BucketList.svelte
index 05e784c1..5b3ea428 100644
--- a/src/lib/components/storage/sidebar/BucketList.svelte
+++ b/src/lib/components/storage/sidebar/BucketList.svelte
@@ -44,8 +44,7 @@
   // with optional chaining to avoid crashing the layout and escalating the
   // error to the root fallback handler.
   const activeBucket = $derived.by(() => {
-    const match = page.url?.pathname?.match(/^\/storage\/([^/]+)/);
-    return match ? decodeURIComponent(match[1]) : null;
+    return page.params.bucket ?? null;
   });
   const activePrefix = $derived(page.params.prefix ? page.params.prefix + '/' : '');
 
@@ -189,7 +188,7 @@
   style="width: var(--storage-sidebar-width, {resize.width}px)"
   aria-label={m.storage_buckets_label()}
 >
-  {#if !storage.connected}
+  {#if !storage.connected || !storage.connectionHostname}
     <div class="flex flex-1 items-center justify-center">
       <span class="loading loading-md loading-spinner text-primary" aria-hidden="true"></span>
     </div>
@@ -209,7 +208,7 @@
               <!-- eslint-disable svelte/no-navigation-without-resolve -->
               <TooltipTrigger text={pinnedLabel(pin)} orientation="right">
                 <a
-                  href={pinnedHref(pin)}
+                  href={pinnedHref(storage.connectionHostname, pin)}
                   data-sveltekit-preload-data="off"
                   class="
                     hover:bg-base-200 flex w-full min-w-0 items-center gap-2 px-3 py-1.5
@@ -286,7 +285,8 @@
             <li role="none">
               <TooltipTrigger text={bucket} orientation="right">
                 <a
-                  href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+                  href={resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+                    connection: encodeURIComponent(storage.connectionHostname),
                     bucket: encodeURIComponent(bucket),
                     prefix: ''
                   })}
diff --git a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
index d325a48a..46410405 100644
--- a/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
+++ b/src/lib/components/storage/sidebar/StorageConnectionSidebar.svelte
@@ -130,7 +130,7 @@
   >
     <li role="none">
       <a
-        href={resolve(`/storage/connections/${menuConn.id}/edit`)}
+        href={resolve(`/settings/connections/${menuConn.id}/edit`)}
         role="menuitem"
         onclick={closeContextMenu}
         class="justify-start"
@@ -233,7 +233,7 @@
       {/each}
     </div>
     <div class="mt-2 text-right">
-      <a href={resolve('/storage/connections')} class="link link-primary text-xs">
+      <a href={resolve('/settings/connections')} class="link link-primary text-xs">
         {m.storage_connect_manage()}
       </a>
     </div>
@@ -338,7 +338,7 @@
 
   <div class="border-base-300 border-t p-2">
     <a
-      href={resolve('/storage/connections')}
+      href={resolve('/settings/connections')}
       class="btn btn-ghost btn-xs w-full justify-start text-xs"
     >
       {m.storage_connect_manage()}
diff --git a/src/lib/storage/connection-store.svelte.spec.ts b/src/lib/storage/connection-store.svelte.spec.ts
index e52b1782..a45be5a8 100644
--- a/src/lib/storage/connection-store.svelte.spec.ts
+++ b/src/lib/storage/connection-store.svelte.spec.ts
@@ -1,7 +1,16 @@
 import { describe, it, expect } from 'vitest';
-import { connectionStore, type ConnectionListItem } from './connection-store.svelte.js';
+import {
+  connectionHostname,
+  connectionStore,
+  type ConnectionListItem
+} from './connection-store.svelte.js';
 
 describe('connectionStore', () => {
+  it('extracts the hostname from a connection endpoint', () => {
+    expect(connectionHostname({ endpoint: 's3.example.com:9000' } as ConnectionListItem)).toBe(
+      's3.example.com'
+    );
+  });
   it('starts with null activeConnectionId', () => {
     expect(connectionStore.activeConnectionId).toBeNull();
   });
diff --git a/src/lib/storage/connection-store.svelte.ts b/src/lib/storage/connection-store.svelte.ts
index 2a1f3bef..89fbee80 100644
--- a/src/lib/storage/connection-store.svelte.ts
+++ b/src/lib/storage/connection-store.svelte.ts
@@ -14,6 +14,18 @@ export interface ConnectionListItem {
   updatedAt: string;
 }
 
+export function connectionHostname(connection: ConnectionListItem | null): string {
+  if (!connection?.endpoint) return '';
+  try {
+    return new URL(
+      connection.endpoint.includes('://') ? connection.endpoint : `//${connection.endpoint}`,
+      'http://localhost'
+    ).hostname;
+  } catch {
+    return connection.endpoint.split(':')[0] ?? '';
+  }
+}
+
 class ConnectionStore {
   activeConnectionId = $state<string | null>(null);
   connections = $state<ConnectionListItem[]>([]);
diff --git a/src/lib/storage/display-helpers.spec.ts b/src/lib/storage/display-helpers.spec.ts
index 769091e4..c5822145 100644
--- a/src/lib/storage/display-helpers.spec.ts
+++ b/src/lib/storage/display-helpers.spec.ts
@@ -14,28 +14,35 @@ import type { PinnedLocation, RecentFile, RecentLocation } from './types.js';
 
 vi.mock('$app/paths', () => ({
   resolve: (_route: string, params: Record<string, string>) => {
+    const connection = params.connection ?? '';
     const bucket = params.bucket ?? '';
     const prefix = params.prefix ?? '';
-    return `/storage/${bucket}${prefix ? '/' + prefix : ''}` as never;
+    return `/storage/browse/${connection}/${bucket}${prefix ? '/' + prefix : ''}` as never;
   }
 }));
 
 describe('storageHref', () => {
   it('generates href for bucket root', () => {
-    expect(storageHref('my-bucket', '')).toBe('/storage/my-bucket');
+    expect(storageHref('s3.example.com', 'my-bucket', '')).toBe(
+      '/storage/browse/s3.example.com/my-bucket'
+    );
   });
 
   it('generates href with prefix', () => {
-    expect(storageHref('my-bucket', 'some/path')).toBe('/storage/my-bucket/some/path');
+    expect(storageHref('s3.example.com', 'my-bucket', 'some/path')).toBe(
+      '/storage/browse/s3.example.com/my-bucket/some/path'
+    );
   });
 
   it('encodes special characters in bucket', () => {
-    expect(storageHref('my bucket', '')).toBe('/storage/my%20bucket');
+    expect(storageHref('s3.example.com', 'my bucket', '')).toBe(
+      '/storage/browse/s3.example.com/my%20bucket'
+    );
   });
 
   it('encodes special characters in prefix segments', () => {
-    expect(storageHref('bucket', 'path/with spaces/file.txt')).toBe(
-      '/storage/bucket/path/with%20spaces/file.txt'
+    expect(storageHref('s3.example.com', 'bucket', 'path/with spaces/file.txt')).toBe(
+      '/storage/browse/s3.example.com/bucket/path/with%20spaces/file.txt'
     );
   });
 });
@@ -59,7 +66,9 @@ describe('pinnedLabel', () => {
 describe('pinnedHref', () => {
   it('generates href from pinned location', () => {
     const pin: PinnedLocation = { connectionId: 'c1', bucket: 'my-bucket', prefix: 'some/path' };
-    expect(pinnedHref(pin)).toBe('/storage/my-bucket/some/path');
+    expect(pinnedHref('s3.example.com', pin)).toBe(
+      '/storage/browse/s3.example.com/my-bucket/some/path'
+    );
   });
 });
 
@@ -110,7 +119,7 @@ describe('fileHref', () => {
       visitedAt: '2024-01-01',
       connectionId: 'c1'
     };
-    expect(fileHref(file)).toBe('/storage/my-bucket/a/b');
+    expect(fileHref('s3.example.com', file)).toBe('/storage/browse/s3.example.com/my-bucket/a/b');
   });
 
   it('generates href to bucket root for top-level file', () => {
@@ -121,7 +130,7 @@ describe('fileHref', () => {
       visitedAt: '2024-01-01',
       connectionId: 'c1'
     };
-    expect(fileHref(file)).toBe('/storage/my-bucket');
+    expect(fileHref('s3.example.com', file)).toBe('/storage/browse/s3.example.com/my-bucket');
   });
 });
 
@@ -177,6 +186,8 @@ describe('locationHref', () => {
       visitedAt: '',
       connectionId: 'c1'
     };
-    expect(locationHref(loc)).toBe('/storage/my-bucket/some/path');
+    expect(locationHref('s3.example.com', loc)).toBe(
+      '/storage/browse/s3.example.com/my-bucket/some/path'
+    );
   });
 });
diff --git a/src/lib/storage/display-helpers.ts b/src/lib/storage/display-helpers.ts
index d9e4874f..4e7508e6 100644
--- a/src/lib/storage/display-helpers.ts
+++ b/src/lib/storage/display-helpers.ts
@@ -2,16 +2,20 @@ import { resolve } from '$app/paths';
 import type { ResolvedPathname } from '$app/types';
 import type { PinnedLocation, RecentFile, RecentLocation } from './types.js';
 
-const STORAGE_ROUTE = '/(app)/storage/[bucket]/[...prefix]' as const;
+const STORAGE_ROUTE = '/(app)/storage/browse/[connection]/[bucket]/[...prefix]' as const;
 
 // ── URL helpers ──────────────────────────────────────────────────────────────
 
-export function storageHref(bucket: string, prefix: string): ResolvedPathname {
+export function storageHref(connection: string, bucket: string, prefix: string): ResolvedPathname {
   const encodedBucket = encodeURIComponent(bucket);
   const encodedPrefix = prefix
     ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
     : '';
-  return resolve(STORAGE_ROUTE, { bucket: encodedBucket, prefix: encodedPrefix });
+  return resolve(STORAGE_ROUTE, {
+    connection: encodeURIComponent(connection),
+    bucket: encodedBucket,
+    prefix: encodedPrefix
+  });
 }
 
 // ── Pinned location helpers ──────────────────────────────────────────────────
@@ -22,8 +26,8 @@ export function pinnedLabel(pin: PinnedLocation): string {
   return parts[parts.length - 1] ?? pin.bucket;
 }
 
-export function pinnedHref(pin: PinnedLocation): ResolvedPathname {
-  return storageHref(pin.bucket, pin.prefix);
+export function pinnedHref(connection: string, pin: PinnedLocation): ResolvedPathname {
+  return storageHref(connection, pin.bucket, pin.prefix);
 }
 
 // ── Recent file helpers ──────────────────────────────────────────────────────
@@ -39,11 +43,12 @@ export function fileLocation(file: RecentFile): string {
   return parts.length > 0 ? `${file.bucket} / ${parts.join(' / ')}` : file.bucket;
 }
 
-export function fileHref(file: RecentFile): ResolvedPathname {
+export function fileHref(connection: string, file: RecentFile): ResolvedPathname {
   const parts = file.key.split('/').filter(Boolean);
   parts.pop();
   const encodedPrefix = parts.map(encodeURIComponent).join('/');
   return resolve(STORAGE_ROUTE, {
+    connection: encodeURIComponent(connection),
     bucket: encodeURIComponent(file.bucket),
     prefix: encodedPrefix
   });
@@ -63,6 +68,6 @@ export function locationPath(loc: RecentLocation): string {
   return `${loc.bucket} / ${parts.join(' / ')}`;
 }
 
-export function locationHref(loc: RecentLocation): ResolvedPathname {
-  return storageHref(loc.bucket, loc.prefix);
+export function locationHref(connection: string, loc: RecentLocation): ResolvedPathname {
+  return storageHref(connection, loc.bucket, loc.prefix);
 }
diff --git a/src/lib/storage/state.svelte.ts b/src/lib/storage/state.svelte.ts
index 401f3931..ce6040d5 100644
--- a/src/lib/storage/state.svelte.ts
+++ b/src/lib/storage/state.svelte.ts
@@ -95,6 +95,7 @@ export class StorageState {
 
   // ── Connection identity ──
   connectionId = $state<string | null>(null);
+  connectionHostname = $state('');
 
   // ── Pagination ──
   prevTokens = $state<(string | null)[]>([]);
diff --git a/src/lib/storage/tabs.svelte.spec.ts b/src/lib/storage/tabs.svelte.spec.ts
index 9ec83f76..600e3850 100644
--- a/src/lib/storage/tabs.svelte.spec.ts
+++ b/src/lib/storage/tabs.svelte.spec.ts
@@ -9,6 +9,7 @@ function makeStorage(bucket = 'test-bucket', prefix = ''): StorageState {
   const state = new StorageState({ connected: true });
   state.bucket = bucket;
   state.prefix = prefix;
+  state.connectionHostname = 's3.example.com';
   state.objects = { objects: [], hasNextPage: false, currentPage: 1, pageSize: 25 };
   return state;
 }
@@ -70,12 +71,12 @@ describe('TabsState', () => {
   // ── hasTabs ───────────────────────────────────────────────────────────────
 
   describe('hasTabs', () => {
-    it('returns false with one tab', () => {
+    it('returns true with one tab', () => {
       const storage = makeStorage();
       const { ts } = makeTabs(storage);
       ts.ensureInitialTab();
 
-      expect(ts.hasTabs).toBe(false);
+      expect(ts.hasTabs).toBe(true);
     });
 
     it('returns true with two or more tabs', () => {
@@ -150,7 +151,7 @@ describe('TabsState', () => {
       ts.switchTo(ts.tabs[0].id);
 
       expect(storage.prefix).toBe('a/');
-      expect(replaceLocationUrl).toHaveBeenCalledWith('bucket', 'a/');
+      expect(replaceLocationUrl).toHaveBeenCalledWith('s3.example.com', 'bucket', 'a/');
     });
 
     it('calls navigateToLocation for a stub tab', () => {
@@ -170,7 +171,7 @@ describe('TabsState', () => {
 
       ts.switchTo(ts.tabs[1].id);
 
-      expect(navigateToLocation).toHaveBeenCalledWith('bucket', 'b/');
+      expect(navigateToLocation).toHaveBeenCalledWith('s3.example.com', 'bucket', 'b/');
     });
 
     it('sets activeTabId to the switched-to tab', () => {
@@ -282,6 +283,20 @@ describe('TabsState', () => {
   // ── syncActiveTab ─────────────────────────────────────────────────────────
 
   describe('syncActiveTab', () => {
+    it('keeps other tabs at their own bucket when the active tab changes bucket', () => {
+      const storage = makeStorage('bucket-a', '');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      ts.addTab();
+
+      storage.bucket = 'bucket-b';
+      storage.prefix = '';
+      ts.syncActiveTab();
+
+      expect(ts.tabs[0].snapshot.bucket).toBe('bucket-a');
+      expect(ts.tabs[1].snapshot.bucket).toBe('bucket-b');
+    });
+
     it('updates snapshot bucket and prefix from current storage state', () => {
       const storage = makeStorage('bucket', 'old/');
       const { ts } = makeTabs(storage);
@@ -514,7 +529,7 @@ describe('TabsState', () => {
       ts.restorePersistedTabs(saved);
 
       // Active tab (b/) is a stub and storage is at a/ → navigate is called
-      expect(navigateToLocation).toHaveBeenCalledWith('bucket', 'b/');
+      expect(navigateToLocation).toHaveBeenCalledWith('s3.example.com', 'bucket', 'b/');
     });
   });
 
diff --git a/src/lib/storage/tabs.svelte.ts b/src/lib/storage/tabs.svelte.ts
index bbf7d9ea..bbfa7407 100644
--- a/src/lib/storage/tabs.svelte.ts
+++ b/src/lib/storage/tabs.svelte.ts
@@ -8,6 +8,7 @@ import { keyToName } from './utils.js';
 // ── Tab data ─────────────────────────────────────────────────────────────────
 
 export interface TabSnapshot {
+  connection: string;
   bucket: string;
   prefix: string;
   objects: StoragePage;
@@ -41,6 +42,7 @@ export interface PersistedTab {
   label: string;
   bucket: string;
   prefix: string;
+  connection?: string;
 }
 
 export interface PersistedTabsState {
@@ -65,11 +67,11 @@ export class TabsState {
   private storage: StorageState;
   private persistEnabled: boolean;
   private connectionId: string | null;
-  private navigateToLocation: ((bucket: string, prefix: string) => void) | null;
-  private replaceLocationUrl: ((bucket: string, prefix: string) => void) | null;
+  private navigateToLocation: ((connection: string, bucket: string, prefix: string) => void) | null;
+  private replaceLocationUrl: ((connection: string, bucket: string, prefix: string) => void) | null;
 
   get hasTabs(): boolean {
-    return this.tabs.length > 1;
+    return this.tabs.length > 0;
   }
 
   constructor(
@@ -77,8 +79,8 @@ export class TabsState {
     options?: {
       persistEnabled?: boolean;
       connectionId?: string | null;
-      navigateToLocation?: (bucket: string, prefix: string) => void;
-      replaceLocationUrl?: (bucket: string, prefix: string) => void;
+      navigateToLocation?: (connection: string, bucket: string, prefix: string) => void;
+      replaceLocationUrl?: (connection: string, bucket: string, prefix: string) => void;
     }
   ) {
     this.storage = storage;
@@ -92,6 +94,7 @@ export class TabsState {
 
   private captureSnapshot(): TabSnapshot {
     return {
+      connection: this.storage.connectionHostname,
       bucket: this.storage.bucket,
       prefix: this.storage.prefix,
       objects: this.storage.objects,
@@ -120,6 +123,7 @@ export class TabsState {
 
   private restoreSnapshot(snapshot: TabSnapshot): void {
     this.storage.bucket = snapshot.bucket;
+    this.storage.connectionHostname = snapshot.connection;
     this.storage.prefix = snapshot.prefix;
     this.storage.objects = snapshot.objects;
     this.storage.prevTokens = [...snapshot.prevTokens];
@@ -134,7 +138,7 @@ export class TabsState {
     });
     this.storage.loading = false;
     this.storage.clearSelection();
-    this.replaceLocationUrl?.(snapshot.bucket, snapshot.prefix);
+    this.replaceLocationUrl?.(snapshot.connection, snapshot.bucket, snapshot.prefix);
   }
 
   // ── Persistence ──────────────────────────────────────────────────────────
@@ -146,7 +150,8 @@ export class TabsState {
         id: t.id,
         label: t.label,
         bucket: t.snapshot.bucket,
-        prefix: t.snapshot.prefix
+        prefix: t.snapshot.prefix,
+        connection: t.snapshot.connection
       })),
       activeTabId: this.activeTabId ?? '',
       connectionId: this.connectionId ?? undefined
@@ -189,6 +194,7 @@ export class TabsState {
       label: pt.label,
       stub: true,
       snapshot: {
+        connection: pt.connection ?? this.storage.connectionHostname,
         bucket: pt.bucket,
         prefix: pt.prefix,
         objects: EMPTY_PAGE,
@@ -215,12 +221,17 @@ export class TabsState {
     const activeTab = this.tabs.find((t) => t.id === mappedActiveId)!;
 
     if (
+      this.storage.connectionHostname === activeTab.snapshot.connection &&
       this.storage.bucket === activeTab.snapshot.bucket &&
       this.storage.prefix === activeTab.snapshot.prefix
     ) {
       this.markActiveTabLoaded();
     } else if (this.navigateToLocation) {
-      this.navigateToLocation(activeTab.snapshot.bucket, activeTab.snapshot.prefix);
+      this.navigateToLocation(
+        activeTab.snapshot.connection,
+        activeTab.snapshot.bucket,
+        activeTab.snapshot.prefix
+      );
     } else {
       this.markActiveTabLoaded();
     }
@@ -250,6 +261,8 @@ export class TabsState {
         const activeTab = activeIdx >= 0 ? saved.tabs[activeIdx] : saved.tabs[0];
         if (
           activeTab &&
+          this.storage.connectionHostname ===
+            (activeTab.connection ?? this.storage.connectionHostname) &&
           this.storage.bucket === activeTab.bucket &&
           this.storage.prefix === activeTab.prefix
         ) {
@@ -320,7 +333,7 @@ export class TabsState {
     this.saveToPersistence();
 
     if (tab.stub && this.navigateToLocation) {
-      this.navigateToLocation(tab.snapshot.bucket, tab.snapshot.prefix);
+      this.navigateToLocation(tab.snapshot.connection, tab.snapshot.bucket, tab.snapshot.prefix);
     } else {
       this.restoreSnapshot(tab.snapshot);
     }
@@ -341,7 +354,11 @@ export class TabsState {
       const nextTab = newTabs[newIdx];
       this.activeTabId = nextTab.id;
       if (nextTab.stub && this.navigateToLocation) {
-        this.navigateToLocation(nextTab.snapshot.bucket, nextTab.snapshot.prefix);
+        this.navigateToLocation(
+          nextTab.snapshot.connection,
+          nextTab.snapshot.bucket,
+          nextTab.snapshot.prefix
+        );
       } else {
         this.restoreSnapshot(nextTab.snapshot);
       }
diff --git a/src/routes/(app)/api/storage/preview/+server.ts b/src/routes/(app)/api/storage/preview/+server.ts
index 7bcdcfd5..0c2cc0c4 100644
--- a/src/routes/(app)/api/storage/preview/+server.ts
+++ b/src/routes/(app)/api/storage/preview/+server.ts
@@ -65,15 +65,10 @@ export const GET: RequestHandler = async (event) => {
       else if (lowerKey.endsWith('.tsv')) contentType = 'text/tab-separated-values';
     }
 
-    // CSV files — use row-based NDJSON streaming (regardless of flag, so the
-    // client always receives structured data). The offset/limit cap above
-    // restricts chunked loading when the feature is disabled.
+    // CSV files use row-based NDJSON streaming. TSV is deliberately handled by
+    // the text preview below so CsvPreview can parse its tab delimiter directly.
     const isCsv =
-      contentType === 'text/csv' ||
-      contentType === 'application/csv' ||
-      contentType === 'text/tab-separated-values' ||
-      lowerKey.endsWith('.csv') ||
-      lowerKey.endsWith('.tsv');
+      contentType === 'text/csv' || contentType === 'application/csv' || lowerKey.endsWith('.csv');
 
     if (isCsv) {
       return await getCsvPreview(
diff --git a/src/routes/(app)/api/storage/preview/server.test.ts b/src/routes/(app)/api/storage/preview/server.test.ts
index 015d1d0b..098c1afc 100644
--- a/src/routes/(app)/api/storage/preview/server.test.ts
+++ b/src/routes/(app)/api/storage/preview/server.test.ts
@@ -109,20 +109,18 @@ describe('GET /api/storage/preview', () => {
     );
   });
 
-  it('normalises Excel TSV content type', async () => {
+  it('normalises Excel TSV content type for text preview', async () => {
     mockGetMetadata.mockResolvedValue({ contentType: 'application/vnd.ms-excel', size: 200 });
 
     await GET(mockEvent('bucket=b1&key=data.tsv'));
 
-    expect(getCsvPreview).toHaveBeenCalledWith(
+    expect(streamPreview).toHaveBeenCalledWith(
       expect.anything(),
       'data.tsv',
-      0,
-      250,
       'text/tab-separated-values',
       200,
-      expect.anything(),
-      false
+      'client',
+      expect.anything()
     );
   });
 
@@ -149,19 +147,17 @@ describe('GET /api/storage/preview', () => {
 
     await GET(mockEvent('bucket=b1&key=data.tsv'));
 
-    expect(getCsvPreview).toHaveBeenCalledWith(
+    expect(streamPreview).toHaveBeenCalledWith(
       expect.anything(),
       'data.tsv',
-      0,
-      250,
       'text/tab-separated-values',
       150,
-      expect.anything(),
-      false
+      'client',
+      expect.anything()
     );
   });
 
-  it('streams TSV file with .tsv extension and generic content type', async () => {
+  it('uses text preview for TSV files with generic content types', async () => {
     mockGetMetadata.mockResolvedValue({
       contentType: 'application/octet-stream',
       size: 75
@@ -169,15 +165,13 @@ describe('GET /api/storage/preview', () => {
 
     await GET(mockEvent('bucket=b1&key=report.tsv'));
 
-    expect(getCsvPreview).toHaveBeenCalledWith(
+    expect(streamPreview).toHaveBeenCalledWith(
       expect.anything(),
       'report.tsv',
-      0,
-      250,
       'application/octet-stream',
       75,
-      expect.anything(),
-      false
+      'client',
+      expect.anything()
     );
   });
 
diff --git a/src/routes/(app)/storage/connections/+page.server.ts b/src/routes/(app)/settings/connections/+page.server.ts
similarity index 96%
rename from src/routes/(app)/storage/connections/+page.server.ts
rename to src/routes/(app)/settings/connections/+page.server.ts
index 383dd0b1..adf669d6 100644
--- a/src/routes/(app)/storage/connections/+page.server.ts
+++ b/src/routes/(app)/settings/connections/+page.server.ts
@@ -35,6 +35,6 @@ export const actions: Actions = {
     await deleteConnection(userId, connectionId);
     log.info({ connectionId }, 'storage connection deleted from management page');
 
-    throw redirect(303, '/storage/connections');
+    throw redirect(303, '/settings/connections');
   }
 };
diff --git a/src/routes/(app)/storage/connections/+page.svelte b/src/routes/(app)/settings/connections/+page.svelte
similarity index 98%
rename from src/routes/(app)/storage/connections/+page.svelte
rename to src/routes/(app)/settings/connections/+page.svelte
index 5ad4d356..fc765ea9 100644
--- a/src/routes/(app)/storage/connections/+page.svelte
+++ b/src/routes/(app)/settings/connections/+page.svelte
@@ -160,7 +160,7 @@
   >
     <li role="none">
       <a
-        href={resolve(`/storage/connections/${menuConn.id}/edit`)}
+        href={resolve(`/settings/connections/${menuConn.id}/edit`)}
         role="menuitem"
         onclick={closeContextMenu}
       >
diff --git a/src/routes/(app)/storage/connections/[id]/+layout.svelte b/src/routes/(app)/settings/connections/[id]/+layout.svelte
similarity index 93%
rename from src/routes/(app)/storage/connections/[id]/+layout.svelte
rename to src/routes/(app)/settings/connections/[id]/+layout.svelte
index 6c22eadf..1aa091a2 100644
--- a/src/routes/(app)/storage/connections/[id]/+layout.svelte
+++ b/src/routes/(app)/settings/connections/[id]/+layout.svelte
@@ -11,7 +11,7 @@
   const connectionId = $derived(page.params.id);
 
   function handleSelect(conn: ConnectionMetadata) {
-    goto(resolve(`/storage/connections/${conn.id}/edit`));
+    goto(resolve(`/settings/connections/${conn.id}/edit`));
   }
 </script>
 
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts b/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
similarity index 99%
rename from src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
rename to src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
index 307ef566..38d66ff1 100644
--- a/src/routes/(app)/storage/connections/[id]/edit/+page.server.ts
+++ b/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
@@ -27,7 +27,7 @@ export const load: PageServerLoad = async ({ locals, params }) => {
 
   if (rows.length === 0) {
     locals.logger.debug({ connection_id: params.id }, 'connection not found, redirecting');
-    throw redirect(303, '/storage/connections');
+    throw redirect(303, '/settings/connections');
   }
 
   const row = rows[0];
diff --git a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte b/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
similarity index 98%
rename from src/routes/(app)/storage/connections/[id]/edit/+page.svelte
rename to src/routes/(app)/settings/connections/[id]/edit/+page.svelte
index 4095a547..f4539019 100644
--- a/src/routes/(app)/storage/connections/[id]/edit/+page.svelte
+++ b/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
@@ -33,7 +33,7 @@
         if (result.type === 'success' && result.data?.form?.message === 'ok') {
           cancel();
           bypassDirtyCheck = true;
-          goto(resolve('/storage/connections'));
+          goto(resolve('/settings/connections'));
         }
       }
     }
@@ -321,7 +321,7 @@
   </form>
 
   <div class="mt-3 flex items-center gap-3">
-    <a href={resolve('/storage/connections')} class="btn btn-ghost">
+    <a href={resolve('/settings/connections')} class="btn btn-ghost">
       ← {m.storage_connections_title()}
     </a>
   </div>
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
index a61dccf7..8fd67399 100644
--- a/src/routes/(app)/storage/+error.svelte
+++ b/src/routes/(app)/storage/+error.svelte
@@ -10,14 +10,11 @@
   const storage = getStorageState();
   storage.loading = false;
 
-  const bucket = $derived(
-    page.params.bucket ||
-      decodeURIComponent(page.url?.pathname?.split('/').filter(Boolean)[1] ?? '')
-  );
+  const bucket = $derived(page.params.bucket ?? '');
 
   const prefixParts = $derived.by(() => {
     const segments = page.url?.pathname?.split('/').filter(Boolean) ?? [];
-    return decodeURIComponent(segments.slice(2).join('/') || '');
+    return decodeURIComponent(segments.slice(4).join('/') || '');
   });
 
   function bucketErrorMessage(status: number, name: string): string | null {
@@ -39,7 +36,8 @@
     >
       <span class="flex shrink-0 items-center gap-1">
         <a
-          href={resolve('/(app)/storage/[bucket]/[...prefix]', {
+          href={resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+            connection: encodeURIComponent(storage.connectionHostname),
             bucket: encodeURIComponent(bucket),
             prefix: ''
           })}
diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 96374f74..4bc54c7b 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -1,12 +1,16 @@
 <script lang="ts">
   import { untrack } from 'svelte';
+  import { goto } from '$app/navigation';
+  import { resolve } from '$app/paths';
   import { page } from '$app/state';
   import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
   import { StorageState } from '$lib/storage/state.svelte.js';
-  import { setStorageState } from '$lib/storage/context.js';
+  import { setStorageState, setTabsState } from '$lib/storage/context.js';
   import StorageModals from '$lib/components/storage/modals/StorageModals.svelte';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+  import { connectionHostname, connectionStore } from '$lib/storage/connection-store.svelte.js';
   import { createFetchStorageApi } from '$lib/storage/api.js';
+  import { TabsState } from '$lib/storage/tabs.svelte.js';
+  import { storageRestoreTabsEnabled } from '$lib/client/feature-flags.js';
 
   let { children, data } = $props();
 
@@ -23,6 +27,26 @@
   );
   setStorageState(storage);
 
+  function locationPath(connection: string, bucket: string, prefix: string): string {
+    return resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+      connection: encodeURIComponent(connection),
+      bucket: encodeURIComponent(bucket),
+      prefix: prefix ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/') : ''
+    });
+  }
+
+  const tabsState = new TabsState(storage, {
+    persistEnabled: storageRestoreTabsEnabled,
+    connectionId: storage.connectionId,
+    navigateToLocation: (connection, bucket, prefix) => {
+      void goto(locationPath(connection, bucket, prefix));
+    },
+    replaceLocationUrl: (connection, bucket, prefix) => {
+      history.replaceState(history.state, '', locationPath(connection, bucket, prefix));
+    }
+  });
+  setTabsState(tabsState);
+
   // Keep layout-level data in sync when SvelteKit re-runs the load function
   $effect(() => {
     storage.connected = data.connected;
@@ -32,10 +56,11 @@
 
   $effect(() => {
     storage.connectionId = connectionStore.activeConnectionId;
+    storage.connectionHostname = connectionHostname(connectionStore.activeConnection);
   });
 
   // Connections management pages have their own full-page layout — no sidebar.
-  const isConnectionsRoute = $derived(page.url.pathname.startsWith('/storage/connections'));
+  const isConnectionsRoute = $derived(page.url.pathname.startsWith('/settings/connections'));
 </script>
 
 {#if !isConnectionsRoute && (data.connected || (data.hydrating && data.hasActiveConnection))}
diff --git a/src/routes/(app)/storage/+page.svelte b/src/routes/(app)/storage/+page.svelte
index 0a4d8f45..27527a88 100644
--- a/src/routes/(app)/storage/+page.svelte
+++ b/src/routes/(app)/storage/+page.svelte
@@ -80,7 +80,8 @@
 
     savedTabs = null;
     goto(
-      resolve('/(app)/storage/[bucket]/[...prefix]', {
+      resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+        connection: encodeURIComponent(storage.connectionHostname),
         bucket: encodeURIComponent(active.bucket),
         prefix: encodedPrefix
       })
@@ -97,7 +98,7 @@
   });
 </script>
 
-{#if data.connected || (data.hydrating && data.hasActiveConnection)}
+{#if data.connected && storage.connectionHostname}
   <div class="relative flex h-full min-h-0 flex-col overflow-x-hidden overflow-y-auto p-2">
     {#if navigating?.to?.url.pathname.startsWith('/storage/')}
       <div
@@ -147,13 +148,13 @@
       </div>
       <p class="text-base-content/60 text-sm">{m.storage_buckets_subtitle()}</p>
     </div>
-    <BucketGrid buckets={storage.buckets} loading={data.hydrating} />
+    <BucketGrid buckets={storage.buckets} loading={data.hydrating || !storage.connectionHostname} />
   </div>
   <div class="relative flex h-full min-h-0 flex-col overflow-y-auto p-2">
     <RecentItems loading={data.hydrating} />
   </div>
   <AddBucketModal bind:open={addBucketOpen} />
-{:else if data.hydrating && !data.hasActiveConnection}
+{:else if data.connected || (data.hydrating && data.hasActiveConnection)}
   <div class="flex h-full items-center justify-center">
     <span class="loading loading-lg loading-spinner text-primary" aria-hidden="true"></span>
   </div>
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.server.ts
similarity index 77%
rename from src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
rename to src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.server.ts
index c0778da5..b1cb8968 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.server.ts
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.server.ts
@@ -9,5 +9,6 @@ export const load: PageServerLoad = async ({ params, locals }) => {
 
   const prefix = params.prefix ? params.prefix + '/' : '';
   const bucket = params.bucket;
-  return { bucket, prefix, activeConnectionId: activeId };
+  const connection = params.connection;
+  return { connection, bucket, prefix, activeConnectionId: activeId };
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
similarity index 75%
rename from src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
rename to src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
index 8efa9929..12f214b3 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
@@ -9,19 +9,32 @@
   let { data } = $props();
   const storage = getStorageState();
 
+  const routePath = $derived(
+    resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+      connection: encodeURIComponent(data.connection),
+      bucket: encodeURIComponent(data.bucket),
+      prefix: data.prefix
+        ? data.prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
+        : ''
+    })
+  );
+  const isCurrentRoute = $derived(page.url.pathname === routePath);
+
   // Set bucket/prefix immediately so breadcrumb renders correctly during SSR
   // ($effect doesn't run on the server, but data is available from the load function)
   // svelte-ignore state_referenced_locally
-  storage.bucket = data.bucket;
+  if (!browser || isCurrentRoute) storage.connectionHostname = data.connection;
+  // svelte-ignore state_referenced_locally
+  if (!browser || isCurrentRoute) storage.bucket = data.bucket;
   // svelte-ignore state_referenced_locally
-  storage.prefix = data.prefix;
+  if (!browser || isCurrentRoute) storage.prefix = data.prefix;
 
   // During SSR, $effect doesn't run, so storage.loading stays false and the
   // empty state renders instead of the loading overlay. Setting loading here
   // when hydrating ensures the loading spinner is present in the SSR HTML,
   // preventing a flash of empty state on F5 reload before the client load completes.
   // svelte-ignore state_referenced_locally
-  if (data.hydrating) storage.loading = true;
+  if (data.hydrating && (!browser || isCurrentRoute)) storage.loading = true;
 
   let hydrated = false;
 
@@ -31,8 +44,9 @@
       ? prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';
 
-    const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
-      bucket: encodeURIComponent(data.bucket),
+    const basePath = resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+      connection: encodeURIComponent(storage.connectionHostname),
+      bucket: encodeURIComponent(storage.bucket),
       prefix: encodedPrefix
     });
 
@@ -51,7 +65,8 @@
       ? storage.prefix.replace(/\/$/, '').split('/').map(encodeURIComponent).join('/')
       : '';
 
-    const basePath = resolve('/(app)/storage/[bucket]/[...prefix]', {
+    const basePath = resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
+      connection: encodeURIComponent(storage.connectionHostname),
       bucket: encodeURIComponent(storage.bucket),
       prefix: encodedPrefix
     });
@@ -72,6 +87,7 @@
   // so the spinner shows while the client-side load re-runs. Subsequent renders
   // from client navigation call syncFromServer normally.
   $effect(() => {
+    if (!isCurrentRoute) return;
     if (!hydrated) {
       hydrated = true;
       // First client render — SSR data has hydrating:true. Set loading so the
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.ts
similarity index 85%
rename from src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
rename to src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.ts
index a30bf87d..6b662a16 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.ts
@@ -1,6 +1,6 @@
 import { browser } from '$app/environment';
 import { error, redirect } from '@sveltejs/kit';
-import { connectionStore } from '$lib/storage/connection-store.svelte.js';
+import { connectionHostname, connectionStore } from '$lib/storage/connection-store.svelte.js';
 import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 import * as m from '$lib/paraglide/messages.js';
 import type { PageLoad } from './$types';
@@ -23,10 +23,13 @@ const EMPTY_PAGE: StoragePage = {
  * and updates the page after hydration.
  */
 export const load: PageLoad = async ({ fetch, url, data }) => {
-  const { bucket, prefix } = data;
+  const { connection, bucket, prefix } = data;
 
   const connectionId = connectionStore.activeConnectionId ?? data.activeConnectionId;
   if (!connectionId) throw redirect(303, '/storage');
+  if (browser && connectionHostname(connectionStore.activeConnection) !== connection) {
+    throw redirect(303, '/storage');
+  }
 
   const query = new URLSearchParams({ bucket, prefix: prefix ?? '' });
 
@@ -42,7 +45,7 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
       throw error(res.status, body.message ?? 'Failed to load objects');
     }
 
-    return { bucket, prefix, objects: EMPTY_PAGE, hydrating: true };
+    return { connection, bucket, prefix, objects: EMPTY_PAGE, hydrating: true };
   }
 
   const continuationToken = url.searchParams.get('continuationToken');
@@ -63,5 +66,5 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
   }
 
   const objects = (await res.json()) as StoragePage;
-  return { bucket, prefix, objects, hydrating: false };
+  return { connection, bucket, prefix, objects, hydrating: false };
 };
diff --git a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/page.server.test.ts
similarity index 77%
rename from src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
rename to src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/page.server.test.ts
index a498c540..df88db3d 100644
--- a/src/routes/(app)/storage/[bucket]/[...prefix]/page.server.test.ts
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/page.server.test.ts
@@ -5,6 +5,7 @@ import { load } from './+page.server.js';
 function mockEvent(
   opts: {
     bucket?: string;
+    connection?: string;
     prefix?: string;
     activeConnectionId?: string | null;
     session?: Record<string, unknown> | null;
@@ -23,14 +24,23 @@ function mockEvent(
       user: { id: 'test-user' },
       session
     },
-    params: { bucket: opts.bucket ?? 'my-bucket', prefix: opts.prefix ?? '' }
+    params: {
+      connection: opts.connection ?? 's3.example.com',
+      bucket: opts.bucket ?? 'my-bucket',
+      prefix: opts.prefix ?? ''
+    }
   } as unknown as Parameters<typeof load>[0];
 }
 
 describe('bucket page server load', () => {
   it('returns bucket and prefix when an active connection exists', async () => {
     const result = await load(mockEvent({ activeConnectionId: 'conn-123' }));
-    expect(result).toEqual({ bucket: 'my-bucket', prefix: '', activeConnectionId: 'conn-123' });
+    expect(result).toEqual({
+      connection: 's3.example.com',
+      bucket: 'my-bucket',
+      prefix: '',
+      activeConnectionId: 'conn-123'
+    });
   });
 
   it('redirects to /storage when no active connection', async () => {
@@ -48,6 +58,7 @@ describe('bucket page server load', () => {
   it('adds trailing slash to prefix', async () => {
     const result = await load(mockEvent({ prefix: 'data/2024', activeConnectionId: 'conn-123' }));
     expect(result).toEqual({
+      connection: 's3.example.com',
       bucket: 'my-bucket',
       prefix: 'data/2024/',
       activeConnectionId: 'conn-123'
@@ -58,6 +69,11 @@ describe('bucket page server load', () => {
     const result = await load(
       mockEvent({ bucket: 'test-bucket', prefix: '', activeConnectionId: 'conn-123' })
     );
-    expect(result).toEqual({ bucket: 'test-bucket', prefix: '', activeConnectionId: 'conn-123' });
+    expect(result).toEqual({
+      connection: 's3.example.com',
+      bucket: 'test-bucket',
+      prefix: '',
+      activeConnectionId: 'conn-123'
+    });
   });
 });

From f9bd54d27fc15d1481d341806a38870b8b07d8f1 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 31 Aug 2026 09:58:01 +0200
Subject: [PATCH 129/136] fix tab and bucket switching behavior

---
 .../storage/explorer/FileExplorer.svelte      | 11 +++++
 src/lib/storage/tabs.svelte.spec.ts           | 15 ++++++
 src/lib/storage/tabs.svelte.ts                | 46 +++++++++++++++++++
 .../[bucket]/[...prefix]/+page.svelte         |  4 ++
 4 files changed, 76 insertions(+)

diff --git a/src/lib/components/storage/explorer/FileExplorer.svelte b/src/lib/components/storage/explorer/FileExplorer.svelte
index 915b6069..931e8fab 100644
--- a/src/lib/components/storage/explorer/FileExplorer.svelte
+++ b/src/lib/components/storage/explorer/FileExplorer.svelte
@@ -1,6 +1,7 @@
 <script lang="ts">
   import * as m from '$lib/paraglide/messages.js';
   import { untrack } from 'svelte';
+  import { beforeNavigate } from '$app/navigation';
   import { navigating } from '$app/state';
   import { getStorageState } from '$lib/storage/context.js';
   import { getTabsState } from '$lib/storage/context.js';
@@ -35,6 +36,16 @@
 
   const tabsState = getTabsState();
 
+  beforeNavigate((navigation) => {
+    const params = navigation.to?.params;
+    const connection = params?.connection;
+    const bucket = params?.bucket;
+    if (!connection || !bucket) return;
+
+    const prefix = params.prefix ? `${params.prefix}/` : '';
+    tabsState.prepareActiveTabForNavigation(connection, bucket, prefix);
+  });
+
   // Wire up source-tab invalidation so that after a move, source tabs refetch.
   storage.setTabsInvalidationHandler((prefix: string) => {
     tabsState.setStalePrefix(prefix);
diff --git a/src/lib/storage/tabs.svelte.spec.ts b/src/lib/storage/tabs.svelte.spec.ts
index 600e3850..b8ce5bd2 100644
--- a/src/lib/storage/tabs.svelte.spec.ts
+++ b/src/lib/storage/tabs.svelte.spec.ts
@@ -185,6 +185,21 @@ describe('TabsState', () => {
 
       expect(ts.activeTabId).toBe(firstId);
     });
+
+    it('does not let a pending navigation overwrite a tab switched to in the meantime', () => {
+      const storage = makeStorage('first-bucket', 'first/');
+      const { ts } = makeTabs(storage);
+      ts.ensureInitialTab();
+      const firstTabId = ts.activeTabId!;
+      ts.addTab();
+
+      ts.prepareActiveTabForNavigation('s3.example.com', 'second-bucket', 'second/');
+      ts.switchTo(firstTabId);
+
+      expect(ts.canSyncServerLocation('s3.example.com', 'second-bucket', 'second/')).toBe(false);
+      expect(storage.bucket).toBe('first-bucket');
+      expect(storage.prefix).toBe('first/');
+    });
   });
 
   // ── closeTab ──────────────────────────────────────────────────────────────
diff --git a/src/lib/storage/tabs.svelte.ts b/src/lib/storage/tabs.svelte.ts
index bbfa7407..ecf6194c 100644
--- a/src/lib/storage/tabs.svelte.ts
+++ b/src/lib/storage/tabs.svelte.ts
@@ -65,6 +65,12 @@ export class TabsState {
   activeTabId = $state<string | null>(null);
 
   private storage: StorageState;
+  private pendingNavigation: {
+    tabId: string;
+    connection: string;
+    bucket: string;
+    prefix: string;
+  } | null = null;
   private persistEnabled: boolean;
   private connectionId: string | null;
   private navigateToLocation: ((connection: string, bucket: string, prefix: string) => void) | null;
@@ -298,6 +304,9 @@ export class TabsState {
   /** Updates the active tab's snapshot to reflect current storage state. */
   syncActiveTab(): void {
     if (!this.activeTabId) return;
+    // The shared storage state still contains the previous location until the
+    // destination load completes, so it must not overwrite this tab's snapshot.
+    if (this.pendingNavigation?.tabId === this.activeTabId) return;
     const idx = this.tabs.findIndex((t) => t.id === this.activeTabId);
     if (idx === -1) return;
     // eslint-disable-next-line security/detect-object-injection
@@ -312,6 +321,41 @@ export class TabsState {
     this.saveToPersistence();
   }
 
+  /** Associates an in-flight route navigation with the current tab. */
+  prepareActiveTabForNavigation(connection: string, bucket: string, prefix: string): void {
+    if (!this.activeTabId) return;
+    this.pendingNavigation = { tabId: this.activeTabId, connection, bucket, prefix };
+  }
+
+  /** Returns whether the current tab owns server data for this location. */
+  canSyncServerLocation(connection: string, bucket: string, prefix: string): boolean {
+    if (!this.activeTabId) return true;
+
+    if (this.pendingNavigation) {
+      const pending = this.pendingNavigation;
+      return (
+        pending.tabId === this.activeTabId &&
+        pending.connection === connection &&
+        pending.bucket === bucket &&
+        pending.prefix === prefix
+      );
+    }
+
+    const activeTab = this.tabs.find((tab) => tab.id === this.activeTabId);
+    return (
+      activeTab?.snapshot.connection === connection &&
+      activeTab.snapshot.bucket === bucket &&
+      activeTab.snapshot.prefix === prefix
+    );
+  }
+
+  /** Marks the active tab's pending navigation as complete. */
+  completeNavigation(): void {
+    if (this.pendingNavigation?.tabId === this.activeTabId) {
+      this.pendingNavigation = null;
+    }
+  }
+
   /** Adds a new tab at the current location and switches to it. */
   addTab(): void {
     this.syncActiveTab();
@@ -330,6 +374,7 @@ export class TabsState {
     if (!tab) return;
     this.syncActiveTab();
     this.activeTabId = id;
+    this.pendingNavigation = null;
     this.saveToPersistence();
 
     if (tab.stub && this.navigateToLocation) {
@@ -353,6 +398,7 @@ export class TabsState {
       // eslint-disable-next-line security/detect-object-injection
       const nextTab = newTabs[newIdx];
       this.activeTabId = nextTab.id;
+      this.pendingNavigation = null;
       if (nextTab.stub && this.navigateToLocation) {
         this.navigateToLocation(
           nextTab.snapshot.connection,
diff --git a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
index 12f214b3..01fbf9b5 100644
--- a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
@@ -4,10 +4,12 @@
   import { resolve } from '$app/paths';
   import { page } from '$app/state';
   import { getStorageState } from '$lib/storage/context.js';
+  import { getTabsState } from '$lib/storage/context.js';
   import FileExplorer from '$lib/components/storage/explorer/FileExplorer.svelte';
 
   let { data } = $props();
   const storage = getStorageState();
+  const tabsState = getTabsState();
 
   const routePath = $derived(
     resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
@@ -98,7 +100,9 @@
         return;
       }
     }
+    if (!tabsState.canSyncServerLocation(data.connection, data.bucket, data.prefix)) return;
     storage.syncFromServer(data.bucket, data.prefix, data.objects);
+    tabsState.completeNavigation();
   });
 </script>
 

From 6737272c98836d45abfe090543fc475b9d52a412 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 31 Aug 2026 10:56:03 +0200
Subject: [PATCH 130/136] remove close button

---
 src/lib/components/storage/modals/PreviewModal.svelte | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/src/lib/components/storage/modals/PreviewModal.svelte b/src/lib/components/storage/modals/PreviewModal.svelte
index a9fc5f52..9452a9d7 100644
--- a/src/lib/components/storage/modals/PreviewModal.svelte
+++ b/src/lib/components/storage/modals/PreviewModal.svelte
@@ -1081,9 +1081,6 @@
             {m.storage_editor_save_and_close()}
           </button>
         {/if}
-        <button class="btn btn-ghost btn-sm" onclick={handleCloseClick}>
-          {m.storage_preview_close()}
-        </button>
       </div>
     {/if}
   </div>

From f29eedf33190723e9e222ab4bc14c21a6d8966a5 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 31 Aug 2026 11:08:39 +0200
Subject: [PATCH 131/136] fix lint

---
 e2e/storage/archive.spec.ts                                  | 2 +-
 src/lib/components/storage/explorer/StorageBreadcrumb.svelte | 2 --
 src/lib/storage/connection-store.svelte.ts                   | 4 +++-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/e2e/storage/archive.spec.ts b/e2e/storage/archive.spec.ts
index 9bc34feb..ae240cf0 100644
--- a/e2e/storage/archive.spec.ts
+++ b/e2e/storage/archive.spec.ts
@@ -169,7 +169,7 @@ test.describe('Storage S3 — Archive preview', () => {
       await waitForObjectsLoaded(page);
 
       // Should be at the bucket root (archive exited)
-      // eslint-disable-next-line security/detect-non-literal-regexp
+
       await expect(page).toHaveURL(
         new RegExp(
           `/storage/browse/${new URL(credentials.endpoint).hostname}/${credentials.bucket}(\\?|$)`
diff --git a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
index c2a75803..4f881b82 100644
--- a/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
+++ b/src/lib/components/storage/explorer/StorageBreadcrumb.svelte
@@ -15,7 +15,6 @@
   import IconContentCopy from 'virtual:icons/material-symbols/content-copy';
   import * as m from '$lib/paraglide/messages.js';
   import { getStorageState } from '$lib/storage/context.js';
-  import { getTabsState } from '$lib/storage/context.js';
   import type { StorageLocation } from '$lib/storage/types.js';
   import { keyToName } from '$lib/storage/utils.js';
   import { invalidateAll } from '$app/navigation';
@@ -27,7 +26,6 @@
   import type { ContextMenuAction } from '$lib/storage/types.js';
 
   const storage = getStorageState();
-  const tabsState = getTabsState();
 
   const breadcrumbParts = $derived(
     storage.prefix
diff --git a/src/lib/storage/connection-store.svelte.ts b/src/lib/storage/connection-store.svelte.ts
index 89fbee80..8c9da142 100644
--- a/src/lib/storage/connection-store.svelte.ts
+++ b/src/lib/storage/connection-store.svelte.ts
@@ -5,6 +5,8 @@
  * This module is client-safe. It never imports server-only code.
  */
 
+import { SvelteURL } from 'svelte/reactivity';
+
 export interface ConnectionListItem {
   id: string;
   name: string;
@@ -17,7 +19,7 @@ export interface ConnectionListItem {
 export function connectionHostname(connection: ConnectionListItem | null): string {
   if (!connection?.endpoint) return '';
   try {
-    return new URL(
+    return new SvelteURL(
       connection.endpoint.includes('://') ? connection.endpoint : `//${connection.endpoint}`,
       'http://localhost'
     ).hostname;

From b0ada4cf12debd986afd2e100e2d3b768a357468 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 31 Aug 2026 14:50:42 +0200
Subject: [PATCH 132/136] fix history.pushState

---
 src/routes/(app)/storage/+layout.svelte | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/routes/(app)/storage/+layout.svelte b/src/routes/(app)/storage/+layout.svelte
index 4bc54c7b..1c5fb50f 100644
--- a/src/routes/(app)/storage/+layout.svelte
+++ b/src/routes/(app)/storage/+layout.svelte
@@ -1,6 +1,6 @@
 <script lang="ts">
   import { untrack } from 'svelte';
-  import { goto } from '$app/navigation';
+  import { goto, replaceState } from '$app/navigation';
   import { resolve } from '$app/paths';
   import { page } from '$app/state';
   import BucketList from '$lib/components/storage/sidebar/BucketList.svelte';
@@ -42,7 +42,7 @@
       void goto(locationPath(connection, bucket, prefix));
     },
     replaceLocationUrl: (connection, bucket, prefix) => {
-      history.replaceState(history.state, '', locationPath(connection, bucket, prefix));
+      replaceState(locationPath(connection, bucket, prefix), page.state);
     }
   });
   setTabsState(tabsState);

From 84df7be9ba5b5b76e5eea7a1ec6def1920a20598 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Mon, 31 Aug 2026 14:51:35 +0200
Subject: [PATCH 133/136] add nvm version

---
 .nvmrc    | 1 +
 AGENTS.md | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)
 create mode 100644 .nvmrc

diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 00000000..32f8c50d
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24.13.1
diff --git a/AGENTS.md b/AGENTS.md
index e461beda..bc575200 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -189,10 +189,10 @@ The application uses **Paraglide-JS v2** for type-safe, compiler-based internati
 
 ### Node.js Version
 
-The required Node.js version is pinned in `.node-version`. Use `nvm` to install and activate it before running any `npm` commands — `npm` will hard-fail with engine errors otherwise (`.npmrc` sets `engine-strict=true`).
+The required Node.js version is pinned in `.node-version` for CI and `.nvmrc` for NVM. Keep both files synchronised. Use `nvm` to install and activate it before running any `npm` commands — `npm` will hard-fail with engine errors otherwise (`.npmrc` sets `engine-strict=true`).
 
 ```bash
-nvm install   # installs the version from .node-version
+nvm install   # installs the version from .nvmrc
 nvm use       # activates it in the current shell
 ```
 

From 297fcc6fbaee484bb256451a4ab1b5493a3d329e Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Wed, 2 Sep 2026 09:18:10 +0200
Subject: [PATCH 134/136] fix unit and e2e tests

---
 e2e/storage/permissions.spec.ts               |  2 +-
 .../__tests__/FileExplorerWrapper.svelte      |  8 +-
 .../StorageBreadcrumb.svelte.spec.ts          | 74 +++----------------
 .../__tests__/RecentItemsWrapper.svelte       |  5 +-
 .../__tests__/BucketListWrapper.svelte        |  5 +-
 5 files changed, 27 insertions(+), 67 deletions(-)

diff --git a/e2e/storage/permissions.spec.ts b/e2e/storage/permissions.spec.ts
index f7852447..b38f6eb3 100644
--- a/e2e/storage/permissions.spec.ts
+++ b/e2e/storage/permissions.spec.ts
@@ -104,7 +104,7 @@ test.describe('Storage S3 — Permissions', () => {
     await connectToStorage(page, writeonlyCredentials);
     await expect(page.locator('main').getByRole('heading', { name: 'Buckets' })).toBeVisible();
 
-    await page.goto(bucketRoute(new URL(credentials.endpoint).hostname, writeonlyBucket));
+    await page.goto(bucketRoute(new URL(baseCredentials.endpoint).hostname, writeonlyBucket));
 
     await expect(page.getByText('403')).toBeVisible();
     await expect(page.getByText('You do not have permission to access the bucket')).toBeVisible();
diff --git a/src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte b/src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte
index 7106df4f..2c577d6b 100644
--- a/src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte
+++ b/src/lib/components/storage/explorer/__tests__/FileExplorerWrapper.svelte
@@ -1,7 +1,8 @@
 <script lang="ts">
   import { untrack } from 'svelte';
-  import { setStorageState } from '$lib/storage/context.js';
+  import { setStorageState, setTabsState } from '$lib/storage/context.js';
   import type { StorageState } from '$lib/storage/state.svelte.js';
+  import { TabsState } from '$lib/storage/tabs.svelte.js';
   import FileExplorer from '../FileExplorer.svelte';
 
   interface Props {
@@ -9,7 +10,10 @@
   }
 
   let { state }: Props = $props();
-  untrack(() => setStorageState(state));
+  untrack(() => {
+    setStorageState(state);
+    setTabsState(new TabsState(state));
+  });
 </script>
 
 <FileExplorer />
diff --git a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
index ba70c727..c557470a 100644
--- a/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
+++ b/src/lib/components/storage/explorer/__tests__/StorageBreadcrumb.svelte.spec.ts
@@ -4,7 +4,6 @@ import { render } from 'vitest-browser-svelte';
 import { faker } from '@faker-js/faker';
 import StorageBreadcrumbWrapper from './StorageBreadcrumbWrapper.svelte';
 import { StorageState } from '$lib/storage/state.svelte.js';
-import { TabsState } from '$lib/storage/tabs.svelte.js';
 import type { StorageObject } from '$lib/storage/types.js';
 
 function makeFolders(count: number): StorageObject[] {
@@ -192,16 +191,14 @@ describe('StorageBreadcrumb', () => {
   });
 
   describe('pin/unpin', () => {
-    it('should show pin option in more options menu', async () => {
+    it('should show a pin control for the current location', async () => {
       const state = createState();
       render(StorageBreadcrumbWrapper, { state });
 
-      // The more options button exists
-      const moreBtn = page.getByRole('button', { name: /more options/i });
-      await expect.element(moreBtn).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: 'Pin' })).toBeInTheDocument();
     });
 
-    it('should show unpin when current location is pinned', async () => {
+    it('should show unpin control when current location is pinned', async () => {
       const state = createState({
         bucket: 'test-bucket',
         prefix: 'data/',
@@ -209,35 +206,20 @@ describe('StorageBreadcrumb', () => {
       });
       render(StorageBreadcrumbWrapper, { state });
 
-      // The more menu should contain unpin
-      const menuItems = page.getByRole('menuitem');
-      await expect.element(menuItems.first()).toBeInTheDocument();
+      await expect.element(page.getByRole('button', { name: 'Unpin' })).toBeInTheDocument();
     });
 
-    it('should call pin via more options menu when not pinned', async () => {
+    it('should pin the current location', async () => {
       const state = createState({ bucket: 'test-bucket', prefix: 'data/' });
       const spy = vi.spyOn(state.bookmarks, 'pin');
       render(StorageBreadcrumbWrapper, { state });
 
-      // Open the dropdown by focusing/clicking the trigger
-      const moreBtn = page.getByRole('button', { name: /more options/i });
-      await moreBtn.click();
-
-      // The more-options dropdown now has: 0="New Tab", 1="Pin this location"
-      // Use .nth(1) to target the pin item, with direct DOM dispatch as fallback
-      const menuItems = page.getByRole('menuitem');
-      const el = menuItems.nth(1);
-      await el.click();
-
-      // If DaisyUI dropdown prevents click, try direct dispatch
-      if (!spy.mock.calls.length) {
-        const domEl = (await el.element()) as HTMLElement;
-        domEl.click();
-      }
+      const pinButton = page.getByRole('button', { name: 'Pin' }).last();
+      ((await pinButton.element()) as HTMLElement).click();
       expect(spy).toHaveBeenCalledWith('test-bucket', 'data/');
     });
 
-    it('should call unpin via more options menu when pinned', async () => {
+    it('should unpin the current location', async () => {
       const state = createState({
         bucket: 'test-bucket',
         prefix: 'data/',
@@ -246,13 +228,8 @@ describe('StorageBreadcrumb', () => {
       const spy = vi.spyOn(state.bookmarks, 'unpin');
       render(StorageBreadcrumbWrapper, { state });
 
-      // Open the dropdown first
-      const moreBtn = page.getByRole('button', { name: /more options/i });
-      await moreBtn.click();
-
-      // Click the unpin menuitem specifically (not the first one which is now "New Tab")
-      const menuItem = page.getByRole('menuitem', { name: /unpin/i });
-      await menuItem.click();
+      const unpinButton = page.getByRole('button', { name: 'Unpin' });
+      ((await unpinButton.element()) as HTMLElement).click();
       expect(spy).toHaveBeenCalledWith('test-bucket', 'data/');
     });
   });
@@ -393,9 +370,8 @@ describe('StorageBreadcrumb', () => {
       const backdrop = menuUl.previousElementSibling as HTMLElement;
       backdrop.dispatchEvent(new MouseEvent('mousedown', { bubbles: true }));
 
-      // Context menu should be closed - menuitem from ctx menu should be gone
-      // The remaining menuitems should be from the more options dropdown (New Tab + Pin)
-      await expect.element(page.getByRole('menuitem').first()).toBeInTheDocument(); // the one in more options
+      // Context menu should be closed.
+      await expect.element(page.getByRole('menuitem').first()).not.toBeInTheDocument();
     });
 
     it('should open context menu on right-click of bucket with prefix', async () => {
@@ -521,30 +497,4 @@ describe('StorageBreadcrumb', () => {
       await expect.element(page.getByRole('button', { name: /upload/i })).not.toBeInTheDocument();
     });
   });
-
-  describe('new tab', () => {
-    it('should show "New Tab" option in the more options menu', async () => {
-      const state = createState();
-      render(StorageBreadcrumbWrapper, { state });
-
-      const moreBtn = page.getByRole('button', { name: /more options/i });
-      await moreBtn.click();
-
-      await expect.element(page.getByRole('menuitem', { name: 'New Tab' })).toBeInTheDocument();
-    });
-
-    it('should call tabsState.addTab when "New Tab" is clicked', async () => {
-      const state = createState({ bucket: 'test-bucket', prefix: 'data/' });
-      const tabsState = new TabsState(state);
-      const spy = vi.spyOn(tabsState, 'addTab');
-      render(StorageBreadcrumbWrapper, { state, tabsState });
-
-      const moreBtn = page.getByRole('button', { name: /more options/i });
-      await moreBtn.click();
-
-      await page.getByRole('menuitem', { name: 'New Tab' }).click();
-
-      expect(spy).toHaveBeenCalled();
-    });
-  });
 });
diff --git a/src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte b/src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte
index 4f3cf0eb..d7a98c26 100644
--- a/src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte
+++ b/src/lib/components/storage/landing/__tests__/RecentItemsWrapper.svelte
@@ -9,7 +9,10 @@
   }
 
   let { state }: Props = $props();
-  untrack(() => setStorageState(state));
+  untrack(() => {
+    state.connectionHostname = 'storage.example.com';
+    setStorageState(state);
+  });
 </script>
 
 <RecentItems />
diff --git a/src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte b/src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte
index 622b879f..46bb3fdc 100644
--- a/src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte
+++ b/src/lib/components/storage/sidebar/__tests__/BucketListWrapper.svelte
@@ -9,7 +9,10 @@
   }
 
   let { state }: Props = $props();
-  untrack(() => setStorageState(state));
+  untrack(() => {
+    state.connectionHostname = 'storage.example.com';
+    setStorageState(state);
+  });
 </script>
 
 <BucketList />

From b828fb64c14d3cac2c1099f3f9c0d80fe01238a8 Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 3 Sep 2026 15:24:55 +0200
Subject: [PATCH 135/136] remove mobile e2e test config

---
 e2e/storage/permissions.spec.ts               |  2 +-
 e2e/storage/preview.spec.ts                   |  5 ++-
 e2e/storage/recent-items.spec.ts              | 10 ++++--
 package.json                                  |  1 -
 playwright.config.ts                          | 32 +----------------
 .../settings/connections/+page.server.ts      | 36 ++++++++++++++++++-
 .../connections/[id]/edit/+page.server.ts     |  6 +++-
 .../connections/[id]/edit/+page.svelte        |  3 +-
 src/routes/(app)/storage/+error.svelte        |  7 ++--
 .../[bucket]/[...prefix]/+page.svelte         |  7 ++--
 .../[bucket]/[...prefix]/+page.ts             | 16 ++++++---
 11 files changed, 74 insertions(+), 51 deletions(-)

diff --git a/e2e/storage/permissions.spec.ts b/e2e/storage/permissions.spec.ts
index b38f6eb3..c6af1cf2 100644
--- a/e2e/storage/permissions.spec.ts
+++ b/e2e/storage/permissions.spec.ts
@@ -128,7 +128,7 @@ test.describe('Storage S3 — Permissions', () => {
 
     await connectToStorage(page, noAccessCredentials);
     await expect(page).toHaveURL('/storage');
-    await page.goto(bucketRoute(new URL(credentials.endpoint).hostname, noAccessBucket));
+    await page.goto(bucketRoute(new URL(baseCredentials.endpoint).hostname, noAccessBucket));
 
     await expect(page.getByText('403')).toBeVisible();
     await expect(page.getByText('You do not have permission to access the bucket')).toBeVisible();
diff --git a/e2e/storage/preview.spec.ts b/e2e/storage/preview.spec.ts
index db87c55a..35c4827a 100644
--- a/e2e/storage/preview.spec.ts
+++ b/e2e/storage/preview.spec.ts
@@ -44,7 +44,10 @@ test.describe('Storage S3 — Preview', () => {
       await expect(page.getByText('Preview line one')).toBeVisible();
       await expect(page.getByText('Preview line two')).toBeVisible();
 
-      await page.getByRole('button', { name: 'Close' }).last().click();
+      await page
+        .getByRole('dialog')
+        .getByRole('button', { name: 'Close', exact: true })
+        .click();
       await expect(page.getByRole('heading', { name: 'preview.txt' })).not.toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index ee7229e0..63863148 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -19,7 +19,10 @@ import {
 async function previewFile(page: Page, name: string) {
   await rowByName(page, name).dblclick();
   await expect(page.getByRole('heading', { name })).toBeVisible();
-  await page.getByRole('button', { name: 'Close' }).last().click();
+  await page
+    .getByRole('dialog')
+    .getByRole('button', { name: 'Close', exact: true })
+    .click();
   await expect(page.getByRole('heading', { name })).not.toBeVisible();
 }
 
@@ -63,7 +66,10 @@ test.describe('Storage S3 — Recent Items', () => {
       await connectAndOpenPrefix(page, credentials, prefix);
       await rowByName(page, 'recent.txt').dblclick();
       await expect(page.getByRole('heading', { name: 'recent.txt' })).toBeVisible();
-      await page.getByRole('button', { name: 'Close' }).last().click();
+      await page
+        .getByRole('dialog')
+        .getByRole('button', { name: 'Close', exact: true })
+        .click();
 
       await page.goto('/storage');
       await waitForStorageConnected(page);
diff --git a/package.json b/package.json
index aa72cf0c..0eaa2ed2 100644
--- a/package.json
+++ b/package.json
@@ -18,7 +18,6 @@
     "test:arch": "vitest run --config vitest.arch.config.ts",
     "test:arch:report": "ARCH_REPORT=1 vitest run --config vitest.arch.config.ts",
     "test:e2e": "node --env-file=.env.test node_modules/.bin/vite build && npx tsx e2e/support/run-e2e.ts",
-    "test:e2e:desktop": "node --env-file=.env.test node_modules/.bin/vite build && npx tsx e2e/support/run-e2e.ts --project=chromium --project=firefox",
     "test:e2e:ui": "playwright test --ui",
     "generate:antlr": "cd src/lib/editor/grammar && antlr-ng -v -l -Dlanguage=TypeScript -o ../generated SqlBase.g4 && node patch-generated.mjs",
     "db:generate": "drizzle-kit generate",
diff --git a/playwright.config.ts b/playwright.config.ts
index f952e93a..f47bf143 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -67,18 +67,6 @@ export default defineConfig({
         viewport: { width: 1280, height: 720 }
       }
     },
-    ...(!process.env.CI
-      ? [
-          {
-            name: 'setup-mobile',
-            testMatch: /auth\.setup\.ts/,
-            use: {
-              browserName: 'chromium' as const,
-              viewport: { width: 393, height: 851 }
-            }
-          }
-        ]
-      : []),
     {
       name: 'firefox',
       use: {
@@ -97,24 +85,6 @@ export default defineConfig({
         ...(chromiumExecutablePath && { launchOptions: { executablePath: chromiumExecutablePath } })
       },
       dependencies: ['setup-chromium']
-    },
-    ...(!process.env.CI
-      ? [
-          {
-            name: 'mobile',
-            use: {
-              browserName: 'chromium' as const,
-              viewport: { width: 393, height: 851 },
-              isMobile: true,
-              hasTouch: true,
-              storageState: 'e2e/.auth/user-setup-mobile.json',
-              ...(chromiumExecutablePath && {
-                launchOptions: { executablePath: chromiumExecutablePath }
-              })
-            },
-            dependencies: ['setup-mobile']
-          }
-        ]
-      : [])
+    }
   ]
 });
diff --git a/src/routes/(app)/settings/connections/+page.server.ts b/src/routes/(app)/settings/connections/+page.server.ts
index adf669d6..5e291198 100644
--- a/src/routes/(app)/settings/connections/+page.server.ts
+++ b/src/routes/(app)/settings/connections/+page.server.ts
@@ -5,10 +5,44 @@ import { zod4 as zod } from 'sveltekit-superforms/adapters';
 import { ConnectionIdSchema } from '$lib/storage/schemas.js';
 import { deleteConnection } from '$lib/server/storage/connections-db.js';
 import { auth } from '$lib/server/auth.js';
+import { desc, eq } from 'drizzle-orm';
+import { db } from '$lib/server/db.js';
+import { userStorageConnections } from '$lib/server/schema.js';
+import { decrypt } from '$lib/server/storage/encryption.js';
+import { storageEncryptionKey } from '$lib/server/storage/encryption-key.js';
+import type { ConnectionListItem } from '$lib/storage/connection-store.svelte.js';
 
 export const load: PageServerLoad = async ({ locals }) => {
   locals.logger.debug('loading storage connections management page');
-  return {};
+  const rows = await db
+    .select()
+    .from(userStorageConnections)
+    .where(eq(userStorageConnections.userId, locals.user!.id))
+    .orderBy(desc(userStorageConnections.updatedAt));
+
+  const connections: ConnectionListItem[] = rows.map((row) => {
+    let endpoint: string | null = null;
+    try {
+      const payload = JSON.parse(decrypt(row.encryptedPayload, storageEncryptionKey())) as {
+        host?: string;
+        port?: number;
+      };
+      endpoint =
+        payload.host && payload.port ? `${payload.host}:${payload.port}` : (payload.host ?? null);
+    } catch (err) {
+      locals.logger.warn({ err, connection_id: row.id }, 'failed to decrypt storage connection');
+    }
+    return {
+      id: row.id,
+      name: row.name,
+      endpoint,
+      additionalBuckets: (row.additionalBuckets as string[]) ?? [],
+      createdAt: row.createdAt.toISOString(),
+      updatedAt: row.updatedAt.toISOString()
+    };
+  });
+
+  return { connections };
 };
 
 export const actions: Actions = {
diff --git a/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts b/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
index 38d66ff1..7c2bcbb2 100644
--- a/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
+++ b/src/routes/(app)/settings/connections/[id]/edit/+page.server.ts
@@ -60,7 +60,11 @@ export const load: PageServerLoad = async ({ locals, params }) => {
   );
 
   locals.logger.debug({ connection_id: params.id }, 'loading storage connection edit page');
-  return { editForm, connectionId: params.id };
+  return {
+    editForm,
+    connectionId: params.id,
+    activeConnectionId: locals.session?.activeStorageConnectionId ?? null
+  };
 };
 
 export const actions: Actions = {
diff --git a/src/routes/(app)/settings/connections/[id]/edit/+page.svelte b/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
index f4539019..7b0963fb 100644
--- a/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
+++ b/src/routes/(app)/settings/connections/[id]/edit/+page.svelte
@@ -9,14 +9,13 @@
   import * as m from '$lib/paraglide/messages.js';
   import Modal from '$lib/components/Modal.svelte';
   import { EditStorageConnectionSchema } from '$lib/storage/schemas.js';
-  import { connectionStore } from '$lib/storage/connection-store.svelte.js';
 
   let { data } = $props();
 
   const uid = $props.id();
 
   let loaded = $state(false);
-  let isActiveConnection = $derived(connectionStore.activeConnectionId === data.connectionId);
+  let isActiveConnection = $derived(data.activeConnectionId === data.connectionId);
 
   // Unsaved-changes guard
   let initialSnapshot = $state.raw('');
diff --git a/src/routes/(app)/storage/+error.svelte b/src/routes/(app)/storage/+error.svelte
index 8fd67399..64e8701a 100644
--- a/src/routes/(app)/storage/+error.svelte
+++ b/src/routes/(app)/storage/+error.svelte
@@ -5,12 +5,9 @@
   import IconStorage from 'virtual:icons/material-symbols/storage';
   import IconChevronRight from 'virtual:icons/material-symbols/chevron-right';
   import * as m from '$lib/paraglide/messages.js';
-  import { getStorageState } from '$lib/storage/context.js';
-
-  const storage = getStorageState();
-  storage.loading = false;
 
   const bucket = $derived(page.params.bucket ?? '');
+  const connection = $derived(page.params.connection ?? '');
 
   const prefixParts = $derived.by(() => {
     const segments = page.url?.pathname?.split('/').filter(Boolean) ?? [];
@@ -37,7 +34,7 @@
       <span class="flex shrink-0 items-center gap-1">
         <a
           href={resolve('/(app)/storage/browse/[connection]/[bucket]/[...prefix]', {
-            connection: encodeURIComponent(storage.connectionHostname),
+            connection: encodeURIComponent(connection),
             bucket: encodeURIComponent(bucket),
             prefix: ''
           })}
diff --git a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
index 01fbf9b5..00f6dc8f 100644
--- a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
@@ -3,6 +3,7 @@
   import { goto, invalidateAll } from '$app/navigation';
   import { resolve } from '$app/paths';
   import { page } from '$app/state';
+  import { untrack } from 'svelte';
   import { getStorageState } from '$lib/storage/context.js';
   import { getTabsState } from '$lib/storage/context.js';
   import FileExplorer from '$lib/components/storage/explorer/FileExplorer.svelte';
@@ -100,9 +101,11 @@
         return;
       }
     }
-    if (!tabsState.canSyncServerLocation(data.connection, data.bucket, data.prefix)) return;
+    if (!untrack(() => tabsState.canSyncServerLocation(data.connection, data.bucket, data.prefix))) {
+      return;
+    }
     storage.syncFromServer(data.bucket, data.prefix, data.objects);
-    tabsState.completeNavigation();
+    untrack(() => tabsState.completeNavigation());
   });
 </script>
 
diff --git a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.ts b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.ts
index 6b662a16..32a5efc1 100644
--- a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.ts
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.ts
@@ -1,5 +1,5 @@
 import { browser } from '$app/environment';
-import { error, redirect } from '@sveltejs/kit';
+import { error, isHttpError, redirect } from '@sveltejs/kit';
 import { connectionHostname, connectionStore } from '$lib/storage/connection-store.svelte.js';
 import { STORAGE_CONNECTION_ID_HEADER } from '$lib/storage/connection-id-header.js';
 import * as m from '$lib/paraglide/messages.js';
@@ -34,9 +34,17 @@ export const load: PageLoad = async ({ fetch, url, data }) => {
   const query = new URLSearchParams({ bucket, prefix: prefix ?? '' });
 
   if (!browser) {
-    const res = await fetch(`/api/storage/list?${query}`, {
-      headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
-    });
+    let res: Response;
+    try {
+      res = await fetch(`/api/storage/list?${query}`, {
+        headers: { [STORAGE_CONNECTION_ID_HEADER]: connectionId }
+      });
+    } catch (err) {
+      if (isHttpError(err) && err.status === 403) {
+        throw error(403, m.storage_error_access_denied({ bucket }));
+      }
+      throw err;
+    }
 
     if (!res.ok) {
       if (res.status === 401) throw redirect(303, '/storage');

From 4f42efb2be0a0773403cc1506172b9c1580a44ae Mon Sep 17 00:00:00 2001
From: F3l1x1vo <fli@ordix.de>
Date: Thu, 3 Sep 2026 15:42:32 +0200
Subject: [PATCH 136/136] fix e2e tests

---
 e2e/storage/delete.spec.ts                    |  1 +
 e2e/storage/file-operations.spec.ts           |  9 +++---
 e2e/storage/helpers.ts                        | 29 +++++++++++++++----
 e2e/storage/preview.spec.ts                   |  5 +---
 e2e/storage/recent-items.spec.ts              | 10 ++-----
 .../[bucket]/[...prefix]/+page.svelte         |  4 ++-
 6 files changed, 35 insertions(+), 23 deletions(-)

diff --git a/e2e/storage/delete.spec.ts b/e2e/storage/delete.spec.ts
index a4ed22ba..d6b7ede8 100644
--- a/e2e/storage/delete.spec.ts
+++ b/e2e/storage/delete.spec.ts
@@ -135,6 +135,7 @@ test.describe('Storage S3 — Delete & Selection', () => {
 
       // Select the file by clicking on the row
       await rowByName(page, 'delete-me.txt').click();
+      await expect(page.getByLabel('Select delete-me.txt')).toBeChecked();
 
       // Press Delete key
       await page.keyboard.press('Delete');
diff --git a/e2e/storage/file-operations.spec.ts b/e2e/storage/file-operations.spec.ts
index 383bbc8d..6c880b6c 100644
--- a/e2e/storage/file-operations.spec.ts
+++ b/e2e/storage/file-operations.spec.ts
@@ -57,13 +57,14 @@ test.describe('Storage S3 — File Operations', () => {
       await page.locator('table').click();
       await page.keyboard.press('Control+v');
 
-      // Wait for paste to complete
-      await page.waitForTimeout(1000);
+      await expect(page.getByText('1 item pasted')).toBeVisible();
 
       // File should exist at dest (moved)
-      expect(await objectExists(client, credentials.bucket, `${prefix}cut-me.txt`)).toBe(true);
+      await expect
+        .poll(() => objectExists(client, credentials.bucket, `${prefix}cut-me.txt`))
+        .toBe(true);
       // Original should be deleted (cut = move)
-      expect(await objectExists(client, credentials.bucket, srcFile)).toBe(false);
+      await expect.poll(() => objectExists(client, credentials.bucket, srcFile)).toBe(false);
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
     }
diff --git a/e2e/storage/helpers.ts b/e2e/storage/helpers.ts
index 0feb1a15..45978f90 100644
--- a/e2e/storage/helpers.ts
+++ b/e2e/storage/helpers.ts
@@ -139,14 +139,31 @@ export async function connectAndOpenPrefix(
 ) {
   await connectToStorage(page, credentials);
   const connection = new URL(credentials.endpoint).hostname;
-  await page.goto(bucketRoute(connection, credentials.bucket, prefix));
-  // If a parallel worker's disconnect raced with this navigation the page will
-  // have been redirected back to /storage.  Detect that and reconnect once.
-  await waitForHydration(page);
-  if (!page.url().includes(encodeURIComponent(credentials.bucket))) {
+  const route = bucketRoute(connection, credentials.bucket, prefix);
+
+  // A session update can redirect a just-opened bucket route to the storage
+  // overview after hydration. Retry once if that happens while loading.
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    await page.goto(route);
+    await waitForHydration(page);
+
+    const objectsLoaded = page
+      .locator('tbody tr')
+      .or(page.getByText('This bucket is empty'))
+      .first()
+      .waitFor({ timeout: 15_000 });
+    const storageOverview = page.getByRole('heading', { name: 'Buckets', exact: true }).waitFor({
+      timeout: 15_000
+    });
+
+    await Promise.race([objectsLoaded, storageOverview]);
+    if (page.url().includes(encodeURIComponent(credentials.bucket))) {
+      return;
+    }
+
     await connectToStorage(page, credentials);
-    await page.goto(bucketRoute(connection, credentials.bucket, prefix));
   }
+
   await waitForObjectsLoaded(page);
 }
 
diff --git a/e2e/storage/preview.spec.ts b/e2e/storage/preview.spec.ts
index 35c4827a..744f1e7a 100644
--- a/e2e/storage/preview.spec.ts
+++ b/e2e/storage/preview.spec.ts
@@ -44,10 +44,7 @@ test.describe('Storage S3 — Preview', () => {
       await expect(page.getByText('Preview line one')).toBeVisible();
       await expect(page.getByText('Preview line two')).toBeVisible();
 
-      await page
-        .getByRole('dialog')
-        .getByRole('button', { name: 'Close', exact: true })
-        .click();
+      await page.getByRole('dialog').getByRole('button', { name: 'Close', exact: true }).click();
       await expect(page.getByRole('heading', { name: 'preview.txt' })).not.toBeVisible();
     } finally {
       await deleteKnownKeys(client, credentials.bucket, cleanupKeys);
diff --git a/e2e/storage/recent-items.spec.ts b/e2e/storage/recent-items.spec.ts
index 63863148..9b7a9db0 100644
--- a/e2e/storage/recent-items.spec.ts
+++ b/e2e/storage/recent-items.spec.ts
@@ -19,10 +19,7 @@ import {
 async function previewFile(page: Page, name: string) {
   await rowByName(page, name).dblclick();
   await expect(page.getByRole('heading', { name })).toBeVisible();
-  await page
-    .getByRole('dialog')
-    .getByRole('button', { name: 'Close', exact: true })
-    .click();
+  await page.getByRole('dialog').getByRole('button', { name: 'Close', exact: true }).click();
   await expect(page.getByRole('heading', { name })).not.toBeVisible();
 }
 
@@ -66,10 +63,7 @@ test.describe('Storage S3 — Recent Items', () => {
       await connectAndOpenPrefix(page, credentials, prefix);
       await rowByName(page, 'recent.txt').dblclick();
       await expect(page.getByRole('heading', { name: 'recent.txt' })).toBeVisible();
-      await page
-        .getByRole('dialog')
-        .getByRole('button', { name: 'Close', exact: true })
-        .click();
+      await page.getByRole('dialog').getByRole('button', { name: 'Close', exact: true }).click();
 
       await page.goto('/storage');
       await waitForStorageConnected(page);
diff --git a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
index 00f6dc8f..fe83f29c 100644
--- a/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
+++ b/src/routes/(app)/storage/browse/[connection]/[bucket]/[...prefix]/+page.svelte
@@ -101,7 +101,9 @@
         return;
       }
     }
-    if (!untrack(() => tabsState.canSyncServerLocation(data.connection, data.bucket, data.prefix))) {
+    if (
+      !untrack(() => tabsState.canSyncServerLocation(data.connection, data.bucket, data.prefix))
+    ) {
       return;
     }
     storage.syncFromServer(data.bucket, data.prefix, data.objects);