diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
new file mode 100644
index 00000000..290b981e
--- /dev/null
+++ b/.github/actions/setup/action.yml
@@ -0,0 +1,48 @@
+name: Setup workspace
+description: >-
+  pnpm + Node (pinned by .node-version) + a frozen-lockfile install, and
+  optionally the Turborepo local cache for a task.
+
+# Every CI job repeats the same setup after checkout. It lives here so a
+# Node/pnpm change is one edit instead of one per job, and so each job's YAML
+# is only what makes that job different.
+
+inputs:
+  turbo-cache:
+    description: >-
+      Cache namespace for this job's `.turbo/cache` (e.g. "unit"). Each job
+      gets its own so they don't contend for one exact-key save. Leave empty
+      for jobs that run no turbo task, or that need a bespoke key.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    # Container jobs check out as a different UID than the container user, so
+    # git rejects the workspace as "dubious ownership" and the `prepare`
+    # script (lefthook install) dies. No-op on host runners.
+    - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      shell: bash
+
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      # version comes from package.json "packageManager"
+
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version-file: ".node-version"
+        cache: pnpm
+
+    - run: pnpm install --frozen-lockfile
+      shell: bash
+
+    # Exact-key save per commit, prefix fallback to the newest prior cache:
+    # unchanged turbo tasks replay instead of re-executing.
+    - if: inputs.turbo-cache != ''
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: .turbo/cache
+        key: turbo-${{ inputs.turbo-cache }}-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
+        restore-keys: |
+          turbo-${{ inputs.turbo-cache }}-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
+          turbo-${{ inputs.turbo-cache }}-${{ runner.os }}-
diff --git a/.github/workflows/_workflow-lint.yaml b/.github/workflows/_workflow-lint.yaml
new file mode 100644
index 00000000..3ccb45bb
--- /dev/null
+++ b/.github/workflows/_workflow-lint.yaml
@@ -0,0 +1,96 @@
+# Reusable: lint the workflows themselves — actionlint (syntax + shellcheck),
+# zizmor (security posture) and pinact (every action ref pinned to a full
+# commit SHA).
+#
+# Called by workflow-lint.yml here, and callable from any other repository:
+#
+#   jobs:
+#     workflows:
+#       uses: leon0399/llame/.github/workflows/_workflow-lint.yaml@master
+#       permissions:
+#         contents: read
+#         security-events: write   # only when advanced-security is true
+#
+# The inputs exist because the repos sharing this differ in exactly two ways:
+# whether GitHub Advanced Security is available (public repo, or enabled), and
+# whether the repo ships a zizmor config. The actionlint container is NOT an
+# input — step-level `uses:` cannot take an expression — so its digest is
+# pinned here and bumped in one place for every caller.
+
+name: Workflow lint (reusable)
+
+on:
+  workflow_call:
+    inputs:
+      advanced-security:
+        description: >-
+          Upload zizmor findings as SARIF to the Security tab. Requires
+          `security-events: write` from the caller. Set false when Advanced
+          Security is unavailable (e.g. a private repo without it) — findings
+          then surface as inline annotations instead.
+        type: boolean
+        default: true
+      zizmor-config:
+        description: >-
+          Path to a zizmor config file. Left empty, no --config is passed.
+        type: string
+        default: ""
+
+# Per-job permissions narrow whatever the caller granted: only zizmor needs
+# the security-events surface for its SARIF upload — actionlint and pinact
+# read the checkout and nothing else.
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      # Pinned by immutable image digest — a stronger pin than a commit SHA.
+      # The image ships shellcheck (/usr/local/bin/shellcheck), which
+      # actionlint auto-detects on PATH, so `run:` blocks are checked too.
+      - uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color
+
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+        with:
+          advanced-security: ${{ inputs.advanced-security }}
+          # Mutually exclusive with advanced-security: annotations are the
+          # fallback surface when SARIF upload isn't available.
+          annotations: ${{ !inputs.advanced-security }}
+          # Empty string is a no-op: the action only passes --config when set.
+          config: ${{ inputs.zizmor-config }}
+
+  pinact:
+    name: pinact
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      # Validate only — never rewrites files in CI.
+      - uses: suzuki-shunsuke/pinact-action@896d595f299e71d65b9d28349d6956abe144390a # v3.0.0
+        with:
+          fix: "false"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 21a81813..906ceef2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,18 @@
-# Test CI (#70) — gate PRs on the checks that already pass locally:
-# lint / build / unit tests across the workspace, plus apps/api/scripts/rls-test.sh
-# (cross-tenant RLS isolation + the auth/chat e2e over real HTTP against a
-# throwaway Postgres — same script as local, GitHub-hosted runners have Docker).
+# The test pyramid, as a job graph (docs/testing.md is the contract).
+#
+#   typecheck ─┐
+#   unit ──────┼─→ build
+#              ├─→ storybook        (component tests, real browser)
+#              └─→ integration ──→ browser-e2e
+#
+# One job per concern, so a red X names what broke instead of hiding inside a
+# grab-bag. Cheap gates run first and unconditionally; each expensive layer
+# waits for the cheaper layer that would have caught the same breakage — a
+# type error never spends a runner on the full-stack browser suite, and the
+# browser suite never boots a stack whose api contract is already failing.
+#
+# Static checks (lint, format, workflow linting) live in lint.yml — they need
+# no build, browser or database, and report independently.
 #
 # Actions are pinned to commit SHAs (comment = the release tag they resolve to).
 
@@ -12,6 +23,12 @@ on:
   push:
     branches: [master]
 
+# A new push supersedes the old run: nothing here needs to finish for a commit
+# that is already outdated.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -19,86 +36,138 @@ env:
   TURBO_TELEMETRY_DISABLED: "1"
 
 jobs:
-  checks:
-    name: lint · build · unit tests
+  typecheck:
+    name: Typecheck
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-        # version comes from package.json "packageManager"
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: ./.github/actions/setup
         with:
-          node-version-file: ".node-version"
-          cache: pnpm
+          turbo-cache: typecheck
 
-      - run: pnpm install --frozen-lockfile
+      # Full-program check on tsgo (TypeScript 7 Go port) — covers tests, which
+      # `nest build` and Next's bundled check exclude. Emit stays on TS 5.x.
+      - run: pnpm exec turbo run typecheck
 
-      # Persist the Turborepo local cache across runs: exact-key restore per
-      # commit, prefix fallback to the newest prior cache. Unchanged tasks
-      # (hashed over inputs + env declared in turbo.json) replay from cache
-      # instead of re-executing.
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+  unit:
+    name: Unit tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          path: .turbo/cache
-          key: turbo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
-          restore-keys: |
-            turbo-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
-            turbo-${{ runner.os }}-
+          persist-credentials: false
 
-      - run: pnpm exec turbo run lint
+      # No turbo-cache: the `test` task is `cache: false` (turbo.json), so a
+      # cache here would be written and never read.
+      - uses: ./.github/actions/setup
 
-      # Full-program type check on tsgo (TypeScript 7 Go port) — covers specs,
-      # which `nest build` (tsconfig.build.json) and Next's bundled check
-      # exclude. Emit/build stays on TypeScript 5.x.
-      - run: pnpm exec turbo run typecheck
+      # Strictly dependency-free by construction: DB-backed suites are their
+      # own `test:integration` task, evals are opt-in behind RUN_MODEL_EVALS.
+      - run: pnpm exec turbo run test
 
-      # Formatting is checked explicitly (not embedded in a lint pass). Covers
-      # the whole repo via the root .prettierignore — the same surface the
-      # lefthook pre-commit `format` job gates per staged file (#175).
-      - run: pnpm run format:check
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: [typecheck, unit]
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup
+        with:
+          turbo-cache: build
 
       - run: pnpm exec turbo run build
 
+      # The api build regenerates openapi.json — a drifted checked-in copy is
+      # a failure, not a silent fixup.
       - run: git diff --exit-code
 
-      # Unit tests via the turbo task graph (cached like every other task).
-      # DB-backed suites self-skip without POSTGRES_URL / TEST_DATABASE_URL;
-      # model evals stay opt-in behind RUN_MODEL_EVALS — all three are declared
-      # in apps/api/turbo.json's test.env so their presence busts the cache.
-      - run: pnpm exec turbo run test
-
-  rls:
-    name: RLS isolation + e2e (real Postgres)
+  integration:
+    name: Integration tests (real Postgres)
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    needs: [typecheck, unit]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: ./.github/actions/setup
+
+      # Self-provisioning (Testcontainers in the project's globalSetup): a
+      # throwaway Postgres owned by a NON-superuser role that runs the
+      # migrations — the worst-case single-role self-hosted deployment, so a
+      # green RLS suite proves FORCE constrains even the table owner. Needs
+      # host Docker, hence no container image for this job.
+      - run: pnpm --filter api test:integration
 
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+  storybook:
+    name: Component tests (Storybook)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    needs: [typecheck, unit]
+    # The Playwright image ships the browser and its system libraries, so this
+    # job skips `playwright install --with-deps` entirely. Safe here because
+    # component tests need a browser but no Docker.
+    container:
+      # Pinned by digest, like every action here: a retag would otherwise
+      # change the browser and base image for an already-reviewed commit.
+      # Refresh with the catalog's playwright version:
+      #   docker buildx imagetools inspect mcr.microsoft.com/playwright:vX.Y.Z-noble
+      image: mcr.microsoft.com/playwright:v1.55.1-noble@sha256:2f29369043d81d6d69a815ceb80760f55e85f5020371ad06a4d996f18503ad1c
+      # Chromium renderers allocate from /dev/shm, and Docker's default 64 MB
+      # segment is a known crash source under parallel story runs; --ipc=host
+      # is Playwright's documented mitigation for Chromium in containers.
+      options: --ipc=host
+    env:
+      # The image ships its browsers at /ms-playwright, but the step's HOME is
+      # /github/home, so Playwright would look in ~/.cache and find nothing.
+      PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
+      # Same locale pinning as the browser-e2e job: Node >=21 derives
+      # navigator.language from the process locale, and an invalid tag makes
+      # `new Intl.Locale(...)` throw during SSR.
+      LANG: en_US.UTF-8
+      LC_ALL: en_US.UTF-8
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          node-version-file: ".node-version"
-          cache: pnpm
+          persist-credentials: false
 
-      - run: pnpm install --frozen-lockfile
+      - uses: ./.github/actions/setup
 
-      # Proves FORCE RLS cross-tenant isolation and runs the HTTP e2e suites
-      # against a throwaway Postgres owned by a non-superuser role — the same
-      # worst-case single-role deployment the script exercises locally.
-      - run: bash apps/api/scripts/rls-test.sh
+      # The workflow's own hash is part of the key: this task's turbo inputs
+      # don't include the container image, so bumping the Playwright digest
+      # would otherwise restore a cache whose stored PASS was produced by the
+      # OLD browser — green without ever exercising the new one. Costs one
+      # cold cache per ci.yml edit, which is the cheap side of that trade.
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .turbo/cache
+          key: turbo-storybook-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', '.github/workflows/ci.yml') }}-${{ github.sha }}
+          restore-keys: |
+            turbo-storybook-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml', '.github/workflows/ci.yml') }}-
+
+      - run: pnpm exec turbo run test:storybook build --filter=storybook
 
   browser-e2e:
-    name: browser e2e (Playwright, worker mode)
+    name: Product e2e (Playwright)
     runs-on: ubuntu-latest
     timeout-minutes: 25
+    # The top of the pyramid: everything below it has already passed, so a
+    # failure here is a genuine cross-stack defect rather than a unit-level
+    # bug wearing a browser costume. `integration` already needs
+    # [typecheck, unit], so naming them here too would be redundant — and
+    # neither `build` nor `storybook` belongs: this suite runs `next dev`,
+    # not the production build, and component tests are orthogonal to it.
+    needs: [integration]
     env:
       # Node >=21 derives navigator.language from the process locale; with
       # LANG=C/unset it reports an invalid tag and `new Intl.Locale(...)`
@@ -110,24 +179,21 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: ".node-version"
-          cache: pnpm
-
-      - run: pnpm install --frozen-lockfile
+      - uses: ./.github/actions/setup
 
+      # Host runner (not the Playwright image): this suite boots a throwaway
+      # Postgres through the Docker CLI, which a container job cannot reach.
       - run: pnpm exec playwright install --with-deps chromium
 
-      # Full browser chat-flow + mid-run refresh resume (#49/#80): Playwright
-      # boots a throwaway Postgres (docker), applies migrations, starts api +
-      # web + the mock model server, and drives Chromium against the real
-      # stack. This is the ONLY place the browser suite runs — keep it green.
+      # Boots db + api + worker + the mock model server + web, then drives
+      # Chromium against the real stack. The ONLY place the browser suite
+      # runs — keep it green.
       - run: pnpm test:e2e
 
-      - if: failure() || cancelled()
+      # failure() || cancelled(), NOT !cancelled(): a timed-out or cancelled
+      # run is exactly when the trace is worth keeping, and a green run has
+      # nothing worth uploading.
+      - if: ${{ failure() || cancelled() }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: playwright-report
@@ -135,41 +201,3 @@ jobs:
             playwright-report/
             test-results/
           retention-days: 7
-
-  storybook:
-    name: Storybook component tests
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    env:
-      LANG: en_US.UTF-8
-      LC_ALL: en_US.UTF-8
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version-file: ".node-version"
-          cache: pnpm
-
-      - run: pnpm install --frozen-lockfile
-
-      - run: pnpm exec playwright install --with-deps chromium
-
-      # Same Turborepo local-cache persistence as the checks job, under its
-      # own key so the two jobs don't contend for the same exact-key save.
-      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: .turbo/cache
-          key: turbo-sb-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ github.sha }}
-          restore-keys: |
-            turbo-sb-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}-
-            turbo-sb-${{ runner.os }}-
-
-      # Browser component tests + static build for the dedicated Storybook
-      # app (apps/storybook; stories stay co-located in packages/ui). Kept out
-      # of the checks job's `turbo run test` because they need Playwright.
-      - run: pnpm exec turbo run test:storybook build --filter=storybook
diff --git a/.github/workflows/git-ai.yaml b/.github/workflows/git-ai.yaml
index 3ad891cc..dd885632 100644
--- a/.github/workflows/git-ai.yaml
+++ b/.github/workflows/git-ai.yaml
@@ -12,7 +12,7 @@ jobs:
       - name: Install git-ai
         run: |
           curl -fsSL https://usegitai.com/install.sh | bash
-          echo "$HOME/.git-ai/bin" >> $GITHUB_PATH
+          echo "$HOME/.git-ai/bin" >> "$GITHUB_PATH"
       - name: Run git-ai
         id: run-git-ai
         env:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 00000000..ab5b1a12
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,57 @@
+# Static checks over the SOURCE that need no build, browser or database — the
+# cheapest feedback in the pipeline, deliberately its own workflow so a
+# formatting nit reports separately from a failing test.
+#
+# The workflows themselves are linted by workflow-lint.yml (actionlint,
+# zizmor, pinact).
+#
+# Actions are pinned to commit SHAs (comment = the release tag they resolve to).
+
+name: Lint
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  TURBO_TELEMETRY_DISABLED: "1"
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup
+        with:
+          turbo-cache: lint
+
+      # oxlint per workspace; type-aware rules via tsgolint in apps/api.
+      - run: pnpm exec turbo run lint
+
+  format:
+    name: Format
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - uses: ./.github/actions/setup
+
+      # Whole repo via the root .prettierignore — the same surface the
+      # lefthook pre-commit hook gates per staged file (#175).
+      - run: pnpm run format:check
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
new file mode 100644
index 00000000..7ced21bd
--- /dev/null
+++ b/.github/workflows/workflow-lint.yml
@@ -0,0 +1,32 @@
+# Thin caller: the jobs live in _workflow-lint.yaml so other repositories can
+# reuse the same three checks instead of each keeping its own copy (they had
+# already drifted across tools and versions).
+
+name: Workflow lint
+
+on:
+  pull_request:
+  push:
+    branches: [master]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  workflows:
+    uses: ./.github/workflows/_workflow-lint.yaml
+    permissions:
+      contents: read
+      # SARIF upload to the Security tab — available because this repo is
+      # public. A private repo without Advanced Security passes
+      # `advanced-security: false` instead and gets inline annotations.
+      security-events: write
+    with:
+      # Fork PRs run with a read-only token (the permissions grant above is
+      # capped, not elevated), so the SARIF upload would 403 and fail the
+      # gate — fall back to inline annotations for them. Evaluates true for
+      # push and same-repo PR events.
+      advanced-security: ${{ github.event.pull_request.head.repo.fork != true }}
diff --git a/.node-version b/.node-version
index 1d9b7831..f9e7451e 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-22.12.0
+22.23.1
diff --git a/.pinact.yaml b/.pinact.yaml
new file mode 100644
index 00000000..10fda071
--- /dev/null
+++ b/.pinact.yaml
@@ -0,0 +1,13 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/suzuki-shunsuke/pinact/main/json-schema/pinact.json
+# pinact - https://github.com/suzuki-shunsuke/pinact
+version: 3
+ignore_actions:
+  # actionlint runs from its official container, pinned by immutable image
+  # digest — a stronger pin than a commit SHA. pinact cannot parse docker://
+  # refs (they surface as "action isn't pinned"), so this line is excluded
+  # rather than the pin weakened.
+  # Scoped to the docker:// form ONLY: making the prefix optional would also
+  # exempt a marketplace `uses: rhysd/actionlint@v1.7.12`, silently punching a
+  # hole in the very guarantee this job exists to enforce.
+  - name: docker://rhysd/actionlint(:.*)?
+    ref: .*
diff --git a/AGENTS.md b/AGENTS.md
index 78c3d4e1..1bb12776 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -16,11 +16,12 @@ The product overview (what llame is) is short and always relevant, so it is impo
 - [CHANGELOG.md](CHANGELOG.md) — shipped chronology
 - [`docs/research`](docs/research) — noncanonical evidence, alternatives, and decision provenance
 - [DESIGN.md](DESIGN.md) — design system reference (visual language, OKLCH tokens, component stylings); consult before building or restyling any UI
+- [docs/testing.md](docs/testing.md) — the test pyramid, suffix-is-runner naming contract, placement rules, and CI mapping
 - [docs/scaling.md](docs/scaling.md) — horizontal-scaling topology, invariants, and the design constraints for the durable-run worker split (#48/#50)
 
 ## Monorepo layout
 
-pnpm + Turborepo workspace, **TypeScript end-to-end** (Node >= 22.12, pinned in `.node-version`; `nix develop` or direnv gives a ready shell; pnpm 10). Workspaces: `apps/*`, `packages/*`.
+pnpm + Turborepo workspace, **TypeScript end-to-end** (Node >= 22.19 (pinned to 22.23.1 in `.node-version`); `nix develop` or direnv gives a ready shell; pnpm 10). Workspaces: `apps/*`, `packages/*`.
 
 | Path                         | Role                                                                                        | Stack (details in its own `AGENTS.md`)                                         |
 | ---------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
@@ -48,7 +49,7 @@ pnpm test:e2e:report     # playwright show-report
 ```
 
 Scope to one workspace with `pnpm --filter web <script>` (or `--filter api`).
-Install Playwright browsers once with `pnpm exec playwright install chromium` if the local browser cache is missing. For E2E, Playwright starts a throwaway Docker Postgres, applies migrations, then starts `apps/api` and `apps/web`; set `POSTGRES_URL` only to use an already-migrated external database instead. Authenticated E2E tests should use the worker-scoped fixture from `e2e/fixtures.ts`, which writes per-worker storage state under `.auth/`; destructive session tests should request `freshAccount`. Override `E2E_WEB_PORT`, `E2E_API_PORT`, `E2E_DB_PORT`, or `E2E_DB_READY_PORT` only when the default E2E ports (`4300`/`4301`/`55433`/`4302`) conflict. Next.js 16 enforces one dev instance **per project directory**, not per port — `pnpm test:e2e`'s own `next dev --port 4300` refuses to start (and the whole run fails) while a manual `pnpm dev`/`next dev` is running anywhere against `apps/web`, even on a different port; stop the manual dev server first.
+Install Playwright browsers once with `pnpm exec playwright install chromium` if the local browser cache is missing. For E2E, Playwright starts a throwaway Docker Postgres, applies migrations, then starts `apps/api` and `apps/web`; set `POSTGRES_URL` only to use an already-migrated external database instead. Authenticated E2E tests should use the worker-scoped fixture from `e2e/support/fixtures.ts`, which writes per-worker storage state under `.auth/`; destructive session tests should request `freshAccount`. Override `E2E_WEB_PORT`, `E2E_API_PORT`, `E2E_DB_PORT`, or `E2E_DB_READY_PORT` only when the default E2E ports (`4300`/`4301`/`55433`/`4302`) conflict. Next.js 16 enforces one dev instance **per project directory**, not per port — `pnpm test:e2e`'s own `next dev --port 4300` refuses to start (and the whole run fails) while a manual `pnpm dev`/`next dev` is running anywhere against `apps/web`, even on a different port; stop the manual dev server first.
 
 ## Local database (docker)
 
@@ -61,13 +62,14 @@ pnpm db:provision-rls # assign privileged RLS helper ownership after migrations
 pnpm db:studio    ·   pnpm db:psql   ·   pnpm db:logs
 ```
 
-Dev provisions a non-superuser role so RLS (incl. `FORCE`) is exercised as in production — the role model, the per-request `app.current_user_id` requirement, and `scripts/rls-test.sh` are documented in [apps/api/AGENTS.md](apps/api/AGENTS.md). `apps/api` is the sole DB owner; `apps/web` holds no database connection and reads/writes only through `apps/api` (SPEC.md §22.0).
+Dev provisions a non-superuser role so RLS (incl. `FORCE`) is exercised as in production — the role model, the per-request `app.current_user_id` requirement, and the self-provisioning `test:integration` gate are documented in [apps/api/AGENTS.md](apps/api/AGENTS.md). `apps/api` is the sole DB owner; `apps/web` holds no database connection and reads/writes only through `apps/api` (SPEC.md §22.0).
 
 ## Conventions
 
 - TypeScript only across web/api/worker — no second backend language (SPEC.md §23).
 - Drizzle ORM for all DB access; generate migrations with `drizzle-kit`, never hand-write migration SQL.
 - Conventional commits (e.g. `feat(api):`, `docs(spec):`).
+- Tests follow [docs/testing.md](docs/testing.md): `*.test.ts(x)` is Vitest everywhere (`.integration` infix = needs real Postgres; root `e2e/` is Playwright's island); component behavior belongs in Storybook stories, not jsdom render tests; DB-backed suites fail loudly, never skip silently.
 - UI work follows the design language in [DESIGN.md](DESIGN.md) — compose `@workspace/ui` primitives and the semantic tokens; no ad-hoc colors or a brand hue (see its §10 Do/Don't).
 
 ## Storybook MCP tools
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4f107af4..4349bed5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 _Reverse-chronological record of shipped work — features, fixes, and chores. Newest first._
 
+# 2026-07-31
+
+- Rebuilt the testing architecture around one explicit contract, documented in [docs/testing.md](docs/testing.md) and validated by a three-model review panel against twelve placement scenarios before implementation. The old state had four runners and three different meanings for `.spec.ts` depending on directory: `apps/api` ran Jest (ts-jest) with unit `.spec.ts`, DB-backed `.integration.spec.ts` that **silently self-skipped to zero tests** without `TEST_DATABASE_URL` in the same `pnpm test` invocation, and a second Jest config for `test/*.e2e-spec.ts` held together by `forceExit`; `apps/web` ran Vitest `.test.ts(x)`; Playwright owned root `e2e/*.spec.ts`; the RLS proof lived in a 150-line bash provisioner (`rls-test.sh`). Now the pyramid is five layers with stock tools at every level: **`*.test.ts(x)` is Vitest everywhere** (root `e2e/` is Playwright's island with its own `.spec.ts` convention, unreachable by any Vitest glob; `nest g` no longer scaffolds `.spec.ts` files), and the `.integration` infix is the only other marker. `apps/api` migrated Jest→Vitest (80 files; `unplugin-swc` emits the decorator metadata Nest DI silently loses under esbuild) with three projects: `unit` (`pnpm test`, zero external deps), `integration`, and `evals` (opt-in via `RUN_MODEL_EVALS`). The **integration project is self-provisioning**: a Testcontainers globalSetup starts a throwaway Postgres and reproduces the worst-case self-hosted topology — a non-superuser `app` role that owns the schema and runs the migrations, plus the `app_rls` BYPASSRLS function owner — so `pnpm --filter api test:integration` is the entire story locally and in CI, `rls-test.sh` is deleted, and a green RLS suite still proves `FORCE` constrains even the table owner (`TEST_DATABASE_URL` overrides for docker-less machines). The api's separate HTTP-e2e layer was **dissolved into integration**: supertest suites are integration tests of the HTTP boundary, moved into `src/` feature modules as `*.integration.test.ts` (shared helpers in `src/testing/`), with the per-suite pg-boss schema isolation now covering every integration file; `worker.module` was likewise reclassified — it required a real Postgres while hiding in the unit suite. Nothing silently skips (no database = loud failure, not a green zero-test run) and the DB-backed turbo tasks are `cache: false`, because a stale cached PASS against live state turbo cannot hash would be worse than the silent skip this kills. Root `e2e/` reorganized per product surface (`e2e/web/` suites, `e2e/support/` boot infra), so a future non-browser surface adds `e2e/<surface>/` instead of competing for the root. The migration surfaced and fixed a real latent bug the silent-skip era had buried: `worker-harness.ts` only set `POSTGRES_URL` from `TEST_DATABASE_URL` when unset, but `ConfigModule.forRoot` had already leaked the developer's `.env.local` dev-database URL into `process.env` — so on a dev machine the durable-run worker suites would have run against the dev database; the override is now unconditional, and the globalSetup setting both URLs closes the same trap for the HTTP suites. Verified against a provisioned worst-case-owner Postgres: 507 unit and 256 integration tests green (including 8 formerly-skipped worker tests and the 62 former e2e tests); Playwright collects all 19 browser tests post-reorg. Ts-jest, the ESM `transformIgnorePatterns` hacks, `jest-e2e.json`, `rls-test.sh`, and six Jest-toolchain devDependencies are gone. The rebuild also revived the browser-e2e gate, red for 11 consecutive days on master: CI-history bisection plus failure-artifact analysis showed an unrelated Jul-20 flake turned the job red, after which #238 and #239 landed unnoticed breakage into it — two stale test vocabularies (Radix's `data-state="open"` vs Base UI's `data-open`; the pre-AI-Elements tool chip's "done" badge vs "Completed") now fixed, one real capacity flaw (the e2e api served the runs queue at concurrency 1 behind a dead `RUN_EXECUTION_MODE` env var; now 8 via the e2e instance config), and two genuine product regressions the red gate hid, filed as #259 (assistant answers render duplicated partial+final paragraphs on stream/resume) and #260 (browser `TypeError: reading 'state'` during tool runs). The job went from 6-7 failures to exactly the #259 family, and its runtime halved. Deliberate follow-ups are listed at the end of docs/testing.md: migrating story-eligible `apps/web` component tests into Storybook play tests per the ≤2-mocks rubric, replacing the source-regex `chat-page.hydration.test.ts` with behavioral coverage, removing the now-dead in-file `describeIfDb` guards, and ratcheting the four temporarily-disabled `vitest/*` oxlint style rules back on.
+
 # 2026-07-28
 
 - **BREAKING (operators with a custom `systemPromptFile`)**: model system-prompt files are now **Handlebars templates** instead of the bespoke `${model.id}` / `${model.name}` / `$${model.name}` grammar. Hard cutover, no dual-syntax window and no compatibility shim — llame is not in production use, so `${...}` simply carries no meaning now and is ordinary prose. The motivation is **absence, not syntax**: the old grammar could substitute a value but not express that one was missing, so an unset value left its label, heading, or enclosing sentence stranded — and per-user context, project instructions, and later memory surfaces all need exactly that. Three designs were tried to avoid conditionals and each failed on a concrete case (an llame-owned block operators could not reshape; a "drop the line whose expressions all render empty" rule that silently deleted operator instructions sharing the line; absence markers that put llame's prose inside operator sentences). Renderable paths remain exactly `{{model.id}}` and `{{model.name}}` — **no new data is exposed** — with `if`/`unless` conditionals, comments, and whitespace control now available to operators. Validation is **deny-by-default at boot** over the parsed AST: permitted node kinds are literal content, value expressions, block expressions, and comments; everything else aborts startup naming the model id and the construct, which covers partials in all three syntactic forms (`{{> x}}`, `{{#> x}}…{{/x}}`, and inline partials via `{{#*inline}}` — verified to render if permitted) that would otherwise reintroduce the prompt composition `model-system-prompts` forbids. One deliberate behavior change: an **unknown path aborts boot** (typos fail loudly) but an **absent value renders empty**, so `{{#if model.name}}…{{model.name}}…{{/if}}` is expressible. Three implementation facts were verified against handlebars 4.7.9 rather than assumed, and are documented in `apps/api/AGENTS.md` because each is a trap: `Handlebars.create()` shares `Utils` **by reference** with the global export, so patching `escapeExpression` on a "isolated" environment changes escaping process-wide — llame instead escapes when building the context and emits `SafeString`s; the default escaping converts `'`, `"`, `=`, and backticks into character references, mangling prose and code fragments, so escaping is narrowed to exactly `&`, `<`, `>`; and a `SafeString` is truthy **even when it wraps an empty string**, so absent and empty values are omitted from the render context entirely rather than passed as empty, or every `{{#if}}` over them would silently evaluate true (values are trimmed, whitespace-only counts as absent). The render context is a hand-built projection and never a database row — `users` carries a `password` column, and a row passed as context would put a credential hash into a system prompt, an immutable snapshot, and the owner-visible receipt.
diff --git a/apps/api/.oxlintrc.json b/apps/api/.oxlintrc.json
index 3e88c670..d3925698 100644
--- a/apps/api/.oxlintrc.json
+++ b/apps/api/.oxlintrc.json
@@ -3,15 +3,28 @@
   "options": {
     "typeAware": true
   },
+  "plugins": ["typescript", "unicorn", "oxc", "vitest"],
   "categories": {
     "correctness": "error"
   },
   "env": {
     "node": true,
-    "jest": true
+    "vitest": true
   },
   "ignorePatterns": ["dist/**", "src/db/migrations/**"],
   "rules": {
+    // Requires a type parameter on every `vi.fn()` — noisy against our test
+    // style, which relies on inference/assertion at the call site instead.
+    "vitest/require-mock-type-parameters": "off",
+    // Pre-existing test style predating the vitest plugin (expects inside
+    // rejects-catch blocks, shared beforeAll assertions, helper-asserting
+    // tests). Tightening these is follow-up cleanup, not part of the Jest →
+    // Vitest migration — flip one to "error" and fix its findings when
+    // touching the affected suites.
+    "vitest/no-conditional-expect": "off",
+    "vitest/no-standalone-expect": "off",
+    "vitest/require-to-throw-message": "off",
+    "vitest/expect-expect": "off",
     "typescript/await-thenable": "error",
     "typescript/no-array-delete": "error",
     "typescript/no-base-to-string": "error",
diff --git a/apps/api/AGENTS.md b/apps/api/AGENTS.md
index 09b2ebe6..9e22fa65 100644
--- a/apps/api/AGENTS.md
+++ b/apps/api/AGENTS.md
@@ -6,12 +6,14 @@ NestJS 11 backend: HTTP API, application services, sole owner of the database sc
 
 - NestJS 11 (`@nestjs/*`), Express platform
 - DB: Drizzle ORM via `@knaadh/nestjs-drizzle-postgres` + `postgres.js`; migrations with `drizzle-kit`
-- Tests: Jest (+ SWC); e2e under `test/`
+- Tests: Vitest (unplugin-swc emits the decorator metadata Nest DI needs); projects `unit` / `integration` — layers, naming, and commands in [docs/testing.md](../../docs/testing.md)
 
 ## Structure
 
 - `src/` — one directory per feature, each a NestJS module (`chats/`, `runs/`, `compaction/`, `titles/`, `queue/`, `models/`, `auth/`, `users/`, `db/`, `tools/`); a feature another feature consumes exports its service from its own module, never re-provided elsewhere. Boundary rules: `queue/` is consumed ONLY by `runs/` (chats dispatches runs via `RunDispatchService` and never sees queue names/payloads); `runs/` hosts the whole execution domain (executor, worker consumers, dispatch, stream bridge — `RunWorkerModule` backs both co-located consumers and the shipped dedicated worker entrypoint in `src/worker.ts`; `run-execution.service.ts` also owns the tool-calling loop's gate, `resolveAdvertisedTools` (`src/tools/registry.ts`) — the advertised/executable toolset is simply `allowlisted ∩ read_only`, sourced from `tools.allowed` in `llame.config.json` (no policy-verdict composition, no `TOOLS_ENABLED` env var — that machinery is gone). A real policy engine (org/user capability grants, deny-overrides-allow) is a later slice (#133); the gate is designed so it can later become "capability composition minus denies" without reworking the loop or the tool interface); `db/DbModule` is the single global `TenantDbService` provider
 - `src/db/` — `schema/` (`auth.ts`, `chats.ts`), `migrations/` (+ `meta/` journal), `migrate.ts`
+- `src/testing/` — shared helpers for the HTTP-boundary integration suites (supertest cookie/SSE/fake-model utilities); excluded from the build
+- `evals/` — opt-in model-graded suites (`test:evals`), never run by CI
 - `src/main.ts`, `src/worker.ts`, `src/app.module.ts`
 
 ## Commands
@@ -21,7 +23,9 @@ pnpm --filter api dev          # nest start --watch
 pnpm --filter api build        # nest build  (start:prod -> node dist/main)
 pnpm --filter api lint         # oxlint --deny-warnings; type-aware rules via tsgolint (tsgo)  (lint:fix to autofix)
 pnpm --filter api typecheck    # tsgo --noEmit — full program incl. specs (nest build excludes them)
-pnpm --filter api test         # jest  (also test:e2e, test:cov)
+pnpm --filter api test              # vitest unit project — zero external deps, always safe
+pnpm --filter api test:integration  # everything needing real Postgres incl. RLS proof + HTTP suites; self-provisions via Testcontainers (docker), TEST_DATABASE_URL overrides
+pnpm --filter api test:evals        # opt-in model-graded evals — bring model credentials; DB self-provisions (TEST_DATABASE_URL overrides)
 pnpm --filter api db:generate  # drizzle-kit generate from src/db/schema
 pnpm --filter api db:migrate   # tsx src/db/migrate.ts
 pnpm --filter api db:studio    # drizzle-kit studio (also db:push / db:check)
@@ -119,8 +123,9 @@ Migrations run as a **non-superuser `app` role that owns the schema** (provision
   bypasses RLS, so a single-role self-hosted deployment would silently lose tenant isolation.
 - Every request must run inside `TenantDbService.runAs(userId, …)`, which sets
   `app.current_user_id` transaction-locally. If it is unset, every RLS policy denies all rows.
-- `scripts/rls-test.sh` re-proves cross-tenant isolation **and** runs the auth e2e
-  (real HTTP via supertest) against a throwaway Postgres (non-superuser owner + FORCE).
+- `pnpm --filter api test:integration` re-proves cross-tenant isolation **and** runs the
+  HTTP-boundary suites (real HTTP via supertest) against a throwaway Postgres its
+  Testcontainers globalSetup provisions with the same non-superuser owner + FORCE topology.
   Run it after touching the schema, RLS, `TenantDbService`, or the auth/HTTP surface.
 
 ### `app_rls` (BYPASSRLS) — required for org-unit/membership RLS
@@ -144,7 +149,7 @@ table — `BYPASSRLS` is the only thing that outranks `FORCE`.
    (a privilege grant, which the table owner can do for any role with no
    membership needed).
 2. `docker/postgres/rls-function-owner.sql`, run as the `postgres` **superuser**
-   (`pnpm db:provision-rls`; `scripts/rls-test.sh` runs the equivalent against its
+   (`pnpm db:provision-rls`; `test:integration`'s globalSetup runs the equivalent against its
    own throwaway container), reassigns the function's ownership to `app_rls`.
 
 Why not just do the ownership reassignment in the migration too: `ALTER FUNCTION
@@ -198,7 +203,7 @@ this split exists to avoid.
 ## Gotchas
 
 - `apps/api/src/db` is the **sole** schema; `apps/web` owns no database.
-- Linting is oxlint with type-aware rules (`.oxlintrc.json`, `options.typeAware`) running on **tsgo** (TypeScript 7). tsgo rejects `baseUrl`, so `tsconfig.json` must not reintroduce it, and global test/node types are declared explicitly via `"types": ["node", "jest"]` (tsgo does not auto-include `@types/*` under pnpm the way tsc does). Formatting is prettier (`pnpm format`), checked in CI via the root `format:check` — it is no longer an ESLint rule.
+- Linting is oxlint with type-aware rules (`.oxlintrc.json`, `options.typeAware`) running on **tsgo** (TypeScript 7). tsgo rejects `baseUrl`, so `tsconfig.json` must not reintroduce it, and global test/node types are declared explicitly via `"types": ["node", "vitest/globals"]` (tsgo does not auto-include `@types/*` under pnpm the way tsc does). Formatting is prettier (`pnpm format`), checked in CI via the root `format:check` — it is no longer an ESLint rule.
 - Migrations are `drizzle-kit`-generated (`0005`+). Hand-authored exceptions: `0004` (the PoC → multi-tenant transition — drizzle-kit's interactive column-rename can't be driven non-interactively; `FORCE ROW LEVEL SECURITY` is hand-maintained here too, Drizzle can't express it), `0006` (the sessions hashing migration carries a manual `DELETE FROM sessions` — raw tokens can't be carried into the hashed-at-rest model), `0010` (the nullable-title migration carries a manual `UPDATE` backfilling old default-literal titles to NULL, and drops a spurious generated DROP/CREATE of the unchanged `sessions_user_created_idx`), `0011` (the durable-runs migration hand-appends `FORCE ROW LEVEL SECURITY` for `runs`/`run_events` — Drizzle emits ENABLE only — and hand-reorders the composite-key unique indexes before the FKs that reference them), `0012` (the single-flight migration carries a manual `UPDATE` cancelling all but the newest non-terminal run per chat — the partial unique index cannot be created over duplicates — plus matching `run.cancelled` events, applied inside a NO FORCE RLS window since migrations run as the owning role), `0013` (the `in_reply_to` reply-integrity trigger, #73 — Drizzle can't express triggers), `0018` (the identity/org-units migration hand-appends `FORCE ROW LEVEL SECURITY` for `org_units`/`memberships`/`external_identities`, same as `0004`/`0011`), and `0019` (org-units production-grade invariants — hand-appends the `llame_role_on_unit_path` `SECURITY DEFINER` function (owned by `app` until the separate `pnpm db:provision-rls` step reassigns it to `app_rls` — see "`app_rls` (BYPASSRLS)" above) + `GRANT SELECT ... TO app_rls`, the deferred path-integrity constraint trigger on `org_units` (+ a `DO`-block assertion that pre-existing rows already satisfy it), and the last-owner `BEFORE UPDATE OR DELETE` trigger on `memberships` — Drizzle can express none of CREATE FUNCTION or CREATE [CONSTRAINT] TRIGGER), and `0020` (the `runs.model_id` migration carries a manual `UPDATE` backfilling existing rows to the canonical default `system:openai:gpt-5.4-mini` before `SET NOT NULL` — drizzle-kit emits only `ADD COLUMN` + `SET NOT NULL` — inside a NO FORCE RLS window, same as `0012`, since migrations run as the owning `app` role with no `app.current_user_id` and FORCE would silently no-op the update), `0021` (the projects migration hand-appends `FORCE ROW LEVEL SECURITY` for `projects`, same as `0004`/`0011`/`0018`), and `0022` (the `org_unit_type` recreate dropping `'project'` from the vocabulary, admin-area-org-tree D5 — drizzle-kit's generated enum-recreate converts the column to `text`, drops/recreates the enum, then casts back with a `USING` clause; it doesn't account for existing rows holding a value about to be dropped, so a manual `UPDATE org_units SET type = 'group' WHERE type = 'project'` is hand-inserted while the column is still plain `text`, before the project-less enum exists — otherwise the final `USING` cast would fail on any stray `project`-typed row; the UPDATE runs inside a NO FORCE RLS window, same as `0012`/`0020`, since `org_units` is FORCE RLS (`0018`) and migrations run with no `app.current_user_id` — without the window the backfill silently no-ops and the cast aborts), and `0023` (the rework-item-pinning migration hand-appends `FORCE ROW LEVEL SECURITY` for `pins`, same as `0021` — it also drops `chats.pinned_at` + `chats_owner_pinned_updated_idx`, replacing row-level chat pinning with the per-user `pins` table; no data backfill by design), and `20260712055209_search_projection` (chat-search-platform #195 — hand-prepends `CREATE EXTENSION IF NOT EXISTS pg_trgm` (trusted contrib, creatable by the non-superuser `app` role; MUST precede the `gin_trgm_ops` index), hand-appends `FORCE ROW LEVEL SECURITY` for `search_documents`/`search_chat_state` (same as `0004`/`0011`/`0018`/`0021`/`0023`), and the `llame_search_stale_chats(integer, integer)` `SECURITY DEFINER` staleness-discovery function — owned by `app` until `pnpm db:provision-rls` reassigns it to `app_rls`, same lifecycle as `0019`'s `llame_role_on_unit_path`, plus `GRANT SELECT ON chats, messages, search_chat_state TO app_rls` (the function's message-time staleness subquery reads `messages`); the function returns only identifiers + timestamps, never content), and `20260713020237_rename_search_documents` (chat-search-platform D1 naming — a hand-authored, **non-destructive** `ALTER TABLE "search_documents" RENAME TO "search_chat_documents"` plus every dependent object rename: the 5 indexes, the pkey + 2 FK constraints (renaming the pkey constraint auto-renames its backing index), and the RLS policy. drizzle-kit can't emit a table rename non-interactively, and this rename **must** preserve the rows already shipped to existing databases under the old name — so it is a forward ALTER on top of `20260712055209_search_projection`, NOT a regenerated create. `search_chat_state` is unchanged; `llame_search_stale_chats` reads `search_chat_state`/`chats`/`messages`, never this table, so it needs no change. Proven non-destructive against a live DB in a rolled-back transaction; FORCE RLS survives the rename). `drizzle-kit check` passes for all. Re-add the manual steps if you ever regenerate these.
 - `20260718134220_flashy_infant_terrible` is otherwise Drizzle-generated, but hand-appends `FORCE ROW LEVEL SECURITY` for `model_context_snapshots` because `.enableRLS()` emits only `ENABLE`; re-add that statement if the migration is regenerated.
-- Migration filenames: `0000`–`0023` are index-prefixed; `drizzle.config.ts` now sets `migrations.prefix: 'timestamp'`, so newer migrations are named `YYYYMMDDHHMMSS_<name>.sql` and parallel branches no longer collide on the next sequential number — only `meta/_journal.json` still conflicts (append-only entries; resolve a merge by keeping both and renumbering `idx`). Apply **order comes from the journal, not filenames**, and the migrator applies an entry only when its `when` is newer than the newest already-applied migration — an out-of-order entry is **silently skipped on existing databases**. `src/db/migration-journal.spec.ts` pins both invariants (contiguous `idx`, strictly increasing `when`); if it fails after a rebase because master gained newer migrations, regenerate your migration (or re-stamp its journal `when`) so it sorts last. `0004`'s hand-stamped `when` originally violated this (older than `0003`'s — a database parked at `0003` would have silently skipped it) and was re-stamped when the guard landed.
+- Migration filenames: `0000`–`0023` are index-prefixed; `drizzle.config.ts` now sets `migrations.prefix: 'timestamp'`, so newer migrations are named `YYYYMMDDHHMMSS_<name>.sql` and parallel branches no longer collide on the next sequential number — only `meta/_journal.json` still conflicts (append-only entries; resolve a merge by keeping both and renumbering `idx`). Apply **order comes from the journal, not filenames**, and the migrator applies an entry only when its `when` is newer than the newest already-applied migration — an out-of-order entry is **silently skipped on existing databases**. `src/db/migration-journal.test.ts` pins both invariants (contiguous `idx`, strictly increasing `when`); if it fails after a rebase because master gained newer migrations, regenerate your migration (or re-stamp its journal `when`) so it sorts last. `0004`'s hand-stamped `when` originally violated this (older than `0003`'s — a database parked at `0003` would have silently skipped it) and was re-stamped when the guard landed.
diff --git a/apps/api/test/qa-evals.e2e-spec.ts b/apps/api/evals/qa-evals.test.ts
similarity index 95%
rename from apps/api/test/qa-evals.e2e-spec.ts
rename to apps/api/evals/qa-evals.test.ts
index 246159e9..4605b98c 100644
--- a/apps/api/test/qa-evals.e2e-spec.ts
+++ b/apps/api/evals/qa-evals.test.ts
@@ -13,14 +13,15 @@
  * Unlike the other e2e suites this one does NOT fake the model client, so it
  * spends provider tokens. It is therefore double-gated and skipped by default:
  *
- *   RUN_MODEL_EVALS=1  — explicit opt-in (keeps rls-test.sh / CI free)
- *   POSTGRES_URL       — a migrated database (the loop persists turns)
+ *   RUN_MODEL_EVALS=1  — explicit opt-in (keeps test:integration / CI free)
+ *   a database — the integration project's globalSetup self-provisions one
+ *   (Testcontainers), or point TEST_DATABASE_URL at your own migrated DB
  *   OPENAI_API_KEY     — via env or apps/api/.env.local, when the endpoint needs one
  *   OPENAI_BASE_URL    — optional cheap/free OpenAI-compatible endpoint
  *   DEFAULT_MODEL_ID   — the llame model id to execute (default example:
  *                        system:openai:gpt-5.4-mini)
  *
- *   RUN_MODEL_EVALS=1 POSTGRES_URL=... pnpm --filter api test:evals
+ *   pnpm --filter api test:evals   (sets RUN_MODEL_EVALS=1 itself)
  *
  * The overflow case's aggressive compaction threshold (providers-and-models-
  * as-code, #167) comes from the target model's `compactionThresholdTokens` in
@@ -43,7 +44,7 @@ import { configureApp } from './../src/app.setup';
 import { TenantDbService } from './../src/db/tenant-db.service';
 import { CompactionsRepository } from './../src/chats/chats-repository';
 import { type Compaction } from './../src/db/schema';
-import { cookieOf, streamedText } from './support';
+import { cookieOf, streamedText } from '../src/testing/support';
 
 const enabled =
   process.env.RUN_MODEL_EVALS === '1' && !!process.env.POSTGRES_URL;
@@ -52,7 +53,6 @@ const evalModelId =
   process.env.DEFAULT_MODEL_ID?.trim() || 'system:openai:gpt-5.4-mini';
 
 // A real model call (plus a compaction call) sits behind each turn.
-jest.setTimeout(120_000);
 
 async function waitFor<T>(
   poll: () => Promise<T | undefined>,
diff --git a/apps/api/nest-cli.json b/apps/api/nest-cli.json
index 0efa7058..79825b64 100644
--- a/apps/api/nest-cli.json
+++ b/apps/api/nest-cli.json
@@ -2,6 +2,9 @@
   "$schema": "https://json.schemastore.org/nest-cli",
   "collection": "@nestjs/schematics",
   "sourceRoot": "src",
+  "generateOptions": {
+    "spec": false
+  },
   "compilerOptions": {
     "deleteOutDir": true,
     "assets": ["instance-config/llame.config.schema.json", "prompts/*.md"],
diff --git a/apps/api/package.json b/apps/api/package.json
index c5ccf788..785cabba 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -7,7 +7,7 @@
   "license": "UNLICENSED",
   "scripts": {
     "build": "nest build && node dist/instance-config/prompt-built-runtime.contract.js && node dist/generate-openapi.js && prettier --write --log-level warn openapi.json",
-    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
+    "format": "prettier --write \"src/**/*.ts\" \"evals/**/*.ts\"",
     "dev": "nest start --watch",
     "dev:studio": "drizzle-kit studio",
     "start": "nest start",
@@ -20,12 +20,10 @@
     "lint": "oxlint --deny-warnings",
     "lint:fix": "oxlint --fix",
     "typecheck": "tsgo --noEmit",
-    "test": "jest --maxWorkers=2",
-    "test:watch": "jest --watch",
-    "test:cov": "jest --coverage",
-    "test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
-    "test:e2e": "jest --config ./test/jest-e2e.json",
-    "test:evals": "RUN_MODEL_EVALS=1 jest --config ./test/jest-e2e.json --testPathPattern qa-evals --silent=false",
+    "test": "vitest run --project unit",
+    "test:watch": "vitest --project unit",
+    "test:integration": "vitest run --project integration",
+    "test:evals": "RUN_MODEL_EVALS=1 vitest run --project integration qa-evals",
     "db:generate": "drizzle-kit generate && prettier --write --log-level warn \"src/db/migrations/meta/**/*.json\"",
     "db:migrate": "npx tsx src/db/migrate.ts",
     "db:studio": "drizzle-kit studio",
@@ -69,51 +67,21 @@
     "@nestjs/testing": "^11.0.1",
     "@swc/cli": "^0.6.0",
     "@swc/core": "^1.10.7",
+    "@testcontainers/postgresql": "12.0.4",
     "@types/express": "^5.0.0",
-    "@types/jest": "^29.5.14",
     "@types/node": "catalog:",
     "@types/supertest": "^6.0.2",
     "@types/uuid": "^10.0.0",
     "@typescript/native-preview": "catalog:",
     "drizzle-kit": "^0.31.4",
-    "jest": "^29.7.0",
     "oxlint": "catalog:",
     "oxlint-tsgolint": "^0.24.0",
     "prettier": "catalog:",
     "source-map-support": "^0.5.21",
     "supertest": "^7.0.0",
-    "ts-jest": "^29.2.5",
-    "ts-loader": "^9.5.2",
-    "ts-node": "^10.9.2",
-    "tsconfig-paths": "^4.2.0",
     "tsx": "catalog:",
-    "typescript": "catalog:"
-  },
-  "jest": {
-    "moduleFileExtensions": [
-      "js",
-      "json",
-      "ts"
-    ],
-    "rootDir": "src",
-    "testRegex": ".*\\.spec\\.ts$",
-    "transform": {
-      "^.+\\.(t|j)s$": [
-        "ts-jest",
-        {
-          "tsconfig": {
-            "allowJs": true
-          }
-        }
-      ]
-    },
-    "transformIgnorePatterns": [
-      "node_modules/(?!\\.pnpm/(pg-boss@|serialize-error@|non-error@)|(pg-boss|serialize-error|non-error)/)"
-    ],
-    "collectCoverageFrom": [
-      "**/*.(t|j)s"
-    ],
-    "coverageDirectory": "../coverage",
-    "testEnvironment": "node"
+    "typescript": "catalog:",
+    "unplugin-swc": "1.5.9",
+    "vitest": "catalog:"
   }
 }
diff --git a/apps/api/scripts/rls-test.sh b/apps/api/scripts/rls-test.sh
deleted file mode 100755
index e1b1dbb6..00000000
--- a/apps/api/scripts/rls-test.sh
+++ /dev/null
@@ -1,136 +0,0 @@
-#!/usr/bin/env bash
-#
-# Prove the multi-tenant RLS moat (#53) against a real Postgres.
-#
-# Spins up a throwaway Postgres in docker, creates a NON-superuser role `app` that
-# OWNS the schema (the worst case for a self-hosted single-role deployment), applies
-# all migrations as that role, then runs the RLS integration suite connected as it.
-# A green run proves FORCE ROW LEVEL SECURITY is enforcing isolation even against the
-# table owner — ENABLE alone would let the owner bypass RLS and leak across tenants.
-#
-# Usage:  apps/api/scripts/rls-test.sh
-# Requires: docker.
-set -euo pipefail
-
-API_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-IMAGE="${RLS_TEST_PG_IMAGE:-postgres:17-alpine}"
-
-# TCP reachability probe from the HOST. `/dev/tcp` because it needs no extra
-# tooling; `127.0.0.1` (not `localhost`) sidesteps hosts where `localhost`
-# resolves IPv6-first to `::1` (docker's `-p` only publishes on IPv4).
-# `timeout` is GNU coreutils and isn't guaranteed present (e.g. a stock
-# macOS/BSD shell) — fall back to a bare probe there; a connection to a
-# closed/absent localhost port fails near-instantly either way.
-port_in_use() {
-  if command -v timeout >/dev/null 2>&1; then
-    timeout 1 bash -c "exec 3<>/dev/tcp/127.0.0.1/$1" >/dev/null 2>&1
-  else
-    bash -c "exec 3<>/dev/tcp/127.0.0.1/$1" >/dev/null 2>&1
-  fi
-}
-
-# Container name and host port are per-invocation (#164): two harness runs on
-# one machine (parallel agent worktrees, or a dev run next to CI-local tooling)
-# used to share `llame-rls-test`/55432 and kill each other's container
-# mid-lifecycle (observed: "duplicate role", ECONNRESET, "container not
-# running" caused by the sibling run). An explicit RLS_TEST_PORT still wins;
-# otherwise probe 55440–55490 for a free port.
-CONTAINER="llame-rls-test-$$"
-if [ -n "${RLS_TEST_PORT:-}" ]; then
-  PORT="$RLS_TEST_PORT"
-else
-  PORT=""
-  for candidate in $(seq 55440 55490); do
-    if ! port_in_use "$candidate"; then
-      PORT="$candidate"
-      break
-    fi
-  done
-  if [ -z "$PORT" ]; then
-    echo "✗ no free port in 55440–55490 (set RLS_TEST_PORT to override)" >&2
-    exit 1
-  fi
-fi
-APP_URL="postgres://app:app@localhost:${PORT}/llame_test"
-
-cleanup() { docker rm -f "$CONTAINER" >/dev/null 2>&1 || true; }
-trap cleanup EXIT
-cleanup
-
-echo "▶ starting $IMAGE on :$PORT"
-docker run -d --name "$CONTAINER" -e POSTGRES_PASSWORD=postgres \
-  -p "${PORT}:5432" "$IMAGE" >/dev/null
-
-# Host-side reachability for the readiness loop below. BOTH: postgres
-# accepting INSIDE the container (pg_isready, checked by the caller), AND the
-# published port reachable from the HOST. Under WSL2/Docker the host
-# port-forward can lag the container's internal readiness by seconds under
-# load — checking only `docker exec pg_isready` (internal) let migrate
-# connect from the host too early and hit CONNECT_TIMEOUT. The outer
-# 60-iteration loop bounds total wait.
-host_reachable() {
-  port_in_use "$PORT"
-}
-
-echo -n "▶ waiting for postgres"
-ready=false
-for _ in $(seq 1 60); do
-  if docker exec "$CONTAINER" pg_isready -h 127.0.0.1 -U postgres >/dev/null 2>&1 \
-    && host_reachable; then
-    ready=true; break
-  fi
-  echo -n "."; sleep 1
-done
-if [ "$ready" != true ]; then
-  echo " TIMEOUT"
-  echo "✗ postgres did not become ready within 60s" >&2
-  exit 1
-fi
-echo " ready"
-
-echo "▶ provisioning non-superuser owner role 'app'"
-docker exec -e PGPASSWORD=postgres -i "$CONTAINER" \
-  psql -h 127.0.0.1 -U postgres -v ON_ERROR_STOP=1 >/dev/null <<'SQL'
-CREATE ROLE app LOGIN PASSWORD 'app' NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE;
-CREATE DATABASE llame_test OWNER app;
-SQL
-
-echo "▶ provisioning 'app_rls' BYPASSRLS role (docker/postgres/initdb/02-app-rls-role.sql, mirrored here"
-echo "  since this script builds its own throwaway container rather than mounting initdb/)"
-docker exec -e PGPASSWORD=postgres -i "$CONTAINER" \
-  psql -h 127.0.0.1 -U postgres -d llame_test -v ON_ERROR_STOP=1 >/dev/null <<'SQL'
-CREATE ROLE app_rls WITH NOLOGIN NOSUPERUSER BYPASSRLS NOCREATEDB NOCREATEROLE;
-SQL
-# app must own schema `public` to create tables in it (PG15+ locks this down).
-docker exec -e PGPASSWORD=postgres -i "$CONTAINER" \
-  psql -h 127.0.0.1 -U postgres -d llame_test -v ON_ERROR_STOP=1 >/dev/null <<'SQL'
-ALTER SCHEMA public OWNER TO app;
-SQL
-
-echo "▶ applying migrations as 'app' (so app owns every table)"
-( cd "$API_DIR" && POSTGRES_URL="$APP_URL" pnpm db:migrate )
-
-echo "▶ granting app_rls ownership of the RLS helper function (docker/postgres/rls-function-owner.sql —"
-echo "  ALTER FUNCTION ... OWNER TO needs superuser, not the migrating 'app' role; see that file for why)"
-docker exec -e PGPASSWORD=postgres -i "$CONTAINER" \
-  psql -h 127.0.0.1 -U postgres -d llame_test -v ON_ERROR_STOP=1 \
-  < "$(cd "$API_DIR/../.." && pwd)/docker/postgres/rls-function-owner.sql" >/dev/null
-
-echo "▶ running RLS + queue integration suites as 'app' (the '.integration' glob"
-echo "  covers every *.integration.spec.ts — chats-rls, compaction-surfacing,"
-echo "  chats-search, chat-sharing, chats-delete, chat-pinning, fork-chat,"
-echo "  identity-rls, identity-admin, identity-invariants, queue — no separate"
-echo "  per-suite steps needed; keeps new integration specs covered automatically)"
-# --runInBand: every suite opens its own pool against the ONE throwaway
-# database; parallel workers contend on it (same class as the documented e2e
-# flake) and a real RLS regression could be misread as "the known flake".
-# This is the mandated isolation gate — determinism beats a faster wall clock.
-( cd "$API_DIR" && TEST_DATABASE_URL="$APP_URL" pnpm exec jest '.integration' --silent=false --runInBand )
-
-echo "▶ running active-runs integration suite (run-notification re-hydration + RLS)"
-( cd "$API_DIR" && TEST_DATABASE_URL="$APP_URL" pnpm exec jest active-runs.integration --silent=false )
-
-echo "▶ running auth e2e (real HTTP) against the same database"
-( cd "$API_DIR" && POSTGRES_URL="$APP_URL" RUN_STREAM_MAX_MS=20000 pnpm exec jest --config ./test/jest-e2e.json --silent=false )
-
-echo "✓ RLS moat proven + queue substrate proven + auth surface verified end-to-end over HTTP"
diff --git a/apps/api/src/app.controller.spec.ts b/apps/api/src/app.controller.test.ts
similarity index 100%
rename from apps/api/src/app.controller.spec.ts
rename to apps/api/src/app.controller.test.ts
diff --git a/apps/api/test/app.e2e-spec.ts b/apps/api/src/app.integration.test.ts
similarity index 92%
rename from apps/api/test/app.e2e-spec.ts
rename to apps/api/src/app.integration.test.ts
index 36852c54..49250831 100644
--- a/apps/api/test/app.e2e-spec.ts
+++ b/apps/api/src/app.integration.test.ts
@@ -2,7 +2,7 @@ import { Test, TestingModule } from '@nestjs/testing';
 import { INestApplication } from '@nestjs/common';
 import request from 'supertest';
 import { App } from 'supertest/types';
-import { AppModule } from './../src/app.module';
+import { AppModule } from './app.module';
 
 describe('AppController (e2e)', () => {
   let app: INestApplication<App>;
diff --git a/apps/api/src/app.module.ts b/apps/api/src/app.module.ts
index de89d7ae..c9c29c87 100644
--- a/apps/api/src/app.module.ts
+++ b/apps/api/src/app.module.ts
@@ -14,6 +14,16 @@ import { IdentityModule } from './identity/identity.module';
 import { AuthModule } from './auth/auth.module';
 import { SessionAuthGuard } from './auth/session-auth.guard';
 
+// Global per-IP request ceiling per minute. Env-tunable for the same reason
+// AUTH_RATE_LIMIT_PER_MINUTE is (auth/constants.ts): the browser e2e harness
+// drives many parallel workers — page loads, history fetches, run polling —
+// from ONE IP, so the production-strict default starves it. Read once at
+// boot, like its auth counterpart; production keeps the default.
+const API_RATE_LIMIT_PER_MINUTE = (() => {
+  const raw = Number(process.env.API_RATE_LIMIT_PER_MINUTE);
+  return Number.isInteger(raw) && raw > 0 ? raw : 300;
+})();
+
 @Module({
   imports: [
     // Config-as-code loading, DB_DEV, TenantDbService (core-infra.module.ts) —
@@ -27,7 +37,9 @@ import { SessionAuthGuard } from './auth/session-auth.guard';
     // effective ceiling is N× and resets on restart. Acceptable single-node;
     // a shared ThrottlerStorage becomes necessary with #116 (docs/scaling.md).
     ThrottlerModule.forRoot({
-      throttlers: [{ name: 'default', ttl: 60_000, limit: 300 }],
+      throttlers: [
+        { name: 'default', ttl: 60_000, limit: API_RATE_LIMIT_PER_MINUTE },
+      ],
     }),
     AuthModule,
     UsersModule,
diff --git a/apps/api/src/app.setup.spec.ts b/apps/api/src/app.setup.test.ts
similarity index 90%
rename from apps/api/src/app.setup.spec.ts
rename to apps/api/src/app.setup.test.ts
index 7dcae1c6..a76fa21d 100644
--- a/apps/api/src/app.setup.spec.ts
+++ b/apps/api/src/app.setup.test.ts
@@ -5,8 +5,8 @@ import { RegisterDto } from './auth/dto/auth.dto';
 
 describe('configureApp', () => {
   it('installs a fail-closed global ValidationPipe', () => {
-    const useGlobalPipes = jest.fn();
-    const enableCors = jest.fn();
+    const useGlobalPipes = vi.fn();
+    const enableCors = vi.fn();
     const app = {
       useGlobalPipes,
       enableCors,
@@ -29,8 +29,8 @@ describe('configureApp', () => {
     process.env.WEB_ORIGIN =
       'https://app.example.com, https://admin.example.com';
 
-    const useGlobalPipes = jest.fn();
-    const enableCors = jest.fn();
+    const useGlobalPipes = vi.fn();
+    const enableCors = vi.fn();
     const app = {
       useGlobalPipes,
       enableCors,
@@ -59,8 +59,8 @@ describe('configureApp', () => {
     delete process.env.WEB_ORIGIN;
 
     const app = {
-      useGlobalPipes: jest.fn(),
-      enableCors: jest.fn(),
+      useGlobalPipes: vi.fn(),
+      enableCors: vi.fn(),
     } as unknown as INestApplication;
 
     try {
@@ -82,8 +82,8 @@ describe('configureApp', () => {
   it('fails closed when a web origin carries a path or trailing slash', () => {
     const originalWebOrigin = process.env.WEB_ORIGIN;
     const app = {
-      useGlobalPipes: jest.fn(),
-      enableCors: jest.fn(),
+      useGlobalPipes: vi.fn(),
+      enableCors: vi.fn(),
     } as unknown as INestApplication;
 
     try {
@@ -109,8 +109,8 @@ describe('configureApp', () => {
     process.env.WEB_ORIGIN = '*';
 
     const app = {
-      useGlobalPipes: jest.fn(),
-      enableCors: jest.fn(),
+      useGlobalPipes: vi.fn(),
+      enableCors: vi.fn(),
     } as unknown as INestApplication;
 
     try {
@@ -125,10 +125,10 @@ describe('configureApp', () => {
   });
 
   it('does not touch the Express trust-proxy setting when no trustProxy value is resolved', () => {
-    const getHttpAdapter = jest.fn();
+    const getHttpAdapter = vi.fn();
     const app = {
-      useGlobalPipes: jest.fn(),
-      enableCors: jest.fn(),
+      useGlobalPipes: vi.fn(),
+      enableCors: vi.fn(),
       getHttpAdapter,
     } as unknown as INestApplication;
 
@@ -138,13 +138,13 @@ describe('configureApp', () => {
   });
 
   it('applies the resolved trustProxy value to the Express instance', () => {
-    const set = jest.fn();
-    const getHttpAdapter = jest.fn(() => ({
+    const set = vi.fn();
+    const getHttpAdapter = vi.fn(() => ({
       getInstance: () => ({ set }),
     }));
     const app = {
-      useGlobalPipes: jest.fn(),
-      enableCors: jest.fn(),
+      useGlobalPipes: vi.fn(),
+      enableCors: vi.fn(),
       getHttpAdapter,
     } as unknown as INestApplication;
 
diff --git a/apps/api/src/auth/auth.controller.spec.ts b/apps/api/src/auth/auth.controller.test.ts
similarity index 94%
rename from apps/api/src/auth/auth.controller.spec.ts
rename to apps/api/src/auth/auth.controller.test.ts
index 84f3f06b..89ed1279 100644
--- a/apps/api/src/auth/auth.controller.spec.ts
+++ b/apps/api/src/auth/auth.controller.test.ts
@@ -22,8 +22,8 @@ describe('auth session cookies', () => {
   it('sets and clears the session cookie with the same configured domain', () => {
     process.env.SESSION_COOKIE_DOMAIN = '.example.com';
     const expires = new Date('2030-01-01T00:00:00.000Z');
-    const cookie = jest.fn();
-    const clearCookie = jest.fn();
+    const cookie = vi.fn();
+    const clearCookie = vi.fn();
     const response = {
       cookie,
       clearCookie,
@@ -56,8 +56,8 @@ describe('auth session cookies', () => {
     process.env.NODE_ENV = 'production';
     delete process.env.SESSION_COOKIE_DOMAIN;
     const response = {
-      cookie: jest.fn(),
-      clearCookie: jest.fn(),
+      cookie: vi.fn(),
+      clearCookie: vi.fn(),
     } as unknown as Response;
 
     expect(() =>
diff --git a/apps/api/test/auth.e2e-spec.ts b/apps/api/src/auth/auth.integration.test.ts
similarity index 94%
rename from apps/api/test/auth.e2e-spec.ts
rename to apps/api/src/auth/auth.integration.test.ts
index 9f7a8016..b1887a56 100644
--- a/apps/api/test/auth.e2e-spec.ts
+++ b/apps/api/src/auth/auth.integration.test.ts
@@ -6,7 +6,7 @@
  * proves the surface works for a client, not just that units pass in isolation.
  *
  * Requires POSTGRES_URL to point at a migrated database whose role is non-superuser
- * (so RLS is enforced). scripts/rls-test.sh provisions exactly that and runs this file.
+ * (so RLS is enforced). the test:integration globalSetup provisions exactly that and runs this file.
  * Without POSTGRES_URL the whole suite is skipped (so `pnpm test` stays green offline).
  */
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
@@ -16,12 +16,12 @@
 import { INestApplication } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import request from 'supertest';
-import { AppModule } from './../src/app.module';
-import { configureApp } from './../src/app.setup';
-import { TenantDbService } from './../src/db/tenant-db.service';
-import { ChatsRepository } from './../src/chats/chats-repository';
+import { AppModule } from '../app.module';
+import { configureApp } from '../app.setup';
+import { TenantDbService } from '../db/tenant-db.service';
+import { ChatsRepository } from '../chats/chats-repository';
 
-import { cookieOf } from './support';
+import { cookieOf } from '../testing/support';
 
 const hasDb = !!process.env.POSTGRES_URL;
 const d = hasDb ? describe : describe.skip;
diff --git a/apps/api/src/auth/auth.service.spec.ts b/apps/api/src/auth/auth.service.test.ts
similarity index 83%
rename from apps/api/src/auth/auth.service.spec.ts
rename to apps/api/src/auth/auth.service.test.ts
index b6cd3998..fd33863d 100644
--- a/apps/api/src/auth/auth.service.spec.ts
+++ b/apps/api/src/auth/auth.service.test.ts
@@ -7,6 +7,7 @@ import type { SessionsRepository } from './sessions.repository';
 import type { UsersService } from '../users/users.service';
 import type { User } from '../db/schema';
 
+import type { Mocked } from 'vitest';
 const user: User = {
   id: 'user-1',
   name: 'Alice',
@@ -22,30 +23,30 @@ function makeService(overrides?: {
   passwordService?: Partial<PasswordService>;
 }) {
   const users = {
-    getUserByEmail: jest.fn(),
-    getUserById: jest.fn(),
-    createUser: jest.fn(),
+    getUserByEmail: vi.fn(),
+    getUserById: vi.fn(),
+    createUser: vi.fn(),
     ...overrides?.users,
-  } as unknown as jest.Mocked<UsersService>;
+  } as unknown as Mocked<UsersService>;
 
   const sessions = {
-    create: jest.fn(),
-    findActiveAndTouch: jest.fn(),
-    deleteStaleByTokenHash: jest.fn(),
-    deleteByIdForUser: jest.fn(),
-    deleteCurrentForUser: jest.fn(),
-    deleteOthersForUser: jest.fn(),
-    deleteAllForUser: jest.fn(),
-    listForUser: jest.fn(),
-    findByIdForUser: jest.fn(),
+    create: vi.fn(),
+    findActiveAndTouch: vi.fn(),
+    deleteStaleByTokenHash: vi.fn(),
+    deleteByIdForUser: vi.fn(),
+    deleteCurrentForUser: vi.fn(),
+    deleteOthersForUser: vi.fn(),
+    deleteAllForUser: vi.fn(),
+    listForUser: vi.fn(),
+    findByIdForUser: vi.fn(),
     ...overrides?.sessions,
-  } as unknown as jest.Mocked<SessionsRepository>;
+  } as unknown as Mocked<SessionsRepository>;
 
   const passwordService = {
-    hash: jest.fn(),
-    compare: jest.fn(),
+    hash: vi.fn(),
+    compare: vi.fn(),
     ...overrides?.passwordService,
-  } as unknown as jest.Mocked<PasswordService>;
+  } as unknown as Mocked<PasswordService>;
 
   const tokenService = new SessionTokenService();
   const service = new AuthService(
@@ -60,7 +61,7 @@ function makeService(overrides?: {
 
 describe('AuthService', () => {
   const metadata: SessionMetadata = {
-    userAgent: 'jest-agent',
+    userAgent: 'vitest-agent',
     ip: '127.0.0.1',
   };
 
@@ -70,8 +71,8 @@ describe('AuthService', () => {
     const passwordUser = { ...user, password: passwordHash };
     const { service, users, sessions, tokenService, passwordService } =
       makeService({
-        users: { getUserByEmail: jest.fn().mockResolvedValue(passwordUser) },
-        passwordService: { compare: jest.fn().mockResolvedValue(true) },
+        users: { getUserByEmail: vi.fn().mockResolvedValue(passwordUser) },
+        passwordService: { compare: vi.fn().mockResolvedValue(true) },
       });
     sessions.create.mockImplementation((input) =>
       Promise.resolve({
@@ -112,7 +113,7 @@ describe('AuthService', () => {
 
   it('validateToken returns undefined for revoked or unknown sessions', async () => {
     const { service, sessions } = makeService({
-      sessions: { findActiveAndTouch: jest.fn().mockResolvedValue(undefined) },
+      sessions: { findActiveAndTouch: vi.fn().mockResolvedValue(undefined) },
     });
 
     await expect(
diff --git a/apps/api/src/auth/session-auth.guard.spec.ts b/apps/api/src/auth/session-auth.guard.test.ts
similarity index 85%
rename from apps/api/src/auth/session-auth.guard.spec.ts
rename to apps/api/src/auth/session-auth.guard.test.ts
index a09825e6..361a9ba2 100644
--- a/apps/api/src/auth/session-auth.guard.spec.ts
+++ b/apps/api/src/auth/session-auth.guard.test.ts
@@ -6,6 +6,7 @@ import type { Reflector } from '@nestjs/core';
 import { SessionAuthGuard } from './session-auth.guard';
 import type { AuthService } from './auth.service';
 
+import type { Mocked } from 'vitest';
 function makeContext(request: Record<string, unknown>): ExecutionContext {
   return {
     switchToHttp: () => ({
@@ -17,12 +18,12 @@ function makeContext(request: Record<string, unknown>): ExecutionContext {
 }
 
 describe('SessionAuthGuard', () => {
-  function makeGuard(validateToken = jest.fn(), isPublic = false) {
+  function makeGuard(validateToken = vi.fn(), isPublic = false) {
     const authService = {
       validateToken,
-    } as unknown as jest.Mocked<AuthService>;
+    } as unknown as Mocked<AuthService>;
     const reflector = {
-      getAllAndOverride: jest.fn().mockReturnValue(isPublic),
+      getAllAndOverride: vi.fn().mockReturnValue(isPublic),
     } as unknown as Reflector;
     return {
       guard: new SessionAuthGuard(authService, reflector),
@@ -32,7 +33,7 @@ describe('SessionAuthGuard', () => {
 
   it('reads Authorization Bearer before the HttpOnly cookie and attaches AuthContext', async () => {
     const { guard, authService } = makeGuard(
-      jest.fn().mockResolvedValue({ userId: 'user-1', sessionId: 'session-1' }),
+      vi.fn().mockResolvedValue({ userId: 'user-1', sessionId: 'session-1' }),
     );
     const request = {
       headers: {
@@ -52,7 +53,7 @@ describe('SessionAuthGuard', () => {
 
   it('accepts a case-insensitive scheme and repeated whitespace (RFC 6750)', async () => {
     const { guard, authService } = makeGuard(
-      jest.fn().mockResolvedValue({ userId: 'user-1', sessionId: 'session-1' }),
+      vi.fn().mockResolvedValue({ userId: 'user-1', sessionId: 'session-1' }),
     );
     const request = {
       headers: { authorization: 'bearer    spaced-token' },
@@ -64,7 +65,7 @@ describe('SessionAuthGuard', () => {
 
   it('falls back to the HttpOnly cookie when no bearer token is present', async () => {
     const { guard, authService } = makeGuard(
-      jest.fn().mockResolvedValue({ userId: 'user-1', sessionId: 'session-1' }),
+      vi.fn().mockResolvedValue({ userId: 'user-1', sessionId: 'session-1' }),
     );
     const request = {
       headers: {
@@ -102,7 +103,7 @@ describe('SessionAuthGuard', () => {
   });
 
   it('lets a @Public() route through without any token (#68)', async () => {
-    const { guard, authService } = makeGuard(jest.fn(), true);
+    const { guard, authService } = makeGuard(vi.fn(), true);
 
     await expect(guard.canActivate(makeContext({ headers: {} }))).resolves.toBe(
       true,
@@ -111,7 +112,7 @@ describe('SessionAuthGuard', () => {
   });
 
   it('fails closed when the token is unknown or revoked', async () => {
-    const { guard } = makeGuard(jest.fn().mockResolvedValue(undefined));
+    const { guard } = makeGuard(vi.fn().mockResolvedValue(undefined));
 
     await expect(
       guard.canActivate(
diff --git a/apps/api/src/auth/session-token.service.spec.ts b/apps/api/src/auth/session-token.service.test.ts
similarity index 100%
rename from apps/api/src/auth/session-token.service.spec.ts
rename to apps/api/src/auth/session-token.service.test.ts
diff --git a/apps/api/src/chats/active-runs.integration.spec.ts b/apps/api/src/chats/active-runs.integration.test.ts
similarity index 98%
rename from apps/api/src/chats/active-runs.integration.spec.ts
rename to apps/api/src/chats/active-runs.integration.test.ts
index 579f2910..1aad4a51 100644
--- a/apps/api/src/chats/active-runs.integration.spec.ts
+++ b/apps/api/src/chats/active-runs.integration.test.ts
@@ -7,7 +7,7 @@
  * - a PUBLIC chat's active run still belongs only to its owner — visibility
  *   never widens who can see it via this endpoint.
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/chats/chat-loop.integration.spec.ts b/apps/api/src/chats/chat-loop.integration.test.ts
similarity index 97%
rename from apps/api/src/chats/chat-loop.integration.spec.ts
rename to apps/api/src/chats/chat-loop.integration.test.ts
index dd96d7c5..a47b8856 100644
--- a/apps/api/src/chats/chat-loop.integration.spec.ts
+++ b/apps/api/src/chats/chat-loop.integration.test.ts
@@ -5,16 +5,16 @@
  * catch/re-check/retry logic in persistUserMessageAndRun, with only the
  * execution-adjacent leaves mocked (ModelsService.validateModelSelection,
  * RunStreamBridgeService, RunDispatchService.dispatch) — the same
- * direct-instantiation-of-repos pattern as active-runs.integration.spec.ts.
+ * direct-instantiation-of-repos pattern as active-runs.integration.test.ts.
  *
- * `chat-loop.service.spec.ts` already unit-tests the model-selection guard
+ * `chat-loop.service.test.ts` already unit-tests the model-selection guard
  * against a fully mocked `tenantDb.runAs`; that mock cannot exercise a real
  * unique-constraint race, which is exactly what these tests guard: the D7
  * unwedge deletion (chat-loop.service.ts) narrowed single-flight enqueue to
  * "409 + vanished-blocker retry" with NO enqueue-side expiry — these three
  * scenarios are the ones that regression would silently break.
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh with the other
+ * TEST_DATABASE_URL-gated; run by test:integration with the other
  * .integration suites.
  */
 
@@ -91,11 +91,11 @@ describeIfDb(
         }),
       } as unknown as ModelsService;
       const bridge = {
-        createUiMessageStreamResponse: jest.fn(),
+        createUiMessageStreamResponse: vi.fn(),
       } as unknown as RunStreamBridgeService;
       const aborts = new RunAbortRegistry();
       const dispatch = {
-        dispatch: jest.fn((job: unknown) => {
+        dispatch: vi.fn((job: unknown) => {
           dispatchCalls.push(job);
           return Promise.resolve();
         }),
@@ -231,7 +231,7 @@ describeIfDb(
       const original: RunsRepository['findActiveByChatId'] =
         // eslint-disable-next-line @typescript-eslint/unbound-method -- deliberately grabbed unbound: re-invoked below via .call(this, ...) with an explicit receiver, not as a free-standing function.
         RunsRepository.prototype.findActiveByChatId;
-      const spy = jest
+      const spy = vi
         .spyOn(RunsRepository.prototype, 'findActiveByChatId')
         .mockImplementation(async function (
           this: RunsRepository,
@@ -291,7 +291,7 @@ describeIfDb(
           systemPromptSource: 'model_override' as const,
         }),
       } as unknown as ModelsService;
-      const dispatchRun = jest.fn().mockResolvedValue(undefined);
+      const dispatchRun = vi.fn().mockResolvedValue(undefined);
       const dispatch = {
         dispatch: dispatchRun,
       } as unknown as RunDispatchService;
@@ -305,7 +305,7 @@ describeIfDb(
           },
         } as unknown as InstanceConfigService,
         {
-          createUiMessageStreamResponse: jest.fn(),
+          createUiMessageStreamResponse: vi.fn(),
         } as unknown as RunStreamBridgeService,
         new RunAbortRegistry(),
         dispatch,
@@ -317,7 +317,7 @@ describeIfDb(
         runs: (await tx.select().from(schema.runs)).length,
         events: (await tx.select().from(schema.runEvents)).length,
       }));
-      const append = jest
+      const append = vi
         .spyOn(RunEventsRepository.prototype, 'append')
         .mockRejectedValueOnce(new Error('forced run.created failure'));
 
diff --git a/apps/api/src/chats/chat-loop.service.spec.ts b/apps/api/src/chats/chat-loop.service.test.ts
similarity index 85%
rename from apps/api/src/chats/chat-loop.service.spec.ts
rename to apps/api/src/chats/chat-loop.service.test.ts
index 18e77d14..01574a6f 100644
--- a/apps/api/src/chats/chat-loop.service.spec.ts
+++ b/apps/api/src/chats/chat-loop.service.test.ts
@@ -18,28 +18,29 @@ import { type Run } from '../db/schema';
 import { type RunJob } from '../runs/run-queues';
 import { BadRequestException } from '@nestjs/common';
 
+import type { Mocked } from 'vitest';
 describe('ChatLoopService model selection', () => {
   function makeService(models?: Partial<ModelsService>) {
-    const runAs = jest.fn();
-    const validateModelSelection = models?.validateModelSelection ?? jest.fn();
-    const dispatchRun = jest.fn();
+    const runAs = vi.fn();
+    const validateModelSelection = models?.validateModelSelection ?? vi.fn();
+    const dispatchRun = vi.fn();
     const tenantDb = {
       runAs,
-    } as unknown as jest.Mocked<TenantDbService>;
+    } as unknown as Mocked<TenantDbService>;
     const modelsService = {
       validateModelSelection,
-      resolveModelCredential: jest.fn().mockResolvedValue('sk-test'),
+      resolveModelCredential: vi.fn().mockResolvedValue('sk-test'),
       ...models,
-    } as unknown as jest.Mocked<ModelsService>;
+    } as unknown as Mocked<ModelsService>;
     const bridge = {
-      createUiMessageStreamResponse: jest.fn(),
-    } as unknown as jest.Mocked<RunStreamBridgeService>;
+      createUiMessageStreamResponse: vi.fn(),
+    } as unknown as Mocked<RunStreamBridgeService>;
     const aborts = {
-      abort: jest.fn(),
-    } as unknown as jest.Mocked<RunAbortRegistry>;
+      abort: vi.fn(),
+    } as unknown as Mocked<RunAbortRegistry>;
     const dispatch = {
       dispatch: dispatchRun,
-    } as unknown as jest.Mocked<RunDispatchService>;
+    } as unknown as Mocked<RunDispatchService>;
 
     const instanceConfig = {
       config: {
@@ -77,7 +78,7 @@ describe('ChatLoopService model selection', () => {
   };
 
   it('rejects an unavailable model before any message, run, or queue write', async () => {
-    const validateModelSelection = jest.fn(() => {
+    const validateModelSelection = vi.fn(() => {
       throw new ModelNotAvailableError('unknown-model');
     });
     const { service, runAs, dispatchRun } = makeService({
@@ -94,7 +95,7 @@ describe('ChatLoopService model selection', () => {
 
   it('rejects model configuration errors before any message, run, or queue write', async () => {
     const { service, runAs, dispatchRun } = makeService({
-      validateModelSelection: jest.fn(() => {
+      validateModelSelection: vi.fn(() => {
         throw new ModelConfigurationError('DEFAULT_MODEL_ID is required.');
       }),
     });
@@ -118,7 +119,7 @@ describe('ChatLoopService effective-context transaction binding', () => {
     systemPromptSource: 'model_override',
   };
 
-  afterEach(() => jest.restoreAllMocks());
+  afterEach(() => vi.restoreAllMocks());
 
   function setup(options?: { failRunCreated?: boolean; previousRun?: Run }) {
     const txHolder = {} as {
@@ -128,13 +129,13 @@ describe('ChatLoopService effective-context transaction binding', () => {
     };
     const tx = txHolder as unknown as Db;
     txHolder.transaction = (callback) => callback(tx);
-    const runAs = jest.fn(
+    const runAs = vi.fn(
       (_userId: string, callback: (scoped: Db) => Promise<unknown>) =>
         callback(tx),
     );
-    const dispatch = jest.fn(async (_job: RunJob): Promise<void> => {});
+    const dispatch = vi.fn(async (_job: RunJob): Promise<void> => {});
 
-    jest.spyOn(ChatsRepository.prototype, 'findById').mockResolvedValue({
+    vi.spyOn(ChatsRepository.prototype, 'findById').mockResolvedValue({
       id: 'chat-id',
       ownerUserId: 'user-id',
       title: null,
@@ -144,34 +145,34 @@ describe('ChatLoopService effective-context transaction binding', () => {
       archivedAt: null,
       projectId: null,
     });
-    jest.spyOn(ChatsRepository.prototype, 'touch').mockResolvedValue(undefined);
-    jest
-      .spyOn(MessagesRepository.prototype, 'findTurnState')
-      .mockResolvedValue({
-        userMessage: undefined,
-        assistantMessage: undefined,
-      });
-    jest
-      .spyOn(MessagesRepository.prototype, 'createUserMessageIfAbsent')
-      .mockResolvedValue({
-        id: 'message-id',
-        chatId: 'chat-id',
-        seq: 1,
-        role: 'user',
-        senderUserId: 'user-id',
-        parts: [{ type: 'text', text: 'hello' }],
-        attachments: [],
-        usage: null,
-        inReplyTo: null,
-        createdAt: new Date(),
-      });
-    jest
-      .spyOn(RunsRepository.prototype, 'cancelActiveRunsForMessage')
-      .mockResolvedValue([]);
-    const findPreviousRun = jest
+    vi.spyOn(ChatsRepository.prototype, 'touch').mockResolvedValue(undefined);
+    vi.spyOn(MessagesRepository.prototype, 'findTurnState').mockResolvedValue({
+      userMessage: undefined,
+      assistantMessage: undefined,
+    });
+    vi.spyOn(
+      MessagesRepository.prototype,
+      'createUserMessageIfAbsent',
+    ).mockResolvedValue({
+      id: 'message-id',
+      chatId: 'chat-id',
+      seq: 1,
+      role: 'user',
+      senderUserId: 'user-id',
+      parts: [{ type: 'text', text: 'hello' }],
+      attachments: [],
+      usage: null,
+      inReplyTo: null,
+      createdAt: new Date(),
+    });
+    vi.spyOn(
+      RunsRepository.prototype,
+      'cancelActiveRunsForMessage',
+    ).mockResolvedValue([]);
+    const findPreviousRun = vi
       .spyOn(RunsRepository.prototype, 'findMostRecentByChatMessageSequence')
       .mockResolvedValue(options?.previousRun);
-    const createSnapshot = jest
+    const createSnapshot = vi
       .spyOn(ModelContextSnapshotsRepository.prototype, 'createOrReuse')
       .mockResolvedValue({
         id: 'snapshot-id',
@@ -184,7 +185,7 @@ describe('ChatLoopService effective-context transaction binding', () => {
         toolDeclarations: [],
         createdAt: new Date(),
       });
-    const createRun = jest
+    const createRun = vi
       .spyOn(RunsRepository.prototype, 'create')
       .mockImplementation((runInput) =>
         Promise.resolve({
@@ -203,7 +204,7 @@ describe('ChatLoopService effective-context transaction binding', () => {
           finishedAt: null,
         }),
       );
-    const appendEvent = jest
+    const appendEvent = vi
       .spyOn(RunEventsRepository.prototype, 'append')
       .mockImplementation(() =>
         options?.failRunCreated
@@ -220,7 +221,7 @@ describe('ChatLoopService effective-context transaction binding', () => {
     const service = new ChatLoopService(
       { runAs } as unknown as TenantDbService,
       {
-        validateModelSelection: jest.fn(() => model),
+        validateModelSelection: vi.fn(() => model),
       } as unknown as ModelsService,
       {
         config: {
@@ -229,9 +230,9 @@ describe('ChatLoopService effective-context transaction binding', () => {
         },
       } as unknown as InstanceConfigService,
       {
-        createUiMessageStreamResponse: jest.fn(() => new Response()),
+        createUiMessageStreamResponse: vi.fn(() => new Response()),
       } as unknown as RunStreamBridgeService,
-      { abort: jest.fn() } as unknown as RunAbortRegistry,
+      { abort: vi.fn() } as unknown as RunAbortRegistry,
       { dispatch } as unknown as RunDispatchService,
     );
 
@@ -304,7 +305,7 @@ describe('ChatLoopService effective-context transaction binding', () => {
 
   it('discards every non-text client part before message persistence', async () => {
     const { service } = setup();
-    const createMessage = jest.spyOn(
+    const createMessage = vi.spyOn(
       MessagesRepository.prototype,
       'createUserMessageIfAbsent',
     );
@@ -378,7 +379,7 @@ describe('ChatLoopService effective-context transaction binding', () => {
       finishedAt: new Date(),
     };
     const { service, createRun } = setup({ previousRun });
-    const createMessage = jest.spyOn(
+    const createMessage = vi.spyOn(
       MessagesRepository.prototype,
       'createUserMessageIfAbsent',
     );
diff --git a/apps/api/src/chats/chat-sharing.integration.spec.ts b/apps/api/src/chats/chat-sharing.integration.test.ts
similarity index 99%
rename from apps/api/src/chats/chat-sharing.integration.spec.ts
rename to apps/api/src/chats/chat-sharing.integration.test.ts
index b128ed1a..700c33a6 100644
--- a/apps/api/src/chats/chat-sharing.integration.spec.ts
+++ b/apps/api/src/chats/chat-sharing.integration.test.ts
@@ -9,7 +9,7 @@
  * - sharing one chat leaks nothing about the owner's OTHER chats (public or
  *   private), even when both exist side by side.
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/chats/chats-delete.integration.spec.ts b/apps/api/src/chats/chats-delete.integration.test.ts
similarity index 97%
rename from apps/api/src/chats/chats-delete.integration.spec.ts
rename to apps/api/src/chats/chats-delete.integration.test.ts
index ae385def..b732a75e 100644
--- a/apps/api/src/chats/chats-delete.integration.spec.ts
+++ b/apps/api/src/chats/chats-delete.integration.test.ts
@@ -5,7 +5,7 @@
  * - ChatsService.deleteChat cancels an in-flight run BEFORE deleting (so the
  *   provider stream stops instead of billing until the deadman timeout).
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
@@ -114,7 +114,7 @@ describeIfDb('chat deletion — RLS + cascade + run cancel', () => {
     );
 
     const aborts = new RunAbortRegistry();
-    const abortSpy = jest.spyOn(aborts, 'abort');
+    const abortSpy = vi.spyOn(aborts, 'abort');
     const service = new ChatsService(tenantDb, aborts, noopReindexDispatch());
 
     const deleted = await service.deleteChat(a, chat);
diff --git a/apps/api/test/chats-messages.e2e-spec.ts b/apps/api/src/chats/chats-messages.integration.test.ts
similarity index 98%
rename from apps/api/test/chats-messages.e2e-spec.ts
rename to apps/api/src/chats/chats-messages.integration.test.ts
index c29a12b6..0183cb45 100644
--- a/apps/api/test/chats-messages.e2e-spec.ts
+++ b/apps/api/src/chats/chats-messages.integration.test.ts
@@ -2,7 +2,7 @@
  * Chat message streaming e2e (#55) — real HTTP + Postgres, fake model client.
  *
  * Requires POSTGRES_URL to point at a migrated database. Without it the suite is
- * skipped so offline `pnpm test` remains usable; scripts/rls-test.sh provides the
+ * skipped so offline `pnpm test` remains usable; the test:integration globalSetup provides the
  * real database gate.
  */
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
@@ -10,31 +10,25 @@
 import { INestApplication } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import request from 'supertest';
-import { AppModule } from './../src/app.module';
-import { configureApp } from './../src/app.setup';
-import { type Message } from './../src/db/schema';
-import { TenantDbService } from './../src/db/tenant-db.service';
-import {
-  ChatsRepository,
-  MessagesRepository,
-} from './../src/chats/chats-repository';
-import {
-  RunEventsRepository,
-  RunsRepository,
-} from './../src/runs/runs-repository';
-import { ModelsService } from './../src/models/models.service';
-import { turnTelemetryLogger } from './../src/chats/turn-telemetry';
+import { AppModule } from '../app.module';
+import { configureApp } from '../app.setup';
+import { type Message } from '../db/schema';
+import { TenantDbService } from '../db/tenant-db.service';
+import { ChatsRepository, MessagesRepository } from '../chats/chats-repository';
+import { RunEventsRepository, RunsRepository } from '../runs/runs-repository';
+import { ModelsService } from '../models/models.service';
+import { turnTelemetryLogger } from '../chats/turn-telemetry';
 import {
   FakeModelsService,
   cookieOf,
   parseSseEvents,
   streamedText,
-} from './support';
+} from '../testing/support';
 
 const hasDb = !!process.env.POSTGRES_URL;
 const d = hasDb ? describe : describe.skip;
 
-jest.setTimeout(30_000);
+vi.setConfig({ testTimeout: 30_000 });
 
 /**
  * Waits until a condition becomes true.
@@ -150,7 +144,7 @@ d('POST /api/v1/chats/:id/messages — streaming loop', () => {
   });
 
   beforeEach(() => {
-    jest.restoreAllMocks();
+    vi.restoreAllMocks();
     models.credential = 'sk-test';
     models.createClientCalls.length = 0;
     models.client.turns.length = 0;
@@ -337,7 +331,7 @@ d('POST /api/v1/chats/:id/messages — streaming loop', () => {
   });
 
   it('streams a UI-message SSE reply and persists user + assistant with usage', async () => {
-    const telemetryLog = jest
+    const telemetryLog = vi
       .spyOn(turnTelemetryLogger, 'info')
       .mockImplementation(() => {});
     models.client.responses = ['hello from model'];
@@ -430,7 +424,7 @@ d('POST /api/v1/chats/:id/messages — streaming loop', () => {
   });
 
   it('does not fail the turn when the telemetry log sink throws', async () => {
-    jest.spyOn(turnTelemetryLogger, 'info').mockImplementation(() => {
+    vi.spyOn(turnTelemetryLogger, 'info').mockImplementation(() => {
       throw new Error('pino sink failed');
     });
     models.client.responses = ['still persisted'];
diff --git a/apps/api/src/chats/chats-repository.spec.ts b/apps/api/src/chats/chats-repository.test.ts
similarity index 94%
rename from apps/api/src/chats/chats-repository.spec.ts
rename to apps/api/src/chats/chats-repository.test.ts
index 1c31d16e..9a8f64e6 100644
--- a/apps/api/src/chats/chats-repository.spec.ts
+++ b/apps/api/src/chats/chats-repository.test.ts
@@ -6,7 +6,7 @@
  * `.where` conditions reference the owner id. Removing the owner filter fails these.
  *
  * Real RLS enforcement (cross-tenant isolation) is proven against a live Postgres in
- * chats-rls.integration.spec.ts.
+ * chats-rls.integration.test.ts.
  */
 
 import { PgDialect } from 'drizzle-orm/pg-core';
@@ -18,47 +18,48 @@ import {
 } from './chats-repository';
 import { RunEventsRepository, RunsRepository } from '../runs/runs-repository';
 
+import type { Mock } from 'vitest';
 // Mock Drizzle db that records the arguments passed to where/values/set so tests can
 // assert the scoping appears in the payload. Chain methods return the same object so
 // any call order resolves; terminal methods resolve empty.
 function makeMockDb() {
-  const whereSpy = jest.fn<void, [unknown]>();
-  const valuesSpy = jest.fn<void, [unknown]>();
-  const setSpy = jest.fn<void, [unknown]>();
-  const onConflictDoNothingSpy = jest.fn<void, [unknown]>();
-  const limitSpy = jest.fn<void, [unknown]>();
-  const orderBySpy = jest.fn<void, unknown[]>();
+  const whereSpy = vi.fn<(arg: unknown) => void>();
+  const valuesSpy = vi.fn<(arg: unknown) => void>();
+  const setSpy = vi.fn<(arg: unknown) => void>();
+  const onConflictDoNothingSpy = vi.fn<(arg: unknown) => void>();
+  const limitSpy = vi.fn<(arg: unknown) => void>();
+  const orderBySpy = vi.fn<(...args: unknown[]) => void>();
   const terminal = {
-    execute: jest.fn().mockResolvedValue([]),
-    returning: jest.fn().mockResolvedValue([]),
+    execute: vi.fn().mockResolvedValue([]),
+    returning: vi.fn().mockResolvedValue([]),
   };
 
-  function chain(): Record<string, jest.Mock> {
-    const obj: Record<string, jest.Mock> = {};
+  function chain(): Record<string, Mock> {
+    const obj: Record<string, Mock> = {};
     ['from', 'innerJoin'].forEach((m) => {
-      obj[m] = jest.fn(() => ({ ...obj, ...terminal }));
+      obj[m] = vi.fn(() => ({ ...obj, ...terminal }));
     });
-    obj.orderBy = jest.fn((...args: unknown[]) => {
+    obj.orderBy = vi.fn((...args: unknown[]) => {
       orderBySpy(...args);
       return { ...obj, ...terminal };
     });
-    obj.limit = jest.fn((arg: unknown) => {
+    obj.limit = vi.fn((arg: unknown) => {
       limitSpy(arg);
       return { ...obj, ...terminal };
     });
-    obj.where = jest.fn((arg: unknown) => {
+    obj.where = vi.fn((arg: unknown) => {
       whereSpy(arg);
       return { ...obj, ...terminal };
     });
-    obj.values = jest.fn((arg: unknown) => {
+    obj.values = vi.fn((arg: unknown) => {
       valuesSpy(arg);
       return { ...obj, ...terminal };
     });
-    obj.set = jest.fn((arg: unknown) => {
+    obj.set = vi.fn((arg: unknown) => {
       setSpy(arg);
       return { ...obj, ...terminal };
     });
-    obj.onConflictDoNothing = jest.fn((arg: unknown) => {
+    obj.onConflictDoNothing = vi.fn((arg: unknown) => {
       onConflictDoNothingSpy(arg);
       return { ...obj, ...terminal };
     });
@@ -66,18 +67,18 @@ function makeMockDb() {
   }
 
   const db = {
-    select: jest.fn(() => chain()),
-    insert: jest.fn(() => chain()),
-    update: jest.fn(() => chain()),
-    delete: jest.fn(() => chain()),
+    select: vi.fn(() => chain()),
+    insert: vi.fn(() => chain()),
+    update: vi.fn(() => chain()),
+    delete: vi.fn(() => chain()),
   };
 
   return {
     db: db as unknown as Db & {
-      select: jest.Mock;
-      insert: jest.Mock;
-      update: jest.Mock;
-      delete: jest.Mock;
+      select: Mock;
+      insert: Mock;
+      update: Mock;
+      delete: Mock;
     },
     whereSpy,
     valuesSpy,
@@ -91,7 +92,7 @@ function makeMockDb() {
 // Drizzle wraps bound values in Params; compile each captured where-condition to
 // SQL + params via the real dialect and assert the id is a bound parameter.
 const dialect = new PgDialect();
-function whereContains(whereSpy: jest.Mock, value: string | number): boolean {
+function whereContains(whereSpy: Mock, value: string | number): boolean {
   return whereSpy.mock.calls.some((call: unknown[]) => {
     try {
       return dialect.sqlToQuery(call[0] as never).params.includes(value);
@@ -101,7 +102,7 @@ function whereContains(whereSpy: jest.Mock, value: string | number): boolean {
   });
 }
 
-function whereSqlContains(whereSpy: jest.Mock, fragment: string): boolean {
+function whereSqlContains(whereSpy: Mock, fragment: string): boolean {
   return whereSpy.mock.calls.some((call: unknown[]) => {
     try {
       return dialect.sqlToQuery(call[0] as never).sql.includes(fragment);
@@ -159,7 +160,7 @@ describe('ChatsRepository — owner-scoped queries (defense-in-depth)', () => {
       | undefined
     >,
   ) {
-    return jest
+    return vi
       .spyOn(ChatsRepository.prototype, 'findById')
       .mockImplementation(impl);
   }
diff --git a/apps/api/src/chats/chats-rls.integration.spec.ts b/apps/api/src/chats/chats-rls.integration.test.ts
similarity index 99%
rename from apps/api/src/chats/chats-rls.integration.spec.ts
rename to apps/api/src/chats/chats-rls.integration.test.ts
index b463dda6..506634b9 100644
--- a/apps/api/src/chats/chats-rls.integration.spec.ts
+++ b/apps/api/src/chats/chats-rls.integration.test.ts
@@ -8,7 +8,7 @@
  *     RLS only constrains a table owner when FORCE ROW LEVEL SECURITY is set, so a
  *     green run as the owner proves FORCE is doing its job.
  *
- * Example (scripts/rls-test.sh provisions exactly this — it picks a free port
+ * Example (the test:integration globalSetup provisions exactly this — it picks a free port
  * in 55440–55490 per invocation, or honors RLS_TEST_PORT, and prints it):
  *   TEST_DATABASE_URL="postgres://app:app@localhost:<port>/llame_test" pnpm --filter api test
  *
diff --git a/apps/api/src/chats/chats-search.integration.spec.ts b/apps/api/src/chats/chats-search.integration.test.ts
similarity index 99%
rename from apps/api/src/chats/chats-search.integration.spec.ts
rename to apps/api/src/chats/chats-search.integration.test.ts
index 8a881b88..80132ce1 100644
--- a/apps/api/src/chats/chats-search.integration.spec.ts
+++ b/apps/api/src/chats/chats-search.integration.test.ts
@@ -12,7 +12,7 @@
  * - both search tables are FORCE ROW LEVEL SECURITY.
  *
  * Because retrieval now reads the projection, each seeded chat is reindexed via
- * SearchIndexService before searching. TEST_DATABASE_URL-gated; run by rls-test.sh.
+ * SearchIndexService before searching. TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/chats/chats.controller.spec.ts b/apps/api/src/chats/chats.controller.test.ts
similarity index 90%
rename from apps/api/src/chats/chats.controller.spec.ts
rename to apps/api/src/chats/chats.controller.test.ts
index b7cba08a..4275cc16 100644
--- a/apps/api/src/chats/chats.controller.spec.ts
+++ b/apps/api/src/chats/chats.controller.test.ts
@@ -12,6 +12,7 @@ import {
   ModelNotAvailableError,
 } from '../models/models.service';
 
+import type { Mock, Mocked } from 'vitest';
 const chat: Chat = {
   id: '0b6f5499-dde4-43cf-89fe-037998a0fe64',
   ownerUserId: 'verified-user',
@@ -53,14 +54,14 @@ const chatMessages: Message[] = [
 describe('ChatsController', () => {
   function makeWritableResponse(): ExpressResponse {
     const response = new EventEmitter() as unknown as ExpressResponse & {
-      status: jest.Mock;
-      setHeader: jest.Mock;
-      end: jest.Mock;
+      status: Mock;
+      setHeader: Mock;
+      end: Mock;
       writableEnded: boolean;
     };
-    response.status = jest.fn().mockReturnValue(response);
-    response.setHeader = jest.fn().mockReturnValue(response);
-    response.end = jest.fn(() => {
+    response.status = vi.fn().mockReturnValue(response);
+    response.setHeader = vi.fn().mockReturnValue(response);
+    response.end = vi.fn(() => {
       response.writableEnded = true;
       return response;
     });
@@ -70,29 +71,27 @@ describe('ChatsController', () => {
 
   function makeController(service?: Partial<ChatsService>) {
     const chatsService = {
-      listChatsWithLastMessage: jest
+      listChatsWithLastMessage: vi
         .fn()
         .mockResolvedValue([{ chat, lastMessage: chatMessages[1] }]),
-      getChatById: jest.fn().mockResolvedValue(chat),
-      getChatMessages: jest.fn().mockResolvedValue({
+      getChatById: vi.fn().mockResolvedValue(chat),
+      getChatMessages: vi.fn().mockResolvedValue({
         messages: chatMessages,
         compaction: undefined,
         absorbedMessageCount: null,
       }),
-      updateChat: jest.fn().mockResolvedValue(chat),
+      updateChat: vi.fn().mockResolvedValue(chat),
       ...service,
-    } as unknown as jest.Mocked<ChatsService>;
+    } as unknown as Mocked<ChatsService>;
     const chatLoopService = {
-      createMessageStream: jest.fn(),
-    } as unknown as jest.Mocked<ChatLoopService>;
+      createMessageStream: vi.fn(),
+    } as unknown as Mocked<ChatLoopService>;
     const tenantDb = {
-      runAs: jest.fn(),
-    } as unknown as jest.Mocked<
-      import('../db/tenant-db.service').TenantDbService
-    >;
+      runAs: vi.fn(),
+    } as unknown as Mocked<import('../db/tenant-db.service').TenantDbService>;
     const bridge = {
-      createUiMessageStreamResponse: jest.fn(),
-    } as unknown as jest.Mocked<
+      createUiMessageStreamResponse: vi.fn(),
+    } as unknown as Mocked<
       import('../runs/run-stream-bridge').RunStreamBridgeService
     >;
 
@@ -136,7 +135,7 @@ describe('ChatsController', () => {
 
   it('returns lastMessage null for a chat without messages', async () => {
     const { controller } = makeController({
-      listChatsWithLastMessage: jest
+      listChatsWithLastMessage: vi
         .fn()
         .mockResolvedValue([{ chat, lastMessage: undefined }]),
     });
@@ -156,7 +155,7 @@ describe('ChatsController', () => {
       ],
     };
     const { controller } = makeController({
-      listChatsWithLastMessage: jest
+      listChatsWithLastMessage: vi
         .fn()
         .mockResolvedValue([{ chat, lastMessage: toolMessage }]),
     });
@@ -222,7 +221,7 @@ describe('ChatsController', () => {
       createdAt: new Date('2026-07-06T00:00:00.000Z'),
     };
     const { controller } = makeController({
-      getChatMessages: jest.fn().mockResolvedValue({
+      getChatMessages: vi.fn().mockResolvedValue({
         messages: [],
         compaction,
         absorbedMessageCount: 5,
@@ -267,7 +266,7 @@ describe('ChatsController', () => {
       createdAt: new Date('2026-07-06T00:00:00.000Z'),
     };
     const { controller } = makeController({
-      getChatMessages: jest.fn().mockResolvedValue({
+      getChatMessages: vi.fn().mockResolvedValue({
         messages: [],
         compaction,
         absorbedMessageCount: 5,
@@ -288,7 +287,7 @@ describe('ChatsController', () => {
 
   it('returns 404 when the verified user cannot read chat messages', async () => {
     const { controller } = makeController({
-      getChatMessages: jest.fn().mockResolvedValue(undefined),
+      getChatMessages: vi.fn().mockResolvedValue(undefined),
     });
 
     await expect(
@@ -298,7 +297,7 @@ describe('ChatsController', () => {
 
   it('returns an empty message list for an owned chat with no messages', async () => {
     const { controller } = makeController({
-      getChatMessages: jest.fn().mockResolvedValue({
+      getChatMessages: vi.fn().mockResolvedValue({
         messages: [],
         compaction: undefined,
         absorbedMessageCount: null,
@@ -342,7 +341,7 @@ describe('ChatsController', () => {
 
   it('deletes a chat scoped to the verified user only', async () => {
     const { controller, chatsService } = makeController({
-      deleteChat: jest.fn().mockResolvedValue(true),
+      deleteChat: vi.fn().mockResolvedValue(true),
     });
 
     await controller.deleteChat('verified-user', chat.id);
@@ -355,7 +354,7 @@ describe('ChatsController', () => {
 
   it('404s deleting a chat that is absent or not owned', async () => {
     const { controller } = makeController({
-      deleteChat: jest.fn().mockResolvedValue(false),
+      deleteChat: vi.fn().mockResolvedValue(false),
     });
 
     await expect(
@@ -366,7 +365,7 @@ describe('ChatsController', () => {
   it('forks a chat scoped to the verified user only', async () => {
     const forked: Chat = { ...chat, id: 'forked-chat-id' };
     const { controller, chatsService } = makeController({
-      forkChat: jest.fn().mockResolvedValue(forked),
+      forkChat: vi.fn().mockResolvedValue(forked),
     });
     const fromMessageId = chatMessages[0].id;
 
@@ -385,7 +384,7 @@ describe('ChatsController', () => {
   it('forks the whole chat when fromMessageId is absent (clone)', async () => {
     const forked: Chat = { ...chat, id: 'cloned-chat-id' };
     const { controller, chatsService } = makeController({
-      forkChat: jest.fn().mockResolvedValue(forked),
+      forkChat: vi.fn().mockResolvedValue(forked),
     });
 
     const result = await controller.forkChat('verified-user', chat.id, {});
@@ -401,7 +400,7 @@ describe('ChatsController', () => {
   it('streams messages with userId from the verified session only', async () => {
     const { controller, chatLoopService } = makeController();
     const streamResult = {
-      toUIMessageStreamResponse: jest.fn(() => new Response(null)),
+      toUIMessageStreamResponse: vi.fn(() => new Response(null)),
     } as unknown as Awaited<ReturnType<ChatLoopService['createMessageStream']>>;
     chatLoopService.createMessageStream.mockResolvedValue(streamResult);
 
@@ -501,10 +500,10 @@ describe('ChatsController', () => {
     const { controller, tenantDb, bridge } = makeController();
     tenantDb.runAs.mockResolvedValue(undefined);
     const response = {
-      status: jest.fn().mockReturnThis(),
-      end: jest.fn(),
-      on: jest.fn(),
-      off: jest.fn(),
+      status: vi.fn().mockReturnThis(),
+      end: vi.fn(),
+      on: vi.fn(),
+      off: vi.fn(),
       destroyed: false,
     };
 
@@ -530,10 +529,10 @@ describe('ChatsController', () => {
     // handler ran must exit after the (single) lookup without a write.
     tenantDb.runAs.mockResolvedValue({ id: 'run-1' });
     const response = {
-      status: jest.fn().mockReturnThis(),
-      end: jest.fn(),
-      on: jest.fn(),
-      off: jest.fn(),
+      status: vi.fn().mockReturnThis(),
+      end: vi.fn(),
+      on: vi.fn(),
+      off: vi.fn(),
       destroyed: true,
     };
 
@@ -555,12 +554,12 @@ describe('ChatsController', () => {
       new Response(null, { status: 200 }),
     );
     const response = {
-      status: jest.fn().mockReturnThis(),
-      end: jest.fn(),
-      on: jest.fn(),
-      off: jest.fn(),
-      setHeader: jest.fn(),
-      write: jest.fn(),
+      status: vi.fn().mockReturnThis(),
+      end: vi.fn(),
+      on: vi.fn(),
+      off: vi.fn(),
+      setHeader: vi.fn(),
+      write: vi.fn(),
       destroyed: false,
       writableEnded: false,
     };
@@ -578,7 +577,7 @@ describe('ChatsController', () => {
 
   it('returns 404 when the verified user does not own the chat', async () => {
     const { controller } = makeController({
-      getChatById: jest.fn().mockResolvedValue(undefined),
+      getChatById: vi.fn().mockResolvedValue(undefined),
     });
 
     await expect(
diff --git a/apps/api/src/chats/compaction-surfacing.integration.spec.ts b/apps/api/src/chats/compaction-surfacing.integration.test.ts
similarity index 99%
rename from apps/api/src/chats/compaction-surfacing.integration.spec.ts
rename to apps/api/src/chats/compaction-surfacing.integration.test.ts
index 7a51c2a9..f69aef06 100644
--- a/apps/api/src/chats/compaction-surfacing.integration.spec.ts
+++ b/apps/api/src/chats/compaction-surfacing.integration.test.ts
@@ -14,7 +14,7 @@
  * a foreign/cross-tenant chat id still resolves to `undefined` (404), same as
  * before this field existed.
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/chats/context-builder.spec.ts b/apps/api/src/chats/context-builder.test.ts
similarity index 100%
rename from apps/api/src/chats/context-builder.spec.ts
rename to apps/api/src/chats/context-builder.test.ts
diff --git a/apps/api/src/chats/dto/chats.dto.spec.ts b/apps/api/src/chats/dto/chats.dto.test.ts
similarity index 100%
rename from apps/api/src/chats/dto/chats.dto.spec.ts
rename to apps/api/src/chats/dto/chats.dto.test.ts
diff --git a/apps/api/src/chats/fork-chat.integration.spec.ts b/apps/api/src/chats/fork-chat.integration.test.ts
similarity index 99%
rename from apps/api/src/chats/fork-chat.integration.spec.ts
rename to apps/api/src/chats/fork-chat.integration.test.ts
index 0ed6c32f..1590bee0 100644
--- a/apps/api/src/chats/fork-chat.integration.spec.ts
+++ b/apps/api/src/chats/fork-chat.integration.test.ts
@@ -4,7 +4,7 @@
  *   REMAPPED to the copied user turn (not the original id), usage NOT carried;
  * - a cross-tenant fork throws + creates nothing (owner-scoped).
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/chats/reasoning-loop.integration.spec.ts b/apps/api/src/chats/reasoning-loop.integration.test.ts
similarity index 99%
rename from apps/api/src/chats/reasoning-loop.integration.spec.ts
rename to apps/api/src/chats/reasoning-loop.integration.test.ts
index 2393617c..8741bef0 100644
--- a/apps/api/src/chats/reasoning-loop.integration.spec.ts
+++ b/apps/api/src/chats/reasoning-loop.integration.test.ts
@@ -10,7 +10,7 @@
  * survives a reload. Proves capture -> persist (events) -> persist (message)
  * -> ordering against a live DB.
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/chats/reasoning-parts.spec.ts b/apps/api/src/chats/reasoning-parts.test.ts
similarity index 100%
rename from apps/api/src/chats/reasoning-parts.spec.ts
rename to apps/api/src/chats/reasoning-parts.test.ts
diff --git a/apps/api/src/chats/run-execution-tools.integration.spec.ts b/apps/api/src/chats/run-execution-tools.integration.test.ts
similarity index 99%
rename from apps/api/src/chats/run-execution-tools.integration.spec.ts
rename to apps/api/src/chats/run-execution-tools.integration.test.ts
index 5825a30b..60639b82 100644
--- a/apps/api/src/chats/run-execution-tools.integration.spec.ts
+++ b/apps/api/src/chats/run-execution-tools.integration.test.ts
@@ -11,7 +11,7 @@
  * agents-best-practices property under test: "could the run be audited or
  * safely rerun from recorded state."
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh with the other
+ * TEST_DATABASE_URL-gated; run by test:integration with the other
  * .integration suites.
  */
 
diff --git a/apps/api/test/shared-chats.e2e-spec.ts b/apps/api/src/chats/shared-chats.integration.test.ts
similarity index 95%
rename from apps/api/test/shared-chats.e2e-spec.ts
rename to apps/api/src/chats/shared-chats.integration.test.ts
index a2ae114b..41a3ad2d 100644
--- a/apps/api/test/shared-chats.e2e-spec.ts
+++ b/apps/api/src/chats/shared-chats.integration.test.ts
@@ -6,18 +6,18 @@
  * HTTP, and that the response carries `Cache-Control: no-store`.
  *
  * Requires POSTGRES_URL to point at a migrated database. Without it the suite
- * is skipped so offline `pnpm test` remains usable; scripts/rls-test.sh
+ * is skipped so offline `pnpm test` remains usable; the test:integration globalSetup
  * provides the real database gate.
  */
 
 import { INestApplication } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import request from 'supertest';
-import { AppModule } from './../src/app.module';
-import { configureApp } from './../src/app.setup';
-import { TenantDbService } from './../src/db/tenant-db.service';
-import { ChatsRepository } from './../src/chats/chats-repository';
-import { cookieOf } from './support';
+import { AppModule } from '../app.module';
+import { configureApp } from '../app.setup';
+import { TenantDbService } from '../db/tenant-db.service';
+import { ChatsRepository } from '../chats/chats-repository';
+import { cookieOf } from '../testing/support';
 
 const hasDb = !!process.env.POSTGRES_URL;
 const d = hasDb ? describe : describe.skip;
diff --git a/apps/api/src/chats/turn-telemetry.spec.ts b/apps/api/src/chats/turn-telemetry.test.ts
similarity index 95%
rename from apps/api/src/chats/turn-telemetry.spec.ts
rename to apps/api/src/chats/turn-telemetry.test.ts
index fed3a749..821e1b31 100644
--- a/apps/api/src/chats/turn-telemetry.spec.ts
+++ b/apps/api/src/chats/turn-telemetry.test.ts
@@ -81,11 +81,11 @@ describe('TurnTelemetry', () => {
 
   it('does not throw when telemetry logging fails', () => {
     const logger = {
-      info: jest.fn(() => {
+      info: vi.fn(() => {
         throw new Error('pino sink failed');
       }),
     } satisfies TurnTelemetryLogger;
-    const onError = jest.fn();
+    const onError = vi.fn();
     const telemetry = buildTurnTelemetry({
       usage: {
         inputTokens: 1,
@@ -114,7 +114,7 @@ describe('TurnTelemetry', () => {
   it.each(['aborted', 'error'] as const)(
     'does not emit a structured log for a %s turn',
     (status) => {
-      const info = jest.fn<void, [Record<string, unknown>]>();
+      const info = vi.fn<(payload: Record<string, unknown>) => void>();
       const logger = { info } satisfies TurnTelemetryLogger;
       const telemetry = buildTurnTelemetry({
         usage: null,
@@ -137,7 +137,7 @@ describe('TurnTelemetry', () => {
   );
 
   it('omits message content from the structured telemetry log payload', () => {
-    const info = jest.fn<void, [Record<string, unknown>]>();
+    const info = vi.fn<(payload: Record<string, unknown>) => void>();
     const logger = { info } satisfies TurnTelemetryLogger;
     const telemetry = buildTurnTelemetry({
       usage: {
diff --git a/apps/api/src/compaction/compaction-context.integration.spec.ts b/apps/api/src/compaction/compaction-context.integration.test.ts
similarity index 98%
rename from apps/api/src/compaction/compaction-context.integration.spec.ts
rename to apps/api/src/compaction/compaction-context.integration.test.ts
index cb824429..4d0eece4 100644
--- a/apps/api/src/compaction/compaction-context.integration.spec.ts
+++ b/apps/api/src/compaction/compaction-context.integration.test.ts
@@ -316,7 +316,7 @@ describeIfDb('snapshot-bound compaction continuity', () => {
       response: summary,
       contextWindowTokens: 10_000,
     });
-    const createSourceClient = jest.fn(() => sourceClient);
+    const createSourceClient = vi.fn(() => sourceClient);
     const compaction = new CompactionService(tenantDb, {
       createClient: createSourceClient,
     } as unknown as ModelsService);
@@ -393,7 +393,7 @@ describeIfDb('snapshot-bound compaction continuity', () => {
     const sourceCalls: ModelStreamInput[] = [];
     const targetCalls: ModelStreamInput[] = [];
     const compaction = new CompactionService(tenantDb, {
-      createClient: jest.fn(() =>
+      createClient: vi.fn(() =>
         compactionClient({ model: 'source-model', calls: sourceCalls }),
       ),
     } as unknown as ModelsService);
@@ -467,7 +467,7 @@ describeIfDb('snapshot-bound compaction continuity', () => {
       },
     };
     const compaction = new CompactionService(tenantDb, {
-      createClient: jest.fn(() => sourceClient),
+      createClient: vi.fn(() => sourceClient),
     } as unknown as ModelsService);
     const targetDelegate = createFakeModelClient(['must not run'], 500);
     const targetClient: ModelClient = {
@@ -543,7 +543,7 @@ describeIfDb('snapshot-bound compaction continuity', () => {
       },
     };
     const compaction = new CompactionService(tenantDb, {
-      createClient: jest.fn(() => sourceClient),
+      createClient: vi.fn(() => sourceClient),
     } as unknown as ModelsService);
     const targetDelegate = createFakeModelClient(['target response'], 500);
     const targetClient: ModelClient = {
@@ -621,7 +621,7 @@ describeIfDb('snapshot-bound compaction continuity', () => {
       },
     };
     const compaction = new CompactionService(tenantDb, {
-      createClient: jest.fn(() => sourceClient),
+      createClient: vi.fn(() => sourceClient),
     } as unknown as ModelsService);
     const targetDelegate = createFakeModelClient(['target response'], 500);
     const targetClient: ModelClient = {
@@ -678,7 +678,7 @@ describeIfDb('snapshot-bound compaction continuity', () => {
       name: 'source model unavailable',
       sourceRun: true,
       models: {
-        createClient: jest.fn(() => {
+        createClient: vi.fn(() => {
           throw new Error('gone');
         }),
       },
@@ -687,7 +687,7 @@ describeIfDb('snapshot-bound compaction continuity', () => {
       name: 'source compaction fails',
       sourceRun: true,
       models: {
-        createClient: jest.fn(() =>
+        createClient: vi.fn(() =>
           compactionClient({
             model: 'source-model',
             calls: [],
@@ -700,13 +700,13 @@ describeIfDb('snapshot-bound compaction continuity', () => {
       name: 'public-fork-like history has no owned source run',
       sourceRun: false,
       switchMarker: false,
-      models: { createClient: jest.fn() },
+      models: { createClient: vi.fn() },
     },
     {
       name: 'one transition summary still exceeds the target window',
       sourceRun: true,
       models: {
-        createClient: jest.fn(() =>
+        createClient: vi.fn(() =>
           compactionClient({
             model: 'source-model',
             calls: [],
diff --git a/apps/api/src/compaction/compaction.spec.ts b/apps/api/src/compaction/compaction.test.ts
similarity index 100%
rename from apps/api/src/compaction/compaction.spec.ts
rename to apps/api/src/compaction/compaction.test.ts
diff --git a/apps/api/test/compactions.e2e-spec.ts b/apps/api/src/compaction/compactions.integration.test.ts
similarity index 91%
rename from apps/api/test/compactions.e2e-spec.ts
rename to apps/api/src/compaction/compactions.integration.test.ts
index cbbe7b7c..f417c1c9 100644
--- a/apps/api/test/compactions.e2e-spec.ts
+++ b/apps/api/src/compaction/compactions.integration.test.ts
@@ -14,24 +14,24 @@
 import { INestApplication } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import request from 'supertest';
-import { AppModule } from './../src/app.module';
-import { configureApp } from './../src/app.setup';
-import { TenantDbService } from './../src/db/tenant-db.service';
-import { CompactionsRepository } from './../src/chats/chats-repository';
-import { COMPACTION_INSTRUCTION } from './../src/compaction/compaction';
+import { AppModule } from '../app.module';
+import { configureApp } from '../app.setup';
+import { TenantDbService } from '../db/tenant-db.service';
+import { CompactionsRepository } from '../chats/chats-repository';
+import { COMPACTION_INSTRUCTION } from '../compaction/compaction';
 import {
   CONVERSATION_CHECKPOINT_START,
   renderConversationCheckpoint,
-} from './../src/chats/context-builder';
-import { type Compaction } from './../src/db/schema';
-import { ModelsService } from './../src/models/models.service';
-import { FakeModelsService, type FakeTurn, cookieOf } from './support';
+} from '../chats/context-builder';
+import { type Compaction } from '../db/schema';
+import { ModelsService } from '../models/models.service';
+import { FakeModelsService, type FakeTurn, cookieOf } from '../testing/support';
 
 const hasDb = !!process.env.POSTGRES_URL;
 const d = hasDb ? describe : describe.skip;
 
 // Each turn is a full HTTP stream + fire-and-forget compaction poll.
-jest.setTimeout(30_000);
+vi.setConfig({ testTimeout: 30_000 });
 
 d('compaction lineage over HTTP (#57)', () => {
   let app: INestApplication;
@@ -39,7 +39,7 @@ d('compaction lineage over HTTP (#57)', () => {
   let models: FakeModelsService;
   let tenantDb: TenantDbService;
 
-  // Random (not Date.now()): parallel jest workers evaluate this at the same
+  // Random (not Date.now()): parallel test workers evaluate this at the same
   // millisecond often enough to collide on the registration email.
   const tag = crypto.randomUUID();
   let cookie = '';
diff --git a/apps/api/src/db/migration-journal.spec.ts b/apps/api/src/db/migration-journal.test.ts
similarity index 100%
rename from apps/api/src/db/migration-journal.spec.ts
rename to apps/api/src/db/migration-journal.test.ts
diff --git a/apps/api/src/db/schema/chats.ts b/apps/api/src/db/schema/chats.ts
index 08335553..09b1dcbe 100644
--- a/apps/api/src/db/schema/chats.ts
+++ b/apps/api/src/db/schema/chats.ts
@@ -72,7 +72,7 @@ export const chats = pgTable(
     // `FORCE ROW LEVEL SECURITY` on both tables, which Drizzle cannot express here
     // (no force option in this version). FORCE is load-bearing for the single-role
     // self-hosted case — see migration 0004 and the relforcerowsecurity assertion in
-    // chats-rls.integration.spec.ts. If you regenerate this migration, re-add FORCE.
+    // chats-rls.integration.test.ts. If you regenerate this migration, re-add FORCE.
     pgPolicy('chats_owner', {
       using: sql`owner_user_id = current_setting('app.current_user_id', true)`,
       // Filing gate: a chat may only be filed into a project the caller owns.
@@ -206,7 +206,7 @@ export const compactions = pgTable(
     }),
     // RLS: same shape as messages_owner. The migration ALSO issues
     // FORCE ROW LEVEL SECURITY (Drizzle can't express it) — see migration 0009
-    // and the relforcerowsecurity assertion in chats-rls.integration.spec.ts.
+    // and the relforcerowsecurity assertion in chats-rls.integration.test.ts.
     pgPolicy('compactions_owner', {
       using: sql`chat_id IN (
         SELECT id FROM chats
diff --git a/apps/api/src/db/schema/model-context.spec.ts b/apps/api/src/db/schema/model-context.test.ts
similarity index 100%
rename from apps/api/src/db/schema/model-context.spec.ts
rename to apps/api/src/db/schema/model-context.test.ts
diff --git a/apps/api/src/db/tenant-db.service.spec.ts b/apps/api/src/db/tenant-db.service.test.ts
similarity index 96%
rename from apps/api/src/db/tenant-db.service.spec.ts
rename to apps/api/src/db/tenant-db.service.test.ts
index 54a22ac6..8779eb77 100644
--- a/apps/api/src/db/tenant-db.service.spec.ts
+++ b/apps/api/src/db/tenant-db.service.test.ts
@@ -17,13 +17,13 @@ import { PgDialect } from 'drizzle-orm/pg-core';
 import { TenantDbService, type Db } from './tenant-db.service';
 
 function makeFakeDb() {
-  const executeSpy = jest.fn().mockResolvedValue([]);
+  const executeSpy = vi.fn().mockResolvedValue([]);
 
   const fakeTx = {
     execute: executeSpy,
   } as unknown as Db;
 
-  const transactionSpy = jest.fn((fn: (tx: Db) => Promise<unknown>) =>
+  const transactionSpy = vi.fn((fn: (tx: Db) => Promise<unknown>) =>
     fn(fakeTx),
   );
 
diff --git a/apps/api/src/identity/dto/identity.dto.spec.ts b/apps/api/src/identity/dto/identity.dto.test.ts
similarity index 100%
rename from apps/api/src/identity/dto/identity.dto.spec.ts
rename to apps/api/src/identity/dto/identity.dto.test.ts
diff --git a/apps/api/src/identity/identity-admin.integration.spec.ts b/apps/api/src/identity/identity-admin.integration.test.ts
similarity index 99%
rename from apps/api/src/identity/identity-admin.integration.spec.ts
rename to apps/api/src/identity/identity-admin.integration.test.ts
index 3bfb9922..cf10bc12 100644
--- a/apps/api/src/identity/identity-admin.integration.spec.ts
+++ b/apps/api/src/identity/identity-admin.integration.test.ts
@@ -14,7 +14,7 @@
  * - owner-tier grants (D3): a plain admin still cannot mint `owner` through
  *   the service; an owner can.
  *
- * TEST_DATABASE_URL-gated; run by scripts/rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
@@ -63,7 +63,7 @@ describeIfDb('org/membership admin surface — RLS + escalation guards', () => {
       // The last-owner trigger (org-units change, D2) now blocks deleting a
       // user who is the sole owner of a root org — every unit `owner` created
       // in this suite has to go leaf-first before the users can, same pattern
-      // as identity-rls.integration.spec.ts's teardown.
+      // as identity-rls.integration.test.ts's teardown.
       for (const creator of [owner, member, stranger]) {
         await sql.begin(async (tx: SqlClient) => {
           await tx`SELECT set_config('app.current_user_id', ${creator}, true)`;
diff --git a/apps/api/src/identity/identity-invariants.integration.spec.ts b/apps/api/src/identity/identity-invariants.integration.test.ts
similarity index 99%
rename from apps/api/src/identity/identity-invariants.integration.spec.ts
rename to apps/api/src/identity/identity-invariants.integration.test.ts
index 39e83a10..319fb902 100644
--- a/apps/api/src/identity/identity-invariants.integration.spec.ts
+++ b/apps/api/src/identity/identity-invariants.integration.test.ts
@@ -1,6 +1,6 @@
 /**
  * DB-enforced org-tree invariants (org-units change, D1/D2) — requires a real
- * PostgreSQL connection; same harness contract as identity-rls.integration.spec.ts.
+ * PostgreSQL connection; same harness contract as identity-rls.integration.test.ts.
  *
  * Covered:
  * - D1: a path that doesn't match its parent's current path is rejected at
diff --git a/apps/api/src/identity/identity-rls.integration.spec.ts b/apps/api/src/identity/identity-rls.integration.test.ts
similarity index 99%
rename from apps/api/src/identity/identity-rls.integration.spec.ts
rename to apps/api/src/identity/identity-rls.integration.test.ts
index 58933470..39200e23 100644
--- a/apps/api/src/identity/identity-rls.integration.spec.ts
+++ b/apps/api/src/identity/identity-rls.integration.test.ts
@@ -1,6 +1,6 @@
 /**
  * Identity RLS integration tests (#44) — requires a real PostgreSQL
- * connection; same harness contract as chats-rls.integration.spec.ts:
+ * connection; same harness contract as chats-rls.integration.test.ts:
  * set TEST_DATABASE_URL to run, connecting role must be non-superuser and
  * ideally the table owner (a green run as the owner proves FORCE works).
  *
diff --git a/apps/api/src/identity/org-path.spec.ts b/apps/api/src/identity/org-path.test.ts
similarity index 100%
rename from apps/api/src/identity/org-path.spec.ts
rename to apps/api/src/identity/org-path.test.ts
diff --git a/apps/api/test/org-units.e2e-spec.ts b/apps/api/src/identity/org-units.integration.test.ts
similarity index 97%
rename from apps/api/test/org-units.e2e-spec.ts
rename to apps/api/src/identity/org-units.integration.test.ts
index 05bf6b51..57031df1 100644
--- a/apps/api/test/org-units.e2e-spec.ts
+++ b/apps/api/src/identity/org-units.integration.test.ts
@@ -3,13 +3,13 @@
  * consumer (supertest) against the bootstrapped NestJS app and a real
  * Postgres, exercising design.md's D5 endpoint table end to end: happy path
  * plus the 403/404/409/422 semantics the org-units/org-memberships spec
- * scenarios require. Complements identity-{rls,admin,invariants}.integration.spec.ts,
+ * scenarios require. Complements identity-{rls,admin,invariants}.integration.test.ts,
  * which drive the service/repository layer directly — this file proves the
  * SAME guarantees hold through the controller (DTOs, ParseUUIDPipe, status
  * codes).
  *
  * Requires POSTGRES_URL to point at a migrated, non-superuser-owned database
- * with `app_rls` provisioned (see apps/api/AGENTS.md) — scripts/rls-test.sh
+ * with `app_rls` provisioned (see apps/api/AGENTS.md) — the test:integration globalSetup
  * sets this up and runs this file.
  *
  * A SMALL, FIXED pool of users is registered once in `beforeAll` and reused
@@ -28,15 +28,15 @@
 import { INestApplication } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import request from 'supertest';
-import { AppModule } from './../src/app.module';
-import { configureApp } from './../src/app.setup';
+import { AppModule } from '../app.module';
+import { configureApp } from '../app.setup';
 
-import { cookieOf } from './support';
+import { cookieOf } from '../testing/support';
 
 // beforeAll compiles the full AppModule and registers a 5-account pool
-// (parallel bcrypt) — well past jest's 5s default hook timeout under load.
+// (parallel bcrypt) — well past the default hook timeout under load.
 // Same guard as the other e2e suites (chats-messages, compactions).
-jest.setTimeout(30_000);
+vi.setConfig({ testTimeout: 30_000 });
 
 const hasDb = !!process.env.POSTGRES_URL;
 const d = hasDb ? describe : describe.skip;
diff --git a/apps/api/src/identity/role-resolution.spec.ts b/apps/api/src/identity/role-resolution.test.ts
similarity index 100%
rename from apps/api/src/identity/role-resolution.spec.ts
rename to apps/api/src/identity/role-resolution.test.ts
diff --git a/apps/api/src/instance-config/config-loader.spec.ts b/apps/api/src/instance-config/config-loader.test.ts
similarity index 99%
rename from apps/api/src/instance-config/config-loader.spec.ts
rename to apps/api/src/instance-config/config-loader.test.ts
index 90c94c38..6dbaf1ea 100644
--- a/apps/api/src/instance-config/config-loader.spec.ts
+++ b/apps/api/src/instance-config/config-loader.test.ts
@@ -157,7 +157,7 @@ describe('loadInstanceConfig — file presence', () => {
     expect(() => loadInstanceConfig()).toThrow(InstanceConfigError);
     try {
       loadInstanceConfig();
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect((err as Error).message).toContain(file);
       expect((err as Error).message).toMatch(/line \d+, column \d+/);
@@ -321,7 +321,7 @@ describe('loadInstanceConfig — whole-value numeric interpolation (task 2.2)',
     expect(() => loadInstanceConfig()).toThrow(InstanceConfigError);
     try {
       loadInstanceConfig();
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect((err as Error).message).toContain(missing);
     }
@@ -732,7 +732,7 @@ describe('loadInstanceConfig — providers[] / models[] (providers-and-models-as
     }`);
     try {
       loadInstanceConfig();
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect((err as Error).message).not.toContain('sk-should-never-leak');
     }
@@ -746,7 +746,7 @@ describe('loadInstanceConfig — providers[] / models[] (providers-and-models-as
     );
     try {
       loadInstanceConfig();
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect((err as Error).message).not.toContain(
         'sk-should-never-appear-either',
@@ -772,7 +772,7 @@ describe('loadInstanceConfig — no secret in logs', () => {
     }`);
     try {
       loadInstanceConfig();
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect((err as Error).message).not.toContain(
         'sk-should-never-appear-in-any-error',
diff --git a/apps/api/src/instance-config/interpolation.spec.ts b/apps/api/src/instance-config/interpolation.test.ts
similarity index 97%
rename from apps/api/src/instance-config/interpolation.spec.ts
rename to apps/api/src/instance-config/interpolation.test.ts
index 54d1f299..b1c7cf63 100644
--- a/apps/api/src/instance-config/interpolation.spec.ts
+++ b/apps/api/src/instance-config/interpolation.test.ts
@@ -45,7 +45,7 @@ describe('interpolateString — {env:...}', () => {
     );
     try {
       interpolateString('{env:IC_TEST_VAR}');
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect(err).toBeInstanceOf(InterpolationError);
       expect((err as InterpolationError).source).toEqual({
@@ -117,7 +117,7 @@ describe('interpolateString — {path:...}', () => {
     const missing = path.join(tmpdir(), 'llame-instance-config-missing-file');
     try {
       interpolateString(`{path:${missing}}`);
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect(err).toBeInstanceOf(InterpolationError);
       expect((err as InterpolationError).source).toEqual({
@@ -146,7 +146,7 @@ describe('interpolateString — redaction', () => {
     try {
       // A sibling token resolves a secret; this one is missing and required.
       interpolateString('{env:IC_TEST_SECRET}{env:IC_TEST_VAR}');
-      fail('expected throw');
+      expect.unreachable('expected throw');
     } catch (err) {
       expect((err as Error).message).not.toContain('sk-should-never-appear');
     }
diff --git a/apps/api/src/instance-config/prompt-loader.spec.ts b/apps/api/src/instance-config/prompt-loader.test.ts
similarity index 98%
rename from apps/api/src/instance-config/prompt-loader.spec.ts
rename to apps/api/src/instance-config/prompt-loader.test.ts
index e405f1d0..04658ae0 100644
--- a/apps/api/src/instance-config/prompt-loader.spec.ts
+++ b/apps/api/src/instance-config/prompt-loader.test.ts
@@ -37,9 +37,9 @@ describe('model prompt file loading', () => {
       [defaultPromptPath, 'Default for {{model.id}}'],
       [path.join(path.dirname(configPath), 'shared.md'), 'Hello {{model.id}}'],
     ]);
-    const readFile = jest.fn((file: string) => contents.get(file) ?? '');
+    const readFile = vi.fn((file: string) => contents.get(file) ?? '');
     const access: PromptFileAccess = {
-      isFile: jest.fn((file) => contents.has(file)),
+      isFile: vi.fn((file: string) => contents.has(file)),
       readFile,
     };
     const prompts = loader(access);
diff --git a/apps/api/src/instance-config/schema.spec.ts b/apps/api/src/instance-config/schema.test.ts
similarity index 90%
rename from apps/api/src/instance-config/schema.spec.ts
rename to apps/api/src/instance-config/schema.test.ts
index 2cb687ba..0e1c911c 100644
--- a/apps/api/src/instance-config/schema.spec.ts
+++ b/apps/api/src/instance-config/schema.test.ts
@@ -9,14 +9,15 @@ import { WHOLE_VALUE_TOKEN_PATTERN } from './interpolation';
 import { InstanceConfigError } from './instance-config.error';
 import { getConfigValidator, loadSchemaDocument, SCHEMA_PATH } from './schema';
 
-// node:fs's own exports object rejects jest.spyOn (its properties are
+import type { Mock } from 'vitest';
+// node:fs's own exports object rejects vi.spyOn (its properties are
 // non-configurable in this runtime — "Cannot redefine property"), so
-// readFileSync is replaced with a jest.fn wrapping the real implementation
+// readFileSync is replaced with a vi.fn wrapping the real implementation
 // by default; only the one test below overrides it, via
 // mockImplementationOnce, which self-restores after that single call.
-jest.mock('node:fs', () => {
-  const actual = jest.requireActual<typeof fs>('node:fs');
-  return { ...actual, readFileSync: jest.fn(actual.readFileSync) };
+vi.mock('node:fs', async () => {
+  const actual = await vi.importActual<typeof fs>('node:fs');
+  return { ...actual, readFileSync: vi.fn(actual.readFileSync) };
 });
 
 describe('published schema — single artifact', () => {
@@ -26,7 +27,7 @@ describe('published schema — single artifact', () => {
   });
 
   it('wraps a missing/unreadable schema artifact as InstanceConfigError, never a raw fs error — a packaging problem must not read like the operator broke their own llame.config.json', () => {
-    const mockedReadFileSync = fs.readFileSync as jest.Mock;
+    const mockedReadFileSync = fs.readFileSync as Mock;
     mockedReadFileSync.mockImplementationOnce(() => {
       throw Object.assign(new Error('ENOENT: no such file or directory'), {
         code: 'ENOENT',
diff --git a/apps/api/src/instance-config/schema.ts b/apps/api/src/instance-config/schema.ts
index 2a10fba7..11095cc2 100644
--- a/apps/api/src/instance-config/schema.ts
+++ b/apps/api/src/instance-config/schema.ts
@@ -10,7 +10,7 @@ import { InstanceConfigError } from './instance-config.error';
  * the boot-time validator, so the two can never drift.
  *
  * Resolved relative to THIS module's own compiled location (`__dirname`),
- * NOT the runtime cwd: a source checkout (`nest start`, jest) has
+ * NOT the runtime cwd: a source checkout (`nest start`, vitest) has
  * `__dirname` at `src/instance-config`, right next to this file, and a
  * dist-only deploy has it at `dist/instance-config` because `nest build`
  * copies the schema there too (nest-cli.json `compilerOptions.assets`) — the
diff --git a/apps/api/src/instance-config/worker-profile.service.spec.ts b/apps/api/src/instance-config/worker-profile.service.test.ts
similarity index 100%
rename from apps/api/src/instance-config/worker-profile.service.spec.ts
rename to apps/api/src/instance-config/worker-profile.service.test.ts
diff --git a/apps/api/src/models/keyless-provider.spec.ts b/apps/api/src/models/keyless-provider.test.ts
similarity index 99%
rename from apps/api/src/models/keyless-provider.spec.ts
rename to apps/api/src/models/keyless-provider.test.ts
index e3a05891..c30b0f00 100644
--- a/apps/api/src/models/keyless-provider.spec.ts
+++ b/apps/api/src/models/keyless-provider.test.ts
@@ -1,5 +1,5 @@
 /**
- * Keyless-provider regression test (#162), unmocked: `model-client.spec.ts`
+ * Keyless-provider regression test (#162), unmocked: `model-client.test.ts`
  * mocks the whole `@ai-sdk/openai` module, so it can only assert what OUR
  * code passes to `createOpenAI` — it never actually exercises
  * `@ai-sdk/provider-utils`'s `loadApiKey`, which is where the real bug lived
diff --git a/apps/api/src/models/model-client-factory.spec.ts b/apps/api/src/models/model-client-factory.test.ts
similarity index 88%
rename from apps/api/src/models/model-client-factory.spec.ts
rename to apps/api/src/models/model-client-factory.test.ts
index 86f3bf4d..78473979 100644
--- a/apps/api/src/models/model-client-factory.spec.ts
+++ b/apps/api/src/models/model-client-factory.test.ts
@@ -1,11 +1,11 @@
 import { createModelClient } from './model-client-factory';
 import { createOpenAIModelClient } from './openai-model-client';
 
-jest.mock('./openai-model-client', () => ({
-  createOpenAIModelClient: jest.fn(() => ({ model: 'fake' })),
+vi.mock('./openai-model-client', () => ({
+  createOpenAIModelClient: vi.fn(() => ({ model: 'fake' })),
 }));
 
-const createOpenAIModelClientMock = jest.mocked(createOpenAIModelClient);
+const createOpenAIModelClientMock = vi.mocked(createOpenAIModelClient);
 const model = {
   id: 'system:test:model',
   source: 'system' as const,
diff --git a/apps/api/src/models/model-client.spec.ts b/apps/api/src/models/model-client.test.ts
similarity index 91%
rename from apps/api/src/models/model-client.spec.ts
rename to apps/api/src/models/model-client.test.ts
index 81bf194a..f4f2a031 100644
--- a/apps/api/src/models/model-client.spec.ts
+++ b/apps/api/src/models/model-client.test.ts
@@ -13,16 +13,17 @@ import {
   KEYLESS_PLACEHOLDER_API_KEY,
 } from './openai-model-client';
 
-jest.mock('@ai-sdk/openai', () => ({
-  createOpenAI: jest.fn(),
+import type { Mock } from 'vitest';
+vi.mock('@ai-sdk/openai', () => ({
+  createOpenAI: vi.fn(),
 }));
 
-jest.mock('ai', () => ({
-  streamText: jest.fn(),
+vi.mock('ai', () => ({
+  streamText: vi.fn(),
 }));
 
-const createOpenAIMock = jest.mocked(createOpenAI);
-const streamTextMock = jest.mocked(streamText);
+const createOpenAIMock = vi.mocked(createOpenAI);
+const streamTextMock = vi.mocked(streamText);
 
 async function collectText(stream: AsyncIterable<string>): Promise<string> {
   let text = '';
@@ -61,7 +62,7 @@ describe('ModelClient', () => {
 
   it('constructs a per-request client from a user-supplied credential', async () => {
     const providerModel = { provider: 'openai', modelId: 'gpt-test' };
-    const openaiProvider = jest.fn(() => providerModel);
+    const openaiProvider = vi.fn(() => providerModel);
     // The client uses the /chat/completions API (OpenAI-compatible, #88).
     (openaiProvider as unknown as { chat: unknown }).chat = openaiProvider;
     createOpenAIMock.mockReturnValue(
@@ -82,8 +83,8 @@ describe('ModelClient', () => {
     });
 
     const abortSignal = AbortSignal.timeout(1000);
-    const onError = jest.fn();
-    const onFinish = jest.fn();
+    const onError = vi.fn();
+    const onFinish = vi.fn();
     client.streamText({
       messages,
       system: 'stable system',
@@ -121,7 +122,7 @@ describe('ModelClient', () => {
       provider: 'openai',
       modelId: 'gpt-local',
     };
-    const openaiProvider = jest.fn(() => providerModel);
+    const openaiProvider = vi.fn(() => providerModel);
     (openaiProvider as unknown as { chat: unknown }).chat = openaiProvider;
     createOpenAIMock.mockReturnValue(
       openaiProvider as unknown as OpenAIProvider,
@@ -157,7 +158,7 @@ describe('ModelClient', () => {
 
   it('targets an OpenAI-compatible endpoint when a base URL is provided', () => {
     const providerModel = { provider: 'openai', modelId: 'gpt-test' };
-    const openaiProvider = jest.fn(() => providerModel);
+    const openaiProvider = vi.fn(() => providerModel);
     // The client uses the /chat/completions API (OpenAI-compatible, #88).
     (openaiProvider as unknown as { chat: unknown }).chat = openaiProvider;
     createOpenAIMock.mockReturnValue(
@@ -188,8 +189,8 @@ describe('ModelClient', () => {
 
   it('uses native Responses with an automatic displayable reasoning summary when configured for native OpenAI', () => {
     const providerModel = { provider: 'openai', modelId: 'gpt-test' };
-    const openaiProvider = jest.fn(() => providerModel);
-    (openaiProvider as unknown as { chat: jest.Mock }).chat = jest.fn();
+    const openaiProvider = vi.fn(() => providerModel);
+    (openaiProvider as unknown as { chat: Mock }).chat = vi.fn();
     createOpenAIMock.mockReturnValue(
       openaiProvider as unknown as OpenAIProvider,
     );
@@ -208,7 +209,7 @@ describe('ModelClient', () => {
 
     expect(openaiProvider).toHaveBeenCalledWith('gpt-test');
     expect(
-      (openaiProvider as unknown as { chat: jest.Mock }).chat,
+      (openaiProvider as unknown as { chat: Mock }).chat,
     ).not.toHaveBeenCalled();
     expect(streamTextMock).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -220,7 +221,7 @@ describe('ModelClient', () => {
 
   it('passes onFinish through to the fake client', async () => {
     const client = createFakeModelClient(['done']);
-    const onFinish = jest.fn();
+    const onFinish = vi.fn();
 
     await collectText(client.streamText({ messages, onFinish }).textStream);
 
diff --git a/apps/api/src/models/models.controller.spec.ts b/apps/api/src/models/models.controller.test.ts
similarity index 93%
rename from apps/api/src/models/models.controller.spec.ts
rename to apps/api/src/models/models.controller.test.ts
index 0a21a6bb..e89e3d00 100644
--- a/apps/api/src/models/models.controller.spec.ts
+++ b/apps/api/src/models/models.controller.test.ts
@@ -3,13 +3,14 @@ import { HttpException, HttpStatus } from '@nestjs/common';
 import { ModelsController } from './models.controller';
 import { ModelConfigurationError, ModelsService } from './models.service';
 
+import type { Mocked } from 'vitest';
 describe('ModelsController', () => {
   function makeController(service?: Partial<ModelsService>): {
     controller: ModelsController;
-    service: jest.Mocked<ModelsService>;
+    service: Mocked<ModelsService>;
   } {
     const modelsService = {
-      getAvailableModels: jest.fn().mockReturnValue({
+      getAvailableModels: vi.fn().mockReturnValue({
         defaultModelId: 'system:openai:gpt-5.4-mini',
         models: [
           {
@@ -25,7 +26,7 @@ describe('ModelsController', () => {
         ],
       }),
       ...service,
-    } as unknown as jest.Mocked<ModelsService>;
+    } as unknown as Mocked<ModelsService>;
 
     return {
       controller: new ModelsController(modelsService),
@@ -58,7 +59,7 @@ describe('ModelsController', () => {
 
   it('maps model configuration failures to the standard error body', () => {
     const { controller } = makeController({
-      getAvailableModels: jest.fn(() => {
+      getAvailableModels: vi.fn(() => {
         throw new ModelConfigurationError('DEFAULT_MODEL_ID is required.');
       }),
     });
diff --git a/apps/api/src/models/models.service.spec.ts b/apps/api/src/models/models.service.test.ts
similarity index 98%
rename from apps/api/src/models/models.service.spec.ts
rename to apps/api/src/models/models.service.test.ts
index 66729e9c..a18fbce1 100644
--- a/apps/api/src/models/models.service.spec.ts
+++ b/apps/api/src/models/models.service.test.ts
@@ -11,16 +11,16 @@ import {
   ModelsService,
 } from './models.service';
 
-jest.mock('./openai-model-client', () => ({
-  createOpenAIModelClient: jest.fn(() => ({
+vi.mock('./openai-model-client', () => ({
+  createOpenAIModelClient: vi.fn(() => ({
     model: 'stub',
     provider: 'openai',
     contextWindowTokens: 400_000,
-    streamText: jest.fn(),
+    streamText: vi.fn(),
   })),
 }));
 
-const createOpenAIModelClientMock = jest.mocked(createOpenAIModelClient);
+const createOpenAIModelClientMock = vi.mocked(createOpenAIModelClient);
 
 const DEFAULT_PROVIDER: ProviderConfig = {
   id: 'openai',
diff --git a/apps/api/src/models/openai-model-client.tools.spec.ts b/apps/api/src/models/openai-model-client.tools.test.ts
similarity index 95%
rename from apps/api/src/models/openai-model-client.tools.spec.ts
rename to apps/api/src/models/openai-model-client.tools.test.ts
index f7d269ab..f4bc203c 100644
--- a/apps/api/src/models/openai-model-client.tools.spec.ts
+++ b/apps/api/src/models/openai-model-client.tools.test.ts
@@ -15,12 +15,12 @@ import type { StepResult, ToolSet } from 'ai';
 
 import { createOpenAIModelClient } from './openai-model-client';
 
-jest.mock('ai', () => ({
-  ...jest.requireActual<typeof import('ai')>('ai'),
-  streamText: jest.fn(),
+vi.mock('ai', async () => ({
+  ...(await vi.importActual<typeof import('ai')>('ai')),
+  streamText: vi.fn(),
 }));
 
-const streamTextMock = jest.mocked(streamText);
+const streamTextMock = vi.mocked(streamText);
 
 function fakeToolStep(toolCallCount: number): StepResult<ToolSet> {
   return {
@@ -62,7 +62,7 @@ describe('createOpenAIModelClient — step-cap enforcement (prepareStep)', () =>
 
   it('leaves tools active while prior tool-requesting steps are under the cap', async () => {
     const client = buildClient();
-    const onCapReached = jest.fn();
+    const onCapReached = vi.fn();
     client.streamText({
       messages: [],
       tools: { echo: {} as ToolSet[string] },
@@ -84,7 +84,7 @@ describe('createOpenAIModelClient — step-cap enforcement (prepareStep)', () =>
 
   it('disables tools and fires onCapReached when maxSteps prior tool-steps have run', async () => {
     const client = buildClient();
-    const onCapReached = jest.fn();
+    const onCapReached = vi.fn();
     client.streamText({
       messages: [],
       tools: { echo: {} as ToolSet[string] },
@@ -111,7 +111,7 @@ describe('createOpenAIModelClient — step-cap enforcement (prepareStep)', () =>
 
   it('counts parallel calls within one step as ONE step toward the cap', async () => {
     const client = buildClient();
-    const onCapReached = jest.fn();
+    const onCapReached = vi.fn();
     client.streamText({
       messages: [],
       tools: { echo: {} as ToolSet[string] },
@@ -148,7 +148,7 @@ describe('createOpenAIModelClient — step-cap enforcement (prepareStep)', () =>
 describe('createOpenAIModelClient — unavailable/hallucinated tool call refusal', () => {
   it('reports "not_available" for a call to an undeclared tool and resolves null (never crashes)', async () => {
     const client = buildClient();
-    const onUnavailableToolCall = jest.fn();
+    const onUnavailableToolCall = vi.fn();
     client.streamText({
       messages: [],
       tools: { echo: {} as ToolSet[string] },
@@ -189,7 +189,7 @@ describe('createOpenAIModelClient — unavailable/hallucinated tool call refusal
 
   it('reports "invalid_input" for schema-invalid arguments and resolves null', async () => {
     const client = buildClient();
-    const onUnavailableToolCall = jest.fn();
+    const onUnavailableToolCall = vi.fn();
     client.streamText({
       messages: [],
       tools: { echo: {} as ToolSet[string] },
@@ -227,7 +227,7 @@ describe('createOpenAIModelClient — unavailable/hallucinated tool call refusal
 
   it('falls back to the raw string when the tool call input is not valid JSON (a hallucinating model), never throws', async () => {
     const client = buildClient();
-    const onUnavailableToolCall = jest.fn();
+    const onUnavailableToolCall = vi.fn();
     client.streamText({
       messages: [],
       tools: { echo: {} as ToolSet[string] },
diff --git a/apps/api/src/pins/pins-rls.integration.spec.ts b/apps/api/src/pins/pins-rls.integration.test.ts
similarity index 98%
rename from apps/api/src/pins/pins-rls.integration.spec.ts
rename to apps/api/src/pins/pins-rls.integration.test.ts
index 44645476..76bbba92 100644
--- a/apps/api/src/pins/pins-rls.integration.spec.ts
+++ b/apps/api/src/pins/pins-rls.integration.test.ts
@@ -6,7 +6,7 @@
  * NOT BYPASSRLS, and ideally the OWNER of the tables — the worst case for a
  * self-hosted deployment (one role owns, migrates, AND serves). RLS only
  * constrains a table owner under FORCE ROW LEVEL SECURITY, so a green run as the
- * owner proves FORCE is doing its job. scripts/rls-test.sh provisions exactly
+ * owner proves FORCE is doing its job. the test:integration globalSetup provisions exactly
  * this. If TEST_DATABASE_URL is not set, all tests here are skipped.
  *
  * Acceptance criteria (item-pins spec):
@@ -27,7 +27,7 @@
 
 // Make this file a module so its top-level `TEST_DB_URL`/`describeIfDb`/
 // `SqlClient` are module-scoped, not globals that collide with the sibling
-// *-rls.integration.spec.ts files (which are scripts using the same names).
+// *-rls.integration.test.ts files (which are scripts using the same names).
 export {};
 
 const TEST_DB_URL = process.env['TEST_DATABASE_URL'];
diff --git a/apps/api/src/pins/pins.spec.ts b/apps/api/src/pins/pins.test.ts
similarity index 96%
rename from apps/api/src/pins/pins.spec.ts
rename to apps/api/src/pins/pins.test.ts
index 3882d721..6dd18325 100644
--- a/apps/api/src/pins/pins.spec.ts
+++ b/apps/api/src/pins/pins.test.ts
@@ -59,7 +59,7 @@ describe('PinsService.pin — error mapping', () => {
   // which we simulate by stubbing runAs directly.
   function makeService(runAsImpl: () => Promise<unknown>): PinsService {
     const tenantDb = {
-      runAs: jest.fn(() => runAsImpl()),
+      runAs: vi.fn(() => runAsImpl()),
     } as unknown as TenantDbService;
     return new PinsService(tenantDb);
   }
@@ -128,7 +128,7 @@ describe('PinsController', () => {
         archivedAt: null,
       },
     ];
-    const listPins = jest.fn().mockResolvedValue(rows);
+    const listPins = vi.fn().mockResolvedValue(rows);
     const service = { listPins } as unknown as PinsService;
     const controller = new PinsController(service);
 
@@ -147,7 +147,7 @@ describe('PinsController', () => {
       title: 'C',
       archivedAt: null,
     };
-    const pin = jest.fn().mockResolvedValue(row);
+    const pin = vi.fn().mockResolvedValue(row);
     const service = { pin } as unknown as PinsService;
     const controller = new PinsController(service);
 
@@ -157,7 +157,7 @@ describe('PinsController', () => {
   });
 
   it('DELETE delegates to the service and returns void', async () => {
-    const unpin = jest.fn().mockResolvedValue(undefined);
+    const unpin = vi.fn().mockResolvedValue(undefined);
     const service = { unpin } as unknown as PinsService;
     const controller = new PinsController(service);
 
diff --git a/apps/api/src/projects/projects-rls.integration.spec.ts b/apps/api/src/projects/projects-rls.integration.test.ts
similarity index 97%
rename from apps/api/src/projects/projects-rls.integration.spec.ts
rename to apps/api/src/projects/projects-rls.integration.test.ts
index 35188144..5af4d00f 100644
--- a/apps/api/src/projects/projects-rls.integration.spec.ts
+++ b/apps/api/src/projects/projects-rls.integration.test.ts
@@ -9,7 +9,7 @@
  *     serves the app). RLS only constrains a table owner when FORCE ROW LEVEL
  *     SECURITY is set, so a green run as the owner proves FORCE is doing its job.
  *
- * Example (scripts/rls-test.sh provisions exactly this — it picks a free port
+ * Example (the test:integration globalSetup provisions exactly this — it picks a free port
  * in 55440–55490 per invocation, or honors RLS_TEST_PORT, and prints it):
  *   TEST_DATABASE_URL="postgres://app:app@localhost:<port>/llame_test" pnpm --filter api test
  *
@@ -31,10 +31,10 @@
  * NOTE: this file uses `any` for the postgres.js client, loaded dynamically so the
  * module does not connect at import time when TEST_DATABASE_URL is absent. Tests
  * operate at the raw-SQL/RLS level (mirroring the first describe block of
- * chats-rls.integration.spec.ts) — there is no separate app-layer describe block
+ * chats-rls.integration.test.ts) — there is no separate app-layer describe block
  * here because ProjectsService/ChatsService are thin `TenantDbService.runAs`
- * pass-throughs already exercised by chats-rls.integration.spec.ts and
- * chat-pinning.integration.spec.ts; nothing project-specific happens above the
+ * pass-throughs already exercised by chats-rls.integration.test.ts and
+ * chat-pinning.integration.test.ts; nothing project-specific happens above the
  * RLS boundary that isn't covered by proving the policies directly.
  */
 
@@ -58,7 +58,7 @@ describeIfDb('RLS integration — projects tenancy (projects-foundation)', () =>
    * Run `fn` inside a transaction scoped to `userId` via app.current_user_id.
    * Uses set_config(..., is_local = true) — the parameterizable equivalent of
    * `SET LOCAL` (plain `SET LOCAL x = $1` cannot take a bind parameter). Mirrors
-   * chats-rls.integration.spec.ts's asUser exactly.
+   * chats-rls.integration.test.ts's asUser exactly.
    */
   const asUser = (userId: string, fn: (tx: SqlClient) => Promise<any>) =>
     sql.begin(async (tx: SqlClient) => {
@@ -74,7 +74,7 @@ describeIfDb('RLS integration — projects tenancy (projects-foundation)', () =>
     // Local test databases (docker) have no TLS; only require it if the URL asks.
     const ssl = /sslmode=require/.test(TEST_DB_URL!) ? 'require' : false;
     // max: 2 (not 1) so afterAll's raw-sql cleanup never deadlocks against a
-    // still-open runAs transaction — see chats-rls.integration.spec.ts.
+    // still-open runAs transaction — see chats-rls.integration.test.ts.
     sql = connect(TEST_DB_URL!, { ssl, max: 2 });
 
     // users has no RLS, so the owner can seed it directly (no scope needed).
@@ -219,7 +219,7 @@ describeIfDb('RLS integration — projects tenancy (projects-foundation)', () =>
           tx`INSERT INTO projects (id, owner_user_id, name) VALUES (${projectId}, ${userAId}, 'Owned by A')`,
       );
 
-      // No set_config call at all — mirrors identity-rls.integration.spec.ts's
+      // No set_config call at all — mirrors identity-rls.integration.test.ts's
       // "unscoped context sees nothing" case: current_setting(...) is NULL, so
       // `owner_user_id = NULL` never matches under the policy.
       const rows = await sql.begin(
diff --git a/apps/api/src/queue/queue.integration.spec.ts b/apps/api/src/queue/queue.integration.test.ts
similarity index 98%
rename from apps/api/src/queue/queue.integration.spec.ts
rename to apps/api/src/queue/queue.integration.test.ts
index 6987918e..8664e06d 100644
--- a/apps/api/src/queue/queue.integration.spec.ts
+++ b/apps/api/src/queue/queue.integration.test.ts
@@ -1,10 +1,10 @@
 /**
  * Queue integration tests (#47) — requires a real PostgreSQL connection.
  *
- * Set TEST_DATABASE_URL to run (same gate as chats-rls.integration.spec.ts);
+ * Set TEST_DATABASE_URL to run (same gate as chats-rls.integration.test.ts);
  * skipped otherwise so offline `pnpm test` stays usable. pg-boss provisions its
  * own `pgboss` schema on first start — the connecting role owns the database in
- * both dev and the rls-test.sh throwaway, so no extra grants are needed.
+ * both dev and the test:integration throwaway, so no extra grants are needed.
  *
  * Acceptance criteria covered (#47):
  * - enqueue/consume roundtrip through the typed Queue interface (pg-boss via DI)
@@ -32,12 +32,12 @@ import {
   type Queue,
   type QueueDefinition,
 } from './queue';
-import { waitFor } from '../../test/support';
+import { waitFor } from '../testing/support';
 
 const TEST_DB_URL = process.env['TEST_DATABASE_URL'];
 const describeIfDb = TEST_DB_URL ? describe : describe.skip;
 
-jest.setTimeout(60_000);
+vi.setConfig({ testTimeout: 60_000 });
 
 describeIfDb(
   'Queue over pg-boss — enqueue/consume/retry/dead-letter/cron',
@@ -454,7 +454,7 @@ describeIfDb(
     // (plans.js `fetchNextJob` excludes `active` jobs; `failJobsByHeartbeat`
     // only returns one after the beat lapses; `manager.js#processJobs`
     // auto-touches every heartbeatSeconds/2), and our USE of it is covered by
-    // `runs/worker-liveness.integration.spec.ts` — matching the test slice's
+    // `runs/worker-liveness.integration.test.ts` — matching the test slice's
     // rule of not committing flaky wall-clock-timing tests.
   },
 );
diff --git a/apps/api/src/queue/queue.module.ts b/apps/api/src/queue/queue.module.ts
index 860a98b4..2f4c89de 100644
--- a/apps/api/src/queue/queue.module.ts
+++ b/apps/api/src/queue/queue.module.ts
@@ -28,7 +28,7 @@ const pgBossImports = isOpenApiGeneration
           // getOrThrow: a missing POSTGRES_URL must fail module boot loudly,
           // not surface later as a cryptic pg connection error.
           connectionString: config.getOrThrow<string>('POSTGRES_URL'),
-          // Test isolation seam: e2e suites in one jest process share a
+          // Test isolation seam: e2e suites in one vitest process share a
           // Postgres, and a suite's stopping consumers can steal the next
           // suite's jobs from a shared 'pgboss' schema (observed as doubled
           // executions interleaving one run's event log). Each suite gets its
diff --git a/apps/api/src/queue/queue.type.spec.ts b/apps/api/src/queue/queue.type.test.ts
similarity index 100%
rename from apps/api/src/queue/queue.type.spec.ts
rename to apps/api/src/queue/queue.type.test.ts
diff --git a/apps/api/src/runs/delta-buffer.spec.ts b/apps/api/src/runs/delta-buffer.test.ts
similarity index 100%
rename from apps/api/src/runs/delta-buffer.spec.ts
rename to apps/api/src/runs/delta-buffer.test.ts
diff --git a/apps/api/src/runs/effective-context-resolver.spec.ts b/apps/api/src/runs/effective-context-resolver.test.ts
similarity index 100%
rename from apps/api/src/runs/effective-context-resolver.spec.ts
rename to apps/api/src/runs/effective-context-resolver.test.ts
diff --git a/apps/api/src/runs/model-context-snapshot.test-fixture.spec.ts b/apps/api/src/runs/model-context-snapshot.test-fixture.test.ts
similarity index 95%
rename from apps/api/src/runs/model-context-snapshot.test-fixture.spec.ts
rename to apps/api/src/runs/model-context-snapshot.test-fixture.test.ts
index 1e73444d..19b4d14b 100644
--- a/apps/api/src/runs/model-context-snapshot.test-fixture.spec.ts
+++ b/apps/api/src/runs/model-context-snapshot.test-fixture.test.ts
@@ -5,7 +5,7 @@ import { seedModelContextSnapshot } from './model-context-snapshot.test-fixture'
 import { ModelContextSnapshotsRepository } from './model-context-snapshots.repository';
 
 describe('seedModelContextSnapshot', () => {
-  afterEach(() => jest.restoreAllMocks());
+  afterEach(() => vi.restoreAllMocks());
 
   it('uses the production effective-context resolver with no advertised tools', async () => {
     const key = 'fixture-model';
@@ -24,7 +24,7 @@ describe('seedModelContextSnapshot', () => {
       allowedToolIds: new Set(),
       candidates: [],
     });
-    const createOrReuse = jest
+    const createOrReuse = vi
       .spyOn(ModelContextSnapshotsRepository.prototype, 'createOrReuse')
       .mockResolvedValue({
         id: 'snapshot-id',
@@ -42,7 +42,7 @@ describe('seedModelContextSnapshot', () => {
   it('snapshots explicitly allowlisted production tool declarations', async () => {
     const key = 'tool-fixture';
     const ownerUserId = 'owner-id';
-    const createOrReuse = jest
+    const createOrReuse = vi
       .spyOn(ModelContextSnapshotsRepository.prototype, 'createOrReuse')
       .mockResolvedValue({
         id: 'snapshot-id',
diff --git a/apps/api/src/runs/model-context-snapshots.integration.spec.ts b/apps/api/src/runs/model-context-snapshots.integration.test.ts
similarity index 100%
rename from apps/api/src/runs/model-context-snapshots.integration.spec.ts
rename to apps/api/src/runs/model-context-snapshots.integration.test.ts
diff --git a/apps/api/src/runs/model-context-snapshots.repository.spec.ts b/apps/api/src/runs/model-context-snapshots.repository.test.ts
similarity index 85%
rename from apps/api/src/runs/model-context-snapshots.repository.spec.ts
rename to apps/api/src/runs/model-context-snapshots.repository.test.ts
index 366da554..0123f276 100644
--- a/apps/api/src/runs/model-context-snapshots.repository.spec.ts
+++ b/apps/api/src/runs/model-context-snapshots.repository.test.ts
@@ -29,16 +29,16 @@ const snapshot = {
 };
 
 function makeDb(options?: { inserted?: unknown[]; selected?: unknown[] }) {
-  const returning = jest.fn().mockResolvedValue(options?.inserted ?? []);
-  const onConflictDoNothing = jest.fn((_options: unknown) => ({ returning }));
-  const values = jest.fn((_value: unknown) => ({ onConflictDoNothing }));
-  const insert = jest.fn(() => ({ values }));
+  const returning = vi.fn().mockResolvedValue(options?.inserted ?? []);
+  const onConflictDoNothing = vi.fn((_options: unknown) => ({ returning }));
+  const values = vi.fn((_value: unknown) => ({ onConflictDoNothing }));
+  const insert = vi.fn(() => ({ values }));
 
-  const limit = jest.fn().mockResolvedValue(options?.selected ?? []);
-  const where = jest.fn(() => ({ limit }));
-  const innerJoin = jest.fn(() => ({ where }));
-  const from = jest.fn(() => ({ where, innerJoin }));
-  const select = jest.fn(() => ({ from }));
+  const limit = vi.fn().mockResolvedValue(options?.selected ?? []);
+  const where = vi.fn(() => ({ limit }));
+  const innerJoin = vi.fn(() => ({ where }));
+  const from = vi.fn(() => ({ where, innerJoin }));
+  const select = vi.fn(() => ({ from }));
 
   return {
     db: { insert, select } as unknown as Db,
diff --git a/apps/api/src/runs/run-execution.service.spec.ts b/apps/api/src/runs/run-execution.service.test.ts
similarity index 100%
rename from apps/api/src/runs/run-execution.service.spec.ts
rename to apps/api/src/runs/run-execution.service.test.ts
diff --git a/apps/api/src/runs/run-stream-bridge.spec.ts b/apps/api/src/runs/run-stream-bridge.test.ts
similarity index 100%
rename from apps/api/src/runs/run-stream-bridge.spec.ts
rename to apps/api/src/runs/run-stream-bridge.test.ts
diff --git a/apps/api/src/runs/runs-worker.service.spec.ts b/apps/api/src/runs/runs-worker.service.test.ts
similarity index 85%
rename from apps/api/src/runs/runs-worker.service.spec.ts
rename to apps/api/src/runs/runs-worker.service.test.ts
index 00fde249..1c3c39eb 100644
--- a/apps/api/src/runs/runs-worker.service.spec.ts
+++ b/apps/api/src/runs/runs-worker.service.test.ts
@@ -24,30 +24,31 @@ import { RunsRepository } from './runs-repository';
 import { RunsWorkerService } from './runs-worker.service';
 import { RUNS_QUEUE, type RunJob } from './run-queues';
 
+import type { Mock, Mocked } from 'vitest';
 /** Minimal fake Drizzle tx: every update/insert resolves `returning()` to `returningRow`. */
 function makeFakeTx(returningRow: Record<string, unknown> | undefined) {
-  const setSpy = jest.fn();
-  const whereSpy = jest.fn();
-  const valuesSpy = jest.fn();
-  const returning = jest
+  const setSpy = vi.fn();
+  const whereSpy = vi.fn();
+  const valuesSpy = vi.fn();
+  const returning = vi
     .fn()
     .mockResolvedValue(returningRow ? [returningRow] : []);
 
-  const update = jest.fn(() => ({
-    set: jest.fn((arg: unknown) => {
+  const update = vi.fn(() => ({
+    set: vi.fn((arg: unknown) => {
       setSpy(arg);
       return {
-        where: jest.fn((arg2: unknown) => {
+        where: vi.fn((arg2: unknown) => {
           whereSpy(arg2);
           return { returning };
         }),
       };
     }),
   }));
-  const insert = jest.fn(() => ({
-    values: jest.fn((arg: unknown) => {
+  const insert = vi.fn(() => ({
+    values: vi.fn((arg: unknown) => {
       valuesSpy(arg);
-      return { returning: jest.fn().mockResolvedValue([{}]) };
+      return { returning: vi.fn().mockResolvedValue([{}]) };
     }),
   }));
 
@@ -68,18 +69,18 @@ function makeService(
   } = {},
 ) {
   // Named consts (not accessed later as `queue.consume`/`tenantDb.runAs`) so
-  // assertions reference a plain jest.fn variable, not an interface method —
+  // assertions reference a plain vi.fn variable, not an interface method —
   // oxlint's typescript-aware unbound-method rule flags the latter.
-  const ensureQueueSpy = jest.fn().mockResolvedValue(undefined);
-  const consumeSpy = jest.fn().mockResolvedValue('consumer-id');
+  const ensureQueueSpy = vi.fn().mockResolvedValue(undefined);
+  const consumeSpy = vi.fn().mockResolvedValue('consumer-id');
   const queue = {
     ensureQueue: ensureQueueSpy,
     consume: consumeSpy,
-    enqueue: jest.fn(),
-    schedule: jest.fn(),
-    unschedule: jest.fn(),
-    cancel: jest.fn(),
-  } as unknown as jest.Mocked<Queue>;
+    enqueue: vi.fn(),
+    schedule: vi.fn(),
+    unschedule: vi.fn(),
+    cancel: vi.fn(),
+  } as unknown as Mocked<Queue>;
 
   const instanceConfig = {
     config: { runs: { heartbeatSeconds: 15, timeoutSeconds: 300 } },
@@ -88,17 +89,15 @@ function makeService(
   // 'runs' is active in this fake profile (concurrency 1) — the test's
   // bootstrap-time assertions (dead-letter consumer registration) exercise
   // the not-gated-off path; profile-gating itself is covered in
-  // worker-profile.service.spec.ts (design D2/D3, task 7.5).
+  // worker-profile.service.test.ts (design D2/D3, task 7.5).
   const workerProfile = {
-    concurrencyFor: jest.fn().mockReturnValue(1),
+    concurrencyFor: vi.fn().mockReturnValue(1),
   } as unknown as WorkerProfileService;
 
-  const runAsSpy = jest.fn((_userId: string, cb: (tx: Db) => unknown) =>
-    cb(tx),
-  );
+  const runAsSpy = vi.fn((_userId: string, cb: (tx: Db) => unknown) => cb(tx));
   const tenantDb = {
     runAs: runAsSpy,
-  } as unknown as jest.Mocked<TenantDbService>;
+  } as unknown as Mocked<TenantDbService>;
 
   const service = new RunsWorkerService(
     queue,
@@ -118,7 +117,7 @@ type ConsumeCall = [{ name: string }, (job: RunJob) => Promise<void>];
 /** Capture the handler RunsWorkerService registered on the main runs queue. */
 async function captureRunsHandler(
   service: RunsWorkerService,
-  consumeSpy: jest.Mock,
+  consumeSpy: Mock,
 ): Promise<(job: RunJob) => Promise<void>> {
   await service.onApplicationBootstrap();
   const calls = consumeSpy.mock.calls as ConsumeCall[];
@@ -134,7 +133,7 @@ async function captureRunsHandler(
 /** Capture the handler RunsWorkerService registered on the runs.dead queue. */
 async function captureDeadLetterHandler(
   service: RunsWorkerService,
-  consumeSpy: jest.Mock,
+  consumeSpy: Mock,
 ): Promise<(job: RunJob) => Promise<void>> {
   await service.onApplicationBootstrap();
   const deadQueueName = deadLetterQueue(RUNS_QUEUE).name;
@@ -217,7 +216,7 @@ describe('RunsWorkerService — durable run-level failures', () => {
   };
 
   afterEach(() => {
-    jest.restoreAllMocks();
+    vi.restoreAllMocks();
   });
 
   it('settles a durably recorded model-context incompatibility without asking the queue to retry', async () => {
@@ -236,25 +235,24 @@ describe('RunsWorkerService — durable run-level failures', () => {
       workerId: null,
       createdAt: new Date(),
     } as const;
-    jest
-      .spyOn(RunsRepository.prototype, 'findById')
+    vi.spyOn(RunsRepository.prototype, 'findById')
       .mockResolvedValueOnce(run)
       .mockResolvedValueOnce(run)
       .mockResolvedValueOnce({ ...run, status: 'failed' });
-    const createClient = jest.fn().mockReturnValue({});
-    const executeRun = jest
+    const createClient = vi.fn().mockReturnValue({});
+    const executeRun = vi
       .fn()
       .mockRejectedValue(
         new ModelContextExecutionError('snapshot tool declaration drifted'),
       );
     const abort = new AbortController();
-    const unregister = jest.fn();
+    const unregister = vi.fn();
     const { tx } = makeFakeTx(undefined);
     const { service, consumeSpy } = makeService(tx, {
       models: { createClient } as unknown as ModelsService,
       runExecution: { executeRun } as unknown as RunExecutionService,
       aborts: {
-        register: jest.fn().mockReturnValue(abort),
+        register: vi.fn().mockReturnValue(abort),
         unregister,
       } as unknown as RunAbortRegistry,
     });
@@ -283,7 +281,7 @@ describe('RunsWorkerService — durable run-level failures', () => {
       workerId: null,
       createdAt: new Date(),
     };
-    jest.spyOn(RunsRepository.prototype, 'findById').mockResolvedValue(run);
+    vi.spyOn(RunsRepository.prototype, 'findById').mockResolvedValue(run);
     const contextError = new ModelContextExecutionError(
       'snapshot tool declaration drifted',
     );
@@ -291,14 +289,14 @@ describe('RunsWorkerService — durable run-level failures', () => {
     const { tx } = makeFakeTx(undefined);
     const { service, consumeSpy } = makeService(tx, {
       models: {
-        createClient: jest.fn().mockReturnValue({}),
+        createClient: vi.fn().mockReturnValue({}),
       } as unknown as ModelsService,
       runExecution: {
-        executeRun: jest.fn().mockRejectedValue(contextError),
+        executeRun: vi.fn().mockRejectedValue(contextError),
       } as unknown as RunExecutionService,
       aborts: {
-        register: jest.fn().mockReturnValue(abort),
-        unregister: jest.fn(),
+        register: vi.fn().mockReturnValue(abort),
+        unregister: vi.fn(),
       } as unknown as RunAbortRegistry,
     });
     const handler = await captureRunsHandler(service, consumeSpy);
diff --git a/apps/api/src/runs/runs.controller.spec.ts b/apps/api/src/runs/runs.controller.test.ts
similarity index 84%
rename from apps/api/src/runs/runs.controller.spec.ts
rename to apps/api/src/runs/runs.controller.test.ts
index dfc26555..e2124267 100644
--- a/apps/api/src/runs/runs.controller.spec.ts
+++ b/apps/api/src/runs/runs.controller.test.ts
@@ -45,12 +45,12 @@ describe('RunsController context receipt', () => {
     createdAt: new Date('2026-07-18T09:59:59.000Z'),
   };
 
-  afterEach(() => jest.restoreAllMocks());
+  afterEach(() => vi.restoreAllMocks());
 
   function controller() {
     const tx = {};
     const tenantDb = {
-      runAs: jest.fn(
+      runAs: vi.fn(
         (_userId: string, callback: (scoped: unknown) => Promise<unknown>) =>
           callback(tx),
       ),
@@ -60,10 +60,11 @@ describe('RunsController context receipt', () => {
   }
 
   it('returns only the owner-visible immutable effective-context fields', async () => {
-    jest.spyOn(RunsRepository.prototype, 'findById').mockResolvedValue(run);
-    jest
-      .spyOn(ModelContextSnapshotsRepository.prototype, 'findByOwnedRun')
-      .mockResolvedValue(snapshot);
+    vi.spyOn(RunsRepository.prototype, 'findById').mockResolvedValue(run);
+    vi.spyOn(
+      ModelContextSnapshotsRepository.prototype,
+      'findByOwnedRun',
+    ).mockResolvedValue(snapshot);
 
     const receipt = await controller().getContextReceipt('owner', run.id);
 
@@ -81,9 +82,7 @@ describe('RunsController context receipt', () => {
   });
 
   it('returns not-found when the run is missing or belongs to another owner', async () => {
-    jest
-      .spyOn(RunsRepository.prototype, 'findById')
-      .mockResolvedValue(undefined);
+    vi.spyOn(RunsRepository.prototype, 'findById').mockResolvedValue(undefined);
 
     await expect(
       controller().getContextReceipt('other-user', run.id),
@@ -91,10 +90,11 @@ describe('RunsController context receipt', () => {
   });
 
   it('returns not-found for a legacy run without an owned snapshot', async () => {
-    jest.spyOn(RunsRepository.prototype, 'findById').mockResolvedValue(run);
-    jest
-      .spyOn(ModelContextSnapshotsRepository.prototype, 'findByOwnedRun')
-      .mockResolvedValue(undefined);
+    vi.spyOn(RunsRepository.prototype, 'findById').mockResolvedValue(run);
+    vi.spyOn(
+      ModelContextSnapshotsRepository.prototype,
+      'findByOwnedRun',
+    ).mockResolvedValue(undefined);
 
     await expect(
       controller().getContextReceipt('owner', run.id),
diff --git a/apps/api/src/runs/worker-concurrency.integration.spec.ts b/apps/api/src/runs/worker-concurrency.integration.test.ts
similarity index 98%
rename from apps/api/src/runs/worker-concurrency.integration.spec.ts
rename to apps/api/src/runs/worker-concurrency.integration.test.ts
index 4d27109c..91c38ca1 100644
--- a/apps/api/src/runs/worker-concurrency.integration.spec.ts
+++ b/apps/api/src/runs/worker-concurrency.integration.test.ts
@@ -8,7 +8,7 @@
  * model client keyed per-run by modelId.
  *
  * TEST_DATABASE_URL-gated — skipped otherwise, like every other
- * *.integration.spec.ts in this package. worker-harness.ts self-provisions
+ * *.integration.test.ts in this package. worker-harness.ts self-provisions
  * POSTGRES_URL from TEST_DATABASE_URL for WorkerModule's own DB/queue
  * connections, so no ambient POSTGRES_URL is required in the caller's shell.
  */
@@ -25,7 +25,7 @@ import {
 import { InstanceConfigService } from '../instance-config/instance-config.service';
 import { type ModelsService } from '../models/models.service';
 import { searchChatDocuments } from '../db/schema/search';
-import { waitFor } from '../../test/support';
+import { waitFor } from '../testing/support';
 import {
   bootWorkerHarness,
   createUser,
@@ -38,7 +38,7 @@ import {
 const TEST_DB_URL = process.env['TEST_DATABASE_URL'];
 const describeIfDb = TEST_DB_URL ? describe : describe.skip;
 
-jest.setTimeout(60_000);
+vi.setConfig({ testTimeout: 60_000 });
 
 describeIfDb(
   'Durable run workers — concurrency/settlement/single-flight/reindex (design D1/D3/D6)',
@@ -317,7 +317,7 @@ describeIfDb(
           strict: false,
         });
         const bridge = {
-          createUiMessageStreamResponse: jest.fn(),
+          createUiMessageStreamResponse: vi.fn(),
         } as unknown as RunStreamBridgeService;
         const instanceConfig = harness.moduleRef.get(InstanceConfigService, {
           strict: false,
@@ -415,7 +415,7 @@ describeIfDb(
       );
 
       // search_chat_documents is FORCE RLS — read owner-scoped, like
-      // search-index.integration.spec.ts's own docCount helper.
+      // search-index.integration.test.ts's own docCount helper.
       const docCount = (chatId: string) =>
         harness.tenantDb
           .runAs(userId, (tx) =>
diff --git a/apps/api/src/runs/worker-harness.ts b/apps/api/src/runs/worker-harness.ts
index 486b6df5..2d39a298 100644
--- a/apps/api/src/runs/worker-harness.ts
+++ b/apps/api/src/runs/worker-harness.ts
@@ -12,12 +12,12 @@
  *   RunDispatchService) + `SearchModule` (inline reindex, 7.6) + `AuthModule`
  *   + the `DB_DEV` Drizzle connection — exactly what 7.0 asks for, so this
  *   harness boots WorkerModule itself rather than hand-composing a parallel
- *   module graph (worker.module.spec.ts already proves this composition boots
+ *   module graph (worker.module.integration.test.ts already proves this composition boots
  *   headless and drains on shutdown; this harness reuses that proof).
- * - `waitFor`/`describeIfDb` conventions from `queue.integration.spec.ts` /
- *   `test/support.ts` (callers import waitFor themselves).
+ * - `waitFor`/`describeIfDb` conventions from `queue.integration.test.ts` /
+ *   `src/testing/support.ts` (callers import waitFor themselves).
  * - The direct-instantiation-of-repos pattern from
- *   `active-runs.integration.spec.ts` for seeding chat/message/run rows.
+ *   `active-runs.integration.test.ts` for seeding chat/message/run rows.
  *
  * TEST_DATABASE_URL/POSTGRES_URL-gated by the CALLER (this module has no
  * `describe` of its own — it is imported by the actual spec files).
@@ -200,14 +200,14 @@ export type WorkerHarness = {
 
 /**
  * Boots WorkerModule as a headless Nest graph (moduleRef.init(), no HTTP —
- * same shape as `worker.module.spec.ts`) against a REAL Postgres, with:
+ * same shape as `worker.module.integration.test.ts`) against a REAL Postgres, with:
  * - ModelsService replaced by a ScriptedModelsService the test scripts per run
  * - InstanceConfigService replaced by a plain config object so the test can
  *   set `runs.timeoutSeconds`/`heartbeatSeconds` and the `all` profile's
  *   `runs` concurrency without an on-disk llame.config.json
  *
  * A unique PGBOSS_SCHEMA per boot avoids cross-suite job-stealing on a shared
- * Postgres (same rationale as worker.module.spec.ts / queue.module.ts).
+ * Postgres (same rationale as worker.module.integration.test.ts / queue.module.ts).
  */
 export async function bootWorkerHarness(overrides?: {
   runsConcurrency?: number;
@@ -215,14 +215,20 @@ export async function bootWorkerHarness(overrides?: {
   heartbeatSeconds?: number;
 }): Promise<WorkerHarness> {
   // WorkerModule's DrizzlePostgresModule/PgBossModule read POSTGRES_URL
-  // directly (getOrThrow), not TEST_DATABASE_URL — mirror worker.module.spec.ts's
+  // directly (getOrThrow), not TEST_DATABASE_URL — mirror worker.module.integration.test.ts's
   // own setup rather than relying on POSTGRES_URL being ambient in the
   // caller's shell (it must not be a hard requirement for callers gated only
-  // on TEST_DATABASE_URL, e.g. scripts/rls-test.sh's `.integration` run).
-  if (!process.env.POSTGRES_URL && process.env.TEST_DATABASE_URL) {
+  // on TEST_DATABASE_URL, e.g. a bare test:integration run).
+  //
+  // UNCONDITIONAL, like worker.module.integration.test.ts: ConfigModule.forRoot has
+  // already leaked a developer's .env.local POSTGRES_URL (the DEV database)
+  // into process.env by the time this runs, so a `!process.env.POSTGRES_URL`
+  // guard would silently point the whole harness at the dev database instead
+  // of the provisioned test one.
+  if (process.env.TEST_DATABASE_URL) {
     process.env.POSTGRES_URL = process.env.TEST_DATABASE_URL;
   }
-  process.env.PGBOSS_SCHEMA = `wh_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+  process.env.PGBOSS_SCHEMA = `${process.env.LLAME_TEST_SCHEMA_PREFIX ?? 'llame_t'}_wh_${Math.random().toString(36).slice(2, 8)}`;
 
   const models = new ScriptedModelsService();
   const config: LlameConfig = {
@@ -278,7 +284,7 @@ export async function bootWorkerHarness(overrides?: {
 
 // ---- Fixtures --------------------------------------------------------------
 
-/** Insert a bare `users` row (FK target for chats/messages/runs), like active-runs.integration.spec.ts. */
+/** Insert a bare `users` row (FK target for chats/messages/runs), like active-runs.integration.test.ts. */
 export async function createUser(db: Db, tag: string): Promise<string> {
   const id = crypto.randomUUID();
   await db.execute(
diff --git a/apps/api/src/runs/worker-liveness.integration.spec.ts b/apps/api/src/runs/worker-liveness.integration.test.ts
similarity index 96%
rename from apps/api/src/runs/worker-liveness.integration.spec.ts
rename to apps/api/src/runs/worker-liveness.integration.test.ts
index 1f641b49..3f70ba14 100644
--- a/apps/api/src/runs/worker-liveness.integration.spec.ts
+++ b/apps/api/src/runs/worker-liveness.integration.test.ts
@@ -34,7 +34,7 @@
 
 import { RunAbortRegistry } from './run-abort-registry';
 import { RunEventsRepository, RunsRepository } from './runs-repository';
-import { waitFor } from '../../test/support';
+import { waitFor } from '../testing/support';
 import {
   bootWorkerHarness,
   createUser,
@@ -45,7 +45,7 @@ import {
 const TEST_DB_URL = process.env['TEST_DATABASE_URL'];
 const describeIfDb = TEST_DB_URL ? describe : describe.skip;
 
-jest.setTimeout(60_000);
+vi.setConfig({ testTimeout: 60_000 });
 
 describeIfDb(
   'Durable run workers — in-process timeout budget (design D7 mechanism 1)',
@@ -214,17 +214,17 @@ describeIfDb(
 //
 //   - the "single terminal outcome" half of the paused-double-run risk is
 //     markFinished's first-writer-wins guard, proven at the repository unit
-//     level (chats-repository.spec.ts's markStarted/markFinished specs —
+//     level (chats-repository.test.ts's markStarted/markFinished specs —
 //     "refuses terminal or cancel-requested runs" / "scopes by runId AND userId and stamps
 //     finishedAt + status") and exercised again by RunsWorkerService's own
-//     dead-letter unit test (runs-worker.service.spec.ts — "is a no-op when
+//     dead-letter unit test (runs-worker.service.test.ts — "is a no-op when
 //     the run already reached a terminal state (first-writer-wins)"). A real
 //     paused-worker overlap cannot produce two terminal writes no matter how
 //     it is triggered — the guard is unconditional on the WHERE clause, not
 //     on how the race came about.
 //   - the native heartbeat primitive itself (auto-refresh keeping a
 //     long-pending handler alive past heartbeatSeconds, and the >= 10s floor)
-//     is verified end-to-end in queue.integration.spec.ts's dedicated D7 test
+//     is verified end-to-end in queue.integration.test.ts's dedicated D7 test
 //     (#5.1, "keeps a long-running handler alive past heartbeatSeconds via
 //     native auto-refresh") — that IS the primitive worker-death detection
 //     depends on; what would remain untested here is purely the
@@ -233,5 +233,5 @@ describeIfDb(
 //
 // A manual/soak test (kill -9 a dedicated `worker.ts` process mid-run,
 // confirm the job redelivers and a healthy worker completes it) is the right
-// way to validate this further — not a >=20s in-process jest timer race that
+// way to validate this further — not a >=20s in-process test-runner timer race that
 // would be the first flaky test in this suite.
diff --git a/apps/api/src/search/chat/conversation-chunker.spec.ts b/apps/api/src/search/chat/conversation-chunker.test.ts
similarity index 100%
rename from apps/api/src/search/chat/conversation-chunker.spec.ts
rename to apps/api/src/search/chat/conversation-chunker.test.ts
diff --git a/apps/api/src/search/chat/eval/BASELINE.md b/apps/api/src/search/chat/eval/BASELINE.md
index 3a194e98..006b3214 100644
--- a/apps/api/src/search/chat/eval/BASELINE.md
+++ b/apps/api/src/search/chat/eval/BASELINE.md
@@ -1,6 +1,6 @@
 # Chat-search relevance baseline (phase 1, lexical)
 
-Generated by `search-eval.integration.spec.ts` (`RUN_SEARCH_EVAL=1`) over the
+Generated by `search-eval.integration.test.ts` (`RUN_SEARCH_EVAL=1`) over the
 `dataset.ts` fixtures — FTS (`simple`) + `word_similarity` trigram + title leg,
 RRF-fused. This is the lexical baseline that phase 3 (embeddings, #197) is
 measured against. **Cutoff K = 10.**
diff --git a/apps/api/src/search/chat/eval/search-eval.integration.spec.ts b/apps/api/src/search/chat/eval/search-eval.integration.test.ts
similarity index 98%
rename from apps/api/src/search/chat/eval/search-eval.integration.spec.ts
rename to apps/api/src/search/chat/eval/search-eval.integration.test.ts
index 89cf1316..562950f5 100644
--- a/apps/api/src/search/chat/eval/search-eval.integration.spec.ts
+++ b/apps/api/src/search/chat/eval/search-eval.integration.test.ts
@@ -7,7 +7,7 @@
  * - RECORDS overall + per-category Recall@10 / MRR / zero-result-rate (the
  *   phase-3 measuring stick). Set RUN_SEARCH_EVAL=1 to print the full summary.
  *
- * TEST_DATABASE_URL-gated; run by rls-test.sh (floors enforced in CI).
+ * TEST_DATABASE_URL-gated; run by test:integration (floors enforced in CI).
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/search/core/core.spec.ts b/apps/api/src/search/core/core.test.ts
similarity index 100%
rename from apps/api/src/search/core/core.spec.ts
rename to apps/api/src/search/core/core.test.ts
diff --git a/apps/api/src/search/search-index.integration.spec.ts b/apps/api/src/search/search-index.integration.test.ts
similarity index 99%
rename from apps/api/src/search/search-index.integration.spec.ts
rename to apps/api/src/search/search-index.integration.test.ts
index 0695c838..14598870 100644
--- a/apps/api/src/search/search-index.integration.spec.ts
+++ b/apps/api/src/search/search-index.integration.test.ts
@@ -9,7 +9,7 @@
  * - llame_search_stale_chats flags un-indexed / version-stale chats, ignores
  *   fresh ones, and returns ONLY identifiers + timestamps (never content).
  *
- * TEST_DATABASE_URL-gated; run by rls-test.sh.
+ * TEST_DATABASE_URL-gated; run by test:integration.
  */
 
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
diff --git a/apps/api/src/search/search-reindex.worker.spec.ts b/apps/api/src/search/search-reindex.worker.test.ts
similarity index 96%
rename from apps/api/src/search/search-reindex.worker.spec.ts
rename to apps/api/src/search/search-reindex.worker.test.ts
index c8d17ea3..568edcbf 100644
--- a/apps/api/src/search/search-reindex.worker.spec.ts
+++ b/apps/api/src/search/search-reindex.worker.test.ts
@@ -51,8 +51,8 @@ function buildWorker(
     workerProfile,
   );
   const logger = (worker as unknown as { logger: Logger }).logger;
-  const errorSpy = jest.spyOn(logger, 'error').mockImplementation(() => {});
-  const warnSpy = jest.spyOn(logger, 'warn').mockImplementation(() => {});
+  const errorSpy = vi.spyOn(logger, 'error').mockImplementation(() => {});
+  const warnSpy = vi.spyOn(logger, 'warn').mockImplementation(() => {});
   const check = (
     worker as unknown as Provisioned
   ).assertDiscoveryProvisioned.bind(worker);
diff --git a/apps/api/test/support.ts b/apps/api/src/testing/support.ts
similarity index 97%
rename from apps/api/test/support.ts
rename to apps/api/src/testing/support.ts
index c27efa62..4c391e02 100644
--- a/apps/api/test/support.ts
+++ b/apps/api/src/testing/support.ts
@@ -8,14 +8,14 @@
 import type request from 'supertest';
 import type { LanguageModelUsage, ModelMessage, streamText } from 'ai';
 
-import { TITLE_SYSTEM_PROMPT } from './../src/titles/title';
+import { TITLE_SYSTEM_PROMPT } from '../titles/title';
 import {
   MissingModelCredentialError,
   type ModelClient,
   type ModelStreamInput,
-} from './../src/models/model-client';
-import type { TokenPrice } from './../src/models/model-catalog';
-import { ModelNotAvailableError } from './../src/models/models.service';
+} from '../models/model-client';
+import type { TokenPrice } from '../models/model-catalog';
+import { ModelNotAvailableError } from '../models/models.service';
 
 /** Extracts the llame session cookie pair from a response, or '' when absent. */
 export const cookieOf = (res: request.Response): string => {
diff --git a/apps/api/src/titles/title.spec.ts b/apps/api/src/titles/title.test.ts
similarity index 100%
rename from apps/api/src/titles/title.spec.ts
rename to apps/api/src/titles/title.test.ts
diff --git a/apps/api/src/tools/registry.spec.ts b/apps/api/src/tools/registry.test.ts
similarity index 100%
rename from apps/api/src/tools/registry.spec.ts
rename to apps/api/src/tools/registry.test.ts
diff --git a/apps/api/src/tools/registry.ts b/apps/api/src/tools/registry.ts
index e4bb5319..722bd976 100644
--- a/apps/api/src/tools/registry.ts
+++ b/apps/api/src/tools/registry.ts
@@ -11,7 +11,7 @@ export const TOOLS: readonly Tool[] = [searchConversationsTool];
  * in the `Tool` type, but this guard also catches a value that bypassed the
  * type (a future dynamic source, e.g. an MCP-backed adapter per D2) and is
  * exercised directly by tests via an `as Tool` cast. Exported (not just used
- * to build `TOOL_REGISTRY` below) so `registry.spec.ts` tests this exact
+ * to build `TOOL_REGISTRY` below) so `registry.test.ts` tests this exact
  * function rather than a hand-copy that could silently drift from it.
  */
 export function buildRegistry(
diff --git a/apps/api/src/tools/runner.spec.ts b/apps/api/src/tools/runner.test.ts
similarity index 97%
rename from apps/api/src/tools/runner.spec.ts
rename to apps/api/src/tools/runner.test.ts
index 6b244b93..c07bfc2e 100644
--- a/apps/api/src/tools/runner.spec.ts
+++ b/apps/api/src/tools/runner.test.ts
@@ -20,7 +20,7 @@ const echoTool: Tool<{ value: string }> = {
 
 describe('runTool', () => {
   it('fails closed with no reads when identity is absent (D4)', async () => {
-    const spy = jest.fn();
+    const spy = vi.fn();
     const noIdentityTool: Tool<{ value: string }> = {
       ...echoTool,
       execute: (ctx, args) => {
@@ -48,13 +48,13 @@ describe('runTool', () => {
   });
 
   it('fires onValidated once input validation passes, before executing', async () => {
-    const onValidated = jest.fn();
+    const onValidated = vi.fn();
     await runTool(echoTool, { value: 'hi' }, fakeContext(), 15, onValidated);
     expect(onValidated).toHaveBeenCalledTimes(1);
   });
 
   it('never fires onValidated when input validation fails', async () => {
-    const onValidated = jest.fn();
+    const onValidated = vi.fn();
     await runTool(echoTool, { value: 123 }, fakeContext(), 15, onValidated);
     expect(onValidated).not.toHaveBeenCalled();
   });
diff --git a/apps/api/src/tools/search-conversations.spec.ts b/apps/api/src/tools/search-conversations.test.ts
similarity index 98%
rename from apps/api/src/tools/search-conversations.spec.ts
rename to apps/api/src/tools/search-conversations.test.ts
index c979e2de..f3119f0c 100644
--- a/apps/api/src/tools/search-conversations.spec.ts
+++ b/apps/api/src/tools/search-conversations.test.ts
@@ -9,7 +9,7 @@ import { type ToolContext } from './types';
  * tool-boundary behavior): the scope (userId) comes from context; the
  * model's args are only query/limit; rows map to the tool's result shape.
  * Cross-tenant isolation itself is proven on a live Postgres by
- * chats-search.integration.spec.ts, which this tool now shares an
+ * chats-search.integration.test.ts, which this tool now shares an
  * implementation with (ChatsRepository.searchByOwner) — see D7.
  */
 
diff --git a/apps/api/src/users/users.service.spec.ts b/apps/api/src/users/users.service.test.ts
similarity index 100%
rename from apps/api/src/users/users.service.spec.ts
rename to apps/api/src/users/users.service.test.ts
diff --git a/apps/api/test/worker-mode.e2e-spec.ts b/apps/api/src/worker-mode.integration.test.ts
similarity index 97%
rename from apps/api/test/worker-mode.e2e-spec.ts
rename to apps/api/src/worker-mode.integration.test.ts
index 829d9635..e7bf2c9e 100644
--- a/apps/api/test/worker-mode.e2e-spec.ts
+++ b/apps/api/src/worker-mode.integration.test.ts
@@ -18,21 +18,18 @@ import { INestApplication } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import request from 'supertest';
 import { type ModelMessage, type streamText } from 'ai';
-import { AppModule } from './../src/app.module';
-import { configureApp } from './../src/app.setup';
-import { TenantDbService } from './../src/db/tenant-db.service';
-import { MessagesRepository } from './../src/chats/chats-repository';
-import {
-  RunEventsRepository,
-  RunsRepository,
-} from './../src/runs/runs-repository';
-import { ModelsService } from './../src/models/models.service';
-import { TITLE_SYSTEM_PROMPT } from './../src/titles/title';
+import { AppModule } from './app.module';
+import { configureApp } from './app.setup';
+import { TenantDbService } from './db/tenant-db.service';
+import { MessagesRepository } from './chats/chats-repository';
+import { RunEventsRepository, RunsRepository } from './runs/runs-repository';
+import { ModelsService } from './models/models.service';
+import { TITLE_SYSTEM_PROMPT } from './titles/title';
 
 const hasDb = !!process.env.POSTGRES_URL;
 const d = hasDb ? describe : describe.skip;
 
-jest.setTimeout(30_000);
+vi.setConfig({ testTimeout: 30_000 });
 
 const cookieOf = (res: request.Response): string => {
   const set = (res.headers['set-cookie'] as unknown as string[]) ?? [];
diff --git a/apps/api/src/worker.module.spec.ts b/apps/api/src/worker.module.integration.test.ts
similarity index 91%
rename from apps/api/src/worker.module.spec.ts
rename to apps/api/src/worker.module.integration.test.ts
index d436efe1..1207dcb6 100644
--- a/apps/api/src/worker.module.spec.ts
+++ b/apps/api/src/worker.module.integration.test.ts
@@ -1,7 +1,7 @@
 /**
  * Worker-entrypoint smoke test (durable-run-workers D4, task 7.4) — requires
  * a real PostgreSQL connection (same TEST_DATABASE_URL gate as
- * queue.integration.spec.ts; skipped otherwise so offline `pnpm test` stays
+ * queue.integration.test.ts; skipped otherwise so offline `pnpm test` stays
  * usable).
  *
  * Proves the composition worker.ts actually boots: WorkerModule's DI graph
@@ -19,7 +19,7 @@
  * whatever already connected (pg-boss's pool, the Drizzle DB_DEV connection)
  * with no `moduleRef` to close — Nest gives back no reference to a container
  * that failed to build, so there is nothing to call `.close()` on, and the
- * open sockets hang the Jest process. worker-profile.service.spec.ts (task
+ * open sockets hang the Jest process. worker-profile.service.test.ts (task
  * 7.5) already proves that exact throw as a plain unit test, with no queue or
  * DB in the graph at all — cleanly, with nothing left to leak.
  *
@@ -45,7 +45,7 @@ type DrizzleWithClient = PostgresJsDatabase & { $client: Sql };
  * alone leaves an open socket that keeps the Jest worker process alive.
  * Ending it explicitly via Drizzle's `$client` escape hatch is the same
  * teardown discipline the other DB-integration specs use (see
- * search-index.integration.spec.ts's `sqlClient.end()`).
+ * search-index.integration.test.ts's `sqlClient.end()`).
  */
 function getDbClient(moduleRef: INestApplicationContext): DrizzleWithClient {
   return moduleRef.get<DrizzleWithClient>('DB_DEV', { strict: false });
@@ -54,7 +54,7 @@ function getDbClient(moduleRef: INestApplicationContext): DrizzleWithClient {
 const TEST_DB_URL = process.env['TEST_DATABASE_URL'];
 const describeIfDb = TEST_DB_URL ? describe : describe.skip;
 
-jest.setTimeout(60_000);
+vi.setConfig({ testTimeout: 60_000 });
 
 describeIfDb(
   'Worker entrypoint — headless boot + worker-profile gating (design D2-D4)',
@@ -72,7 +72,7 @@ describeIfDb(
         ENV_KEYS.map((k) => [k, process.env[k]]),
       );
       process.env.POSTGRES_URL = TEST_DB_URL;
-      process.env.PGBOSS_SCHEMA = `worker_smoke_${Date.now()}`;
+      process.env.PGBOSS_SCHEMA = `${process.env.LLAME_TEST_SCHEMA_PREFIX ?? 'llame_t'}_smoke_${Date.now().toString(36)}`;
       // No llame.config.json at this cwd -> built-in defaults, including the
       // built-in `all`/`web` worker profiles this test exercises.
       delete process.env.LLAME_CONFIG_PATH;
@@ -87,7 +87,7 @@ describeIfDb(
 
     it('boots headless (no HTTP) and registers all three groups under the default `all` profile', async () => {
       delete process.env.LLAME_WORKER_PROFILE;
-      const consumeSpy = jest.spyOn(PgBossQueueService.prototype, 'consume');
+      const consumeSpy = vi.spyOn(PgBossQueueService.prototype, 'consume');
 
       const moduleRef = await Test.createTestingModule({
         imports: [WorkerModule],
@@ -121,7 +121,7 @@ describeIfDb(
 
     it('registers NOTHING under the empty `web` profile', async () => {
       process.env.LLAME_WORKER_PROFILE = 'web';
-      const consumeSpy = jest.spyOn(PgBossQueueService.prototype, 'consume');
+      const consumeSpy = vi.spyOn(PgBossQueueService.prototype, 'consume');
 
       const moduleRef = await Test.createTestingModule({
         imports: [WorkerModule],
diff --git a/apps/api/test/jest-e2e.json b/apps/api/test/jest-e2e.json
deleted file mode 100644
index 0c1e19cf..00000000
--- a/apps/api/test/jest-e2e.json
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  "moduleFileExtensions": ["js", "json", "ts"],
-  "rootDir": ".",
-  "testEnvironment": "node",
-  "testRegex": ".e2e-spec.ts$",
-  "transform": {
-    "^.+\\.(t|j)s$": [
-      "ts-jest",
-      {
-        "tsconfig": {
-          "allowJs": true
-        }
-      }
-    ]
-  },
-  "transformIgnorePatterns": [
-    "node_modules/(?!\\.pnpm/(pg-boss@|serialize-error@|non-error@)|(pg-boss|serialize-error|non-error)/)"
-  ],
-  "maxWorkers": 1,
-  "forceExit": true,
-  "setupFilesAfterEnv": ["<rootDir>/jest-e2e.setup.ts"]
-}
diff --git a/apps/api/test/jest-e2e.setup.ts b/apps/api/test/jest-e2e.setup.ts
deleted file mode 100644
index e3619d2b..00000000
--- a/apps/api/test/jest-e2e.setup.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * Per-suite pg-boss schema (see queue.module.ts): e2e suites in one serial
- * jest process share the throwaway Postgres, and a suite's stopping consumers
- * must never steal the next suite's jobs from a shared 'pgboss' schema.
- */
-const suite = (expect.getState().testPath ?? 'unknown')
-  .split('/')
-  .pop()!
-  .replace(/[^a-zA-Z0-9]/g, '_')
-  .toLowerCase()
-  .slice(0, 40);
-process.env.PGBOSS_SCHEMA = `pgboss_${suite}`;
diff --git a/apps/api/tsconfig.build.json b/apps/api/tsconfig.build.json
index 5b9e0dcb..bc3e9429 100644
--- a/apps/api/tsconfig.build.json
+++ b/apps/api/tsconfig.build.json
@@ -2,9 +2,11 @@
   "extends": "./tsconfig.json",
   "exclude": [
     "node_modules",
-    "test",
+    "evals",
     "dist",
-    "**/*spec.ts",
-    "drizzle.config.ts"
+    "**/*.test.ts",
+    "src/testing",
+    "drizzle.config.ts",
+    "vitest.*"
   ]
 }
diff --git a/apps/api/tsconfig.json b/apps/api/tsconfig.json
index 0aa06662..22de9fcc 100644
--- a/apps/api/tsconfig.json
+++ b/apps/api/tsconfig.json
@@ -11,7 +11,7 @@
     "target": "ES2023",
     "sourceMap": true,
     "outDir": "./dist",
-    "types": ["node", "jest"],
+    "types": ["node", "vitest/globals"],
     "incremental": true,
     "skipLibCheck": true,
     "strictNullChecks": true,
diff --git a/apps/api/turbo.json b/apps/api/turbo.json
index 084351b5..75325d9d 100644
--- a/apps/api/turbo.json
+++ b/apps/api/turbo.json
@@ -10,8 +10,14 @@
       // the OpenAPI document, so they stay out of the cache hash.
       "passThroughEnv": ["WEB_ORIGIN", "SESSION_COOKIE_DOMAIN"]
     },
-    "test": {
-      "env": ["POSTGRES_URL", "TEST_DATABASE_URL", "RUN_MODEL_EVALS"]
+    // Never cached: these run against live external state (a real Postgres,
+    // a real model endpoint) that turbo's hash cannot see — a stale cached
+    // PASS would look identical to a real, current result.
+    "test:integration": {
+      "cache": false
+    },
+    "test:evals": {
+      "cache": false
     }
   }
 }
diff --git a/apps/api/vitest.config.mts b/apps/api/vitest.config.mts
new file mode 100644
index 00000000..464f02ca
--- /dev/null
+++ b/apps/api/vitest.config.mts
@@ -0,0 +1,50 @@
+import swc from 'unplugin-swc';
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  // NestJS DI resolves constructor parameters from reflect-metadata's
+  // design:paramtypes. Vitest's default esbuild transform does not emit
+  // decorator metadata, so without this plugin Test.createTestingModule
+  // resolves every provider as undefined — silently. unplugin-swc reads
+  // tsconfig.json (emitDecoratorMetadata: true) and emits it.
+  plugins: [swc.vite({ module: { type: 'es6' } })],
+  test: {
+    globals: true,
+    environment: 'node',
+    // Bounded rather than one-worker-per-core: this suite compiles Nest DI
+    // graphs, which are memory-hungry enough that a 16-core runner (or a
+    // memory-constrained dev machine) thrashes. Replaces the jest era's
+    // --maxWorkers=2.
+    maxWorkers: 4,
+    projects: [
+      {
+        extends: true,
+        test: {
+          name: 'unit',
+          include: ['src/**/*.test.ts'],
+          exclude: ['src/**/*.integration.test.ts'],
+        },
+      },
+      {
+        extends: true,
+        test: {
+          name: 'integration',
+          // evals/ rides this project rather than owning one: qa-evals
+          // self-gates on RUN_MODEL_EVALS (spend), so a plain
+          // test:integration run skips it.
+          include: ['src/**/*.integration.test.ts', 'evals/**/*.test.ts'],
+          // Self-provisions a throwaway worst-case-owner Postgres via
+          // Testcontainers; TEST_DATABASE_URL overrides (no container).
+          globalSetup: ['./vitest.integration.global-setup.mts'],
+          setupFiles: ['./vitest.integration.setup.ts'],
+          // Files sequential in one worker: every suite opens its own pool
+          // against ONE throwaway database; parallel workers contend on it
+          // and a real RLS regression could be misread as a flake.
+          fileParallelism: false,
+          testTimeout: 120_000,
+          hookTimeout: 120_000,
+        },
+      },
+    ],
+  },
+});
diff --git a/apps/api/vitest.integration.global-setup.mts b/apps/api/vitest.integration.global-setup.mts
new file mode 100644
index 00000000..14313490
--- /dev/null
+++ b/apps/api/vitest.integration.global-setup.mts
@@ -0,0 +1,156 @@
+/**
+ * Self-provisioning database for the integration project (and nothing else):
+ * starts a throwaway Postgres via Testcontainers and reproduces the worst-case
+ * self-hosted role topology — a NON-superuser `app` role that OWNS the schema
+ * and runs the migrations, so a green RLS suite proves FORCE ROW LEVEL
+ * SECURITY constrains even the table owner, plus the `app_rls` BYPASSRLS
+ * function owner (docker/postgres/rls-function-owner.sql, which needs
+ * superuser — see apps/api/AGENTS.md "app_rls (BYPASSRLS)").
+ *
+ * TEST_DATABASE_URL overrides everything: point it at an already-provisioned
+ * database (e.g. when docker is unavailable) and no container is started.
+ * Runs in the vitest main process before workers spawn, so the env it sets is
+ * inherited by every test worker.
+ */
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+
+import { PostgreSqlContainer } from '@testcontainers/postgresql';
+import { drizzle } from 'drizzle-orm/postgres-js';
+import { migrate } from 'drizzle-orm/postgres-js/migrator';
+import postgres from 'postgres';
+
+// Pinned by digest, same as compose.yaml's dev database — a floating tag
+// would let an upstream refresh change test behavior with no code change.
+// Refresh both together:
+//   docker pull postgres:17-alpine && docker inspect \
+//     --format '{{index .RepoDigests 0}}' postgres:17-alpine
+const POSTGRES_IMAGE =
+  'postgres:17-alpine@sha256:dc17045ccfd343b49600570ea734b9c4991cf1c3f3302e67df51e3b402dd55c4';
+
+function sqlFile(relativePath: string): string {
+  return readFileSync(path.resolve(import.meta.dirname, relativePath), 'utf8');
+}
+
+/**
+ * Reproduces the worst-case self-hosted role topology on a fresh container
+ * and returns the `app`-role connection string. Every client it opens is
+ * closed on the way out, including when a step throws.
+ */
+async function provision(superuserUri: string): Promise<string> {
+  const asSuperuser = postgres(superuserUri, { max: 1 });
+  try {
+    await asSuperuser.unsafe(
+      `CREATE ROLE app LOGIN PASSWORD 'app' NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE`,
+    );
+    await asSuperuser.unsafe(`CREATE DATABASE llame_test OWNER app`);
+  } finally {
+    await asSuperuser.end();
+  }
+
+  const url = new URL(superuserUri);
+  url.pathname = '/llame_test';
+  const appUrl = `postgres://app:app@${url.host}/llame_test`;
+
+  const superuserOnTestDb = postgres(url.href, { max: 1 });
+  try {
+    await superuserOnTestDb.unsafe(
+      sqlFile('../../docker/postgres/initdb/02-app-rls-role.sql'),
+    );
+    // app must own schema `public` to create tables in it (PG15+ locks this down).
+    await superuserOnTestDb.unsafe(`ALTER SCHEMA public OWNER TO app`);
+
+    const asApp = postgres(appUrl, { max: 1 });
+    try {
+      await migrate(drizzle(asApp), {
+        migrationsFolder: path.resolve(
+          import.meta.dirname,
+          'src/db/migrations',
+        ),
+      });
+    } finally {
+      await asApp.end();
+    }
+
+    // Superuser again: ALTER FUNCTION ... OWNER TO app_rls needs membership the
+    // migrating `app` role must never have.
+    await superuserOnTestDb.unsafe(
+      sqlFile('../../docker/postgres/rls-function-owner.sql'),
+    );
+  } finally {
+    await superuserOnTestDb.end();
+  }
+
+  return appUrl;
+}
+
+/**
+ * Drops the queue schemas THIS run created — matched by the run-scoped
+ * prefix, never by a bare `pgboss_%`: a caller-supplied database may be
+ * serving a concurrent run, whose schemas must survive ours.
+ */
+async function dropRunSchemas(url: string, prefix: string): Promise<void> {
+  const sql = postgres(url, { max: 1 });
+  try {
+    const schemas = await sql<{ nspname: string }[]>`
+      SELECT nspname FROM pg_namespace WHERE nspname LIKE ${prefix + '%'}
+    `;
+    for (const { nspname } of schemas) {
+      // Identifier interpolation, not string concatenation: a schema name is
+      // data here, and `"` inside one would otherwise close the quote.
+      await sql`DROP SCHEMA IF EXISTS ${sql(nspname)} CASCADE`;
+    }
+  } catch (error) {
+    // Teardown must never fail an otherwise-green run; the schemas are inert.
+    // But say what leaked — on an external TEST_DATABASE_URL these accumulate
+    // invisibly otherwise.
+    console.warn(
+      `[integration teardown] failed to drop run schemas '${prefix}%':`,
+      error,
+    );
+  } finally {
+    await sql.end();
+  }
+}
+
+export default async function setup(): Promise<(() => Promise<void>) | void> {
+  // The HTTP-boundary suites boot the real app, whose stream cap would
+  // otherwise wait out production-length timeouts (same default the retired
+  // rls-test.sh provisioning script set).
+  process.env.RUN_STREAM_MAX_MS ??= '20000';
+
+  // Every queue schema this run creates (per-file pg-boss schemas, the worker
+  // harness, worker.module) is named from this prefix, so teardown can drop
+  // exactly ours and nothing belonging to a concurrent run.
+  const runPrefix = `llame_t${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
+  process.env.LLAME_TEST_SCHEMA_PREFIX = runPrefix;
+
+  if (process.env.TEST_DATABASE_URL) {
+    const externalUrl = process.env.TEST_DATABASE_URL;
+    process.env.POSTGRES_URL = externalUrl;
+    // A throwaway container takes its schemas away with it; a caller-supplied
+    // database would accumulate a set per run forever, so drop ours on exit.
+    return async () => {
+      await dropRunSchemas(externalUrl, runPrefix);
+    };
+  }
+
+  const container = await new PostgreSqlContainer(POSTGRES_IMAGE).start();
+
+  let appUrl: string;
+  try {
+    appUrl = await provision(container.getConnectionUri());
+  } catch (error) {
+    // Provisioning failed: stop the container rather than leaking it for the
+    // rest of the CI job (or the developer's machine).
+    await container.stop();
+    throw error;
+  }
+
+  process.env.TEST_DATABASE_URL = appUrl;
+  process.env.POSTGRES_URL = appUrl;
+
+  return async () => {
+    await container.stop();
+  };
+}
diff --git a/apps/api/vitest.integration.setup.ts b/apps/api/vitest.integration.setup.ts
new file mode 100644
index 00000000..03dc1063
--- /dev/null
+++ b/apps/api/vitest.integration.setup.ts
@@ -0,0 +1,12 @@
+/**
+ * Per-suite pg-boss schema (see queue.module.ts): integration suites run
+ * sequentially against one throwaway Postgres, and a suite's stopping
+ * consumers must never steal the next suite's jobs from a shared 'pgboss'
+ * schema. Setup files re-evaluate per test file (isolate: true), so a random
+ * name here is unique per suite — same pattern as worker-harness.ts. Suites
+ * that provision their own schema simply override it.
+ */
+// Prefixed by the run (globalSetup) so teardown drops exactly this run's
+// schemas and never a concurrent run's.
+const prefix = process.env.LLAME_TEST_SCHEMA_PREFIX ?? 'llame_t';
+process.env.PGBOSS_SCHEMA = `${prefix}_pgboss_${Math.random().toString(36).slice(2, 8)}`;
diff --git a/apps/storybook/.storybook/preview.tsx b/apps/storybook/.storybook/preview.tsx
index 6eac6085..cc0889cc 100644
--- a/apps/storybook/.storybook/preview.tsx
+++ b/apps/storybook/.storybook/preview.tsx
@@ -14,6 +14,17 @@ import "./preview.css";
 //   `mutate` spies for the interaction stories.
 sb.mock(import("../../web/contexts/active-runs-context.tsx"));
 sb.mock(import("../../web/lib/services/pins/mutations.ts"));
+// - chat/runs: `useRunContextReceipt` fetches a run's context receipt; the
+//   mock lets the effective-context-inspector stories present receipt states
+//   without a backend.
+sb.mock(import("../../web/lib/services/chat/runs.ts"));
+// - chat/fork: exposes a stable `forkMutate` spy for the fork-affordance
+//   interaction stories.
+sb.mock(import("../../web/lib/services/chat/fork.ts"));
+// - models/queries: stubs only the catalog query hook (the real
+//   modelDisplayName/hasModelId helpers are re-exported) so model-picker
+//   stories can drive loading/loaded catalogs without a backend.
+sb.mock(import("../../web/lib/services/models/queries.ts"));
 
 // One QueryClient shared across stories (retry off so any mutation/query hook
 // in an apps/web component doesn't hammer a nonexistent backend), cleared
diff --git a/apps/storybook/AGENTS.md b/apps/storybook/AGENTS.md
index a603f952..416d2386 100644
--- a/apps/storybook/AGENTS.md
+++ b/apps/storybook/AGENTS.md
@@ -21,7 +21,7 @@ pnpm --filter storybook lint / typecheck
 - `.storybook/preview.tsx` + `preview.css` — theme toolbar/decorator; the CSS entry imports
   `@workspace/ui/globals.css` and adds the `@source` scan for story files
 - `.storybook/vitest.setup.ts` — project annotations (a11y `test: "error"`)
-- `test/` — plain node tests (run in the `unit` vitest project via the `test` script)
+- `test/` — plain node tests (run in the `unit` vitest project via the `test` script); this is the sanctioned home for tooling-invariant guards (config ordering, addon wiring) that have no source file to co-locate with (docs/testing.md)
 - Visual testing comes from the external [`storyproof`](https://github.com/leon0399/storyproof)
   npm package (registered as `storyproof/preset` in `.storybook/main.ts`) — it
   no longer lives in this repo; see that repo for its own source and package
diff --git a/apps/storybook/turbo.json b/apps/storybook/turbo.json
index 6a63f7c3..2c28834b 100644
--- a/apps/storybook/turbo.json
+++ b/apps/storybook/turbo.json
@@ -23,7 +23,14 @@
         "$TURBO_DEFAULT$",
         "$TURBO_ROOT$/packages/ui/src/**/*.stories.tsx",
         "$TURBO_ROOT$/apps/web/**/*.{ts,tsx}"
-      ]
+      ],
+      // CI runs this task inside the Playwright image, whose browsers live at
+      // /ms-playwright rather than under the step's HOME. Turbo's strict env
+      // mode drops any variable it wasn't told about, so without this the
+      // browser launch resolves ~/.cache and fails. Pass-through (not `env`):
+      // where the browsers live doesn't change the test result, so it must
+      // not enter the cache hash.
+      "passThroughEnv": ["PLAYWRIGHT_BROWSERS_PATH"]
     }
   }
 }
diff --git a/apps/web/AGENTS.md b/apps/web/AGENTS.md
index fadf2cc1..a6bad358 100644
--- a/apps/web/AGENTS.md
+++ b/apps/web/AGENTS.md
@@ -36,6 +36,7 @@ Copy `.env.example` to `.env.local`. Needs `NEXT_PUBLIC_API_URL` pointing at `ap
 
 ## Gotchas
 
+- **Where a test goes** ([docs/testing.md](../../docs/testing.md) rule 5): a test that renders a component and asserts DOM/interaction belongs in the component's `.stories.tsx` as a play-function test, not a jsdom `.test.tsx`. jsdom is for pure logic, headless hooks (`renderHook`, React Query cache logic), and — temporarily, with a one-line comment — containers mocking ≥3 modules, the router, or the AI SDK streaming hook.
 - Route groups: `(auth)` and `(chat)`.
 - `proxy.ts` is a cookie-presence UX gate only. It must not import NextAuth, touch the DB, or call api per request. `apps/api` guards are authoritative.
 - `useMe()` is auth-critical: keep `staleTime: 0` and `refetchOnMount: 'always'` despite the global QueryClient stale time.
diff --git a/apps/web/app/(admin)/admin/components/admin-section-nav.stories.tsx b/apps/web/app/(admin)/admin/components/admin-section-nav.stories.tsx
new file mode 100644
index 00000000..e1c8a1c3
--- /dev/null
+++ b/apps/web/app/(admin)/admin/components/admin-section-nav.stories.tsx
@@ -0,0 +1,70 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { SidebarProvider } from "@workspace/ui/components/sidebar";
+import { expect, within } from "storybook/test";
+
+import { AdminSectionNav } from "./admin-section-nav";
+
+const meta = {
+  component: AdminSectionNav,
+  tags: ["autodocs"],
+  args: { host: "llame.local" },
+  parameters: {
+    layout: "centered",
+    nextjs: {
+      appDirectory: true,
+      navigation: { pathname: "/admin/organizations" },
+    },
+  },
+  decorators: [
+    (Story) => (
+      <SidebarProvider className="min-h-0 w-fit">
+        <div className="w-[16rem]">
+          <Story />
+        </div>
+      </SidebarProvider>
+    ),
+  ],
+} satisfies Meta<typeof AdminSectionNav>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The admin area's second rail (admin-area-org-tree task 2.1): Organizations
+ * is the only live section, marked active from the current pathname; the five
+ * unshipped sections stay visible as disabled placeholders with a "soon" chip
+ * (llame's unimplemented-UI convention: disabled, never hidden), and the
+ * footer names the instance host.
+ *
+ * @summary admin rail with one live section and disabled placeholders
+ */
+export const Basic: Story = {
+  tags: ["ai-generated"],
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+
+    const link = canvas.getByRole("link", { name: /Organizations/i });
+    await expect(link).toHaveAttribute("href", "/admin/organizations");
+    // asChild renders the Link straight through Slot — data-active lands on
+    // the <a> itself, there is no separate wrapping <button>.
+    await expect(link).toHaveAttribute("data-active");
+
+    for (const label of [
+      "Users & accounts",
+      "Model providers",
+      "Connectors",
+      "Policies",
+      "Audit log",
+    ]) {
+      const button = canvas.getByText(label).closest("button");
+      await expect(button).toHaveAttribute("aria-disabled", "true");
+      await expect(button).toHaveAttribute("tabindex", "-1");
+      await expect(button?.textContent).toContain("soon");
+    }
+    await expect(
+      canvas.queryByRole("link", { name: /Users & accounts/i }),
+    ).not.toBeInTheDocument();
+
+    await expect(canvas.getByText(/instance · llame\.local/)).toBeVisible();
+  },
+};
diff --git a/apps/web/app/(admin)/admin/components/admin-section-nav.test.tsx b/apps/web/app/(admin)/admin/components/admin-section-nav.test.tsx
deleted file mode 100644
index 8e9e522f..00000000
--- a/apps/web/app/(admin)/admin/components/admin-section-nav.test.tsx
+++ /dev/null
@@ -1,89 +0,0 @@
-// @vitest-environment jsdom
-
-/**
- * Covers admin-area-org-tree task 2.1: the admin second rail's section
- * list — Organizations is the only live/active link, the other five
- * (Users & accounts, Model providers, Connectors, Policies, Audit log)
- * render as disabled (not hidden) placeholders with a visible "soon" chip.
- */
-
-import * as React from "react";
-import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-import { cleanup, render, screen } from "@testing-library/react";
-
-import { SidebarProvider } from "@workspace/ui/components/sidebar";
-
-vi.mock("@workspace/ui/hooks/use-mobile", () => ({
-  useIsMobile: () => false,
-}));
-
-let mockPathname = "/admin/organizations";
-vi.mock("next/navigation", () => ({
-  usePathname: () => mockPathname,
-}));
-
-import { AdminSectionNav } from "./admin-section-nav";
-
-beforeAll(() => {
-  for (const method of [
-    "hasPointerCapture",
-    "setPointerCapture",
-    "releasePointerCapture",
-  ] as const) {
-    if (!(method in Element.prototype)) {
-      Object.defineProperty(Element.prototype, method, {
-        value: () => false,
-        writable: true,
-      });
-    }
-  }
-});
-
-function renderNav() {
-  return render(
-    <SidebarProvider>
-      <AdminSectionNav host="llame.local" />
-    </SidebarProvider>,
-  );
-}
-
-afterEach(() => {
-  mockPathname = "/admin/organizations";
-  cleanup();
-});
-
-describe("AdminSectionNav", () => {
-  it("renders Organizations as the active, live link", () => {
-    renderNav();
-    const link = screen.getByRole("link", { name: /Organizations/i });
-    expect(link.getAttribute("href")).toBe("/admin/organizations");
-    // asChild renders the Link straight through Slot — data-active lands on
-    // the <a> itself, there is no separate wrapping <button>.
-    expect(link.getAttribute("data-active")).not.toBeNull();
-  });
-
-  it("renders the five stub sections as disabled placeholders with a soon chip, not links", () => {
-    renderNav();
-    for (const label of [
-      "Users & accounts",
-      "Model providers",
-      "Connectors",
-      "Policies",
-      "Audit log",
-    ]) {
-      const button = screen.getByText(label).closest("button");
-      expect(button).toBeTruthy();
-      expect(button?.getAttribute("aria-disabled")).toBe("true");
-      expect(button?.getAttribute("tabindex")).toBe("-1");
-      expect(button?.textContent).toContain("soon");
-    }
-    expect(
-      screen.queryByRole("link", { name: /Users & accounts/i }),
-    ).toBeNull();
-  });
-
-  it("shows the instance host in the footer", () => {
-    renderNav();
-    expect(screen.getByText(/instance · llame\.local/)).toBeTruthy();
-  });
-});
diff --git a/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.stories.tsx b/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.stories.tsx
new file mode 100644
index 00000000..2c321b76
--- /dev/null
+++ b/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.stories.tsx
@@ -0,0 +1,59 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { expect, within } from "storybook/test";
+
+import { ChatActivityIndicator } from "./chat-activity-indicator";
+
+const meta = {
+  component: ChatActivityIndicator,
+  tags: ["autodocs"],
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof ChatActivityIndicator>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The unread badge on a chat row: a completed reply the user hasn't opened
+ * yet.
+ *
+ * @summary unread-reply badge
+ */
+export const Unread: Story = {
+  tags: ["ai-generated"],
+  args: { status: "unread" },
+  play: async ({ canvasElement }) => {
+    await expect(
+      within(canvasElement).getByLabelText("Unread reply"),
+    ).toBeVisible();
+  },
+};
+
+/**
+ * The processing badge (spinner ring) while a run is still generating —
+ * takes precedence over unread, since a generating reply isn't unread yet.
+ *
+ * @summary generating-response spinner badge
+ */
+export const Processing: Story = {
+  tags: ["ai-generated"],
+  args: { status: "processing" },
+  play: async ({ canvasElement }) => {
+    const badge = within(canvasElement).getByLabelText("Generating response");
+    await expect(badge).toBeVisible();
+    await expect(badge.className).toContain("animate-spin");
+  },
+};
+
+/**
+ * An idle chat renders no indicator at all — absence is the design, not a
+ * hidden element.
+ *
+ * @summary nothing rendered for a null status
+ */
+export const Idle: Story = {
+  tags: ["ai-generated"],
+  args: { status: null },
+  play: async ({ canvasElement }) => {
+    await expect(canvasElement.querySelector("[aria-label]")).toBeNull();
+  },
+};
diff --git a/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.test.tsx b/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.test.tsx
index dbbdad64..0936626d 100644
--- a/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.test.tsx
+++ b/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.test.tsx
@@ -1,16 +1,11 @@
-// @vitest-environment jsdom
+/**
+ * Pure status-resolution logic only — the badge's rendered states live in
+ * chat-activity-indicator.stories.tsx (docs/testing.md rule 5).
+ */
 
-import { afterEach, describe, expect, it } from "vitest";
-import { cleanup, render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
 
-import {
-  ChatActivityIndicator,
-  resolveChatActivityStatus,
-} from "./chat-activity-indicator";
-
-afterEach(() => {
-  cleanup();
-});
+import { resolveChatActivityStatus } from "./chat-activity-indicator";
 
 describe("resolveChatActivityStatus", () => {
   it("is null when neither signal is set (idle chat)", () => {
@@ -37,22 +32,3 @@ describe("resolveChatActivityStatus", () => {
     );
   });
 });
-
-describe("ChatActivityIndicator", () => {
-  it("renders nothing for a null status", () => {
-    const { container } = render(<ChatActivityIndicator status={null} />);
-    expect(container.firstChild).toBeNull();
-  });
-
-  it("renders the unread badge", () => {
-    render(<ChatActivityIndicator status="unread" />);
-    expect(screen.getByLabelText("Unread reply")).toBeTruthy();
-  });
-
-  it("renders the processing badge (spinner ring)", () => {
-    render(<ChatActivityIndicator status="processing" />);
-    const badge = screen.getByLabelText("Generating response");
-    expect(badge).toBeTruthy();
-    expect(badge.className).toContain("animate-spin");
-  });
-});
diff --git a/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.tsx b/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.tsx
index 772da4d2..8c90be17 100644
--- a/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.tsx
+++ b/apps/web/app/(chat)/components/chat-list-sidebar/chat-activity-indicator.tsx
@@ -49,7 +49,10 @@ export function ChatActivityIndicator({
     // already-sanctioned DESIGN.md tokens) — no color judgment call needed
     // here, unlike `unread` below.
     return (
-      <span
+      // <output> (not a bare span): aria-label is prohibited on a span with
+      // no role (axe aria-prohibited-attr), and output carries role=status
+      // natively — this badge IS a live status.
+      <output
         aria-label="Generating response"
         className={`${BADGE_BASE} animate-spin border-[1.5px] border-border border-t-muted-foreground bg-background`}
       />
@@ -66,7 +69,10 @@ export function ChatActivityIndicator({
     // same token this feature's original unseen-dot already used — matching
     // the design's shape/position but not its one-off color.
     return (
-      <span aria-label="Unread reply" className={`${BADGE_BASE} bg-primary`} />
+      <output
+        aria-label="Unread reply"
+        className={`${BADGE_BASE} bg-primary`}
+      />
     );
   }
   return null;
diff --git a/apps/web/app/(chat)/components/chat-page.compaction.test.tsx b/apps/web/app/(chat)/components/chat-page.compaction.test.tsx
index 51ccfbb9..558f2772 100644
--- a/apps/web/app/(chat)/components/chat-page.compaction.test.tsx
+++ b/apps/web/app/(chat)/components/chat-page.compaction.test.tsx
@@ -61,6 +61,9 @@ vi.mock("@ai-sdk/react", () => ({
       status: "ready",
       stop: vi.fn(),
       error: undefined,
+      // ChatPage drives resume itself (guarded against Strict Mode's double
+      // mount effect — see its useChat call), so the stub must provide it.
+      resumeStream: vi.fn(),
     };
   },
 }));
diff --git a/apps/web/app/(chat)/components/chat-page.models.test.tsx b/apps/web/app/(chat)/components/chat-page.models.test.tsx
index 0d961aa5..d93a964b 100644
--- a/apps/web/app/(chat)/components/chat-page.models.test.tsx
+++ b/apps/web/app/(chat)/components/chat-page.models.test.tsx
@@ -27,6 +27,9 @@ vi.mock("@ai-sdk/react", () => ({
     status: "ready",
     stop: vi.fn(),
     error: undefined,
+    // ChatPage drives resume itself (guarded against Strict Mode's double
+    // mount effect — see its useChat call), so the stub must provide it.
+    resumeStream: vi.fn(),
   }),
 }));
 
diff --git a/apps/web/app/(chat)/components/chat-page.tsx b/apps/web/app/(chat)/components/chat-page.tsx
index 3e56629e..8305dc77 100644
--- a/apps/web/app/(chat)/components/chat-page.tsx
+++ b/apps/web/app/(chat)/components/chat-page.tsx
@@ -294,7 +294,7 @@ function ChatSessionContent({
     refreshChatList();
     refreshChatMessages();
   };
-  const { messages, sendMessage, status, stop, error } = useChat({
+  const { messages, sendMessage, status, stop, error, resumeStream } = useChat({
     id: chatId,
     messages: chatMessages,
     generateId: safeRandomUUID,
@@ -310,7 +310,15 @@ function ChatSessionContent({
     // draft id — the SDK then probed 204 against the not-yet-committed run
     // and fired a spurious onFinish that cleared the draft and navigated
     // early (found via CI trace diagnostics).
-    resume,
+    //
+    // The SDK's own `resume` effect is deliberately NOT used (see the guarded
+    // effect below): it has no cleanup and no re-entrancy guard, so React
+    // Strict Mode's double-invoked mount effect calls resumeStream() twice on
+    // the same Chat instance. Two concurrent makeRequest() calls then race on
+    // the shared `activeResponse`, which the first one clears in its finally —
+    // the second dereferences it and throws (#260), and each accumulates its
+    // own message state, duplicating the answer (#259).
+    resume: false,
     // A completed turn proves the chat exists server-side: adopt the id as active (so the
     // sidebar highlights it — key is already this chatId, so no remount) and refresh the
     // list. On error we only refresh (a mid-stream failure may still have created the chat)
@@ -367,6 +375,20 @@ function ChatSessionContent({
   })();
   const modelReadyForSend = modelsQuery.isSuccess && selectedModelAvailable;
 
+  // Resume-on-refresh (#49), driven here instead of via useChat's `resume`
+  // prop: the SDK's own effect has no cleanup or re-entrancy guard, so Strict
+  // Mode's double-invoked mount effect resumes the same Chat instance twice
+  // and the two concurrent requests race on shared state (#259/#260 — see the
+  // note at the useChat call). The ref is set synchronously before the call,
+  // so the second invocation is a no-op; ChatPage remounts per chat id
+  // (key={chatId}), giving each real session a fresh ref and Chat.
+  const resumedRef = useRef(false);
+  useEffect(() => {
+    if (!resume || resumedRef.current) return;
+    resumedRef.current = true;
+    void resumeStream();
+  }, [resume, resumeStream]);
+
   // Register the active run globally so its completion notifies (toast + badge)
   // if the user navigates to another chat before it finishes — the durable
   // worker keeps generating regardless (#50). Label the toast with the first
diff --git a/apps/web/app/(chat)/components/compaction-boundary.stories.tsx b/apps/web/app/(chat)/components/compaction-boundary.stories.tsx
new file mode 100644
index 00000000..2771f790
--- /dev/null
+++ b/apps/web/app/(chat)/components/compaction-boundary.stories.tsx
@@ -0,0 +1,172 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { expect, userEvent, within } from "storybook/test";
+
+import type { CompactionStats } from "@/lib/services/chat/history";
+import { CompactionBoundary } from "./compaction-boundary";
+
+const NO_STATS: CompactionStats = {
+  absorbedMessageCount: null,
+  beforeTokens: null,
+  afterTokens: null,
+  modelId: null,
+};
+
+const FULL_STATS: CompactionStats = {
+  absorbedMessageCount: 18,
+  beforeTokens: 71400,
+  afterTokens: 12800,
+  modelId: "system:openai:gpt-4o",
+};
+
+const MODELS = [
+  {
+    id: "system:openai:gpt-4o",
+    source: "system" as const,
+    name: "GPT-4o",
+    contextWindowTokens: 128_000,
+  },
+];
+
+const meta = {
+  component: CompactionBoundary,
+  tags: ["autodocs"],
+  args: {
+    summary: "The user asked about X and Y.",
+    createdAt: "2026-07-06T00:00:00.000Z",
+    stats: NO_STATS,
+  },
+  decorators: [
+    (Story) => (
+      <div className="w-[36rem] max-w-full">
+        <Story />
+      </div>
+    ),
+  ],
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof CompactionBoundary>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The resting state readers see in a transcript: a Checkpoint pill between two
+ * rules, collapsed so the compacted summary never competes with live chat.
+ *
+ * @summary collapsed checkpoint chip in a transcript
+ */
+export const Collapsed: Story = {
+  tags: ["ai-generated"],
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    const trigger = canvas.getByRole("button", { name: /context compacted/i });
+    await expect(trigger).toHaveAttribute("aria-expanded", "false");
+    // The result card is not in the document until expanded.
+    await expect(
+      canvas.queryByText("The user asked about X and Y."),
+    ).not.toBeInTheDocument();
+    await expect(
+      canvas.queryByText("Compaction result"),
+    ).not.toBeInTheDocument();
+  },
+};
+
+/**
+ * Use when the reader wants the compacted context itself: clicking the chip
+ * discloses an INLINE result card with the plaintext summary — never a modal,
+ * so the transcript's reading flow is preserved.
+ *
+ * @summary inline result card disclosure (no modal)
+ */
+export const Expanded: Story = {
+  tags: ["ai-generated"],
+  args: { summary: "Compacted: discussed the roadmap." },
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await userEvent.click(
+      canvas.getByRole("button", { name: /context compacted/i }),
+    );
+    await expect(canvas.getByText("Compaction result")).toBeVisible();
+    await expect(
+      canvas.getByText("Compacted: discussed the roadmap."),
+    ).toBeVisible();
+    await expect(
+      canvas.getByText(/full transcript is preserved and still searchable/i),
+    ).toBeVisible();
+    // Design's inline disclosure, not a Dialog overlay.
+    await expect(canvas.queryByRole("dialog")).not.toBeInTheDocument();
+  },
+};
+
+/**
+ * The fully-informed state (#136 read-side merge): real compression stats in
+ * the chip (message count + token savings) and the before→after + model line
+ * inside the card.
+ *
+ * @summary chip savings and card breakdown with full stats
+ */
+export const WithStats: Story = {
+  tags: ["ai-generated"],
+  args: {
+    summary: "Compacted: discussed the roadmap.",
+    stats: FULL_STATS,
+    models: MODELS,
+  },
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    // 71400 - 12800 = 58600 -> "58.6k" (design's own fmtTokens formatting).
+    await expect(
+      canvas.getByText("18 messages · saved 58.6k tokens"),
+    ).toBeVisible();
+    await userEvent.click(
+      canvas.getByRole("button", { name: /context compacted/i }),
+    );
+    await expect(
+      canvas.getByText("71.4k → 12.8k tokens · GPT-4o"),
+    ).toBeVisible();
+  },
+};
+
+/**
+ * Degraded-stats fallback: an older or seeded compaction may carry only a
+ * message count (no token usage) — the chip shows the count alone.
+ *
+ * @summary chip fallback when token stats are absent
+ */
+export const CountOnlyStats: Story = {
+  tags: ["ai-generated"],
+  args: {
+    summary: "Compacted.",
+    stats: {
+      absorbedMessageCount: 18,
+      beforeTokens: null,
+      afterTokens: null,
+      modelId: null,
+    },
+  },
+  play: async ({ canvasElement }) => {
+    await expect(within(canvasElement).getByText("18 messages")).toBeVisible();
+  },
+};
+
+/**
+ * The no-stats fallback: with nothing derivable, both the chip and the
+ * expanded card fall back to the same relative timestamp.
+ *
+ * @summary relative-time fallback with no stats at all
+ */
+export const TimestampFallback: Story = {
+  tags: ["ai-generated"],
+  args: {
+    summary: "Compacted.",
+    createdAt: new Date(Date.now() - 2 * 60 * 60 * 1000).toISOString(),
+  },
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await expect(canvas.getByText(/2 hours ago/i)).toBeVisible();
+    await userEvent.click(
+      canvas.getByRole("button", { name: /context compacted/i }),
+    );
+    // Both slots show the same relative time — two separate elements.
+    await expect(canvas.getAllByText(/2 hours ago/i)).toHaveLength(2);
+  },
+};
diff --git a/apps/web/app/(chat)/components/compaction-boundary.test.tsx b/apps/web/app/(chat)/components/compaction-boundary.test.tsx
deleted file mode 100644
index 61bc9de2..00000000
--- a/apps/web/app/(chat)/components/compaction-boundary.test.tsx
+++ /dev/null
@@ -1,152 +0,0 @@
-// @vitest-environment jsdom
-
-/**
- * Render-level proof for the compaction Checkpoint (#136 design pass: matches
- * Leo's design file — a pill chip between two rules that toggles an INLINE
- * result card, not a modal — see compaction-boundary.tsx's doc comment).
- *
- * Also covers the #136 read-side merge's stats rendering: the chip/card show
- * the real compression stats (message count, before/after tokens, model)
- * embedded in `GET :id/messages` when present, and fall back independently
- * to a relative timestamp when they're null (an older/seeded compaction may
- * have no `usage`).
- */
-
-import { afterEach, describe, expect, it } from "vitest";
-import { cleanup, render, screen } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-
-import type { CompactionStats } from "@/lib/services/chat/history";
-import { CompactionBoundary } from "./compaction-boundary";
-
-const NO_STATS: CompactionStats = {
-  absorbedMessageCount: null,
-  beforeTokens: null,
-  afterTokens: null,
-  modelId: null,
-};
-
-const COUNT_ONLY_STATS: CompactionStats = {
-  absorbedMessageCount: 18,
-  beforeTokens: null,
-  afterTokens: null,
-  modelId: null,
-};
-
-const FULL_STATS: CompactionStats = {
-  absorbedMessageCount: 18,
-  beforeTokens: 71400,
-  afterTokens: 12800,
-  modelId: "system:openai:gpt-4o",
-};
-
-const MODELS = [
-  {
-    id: "system:openai:gpt-4o",
-    source: "system" as const,
-    name: "GPT-4o",
-    contextWindowTokens: 128_000,
-  },
-];
-
-afterEach(() => {
-  cleanup();
-});
-
-describe("CompactionBoundary", () => {
-  it("renders a checkpoint chip with the 'Context compacted' label, collapsed by default", () => {
-    render(
-      <CompactionBoundary
-        summary="The user asked about X and Y."
-        createdAt="2026-07-06T00:00:00.000Z"
-        stats={NO_STATS}
-      />,
-    );
-
-    const trigger = screen.getByRole("button", {
-      name: /context compacted/i,
-    });
-    expect(trigger).toBeTruthy();
-    expect(trigger.getAttribute("aria-expanded")).toBe("false");
-    // The result card is not in the document until expanded.
-    expect(screen.queryByText("The user asked about X and Y.")).toBeNull();
-    expect(screen.queryByText("Compaction result")).toBeNull();
-  });
-
-  it("expands an inline result card with the plaintext summary when clicked — no modal", async () => {
-    const user = userEvent.setup();
-    render(
-      <CompactionBoundary
-        summary="Compacted: discussed the roadmap."
-        createdAt="2026-07-06T00:00:00.000Z"
-        stats={NO_STATS}
-      />,
-    );
-
-    await user.click(
-      screen.getByRole("button", { name: /context compacted/i }),
-    );
-
-    expect(screen.getByText("Compaction result")).toBeTruthy();
-    expect(screen.getByText("Compacted: discussed the roadmap.")).toBeTruthy();
-    expect(
-      screen.getByText(/full transcript is preserved and still searchable/i),
-    ).toBeTruthy();
-    // Design's inline disclosure, not a Dialog overlay.
-    expect(screen.queryByRole("dialog")).toBeNull();
-  });
-
-  it("shows the real message count + token savings in the chip, and before→after + model in the card, when stats are present", async () => {
-    const user = userEvent.setup();
-    render(
-      <CompactionBoundary
-        summary="Compacted: discussed the roadmap."
-        createdAt="2026-07-06T00:00:00.000Z"
-        stats={FULL_STATS}
-        models={MODELS}
-      />,
-    );
-
-    // 71400 - 12800 = 58600 -> "58.6k" (design's own fmtTokens formatting).
-    expect(screen.getByText("18 messages · saved 58.6k tokens")).toBeTruthy();
-
-    await user.click(
-      screen.getByRole("button", { name: /context compacted/i }),
-    );
-
-    expect(screen.getByText("71.4k → 12.8k tokens · GPT-4o")).toBeTruthy();
-  });
-
-  it("falls back to the message count alone in the chip when token stats are absent", () => {
-    render(
-      <CompactionBoundary
-        summary="Compacted."
-        createdAt="2026-07-06T00:00:00.000Z"
-        stats={COUNT_ONLY_STATS}
-      />,
-    );
-
-    expect(screen.getByText("18 messages")).toBeTruthy();
-  });
-
-  it("falls back to a relative timestamp in BOTH the chip and the card when no stats are derivable at all", async () => {
-    const user = userEvent.setup();
-    render(
-      <CompactionBoundary
-        summary="Compacted."
-        createdAt={new Date(Date.now() - 2 * 60 * 60 * 1000).toISOString()}
-        stats={NO_STATS}
-      />,
-    );
-
-    expect(screen.getByText(/2 hours ago/i)).toBeTruthy();
-
-    await user.click(
-      screen.getByRole("button", { name: /context compacted/i }),
-    );
-
-    // Both slots show the same relative time — two separate elements, not a
-    // literal duplicate string check (getByText would throw on ambiguity).
-    expect(screen.getAllByText(/2 hours ago/i).length).toBe(2);
-  });
-});
diff --git a/apps/web/app/(chat)/components/effective-context-inspector.stories.tsx b/apps/web/app/(chat)/components/effective-context-inspector.stories.tsx
new file mode 100644
index 00000000..9eb996a7
--- /dev/null
+++ b/apps/web/app/(chat)/components/effective-context-inspector.stories.tsx
@@ -0,0 +1,96 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { expect, within } from "storybook/test";
+
+// Import via the REAL specifier: sb.mock (preview.tsx) redirects it to the
+// __mocks__ module, so overriding `useRunContextReceipt.mockReturnValue(...)`
+// here reaches the SAME instance the component reads (a direct __mocks__
+// import would be a separate module instance).
+import * as runs from "@/lib/services/chat/runs";
+import type * as runsMock from "@/lib/services/chat/__mocks__/runs";
+import { EffectiveContextInspector } from "./effective-context-inspector";
+
+const { useRunContextReceipt } = runs as unknown as typeof runsMock;
+
+const RECEIPT = {
+  modelId: "custom:anthropic:sonnet",
+  promptSource: "model_override" as const,
+  systemPrompt: "You are the complete model-specific prompt.",
+  tools: [
+    {
+      id: "search_conversations",
+      description: "Search the owner's conversations.",
+      inputSchema: {
+        type: "object",
+        properties: { query: { type: "string" } },
+      },
+    },
+  ],
+  contentHash: "7f07b813",
+  createdAt: "2026-07-18T12:34:56.000Z",
+};
+
+const meta = {
+  component: EffectiveContextInspector,
+  tags: ["autodocs"],
+  args: {
+    runId: "a5dc235e-1de8-4aad-84d8-e0e247b6a135",
+    open: true,
+    onOpenChange: () => undefined,
+  },
+  beforeEach: () => {
+    useRunContextReceipt.mockReturnValue({
+      isPending: false,
+      isError: false,
+      data: RECEIPT,
+    });
+  },
+} satisfies Meta<typeof EffectiveContextInspector>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The owner auditing exactly what a run saw: the complete receipt (prompt
+ * source, full system prompt, advertised tools, content hash) with the
+ * server-only host path structurally absent — never leaked to the client.
+ *
+ * @summary complete owner receipt without a host path
+ */
+export const Receipt: Story = {
+  tags: ["ai-generated"],
+  play: async () => {
+    const dialog = within(
+      await within(document.body).findByRole("dialog", {
+        name: "Effective context",
+      }),
+    );
+    await expect(dialog.getByText("Model-specific override")).toBeVisible();
+    await expect(
+      dialog.getByText("You are the complete model-specific prompt."),
+    ).toBeVisible();
+    await expect(dialog.getByText("search_conversations")).toBeVisible();
+    await expect(dialog.getByText(/"query"/)).toBeVisible();
+    await expect(dialog.getByText("7f07b813")).toBeVisible();
+    // The configured systemPromptFile path is server-only (README contract).
+    await expect(
+      dialog.queryByText(/\/etc\/|systemPromptFile|host path/i),
+    ).not.toBeInTheDocument();
+  },
+};
+
+/**
+ * The on-demand loading state while the receipt query is in flight — the
+ * inspector opens instantly and fills in when the fetch settles.
+ *
+ * @summary pending state while the receipt loads
+ */
+export const Loading: Story = {
+  tags: ["ai-generated"],
+  beforeEach: () => {
+    useRunContextReceipt.mockReturnValue({
+      isPending: true,
+      isError: false,
+      data: undefined,
+    });
+  },
+};
diff --git a/apps/web/app/(chat)/components/effective-context-inspector.test.tsx b/apps/web/app/(chat)/components/effective-context-inspector.test.tsx
deleted file mode 100644
index c908b357..00000000
--- a/apps/web/app/(chat)/components/effective-context-inspector.test.tsx
+++ /dev/null
@@ -1,68 +0,0 @@
-// @vitest-environment jsdom
-
-import { cleanup, render, screen } from "@testing-library/react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-
-const useReceipt = vi.fn();
-vi.mock("@/lib/services/chat/runs", () => ({
-  useRunContextReceipt: (...args: unknown[]) => useReceipt(...args),
-}));
-
-import { EffectiveContextInspector } from "./effective-context-inspector";
-
-afterEach(() => {
-  cleanup();
-  useReceipt.mockReset();
-});
-
-describe("EffectiveContextInspector", () => {
-  it("shows the complete safe owner receipt without a host path", () => {
-    useReceipt.mockReturnValue({
-      isPending: false,
-      isError: false,
-      data: {
-        modelId: "custom:anthropic:sonnet",
-        promptSource: "model_override",
-        systemPrompt: "You are the complete model-specific prompt.",
-        tools: [
-          {
-            id: "search_conversations",
-            description: "Search the owner's conversations.",
-            inputSchema: {
-              type: "object",
-              properties: { query: { type: "string" } },
-            },
-          },
-        ],
-        contentHash: "7f07b813",
-        createdAt: "2026-07-18T12:34:56.000Z",
-      },
-    });
-
-    render(
-      <EffectiveContextInspector
-        runId="a5dc235e-1de8-4aad-84d8-e0e247b6a135"
-        open
-        onOpenChange={() => undefined}
-      />,
-    );
-
-    expect(
-      screen.getByRole("dialog", { name: "Effective context" }),
-    ).toBeTruthy();
-    expect(screen.getByText("Model-specific override")).toBeTruthy();
-    expect(
-      screen.getByText("You are the complete model-specific prompt."),
-    ).toBeTruthy();
-    expect(screen.getByText("search_conversations")).toBeTruthy();
-    expect(screen.getByText(/"query"/)).toBeTruthy();
-    expect(screen.getByText("7f07b813")).toBeTruthy();
-    expect(
-      screen.queryByText(/\/etc\/|systemPromptFile|host path/i),
-    ).toBeNull();
-    expect(useReceipt).toHaveBeenCalledWith(
-      "a5dc235e-1de8-4aad-84d8-e0e247b6a135",
-      true,
-    );
-  });
-});
diff --git a/apps/web/app/(chat)/components/message-fork-button.stories.tsx b/apps/web/app/(chat)/components/message-fork-button.stories.tsx
new file mode 100644
index 00000000..d5c78935
--- /dev/null
+++ b/apps/web/app/(chat)/components/message-fork-button.stories.tsx
@@ -0,0 +1,83 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { expect, fn, userEvent, within } from "storybook/test";
+
+// Import via the REAL specifier: sb.mock (preview.tsx) redirects it to the
+// __mocks__ module, so the `forkMutate` spy here is the SAME instance the
+// component's `useForkChat().mutate` returns.
+import * as fork from "@/lib/services/chat/fork";
+import type * as forkMock from "@/lib/services/chat/__mocks__/fork";
+import { MessageForkButton } from "./message-fork-button";
+
+const { forkMutate, useForkChat } = fork as unknown as typeof forkMock;
+
+const meta = {
+  component: MessageForkButton,
+  tags: ["autodocs"],
+  args: {
+    chatId: "chat-1",
+    fromMessageId: "msg-2",
+    onForked: fn(),
+  },
+  beforeEach: () => {
+    forkMutate.mockClear();
+    useForkChat.mockReturnValue({ mutate: forkMutate, isPending: false });
+  },
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof MessageForkButton>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The always-visible fork-from-here affordance on a message (#141: a
+ * persistent MessageActions row, not a hover-only floating icon) — clicking
+ * it requests the fork with the chat + message id and navigates via onForked
+ * when the mutation succeeds.
+ *
+ * @summary reachable fork affordance wired to the fork mutation
+ */
+export const Basic: Story = {
+  tags: ["ai-generated"],
+  play: async ({ args, canvasElement }) => {
+    const canvas = within(canvasElement);
+    const button = canvas.getByRole("button", { name: /fork from here/i });
+    await expect(button).toBeEnabled();
+
+    await userEvent.click(button);
+    await expect(forkMutate).toHaveBeenCalledTimes(1);
+    // Direct call inspection instead of expect.any(Function): browser-mode
+    // matchers instanceof-check against the wrong realm's Function.
+    const [variables, { onSuccess }] = forkMutate.mock.calls[0] as [
+      { chatId: string; fromMessageId: string },
+      { onSuccess: (forked: { id: string }) => void },
+    ];
+    await expect(variables).toEqual({
+      chatId: "chat-1",
+      fromMessageId: "msg-2",
+    });
+    await expect(typeof onSuccess).toBe("function");
+
+    // Driving the mutation's success navigates through onForked.
+    onSuccess({ id: "forked-chat-9" });
+    await expect(args.onForked).toHaveBeenCalledWith("forked-chat-9");
+  },
+};
+
+/**
+ * No double-submit: while a fork is in flight the button disables until the
+ * mutation settles.
+ *
+ * @summary disabled while the fork mutation is pending
+ */
+export const Pending: Story = {
+  tags: ["ai-generated"],
+  // Runs after meta.beforeEach, so this override wins for this story only.
+  beforeEach: () => {
+    useForkChat.mockReturnValue({ mutate: forkMutate, isPending: true });
+  },
+  play: async ({ canvasElement }) => {
+    await expect(
+      within(canvasElement).getByRole("button", { name: /fork from here/i }),
+    ).toBeDisabled();
+  },
+};
diff --git a/apps/web/app/(chat)/components/message-fork-button.test.tsx b/apps/web/app/(chat)/components/message-fork-button.test.tsx
deleted file mode 100644
index 0f87a794..00000000
--- a/apps/web/app/(chat)/components/message-fork-button.test.tsx
+++ /dev/null
@@ -1,115 +0,0 @@
-// @vitest-environment jsdom
-
-/**
- * Render-level proof that the fork-from-here affordance is actually reachable
- * in the DOM and wired to the fork mutation — not just source-text asserted.
- * (#141: the message-level fork action was structurally present but easy to
- * miss; this both fixes the visibility — a persistent MessageActions row
- * instead of a bare floating icon — and proves it with a real render.)
- */
-
-// Explicit React import: the shared tsconfig sets jsx: "preserve" (Next.js
-// itself does the JSX transform), so vitest's underlying esbuild falls back
-// to the classic transform here, which needs React in scope.
-import React, { type ReactElement } from "react";
-import { afterEach, describe, expect, it, vi } from "vitest";
-import { cleanup, fireEvent, render, screen } from "@testing-library/react";
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-
-const mutateMock = vi.fn();
-let isPending = false;
-
-vi.mock("../../../lib/services/chat/fork", () => ({
-  useForkChat: () => ({
-    mutate: mutateMock,
-    get isPending() {
-      return isPending;
-    },
-  }),
-}));
-
-import { MessageForkButton } from "./message-fork-button";
-
-function renderWithClient(ui: ReactElement) {
-  const queryClient = new QueryClient();
-  return render(
-    <QueryClientProvider client={queryClient}>{ui}</QueryClientProvider>,
-  );
-}
-
-afterEach(() => {
-  mutateMock.mockReset();
-  isPending = false;
-  cleanup();
-});
-
-describe("MessageForkButton", () => {
-  it("renders a reachable, always-visible fork affordance", () => {
-    renderWithClient(
-      <MessageForkButton
-        chatId="chat-1"
-        fromMessageId="msg-2"
-        onForked={vi.fn()}
-      />,
-    );
-
-    const button = screen.getByRole("button", { name: /fork from here/i });
-    expect(button).toBeTruthy();
-    expect((button as HTMLButtonElement).disabled).toBe(false);
-  });
-
-  it("invokes the fork mutation with the chat + message id on click", () => {
-    renderWithClient(
-      <MessageForkButton
-        chatId="chat-1"
-        fromMessageId="msg-2"
-        onForked={vi.fn()}
-      />,
-    );
-
-    fireEvent.click(screen.getByRole("button", { name: /fork from here/i }));
-
-    expect(mutateMock).toHaveBeenCalledTimes(1);
-    expect(mutateMock).toHaveBeenCalledWith(
-      { chatId: "chat-1", fromMessageId: "msg-2" },
-      expect.objectContaining({ onSuccess: expect.any(Function) }),
-    );
-  });
-
-  it("navigates via onForked when the mutation succeeds", () => {
-    const onForked = vi.fn();
-    renderWithClient(
-      <MessageForkButton
-        chatId="chat-1"
-        fromMessageId="msg-2"
-        onForked={onForked}
-      />,
-    );
-
-    fireEvent.click(screen.getByRole("button", { name: /fork from here/i }));
-
-    const [, { onSuccess }] = mutateMock.mock.calls[0] as [
-      unknown,
-      { onSuccess: (forked: { id: string }) => void },
-    ];
-    onSuccess({ id: "forked-chat-9" });
-
-    expect(onForked).toHaveBeenCalledWith("forked-chat-9");
-  });
-
-  it("disables the button while a fork is pending (no double-submit)", () => {
-    isPending = true;
-    renderWithClient(
-      <MessageForkButton
-        chatId="chat-1"
-        fromMessageId="msg-2"
-        onForked={vi.fn()}
-      />,
-    );
-
-    const button = screen.getByRole("button", {
-      name: /fork from here/i,
-    }) as HTMLButtonElement;
-    expect(button.disabled).toBe(true);
-  });
-});
diff --git a/apps/web/app/(chat)/components/model-selector.stories.tsx b/apps/web/app/(chat)/components/model-selector.stories.tsx
new file mode 100644
index 00000000..8bbb001e
--- /dev/null
+++ b/apps/web/app/(chat)/components/model-selector.stories.tsx
@@ -0,0 +1,106 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { expect, userEvent, waitFor, within } from "storybook/test";
+
+import { ChatProvider } from "@/contexts/chat-context";
+// Import via the REAL specifier: sb.mock (preview.tsx) redirects it to the
+// __mocks__ module, so this is the SAME hook instance the component reads.
+import * as modelQueries from "@/lib/services/models/queries";
+import type { AvailableModel } from "@/lib/services/models/queries";
+import type * as modelQueriesMock from "@/lib/services/models/__mocks__/queries";
+import { ModelSelector } from "./model-selector";
+
+const { useModelsQuery } = modelQueries as unknown as typeof modelQueriesMock;
+
+const CATALOG: {
+  defaultModelId: string;
+  models: AvailableModel[];
+} = {
+  defaultModelId: "system:openai:model-two",
+  models: [
+    {
+      id: "system:openai:model-one",
+      source: "system",
+      name: "Model One",
+      contextWindowTokens: 128_000,
+    },
+    {
+      id: "system:openai:model-two",
+      source: "system",
+      name: "Model Two",
+      contextWindowTokens: 400_000,
+    },
+  ],
+};
+
+const meta = {
+  component: ModelSelector,
+  tags: ["autodocs"],
+  beforeEach: () => {
+    useModelsQuery.mockReturnValue({
+      data: CATALOG,
+      isError: false,
+      isPending: false,
+    });
+  },
+  decorators: [
+    (Story) => (
+      <ChatProvider>
+        <Story />
+      </ChatProvider>
+    ),
+  ],
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof ModelSelector>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The composer's model picker with a loaded catalog: the visible selection
+ * initializes from the API's own default model id, so the user always sees
+ * which model will answer.
+ *
+ * @summary selection initialized from the API default model
+ */
+export const Basic: Story = {
+  tags: ["ai-generated"],
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await waitFor(async () => {
+      await expect(canvas.getByRole("combobox").textContent).toContain(
+        "Model Two",
+      );
+    });
+  },
+};
+
+/**
+ * Catalog still loading: the trigger stays enabled and openable, showing
+ * skeleton rows rather than blocking the composer behind a spinner.
+ *
+ * @summary openable with skeleton rows while the catalog loads
+ */
+export const Loading: Story = {
+  tags: ["ai-generated"],
+  // Runs after meta.beforeEach, so this override wins for this story only.
+  beforeEach: () => {
+    useModelsQuery.mockReturnValue({
+      data: undefined,
+      isError: false,
+      isPending: true,
+    });
+  },
+  play: async ({ canvasElement }) => {
+    const trigger = within(canvasElement).getByRole("combobox");
+    await expect(trigger).toBeEnabled();
+
+    await userEvent.click(trigger);
+
+    // The picker is portalled, so query the document, not the canvas.
+    await waitFor(async () => {
+      await expect(
+        document.querySelectorAll('[data-slot="skeleton"]').length,
+      ).toBeGreaterThan(0);
+    });
+  },
+};
diff --git a/apps/web/app/(chat)/components/model-selector.test.tsx b/apps/web/app/(chat)/components/model-selector.test.tsx
deleted file mode 100644
index 5dad5bce..00000000
--- a/apps/web/app/(chat)/components/model-selector.test.tsx
+++ /dev/null
@@ -1,114 +0,0 @@
-// @vitest-environment jsdom
-
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { cleanup, render, screen, waitFor } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-
-const modelsQuery = vi.hoisted(() => ({
-  state: {
-    data: undefined as
-      | {
-          defaultModelId: string;
-          models: Array<{ id: string; source: "system"; name?: string }>;
-        }
-      | undefined,
-    isError: false,
-    isPending: true,
-  },
-}));
-
-// Stub only the query hook; keep the real hasModelId/modelDisplayName so the
-// test exercises the shipped helpers rather than a hand-copied approximation.
-vi.mock("@/lib/services/models/queries", async (importOriginal) => ({
-  ...(await importOriginal<typeof import("@/lib/services/models/queries")>()),
-  useModelsQuery: () => modelsQuery.state,
-}));
-
-import { ChatProvider } from "@/contexts/chat-context";
-
-import { ModelSelector } from "./model-selector";
-
-// Base UI Popover + cmdk need a handful of DOM APIs jsdom omits.
-beforeAll(() => {
-  Element.prototype.scrollIntoView ??= () => {};
-  Element.prototype.hasPointerCapture ??= () => false;
-  Element.prototype.setPointerCapture ??= () => {};
-  Element.prototype.releasePointerCapture ??= () => {};
-  if (!("ResizeObserver" in globalThis)) {
-    class ResizeObserverStub {
-      observe() {}
-      unobserve() {}
-      disconnect() {}
-    }
-    (
-      globalThis as unknown as { ResizeObserver: typeof ResizeObserverStub }
-    ).ResizeObserver = ResizeObserverStub;
-  }
-});
-
-afterEach(() => {
-  cleanup();
-  modelsQuery.state = { data: undefined, isError: false, isPending: true };
-});
-
-function renderModelSelector() {
-  const queryClient = new QueryClient({
-    defaultOptions: { queries: { retry: false } },
-  });
-
-  return render(
-    <QueryClientProvider client={queryClient}>
-      <ChatProvider>
-        <ModelSelector />
-      </ChatProvider>
-    </QueryClientProvider>,
-  );
-}
-
-describe("ModelSelector", () => {
-  it("initializes the visible selection from the API default model id", async () => {
-    modelsQuery.state = {
-      data: {
-        defaultModelId: "system:openai:model-two",
-        models: [
-          {
-            id: "system:openai:model-one",
-            source: "system",
-            name: "Model One",
-          },
-          {
-            id: "system:openai:model-two",
-            source: "system",
-            name: "Model Two",
-          },
-        ],
-      },
-      isError: false,
-      isPending: false,
-    };
-
-    renderModelSelector();
-
-    await waitFor(() => {
-      expect(screen.getByRole("combobox").textContent).toContain("Model Two");
-    });
-  });
-
-  it("stays openable and shows skeleton rows in the picker while the catalog loads", async () => {
-    // Default hoisted state is isPending with no data.
-    const user = userEvent.setup();
-    renderModelSelector();
-
-    const trigger = screen.getByRole("combobox");
-    expect((trigger as HTMLButtonElement).disabled).toBe(false);
-
-    await user.click(trigger);
-
-    await waitFor(() => {
-      expect(
-        document.querySelectorAll('[data-slot="skeleton"]').length,
-      ).toBeGreaterThan(0);
-    });
-  });
-});
diff --git a/apps/web/app/(chat)/components/model-selector.tsx b/apps/web/app/(chat)/components/model-selector.tsx
index 3702fb10..527589c1 100644
--- a/apps/web/app/(chat)/components/model-selector.tsx
+++ b/apps/web/app/(chat)/components/model-selector.tsx
@@ -94,6 +94,12 @@ export function ModelSelector({ className }: { className?: string }) {
             // role=combobox, so changing the role is a separate follow-up.
             // oxlint-disable-next-line jsx-a11y/prefer-tag-over-role, jsx-a11y/role-has-required-aria-props
             role="combobox"
+            // role=combobox is NOT a name-from-content role, so the visible
+            // label (and the loading skeleton) leave the trigger nameless to
+            // screen readers without this — caught by the story a11y run.
+            aria-label={
+              isPending ? "Select model" : `Select model, ${selectedLabel}`
+            }
             aria-expanded={open}
             // Openable while loading so the skeleton list is reachable; only a
             // hard failure (no reachable catalog) locks the trigger.
@@ -126,6 +132,10 @@ export function ModelSelector({ className }: { className?: string }) {
       </PopoverTrigger>
 
       <PopoverContent
+        // Base UI renders the popover with role=dialog, which needs its own
+        // accessible name (axe aria-dialog-name) — the trigger's label does
+        // not carry over to it.
+        aria-label="Model picker"
         className={cn("p-0", previewModel ? "w-[36rem]" : "w-72")}
         align="end"
         side="top"
diff --git a/apps/web/app/(chat)/components/tool-cap-notice-part.stories.tsx b/apps/web/app/(chat)/components/tool-cap-notice-part.stories.tsx
new file mode 100644
index 00000000..2a2c3a1d
--- /dev/null
+++ b/apps/web/app/(chat)/components/tool-cap-notice-part.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { expect, within } from "storybook/test";
+
+import { ToolCapNoticePart } from "./tool-cap-notice-part";
+
+const meta = {
+  component: ToolCapNoticePart,
+  tags: ["autodocs"],
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof ToolCapNoticePart>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The step-cap chip a run leaves behind when it hit `tools.maxStepsPerRun`
+ * and was forced to answer from accumulated context (tool-calling-loop D6) —
+ * visible in the transcript so the cap is never silent.
+ *
+ * @summary tool step-limit chip naming steps used and the cap
+ */
+export const Basic: Story = {
+  tags: ["ai-generated"],
+  args: { stepsUsed: 8, maxSteps: 8 },
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+    await expect(canvas.getByText("(8/8)", { exact: false })).toBeVisible();
+    await expect(canvas.getByText(/Tool step limit reached/)).toBeVisible();
+  },
+};
diff --git a/apps/web/app/(chat)/components/tool-cap-notice-part.test.tsx b/apps/web/app/(chat)/components/tool-cap-notice-part.test.tsx
index b47a28c1..227e1db7 100644
--- a/apps/web/app/(chat)/components/tool-cap-notice-part.test.tsx
+++ b/apps/web/app/(chat)/components/tool-cap-notice-part.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 
-import { cleanup, render, screen } from "@testing-library/react";
+import { cleanup, render } from "@testing-library/react";
 import { afterEach, describe, expect, it } from "vitest";
 
 import { toChatUiMessages } from "@/lib/services/chat/history";
@@ -44,13 +44,9 @@ describe("parseCapNoticePart", () => {
   });
 });
 
-describe("ToolCapNoticePart", () => {
-  it("renders a visible chip naming the steps used and the cap", () => {
-    render(<ToolCapNoticePart stepsUsed={8} maxSteps={8} />);
-    expect(screen.getByText(/8\/8/)).toBeTruthy();
-    expect(screen.getByText(/Tool step limit reached/)).toBeTruthy();
-  });
-});
+// The chip's rendered state lives in tool-cap-notice-part.stories.tsx
+// (docs/testing.md rule 5); the parity check below stays jsdom because it
+// compares two renders' HTML byte-for-byte — not expressible as a story.
 
 describe("live vs. historical rendering parity", () => {
   it("renders the identical cap-notice chip whether the part came from the live stream or a reloaded history response", () => {
diff --git a/apps/web/app/shell/app-sidebar/app-sidebar-admin-entry.stories.tsx b/apps/web/app/shell/app-sidebar/app-sidebar-admin-entry.stories.tsx
new file mode 100644
index 00000000..25ddf69b
--- /dev/null
+++ b/apps/web/app/shell/app-sidebar/app-sidebar-admin-entry.stories.tsx
@@ -0,0 +1,67 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { SidebarProvider } from "@workspace/ui/components/sidebar";
+import { expect, within } from "storybook/test";
+
+import { AppSidebarAdminEntry } from "./app-sidebar-admin-entry";
+
+const meta = {
+  component: AppSidebarAdminEntry,
+  tags: ["autodocs"],
+  parameters: {
+    layout: "centered",
+    nextjs: { appDirectory: true, navigation: { pathname: "/" } },
+  },
+  decorators: [
+    (Story) => (
+      <SidebarProvider className="min-h-0 w-fit">
+        <div className="w-[16rem]">
+          <Story />
+        </div>
+      </SidebarProvider>
+    ),
+  ],
+} satisfies Meta<typeof AppSidebarAdminEntry>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The Administration entry as its own bottom-pinned group (admin-area-org-tree
+ * task 2.2, per AppShell.dc.html): on desktop it is a live link into the admin
+ * area, not a main-nav item and not a user-menu entry.
+ *
+ * @summary live desktop link into the admin area
+ */
+export const Basic: Story = {
+  tags: ["ai-generated"],
+  play: async ({ canvasElement }) => {
+    const link = within(canvasElement).getByRole("link", {
+      name: /Administration/i,
+    });
+    await expect(link).toHaveAttribute("href", "/admin/organizations");
+  },
+};
+
+/**
+ * Route-awareness: anywhere under /admin the entry marks itself active, so
+ * the rail shows where the user is even from nested admin pages.
+ *
+ * @summary active state on any /admin route
+ */
+export const ActiveOnAdminRoute: Story = {
+  tags: ["ai-generated"],
+  parameters: {
+    nextjs: {
+      appDirectory: true,
+      navigation: { pathname: "/admin/organizations" },
+    },
+  },
+  play: async ({ canvasElement }) => {
+    const link = within(canvasElement).getByRole("link", {
+      name: /Administration/i,
+    });
+    // asChild renders the Link straight through Slot — data-active lands on
+    // the <a> itself, there is no separate wrapping <button>.
+    await expect(link).toHaveAttribute("data-active");
+  },
+};
diff --git a/apps/web/app/shell/app-sidebar/app-sidebar-admin-entry.test.tsx b/apps/web/app/shell/app-sidebar/app-sidebar-admin-entry.test.tsx
index 16195fb8..05e3103c 100644
--- a/apps/web/app/shell/app-sidebar/app-sidebar-admin-entry.test.tsx
+++ b/apps/web/app/shell/app-sidebar/app-sidebar-admin-entry.test.tsx
@@ -1,10 +1,10 @@
 // @vitest-environment jsdom
 
 /**
- * Covers admin-area-org-tree task 2.2 (corrected placement — AppShell.dc.html):
- * Administration is its OWN bottom-pinned group, not a main nav item and not
- * in the user menu. Desktop-only, disabled-not-hidden with a tooltip on
- * mobile (same convention as AppSidebarNav's other desktop-only items).
+ * Mobile-only branch of AppSidebarAdminEntry (admin-area-org-tree task 2.2):
+ * desktop behavior lives in app-sidebar-admin-entry.stories.tsx (docs/testing.md
+ * rule 5); this stays jsdom because vitest browser mode runs a fixed desktop
+ * viewport, so the real useIsMobile media query can't be driven there.
  */
 
 import * as React from "react";
@@ -13,19 +13,19 @@ import { cleanup, render, screen } from "@testing-library/react";
 
 import { SidebarProvider } from "@workspace/ui/components/sidebar";
 
-let mockIsMobile = false;
 vi.mock("@workspace/ui/hooks/use-mobile", () => ({
-  useIsMobile: () => mockIsMobile,
+  useIsMobile: () => true,
 }));
 
-let mockPathname = "/";
 vi.mock("next/navigation", () => ({
-  usePathname: () => mockPathname,
+  usePathname: () => "/",
 }));
 
 import { AppSidebarAdminEntry } from "./app-sidebar-admin-entry";
 
 beforeAll(() => {
+  // jsdom doesn't implement the Pointer Events capture API Base UI's Tooltip
+  // relies on for hover/focus handling.
   for (const method of [
     "hasPointerCapture",
     "setPointerCapture",
@@ -40,39 +40,17 @@ beforeAll(() => {
   }
 });
 
-function renderEntry() {
-  return render(
-    <SidebarProvider>
-      <AppSidebarAdminEntry />
-    </SidebarProvider>,
-  );
-}
-
 afterEach(() => {
-  mockIsMobile = false;
-  mockPathname = "/";
   cleanup();
 });
 
-describe("AppSidebarAdminEntry", () => {
-  it("renders as a live link to /admin/organizations on desktop", () => {
-    renderEntry();
-    const link = screen.getByRole("link", { name: /Administration/i });
-    expect(link.getAttribute("href")).toBe("/admin/organizations");
-  });
-
-  it("marks itself active when the route is under /admin", () => {
-    mockPathname = "/admin/organizations";
-    renderEntry();
-    const link = screen.getByRole("link", { name: /Administration/i });
-    // asChild renders the Link straight through Slot — data-active lands on
-    // the <a> itself, there is no separate wrapping <button>.
-    expect(link.getAttribute("data-active")).not.toBeNull();
-  });
-
+describe("AppSidebarAdminEntry (mobile)", () => {
   it("renders disabled (not hidden) with a tooltip on mobile instead of linking", () => {
-    mockIsMobile = true;
-    renderEntry();
+    render(
+      <SidebarProvider>
+        <AppSidebarAdminEntry />
+      </SidebarProvider>,
+    );
     expect(screen.queryByRole("link", { name: /Administration/i })).toBeNull();
     const button = screen.getByText("Administration").closest("button");
     expect(button?.getAttribute("aria-disabled")).toBe("true");
diff --git a/apps/web/app/shell/app-sidebar/app-sidebar-nav.stories.tsx b/apps/web/app/shell/app-sidebar/app-sidebar-nav.stories.tsx
new file mode 100644
index 00000000..25b9ddb8
--- /dev/null
+++ b/apps/web/app/shell/app-sidebar/app-sidebar-nav.stories.tsx
@@ -0,0 +1,61 @@
+import type { Meta, StoryObj } from "@storybook/nextjs-vite";
+import { SidebarProvider } from "@workspace/ui/components/sidebar";
+import { expect, within } from "storybook/test";
+
+import { AppSidebarNav } from "./app-sidebar-nav";
+
+const meta = {
+  component: AppSidebarNav,
+  tags: ["autodocs"],
+  parameters: {
+    layout: "centered",
+    nextjs: { appDirectory: true, navigation: { pathname: "/" } },
+  },
+  decorators: [
+    (Story) => (
+      <SidebarProvider className="min-h-0 w-fit">
+        <div className="w-[16rem]">
+          <Story />
+        </div>
+      </SidebarProvider>
+    ),
+  ],
+} satisfies Meta<typeof AppSidebarNav>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * The primary rail's main nav (admin-area-org-tree task 2.3): live links
+ * (Chats, Projects) carry no chip, every not-yet-built placeholder renders
+ * disabled with a visible "soon" chip (llame's unimplemented-UI convention:
+ * disabled, never hidden), and Administration is absent here — it is its own
+ * bottom-pinned group per AppShell.dc.html.
+ *
+ * @summary main nav with soon-chip placeholders and no admin item
+ */
+export const Basic: Story = {
+  tags: ["ai-generated"],
+  play: async ({ canvasElement }) => {
+    const canvas = within(canvasElement);
+
+    for (const label of [
+      "Dashboard",
+      "Gallery",
+      "Calendar",
+      "Email",
+      "Brain",
+    ]) {
+      const button = canvas.getByText(label).closest("button");
+      await expect(button).toHaveAttribute("aria-disabled", "true");
+      await expect(button?.textContent).toContain("soon");
+    }
+
+    for (const label of ["Chats", "Projects"]) {
+      const el = canvas.getByText(label).closest("a, button");
+      await expect(el?.textContent).not.toContain("soon");
+    }
+
+    await expect(canvas.queryByText("Administration")).not.toBeInTheDocument();
+  },
+};
diff --git a/apps/web/app/shell/app-sidebar/app-sidebar-nav.test.tsx b/apps/web/app/shell/app-sidebar/app-sidebar-nav.test.tsx
deleted file mode 100644
index 328b6eae..00000000
--- a/apps/web/app/shell/app-sidebar/app-sidebar-nav.test.tsx
+++ /dev/null
@@ -1,89 +0,0 @@
-// @vitest-environment jsdom
-
-/**
- * Covers admin-area-org-tree task 2.3: "soon"-chip parity on the
- * pre-existing disabled placeholders (Dashboard, Gallery, Calendar, Email,
- * Brain). The "Administration" entry is NOT one of these nav items — per
- * AppShell.dc.html it's its own bottom-pinned group, covered by
- * app-sidebar-admin-entry.test.tsx instead.
- */
-
-import * as React from "react";
-import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-import { cleanup, render, screen } from "@testing-library/react";
-
-import { SidebarProvider } from "@workspace/ui/components/sidebar";
-
-let mockIsMobile = false;
-vi.mock("@workspace/ui/hooks/use-mobile", () => ({
-  useIsMobile: () => mockIsMobile,
-}));
-
-let mockPathname = "/";
-vi.mock("next/navigation", () => ({
-  usePathname: () => mockPathname,
-}));
-
-import { AppSidebarNav } from "./app-sidebar-nav";
-
-beforeAll(() => {
-  // jsdom doesn't implement the Pointer Events capture API Base UI's Tooltip
-  // relies on for hover/focus handling.
-  for (const method of [
-    "hasPointerCapture",
-    "setPointerCapture",
-    "releasePointerCapture",
-  ] as const) {
-    if (!(method in Element.prototype)) {
-      Object.defineProperty(Element.prototype, method, {
-        value: () => false,
-        writable: true,
-      });
-    }
-  }
-});
-
-function renderNav() {
-  return render(
-    <SidebarProvider>
-      <AppSidebarNav />
-    </SidebarProvider>,
-  );
-}
-
-afterEach(() => {
-  mockIsMobile = false;
-  mockPathname = "/";
-  cleanup();
-});
-
-describe("AppSidebarNav — soon-chip parity", () => {
-  it("shows a visible 'soon' chip on every not-yet-built placeholder", () => {
-    renderNav();
-    for (const label of [
-      "Dashboard",
-      "Gallery",
-      "Calendar",
-      "Email",
-      "Brain",
-    ]) {
-      const button = screen.getByText(label).closest("button");
-      expect(button).toBeTruthy();
-      expect(button?.getAttribute("aria-disabled")).toBe("true");
-      expect(button?.textContent).toContain("soon");
-    }
-  });
-
-  it("does not put a soon chip on real or desktop-only links", () => {
-    renderNav();
-    for (const label of ["Chats", "Projects"]) {
-      const el = screen.getByText(label).closest("a, button");
-      expect(el?.textContent).not.toContain("soon");
-    }
-  });
-
-  it("does not render an Administration item among the main nav items", () => {
-    renderNav();
-    expect(screen.queryByText("Administration")).toBeNull();
-  });
-});
diff --git a/apps/web/lib/services/chat/__mocks__/fork.ts b/apps/web/lib/services/chat/__mocks__/fork.ts
new file mode 100644
index 00000000..7bae5f87
--- /dev/null
+++ b/apps/web/lib/services/chat/__mocks__/fork.ts
@@ -0,0 +1,15 @@
+import { fn } from "storybook/test";
+
+// Storybook manual mock for the fork mutation (registered globally via
+// `sb.mock` in .storybook/preview.tsx). Exposes a STABLE `forkMutate` spy so
+// interaction stories can assert a fork was requested and drive its
+// onSuccess callback (mirrors message-fork-button.test.tsx's vi.mock seam).
+
+export const forkMutate = fn().mockName("forkMutate");
+
+export const forkChat = fn().mockName("forkChat");
+
+export const useForkChat = fn(() => ({
+  mutate: forkMutate,
+  isPending: false,
+})).mockName("useForkChat");
diff --git a/apps/web/lib/services/chat/__mocks__/runs.ts b/apps/web/lib/services/chat/__mocks__/runs.ts
new file mode 100644
index 00000000..3f61a217
--- /dev/null
+++ b/apps/web/lib/services/chat/__mocks__/runs.ts
@@ -0,0 +1,42 @@
+import { fn } from "storybook/test";
+
+// Type-only import: erased at runtime, so it cannot re-enter the sb.mock
+// redirect the way a value import would.
+import type { RunContextReceipt } from "../runs";
+
+// Storybook manual mock for the run helpers (registered globally via
+// `sb.mock` in .storybook/preview.tsx). `useRunContextReceipt` is a
+// controllable spy so the effective-context-inspector stories can present a
+// receipt without a backend (mirrors effective-context-inspector.test.tsx's
+// vi.mock seam); the remaining exports are inert stand-ins so any other
+// storied component importing this module stays off the network.
+
+// Mirrors the real factory exactly — a drifted key here would make a story
+// seed a cache entry the component never reads.
+export const runQueryKeys = {
+  all: ["runs"] as const,
+  detail: (runId: string) => [...runQueryKeys.all, runId] as const,
+  contextReceipt: (runId: string) =>
+    [...runQueryKeys.detail(runId), "context-receipt"] as const,
+};
+
+type MockedReceiptQuery = {
+  isPending: boolean;
+  isError: boolean;
+  data: RunContextReceipt | undefined;
+};
+
+export const useRunContextReceipt = fn(
+  (): MockedReceiptQuery => ({
+    isPending: true,
+    isError: false,
+    data: undefined,
+  }),
+).mockName("useRunContextReceipt");
+
+export const fetchRunContextReceipt = fn().mockName("fetchRunContextReceipt");
+export const runContextReceiptQueryOptions = fn().mockName(
+  "runContextReceiptQueryOptions",
+);
+export const runIdToCancel = fn(() => null).mockName("runIdToCancel");
+export const cancelRun = fn().mockName("cancelRun");
diff --git a/apps/web/lib/services/models/__mocks__/queries.ts b/apps/web/lib/services/models/__mocks__/queries.ts
new file mode 100644
index 00000000..4ff2fed8
--- /dev/null
+++ b/apps/web/lib/services/models/__mocks__/queries.ts
@@ -0,0 +1,45 @@
+import { fn } from "storybook/test";
+
+// Type-only import: erased at runtime, so it cannot re-enter the sb.mock
+// redirect the way a value re-export would.
+import type { AvailableModel } from "../queries";
+
+// Storybook manual mock for the models catalog query (registered globally via
+// `sb.mock` in .storybook/preview.tsx). Only the QUERY HOOK is stubbed; the
+// two pure helpers are re-implemented here verbatim rather than re-exported
+// from "../queries" — sb.mock redirects that specifier back to THIS module,
+// so a re-export would be a circular self-import that breaks the preview.
+
+export const modelQueryKeys = {
+  all: ["models"] as const,
+};
+
+export const fetchModels = fn().mockName("fetchModels");
+
+type MockedModelsQuery = {
+  data: { defaultModelId: string; models: AvailableModel[] } | undefined;
+  isError: boolean;
+  isPending: boolean;
+};
+
+export const useModelsQuery = fn(
+  (): MockedModelsQuery => ({
+    data: undefined,
+    isError: false,
+    isPending: true,
+  }),
+).mockName("useModelsQuery");
+
+export function modelDisplayName(
+  modelId: string,
+  models?: readonly AvailableModel[],
+): string {
+  return models?.find((model) => model.id === modelId)?.name ?? modelId;
+}
+
+export function hasModelId(
+  models: readonly AvailableModel[],
+  modelId: string | undefined,
+): boolean {
+  return modelId !== undefined && models.some((model) => model.id === modelId);
+}
diff --git a/docs/testing.md b/docs/testing.md
new file mode 100644
index 00000000..5c55075f
--- /dev/null
+++ b/docs/testing.md
@@ -0,0 +1,119 @@
+# Testing
+
+How tests are organized across the monorepo: which layer proves what, where a
+test lives, what it is named, and what runs it.
+
+## The pyramid
+
+| Layer        | Proves                                                                                                   | Runner                          | Naming / location                                                     | Runs via                                   |
+| ------------ | -------------------------------------------------------------------------------------------------------- | ------------------------------- | --------------------------------------------------------------------- | ------------------------------------------ |
+| Unit         | pure logic, hooks — no I/O                                                                               | Vitest (node / jsdom)           | `*.test.ts(x)`, co-located next to source                             | `turbo run test` — always, cached          |
+| Integration  | anything needing a real Postgres: RLS isolation, queries, queue semantics, the HTTP boundary (supertest) | Vitest (`integration` project)  | `*.integration.test.ts`, co-located next to the owning feature module | `pnpm --filter api test:integration`       |
+| UI component | component behavior, interaction, visuals in a real browser                                               | Storybook play fns + storyproof | `*.stories.tsx`, co-located next to the component                     | `turbo run test:storybook`                 |
+| Product e2e  | whole-product flows through a user surface (db + api + worker + mock model + client)                     | Playwright                      | `e2e/<surface>/*.spec.ts`; shared boot infra in `e2e/support/`        | root `pnpm test:e2e`                       |
+| Evals        | model-graded quality; costs provider spend                                                               | Vitest (integration project)    | `apps/api/evals/*.test.ts`                                            | `test:evals` (opt-in, `RUN_MODEL_EVALS=1`) |
+
+Placement rule of thumb: _provable with a function/repo call?_ → unit or
+integration. _Needs a browser user?_ → story (one component) or product e2e (a
+cross-app flow). Tooling-invariant guards (e.g. the Storybook globals.css
+ordering test in `apps/storybook/test/`) are ordinary unit tests owned by the
+workspace whose tooling they guard.
+
+## The rules
+
+1. **`*.test.ts(x)` is Vitest, everywhere.** Root `e2e/` is Playwright's
+   island and uses its `*.spec.ts` convention; no Vitest glob ever looks
+   there. `nest g` is configured (`generateOptions.spec: false`) not to
+   scaffold test files.
+2. **The `.integration` infix declares "needs a real Postgres".** A plain
+   `.test.ts` runs with zero external dependencies, always.
+3. **`test:integration` is self-provisioning.** Its globalSetup starts a
+   throwaway Postgres via Testcontainers and reproduces the worst-case
+   self-hosted topology — a **non-superuser role that owns the schema and runs
+   the migrations**, so a green RLS suite proves `FORCE ROW LEVEL SECURITY`
+   constrains even the table owner. Docker is the only prerequisite;
+   `TEST_DATABASE_URL` overrides with an already-provisioned database
+   (`docker/postgres/` initdb scripts show the role model). Nothing
+   silently skips: no database means a loud failure, not a green zero-test
+   run.
+4. **Live-state tasks are never cached.** `test:integration` and `test:evals`
+   are `cache: false` in turbo — their outcome depends on state turbo's hash
+   cannot see.
+5. **Component behavior lives in stories.** Renders + asserts DOM/interaction
+   ⇒ a play-function test in the component's `.stories.tsx`. Rubric: leaf
+   component with ≤2 module mocks migrates; a container mocking ≥3 modules,
+   the router, or the AI SDK streaming hook stays a jsdom `.test.tsx` (with a
+   one-line comment) until shared mock-provider decorators exist. Headless
+   hooks and React Query cache logic stay jsdom unit tests.
+6. **Root `e2e/` is product-level, one subdirectory per user surface**
+   (`e2e/web/` today). App-scoped tests never live there.
+7. **RLS is an acceptance criterion.** Any new tenant-scoped table or endpoint
+   ships a `*-rls.integration.test.ts` next to its feature module with a
+   cross-tenant negative case (AGENTS.md § Security). App-layer authorization
+   gets its own unit test — the two prove different layers.
+8. **A new app inherits the same shape**: co-located unit tests; its own
+   `test:integration` (cache: false, self-provisioning) if it ever owns an
+   external dependency (today only apps/api owns a datastore — SPEC §22.0);
+   `e2e/<surface>/` for its product flows.
+
+## Commands
+
+```bash
+turbo run test                       # unit everywhere — no DB, no docker, cached
+pnpm --filter api test:integration   # self-provisions Postgres (docker); TEST_DATABASE_URL overrides
+pnpm test:e2e                        # Playwright product suite (boots everything)
+turbo run test:storybook             # browser component tests (needs Playwright browsers)
+pnpm --filter api test:evals         # opt-in, model-graded — bring model credentials; DB self-provisions (TEST_DATABASE_URL overrides)
+```
+
+## CI mapping
+
+Three test-pipeline workflows, one job per concern (`.github/workflows/` —
+`git-ai.yaml`, a merge-time automation helper, sits outside this pyramid):
+
+**Lint** — source checks, independent of everything, so they report in seconds:
+
+- **Lint** — `turbo run lint` · **Format** — `format:check`
+
+**Workflow lint** — the pipeline checks itself:
+
+- **actionlint** (syntax + shellcheck, official container pinned by image digest)
+- **zizmor** (security posture, SARIF to the Security tab)
+- **pinact** (validate-only: every action ref must be a full commit SHA)
+
+**CI** — the pyramid as a job graph, each layer gated on the cheaper layer
+that would catch the same breakage:
+
+```
+typecheck ─┐
+unit ──────┼─→ build
+           ├─→ storybook        (component tests, real browser)
+           └─→ integration ──→ browser-e2e
+```
+
+- **Typecheck** / **Unit tests** — cheap gates, run unconditionally in parallel
+- **Build** — `turbo run build` + a `git diff --exit-code` drift check
+- **Integration tests (real Postgres)** — the RLS gate; self-provisions via Testcontainers
+- **Component tests (Storybook)** — runs in the Playwright image (browser preinstalled)
+- **Product e2e (Playwright)** — the only place the browser suite runs
+- Evals never run in CI.
+
+## Follow-ups (deliberate, not forgotten)
+
+- Migrate the story-eligible `apps/web` component tests per rule 5's rubric
+  (low-friction first: compaction-boundary, effective-context-inspector,
+  admin-section-nav, …; mixed files split pure/render first). Delete a jsdom
+  test only after its story covers the same assertions.
+- Replace `chat-page.hydration.test.ts` (regex over its own source text) with
+  behavioral coverage.
+- The in-file `describeIfDb`-style guards inside integration suites are dead
+  code now that the globalSetup guarantees the env — remove them when touching
+  each suite.
+- The four disabled `vitest/*` style rules in `apps/api/.oxlintrc.json` are a
+  ratchet: flip one to "error" and fix its findings when touching the affected
+  suites.
+- Migrate the hand-forged `as unknown as ReturnType<typeof streamText>` model
+  doubles (16 sites / 8 files) onto `ai/test`'s `MockLanguageModelV3` under
+  the REAL `streamText` — `run-execution-tools.integration.test.ts` shows the
+  pattern. The HTTP-level `e2e/support/model-server.ts` stays (product e2e
+  needs an OpenAI-protocol endpoint, out of `ai/test`'s scope).
diff --git a/e2e/auth/helpers.ts b/e2e/support/auth-helpers.ts
similarity index 100%
rename from e2e/auth/helpers.ts
rename to e2e/support/auth-helpers.ts
diff --git a/e2e/db-server.ts b/e2e/support/db-server.ts
similarity index 99%
rename from e2e/db-server.ts
rename to e2e/support/db-server.ts
index 92534b5b..fb678077 100644
--- a/e2e/db-server.ts
+++ b/e2e/support/db-server.ts
@@ -5,7 +5,7 @@ import { dirname, resolve } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
 
-const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 const rlsFunctionOwnerSqlPath = resolve(
   repoRoot,
   "docker/postgres/rls-function-owner.sql",
diff --git a/e2e/fixtures.ts b/e2e/support/fixtures.ts
similarity index 62%
rename from e2e/fixtures.ts
rename to e2e/support/fixtures.ts
index d010e2c6..39a974d2 100644
--- a/e2e/fixtures.ts
+++ b/e2e/support/fixtures.ts
@@ -4,16 +4,16 @@ import {
   request as playwrightRequest,
   test as baseTest,
 } from "@playwright/test";
-import playwrightConfig from "../playwright.config";
+import playwrightConfig from "../../playwright.config";
 import {
   expectProtectedShell,
   loginViaUi,
   registerAccount,
   type TestAccount,
-} from "./auth/helpers";
+} from "./auth-helpers";
 
 export * from "@playwright/test";
-export * from "./auth/helpers";
+export * from "./auth-helpers";
 
 type Fixtures = {
   account: TestAccount;
@@ -26,6 +26,25 @@ type WorkerFixtures = {
 };
 
 export const test = baseTest.extend<Fixtures, WorkerFixtures>({
+  // An uncaught client exception fails the test that caused it. Without this
+  // the page keeps rendering and only the assertions notice — #260 (a double
+  // resumeStream race throwing on every mid-run reload) logged silently in CI
+  // for weeks because nothing asserted on page errors.
+  page: async ({ page }, use) => {
+    const pageErrors: Error[] = [];
+    page.on("pageerror", (error) => pageErrors.push(error));
+
+    await use(page);
+
+    if (pageErrors.length > 0) {
+      throw new Error(
+        `Uncaught client exception(s) during this test:\n${pageErrors
+          .map((error) => `  - ${error.message}`)
+          .join("\n")}`,
+      );
+    }
+  },
+
   account: async ({ workerAccount }, use) => {
     await use(workerAccount);
   },
@@ -69,9 +88,16 @@ export const test = baseTest.extend<Fixtures, WorkerFixtures>({
 
   workerStorageState: [
     async ({ browser, workerAccount }, use) => {
+      // Keyed by the ACCOUNT, not the worker slot. `parallelIndex` names a
+      // slot and is reused when a worker restarts — and a retry always
+      // restarts one — while `workerAccount` registers a fresh user per
+      // worker process. Keying by slot therefore handed a retry's new account
+      // the previous account's cached cookies: the browser acted as user A
+      // while the spec's Bearer requests authenticated as user B, so
+      // owner-scoped reads 404'd on a chat the page had just created.
       const fileName = path.resolve(
         test.info().project.outputDir,
-        `.auth/${test.info().parallelIndex}.json`,
+        `.auth/${workerAccount.id}.json`,
       );
 
       if (!fs.existsSync(fileName)) {
diff --git a/e2e/fixtures/llame.config.e2e.json b/e2e/support/fixtures/llame.config.e2e.json
similarity index 80%
rename from e2e/fixtures/llame.config.e2e.json
rename to e2e/support/fixtures/llame.config.e2e.json
index 178bbbd4..9b5444df 100644
--- a/e2e/fixtures/llame.config.e2e.json
+++ b/e2e/support/fixtures/llame.config.e2e.json
@@ -1,5 +1,5 @@
 {
-  "$schema": "../../apps/api/src/instance-config/llame.config.schema.json",
+  "$schema": "../../../apps/api/src/instance-config/llame.config.schema.json",
   // E2E instance config (referenced via LLAME_CONFIG_PATH in
   // playwright.config.ts). Model selection is by opaque catalog id; the mock
   // model server answers any /chat/completions regardless of the provider
@@ -44,10 +44,21 @@
     }
   ],
   // Tool-calling loop (openspec/changes/tool-calling-loop): the e2e tool-loop
-  // browser suite (e2e/chat/tool-loop.spec.ts) drives search_conversations
+  // browser suite (e2e/web/chat/tool-loop.spec.ts) drives search_conversations
   // through the mock model server — it must be allowlisted for those tests
   // to see any tool activity at all.
   "tools": {
     "allowed": ["search_conversations"]
+  },
+  // fullyParallel browser workers need real `runs` concurrency (the default
+  // profile's 1 backs up past assertion timeouts); poolSize >= concurrency
+  // per docs/scaling.md.
+  "workers": {
+    "all": {
+      "runs": 8
+    }
+  },
+  "db": {
+    "poolSize": 12
   }
 }
diff --git a/e2e/fixtures/prompts/context-target.md b/e2e/support/fixtures/prompts/context-target.md
similarity index 100%
rename from e2e/fixtures/prompts/context-target.md
rename to e2e/support/fixtures/prompts/context-target.md
diff --git a/e2e/model-server.ts b/e2e/support/model-server.ts
similarity index 100%
rename from e2e/model-server.ts
rename to e2e/support/model-server.ts
diff --git a/e2e/run-after-ready.ts b/e2e/support/run-after-ready.ts
similarity index 100%
rename from e2e/run-after-ready.ts
rename to e2e/support/run-after-ready.ts
diff --git a/e2e/auth/auth.spec.ts b/e2e/web/auth/auth.spec.ts
similarity index 99%
rename from e2e/auth/auth.spec.ts
rename to e2e/web/auth/auth.spec.ts
index b165b2da..e2e9a3cf 100644
--- a/e2e/auth/auth.spec.ts
+++ b/e2e/web/auth/auth.spec.ts
@@ -5,7 +5,7 @@ import {
   revokeAllSessions,
   test,
   expect,
-} from "../fixtures";
+} from "../../support/fixtures";
 
 const emptyStorageState = { cookies: [], origins: [] };
 
diff --git a/e2e/chat/chat-flow.spec.ts b/e2e/web/chat/chat-flow.spec.ts
similarity index 97%
rename from e2e/chat/chat-flow.spec.ts
rename to e2e/web/chat/chat-flow.spec.ts
index 3ca0dc3c..8984e496 100644
--- a/e2e/chat/chat-flow.spec.ts
+++ b/e2e/web/chat/chat-flow.spec.ts
@@ -3,12 +3,12 @@
  *
  * Runs against the full stack — Next.js web, NestJS api in WORKER execution
  * mode (pg-boss queue, run-event bridge), throwaway Postgres, and the
- * deterministic mock model server (e2e/model-server.ts, wired via
+ * deterministic mock model server (e2e/support/model-server.ts, wired via
  * OPENAI_BASE_URL, #88). Every send here exercises the durable-run pipeline
  * end-to-end from a real browser.
  */
 
-import { expect, test } from "../fixtures";
+import { expect, test } from "../../support/fixtures";
 
 const ANSWER = "Mocked answer from the e2e model server.";
 
diff --git a/e2e/chat/compaction-checkpoint.spec.ts b/e2e/web/chat/compaction-checkpoint.spec.ts
similarity index 75%
rename from e2e/chat/compaction-checkpoint.spec.ts
rename to e2e/web/chat/compaction-checkpoint.spec.ts
index 6fd4d85a..4a9a32e4 100644
--- a/e2e/chat/compaction-checkpoint.spec.ts
+++ b/e2e/web/chat/compaction-checkpoint.spec.ts
@@ -24,7 +24,7 @@
  * fallback.
  */
 
-import { expect, test } from "../fixtures";
+import { expect, test } from "../../support/fixtures";
 import { seedCompaction } from "./seed-compaction";
 
 const ANSWER = "Mocked answer from the e2e model server.";
@@ -65,6 +65,12 @@ test.describe("compaction checkpoint (worker execution mode)", () => {
       throw new Error(`Could not extract chat id from URL: ${page.url()}`);
     }
 
+    // The first turn's "Reply ready" toast renders over the composer and
+    // intercepts the send click until it auto-dismisses. It is incidental to
+    // what this test asserts (compaction rendering), so wait it out rather
+    // than racing it — passes immediately when no toast is showing.
+    await expect(page.getByText(/Reply ready/)).toBeHidden({ timeout: 15_000 });
+
     await page
       .getByPlaceholder("What would you like to know?")
       .fill("And what about next steps?");
@@ -80,7 +86,12 @@ test.describe("compaction checkpoint (worker execution mode)", () => {
       `${apiUrl}/api/v1/chats/${chatId}/messages`,
       { headers: { Authorization: `Bearer ${account.token}` } },
     );
-    expect(messagesResponse.ok()).toBe(true);
+    // Status in the message: a bare `.ok()` boolean turns any failure into
+    // "expected true, received false" with no clue whether it was 401, 429, …
+    expect(
+      messagesResponse.ok(),
+      `GET messages failed with ${messagesResponse.status()}`,
+    ).toBe(true);
     const { messages } = (await messagesResponse.json()) as {
       messages: Array<{ seq: number }>;
     };
@@ -102,12 +113,28 @@ test.describe("compaction checkpoint (worker execution mode)", () => {
     // convention — see compaction-boundary.tsx's formatTokenCount).
     await expect(checkpoint.getByText(/saved 58\.6k tokens/)).toBeVisible();
 
-    await checkpoint.click();
-
+    // After a hard reload the SSR HTML is visible (and passes Playwright's
+    // actionability checks) well before React hydrates it, and a click that
+    // lands in that window is silently swallowed — the chip's onClick isn't
+    // attached yet. CI's loaded runner loses that race deterministically
+    // (trace: the hydration pass logged AFTER the click dispatched), so
+    // retry the click until the disclosure actually happens instead of
+    // racing hydration once.
+    //
     // Design's inline disclosure (not a modal): the card renders directly
     // below the chip, in the normal message flow, with the real compression
     // stats (not the timestamp fallback, since usage was seeded).
-    await expect(page.getByText("Compaction result")).toBeVisible();
+    await expect(async () => {
+      // The chip is a toggle: only click while collapsed, so a retry can
+      // re-attempt a swallowed click but never close a disclosure that a
+      // previous attempt already opened.
+      if ((await checkpoint.getAttribute("aria-expanded")) !== "true") {
+        await checkpoint.click();
+      }
+      await expect(page.getByText("Compaction result")).toBeVisible({
+        timeout: 2_000,
+      });
+    }).toPass({ timeout: 15_000 });
     await expect(
       page.getByText("71.4k → 12.8k tokens · e2e-mock"),
     ).toBeVisible();
diff --git a/e2e/chat/model-context-transparency.spec.ts b/e2e/web/chat/model-context-transparency.spec.ts
similarity index 95%
rename from e2e/chat/model-context-transparency.spec.ts
rename to e2e/web/chat/model-context-transparency.spec.ts
index 3341c3ca..42f7c26e 100644
--- a/e2e/chat/model-context-transparency.spec.ts
+++ b/e2e/web/chat/model-context-transparency.spec.ts
@@ -8,7 +8,7 @@
  * to rebuild after every hidden context artifact exists.
  */
 
-import { expect, test } from "../fixtures";
+import { expect, test } from "../../support/fixtures";
 import { seedCompaction } from "./seed-compaction";
 
 const ANSWER = "Mocked answer from the e2e model server.";
@@ -152,7 +152,12 @@ test.describe("model-context transparency (browser, full stack)", () => {
       `${apiUrl}/api/v1/chats/${chatId}/messages`,
       { headers: { Authorization: `Bearer ${account.token}` } },
     );
-    expect(messagesResponse.ok()).toBe(true);
+    // Status in the message: a bare `.ok()` boolean turns any failure into
+    // "expected true, received false" with no clue whether it was 401, 429, …
+    expect(
+      messagesResponse.ok(),
+      `GET messages failed with ${messagesResponse.status()}`,
+    ).toBe(true);
     const { messages } = (await messagesResponse.json()) as {
       messages: Array<{ seq: number }>;
     };
diff --git a/e2e/chat/seed-compaction.ts b/e2e/web/chat/seed-compaction.ts
similarity index 98%
rename from e2e/chat/seed-compaction.ts
rename to e2e/web/chat/seed-compaction.ts
index 385c234b..96c6a46e 100644
--- a/e2e/chat/seed-compaction.ts
+++ b/e2e/web/chat/seed-compaction.ts
@@ -22,7 +22,7 @@ export type SeedCompactionUsage = {
  * (an older/seeded-without-usage compaction shows a relative timestamp
  * instead).
  *
- * The normal throwaway-DB path mirrors e2e/db-server.ts's own
+ * The normal throwaway-DB path mirrors e2e/support/db-server.ts's own
  * `docker exec ... psql` idiom and connects as the `postgres` superuser. When
  * Playwright is pointed at an existing POSTGRES_URL, it instead invokes the
  * local `psql` client as that URL's app role and requires ownerUserId so the
diff --git a/e2e/chat/tool-loop.spec.ts b/e2e/web/chat/tool-loop.spec.ts
similarity index 91%
rename from e2e/chat/tool-loop.spec.ts
rename to e2e/web/chat/tool-loop.spec.ts
index 209b8d31..50dd57b8 100644
--- a/e2e/chat/tool-loop.spec.ts
+++ b/e2e/web/chat/tool-loop.spec.ts
@@ -4,7 +4,7 @@
  *
  * The whole stack: the mock model emits an OpenAI-compatible tool call → the
  * api's real AI SDK tool loop executes `search_conversations` (D7's ONE
- * shipped tool: own-data, read-only, real DB search — see e2e/model-server.ts)
+ * shipped tool: own-data, read-only, real DB search — see e2e/support/model-server.ts)
  * → run_events persist the tool parts (`type: "tool-search_conversations"`)
  * → the stream bridge translates them to UI parts → useChat parses them →
  * `ToolCallPart` renders. The render path is the seam the unit/integration
@@ -35,7 +35,7 @@
  * fallback for an impractical-to-seed e2e scenario.
  */
 
-import { expect, test } from "../fixtures";
+import { expect, test } from "../../support/fixtures";
 
 const TOOL_ANSWER = "Here are the past conversations I found.";
 
@@ -60,8 +60,9 @@ test.describe("tool-calling loop (browser, full stack)", () => {
     });
 
     // The tool resolved (state reached output-available): the chip's badge
-    // reads "done".
-    await expect(log.getByText("done")).toBeVisible({ timeout: 20_000 });
+    // reads "Completed" (AI Elements Tool chip vocabulary — the pre-#239
+    // ToolCallPart chip said "done"; the stale string kept this suite red).
+    await expect(log.getByText("Completed")).toBeVisible({ timeout: 20_000 });
 
     // The follow-up answer (second turn, after the tool result reached the
     // model) streams in.
@@ -89,7 +90,7 @@ test.describe("tool-calling loop (browser, full stack)", () => {
     // Wait for the tool activity to resolve, then for the first token of the
     // slow-dripping follow-up answer — confirms we're mid-run, not
     // post-completion, before reloading.
-    await expect(log.getByText("done")).toBeVisible({ timeout: 20_000 });
+    await expect(log.getByText("Completed")).toBeVisible({ timeout: 20_000 });
     await expect(log.getByText("Here", { exact: false })).toBeVisible({
       timeout: 20_000,
     });
@@ -100,7 +101,7 @@ test.describe("tool-calling loop (browser, full stack)", () => {
     // refresh (still shows as done, not re-executed/re-triggered — no
     // second "search_conversations" chip appears), and the answer completes.
     await expect(log.getByText("search_conversations")).toHaveCount(1);
-    await expect(log.getByText("done")).toBeVisible({ timeout: 10_000 });
+    await expect(log.getByText("Completed")).toBeVisible({ timeout: 10_000 });
     await expect(log.getByText(TOOL_ANSWER)).toBeVisible({ timeout: 25_000 });
   });
 
@@ -127,7 +128,7 @@ test.describe("tool-calling loop (browser, full stack)", () => {
     await expect(log.getByText("search_conversations")).toBeVisible({
       timeout: 15_000,
     });
-    await expect(log.getByText("done")).toBeVisible({ timeout: 15_000 });
+    await expect(log.getByText("Completed")).toBeVisible({ timeout: 15_000 });
     await expect(log.getByText(TOOL_ANSWER)).toBeVisible({ timeout: 15_000 });
   });
 });
diff --git a/e2e/org-units/org-units.spec.ts b/e2e/web/org-units/org-units.spec.ts
similarity index 89%
rename from e2e/org-units/org-units.spec.ts
rename to e2e/web/org-units/org-units.spec.ts
index 5404b23b..479b7836 100644
--- a/e2e/org-units/org-units.spec.ts
+++ b/e2e/web/org-units/org-units.spec.ts
@@ -27,7 +27,7 @@
  * placeholder only.
  */
 
-import { expect, loginViaUi, test } from "../fixtures";
+import { expect, loginViaUi, test } from "../../support/fixtures";
 
 test.describe("org-units admin UI", () => {
   test("redirect → create → nest → rename → move → delete", async ({
@@ -35,19 +35,18 @@ test.describe("org-units admin UI", () => {
     freshAccount,
   }) => {
     // Every Dialog/AlertDialog content in @workspace/ui carries a CSS exit
-    // animation driven by Radix's data-state attribute (dialog.tsx,
-    // alert-dialog.tsx both use `data-[state=closed]:animate-out`). Radix
-    // keeps the closing element's role intact while it fades out, so a
-    // still-animating-out surface (e.g. a create dialog whose close hasn't
-    // finished) can transiently coexist in the DOM with the next one this
-    // test opens — an unscoped getByRole/getByLabel can then resolve to both
-    // and hit Playwright's strict-mode violation. These helpers scope every
-    // such interaction to the currently OPEN instance specifically (not just
-    // "a dialog"), which stays correct even if a closing sibling briefly
-    // lingers.
-    const openDialog = () => page.locator('[role="dialog"][data-state="open"]');
+    // animation, and the closing element keeps its role while it fades out,
+    // so a still-animating-out surface (e.g. a create dialog whose close
+    // hasn't finished) can transiently coexist in the DOM with the next one
+    // this test opens — an unscoped getByRole/getByLabel can then resolve to
+    // both and hit Playwright's strict-mode violation. These helpers scope
+    // every such interaction to the currently OPEN instance specifically.
+    // Base UI marks open state with the `data-open` attribute — NOT Radix's
+    // `data-state="open"`, which silently matches nothing since the #238
+    // migration (this exact selector kept this suite red for 10 days).
+    const openDialog = () => page.locator('[role="dialog"][data-open]');
     const openAlertDialog = () =>
-      page.locator('[role="alertdialog"][data-state="open"]');
+      page.locator('[role="alertdialog"][data-open]');
 
     const row = (name: string) =>
       page.getByRole("treeitem", { name, exact: true });
diff --git a/lefthook.yml b/lefthook.yml
index ee8fdb61..f3e4e9f6 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -35,6 +35,6 @@ pre-commit:
     # an unparseable file to `prettier --check` explicitly exits 2); prettier's
     # own .prettierignore still skips any staged generated/vendored path.
     - name: format (prettier)
-      glob: "*.{ts,tsx,js,jsx,mjs,cjs,md,mdx,json,jsonc,css,scss,yaml,yml,html}"
+      glob: "*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,md,mdx,json,jsonc,css,scss,yaml,yml,html}"
       files: git diff --name-only --cached --diff-filter=ACMR
       run: pnpm exec prettier --check --cache --no-error-on-unmatched-pattern {files}
diff --git a/package.json b/package.json
index 3f2ff664..cb499c9d 100644
--- a/package.json
+++ b/package.json
@@ -40,6 +40,6 @@
   },
   "packageManager": "pnpm@10.34.4",
   "engines": {
-    "node": ">=22.12"
+    "node": ">=22.19"
   }
 }
diff --git a/packages/ui/AGENTS.md b/packages/ui/AGENTS.md
index 97d7dd3d..450b97c7 100644
--- a/packages/ui/AGENTS.md
+++ b/packages/ui/AGENTS.md
@@ -57,7 +57,7 @@ Because it lives in the generated file, this documentation is **overwritten when
 
 ### Stories for vendored components
 
-Every vendored component SHOULD have stories, and each story carries **provenance tags** so the Storybook AI manifest (and a human reviewer) can tell where it came from. Tags go on the **individual story**, not on `meta` — `meta.tags` holds only `["autodocs"]` (file-level). The two provenance tags are **orthogonal** — one marks who _authored_ the story, the other marks where its _rendered output_ came from:
+Stories with play functions ARE this repo's component-test layer (docs/testing.md) — interaction, a11y, and visual coverage all hang off them, so a component without stories is an untested component. Every vendored component SHOULD have stories, and each story carries **provenance tags** so the Storybook AI manifest (and a human reviewer) can tell where it came from. Tags go on the **individual story**, not on `meta` — `meta.tags` holds only `["autodocs"]` (file-level). The two provenance tags are **orthogonal** — one marks who _authored_ the story, the other marks where its _rendered output_ came from:
 
 - **`"ai-generated"` — mandatory on every story an agent writes.** It marks that an AI authored the story, for human review. An agent MUST tag every story it creates with this (in that story's own `tags`) and MUST NOT remove it — even when correcting or restyling an existing story. **Only a human may drop `"ai-generated"` or author a story without it**, which is what signals human authorship.
 - **`"shadcn-example"`** — orthogonal to `ai-generated`, **not** mutually exclusive: it marks the story's **rendered output** as transcribed from the component's own shadcn docs example, adapted **only** for import paths, our `lucide` icon library (upstream sometimes uses `@tabler/icons-react`), framework primitives (`next/link` → a plain `<a>`), and the minimum needed to satisfy our stricter a11y gate (e.g. an `aria-label` an icon-only example omits). Any `play`/interaction test is our own overlay and does not change it. Every such story links its docs anchor (see below).
diff --git a/playwright.config.ts b/playwright.config.ts
index 2559da26..cafc9f89 100644
--- a/playwright.config.ts
+++ b/playwright.config.ts
@@ -81,7 +81,7 @@ export default defineConfig({
       ? [
           {
             name: "db",
-            command: "node --import tsx e2e/db-server.ts",
+            command: "node --import tsx e2e/support/db-server.ts",
             env: webServerEnv({
               E2E_DB_PORT: dbPort,
               E2E_DB_READY_PORT: dbReadyPort,
@@ -104,7 +104,7 @@ export default defineConfig({
       // Deterministic OpenAI-compatible mock (#80): the api streams real
       // answers through the real loop with zero provider spend.
       name: "model",
-      command: "node --import tsx e2e/model-server.ts",
+      command: "node --import tsx e2e/support/model-server.ts",
       env: webServerEnv({ E2E_MODEL_PORT: modelPort }),
       url: `http://localhost:${modelPort}/ready`,
       timeout: 30_000,
@@ -115,7 +115,7 @@ export default defineConfig({
     {
       name: "api",
       command: startDatabase
-        ? `node --import tsx e2e/run-after-ready.ts ${dbReadyUrl} pnpm --filter api dev`
+        ? `node --import tsx e2e/support/run-after-ready.ts ${dbReadyUrl} pnpm --filter api dev`
         : "pnpm --filter api dev",
       env: webServerEnv({
         NODE_ENV: "development",
@@ -123,22 +123,23 @@ export default defineConfig({
         POSTGRES_URL: postgresUrl,
         WEB_ORIGIN: webUrl,
         SESSION_COOKIE_DOMAIN: "",
-        // Chat browser flows (#80) run against the mock model server, and the
-        // whole browser suite runs in worker execution mode — the durability
-        // architecture (#48/#50) soaks under every UI interaction, and the
-        // resume flow (#49) is testable end-to-end.
+        // Chat flows run against the mock model server through the real
+        // pg-boss queue; its e2e concurrency lives in llame.config.e2e.json.
         OPENAI_API_KEY: "e2e-mock-key",
         // Many parallel browser workers register + log in from one IP; the
-        // production-strict per-IP auth throttle would starve the fixtures.
+        // production-strict per-IP throttles would starve the fixtures. The
+        // auth ceiling covers /auth/v1 register+login; the API ceiling covers
+        // everything else (page loads, history fetches, run polling), which
+        // the whole matrix shares from localhost.
         AUTH_RATE_LIMIT_PER_MINUTE: "1000",
+        API_RATE_LIMIT_PER_MINUTE: "100000",
         OPENAI_BASE_URL: `http://localhost:${modelPort}/v1`,
         // Operator settings (model ids) come from the instance config file —
         // bare env vars are not a config source (instance-config, #166).
         LLAME_CONFIG_PATH: path.resolve(
           __dirname,
-          "e2e/fixtures/llame.config.e2e.json",
+          "e2e/support/fixtures/llame.config.e2e.json",
         ),
-        RUN_EXECUTION_MODE: "worker",
       }),
       url: apiUrl,
       timeout: 120_000,
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6f9036f7..53108549 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -213,12 +213,12 @@ importers:
       '@swc/core':
         specifier: ^1.10.7
         version: 1.13.2
+      '@testcontainers/postgresql':
+        specifier: 12.0.4
+        version: 12.0.4
       '@types/express':
         specifier: ^5.0.0
         version: 5.0.3
-      '@types/jest':
-        specifier: ^29.5.14
-        version: 29.5.14
       '@types/node':
         specifier: 'catalog:'
         version: 22.16.5
@@ -234,9 +234,6 @@ importers:
       drizzle-kit:
         specifier: ^0.31.4
         version: 0.31.4
-      jest:
-        specifier: ^29.7.0
-        version: 29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
       oxlint:
         specifier: 'catalog:'
         version: 1.72.0(oxlint-tsgolint@0.24.0)
@@ -252,24 +249,18 @@ importers:
       supertest:
         specifier: ^7.0.0
         version: 7.1.4
-      ts-jest:
-        specifier: ^29.2.5
-        version: 29.4.0(@babel/core@7.28.0)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.28.0))(esbuild@0.25.5)(jest-util@29.7.0)(jest@29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)))(typescript@5.7.3)
-      ts-loader:
-        specifier: ^9.5.2
-        version: 9.5.2(typescript@5.7.3)(webpack@5.100.2(@swc/core@1.13.2)(esbuild@0.25.5))
-      ts-node:
-        specifier: ^10.9.2
-        version: 10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)
-      tsconfig-paths:
-        specifier: ^4.2.0
-        version: 4.2.0
       tsx:
         specifier: 'catalog:'
         version: 4.20.3
       typescript:
         specifier: 'catalog:'
         version: 5.7.3
+      unplugin-swc:
+        specifier: 1.5.9
+        version: 1.5.9(@swc/core@1.13.2)(rollup@4.62.2)
+      vitest:
+        specifier: 'catalog:'
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.16.5)(@vitest/browser-playwright@4.1.10)(jsdom@28.1.0(@noble/hashes@1.8.0))(vite@6.4.3(@types/node@22.16.5)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.43.1)(tsx@4.20.3)(yaml@2.8.0))
 
   apps/storybook:
     dependencies:
@@ -719,10 +710,6 @@ packages:
     resolution: {integrity: sha512-UlLAnTPrFdNGoFtbSXwcGFQBtQZJCNjaN6hQNP3UPvuNXT1i82N26KL3dZeIpNalWywr9IuQuncaAfUaS1g6sQ==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/generator@7.28.0':
-    resolution: {integrity: sha512-lJjzvrbEeWrhB4P3QBsH7tey117PjLZnDbLiQEKjQ/fNJTjuq4HSqgFA+UNSwZT8D7dxxbnuSBMsa1lrWzKlQg==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/generator@7.29.7':
     resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
     engines: {node: '>=6.9.0'}
@@ -806,103 +793,12 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  '@babel/plugin-syntax-async-generators@7.8.4':
-    resolution: {integrity: sha512-tycmZxkGfZaxhMRbXlPXuVFpdWlXpir2W4AMhSJgRKzk/eDlIXOhb2LHWoLpDF7TEHylV5zNhykX6KAgHJmTNw==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-bigint@7.8.3':
-    resolution: {integrity: sha512-wnTnFlG+YxQm3vDxpGE57Pj0srRU4sHE/mDkt1qv2YJJSeUAec2ma4WLUnUPeKjyrfntVwe/N6dCXpU+zL3Npg==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-class-properties@7.12.13':
-    resolution: {integrity: sha512-fm4idjKla0YahUNgFNLCB0qySdsoPiZP3iQE3rky0mBUtMZ23yDJ9SJdg6dXTSDnulOVqiF3Hgr9nbXvXTQZYA==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-class-static-block@7.14.5':
-    resolution: {integrity: sha512-b+YyPmr6ldyNnM6sqYeMWE+bgJcJpO6yS4QD7ymxgH34GBPNDM/THBh8iunyvKIZztiwLH4CJZ0RxTk9emgpjw==}
-    engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-import-attributes@7.27.1':
-    resolution: {integrity: sha512-oFT0FrKHgF53f4vOsZGi2Hh3I35PfSmVs4IBFLFj4dnafP+hIWDLg3VyKmUHfLoLHlyxY4C7DGtmHuJgn+IGww==}
-    engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-import-meta@7.10.4':
-    resolution: {integrity: sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-json-strings@7.8.3':
-    resolution: {integrity: sha512-lY6kdGpWHvjoe2vk4WrAapEuBR69EMxZl+RoGRhrFGNYVK8mOPAW8VfbT/ZgrFbXlDNiiaxQnAtgVCZ6jv30EA==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-jsx@7.27.1':
-    resolution: {integrity: sha512-y8YTNIeKoyhGd9O0Jiyzyyqk8gdjnumGTQPsz0xOZOQ2RmkVJeZ1vmmfIvFEKqucBG6axJGBZDE/7iI5suUI/w==}
-    engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
   '@babel/plugin-syntax-jsx@7.29.7':
     resolution: {integrity: sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
-  '@babel/plugin-syntax-logical-assignment-operators@7.10.4':
-    resolution: {integrity: sha512-d8waShlpFDinQ5MtvGU9xDAOzKH47+FFoney2baFIoMr952hKOLp1HR7VszoZvOsV/4+RRszNY7D17ba0te0ig==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3':
-    resolution: {integrity: sha512-aSff4zPII1u2QD7y+F8oDsz19ew4IGEJg9SVW+bqwpwtfFleiQDMdzA/R+UlWDzfnHFCxxleFT0PMIrR36XLNQ==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-numeric-separator@7.10.4':
-    resolution: {integrity: sha512-9H6YdfkcK/uOnY/K7/aA2xpzaAgkQn37yzWUMRK7OaPOqOpGS1+n0H5hxT9AUw9EsSjPW8SVyMJwYRtWs3X3ug==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-object-rest-spread@7.8.3':
-    resolution: {integrity: sha512-XoqMijGZb9y3y2XskN+P1wUGiVwWZ5JmoDRwx5+3GmEplNyVM2s2Dg8ILFQm8rWM48orGy5YpI5Bl8U1y7ydlA==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-optional-catch-binding@7.8.3':
-    resolution: {integrity: sha512-6VPD0Pc1lpTqw0aKoeRTMiB+kWhAoT24PA+ksWSBrFtl5SIRVpZlwN3NNPQjehA2E/91FV3RjLWoVTglWcSV3Q==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-optional-chaining@7.8.3':
-    resolution: {integrity: sha512-KoK9ErH1MBlCPxV0VANkXW2/dw4vlbGDrFgz8bmUsBGYkFRcbRwMh6cIJubdPrkxRwuGdtCk0v/wPTKbQgBjkg==}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-private-property-in-object@7.14.5':
-    resolution: {integrity: sha512-0wVnp9dxJ72ZUJDV27ZfbSj6iHLoytYZmh3rFcxNnvsJF3ktkzLDZPy/mA17HGsaQT3/DQsWYX1f1QGWkCoVUg==}
-    engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-top-level-await@7.14.5':
-    resolution: {integrity: sha512-hx++upLv5U1rgYfwe1xBQUhRmU41NEvpUvrp8jkrSCdvGSnM5/qdRMtylJ6PG5OFkBaHkbTAKTnd3/YyESRHFw==}
-    engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
-  '@babel/plugin-syntax-typescript@7.27.1':
-    resolution: {integrity: sha512-xfYCBMxveHrRMnAWl1ZlPXOZjzkN82THFvLhQhFXFt81Z5HnN+EtUkZhv/zcKpmT3fzmWZB0ywiBrbC3vogbwQ==}
-    engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0-0
-
   '@babel/plugin-syntax-typescript@7.29.7':
     resolution: {integrity: sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==}
     engines: {node: '>=6.9.0'}
@@ -947,6 +843,9 @@ packages:
     resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
     engines: {node: '>=6.9.0'}
 
+  '@balena/dockerignore@1.0.2':
+    resolution: {integrity: sha512-wMue2Sy4GAVTk6Ic4tJVcnfdau+gx2EnG7S+uAEe+TWJFqE4YoWN4/H8MSLj4eYJKxGg26lZwboEniNiNwZQ6Q==}
+
   '@base-ui/react@1.6.0':
     resolution: {integrity: sha512-/jzjTWJYXhRFO45Bev9lc3cHbmjzCMpUqbMZ2AgKy/z25mY9B6shGSNcXcjQar9n5doM0KYW1W8fcFv2jZBuMw==}
     engines: {node: '>=14.0.0'}
@@ -974,9 +873,6 @@ packages:
       '@types/react':
         optional: true
 
-  '@bcoe/v8-coverage@0.2.3':
-    resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==}
-
   '@blazediff/core@1.9.1':
     resolution: {integrity: sha512-ehg3jIkYKulZh+8om/O25vkvSsXXwC+skXmyA87FFx6A/45eqOkZsBltMw/TVteb0mloiGT8oGRTcjRAz66zaA==}
 
@@ -994,10 +890,6 @@ packages:
     resolution: {integrity: sha512-ooWCrlZP11i8GImSjTHYHLkvFDP48nS4+204nGb1RiX/WXYHmJA2III9/e2DWVabCESdW7hBAEzHRqUn9OUVvQ==}
     engines: {node: '>=0.1.90'}
 
-  '@cspotcode/source-map-support@0.8.1':
-    resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==}
-    engines: {node: '>=12'}
-
   '@csstools/color-helpers@6.1.0':
     resolution: {integrity: sha512-064IFJdjTfUqnjpCVpMOdbr8FLQBhinbZj6yRv2An2E41O/pLEXqfFRWqGq/SxlE5PEUYTlvWsG2r8MswAVvkg==}
     engines: {node: '>=20.19.0'}
@@ -1532,6 +1424,20 @@ packages:
   '@floating-ui/utils@0.2.12':
     resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==}
 
+  '@grpc/grpc-js@1.14.4':
+    resolution: {integrity: sha512-k9Dj3DV/itK9D06Y8f190Qgop7/Ui+D0njFV3LHMPwPT75DpXLQohE9Wmz0QElrJnzsjB7KPWiKJbOl7IPDArQ==}
+    engines: {node: '>=12.10.0'}
+
+  '@grpc/proto-loader@0.7.15':
+    resolution: {integrity: sha512-tMXdRCfYVixjuFK+Hk0Q1s38gV9zDiDJfWL3h1rv4Qc39oILCu1TRTDt7+fGUI8K4G1Fj125Hx/ru3azECWTyQ==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  '@grpc/proto-loader@0.8.1':
+    resolution: {integrity: sha512-wtF6h+DY6M3YaDBPAmvuuA6jV8Sif9MjtOI5euKFWRgCDl5PeDpPsHR9u2l6St5ceY8AZgoNDww5+HvEsXFsGg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
   '@hono/node-server@1.19.14':
     resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
     engines: {node: '>=18.14.1'}
@@ -1844,80 +1750,6 @@ packages:
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
 
-  '@istanbuljs/load-nyc-config@1.1.0':
-    resolution: {integrity: sha512-VjeHSlIzpv/NyD3N0YuHfXOPDIixcA1q2ZV98wsMqcYlPmv2n3Yb2lYP9XMElnaFVXg5A7YLTeLu6V84uQDjmQ==}
-    engines: {node: '>=8'}
-
-  '@istanbuljs/schema@0.1.3':
-    resolution: {integrity: sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==}
-    engines: {node: '>=8'}
-
-  '@jest/console@29.7.0':
-    resolution: {integrity: sha512-5Ni4CU7XHQi32IJ398EEP4RrB8eV09sXP2ROqD4bksHrnTree52PsxvX8tpL8LvTZ3pFzXyPbNQReSN41CAhOg==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/core@29.7.0':
-    resolution: {integrity: sha512-n7aeXWKMnGtDA48y8TLWJPJmLmmZ642Ceo78cYWEpiD7FzDgmNDV/GCVRorPABdXLJZ/9wzzgZAlHjXjxDHGsg==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-    peerDependencies:
-      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
-    peerDependenciesMeta:
-      node-notifier:
-        optional: true
-
-  '@jest/environment@29.7.0':
-    resolution: {integrity: sha512-aQIfHDq33ExsN4jP1NWGXhxgQ/wixs60gDiKO+XVMd8Mn0NWPWgc34ZQDTb2jKaUWQ7MuwoitXAsN2XVXNMpAw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/expect-utils@29.7.0':
-    resolution: {integrity: sha512-GlsNBWiFQFCVi9QVSx7f5AgMeLxe9YCCs5PuP2O2LdjDAA8Jh9eX7lA1Jq/xdXw3Wb3hyvlFNfZIfcRetSzYcA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/expect@29.7.0':
-    resolution: {integrity: sha512-8uMeAMycttpva3P1lBHB8VciS9V0XAr3GymPpipdyQXbBcuhkLQOSe8E/p92RyAdToS6ZD1tFkX+CkhoECE0dQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/fake-timers@29.7.0':
-    resolution: {integrity: sha512-q4DH1Ha4TTFPdxLsqDXK1d3+ioSL7yL5oCMJZgDYm6i+6CygW5E5xVr/D1HdsGxjt1ZWSfUAs9OxSB/BNelWrQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/globals@29.7.0':
-    resolution: {integrity: sha512-mpiz3dutLbkW2MNFubUGUEVLkTGiqW6yLVTA+JbP6fI6J5iL9Y0Nlg8k95pcF8ctKwCS7WVxteBs29hhfAotzQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/reporters@29.7.0':
-    resolution: {integrity: sha512-DApq0KJbJOEzAFYjHADNNxAE3KbhxQB1y5Kplb5Waqw6zVbuWatSnMjE5gs8FUgEPmNsnZA3NCWl9NG0ia04Pg==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-    peerDependencies:
-      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
-    peerDependenciesMeta:
-      node-notifier:
-        optional: true
-
-  '@jest/schemas@29.6.3':
-    resolution: {integrity: sha512-mo5j5X+jIZmJQveBKeS/clAueipV7KgiX1vMgCxam1RNYiqE1w62n0/tJJnHtjW8ZHcQco5gY85jA3mi0L+nSA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/source-map@29.6.3':
-    resolution: {integrity: sha512-MHjT95QuipcPrpLM+8JMSzFx6eHp5Bm+4XeFDJlwsvVBjmKNiIAvasGK2fxz2WbGRlnvqehFbh07MMa7n3YJnw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/test-result@29.7.0':
-    resolution: {integrity: sha512-Fdx+tv6x1zlkJPcWXmMDAG2HBnaR9XPSd5aDWQVsfrZmLVT3lU1cwyxLgRmXR9yrq4NBoEm9BMsfgFzTQAbJYA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/test-sequencer@29.7.0':
-    resolution: {integrity: sha512-GQwJ5WZVrKnOJuiYiAF52UNUJXgTZx1NHjFSEB0qEMmSZKAkdMoIzw/Cj6x6NF4AvV23AUqDpFzQkN/eYCYTxw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/transform@29.7.0':
-    resolution: {integrity: sha512-ok/BTPFzFKVMwO5eOHRrvnBVHdRy9IrsrW1GpMaQ9MCnilNLXQKmAX8s1YXDFaai9xJpac2ySzV0YeRRECr2Vw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  '@jest/types@29.6.3':
-    resolution: {integrity: sha512-u3UPsIilWKOM3F9CXtrG8LEJmNxwoCQC/XVj4IKYXvvpx7QIi/Kg1LI5uDmDpKlac62NUtX7eLjRh+jVZcLOzw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
   '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0':
     resolution: {integrity: sha512-qvsTEwEFefhdirGOPnu9Wp6ChfIwy2dBCRuETU3uE+4cC+PFoxMSiiEhxk4lOluA34eARHA0OxqsEUYDqRMgeQ==}
     peerDependencies:
@@ -1949,8 +1781,8 @@ packages:
   '@jridgewell/trace-mapping@0.3.29':
     resolution: {integrity: sha512-uw6guiW/gcAGPDhLmd77/6lW8QLeiV5RUTsAX46Db6oLhGaVj4lhnPwb184s1bkc8kdVg/+h988dro8GRDpmYQ==}
 
-  '@jridgewell/trace-mapping@0.3.9':
-    resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==}
+  '@js-sdsl/ordered-map@4.4.2':
+    resolution: {integrity: sha512-iUKgm52T8HOE/makSxjqoWhe95ZJA1/G1sYsGev2JDKUSS14KAgg1LHb+Ba+IPow0xflbnSkOsZcO08C7w1gYw==}
 
   '@knaadh/nestjs-drizzle-postgres@1.2.0':
     resolution: {integrity: sha512-F6qFm8yh12uqex//GZsrTTuq1RnwgYYBzw2aWeyeoHMk0qbNP5eog7a8PlL/OLnfW1PX8kPAPWIxAdv5Am68+g==}
@@ -1959,6 +1791,9 @@ packages:
       drizzle-orm: '>=0.28.6'
       postgres: '>=3'
 
+  '@kwsites/file-exists@1.1.1':
+    resolution: {integrity: sha512-m9/5YGR18lIwxSFDwfE3oA7bWuq9kdau6ugN4H2rJeyhFQZcG9AgSHkQtSD15a8WvTgfz9aikZMrKPHvbpqFiw==}
+
   '@lukeed/csprng@1.1.0':
     resolution: {integrity: sha512-Z7C/xXCiGWsg0KuKsHTKJxbWhpI3Vs5GwLfOean7MGyVFGqdRgBbAjOCh6u4bbjPc/8MJ2pZmK/0DLdCbivLDA==}
     engines: {node: '>=8'}
@@ -2721,6 +2556,10 @@ packages:
   '@pinojs/redact@0.4.0':
     resolution: {integrity: sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==}
 
+  '@pkgjs/parseargs@0.11.0':
+    resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
+    engines: {node: '>=14'}
+
   '@playwright/test@1.55.1':
     resolution: {integrity: sha512-IVAh/nOJaw6W9g+RJVlIQJ6gSiER+ae6mKQ5CX1bERzQgbC1VSeBlwdvczT7pxb0GWiyrxH4TGKbMfDb4Sq/ig==}
     engines: {node: '>=18'}
@@ -2729,6 +2568,33 @@ packages:
   '@polka/url@1.0.0-next.29':
     resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
 
+  '@protobufjs/aspromise@1.1.2':
+    resolution: {integrity: sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==}
+
+  '@protobufjs/base64@1.1.2':
+    resolution: {integrity: sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==}
+
+  '@protobufjs/codegen@2.0.5':
+    resolution: {integrity: sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==}
+
+  '@protobufjs/eventemitter@1.1.1':
+    resolution: {integrity: sha512-vW1GmwMZNnL+gMRaovlh9yZX74kc+TTU3FObkkurpMaRtBfLP3ldjS9KQWlwZgraRE0+dheEEoAxdzcJQ8eXZg==}
+
+  '@protobufjs/fetch@1.1.1':
+    resolution: {integrity: sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==}
+
+  '@protobufjs/float@1.0.2':
+    resolution: {integrity: sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==}
+
+  '@protobufjs/path@1.1.2':
+    resolution: {integrity: sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==}
+
+  '@protobufjs/pool@1.1.0':
+    resolution: {integrity: sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==}
+
+  '@protobufjs/utf8@1.1.2':
+    resolution: {integrity: sha512-b1UQwcEZ4yCnMCD8DAL1VlbvBJE9/IX4FTIp7BG1xYpf29SLazLSrqUkj4w7Y5y7cCVP6E5tcqqcI0xemPkHug==}
+
   '@radix-ui/primitive@1.1.2':
     resolution: {integrity: sha512-XnbHrrprsNqZKQhStrSwgRUQzoCI1glLzdw79xiZPoofhGICeZRSQ3dIxAKH1gb3OHfNf4d6f+vAv3kil2eggA==}
 
@@ -2945,6 +2811,15 @@ packages:
       rollup:
         optional: true
 
+  '@rollup/pluginutils@5.4.0':
+    resolution: {integrity: sha512-MfPp06CjRLfXQ3wY0R8vJDYBy/MvVcc9OulEfR0B8Iv9ko+GCNaRZ+EpJYFl27LhKsZK0o420sYCRHCjfCgeUg==}
+    engines: {node: '>=14.0.0'}
+    peerDependencies:
+      rollup: ^1.20.0||^2.0.0||^3.0.0||^4.0.0
+    peerDependenciesMeta:
+      rollup:
+        optional: true
+
   '@rollup/rollup-android-arm-eabi@4.62.2':
     resolution: {integrity: sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==}
     cpu: [arm]
@@ -3257,9 +3132,6 @@ packages:
   '@shikijs/vscode-textmate@10.0.2':
     resolution: {integrity: sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==}
 
-  '@sinclair/typebox@0.27.8':
-    resolution: {integrity: sha512-+Fj43pSMwJs4KRrH/938Uf+uAELIgVBmQzg/q1YG10djyfA3TnrU8N8XzqCh/okZdszqBQTZf96idMfE5lnwTA==}
-
   '@sindresorhus/is@5.6.0':
     resolution: {integrity: sha512-TV7t8GKYaJWsn00tFDqBw8+Uqmr8A0fRU1tvTQhyZzGv0sJCGRQL3JGMI3ucuKo3XIZdUP+Lx7/gh2t3lewy7g==}
     engines: {node: '>=14.16'}
@@ -3268,12 +3140,6 @@ packages:
     resolution: {integrity: sha512-tlqY9xq5ukxTUZBmoOp+m61cqwQD5pHJtFY3Mn8CA8ps6yghLH/Hw8UPdqg4OLmFW3IFlcXnQNmo/dh8HzXYIQ==}
     engines: {node: '>=18'}
 
-  '@sinonjs/commons@3.0.1':
-    resolution: {integrity: sha512-K3mCHKQ9sVh8o1C9cxkwxaOmXoAMlDxC1mYyHrjqOWEcBjYr76t96zL2zlj5dUGZ3HSw240X1qgH3Mjf1yJWpQ==}
-
-  '@sinonjs/fake-timers@10.3.0':
-    resolution: {integrity: sha512-V4BG07kuYSUkTCSBHG8G8TNhM+F19jXFWnQtzj+we8DrkpSBCee9Z3Ms8yiGer/dlmhe35/Xdgyo3/0rQKg7YA==}
-
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
@@ -3629,6 +3495,9 @@ packages:
     peerDependencies:
       react: ^18 || ^19
 
+  '@testcontainers/postgresql@12.0.4':
+    resolution: {integrity: sha512-a/pLU6j5lpKKAlUTPwqweqMGhOSjgTSb6HBX69TOrXn32ifU37nnQDmNFTj8ddOAw+BQL9oTRkeOxVbZkqhgZA==}
+
   '@testing-library/dom@10.4.1':
     resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
     engines: {node: '>=18'}
@@ -3688,18 +3557,6 @@ packages:
   '@ts-morph/common@0.27.0':
     resolution: {integrity: sha512-Wf29UqxWDpc+i61k3oIOzcUfQt79PIT9y/MWfAGlrkjg6lBC1hwDECLXPVJAhWjiGbfBCxZd65F/LIZF3+jeJQ==}
 
-  '@tsconfig/node10@1.0.11':
-    resolution: {integrity: sha512-DcRjDCujK/kCk/cUe8Xz8ZSpm8mS3mNNpta+jGCA6USEDfktlNvm1+IuZ9eTcDbNk41BHwpHHeW+N1lKCz4zOw==}
-
-  '@tsconfig/node12@1.0.11':
-    resolution: {integrity: sha512-cqefuRsh12pWyGsIoBKJA9luFu3mRxCA+ORZvA4ktLSzIuCUtWVxGIuXigEwO5/ywWFMZ2QEGKWvkZG1zDMTag==}
-
-  '@tsconfig/node14@1.0.3':
-    resolution: {integrity: sha512-ysT8mhdixWK6Hw3i1V2AeRqZ5WfXg1G43mqoYlM2nc6388Fq5jcXyr5mRsqViLx/GJYdoL0bfXD8nmF+Zn/Iow==}
-
-  '@tsconfig/node16@1.0.4':
-    resolution: {integrity: sha512-vxhUy4J8lyeyinH7Azl1pdd43GJhZH/tP2weN8TntQblOY+A0XbT8DJk1/oCPuOOyg/Ja757rG0CgHcWC8OfMA==}
-
   '@turbo/darwin-64@2.10.4':
     resolution: {integrity: sha512-m1MUEI4MJ69r5CwfMYxmHi0H0rrgiYCBOp0tgBZ9x/YVvOb5uu/lRIDyDwdtH054R2yWeQaIigUGu6aCX9f8cA==}
     cpu: [x64]
@@ -3859,6 +3716,12 @@ packages:
   '@types/deep-eql@4.0.2':
     resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
 
+  '@types/docker-modem@3.0.6':
+    resolution: {integrity: sha512-yKpAGEuKRSS8wwx0joknWxsmLha78wNMe9R2S3UNsVOkZded8UqOrV8KoeDXoXsjndxwyF3eIhyClGbO1SEhEg==}
+
+  '@types/dockerode@4.0.1':
+    resolution: {integrity: sha512-cmUpB+dPN955PxBEuXE3f6lKO1hHiIGYJA46IVF3BJpNsZGvtBDcRnlrHYHtOH/B6vtDOyl2kZ2ShAu3mgc27Q==}
+
   '@types/doctrine@0.0.9':
     resolution: {integrity: sha512-eOIHzCUSH7SMfonMG1LsC2f8vxBFtho6NGBznK41R84YzPuvSBzrhEps33IsQiOW9+VL6NQ9DbjQJznk/S4uRA==}
 
@@ -3886,9 +3749,6 @@ packages:
   '@types/geojson@7946.0.16':
     resolution: {integrity: sha512-6C8nqWur3j98U6+lXDfTUWIfgvZU+EumvpHKcYjujKH7woYyLj2sUmff0tRhrqM7BohUw7Pz3ZB1jj2gW9Fvmg==}
 
-  '@types/graceful-fs@4.1.9':
-    resolution: {integrity: sha512-olP3sd1qOEe5dXTSaFvQG+02VdRXcdytWLAZsAq1PecU8uqQAhkrnbli7DagjtXKW/Bl7YJbUsa8MPcuc8LHEQ==}
-
   '@types/hast@3.0.4':
     resolution: {integrity: sha512-WPs+bbQw5aCj+x6laNGWLH3wviHtoCv/P3+otBhbOhJgG8qtpdAMlTCxLtsTWA7LH1Oh/bFCHsBn0TPS5m30EQ==}
 
@@ -3898,18 +3758,6 @@ packages:
   '@types/http-errors@2.0.5':
     resolution: {integrity: sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==}
 
-  '@types/istanbul-lib-coverage@2.0.6':
-    resolution: {integrity: sha512-2QF/t/auWm0lsy8XtKVPG19v3sSOQlJe/YHZgfjb/KBBHOGSV+J2q/S671rcq9uTBrLAXmZpqJiaQbMT+zNU1w==}
-
-  '@types/istanbul-lib-report@3.0.3':
-    resolution: {integrity: sha512-NQn7AHQnk/RSLOxrBbGyJM/aVQ+pjj5HCgasFxc0K/KhoATfQ/47AyUl15I2yBUpihjmas+a+VJBOqecrFH+uA==}
-
-  '@types/istanbul-reports@3.0.4':
-    resolution: {integrity: sha512-pk2B1NWalF9toCRu6gjBzR69syFjP4Od8WRAX+0mmf9lAjCRicLOWc+ZrxZHx/0XRjotgkF9t6iaMJ+aXcOdZQ==}
-
-  '@types/jest@29.5.14':
-    resolution: {integrity: sha512-ZN+4sdnLUbo8EVvVc2ao0GFW6oVrQRPn4K2lglySj7APvSrgzxHiNNK99us4WDMi57xxA2yggblIAMNhXOotLQ==}
-
   '@types/js-cookie@3.0.6':
     resolution: {integrity: sha512-wkw9yd1kEXOPnvEeEV1Go1MmxtBJL0RR79aOTAApecWFVu7w0NNXNqhcWgvw2YgZDYadliXkl14pa3WXw5jlCQ==}
 
@@ -3931,6 +3779,9 @@ packages:
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==}
 
+  '@types/node@18.19.130':
+    resolution: {integrity: sha512-GRaXQx6jGfL8sKfaIDD6OupbIHBr9jv7Jnaml9tB7l4v068PAOXqfcujMMo5PhbIs6ggR1XODELqahT2R8v0fg==}
+
   '@types/node@22.16.5':
     resolution: {integrity: sha512-bJFoMATwIGaxxx8VJPeM8TonI8t579oRvgAuT8zFugJsJZgzqv0Fu8Mhp68iecjzG7cnN3mO2dJQ5uUM2EFrgQ==}
 
@@ -3963,8 +3814,14 @@ packages:
   '@types/serve-static@1.15.8':
     resolution: {integrity: sha512-roei0UY3LhpOJvjbIP6ZZFngyLKl5dskOtDhxY5THRSpO+ZI+nzJ+m5yUMzGrp89YRa7lvknKkMYjqQFGwA7Sg==}
 
-  '@types/stack-utils@2.0.3':
-    resolution: {integrity: sha512-9aEbYZ3TbYMznPdcdr3SmIrLXwC/AKZXQeCf9Pgao5CKb8CyHuEX5jzWPTkvregvhRJHcpRO6BFoGW9ycaOkYw==}
+  '@types/ssh2-streams@0.1.13':
+    resolution: {integrity: sha512-faHyY3brO9oLEA0QlcO8N2wT7R0+1sHWZvQ+y3rMLwdY1ZyS1z0W3t65j9PqT4HmQ6ALzNe7RZlNuCNE0wBSWA==}
+
+  '@types/ssh2@0.5.52':
+    resolution: {integrity: sha512-lbLLlXxdCZOSJMCInKH2+9V/77ET2J6NPQHpFI0kda61Dd1KglJs+fPQBchizmzYSOJBgdTajhPqBO1xxLywvg==}
+
+  '@types/ssh2@1.15.5':
+    resolution: {integrity: sha512-N1ASjp/nXH3ovBHddRJpli4ozpk6UdDYIX4RJWFa9L1YKnzdhTlVmiGHm4DZnj/jLbqZpes4aeR30EFGQtvhQQ==}
 
   '@types/superagent@8.1.9':
     resolution: {integrity: sha512-pTVjI73witn+9ILmoJdajHGW2jkSaOzhiFYF1Rd3EQ94kymLqB9PjD9ISg7WaALC7+dCHT0FGe9T2LktLq/3GQ==}
@@ -3990,12 +3847,6 @@ packages:
   '@types/validator@13.15.10':
     resolution: {integrity: sha512-T8L6i7wCuyoK8A/ZeLYt1+q0ty3Zb9+qbSSvrIVitzT3YjZqkTZ40IbRsPanlB4h1QB3JVL1SYCdR6ngtFYcuA==}
 
-  '@types/yargs-parser@21.0.3':
-    resolution: {integrity: sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==}
-
-  '@types/yargs@17.0.33':
-    resolution: {integrity: sha512-WpxBCKWPLr4xSsHgz511rFJAM+wS28w2zEO1QDNY5zM/S8ok70NNfztH0xwhqKyaK0OHCbN98LDAZuy1ctxDkA==}
-
   '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260703.1':
     resolution: {integrity: sha512-EwJEd6hfaHrrbSLat6+xX8fZiAvG+/Ae1gqvJEayTNdDbkrZxmeLS23YdjUmDMIOKI2wa7zXQDid8WtrvDfMTQ==}
     engines: {node: '>=16.20.0'}
@@ -4214,6 +4065,10 @@ packages:
   '@xtuc/long@4.2.2':
     resolution: {integrity: sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==}
 
+  abort-controller@3.0.0:
+    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
+    engines: {node: '>=6.5'}
+
   accepts@2.0.0:
     resolution: {integrity: sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng==}
     engines: {node: '>= 0.6'}
@@ -4229,10 +4084,6 @@ packages:
     peerDependencies:
       acorn: ^8.14.0
 
-  acorn-walk@8.3.4:
-    resolution: {integrity: sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g==}
-    engines: {node: '>=0.4.0'}
-
   acorn@8.15.0:
     resolution: {integrity: sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==}
     engines: {node: '>=0.4.0'}
@@ -4319,21 +4170,19 @@ packages:
     resolution: {integrity: sha512-BGcItUBWSMRgOCe+SVZJ+S7yTRG0eGt9cXAHev72yuGcY23hnLA7Bky5L/xLyPINoSN95geovfBkqoTlNZYa7w==}
     engines: {node: '>=14'}
 
-  anymatch@3.1.3:
-    resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
-    engines: {node: '>= 8'}
-
   append-field@1.0.0:
     resolution: {integrity: sha512-klpgFSWLW1ZEs8svjfb7g4qWY0YS5imI82dTg+QahUvJ8YqAY0P10Uk8tTyh9ZGuYEZEMaeJYCF5BFuX552hsw==}
 
   arch@3.0.0:
     resolution: {integrity: sha512-AmIAC+Wtm2AU8lGfTtHsw0Y9Qtftx2YXEEtiBP10xFUtMOA+sHHx6OAddyL52mUKh1vsXQ6/w1mVDptZCyUt4Q==}
 
-  arg@4.1.3:
-    resolution: {integrity: sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==}
+  archiver-utils@5.0.2:
+    resolution: {integrity: sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA==}
+    engines: {node: '>= 14'}
 
-  argparse@1.0.10:
-    resolution: {integrity: sha512-o5Roy6tNG4SL/FOkCAN6RzjiakZS25RLYFrcMttJqbdd8BWrnA+fGz57iN5Pb06pvBGvl5gQ0B48dJlslXvoTg==}
+  archiver@7.0.1:
+    resolution: {integrity: sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==}
+    engines: {node: '>= 14'}
 
   argparse@2.0.1:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
@@ -4351,6 +4200,9 @@ packages:
   asap@2.0.6:
     resolution: {integrity: sha512-BSHWgDSAiKs50o2Re8ppvp3seVHXSRM44cdSsT9FfNEUUZLOGWVCsiWaRPWM1Znn+mqZ1OfVZ3z3DWEzSp7hRA==}
 
+  asn1@0.2.6:
+    resolution: {integrity: sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==}
+
   assertion-error@2.0.1:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
@@ -4363,6 +4215,9 @@ packages:
     resolution: {integrity: sha512-LElXdjswlqjWrPpJFg1Fx4wpkOCxj1TDHlSV4PlaRxHGWko024xICaa97ZkMfs6DRKlCguiAI+rbXv5GWwXIkg==}
     hasBin: true
 
+  async-lock@1.4.1:
+    resolution: {integrity: sha512-Az2ZTpuytrtqENulXwO3GGv1Bztugx6TT37NIo7imr/Qo0gsYiGtSdBa2B6fsXhTpVZDNfu1Qn3pk531e3q+nQ==}
+
   async@3.2.6:
     resolution: {integrity: sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
 
@@ -4384,30 +4239,13 @@ packages:
   b4a@1.6.7:
     resolution: {integrity: sha512-OnAYlL5b7LEkALw87fUVafQw5rVR9RjwGd4KUwNQ6DrrNmaVaUCgLipfVlzrPQ4tWOR9P0IXGNOx50jYCCdSJg==}
 
-  babel-jest@29.7.0:
-    resolution: {integrity: sha512-BrvGY3xZSwEcCzKvKsCi2GgHqDqsYkOP4/by5xCgIwGXQxIEh+8ew3gmrE1y7XRR6LHZIj6yLYnUi/mm2KXKBg==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-    peerDependencies:
-      '@babel/core': ^7.8.0
-
-  babel-plugin-istanbul@6.1.1:
-    resolution: {integrity: sha512-Y1IQok9821cC9onCx5otgFfRm7Lm+I+wwxOx738M/WLPZ9Q42m4IG5W0FNX8WLL2gYMZo3JkuXIH2DOpWM+qwA==}
-    engines: {node: '>=8'}
-
-  babel-plugin-jest-hoist@29.6.3:
-    resolution: {integrity: sha512-ESAc/RJvGTFEzRwOTT4+lNDk/GNHMkKbNzsvT0qKRfDyyYTskxB5rnU2njIDYVxXCBHHEI1c0YwHob3WaYujOg==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  babel-preset-current-node-syntax@1.1.1:
-    resolution: {integrity: sha512-23fWKohMTvS5s0wwJKycOe0dBdCwQ6+iiLaNR9zy8P13mtFRFM9qLLX6HJX5DL2pi/FNDf3fCQHM4FIMoHH/7w==}
-    peerDependencies:
-      '@babel/core': ^7.0.0 || ^8.0.0-0
-
-  babel-preset-jest@29.6.3:
-    resolution: {integrity: sha512-0B3bhxR6snWXJZtR/RliHTDPRgn1sNHOR0yVtq/IiQFyuOVjFS+wuio/R4gSNkyYmKmJB4wGZv2NZanmKmTnNA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+  b4a@1.8.1:
+    resolution: {integrity: sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw==}
     peerDependencies:
-      '@babel/core': ^7.0.0
+      react-native-b4a: '*'
+    peerDependenciesMeta:
+      react-native-b4a:
+        optional: true
 
   bail@2.0.2:
     resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
@@ -4422,6 +4260,43 @@ packages:
   bare-events@2.6.0:
     resolution: {integrity: sha512-EKZ5BTXYExaNqi3I3f9RtEsaI/xBSGjE0XZCZilPzFAV/goswFHuPd9jEZlPIZ/iNZJwDSao9qRiScySz7MbQg==}
 
+  bare-events@2.9.1:
+    resolution: {integrity: sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg==}
+    peerDependencies:
+      bare-abort-controller: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+
+  bare-fs@4.7.4:
+    resolution: {integrity: sha512-y1kC+ffIx/tPLdTE693uNjHfzTfr+ravR5tvWlMXe25nELbkqV400S71qHDwbkAQ1FVEZobB1NFRzFbCCcyBCQ==}
+    engines: {bare: '>=1.16.0'}
+    peerDependencies:
+      bare-buffer: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true
+
+  bare-path@3.1.1:
+    resolution: {integrity: sha512-JprUlveX3QjApC1cTpsUOiscADftCGVWkzitbHsRqv84hzYwYHw2mbluddsq5TvI8mH/8Ov1f4BiMAdcB0oYnQ==}
+
+  bare-stream@2.13.3:
+    resolution: {integrity: sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ==}
+    peerDependencies:
+      bare-abort-controller: '*'
+      bare-buffer: '*'
+      bare-events: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+      bare-buffer:
+        optional: true
+      bare-events:
+        optional: true
+
+  bare-url@2.4.6:
+    resolution: {integrity: sha512-iQxPClE07hETVpbRoX7JXX3v/ZQViCxe/SYCxylRLzdEx1xJAufPptfiOqR8tqiCtmbtMDANKWszzjLu1PMAZQ==}
+
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
@@ -4435,6 +4310,9 @@ packages:
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  bcrypt-pbkdf@1.0.2:
+    resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==}
+
   bcryptjs@3.0.3:
     resolution: {integrity: sha512-GlF5wPWnSa/X5LKM1o0wz0suXIINz1iHRLvTS+sLyi7XPbe5ycmYI3DlZqVGZZtDgl4DmasFg7gOB3JYbphV5g==}
     hasBin: true
@@ -4485,22 +4363,26 @@ packages:
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
-  bs-logger@0.2.6:
-    resolution: {integrity: sha512-pd8DCoxmbgc7hyPKOvxtqNcjYoOsABPQdcCUjGp3d42VR2CX1ORhk2A87oqqu5R1kk+76nsxZupkmyd+MVtCog==}
-    engines: {node: '>= 6'}
-
-  bser@2.1.1:
-    resolution: {integrity: sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==}
-
   buffer-crc32@0.2.13:
     resolution: {integrity: sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==}
 
+  buffer-crc32@1.0.0:
+    resolution: {integrity: sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==}
+    engines: {node: '>=8.0.0'}
+
   buffer-from@1.1.2:
     resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
 
   buffer@5.7.1:
     resolution: {integrity: sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==}
 
+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
+  buildcheck@0.0.7:
+    resolution: {integrity: sha512-lHblz4ahamxpTmnsk+MNTRWsjYKv965MwOrSJyeD588rR3Jcu7swE+0wN5F+PbL5cjgu/9ObkhfzEPuofEMwLA==}
+    engines: {node: '>=10.0.0'}
+
   bundle-name@4.1.0:
     resolution: {integrity: sha512-tjwM5exMg6BGRI+kNmTntNsvdZS1X8BFYS6tnJ2hdH0kVxM6/eVZ2xy+FqStSWvYmtfFMDLIxurorHwDKfDz5Q==}
     engines: {node: '>=18'}
@@ -4509,6 +4391,10 @@ packages:
     resolution: {integrity: sha512-8SFQbg/0hQ9xy3UNTB0YEnsNBbWfhf7RtnzpL7TkBiTBRfrQ9Fxcnz7VJsleJpyp6rVLvXiuORqjlHi5q+PYuA==}
     engines: {node: '>=10.16.0'}
 
+  byline@5.0.0:
+    resolution: {integrity: sha512-s6webAy+R4SR8XVuJWt2V2rGvhnrhxN+9S15GNuTK3wKPOXFF6RNc+8ug2XhH+2s4f+uudG4kUVYmYOQWL2g0Q==}
+    engines: {node: '>=0.10.0'}
+
   bytes@3.1.2:
     resolution: {integrity: sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==}
     engines: {node: '>= 0.8'}
@@ -4533,14 +4419,6 @@ packages:
     resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
     engines: {node: '>=6'}
 
-  camelcase@5.3.1:
-    resolution: {integrity: sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==}
-    engines: {node: '>=6'}
-
-  camelcase@6.3.0:
-    resolution: {integrity: sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==}
-    engines: {node: '>=10'}
-
   caniuse-lite@1.0.30001751:
     resolution: {integrity: sha512-A0QJhug0Ly64Ii3eIqHu5X51ebln3k4yTUkY1j8drqpWHVreg/VLijN48cZ1bYPiqOQuqpkIKnzr/Ul8V+p6Cw==}
 
@@ -4566,10 +4444,6 @@ packages:
     resolution: {integrity: sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==}
     engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
 
-  char-regex@1.0.2:
-    resolution: {integrity: sha512-kWWXztvZ5SBQV+eRgKFeh8q5sLuZY2+8WUIzlxWVTg+oGwY14qylx1KbKzHd8P6ZYkAg0xyIDU9JMHhyJMZ1jw==}
-    engines: {node: '>=10'}
-
   character-entities-html4@2.1.0:
     resolution: {integrity: sha512-1v7fgQRj6hnSwFpq1Eu0ynr/CDEw0rXo2B61qXrLNdHZmPKgb7fqS1a2JwF0rISo9q77jDI8VMEHoApn8qDoZA==}
 
@@ -4593,17 +4467,13 @@ packages:
     resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
     engines: {node: '>= 14.16.0'}
 
+  chownr@1.1.4:
+    resolution: {integrity: sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==}
+
   chrome-trace-event@1.0.4:
     resolution: {integrity: sha512-rNjApaLzuwaOTjCiT8lSDdGN1APCiqkChLMJxJPWLunPAt5fy8xgU9/jNOchV84wfIxrA0lRQB7oCT8jrn/wrQ==}
     engines: {node: '>=6.0'}
 
-  ci-info@3.9.0:
-    resolution: {integrity: sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==}
-    engines: {node: '>=8'}
-
-  cjs-module-lexer@1.4.3:
-    resolution: {integrity: sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==}
-
   cjs-module-lexer@2.2.0:
     resolution: {integrity: sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==}
 
@@ -4661,16 +4531,9 @@ packages:
     resolution: {integrity: sha512-EjXKMfGfdwtV4AcNSQ6AwQaVzpC1B7IxeiwA3FlhTXz+YFlMKVi4c1JX9tgD2QOlahQXjB8KUXrBaYG+3v871Q==}
     hasBin: true
 
-  co@4.6.0:
-    resolution: {integrity: sha512-QVb0dM5HvG+uaxitm8wONl7jltx8dqhfU33DcqtOZcLSVIKSDDLDi7+0LbAKiyI8hD9u42m2YxXSkMGWThaecQ==}
-    engines: {iojs: '>= 1.0.0', node: '>= 0.12.0'}
-
   code-block-writer@13.0.3:
     resolution: {integrity: sha512-Oofo0pq3IKnsFtuHqSF7TqBfr71aeyZDVJ0HpmqB7FBM2qEigL0iPONSCZSO9pE9dZTAxANe5XHG9Uy0YMv8cg==}
 
-  collect-v8-coverage@1.0.2:
-    resolution: {integrity: sha512-lHl4d5/ONEbLlJvaJNtsF/Lz+WvB07u2ycqTYbdrq7UypDXailES4valYb2eWiJFxZlVmpGekfqoxQhzyFdT4Q==}
-
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -4722,6 +4585,10 @@ packages:
   component-emitter@1.3.1:
     resolution: {integrity: sha512-T0+barUSQRTUQASh8bx02dl+DhF54GtIDY13Y3m9oWTklKbb3Wv974meRpeZ3lp1JpLVECWWNHC4vaG2XHXouQ==}
 
+  compress-commons@6.0.2:
+    resolution: {integrity: sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==}
+    engines: {node: '>= 14'}
+
   concat-map@0.0.1:
     resolution: {integrity: sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==}
 
@@ -4798,13 +4665,18 @@ packages:
       typescript:
         optional: true
 
-  create-jest@29.7.0:
-    resolution: {integrity: sha512-Adz2bdH0Vq3F53KEMJOoftQFutWCukm6J24wbPWRO4k1kMY7gS7ds/uoJkNuV8wDCtWWnuwGcJwpWcih+zEW1Q==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+  cpu-features@0.0.10:
+    resolution: {integrity: sha512-9IkYqtX3YHPCzoVg1Py+o9057a3i0fp7S530UWokCSaFVTc7CwXPRiOjRjBQQ18ZCNafx78YfnG+HALxtVmOGA==}
+    engines: {node: '>=10.0.0'}
+
+  crc-32@1.2.2:
+    resolution: {integrity: sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==}
+    engines: {node: '>=0.8'}
     hasBin: true
 
-  create-require@1.1.1:
-    resolution: {integrity: sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==}
+  crc32-stream@6.0.0:
+    resolution: {integrity: sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g==}
+    engines: {node: '>= 14'}
 
   cron-parser@5.6.1:
     resolution: {integrity: sha512-QBm4o1PwZiuY7KFbVvW7FLC8bozy7YWzv+Fz6KRS7sQghzcbDZCGxr/Bc5b6TQreAoSwuWVP491dIcK0THCX6A==}
@@ -5093,10 +4965,6 @@ packages:
     resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
     engines: {node: '>=8'}
 
-  detect-newline@3.1.0:
-    resolution: {integrity: sha512-TLz+x/vEXm/Y7P7wn1EJFNLxYpUD4TgMosxY6fAVJUnJMbupHBOncxyWUG9OpTaH9EBD7uFI5LfEgmMOc54DsA==}
-    engines: {node: '>=8'}
-
   detect-node-es@1.1.0:
     resolution: {integrity: sha512-ypdmJU/TbBby2Dxibuv7ZLW3Bs1QEmM7nHjEANfohJLvE0XVujisn1qPJcZxg+qDucsr+bP6fLD1rPS3AhJ7EQ==}
 
@@ -5106,18 +4974,22 @@ packages:
   dezalgo@1.0.4:
     resolution: {integrity: sha512-rXSP0bf+5n0Qonsb+SVVfNfIsimO4HEtmnIpPHY8Q1UCzKlQrDMfdobr8nJOOsRgWCyMRqeSBQzmWUMq7zvVig==}
 
-  diff-sequences@29.6.3:
-    resolution: {integrity: sha512-EjePK1srD3P08o2j4f0ExnylqRs5B9tJjcp9t1krH2qRi8CCdsYfwe9JgSLurFBWwq4uOlipzfk5fHNvwFKr8Q==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  diff@4.0.2:
-    resolution: {integrity: sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==}
-    engines: {node: '>=0.3.1'}
-
   diff@8.0.4:
     resolution: {integrity: sha512-DPi0FmjiSU5EvQV0++GFDOJ9ASQUVFh5kD+OzOnYdi7n3Wpm9hWWGfB/O2blfHcMVTL5WkQXSnRiK9makhrcnw==}
     engines: {node: '>=0.3.1'}
 
+  docker-compose@1.4.2:
+    resolution: {integrity: sha512-rPHigTKGaEHpkUmfd69QgaOp+Os5vGJwG/Ry8lcr8W/382AmI+z/D7qoa9BybKIkqNppaIbs8RYeHSevdQjWww==}
+    engines: {node: '>= 6.0.0'}
+
+  docker-modem@5.0.7:
+    resolution: {integrity: sha512-XJgGhoR/CLpqshm4d3L7rzH6t8NgDFUIIpztYlLHIApeJjMZKYJMz2zxPsYxnejq5h3ELYSw/RBsi3t5h7gNTA==}
+    engines: {node: '>= 8.0'}
+
+  dockerode@5.0.1:
+    resolution: {integrity: sha512-avsq/xk4YPIrn0CgleX5bjT9Y8IT1p9PxrNQ++RBQ2WEyFfHCTDsT9kmyxz+H/axnjAwg8wJWEIuPGOUuNupiA==}
+    engines: {node: '>= 14.17'}
+
   doctrine@3.0.0:
     resolution: {integrity: sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==}
     engines: {node: '>=6.0.0'}
@@ -5261,21 +5133,12 @@ packages:
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
-  ejs@3.1.10:
-    resolution: {integrity: sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==}
-    engines: {node: '>=0.10.0'}
-    hasBin: true
-
   electron-to-chromium@1.5.185:
     resolution: {integrity: sha512-dYOZfUk57hSMPePoIQ1fZWl1Fkj+OshhEVuPacNKWzC1efe56OsHY3l/jCfiAgIICOU3VgOIdoq7ahg7r7n6MQ==}
 
   electron-to-chromium@1.5.392:
     resolution: {integrity: sha512-1yQq3VQCZRwsnYc67Oc+1fge6Lwtn0hzi6zmEVkB61Zx21kTbwJAW4dFLadl5Rc1tKhG/kSpYXnfiAhu0f0a1g==}
 
-  emittery@0.13.1:
-    resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==}
-    engines: {node: '>=12'}
-
   emoji-regex@10.6.0:
     resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
 
@@ -5293,6 +5156,9 @@ packages:
     resolution: {integrity: sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==}
     engines: {node: '>= 0.8'}
 
+  end-of-stream@1.4.5:
+    resolution: {integrity: sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg==}
+
   enhanced-resolve@5.18.1:
     resolution: {integrity: sha512-ZSW3ma5GkcQBIpwZTSRAI8N71Uuwgs93IezB7mf7R60tC8ZbJideoDNKjHn2O9KIlx6rkGTTEk1xUCK2E1Y2Yg==}
     engines: {node: '>=10.13.0'}
@@ -5372,10 +5238,6 @@ packages:
   escape-html@1.0.3:
     resolution: {integrity: sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==}
 
-  escape-string-regexp@2.0.0:
-    resolution: {integrity: sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==}
-    engines: {node: '>=8'}
-
   escape-string-regexp@5.0.0:
     resolution: {integrity: sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==}
     engines: {node: '>=12'}
@@ -5425,6 +5287,13 @@ packages:
     resolution: {integrity: sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==}
     engines: {node: '>= 0.6'}
 
+  event-target-shim@5.0.1:
+    resolution: {integrity: sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==}
+    engines: {node: '>=6'}
+
+  events-universal@1.0.1:
+    resolution: {integrity: sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==}
+
   events@3.3.0:
     resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
     engines: {node: '>=0.8.x'}
@@ -5445,18 +5314,10 @@ packages:
     resolution: {integrity: sha512-9Be3ZoN4LmYR90tUoVu2te2BsbzHfhJyfEiAVfz7N5/zv+jduIfLrV2xdQXOHbaD6KgpGdO9PRPM1Y4Q9QkPkA==}
     engines: {node: ^18.19.0 || >=20.5.0}
 
-  exit@0.1.2:
-    resolution: {integrity: sha512-Zk/eNKV2zbjpKzrsQ+n1G6poVbErQxJ0LBOJXaKZ1EViLzH+hrLu9cdXI4zw9dBQJslwBEpbQ2P1oS7nDxs6jQ==}
-    engines: {node: '>= 0.8.0'}
-
   expect-type@1.4.0:
     resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
     engines: {node: '>=12.0.0'}
 
-  expect@29.7.0:
-    resolution: {integrity: sha512-2Zks0hf1VLFYI1kbh0I5jP3KHHyCHpkfyHBzsSXRFgl/Bg9mWYfMW8oD+PdMPlEwy5HNsR9JutYy6pMeOh61nw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
   express-rate-limit@8.5.2:
     resolution: {integrity: sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A==}
     engines: {node: '>= 16'}
@@ -5508,9 +5369,6 @@ packages:
   fastq@1.19.0:
     resolution: {integrity: sha512-7SFSRCNjBQIZH/xZR3iy5iQYR8aGBE0h3VG6/cwlbrpdciNYBMotQav8c1XI3HjHH+NikUpP53nPdlZSdWmFzA==}
 
-  fb-watchman@2.0.2:
-    resolution: {integrity: sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==}
-
   fdir@6.5.0:
     resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
     engines: {node: '>=12.0.0'}
@@ -5535,9 +5393,6 @@ packages:
     resolution: {integrity: sha512-ek5xNX2YBYlXhiUXui3D/BXa3LdqPmoLJ7rqEx2bKJ7EAUEfmXgW0Das7Dc6Nr9MvqaOnIqiPV0mZk/r/UpNAg==}
     engines: {node: '>=20'}
 
-  filelist@1.0.4:
-    resolution: {integrity: sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==}
-
   filename-reserved-regex@3.0.0:
     resolution: {integrity: sha512-hn4cQfU6GOT/7cFHXBqeBg2TbrMBgdD0kcjLhvSQYYwm3s4B6cjvBfb7nBALJLAXqmU5xajSa7X2NnUud/VCdw==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -5558,10 +5413,6 @@ packages:
     resolution: {integrity: sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==}
     engines: {node: '>=6'}
 
-  find-up@4.1.0:
-    resolution: {integrity: sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==}
-    engines: {node: '>=8'}
-
   find-up@5.0.0:
     resolution: {integrity: sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==}
     engines: {node: '>=10'}
@@ -5619,6 +5470,9 @@ packages:
     resolution: {integrity: sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
     engines: {node: '>= 0.8'}
 
+  fs-constants@1.0.0:
+    resolution: {integrity: sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==}
+
   fs-extra@10.1.0:
     resolution: {integrity: sha512-oRXApq54ETRj4eMiFzGnHWGy+zo5raudjuxN0b8H7s/RU2oW0Wvsx9O0ACRN/kRq9E8Vu/ReskGB5o3ji+FzHQ==}
     engines: {node: '>=12'}
@@ -5630,9 +5484,6 @@ packages:
   fs-monkey@1.1.0:
     resolution: {integrity: sha512-QMUezzXWII9EV5aTFXW1UBVUO77wYPpjqIF8/AviUCThNeSYZykpoTixUeaNNBwmCev0AMDWMAni+f8Hxb1IFw==}
 
-  fs.realpath@1.0.0:
-    resolution: {integrity: sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==}
-
   fsevents@2.3.2:
     resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -5673,9 +5524,9 @@ packages:
     resolution: {integrity: sha512-PKsK2FSrQCyxcGHsGrLDcK0lx+0Ke+6e8KFFozA9/fIQLhQzPaRvJFdcz7+Axg3jUH/Mq+NI4xa5u/UT2tQskA==}
     engines: {node: '>=14.16'}
 
-  get-package-type@0.1.0:
-    resolution: {integrity: sha512-pjzuKtY64GYfWizNAJ0fr9VqttZkNiK2iS430LtIHzjBEr6bX8Am2zm4sW4Ro5wjWW5cAlRL1qAMTcXbjNAO2Q==}
-    engines: {node: '>=8.0.0'}
+  get-port@5.1.1:
+    resolution: {integrity: sha512-g/Q1aTSDOxFpchXC4i8ZWvxA1lnPqx/JHqcpIw0/LX9T8x/GBbi6YnlN5nhaKIFkT8oFsscUKgDJYxfwfS6QsQ==}
+    engines: {node: '>=8'}
 
   get-proto@1.0.1:
     resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
@@ -5699,6 +5550,11 @@ packages:
   glob-to-regexp@0.4.1:
     resolution: {integrity: sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw==}
 
+  glob@10.5.0:
+    resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+    hasBin: true
+
   glob@11.0.3:
     resolution: {integrity: sha512-2Nim7dha1KVkaiF4q6Dj+ngPPMdfvLJEOpZk/jKiUAkqKebpGAWQXAq9z1xu9HKu5lWfqw/FASuccEjyznjPaA==}
     engines: {node: 20 || >=22}
@@ -5709,10 +5565,6 @@ packages:
     resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==}
     engines: {node: 18 || 20 || >=22}
 
-  glob@7.2.3:
-    resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
-    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
-
   globrex@0.1.2:
     resolution: {integrity: sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==}
 
@@ -5790,9 +5642,6 @@ packages:
     resolution: {integrity: sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
 
-  html-escaper@2.0.2:
-    resolution: {integrity: sha512-H2iMtd0I4Mt5eYiapRdIDjp+XzelXQ0tFE4JS7YFwFevXXMmOp9myNrUvCg0D6ws8iqkRPBfKHgbwig1SmlLfg==}
-
   html-url-attributes@3.0.1:
     resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
 
@@ -5866,26 +5715,13 @@ packages:
     resolution: {integrity: sha512-vR2B6HKIhaBjcZr2bLpFiJ1VbzOlRQ7aby4/gw5WPIzToLjqpfWw3VJ4sk1uDchoOODEirvO2jyrSPtUSL5CrQ==}
     engines: {node: '>=18'}
 
-  import-local@3.2.0:
-    resolution: {integrity: sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==}
-    engines: {node: '>=8'}
-    hasBin: true
-
   import-meta-resolve@4.2.0:
     resolution: {integrity: sha512-Iqv2fzaTQN28s/FwZAoFq0ZSs/7hMAHJVX+w8PZl3cY19Pxk6jFFalxQoIfW2826i/fDLXv8IiEZRIT0lDuWcg==}
 
-  imurmurhash@0.1.4:
-    resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
-    engines: {node: '>=0.8.19'}
-
   indent-string@4.0.0:
     resolution: {integrity: sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==}
     engines: {node: '>=8'}
 
-  inflight@1.0.6:
-    resolution: {integrity: sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==}
-    deprecated: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
-
   inherits@2.0.4:
     resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
 
@@ -5944,10 +5780,6 @@ packages:
     resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
     engines: {node: '>=8'}
 
-  is-generator-fn@2.1.0:
-    resolution: {integrity: sha512-cTIB4yPYL/Grw0EaSzASzg6bBy9gqCofvWN8okThAYIxKJZC+udlRAmGbM0XLeniEJSs8uEgHPGuHSe1XsOLSQ==}
-    engines: {node: '>=6'}
-
   is-glob@4.0.3:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
@@ -6033,6 +5865,9 @@ packages:
     resolution: {integrity: sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==}
     engines: {node: '>=16'}
 
+  isarray@1.0.0:
+    resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+
   isexe@2.0.0:
     resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
 
@@ -6040,176 +5875,21 @@ packages:
     resolution: {integrity: sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==}
     engines: {node: '>=18'}
 
-  istanbul-lib-coverage@3.2.2:
-    resolution: {integrity: sha512-O8dpsF+r0WV/8MNRKfnmrtCWhuKjxrq2w+jpzBL5UZKTi2LeVWnWOmWRxFlesJONmc+wLAGvKQZEOanko0LFTg==}
-    engines: {node: '>=8'}
-
-  istanbul-lib-instrument@5.2.1:
-    resolution: {integrity: sha512-pzqtp31nLv/XFOzXGuvhCb8qhjmTVo5vjVk19XE4CRlSWz0KoeJ3bw9XsA7nOp9YBf4qHjwBxkDzKcME/J29Yg==}
-    engines: {node: '>=8'}
+  iterare@1.2.1:
+    resolution: {integrity: sha512-RKYVTCjAnRthyJes037NX/IiqeidgN1xc3j1RjFfECFp28A1GVwK9nA+i0rJPaHqSZwygLzRnFlzUuHFoWWy+Q==}
+    engines: {node: '>=6'}
 
-  istanbul-lib-instrument@6.0.3:
-    resolution: {integrity: sha512-Vtgk7L/R2JHyyGW07spoFlB8/lpjiOLTjMdms6AFMraYt3BaJauod/NGrfnVG/y4Ix1JEuMRPDPEj2ua+zz1/Q==}
-    engines: {node: '>=10'}
+  jackspeak@3.4.3:
+    resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}
 
-  istanbul-lib-report@3.0.1:
-    resolution: {integrity: sha512-GCfE1mtsHGOELCU8e/Z7YWzpmybrx/+dSTfLrvY8qRmaY6zXTKWn6WQIjaAFw069icm6GVMNkgu0NzI4iPZUNw==}
-    engines: {node: '>=10'}
-
-  istanbul-lib-source-maps@4.0.1:
-    resolution: {integrity: sha512-n3s8EwkdFIJCG3BPKBYvskgXGoy88ARzvegkitk60NxRdwltLOTaH7CUiMRXvwYorl0Q712iEjcWB+fK/MrWVw==}
-    engines: {node: '>=10'}
-
-  istanbul-reports@3.1.7:
-    resolution: {integrity: sha512-BewmUXImeuRk2YY0PVbxgKAysvhRPUQE0h5QRM++nVWyubKGV0l8qQ5op8+B2DOmwSe63Jivj0BjkPQVf8fP5g==}
-    engines: {node: '>=8'}
-
-  iterare@1.2.1:
-    resolution: {integrity: sha512-RKYVTCjAnRthyJes037NX/IiqeidgN1xc3j1RjFfECFp28A1GVwK9nA+i0rJPaHqSZwygLzRnFlzUuHFoWWy+Q==}
-    engines: {node: '>=6'}
-
-  jackspeak@4.1.1:
-    resolution: {integrity: sha512-zptv57P3GpL+O0I7VdMJNBZCu+BPHVQUk55Ft8/QCJjTVxrnJHuVuX/0Bl2A6/+2oyR/ZMEuFKwmzqqZ/U5nPQ==}
-    engines: {node: 20 || >=22}
-
-  jake@10.9.2:
-    resolution: {integrity: sha512-2P4SQ0HrLQ+fw6llpLnOaGAvN2Zu6778SJMrCUwns4fOoG9ayrTiZk3VV8sCPkVZF8ab0zksVpS8FDY5pRCNBA==}
-    engines: {node: '>=10'}
-    hasBin: true
-
-  jest-changed-files@29.7.0:
-    resolution: {integrity: sha512-fEArFiwf1BpQ+4bXSprcDc3/x4HSzL4al2tozwVpDFpsxALjLYdyiIK4e5Vz66GQJIbXJ82+35PtysofptNX2w==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-circus@29.7.0:
-    resolution: {integrity: sha512-3E1nCMgipcTkCocFwM90XXQab9bS+GMsjdpmPrlelaxwD93Ad8iVEjX/vvHPdLPnFf+L40u+5+iutRdA1N9myw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-cli@29.7.0:
-    resolution: {integrity: sha512-OVVobw2IubN/GSYsxETi+gOe7Ka59EFMR/twOU3Jb2GnKKeMGJB5SGUUrEz3SFVmJASUdZUzy83sLNNQ2gZslg==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-    hasBin: true
-    peerDependencies:
-      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
-    peerDependenciesMeta:
-      node-notifier:
-        optional: true
-
-  jest-config@29.7.0:
-    resolution: {integrity: sha512-uXbpfeQ7R6TZBqI3/TxCU4q4ttk3u0PJeC+E0zbfSoSjq6bJ7buBPxzQPL0ifrkY4DNu4JUdk0ImlBUYi840eQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-    peerDependencies:
-      '@types/node': '*'
-      ts-node: '>=9.0.0'
-    peerDependenciesMeta:
-      '@types/node':
-        optional: true
-      ts-node:
-        optional: true
-
-  jest-diff@29.7.0:
-    resolution: {integrity: sha512-LMIgiIrhigmPrs03JHpxUh2yISK3vLFPkAodPeo0+BuF7wA2FoQbkEg1u8gBYBThncu7e1oEDUfIXVuTqLRUjw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-docblock@29.7.0:
-    resolution: {integrity: sha512-q617Auw3A612guyaFgsbFeYpNP5t2aoUNLwBUbc/0kD1R4t9ixDbyFTHd1nok4epoVFpr7PmeWHrhvuV3XaJ4g==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-each@29.7.0:
-    resolution: {integrity: sha512-gns+Er14+ZrEoC5fhOfYCY1LOHHr0TI+rQUHZS8Ttw2l7gl+80eHc/gFf2Ktkw0+SIACDTeWvpFcv3B04VembQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-environment-node@29.7.0:
-    resolution: {integrity: sha512-DOSwCRqXirTOyheM+4d5YZOrWcdu0LNZ87ewUoywbcb2XR4wKgqiG8vNeYwhjFMbEkfju7wx2GYH0P2gevGvFw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-get-type@29.6.3:
-    resolution: {integrity: sha512-zrteXnqYxfQh7l5FHyL38jL39di8H8rHoecLH3JNxH3BwOrBsNeabdap5e0I23lD4HHI8W5VFBZqG4Eaq5LNcw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-haste-map@29.7.0:
-    resolution: {integrity: sha512-fP8u2pyfqx0K1rGn1R9pyE0/KTn+G7PxktWidOBTqFPLYX0b9ksaMFkhK5vrS3DVun09pckLdlx90QthlW7AmA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-leak-detector@29.7.0:
-    resolution: {integrity: sha512-kYA8IJcSYtST2BY9I+SMC32nDpBT3J2NvWJx8+JCuCdl/CR1I4EKUJROiP8XtCcxqgTTBGJNdbB1A8XRKbTetw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-matcher-utils@29.7.0:
-    resolution: {integrity: sha512-sBkD+Xi9DtcChsI3L3u0+N0opgPYnCRPtGcQYrgXmR+hmt/fYfWAL0xRXYU8eWOdfuLgBe0YCW3AFtnRLagq/g==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-message-util@29.7.0:
-    resolution: {integrity: sha512-GBEV4GRADeP+qtB2+6u61stea8mGcOT4mCtrYISZwfu9/ISHFJ/5zOMXYbpBE9RsS5+Gb63DW4FgmnKJ79Kf6w==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-mock@29.7.0:
-    resolution: {integrity: sha512-ITOMZn+UkYS4ZFh83xYAOzWStloNzJFO2s8DWrE4lhtGD+AorgnbkiKERe4wQVBydIGPx059g6riW5Btp6Llnw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-pnp-resolver@1.2.3:
-    resolution: {integrity: sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==}
-    engines: {node: '>=6'}
-    peerDependencies:
-      jest-resolve: '*'
-    peerDependenciesMeta:
-      jest-resolve:
-        optional: true
-
-  jest-regex-util@29.6.3:
-    resolution: {integrity: sha512-KJJBsRCyyLNWCNBOvZyRDnAIfUiRJ8v+hOBQYGn8gDyF3UegwiP4gwRR3/SDa42g1YbVycTidUF3rKjyLFDWbg==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-resolve-dependencies@29.7.0:
-    resolution: {integrity: sha512-un0zD/6qxJ+S0et7WxeI3H5XSe9lTBBR7bOHCHXkKR6luG5mwDDlIzVQ0V5cZCuoTgEdcdwzTghYkTWfubi+nA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-resolve@29.7.0:
-    resolution: {integrity: sha512-IOVhZSrg+UvVAshDSDtHyFCCBUl/Q3AAJv8iZ6ZjnZ74xzvwuzLXid9IIIPgTnY62SJjfuupMKZsZQRsCvxEgA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-runner@29.7.0:
-    resolution: {integrity: sha512-fsc4N6cPCAahybGBfTRcq5wFR6fpLznMg47sY5aDpsoejOcVYFb07AHuSnR0liMcPTgBsA3ZJL6kFOjPdoNipQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-runtime@29.7.0:
-    resolution: {integrity: sha512-gUnLjgwdGqW7B4LvOIkbKs9WGbn+QLqRQQ9juC6HndeDiezIwhDP+mhMwHWCEcfQ5RUXa6OPnFF8BJh5xegwwQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-snapshot@29.7.0:
-    resolution: {integrity: sha512-Rm0BMWtxBcioHr1/OX5YCP8Uov4riHvKPknOGs804Zg9JGZgmIBkbtlxJC/7Z4msKYVbIJtfU+tKb8xlYNfdkw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-util@29.7.0:
-    resolution: {integrity: sha512-z6EbKajIpqGKU56y5KBUgy1dt1ihhQJgWzUlZHArA/+X2ad7Cb5iF+AK1EWVL/Bo7Rz9uurpqw6SiBCefUbCGA==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-validate@29.7.0:
-    resolution: {integrity: sha512-ZB7wHqaRGVw/9hST/OuFUReG7M8vKeq0/J2egIGLdvjHCmYqGARhzXmtgi+gVeZ5uXFF219aOc3Ls2yLg27tkw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest-watcher@29.7.0:
-    resolution: {integrity: sha512-49Fg7WXkU3Vl2h6LbLtMQ/HyB6rXSIX7SqvBLQmssRBGN9I0PNvPmAmCWSOY6SOvrjhI/F7/bGAv9RtnsPA03g==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
+  jackspeak@4.1.1:
+    resolution: {integrity: sha512-zptv57P3GpL+O0I7VdMJNBZCu+BPHVQUk55Ft8/QCJjTVxrnJHuVuX/0Bl2A6/+2oyR/ZMEuFKwmzqqZ/U5nPQ==}
+    engines: {node: 20 || >=22}
 
   jest-worker@27.5.1:
     resolution: {integrity: sha512-7vuh85V5cdDofPyxn58nrPjBktZo0u9x1g8WtjQol+jZDaE+fhN+cIvTj11GndBnMnyfrUOG1sZQxCdjKh+DKg==}
     engines: {node: '>= 10.13.0'}
 
-  jest-worker@29.7.0:
-    resolution: {integrity: sha512-eIz2msL/EzL9UFTFFx7jBTkeZfku0yUAyZZZmJ93H2TYEiroIx2PQjEXcwYtYl8zXCxb+PAmA2hLIt/6ZEkPHw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
-  jest@29.7.0:
-    resolution: {integrity: sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-    hasBin: true
-    peerDependencies:
-      node-notifier: ^8.0.1 || ^9.0.0 || ^10.0.0
-    peerDependenciesMeta:
-      node-notifier:
-        optional: true
-
   jiti@2.7.0:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
@@ -6224,10 +5904,6 @@ packages:
   js-tokens@4.0.0:
     resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
 
-  js-yaml@3.14.1:
-    resolution: {integrity: sha512-okMH7OXXJ7YrN9Ok3/SXrnu4iX9yOk+25nqX4imS2npuvTYDmo/QEZoqwZkYaIDk3jVvBOTOIEgEhaLOynBS9g==}
-    hasBin: true
-
   js-yaml@4.1.0:
     resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
     hasBin: true
@@ -6317,6 +5993,10 @@ packages:
   layout-base@2.0.1:
     resolution: {integrity: sha512-dp3s92+uNI1hWIpPGH3jK2kxE2lMjdXdr+DH8ynZHpd6PUlH6x6cbuXnoMmiNumznqaNO31xu9e79F0uuZ0JFg==}
 
+  lazystream@1.0.1:
+    resolution: {integrity: sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==}
+    engines: {node: '>= 0.6.3'}
+
   lefthook-darwin-arm64@2.1.9:
     resolution: {integrity: sha512-119HryNcvr4nqn0wUIrNPgpMEPn9yMQzEcW/lezRsnb56PCJriJB92+MCySPVcWDxJnZef7o0T3jdnPNiSH7Qg==}
     cpu: [arm64]
@@ -6371,10 +6051,6 @@ packages:
     resolution: {integrity: sha512-bwDaIOViTktE8kJLf9jP0p+H2/RDTlFFlc43Am2YgUsX22hI6Sq4RbzsrecwzY5y+MHTipOH7WsmWSEniePHWQ==}
     hasBin: true
 
-  leven@3.1.0:
-    resolution: {integrity: sha512-qsda+H8jTaUaN/x5vzW2rzc+8Rw4TAQ/4KjB46IwK5VH+IlVeeeje/EoZRpiXvIqjFgK84QffqPztGI3VBLG1A==}
-    engines: {node: '>=6'}
-
   libphonenumber-js@1.13.7:
     resolution: {integrity: sha512-rvr3HIMdOgzhz1RFGjftji+wjoAFlzhqCNqJOU/MKTZQ8d9NZxAR/tI+0weDicyoucqVR0U1GCniqHJ0f8aM2A==}
 
@@ -6459,6 +6135,10 @@ packages:
     resolution: {integrity: sha512-nVAvWk/jeyrWyXEAs84mpQCYccxRqgKY4OznLuJhJCa0XsPSfdOIr2zvBZEj3IHEHbX97jjscKRRV539bW0Gpw==}
     engines: {node: '>=13.2.0'}
 
+  load-tsconfig@0.2.5:
+    resolution: {integrity: sha512-IXO6OCs9yg8tMKzfPZ1YmheJbZCiEsnBdcB03l0OcfK9prKnJb96siuHCr5Fl37/yo9DnKU+TLpxzTUspw9shg==}
+    engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
+
   loader-runner@4.3.0:
     resolution: {integrity: sha512-3R/1M+yS3j5ou80Me59j7F9IMs4PXs3VqRrm0TU3AbKPxlmpoY1TNscJV/oGJXo8qCatFGTfDbY6W6ipGOYXfg==}
     engines: {node: '>=6.11.5'}
@@ -6467,10 +6147,6 @@ packages:
     resolution: {integrity: sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==}
     engines: {node: '>=6'}
 
-  locate-path@5.0.0:
-    resolution: {integrity: sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==}
-    engines: {node: '>=8'}
-
   locate-path@6.0.0:
     resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
     engines: {node: '>=10'}
@@ -6478,15 +6154,15 @@ packages:
   lodash-es@4.18.1:
     resolution: {integrity: sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==}
 
+  lodash.camelcase@4.3.0:
+    resolution: {integrity: sha512-TwuEnCnxbc3rAvhf/LbG7tJUDzhqXyFnv3dtzLOPgCG/hODL7WFnsbwktkD7yUV0RrreP/l1PALq/YSg6VvjlA==}
+
   lodash.castarray@4.4.0:
     resolution: {integrity: sha512-aVx8ztPv7/2ULbArGJ2Y42bG1mEQ5mGjpdvrbJcJFU3TbYybe+QlLS4pst9zV52ymy2in1KpFPiZnAOATxD4+Q==}
 
   lodash.isplainobject@4.0.6:
     resolution: {integrity: sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA==}
 
-  lodash.memoize@4.1.2:
-    resolution: {integrity: sha512-t7j+NzmgnQzTAYXcsHYLgimltOV1MXHtlOWf6GjL9Kj8GK5FInw5JotxvbOs+IvV1/Dzo04/fCGfLVs7aXb4Ag==}
-
   lodash.merge@4.6.2:
     resolution: {integrity: sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==}
 
@@ -6504,6 +6180,9 @@ packages:
     resolution: {integrity: sha512-i24m8rpwhmPIS4zscNzK6MSEhk0DUWa/8iYQWxhffV8jkI4Phvs3F+quL5xvS0gdQR0FyTCMMH33Y78dDTzzIw==}
     engines: {node: '>=18'}
 
+  long@5.3.2:
+    resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==}
+
   longest-streak@3.1.0:
     resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==}
 
@@ -6514,6 +6193,9 @@ packages:
     resolution: {integrity: sha512-ozCC6gdQ+glXOQsveKD0YsDy8DSQFjDTz4zyzEHNV5+JP5D62LmfDZ6o1cycFx9ouG940M5dE8C8CTewdj2YWQ==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
+  lru-cache@10.4.3:
+    resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
+
   lru-cache@11.1.0:
     resolution: {integrity: sha512-QIXZUBJUx+2zHUdQujWejBkcD9+cs94tLn0+YL8UrCh+D5sCXZ4c7LaEH48pNwRY3MLDgqUFyhlCyjJPf1WP0A==}
     engines: {node: 20 || >=22}
@@ -6544,16 +6226,6 @@ packages:
   magic-string@0.30.21:
     resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
 
-  make-dir@4.0.0:
-    resolution: {integrity: sha512-hXdUTZYIVOt1Ex//jAQi+wTZZpUpwBj/0QsOzqegb3rGMMeJiSEu5xLHnYfBrRV4RH2+OCSOO95Is/7x1WJ4bw==}
-    engines: {node: '>=10'}
-
-  make-error@1.3.6:
-    resolution: {integrity: sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==}
-
-  makeerror@1.0.12:
-    resolution: {integrity: sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==}
-
   markdown-table@3.0.4:
     resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
 
@@ -6805,8 +6477,8 @@ packages:
   minimatch@3.1.2:
     resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
 
-  minimatch@5.1.6:
-    resolution: {integrity: sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==}
+  minimatch@5.1.9:
+    resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
     engines: {node: '>=10'}
 
   minimatch@9.0.5:
@@ -6824,10 +6496,18 @@ packages:
     resolution: {integrity: sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==}
     engines: {node: '>=16 || 14 >=14.17'}
 
+  mkdirp-classic@0.5.3:
+    resolution: {integrity: sha512-gKLcREMhtuZRwRAfqP3RFW+TK4JqApVBtOIftVgjuABpAtpxhPGaDcfvbhNvD0B8iD1oUr/txX35NjcaY6Ns/A==}
+
   mkdirp@0.5.6:
     resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
     hasBin: true
 
+  mkdirp@3.0.1:
+    resolution: {integrity: sha512-+NsyUUAZDmo6YVHzL/stxSu3t9YS1iljliy3BSDrXJ/dkn1KYdmtZODGGjLcc9XLgVVpH4KshHB8XmZgMhaBXg==}
+    engines: {node: '>=10'}
+    hasBin: true
+
   module-alias@2.3.4:
     resolution: {integrity: sha512-bOclZt8hkpuGgSSoG07PKmvzTizROilUTvLNyrMqvlC9snhs7y7GzjNWAVbISIOlhCP1T14rH1PDAV9iNyBq/w==}
 
@@ -6869,14 +6549,14 @@ packages:
     resolution: {integrity: sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
+  nan@2.28.0:
+    resolution: {integrity: sha512-fTsDz99OTq2sVePhGdp4qQhggZFtKr64ZNVyVajRKtMOkJxYekplBh577PiJB12v/D3s2E5cGtOI45LWp6rnLQ==}
+
   nanoid@3.3.15:
     resolution: {integrity: sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==}
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
-  natural-compare@1.4.0:
-    resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
-
   negotiator@1.0.0:
     resolution: {integrity: sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg==}
     engines: {node: '>= 0.6'}
@@ -6926,9 +6606,6 @@ packages:
       encoding:
         optional: true
 
-  node-int64@0.4.0:
-    resolution: {integrity: sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==}
-
   node-releases@2.0.19:
     resolution: {integrity: sha512-xxOWJsBKtzAq7DY0J+DTzuz58K8e7sJbdgwkbMWQe8UYB6ekmsQ45q0M/tJDsGaZmbC+l7n57UV8Hl5tHxO9uw==}
 
@@ -7061,10 +6738,6 @@ packages:
     resolution: {integrity: sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==}
     engines: {node: '>=6'}
 
-  p-locate@4.1.0:
-    resolution: {integrity: sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
-    engines: {node: '>=8'}
-
   p-locate@5.0.0:
     resolution: {integrity: sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==}
     engines: {node: '>=10'}
@@ -7118,10 +6791,6 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
-  path-is-absolute@1.0.1:
-    resolution: {integrity: sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==}
-    engines: {node: '>=0.10.0'}
-
   path-key@3.1.1:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
@@ -7133,6 +6802,10 @@ packages:
   path-parse@1.0.7:
     resolution: {integrity: sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw==}
 
+  path-scurry@1.11.1:
+    resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
+    engines: {node: '>=16 || 14 >=14.18'}
+
   path-scurry@2.0.0:
     resolution: {integrity: sha512-ypGJsmGtdXUOeM5u93TyeIEfEhM6s+ljAhrk5vAvSx8uyY/02OvrZnA0YNGUrPXfpJMgI1ODd3nwz8Npx4O4cg==}
     engines: {node: 20 || >=22}
@@ -7208,10 +6881,6 @@ packages:
     resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
     engines: {node: '>=8.6'}
 
-  picomatch@2.3.2:
-    resolution: {integrity: sha512-V7+vQEJ06Z+c5tSye8S+nHUfI51xoXIXjHQ99cQtKUkQqqO1kO/KCJUfZXuB47h/YBlDhah2H3hdUGXn8ie0oA==}
-    engines: {node: '>=8.6'}
-
   picomatch@4.0.2:
     resolution: {integrity: sha512-M7BAV6Rlcy5u+m6oPhAPFgJTzAioX/6B0DxyvDlo9l8+T3nLKbrczg2WLUyzd45L8RqfUMyGPzekbMvX2Ldkwg==}
     engines: {node: '>=12'}
@@ -7233,10 +6902,6 @@ packages:
     resolution: {integrity: sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==}
     hasBin: true
 
-  pirates@4.0.7:
-    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
-    engines: {node: '>= 6'}
-
   piscina@4.9.2:
     resolution: {integrity: sha512-Fq0FERJWFEUpB4eSY59wSNwXD4RYqR+nR/WiEVcZW8IWfVBxJJafcgTEZDQo8k3w0sUarJ8RyVbbUF4GQ2LGbQ==}
 
@@ -7248,10 +6913,6 @@ packages:
     resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==}
     engines: {node: '>=16.20.0'}
 
-  pkg-dir@4.2.0:
-    resolution: {integrity: sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==}
-    engines: {node: '>=8'}
-
   pkg-up@3.1.0:
     resolution: {integrity: sha512-nDywThFk1i4BQK4twPQ6TA4RT8bDY96yeuCVBWL3ePARCiEKDRSrNGbFIgUJpLp+XeIR65v8ra7WuJOFUBtkMA==}
     engines: {node: '>=8'}
@@ -7329,17 +6990,20 @@ packages:
     resolution: {integrity: sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==}
     engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
 
-  pretty-format@29.7.0:
-    resolution: {integrity: sha512-Pdlw/oPxN+aXdmM9R00JVC9WVFoCLTKJvDVLgmJ+qAffBMxsV85l/Lu7sNx4zSzPyoL2euImuEwHhOXdEgNFZQ==}
-    engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
-
   pretty-ms@9.3.0:
     resolution: {integrity: sha512-gjVS5hOP+M3wMm5nmNOucbIrqudzs9v/57bWRHQWLYklXqoXKrVfYW2W9+glfGsqtPgpiz5WwyEEB+ksXIx3gQ==}
     engines: {node: '>=18'}
 
+  process-nextick-args@2.0.1:
+    resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+
   process-warning@5.0.0:
     resolution: {integrity: sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==}
 
+  process@0.11.10:
+    resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
+    engines: {node: '>= 0.6.0'}
+
   progress@2.0.3:
     resolution: {integrity: sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA==}
     engines: {node: '>=0.4.0'}
@@ -7348,9 +7012,20 @@ packages:
     resolution: {integrity: sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==}
     engines: {node: '>= 6'}
 
+  proper-lockfile@4.1.2:
+    resolution: {integrity: sha512-TjNPblN4BwAWMXU8s9AEz4JmQxnD1NNL7bNOY/AKUzyamc379FWASUhc/K1pL2noVb+XmZKLL68cjzLsiOAMaA==}
+
+  properties-reader@3.0.1:
+    resolution: {integrity: sha512-WPn+h9RGEExOKdu4bsF4HksG/uzd3cFq3MFtq8PsFeExPse5Ha/VOjQNyHhjboBFwGXGev6muJYTSPAOkROq2g==}
+    engines: {node: '>=18'}
+
   property-information@7.1.0:
     resolution: {integrity: sha512-TwEZ+X+yCJmYfL7TPUOcvBZ4QfoT5YenQiJuX//0th53DE6w0xxLEtfK3iyryQFddXuvkIk51EEgrJQ0WJkOmQ==}
 
+  protobufjs@7.6.5:
+    resolution: {integrity: sha512-/FPD0nUc9jH6rfFjji9IBqOz4pcSE3CsT1m7Ep6Mdb0LxSUMj8hgl6GomOvZzpNpAqqGaXA0P3VSrZLFzIhQrw==}
+    engines: {node: '>=12.0.0'}
+
   proxy-addr@2.0.7:
     resolution: {integrity: sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==}
     engines: {node: '>= 0.10'}
@@ -7358,13 +7033,13 @@ packages:
   proxy-from-env@1.1.0:
     resolution: {integrity: sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==}
 
+  pump@3.0.4:
+    resolution: {integrity: sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA==}
+
   punycode@2.3.1:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
-  pure-rand@6.1.0:
-    resolution: {integrity: sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA==}
-
   qs@6.14.0:
     resolution: {integrity: sha512-YWWTjgABSKcvs/nWBi9PycY/JiPJqOD4JA6o9Sej2AtvSGarXxKC3OQSk4pAarbdQlKAh5D4FCQkJNkW+GAn3w==}
     engines: {node: '>=0.6'}
@@ -7417,9 +7092,6 @@ packages:
   react-is@17.0.2:
     resolution: {integrity: sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==}
 
-  react-is@18.3.1:
-    resolution: {integrity: sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==}
-
   react-markdown@10.1.0:
     resolution: {integrity: sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==}
     peerDependencies:
@@ -7460,10 +7132,20 @@ packages:
     resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==}
     engines: {node: '>=0.10.0'}
 
+  readable-stream@2.3.8:
+    resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==}
+
   readable-stream@3.6.2:
     resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
     engines: {node: '>= 6'}
 
+  readable-stream@4.7.0:
+    resolution: {integrity: sha512-oIGGmcpTLwPga8Bn6/Z75SVaH1z5dUut2ibSyAMVhmUggWpmDn2dapB0n7f8nwaSiRtepAsfJyfXIO5DCVAODg==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  readdir-glob@1.1.3:
+    resolution: {integrity: sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==}
+
   readdirp@4.1.2:
     resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
     engines: {node: '>= 14.18.0'}
@@ -7544,25 +7226,13 @@ packages:
   resolve-alpn@1.2.1:
     resolution: {integrity: sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g==}
 
-  resolve-cwd@3.0.0:
-    resolution: {integrity: sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==}
-    engines: {node: '>=8'}
-
   resolve-from@4.0.0:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
 
-  resolve-from@5.0.0:
-    resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
-    engines: {node: '>=8'}
-
   resolve-pkg-maps@1.0.0:
     resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
 
-  resolve.exports@2.0.3:
-    resolution: {integrity: sha512-OcXjMsGdhL4XnbShKpAcSqPMzQoYkYyhbEaeSko47MjRP9NfEQMhZkXL1DoFlt9LWQn4YttrdnV6X2OiyzBi+A==}
-    engines: {node: '>=10'}
-
   resolve@1.22.10:
     resolution: {integrity: sha512-NPRy+/ncIMeDlTAsuqwKIiferiawhefFJtkNSW0qZJEqMEb+qBt/77B/jGeeek+F0uOeN05CDa6HXbbIgtVX4w==}
     engines: {node: '>= 0.4'}
@@ -7580,6 +7250,10 @@ packages:
     resolution: {integrity: sha512-oMA2dcrw6u0YfxJQXm342bFKX/E4sG9rbTzO9ptUcR/e8A33cHuvStiYOwH7fszkZlZ1z/ta9AAoPk2F4qIOHA==}
     engines: {node: '>=18'}
 
+  retry@0.12.0:
+    resolution: {integrity: sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==}
+    engines: {node: '>= 4'}
+
   reusify@1.0.4:
     resolution: {integrity: sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
@@ -7612,6 +7286,9 @@ packages:
   rxjs@7.8.1:
     resolution: {integrity: sha512-AA3TVj+0A2iuIoQkWEK/tqFjBq2j+6PO6Y0zJcvzLAFhEFIO3HL0vls9hWLncZbAAbK0mar7oZ4V079I/qPMxg==}
 
+  safe-buffer@5.1.2:
+    resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+
   safe-buffer@5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
@@ -7770,9 +7447,6 @@ packages:
     resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
     engines: {node: '>=0.10.0'}
 
-  source-map-support@0.5.13:
-    resolution: {integrity: sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==}
-
   source-map-support@0.5.21:
     resolution: {integrity: sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==}
 
@@ -7791,19 +7465,22 @@ packages:
   space-separated-tokens@2.0.2:
     resolution: {integrity: sha512-PEGlAwrG8yXGXRjW32fGbg66JAlOAwbObuqVoJpv/mRgoWDQfgH1wDPvtzWyUSNAXBGSk8h755YDbbcEy3SH2Q==}
 
+  split-ca@1.0.1:
+    resolution: {integrity: sha512-Q5thBSxp5t8WPTTJQS59LrGqOZqOsrhDGDVm8azCqIBjSBd7nd9o2PM+mDulQQkh8h//4U6hFZnc/mul8t5pWQ==}
+
   split2@4.2.0:
     resolution: {integrity: sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==}
     engines: {node: '>= 10.x'}
 
-  sprintf-js@1.0.3:
-    resolution: {integrity: sha512-D9cPgkvLlV3t3IzL0D0YLvGA9Ahk4PcvVwUbN0dSGr1aP0Nrt4AEnTUbuGvquEC0mA64Gqt1fzirlRs5ibXx8g==}
-
   sqids@0.3.0:
     resolution: {integrity: sha512-lOQK1ucVg+W6n3FhRwwSeUijxe93b51Bfz5PMRMihVf1iVkl82ePQG7V5vwrhzB11v0NtsR25PSZRGiSomJaJw==}
 
-  stack-utils@2.0.6:
-    resolution: {integrity: sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ==}
-    engines: {node: '>=10'}
+  ssh-remote-port-forward@1.0.4:
+    resolution: {integrity: sha512-x0LV1eVDwjf1gmG7TTnfqIzf+3VPRz7vrNIjX6oYLbeCrf/PeVY6hkT68Mg+q02qXxQhrLjB0jfgvhevoCRmLQ==}
+
+  ssh2@1.17.0:
+    resolution: {integrity: sha512-wPldCk3asibAjQ/kziWQQt1Wh3PgDFpC0XpwclzKcdT1vql6KeYxf5LIt4nlFkUeR8WuphYMKqUA56X4rjbfgQ==}
+    engines: {node: '>=10.16.0'}
 
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
@@ -7862,9 +7539,8 @@ packages:
   streamx@2.22.1:
     resolution: {integrity: sha512-znKXEBxfatz2GBNK02kRnCXjV+AA4kjZIUxeWSr3UGirZMJfTE9uiwKHobnbgxWyL/JWro8tTq+vOqAK1/qbSA==}
 
-  string-length@4.0.2:
-    resolution: {integrity: sha512-+l6rNN5fYHNhZZy41RXsYptCjA2Igmq4EG7kZAYFQI1E1VTXarr6ZPXBg6eq7Y6eK4FEhY6AJlyuFIb/v/S0VQ==}
-    engines: {node: '>=10'}
+  streamx@2.28.0:
+    resolution: {integrity: sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw==}
 
   string-width@4.2.3:
     resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
@@ -7878,6 +7554,9 @@ packages:
     resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
     engines: {node: '>=18'}
 
+  string_decoder@1.1.1:
+    resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
+
   string_decoder@1.3.0:
     resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
 
@@ -7900,10 +7579,6 @@ packages:
     resolution: {integrity: sha512-vavAMRXOgBVNF6nyEEmL3DBK19iRpDcoIwW+swQ+CbGiu7lju6t+JklA1MHweoWtadgt4ISVUsXLyDq34ddcwA==}
     engines: {node: '>=4'}
 
-  strip-bom@4.0.0:
-    resolution: {integrity: sha512-3xurFv5tEgii33Zi8Jtp55wEIILR9eh34FAW00PZf+JnSsTmV/ioewSgQl97JHvgjoRGwPShsWm+IdrxB35d0w==}
-    engines: {node: '>=8'}
-
   strip-dirs@3.0.0:
     resolution: {integrity: sha512-I0sdgcFTfKQlUPZyAqPJmSG3HLO9rWDFnxonnIbskYNM3DwFOeTNB5KzVq3dA1GdRAc/25b5Y7UO2TQfKWw4aQ==}
 
@@ -7923,10 +7598,6 @@ packages:
     resolution: {integrity: sha512-SlyRoSkdh1dYP0PzclLE7r0M9sgbFKKMFXpFRUMNuKhQSbC6VQIGzq3E0qsfvGJaUFJPGv6Ws1NZ/haTAjfbMA==}
     engines: {node: '>=12'}
 
-  strip-json-comments@3.1.1:
-    resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
-    engines: {node: '>=8'}
-
   strtok3@10.3.4:
     resolution: {integrity: sha512-KIy5nylvC5le1OdaaoCJ07L+8iQzJHGH6pWDuzS+d07Cu7n1MZ2x26P8ZKIWfbK02+XIL8Mp4RkWeqdUCrDMfg==}
     engines: {node: '>=18'}
@@ -8012,9 +7683,22 @@ packages:
     resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
     engines: {node: '>=6'}
 
+  tar-fs@2.1.5:
+    resolution: {integrity: sha512-OboTd8mmMhZDNPV+UjQcK9yKAatXu2aJ+r1w4im1Otd4M4fl2hwvdoXUxIYHFTHWK/3y3FarBP70v3vwmGlOxw==}
+
+  tar-fs@3.1.3:
+    resolution: {integrity: sha512-/hU4AXnIdZu+Gvl1pk0oI5f5HxWsCJRtY2aFaJdk9VvyL48DWU6iU5WAIPG+wIi1YvWA6eTJvIviP/tMAZZNwQ==}
+
+  tar-stream@2.2.0:
+    resolution: {integrity: sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==}
+    engines: {node: '>=6'}
+
   tar-stream@3.1.7:
     resolution: {integrity: sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==}
 
+  teex@1.0.1:
+    resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}
+
   terser-webpack-plugin@5.3.14:
     resolution: {integrity: sha512-vkZjpUjb6OMS7dhV+tILUW6BhpDR7P2L/aQSAv+Uwk+m8KATX9EccViHTJR2qDtACKPIYndLGCyl3FMo+r2LMw==}
     engines: {node: '>= 10.13.0'}
@@ -8036,9 +7720,8 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
-  test-exclude@6.0.0:
-    resolution: {integrity: sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==}
-    engines: {node: '>=8'}
+  testcontainers@12.0.4:
+    resolution: {integrity: sha512-QIR/8xF1+F/26cIM+9B4yyxNTbKJxAv3hygZyhPRgZ8Q2AhlPZjDdpXRuk16V37X4bgJRI3hXFhoEICMBA7Adg==}
 
   text-decoder@1.2.3:
     resolution: {integrity: sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==}
@@ -8094,8 +7777,9 @@ packages:
     resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==}
     engines: {node: '>=0.6.0'}
 
-  tmpl@1.0.5:
-    resolution: {integrity: sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==}
+  tmp@0.2.7:
+    resolution: {integrity: sha512-e0votIpp4Uo2AJYSzVHV6xCcawuiez3DzqDAbrTc3YxBkplN6e+dM13ZeIcZnDg/QpSuU2zfZ3rzwY8ukEnaXw==}
+    engines: {node: '>=14.14'}
 
   to-regex-range@5.0.1:
     resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
@@ -8138,57 +7822,9 @@ packages:
     resolution: {integrity: sha512-JfJeIHke7y2egdGGgRAvpCwYFUsHlM2gPcrVOxFkznt/4uzQ7HFmvE63iFHVLBJNDuyDOQgijDK/tXH/f6Msjg==}
     engines: {node: '>=6.10'}
 
-  ts-jest@29.4.0:
-    resolution: {integrity: sha512-d423TJMnJGu80/eSgfQ5w/R+0zFJvdtTxwtF9KzFFunOpSeD+79lHJQIiAhluJoyGRbvj9NZJsl9WjCUo0ND7Q==}
-    engines: {node: ^14.15.0 || ^16.10.0 || ^18.0.0 || >=20.0.0}
-    hasBin: true
-    peerDependencies:
-      '@babel/core': '>=7.0.0-beta.0 <8'
-      '@jest/transform': ^29.0.0 || ^30.0.0
-      '@jest/types': ^29.0.0 || ^30.0.0
-      babel-jest: ^29.0.0 || ^30.0.0
-      esbuild: '*'
-      jest: ^29.0.0 || ^30.0.0
-      jest-util: ^29.0.0 || ^30.0.0
-      typescript: '>=4.3 <6'
-    peerDependenciesMeta:
-      '@babel/core':
-        optional: true
-      '@jest/transform':
-        optional: true
-      '@jest/types':
-        optional: true
-      babel-jest:
-        optional: true
-      esbuild:
-        optional: true
-      jest-util:
-        optional: true
-
-  ts-loader@9.5.2:
-    resolution: {integrity: sha512-Qo4piXvOTWcMGIgRiuFa6nHNm+54HbYaZCKqc9eeZCLRy3XqafQgwX2F7mofrbJG3g7EEb+lkiR+z2Lic2s3Zw==}
-    engines: {node: '>=12.0.0'}
-    peerDependencies:
-      typescript: '*'
-      webpack: ^5.0.0
-
   ts-morph@26.0.0:
     resolution: {integrity: sha512-ztMO++owQnz8c/gIENcM9XfCEzgoGphTv+nKpYNM1bgsdOVC/jRZuEBf6N+mLLDNg68Kl+GgUZfOySaRiG1/Ug==}
 
-  ts-node@10.9.2:
-    resolution: {integrity: sha512-f0FFpIdcHgn8zcPSbf1dRevwt047YMnaiJM3u2w2RewrB+fob/zePZcrOyQoLMMO7aBIddLcQIEK5dYjkLnGrQ==}
-    hasBin: true
-    peerDependencies:
-      '@swc/core': '>=1.2.50'
-      '@swc/wasm': '>=1.2.50'
-      '@types/node': '*'
-      typescript: '>=2.7'
-    peerDependenciesMeta:
-      '@swc/core':
-        optional: true
-      '@swc/wasm':
-        optional: true
-
   tsconfck@3.1.6:
     resolution: {integrity: sha512-ks6Vjr/jEw0P1gmOVwutM3B7fWxoWBL2KRDb1JfqGVawBmO5UsvmWOQFGHBPl5yxYz4eERr19E6L7NMv+Fej4w==}
     engines: {node: ^18 || >=20}
@@ -8223,9 +7859,8 @@ packages:
   tw-animate-css@1.2.4:
     resolution: {integrity: sha512-yt+HkJB41NAvOffe4NweJU6fLqAlVx/mBX6XmHRp15kq0JxTtOKaIw8pVSWM1Z+n2nXtyi7cW6C9f0WG/F/QAQ==}
 
-  type-detect@4.0.8:
-    resolution: {integrity: sha512-0fr/mIH1dlO+x7TlcMy+bIDqKPsw/70tVyeHW787goQjhmqaZe10uwLujubK9q9Lg6Fiho1KUKDYz0Z7k7g5/g==}
-    engines: {node: '>=4'}
+  tweetnacl@0.14.5:
+    resolution: {integrity: sha512-KXXFFdAbFXY4geFIwoyNK+f5Z1b7swfXABfL7HXCmoIWMKU3dmS26672A4EeQtDzLKy7SXmfBu51JolvEKwtGA==}
 
   type-fest@0.21.3:
     resolution: {integrity: sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==}
@@ -8235,10 +7870,6 @@ packages:
     resolution: {integrity: sha512-Ne2YiiGN8bmrmJJEuTWTLJR32nh/JdL1+PSicowtNb0WFpn59GK8/lfD61bVtzguz7b3PBt74nxpv/Pw5po5Rg==}
     engines: {node: '>=8'}
 
-  type-fest@4.41.0:
-    resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
-    engines: {node: '>=16'}
-
   type-fest@5.7.0:
     resolution: {integrity: sha512-1URUxUqfHFM1c+zfSPsa3gnkO7Aq21qyH75SIduNYz4SzY964rn1X2vCMQaHSHhktiw+0kPa2iyb6PUpXqB6Vg==}
     engines: {node: '>=20'}
@@ -8284,6 +7915,9 @@ packages:
   unbzip2-stream@1.4.3:
     resolution: {integrity: sha512-mlExGW4w71ebDJviH16lQLtZS32VKqsSfk80GCfUlwT/4/hNRFsoscrF/c++9xinkMzECL1uL9DDwXqFWkruPg==}
 
+  undici-types@5.26.5:
+    resolution: {integrity: sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==}
+
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
@@ -8294,6 +7928,10 @@ packages:
     resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
     engines: {node: '>=20.18.1'}
 
+  undici@8.9.0:
+    resolution: {integrity: sha512-aWZpUj7XoGonMClx4gdDRfgBjqeA+F473aDmROQQbM9n6PRfK/u1q/a0X4wMTgcHfT8H6fpbt98PFuDUwFg2YA==}
+    engines: {node: '>=22.19.0'}
+
   unicorn-magic@0.3.0:
     resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
     engines: {node: '>=18'}
@@ -8324,6 +7962,11 @@ packages:
     resolution: {integrity: sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==}
     engines: {node: '>= 0.8'}
 
+  unplugin-swc@1.5.9:
+    resolution: {integrity: sha512-RKwK3yf0M+MN17xZfF14bdKqfx0zMXYdtOdxLiE6jHAoidupKq3jGdJYANyIM1X/VmABhh1WpdO+/f4+Ol89+g==}
+    peerDependencies:
+      '@swc/core': ^1.2.108
+
   unplugin@2.3.11:
     resolution: {integrity: sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww==}
     engines: {node: '>=18.12.0'}
@@ -8388,13 +8031,6 @@ packages:
     resolution: {integrity: sha512-Qo+uWgilfSmAhXCMav1uYFynlQO7fMFiMVZsQqZRMIXp0O7rR7qjkj+cPvBHLgBqi960QCoo/PH2/6ZtVqKvrg==}
     hasBin: true
 
-  v8-compile-cache-lib@3.0.1:
-    resolution: {integrity: sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==}
-
-  v8-to-istanbul@9.3.0:
-    resolution: {integrity: sha512-kiGUalWN+rgBJ/1OHZsBtU4rXZOfj/7rKQxULKlIzwzQSvMJUUNgPwJEEh7gU6xEVxC0ahoOBvN2YI8GH6FNgA==}
-    engines: {node: '>=10.12.0'}
-
   valibot@1.2.0:
     resolution: {integrity: sha512-mm1rxUsmOxzrwnX5arGS+U4T25RdvpPjPN4yR0u9pUBov9+zGVtO84tif1eY4r6zWxVxu3KzIyknJy3rxfRZZg==}
     peerDependencies:
@@ -8529,9 +8165,6 @@ packages:
     resolution: {integrity: sha512-o8qghlI8NZHU1lLPrpi2+Uq7abh4GGPpYANlalzWxyWteJOCsr/P+oPBA49TOLu5FTZO4d3F9MnWJfiMo4BkmA==}
     engines: {node: '>=18'}
 
-  walker@1.0.8:
-    resolution: {integrity: sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==}
-
   watchpack@2.4.4:
     resolution: {integrity: sha512-c5EGNOiyxxV5qmTtAB7rbiXxi1ooX1pQKMLX/MIabJjRA0SJBQOjKF+KSVfHkr9U1cADPon0mRiVe/riyaiDUA==}
     engines: {node: '>=10.13.0'}
@@ -8614,10 +8247,6 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  write-file-atomic@4.0.2:
-    resolution: {integrity: sha512-7KxauUdBmSdWnmpaGFg+ppNjKF8uNLry8LyzjauQDOVONfFLNKrKvQOxZ/VuTIcS/gge/YNahf5RIIQWTSarlg==}
-    engines: {node: ^12.13.0 || ^14.15.0 || >=16.0.0}
-
   ws@8.21.0:
     resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
@@ -8665,18 +8294,14 @@ packages:
     resolution: {integrity: sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==}
     engines: {node: '>=12'}
 
-  yargs@17.7.2:
-    resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
+  yargs@17.7.3:
+    resolution: {integrity: sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g==}
     engines: {node: '>=12'}
 
   yauzl@3.2.0:
     resolution: {integrity: sha512-Ow9nuGZE+qp1u4JIPvg+uCiUr7xGQWdff7JQSk5VGYTAZMDe2q8lxJ10ygv10qmSj031Ty/6FNJpLO4o1Sgc+w==}
     engines: {node: '>=12'}
 
-  yn@3.1.1:
-    resolution: {integrity: sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==}
-    engines: {node: '>=6'}
-
   yocto-queue@0.1.0:
     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
     engines: {node: '>=10'}
@@ -8693,6 +8318,10 @@ packages:
     resolution: {integrity: sha512-CzhO+pFNo8ajLM2d2IW/R93ipy99LWjtwblvC1RsoSUMZgyLbYFr221TnSNT7GjGdYui6P459mw9JH/g/zW2ug==}
     engines: {node: '>=18'}
 
+  zip-stream@6.0.1:
+    resolution: {integrity: sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA==}
+    engines: {node: '>= 14'}
+
   zod-to-json-schema@3.25.2:
     resolution: {integrity: sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA==}
     peerDependencies:
@@ -8888,14 +8517,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/generator@7.28.0':
-    dependencies:
-      '@babel/parser': 7.29.7
-      '@babel/types': 7.29.7
-      '@jridgewell/gen-mapping': 0.3.12
-      '@jridgewell/trace-mapping': 0.3.29
-      jsesc: 3.1.0
-
   '@babel/generator@7.29.7':
     dependencies:
       '@babel/parser': 7.29.7
@@ -8995,96 +8616,11 @@ snapshots:
     dependencies:
       '@babel/types': 7.29.7
 
-  '@babel/plugin-syntax-async-generators@7.8.4(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-bigint@7.8.3(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-class-properties@7.12.13(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-class-static-block@7.14.5(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-import-attributes@7.27.1(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-import-meta@7.10.4(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-json-strings@7.8.3(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-jsx@7.27.1(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
   '@babel/plugin-syntax-jsx@7.29.7(@babel/core@7.28.0)':
     dependencies:
       '@babel/core': 7.28.0
       '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-syntax-logical-assignment-operators@7.10.4(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-nullish-coalescing-operator@7.8.3(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-numeric-separator@7.10.4(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-object-rest-spread@7.8.3(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-optional-catch-binding@7.8.3(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-optional-chaining@7.8.3(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-private-property-in-object@7.14.5(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-top-level-await@7.14.5(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
-  '@babel/plugin-syntax-typescript@7.27.1(@babel/core@7.28.0)':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/helper-plugin-utils': 7.29.7
-
   '@babel/plugin-syntax-typescript@7.29.7(@babel/core@7.28.0)':
     dependencies:
       '@babel/core': 7.28.0
@@ -9157,6 +8693,8 @@ snapshots:
       '@babel/helper-string-parser': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
 
+  '@balena/dockerignore@1.0.2': {}
+
   '@base-ui/react@1.6.0(@types/react@19.0.10)(date-fns@4.1.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.29.7
@@ -9181,8 +8719,6 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.0.10
 
-  '@bcoe/v8-coverage@0.2.3': {}
-
   '@blazediff/core@1.9.1': {}
 
   '@braintree/sanitize-url@7.1.2': {}
@@ -9196,10 +8732,6 @@ snapshots:
   '@colors/colors@1.5.0':
     optional: true
 
-  '@cspotcode/source-map-support@0.8.1':
-    dependencies:
-      '@jridgewell/trace-mapping': 0.3.9
-
   '@csstools/color-helpers@6.1.0': {}
 
   '@csstools/css-calc@3.2.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
@@ -9529,9 +9061,28 @@ snapshots:
 
   '@floating-ui/utils@0.2.12': {}
 
-  '@hono/node-server@1.19.14(hono@4.12.30)':
+  '@grpc/grpc-js@1.14.4':
     dependencies:
-      hono: 4.12.30
+      '@grpc/proto-loader': 0.8.1
+      '@js-sdsl/ordered-map': 4.4.2
+
+  '@grpc/proto-loader@0.7.15':
+    dependencies:
+      lodash.camelcase: 4.3.0
+      long: 5.3.2
+      protobufjs: 7.6.5
+      yargs: 17.7.3
+
+  '@grpc/proto-loader@0.8.1':
+    dependencies:
+      lodash.camelcase: 4.3.0
+      long: 5.3.2
+      protobufjs: 7.6.5
+      yargs: 17.7.3
+
+  '@hono/node-server@1.19.14(hono@4.12.30)':
+    dependencies:
+      hono: 4.12.30
 
   '@hookform/resolvers@5.1.1(react-hook-form@7.59.0(react@19.2.7))':
     dependencies:
@@ -9789,178 +9340,6 @@ snapshots:
       wrap-ansi: 8.1.0
       wrap-ansi-cjs: wrap-ansi@7.0.0
 
-  '@istanbuljs/load-nyc-config@1.1.0':
-    dependencies:
-      camelcase: 5.3.1
-      find-up: 4.1.0
-      get-package-type: 0.1.0
-      js-yaml: 3.14.1
-      resolve-from: 5.0.0
-
-  '@istanbuljs/schema@0.1.3': {}
-
-  '@jest/console@29.7.0':
-    dependencies:
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      chalk: 4.1.2
-      jest-message-util: 29.7.0
-      jest-util: 29.7.0
-      slash: 3.0.0
-
-  '@jest/core@29.7.0(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))':
-    dependencies:
-      '@jest/console': 29.7.0
-      '@jest/reporters': 29.7.0
-      '@jest/test-result': 29.7.0
-      '@jest/transform': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      ansi-escapes: 4.3.2
-      chalk: 4.1.2
-      ci-info: 3.9.0
-      exit: 0.1.2
-      graceful-fs: 4.2.11
-      jest-changed-files: 29.7.0
-      jest-config: 29.7.0(@types/node@26.1.1)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-      jest-haste-map: 29.7.0
-      jest-message-util: 29.7.0
-      jest-regex-util: 29.6.3
-      jest-resolve: 29.7.0
-      jest-resolve-dependencies: 29.7.0
-      jest-runner: 29.7.0
-      jest-runtime: 29.7.0
-      jest-snapshot: 29.7.0
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      jest-watcher: 29.7.0
-      micromatch: 4.0.8
-      pretty-format: 29.7.0
-      slash: 3.0.0
-      strip-ansi: 6.0.1
-    transitivePeerDependencies:
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
-
-  '@jest/environment@29.7.0':
-    dependencies:
-      '@jest/fake-timers': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      jest-mock: 29.7.0
-
-  '@jest/expect-utils@29.7.0':
-    dependencies:
-      jest-get-type: 29.6.3
-
-  '@jest/expect@29.7.0':
-    dependencies:
-      expect: 29.7.0
-      jest-snapshot: 29.7.0
-    transitivePeerDependencies:
-      - supports-color
-
-  '@jest/fake-timers@29.7.0':
-    dependencies:
-      '@jest/types': 29.6.3
-      '@sinonjs/fake-timers': 10.3.0
-      '@types/node': 26.1.1
-      jest-message-util: 29.7.0
-      jest-mock: 29.7.0
-      jest-util: 29.7.0
-
-  '@jest/globals@29.7.0':
-    dependencies:
-      '@jest/environment': 29.7.0
-      '@jest/expect': 29.7.0
-      '@jest/types': 29.6.3
-      jest-mock: 29.7.0
-    transitivePeerDependencies:
-      - supports-color
-
-  '@jest/reporters@29.7.0':
-    dependencies:
-      '@bcoe/v8-coverage': 0.2.3
-      '@jest/console': 29.7.0
-      '@jest/test-result': 29.7.0
-      '@jest/transform': 29.7.0
-      '@jest/types': 29.6.3
-      '@jridgewell/trace-mapping': 0.3.29
-      '@types/node': 26.1.1
-      chalk: 4.1.2
-      collect-v8-coverage: 1.0.2
-      exit: 0.1.2
-      glob: 7.2.3
-      graceful-fs: 4.2.11
-      istanbul-lib-coverage: 3.2.2
-      istanbul-lib-instrument: 6.0.3
-      istanbul-lib-report: 3.0.1
-      istanbul-lib-source-maps: 4.0.1
-      istanbul-reports: 3.1.7
-      jest-message-util: 29.7.0
-      jest-util: 29.7.0
-      jest-worker: 29.7.0
-      slash: 3.0.0
-      string-length: 4.0.2
-      strip-ansi: 6.0.1
-      v8-to-istanbul: 9.3.0
-    transitivePeerDependencies:
-      - supports-color
-
-  '@jest/schemas@29.6.3':
-    dependencies:
-      '@sinclair/typebox': 0.27.8
-
-  '@jest/source-map@29.6.3':
-    dependencies:
-      '@jridgewell/trace-mapping': 0.3.29
-      callsites: 3.1.0
-      graceful-fs: 4.2.11
-
-  '@jest/test-result@29.7.0':
-    dependencies:
-      '@jest/console': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/istanbul-lib-coverage': 2.0.6
-      collect-v8-coverage: 1.0.2
-
-  '@jest/test-sequencer@29.7.0':
-    dependencies:
-      '@jest/test-result': 29.7.0
-      graceful-fs: 4.2.11
-      jest-haste-map: 29.7.0
-      slash: 3.0.0
-
-  '@jest/transform@29.7.0':
-    dependencies:
-      '@babel/core': 7.28.0
-      '@jest/types': 29.6.3
-      '@jridgewell/trace-mapping': 0.3.29
-      babel-plugin-istanbul: 6.1.1
-      chalk: 4.1.2
-      convert-source-map: 2.0.0
-      fast-json-stable-stringify: 2.1.0
-      graceful-fs: 4.2.11
-      jest-haste-map: 29.7.0
-      jest-regex-util: 29.6.3
-      jest-util: 29.7.0
-      micromatch: 4.0.8
-      pirates: 4.0.7
-      slash: 3.0.0
-      write-file-atomic: 4.0.2
-    transitivePeerDependencies:
-      - supports-color
-
-  '@jest/types@29.6.3':
-    dependencies:
-      '@jest/schemas': 29.6.3
-      '@types/istanbul-lib-coverage': 2.0.6
-      '@types/istanbul-reports': 3.0.4
-      '@types/node': 26.1.1
-      '@types/yargs': 17.0.33
-      chalk: 4.1.2
-
   '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(typescript@5.7.3)(vite@6.4.3(@types/node@22.16.5)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.43.1)(tsx@4.20.3)(yaml@2.8.0))':
     dependencies:
       glob: 13.0.6
@@ -9995,10 +9374,7 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  '@jridgewell/trace-mapping@0.3.9':
-    dependencies:
-      '@jridgewell/resolve-uri': 3.1.2
-      '@jridgewell/sourcemap-codec': 1.5.5
+  '@js-sdsl/ordered-map@4.4.2': {}
 
   '@knaadh/nestjs-drizzle-postgres@1.2.0(@nestjs/common@11.1.5(class-transformer@0.5.1)(class-validator@0.15.1)(reflect-metadata@0.2.2)(rxjs@7.8.1))(drizzle-orm@0.45.2(@opentelemetry/api@1.9.1)(@types/pg@8.6.1)(pg@8.22.0)(postgres@3.4.7))(postgres@3.4.7)':
     dependencies:
@@ -10006,6 +9382,12 @@ snapshots:
       drizzle-orm: 0.45.2(@opentelemetry/api@1.9.1)(@types/pg@8.6.1)(pg@8.22.0)(postgres@3.4.7)
       postgres: 3.4.7
 
+  '@kwsites/file-exists@1.1.1':
+    dependencies:
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
   '@lukeed/csprng@1.1.0': {}
 
   '@mdx-js/react@3.1.1(@types/react@19.0.10)(react@19.2.7)':
@@ -10559,12 +9941,35 @@ snapshots:
 
   '@pinojs/redact@0.4.0': {}
 
+  '@pkgjs/parseargs@0.11.0':
+    optional: true
+
   '@playwright/test@1.55.1':
     dependencies:
       playwright: 1.55.1
 
   '@polka/url@1.0.0-next.29': {}
 
+  '@protobufjs/aspromise@1.1.2': {}
+
+  '@protobufjs/base64@1.1.2': {}
+
+  '@protobufjs/codegen@2.0.5': {}
+
+  '@protobufjs/eventemitter@1.1.1': {}
+
+  '@protobufjs/fetch@1.1.1':
+    dependencies:
+      '@protobufjs/aspromise': 1.1.2
+
+  '@protobufjs/float@1.0.2': {}
+
+  '@protobufjs/path@1.1.2': {}
+
+  '@protobufjs/pool@1.1.0': {}
+
+  '@protobufjs/utf8@1.1.2': {}
+
   '@radix-ui/primitive@1.1.2': {}
 
   '@radix-ui/react-compose-refs@1.1.2(@types/react@19.0.10)(react@19.2.7)':
@@ -10749,6 +10154,14 @@ snapshots:
     optionalDependencies:
       rollup: 4.62.2
 
+  '@rollup/pluginutils@5.4.0(rollup@4.62.2)':
+    dependencies:
+      '@types/estree': 1.0.9
+      estree-walker: 2.0.2
+      picomatch: 4.0.4
+    optionalDependencies:
+      rollup: 4.62.2
+
   '@rollup/rollup-android-arm-eabi@4.62.2':
     optional: true
 
@@ -11042,20 +10455,10 @@ snapshots:
 
   '@shikijs/vscode-textmate@10.0.2': {}
 
-  '@sinclair/typebox@0.27.8': {}
-
   '@sindresorhus/is@5.6.0': {}
 
   '@sindresorhus/merge-streams@4.0.0': {}
 
-  '@sinonjs/commons@3.0.1':
-    dependencies:
-      type-detect: 4.0.8
-
-  '@sinonjs/fake-timers@10.3.0':
-    dependencies:
-      '@sinonjs/commons': 3.0.1
-
   '@standard-schema/spec@1.1.0': {}
 
   '@standard-schema/utils@0.3.0': {}
@@ -11393,6 +10796,15 @@ snapshots:
       '@tanstack/query-core': 5.81.5
       react: 19.2.7
 
+  '@testcontainers/postgresql@12.0.4':
+    dependencies:
+      testcontainers: 12.0.4
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+      - supports-color
+
   '@testing-library/dom@10.4.1':
     dependencies:
       '@babel/code-frame': 7.29.7
@@ -11460,14 +10872,6 @@ snapshots:
       minimatch: 10.2.5
       path-browserify: 1.0.1
 
-  '@tsconfig/node10@1.0.11': {}
-
-  '@tsconfig/node12@1.0.11': {}
-
-  '@tsconfig/node14@1.0.3': {}
-
-  '@tsconfig/node16@1.0.4': {}
-
   '@turbo/darwin-64@2.10.4':
     optional: true
 
@@ -11653,6 +11057,17 @@ snapshots:
 
   '@types/deep-eql@4.0.2': {}
 
+  '@types/docker-modem@3.0.6':
+    dependencies:
+      '@types/node': 26.1.1
+      '@types/ssh2': 1.15.5
+
+  '@types/dockerode@4.0.1':
+    dependencies:
+      '@types/docker-modem': 3.0.6
+      '@types/node': 26.1.1
+      '@types/ssh2': 1.15.5
+
   '@types/doctrine@0.0.9': {}
 
   '@types/eslint-scope@3.7.7':
@@ -11688,10 +11103,6 @@ snapshots:
 
   '@types/geojson@7946.0.16': {}
 
-  '@types/graceful-fs@4.1.9':
-    dependencies:
-      '@types/node': 26.1.1
-
   '@types/hast@3.0.4':
     dependencies:
       '@types/unist': 3.0.3
@@ -11700,21 +11111,6 @@ snapshots:
 
   '@types/http-errors@2.0.5': {}
 
-  '@types/istanbul-lib-coverage@2.0.6': {}
-
-  '@types/istanbul-lib-report@3.0.3':
-    dependencies:
-      '@types/istanbul-lib-coverage': 2.0.6
-
-  '@types/istanbul-reports@3.0.4':
-    dependencies:
-      '@types/istanbul-lib-report': 3.0.3
-
-  '@types/jest@29.5.14':
-    dependencies:
-      expect: 29.7.0
-      pretty-format: 29.7.0
-
   '@types/js-cookie@3.0.6': {}
 
   '@types/json-schema@7.0.15': {}
@@ -11731,6 +11127,10 @@ snapshots:
 
   '@types/ms@2.1.0': {}
 
+  '@types/node@18.19.130':
+    dependencies:
+      undici-types: 5.26.5
+
   '@types/node@22.16.5':
     dependencies:
       undici-types: 6.21.0
@@ -11771,7 +11171,18 @@ snapshots:
       '@types/node': 26.1.1
       '@types/send': 0.17.5
 
-  '@types/stack-utils@2.0.3': {}
+  '@types/ssh2-streams@0.1.13':
+    dependencies:
+      '@types/node': 26.1.1
+
+  '@types/ssh2@0.5.52':
+    dependencies:
+      '@types/node': 26.1.1
+      '@types/ssh2-streams': 0.1.13
+
+  '@types/ssh2@1.15.5':
+    dependencies:
+      '@types/node': 18.19.130
 
   '@types/superagent@8.1.9':
     dependencies:
@@ -11798,12 +11209,6 @@ snapshots:
 
   '@types/validator@13.15.10': {}
 
-  '@types/yargs-parser@21.0.3': {}
-
-  '@types/yargs@17.0.33':
-    dependencies:
-      '@types/yargs-parser': 21.0.3
-
   '@typescript/native-preview-darwin-arm64@7.0.0-dev.20260703.1':
     optional: true
 
@@ -12114,6 +11519,10 @@ snapshots:
 
   '@xtuc/long@4.2.2': {}
 
+  abort-controller@3.0.0:
+    dependencies:
+      event-target-shim: 5.0.1
+
   accepts@2.0.0:
     dependencies:
       mime-types: 3.0.1
@@ -12127,10 +11536,6 @@ snapshots:
     dependencies:
       acorn: 8.15.0
 
-  acorn-walk@8.3.4:
-    dependencies:
-      acorn: 8.15.0
-
   acorn@8.15.0: {}
 
   agent-base@6.0.2:
@@ -12211,20 +11616,29 @@ snapshots:
 
   ansis@4.1.0: {}
 
-  anymatch@3.1.3:
-    dependencies:
-      normalize-path: 3.0.0
-      picomatch: 2.3.2
-
   append-field@1.0.0: {}
 
   arch@3.0.0: {}
 
-  arg@4.1.3: {}
+  archiver-utils@5.0.2:
+    dependencies:
+      glob: 10.5.0
+      graceful-fs: 4.2.11
+      is-stream: 2.0.1
+      lazystream: 1.0.1
+      lodash: 4.18.1
+      normalize-path: 3.0.0
+      readable-stream: 4.7.0
 
-  argparse@1.0.10:
+  archiver@7.0.1:
     dependencies:
-      sprintf-js: 1.0.3
+      archiver-utils: 5.0.2
+      async: 3.2.6
+      buffer-crc32: 1.0.0
+      readable-stream: 4.7.0
+      readdir-glob: 1.1.3
+      tar-stream: 3.1.7
+      zip-stream: 6.0.1
 
   argparse@2.0.1: {}
 
@@ -12240,6 +11654,10 @@ snapshots:
 
   asap@2.0.6: {}
 
+  asn1@0.2.6:
+    dependencies:
+      safer-buffer: 2.1.2
+
   assertion-error@2.0.1: {}
 
   ast-types@0.16.1:
@@ -12248,6 +11666,8 @@ snapshots:
 
   astring@1.9.0: {}
 
+  async-lock@1.4.1: {}
+
   async@3.2.6: {}
 
   asynckit@0.4.0: {}
@@ -12260,60 +11680,8 @@ snapshots:
 
   b4a@1.6.7: {}
 
-  babel-jest@29.7.0(@babel/core@7.28.0):
-    dependencies:
-      '@babel/core': 7.28.0
-      '@jest/transform': 29.7.0
-      '@types/babel__core': 7.20.5
-      babel-plugin-istanbul: 6.1.1
-      babel-preset-jest: 29.6.3(@babel/core@7.28.0)
-      chalk: 4.1.2
-      graceful-fs: 4.2.11
-      slash: 3.0.0
-    transitivePeerDependencies:
-      - supports-color
-
-  babel-plugin-istanbul@6.1.1:
-    dependencies:
-      '@babel/helper-plugin-utils': 7.29.7
-      '@istanbuljs/load-nyc-config': 1.1.0
-      '@istanbuljs/schema': 0.1.3
-      istanbul-lib-instrument: 5.2.1
-      test-exclude: 6.0.0
-    transitivePeerDependencies:
-      - supports-color
-
-  babel-plugin-jest-hoist@29.6.3:
-    dependencies:
-      '@babel/template': 7.29.7
-      '@babel/types': 7.29.7
-      '@types/babel__core': 7.20.5
-      '@types/babel__traverse': 7.20.7
-
-  babel-preset-current-node-syntax@1.1.1(@babel/core@7.28.0):
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/plugin-syntax-async-generators': 7.8.4(@babel/core@7.28.0)
-      '@babel/plugin-syntax-bigint': 7.8.3(@babel/core@7.28.0)
-      '@babel/plugin-syntax-class-properties': 7.12.13(@babel/core@7.28.0)
-      '@babel/plugin-syntax-class-static-block': 7.14.5(@babel/core@7.28.0)
-      '@babel/plugin-syntax-import-attributes': 7.27.1(@babel/core@7.28.0)
-      '@babel/plugin-syntax-import-meta': 7.10.4(@babel/core@7.28.0)
-      '@babel/plugin-syntax-json-strings': 7.8.3(@babel/core@7.28.0)
-      '@babel/plugin-syntax-logical-assignment-operators': 7.10.4(@babel/core@7.28.0)
-      '@babel/plugin-syntax-nullish-coalescing-operator': 7.8.3(@babel/core@7.28.0)
-      '@babel/plugin-syntax-numeric-separator': 7.10.4(@babel/core@7.28.0)
-      '@babel/plugin-syntax-object-rest-spread': 7.8.3(@babel/core@7.28.0)
-      '@babel/plugin-syntax-optional-catch-binding': 7.8.3(@babel/core@7.28.0)
-      '@babel/plugin-syntax-optional-chaining': 7.8.3(@babel/core@7.28.0)
-      '@babel/plugin-syntax-private-property-in-object': 7.14.5(@babel/core@7.28.0)
-      '@babel/plugin-syntax-top-level-await': 7.14.5(@babel/core@7.28.0)
-
-  babel-preset-jest@29.6.3(@babel/core@7.28.0):
-    dependencies:
-      '@babel/core': 7.28.0
-      babel-plugin-jest-hoist: 29.6.3
-      babel-preset-current-node-syntax: 1.1.1(@babel/core@7.28.0)
+  b4a@1.8.1:
+    optional: true
 
   bail@2.0.2: {}
 
@@ -12324,12 +11692,50 @@ snapshots:
   bare-events@2.6.0:
     optional: true
 
+  bare-events@2.9.1:
+    optional: true
+
+  bare-fs@4.7.4:
+    dependencies:
+      bare-events: 2.6.0
+      bare-path: 3.1.1
+      bare-stream: 2.13.3(bare-events@2.6.0)
+      bare-url: 2.4.6
+      fast-fifo: 1.3.2
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+    optional: true
+
+  bare-path@3.1.1:
+    optional: true
+
+  bare-stream@2.13.3(bare-events@2.6.0):
+    dependencies:
+      b4a: 1.8.1
+      streamx: 2.28.0
+      teex: 1.0.1
+    optionalDependencies:
+      bare-events: 2.6.0
+    transitivePeerDependencies:
+      - react-native-b4a
+    optional: true
+
+  bare-url@2.4.6:
+    dependencies:
+      bare-path: 3.1.1
+    optional: true
+
   base64-js@1.5.1: {}
 
   baseline-browser-mapping@2.10.41: {}
 
   baseline-browser-mapping@2.10.43: {}
 
+  bcrypt-pbkdf@1.0.2:
+    dependencies:
+      tweetnacl: 0.14.5
+
   bcryptjs@3.0.3: {}
 
   bidi-js@1.0.3:
@@ -12413,16 +11819,10 @@ snapshots:
       node-releases: 2.0.51
       update-browserslist-db: 1.2.3(browserslist@4.28.6)
 
-  bs-logger@0.2.6:
-    dependencies:
-      fast-json-stable-stringify: 2.1.0
-
-  bser@2.1.1:
-    dependencies:
-      node-int64: 0.4.0
-
   buffer-crc32@0.2.13: {}
 
+  buffer-crc32@1.0.0: {}
+
   buffer-from@1.1.2: {}
 
   buffer@5.7.1:
@@ -12430,6 +11830,14 @@ snapshots:
       base64-js: 1.5.1
       ieee754: 1.2.1
 
+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
+  buildcheck@0.0.7:
+    optional: true
+
   bundle-name@4.1.0:
     dependencies:
       run-applescript: 7.1.0
@@ -12438,6 +11846,8 @@ snapshots:
     dependencies:
       streamsearch: 1.1.0
 
+  byline@5.0.0: {}
+
   bytes@3.1.2: {}
 
   cacheable-lookup@7.0.0: {}
@@ -12464,10 +11874,6 @@ snapshots:
 
   callsites@3.1.0: {}
 
-  camelcase@5.3.1: {}
-
-  camelcase@6.3.0: {}
-
   caniuse-lite@1.0.30001751: {}
 
   caniuse-lite@1.0.30001806: {}
@@ -12491,8 +11897,6 @@ snapshots:
 
   chalk@5.6.2: {}
 
-  char-regex@1.0.2: {}
-
   character-entities-html4@2.1.0: {}
 
   character-entities-legacy@3.0.0: {}
@@ -12509,11 +11913,9 @@ snapshots:
     dependencies:
       readdirp: 4.1.2
 
-  chrome-trace-event@1.0.4: {}
-
-  ci-info@3.9.0: {}
+  chownr@1.1.4: {}
 
-  cjs-module-lexer@1.4.3: {}
+  chrome-trace-event@1.0.4: {}
 
   cjs-module-lexer@2.2.0: {}
 
@@ -12573,12 +11975,8 @@ snapshots:
 
   cnfast@0.0.8: {}
 
-  co@4.6.0: {}
-
   code-block-writer@13.0.3: {}
 
-  collect-v8-coverage@1.0.2: {}
-
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
@@ -12617,6 +12015,14 @@ snapshots:
 
   component-emitter@1.3.1: {}
 
+  compress-commons@6.0.2:
+    dependencies:
+      crc-32: 1.2.2
+      crc32-stream: 6.0.0
+      is-stream: 2.0.1
+      normalize-path: 3.0.0
+      readable-stream: 4.7.0
+
   concat-map@0.0.1: {}
 
   concat-stream@2.0.0:
@@ -12694,22 +12100,18 @@ snapshots:
     optionalDependencies:
       typescript: 5.7.3
 
-  create-jest@29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)):
+  cpu-features@0.0.10:
     dependencies:
-      '@jest/types': 29.6.3
-      chalk: 4.1.2
-      exit: 0.1.2
-      graceful-fs: 4.2.11
-      jest-config: 29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-      jest-util: 29.7.0
-      prompts: 2.4.2
-    transitivePeerDependencies:
-      - '@types/node'
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
+      buildcheck: 0.0.7
+      nan: 2.28.0
+    optional: true
+
+  crc-32@1.2.2: {}
 
-  create-require@1.1.1: {}
+  crc32-stream@6.0.0:
+    dependencies:
+      crc-32: 1.2.2
+      readable-stream: 4.7.0
 
   cron-parser@5.6.1:
     dependencies:
@@ -12993,8 +12395,6 @@ snapshots:
 
   detect-libc@2.1.2: {}
 
-  detect-newline@3.1.0: {}
-
   detect-node-es@1.1.0: {}
 
   devlop@1.1.0:
@@ -13006,15 +12406,35 @@ snapshots:
       asap: 2.0.6
       wrappy: 1.0.2
 
-  diff-sequences@29.6.3: {}
-
-  diff@4.0.2: {}
-
   diff@8.0.4: {}
 
-  doctrine@3.0.0:
+  docker-compose@1.4.2:
     dependencies:
-      esutils: 2.0.3
+      yaml: 2.8.0
+
+  docker-modem@5.0.7:
+    dependencies:
+      debug: 4.4.3
+      readable-stream: 3.6.2
+      split-ca: 1.0.1
+      ssh2: 1.17.0
+    transitivePeerDependencies:
+      - supports-color
+
+  dockerode@5.0.1:
+    dependencies:
+      '@balena/dockerignore': 1.0.2
+      '@grpc/grpc-js': 1.14.4
+      '@grpc/proto-loader': 0.7.15
+      docker-modem: 5.0.7
+      protobufjs: 7.6.5
+      tar-fs: 2.1.5
+    transitivePeerDependencies:
+      - supports-color
+
+  doctrine@3.0.0:
+    dependencies:
+      esutils: 2.0.3
 
   dom-accessibility-api@0.5.16: {}
 
@@ -13066,16 +12486,10 @@ snapshots:
 
   ee-first@1.1.1: {}
 
-  ejs@3.1.10:
-    dependencies:
-      jake: 10.9.2
-
   electron-to-chromium@1.5.185: {}
 
   electron-to-chromium@1.5.392: {}
 
-  emittery@0.13.1: {}
-
   emoji-regex@10.6.0: {}
 
   emoji-regex@8.0.0: {}
@@ -13086,6 +12500,10 @@ snapshots:
 
   encodeurl@2.0.0: {}
 
+  end-of-stream@1.4.5:
+    dependencies:
+      once: 1.4.0
+
   enhanced-resolve@5.18.1:
     dependencies:
       graceful-fs: 4.2.11
@@ -13225,8 +12643,6 @@ snapshots:
 
   escape-html@1.0.3: {}
 
-  escape-string-regexp@2.0.0: {}
-
   escape-string-regexp@5.0.0: {}
 
   eslint-scope@5.1.1:
@@ -13262,6 +12678,15 @@ snapshots:
 
   etag@1.8.1: {}
 
+  event-target-shim@5.0.1: {}
+
+  events-universal@1.0.1:
+    dependencies:
+      bare-events: 2.9.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+    optional: true
+
   events@3.3.0: {}
 
   eventsource-parser@3.1.0: {}
@@ -13297,18 +12722,8 @@ snapshots:
       strip-final-newline: 4.0.0
       yoctocolors: 2.1.2
 
-  exit@0.1.2: {}
-
   expect-type@1.4.0: {}
 
-  expect@29.7.0:
-    dependencies:
-      '@jest/expect-utils': 29.7.0
-      jest-get-type: 29.6.3
-      jest-matcher-utils: 29.7.0
-      jest-message-util: 29.7.0
-      jest-util: 29.7.0
-
   express-rate-limit@8.5.2(express@5.2.1):
     dependencies:
       express: 5.2.1
@@ -13418,10 +12833,6 @@ snapshots:
     dependencies:
       reusify: 1.0.4
 
-  fb-watchman@2.0.2:
-    dependencies:
-      bser: 2.1.1
-
   fdir@6.5.0(picomatch@4.0.4):
     optionalDependencies:
       picomatch: 4.0.4
@@ -13450,10 +12861,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  filelist@1.0.4:
-    dependencies:
-      minimatch: 5.1.6
-
   filename-reserved-regex@3.0.0: {}
 
   filenamify@6.0.0:
@@ -13479,11 +12886,6 @@ snapshots:
     dependencies:
       locate-path: 3.0.0
 
-  find-up@4.1.0:
-    dependencies:
-      locate-path: 5.0.0
-      path-exists: 4.0.0
-
   find-up@5.0.0:
     dependencies:
       locate-path: 6.0.0
@@ -13552,6 +12954,8 @@ snapshots:
 
   fresh@2.0.0: {}
 
+  fs-constants@1.0.0: {}
+
   fs-extra@10.1.0:
     dependencies:
       graceful-fs: 4.2.11
@@ -13566,8 +12970,6 @@ snapshots:
 
   fs-monkey@1.1.0: {}
 
-  fs.realpath@1.0.0: {}
-
   fsevents@2.3.2:
     optional: true
 
@@ -13601,7 +13003,7 @@ snapshots:
 
   get-own-enumerable-keys@1.0.0: {}
 
-  get-package-type@0.1.0: {}
+  get-port@5.1.1: {}
 
   get-proto@1.0.1:
     dependencies:
@@ -13625,6 +13027,15 @@ snapshots:
 
   glob-to-regexp@0.4.1: {}
 
+  glob@10.5.0:
+    dependencies:
+      foreground-child: 3.3.1
+      jackspeak: 3.4.3
+      minimatch: 9.0.5
+      minipass: 7.1.3
+      package-json-from-dist: 1.0.1
+      path-scurry: 1.11.1
+
   glob@11.0.3:
     dependencies:
       foreground-child: 3.3.1
@@ -13640,15 +13051,6 @@ snapshots:
       minipass: 7.1.3
       path-scurry: 2.0.2
 
-  glob@7.2.3:
-    dependencies:
-      fs.realpath: 1.0.0
-      inflight: 1.0.6
-      inherits: 2.0.4
-      minimatch: 3.1.2
-      once: 1.4.0
-      path-is-absolute: 1.0.1
-
   globrex@0.1.2: {}
 
   gopd@1.2.0: {}
@@ -13795,8 +13197,6 @@ snapshots:
     transitivePeerDependencies:
       - '@noble/hashes'
 
-  html-escaper@2.0.2: {}
-
   html-url-attributes@3.0.1: {}
 
   html-void-elements@3.0.0: {}
@@ -13879,22 +13279,10 @@ snapshots:
       cjs-module-lexer: 2.2.0
       module-details-from-path: 1.0.4
 
-  import-local@3.2.0:
-    dependencies:
-      pkg-dir: 4.2.0
-      resolve-cwd: 3.0.0
-
   import-meta-resolve@4.2.0: {}
 
-  imurmurhash@0.1.4: {}
-
   indent-string@4.0.0: {}
 
-  inflight@1.0.6:
-    dependencies:
-      once: 1.4.0
-      wrappy: 1.0.2
-
   inherits@2.0.4: {}
 
   inline-style-parser@0.2.4: {}
@@ -13934,8 +13322,6 @@ snapshots:
 
   is-fullwidth-code-point@3.0.0: {}
 
-  is-generator-fn@2.1.0: {}
-
   is-glob@4.0.3:
     dependencies:
       is-extglob: 2.1.1
@@ -13990,384 +13376,23 @@ snapshots:
     dependencies:
       is-inside-container: 1.0.0
 
+  isarray@1.0.0: {}
+
   isexe@2.0.0: {}
 
   isexe@3.1.5: {}
 
-  istanbul-lib-coverage@3.2.2: {}
-
-  istanbul-lib-instrument@5.2.1:
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/parser': 7.29.7
-      '@istanbuljs/schema': 0.1.3
-      istanbul-lib-coverage: 3.2.2
-      semver: 6.3.1
-    transitivePeerDependencies:
-      - supports-color
-
-  istanbul-lib-instrument@6.0.3:
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/parser': 7.29.7
-      '@istanbuljs/schema': 0.1.3
-      istanbul-lib-coverage: 3.2.2
-      semver: 7.7.3
-    transitivePeerDependencies:
-      - supports-color
-
-  istanbul-lib-report@3.0.1:
-    dependencies:
-      istanbul-lib-coverage: 3.2.2
-      make-dir: 4.0.0
-      supports-color: 7.2.0
-
-  istanbul-lib-source-maps@4.0.1:
-    dependencies:
-      debug: 4.4.3
-      istanbul-lib-coverage: 3.2.2
-      source-map: 0.6.1
-    transitivePeerDependencies:
-      - supports-color
-
-  istanbul-reports@3.1.7:
-    dependencies:
-      html-escaper: 2.0.2
-      istanbul-lib-report: 3.0.1
-
   iterare@1.2.1: {}
 
-  jackspeak@4.1.1:
+  jackspeak@3.4.3:
     dependencies:
       '@isaacs/cliui': 8.0.2
-
-  jake@10.9.2:
-    dependencies:
-      async: 3.2.6
-      chalk: 4.1.2
-      filelist: 1.0.4
-      minimatch: 3.1.2
-
-  jest-changed-files@29.7.0:
-    dependencies:
-      execa: 5.1.1
-      jest-util: 29.7.0
-      p-limit: 3.1.0
-
-  jest-circus@29.7.0:
-    dependencies:
-      '@jest/environment': 29.7.0
-      '@jest/expect': 29.7.0
-      '@jest/test-result': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      chalk: 4.1.2
-      co: 4.6.0
-      dedent: 1.6.0
-      is-generator-fn: 2.1.0
-      jest-each: 29.7.0
-      jest-matcher-utils: 29.7.0
-      jest-message-util: 29.7.0
-      jest-runtime: 29.7.0
-      jest-snapshot: 29.7.0
-      jest-util: 29.7.0
-      p-limit: 3.1.0
-      pretty-format: 29.7.0
-      pure-rand: 6.1.0
-      slash: 3.0.0
-      stack-utils: 2.0.6
-    transitivePeerDependencies:
-      - babel-plugin-macros
-      - supports-color
-
-  jest-cli@29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)):
-    dependencies:
-      '@jest/core': 29.7.0(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-      '@jest/test-result': 29.7.0
-      '@jest/types': 29.6.3
-      chalk: 4.1.2
-      create-jest: 29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-      exit: 0.1.2
-      import-local: 3.2.0
-      jest-config: 29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      yargs: 17.7.2
-    transitivePeerDependencies:
-      - '@types/node'
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
-
-  jest-config@29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)):
-    dependencies:
-      '@babel/core': 7.28.0
-      '@jest/test-sequencer': 29.7.0
-      '@jest/types': 29.6.3
-      babel-jest: 29.7.0(@babel/core@7.28.0)
-      chalk: 4.1.2
-      ci-info: 3.9.0
-      deepmerge: 4.3.1
-      glob: 7.2.3
-      graceful-fs: 4.2.11
-      jest-circus: 29.7.0
-      jest-environment-node: 29.7.0
-      jest-get-type: 29.6.3
-      jest-regex-util: 29.6.3
-      jest-resolve: 29.7.0
-      jest-runner: 29.7.0
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      micromatch: 4.0.8
-      parse-json: 5.2.0
-      pretty-format: 29.7.0
-      slash: 3.0.0
-      strip-json-comments: 3.1.1
-    optionalDependencies:
-      '@types/node': 22.16.5
-      ts-node: 10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)
-    transitivePeerDependencies:
-      - babel-plugin-macros
-      - supports-color
-
-  jest-config@29.7.0(@types/node@26.1.1)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)):
-    dependencies:
-      '@babel/core': 7.28.0
-      '@jest/test-sequencer': 29.7.0
-      '@jest/types': 29.6.3
-      babel-jest: 29.7.0(@babel/core@7.28.0)
-      chalk: 4.1.2
-      ci-info: 3.9.0
-      deepmerge: 4.3.1
-      glob: 7.2.3
-      graceful-fs: 4.2.11
-      jest-circus: 29.7.0
-      jest-environment-node: 29.7.0
-      jest-get-type: 29.6.3
-      jest-regex-util: 29.6.3
-      jest-resolve: 29.7.0
-      jest-runner: 29.7.0
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      micromatch: 4.0.8
-      parse-json: 5.2.0
-      pretty-format: 29.7.0
-      slash: 3.0.0
-      strip-json-comments: 3.1.1
     optionalDependencies:
-      '@types/node': 26.1.1
-      ts-node: 10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)
-    transitivePeerDependencies:
-      - babel-plugin-macros
-      - supports-color
-
-  jest-diff@29.7.0:
-    dependencies:
-      chalk: 4.1.2
-      diff-sequences: 29.6.3
-      jest-get-type: 29.6.3
-      pretty-format: 29.7.0
-
-  jest-docblock@29.7.0:
-    dependencies:
-      detect-newline: 3.1.0
-
-  jest-each@29.7.0:
-    dependencies:
-      '@jest/types': 29.6.3
-      chalk: 4.1.2
-      jest-get-type: 29.6.3
-      jest-util: 29.7.0
-      pretty-format: 29.7.0
+      '@pkgjs/parseargs': 0.11.0
 
-  jest-environment-node@29.7.0:
-    dependencies:
-      '@jest/environment': 29.7.0
-      '@jest/fake-timers': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      jest-mock: 29.7.0
-      jest-util: 29.7.0
-
-  jest-get-type@29.6.3: {}
-
-  jest-haste-map@29.7.0:
-    dependencies:
-      '@jest/types': 29.6.3
-      '@types/graceful-fs': 4.1.9
-      '@types/node': 26.1.1
-      anymatch: 3.1.3
-      fb-watchman: 2.0.2
-      graceful-fs: 4.2.11
-      jest-regex-util: 29.6.3
-      jest-util: 29.7.0
-      jest-worker: 29.7.0
-      micromatch: 4.0.8
-      walker: 1.0.8
-    optionalDependencies:
-      fsevents: 2.3.3
-
-  jest-leak-detector@29.7.0:
-    dependencies:
-      jest-get-type: 29.6.3
-      pretty-format: 29.7.0
-
-  jest-matcher-utils@29.7.0:
-    dependencies:
-      chalk: 4.1.2
-      jest-diff: 29.7.0
-      jest-get-type: 29.6.3
-      pretty-format: 29.7.0
-
-  jest-message-util@29.7.0:
-    dependencies:
-      '@babel/code-frame': 7.27.1
-      '@jest/types': 29.6.3
-      '@types/stack-utils': 2.0.3
-      chalk: 4.1.2
-      graceful-fs: 4.2.11
-      micromatch: 4.0.8
-      pretty-format: 29.7.0
-      slash: 3.0.0
-      stack-utils: 2.0.6
-
-  jest-mock@29.7.0:
-    dependencies:
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      jest-util: 29.7.0
-
-  jest-pnp-resolver@1.2.3(jest-resolve@29.7.0):
-    optionalDependencies:
-      jest-resolve: 29.7.0
-
-  jest-regex-util@29.6.3: {}
-
-  jest-resolve-dependencies@29.7.0:
-    dependencies:
-      jest-regex-util: 29.6.3
-      jest-snapshot: 29.7.0
-    transitivePeerDependencies:
-      - supports-color
-
-  jest-resolve@29.7.0:
-    dependencies:
-      chalk: 4.1.2
-      graceful-fs: 4.2.11
-      jest-haste-map: 29.7.0
-      jest-pnp-resolver: 1.2.3(jest-resolve@29.7.0)
-      jest-util: 29.7.0
-      jest-validate: 29.7.0
-      resolve: 1.22.10
-      resolve.exports: 2.0.3
-      slash: 3.0.0
-
-  jest-runner@29.7.0:
-    dependencies:
-      '@jest/console': 29.7.0
-      '@jest/environment': 29.7.0
-      '@jest/test-result': 29.7.0
-      '@jest/transform': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      chalk: 4.1.2
-      emittery: 0.13.1
-      graceful-fs: 4.2.11
-      jest-docblock: 29.7.0
-      jest-environment-node: 29.7.0
-      jest-haste-map: 29.7.0
-      jest-leak-detector: 29.7.0
-      jest-message-util: 29.7.0
-      jest-resolve: 29.7.0
-      jest-runtime: 29.7.0
-      jest-util: 29.7.0
-      jest-watcher: 29.7.0
-      jest-worker: 29.7.0
-      p-limit: 3.1.0
-      source-map-support: 0.5.13
-    transitivePeerDependencies:
-      - supports-color
-
-  jest-runtime@29.7.0:
-    dependencies:
-      '@jest/environment': 29.7.0
-      '@jest/fake-timers': 29.7.0
-      '@jest/globals': 29.7.0
-      '@jest/source-map': 29.6.3
-      '@jest/test-result': 29.7.0
-      '@jest/transform': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      chalk: 4.1.2
-      cjs-module-lexer: 1.4.3
-      collect-v8-coverage: 1.0.2
-      glob: 7.2.3
-      graceful-fs: 4.2.11
-      jest-haste-map: 29.7.0
-      jest-message-util: 29.7.0
-      jest-mock: 29.7.0
-      jest-regex-util: 29.6.3
-      jest-resolve: 29.7.0
-      jest-snapshot: 29.7.0
-      jest-util: 29.7.0
-      slash: 3.0.0
-      strip-bom: 4.0.0
-    transitivePeerDependencies:
-      - supports-color
-
-  jest-snapshot@29.7.0:
-    dependencies:
-      '@babel/core': 7.28.0
-      '@babel/generator': 7.28.0
-      '@babel/plugin-syntax-jsx': 7.27.1(@babel/core@7.28.0)
-      '@babel/plugin-syntax-typescript': 7.27.1(@babel/core@7.28.0)
-      '@babel/types': 7.29.7
-      '@jest/expect-utils': 29.7.0
-      '@jest/transform': 29.7.0
-      '@jest/types': 29.6.3
-      babel-preset-current-node-syntax: 1.1.1(@babel/core@7.28.0)
-      chalk: 4.1.2
-      expect: 29.7.0
-      graceful-fs: 4.2.11
-      jest-diff: 29.7.0
-      jest-get-type: 29.6.3
-      jest-matcher-utils: 29.7.0
-      jest-message-util: 29.7.0
-      jest-util: 29.7.0
-      natural-compare: 1.4.0
-      pretty-format: 29.7.0
-      semver: 7.7.3
-    transitivePeerDependencies:
-      - supports-color
-
-  jest-util@29.7.0:
-    dependencies:
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      chalk: 4.1.2
-      ci-info: 3.9.0
-      graceful-fs: 4.2.11
-      picomatch: 2.3.2
-
-  jest-validate@29.7.0:
-    dependencies:
-      '@jest/types': 29.6.3
-      camelcase: 6.3.0
-      chalk: 4.1.2
-      jest-get-type: 29.6.3
-      leven: 3.1.0
-      pretty-format: 29.7.0
-
-  jest-watcher@29.7.0:
+  jackspeak@4.1.1:
     dependencies:
-      '@jest/test-result': 29.7.0
-      '@jest/types': 29.6.3
-      '@types/node': 26.1.1
-      ansi-escapes: 4.3.2
-      chalk: 4.1.2
-      emittery: 0.13.1
-      jest-util: 29.7.0
-      string-length: 4.0.2
+      '@isaacs/cliui': 8.0.2
 
   jest-worker@27.5.1:
     dependencies:
@@ -14375,25 +13400,6 @@ snapshots:
       merge-stream: 2.0.0
       supports-color: 8.1.1
 
-  jest-worker@29.7.0:
-    dependencies:
-      '@types/node': 26.1.1
-      jest-util: 29.7.0
-      merge-stream: 2.0.0
-      supports-color: 8.1.1
-
-  jest@29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)):
-    dependencies:
-      '@jest/core': 29.7.0(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-      '@jest/types': 29.6.3
-      import-local: 3.2.0
-      jest-cli: 29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-    transitivePeerDependencies:
-      - '@types/node'
-      - babel-plugin-macros
-      - supports-color
-      - ts-node
-
   jiti@2.7.0: {}
 
   jose@6.2.3: {}
@@ -14402,11 +13408,6 @@ snapshots:
 
   js-tokens@4.0.0: {}
 
-  js-yaml@3.14.1:
-    dependencies:
-      argparse: 1.0.10
-      esprima: 4.0.1
-
   js-yaml@4.1.0:
     dependencies:
       argparse: 2.0.1
@@ -14492,6 +13493,10 @@ snapshots:
 
   layout-base@2.0.1: {}
 
+  lazystream@1.0.1:
+    dependencies:
+      readable-stream: 2.3.8
+
   lefthook-darwin-arm64@2.1.9:
     optional: true
 
@@ -14535,8 +13540,6 @@ snapshots:
       lefthook-windows-arm64: 2.1.9
       lefthook-windows-x64: 2.1.9
 
-  leven@3.1.0: {}
-
   libphonenumber-js@1.13.7: {}
 
   lightningcss-android-arm64@1.32.0:
@@ -14592,6 +13595,8 @@ snapshots:
 
   load-esm@1.0.2: {}
 
+  load-tsconfig@0.2.5: {}
+
   loader-runner@4.3.0: {}
 
   locate-path@3.0.0:
@@ -14599,22 +13604,18 @@ snapshots:
       p-locate: 3.0.0
       path-exists: 3.0.0
 
-  locate-path@5.0.0:
-    dependencies:
-      p-locate: 4.1.0
-
   locate-path@6.0.0:
     dependencies:
       p-locate: 5.0.0
 
   lodash-es@4.18.1: {}
 
+  lodash.camelcase@4.3.0: {}
+
   lodash.castarray@4.4.0: {}
 
   lodash.isplainobject@4.0.6: {}
 
-  lodash.memoize@4.1.2: {}
-
   lodash.merge@4.6.2: {}
 
   lodash@4.17.21: {}
@@ -14631,12 +13632,16 @@ snapshots:
       chalk: 5.6.2
       is-unicode-supported: 1.3.0
 
+  long@5.3.2: {}
+
   longest-streak@3.1.0: {}
 
   loupe@3.2.1: {}
 
   lowercase-keys@3.0.0: {}
 
+  lru-cache@10.4.3: {}
+
   lru-cache@11.1.0: {}
 
   lru-cache@11.5.1: {}
@@ -14661,16 +13666,6 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  make-dir@4.0.0:
-    dependencies:
-      semver: 7.7.3
-
-  make-error@1.3.6: {}
-
-  makeerror@1.0.12:
-    dependencies:
-      tmpl: 1.0.5
-
   markdown-table@3.0.4: {}
 
   marked@16.0.0: {}
@@ -15117,7 +14112,7 @@ snapshots:
     dependencies:
       brace-expansion: 1.1.11
 
-  minimatch@5.1.6:
+  minimatch@5.1.9:
     dependencies:
       brace-expansion: 2.0.1
 
@@ -15131,10 +14126,14 @@ snapshots:
 
   minipass@7.1.3: {}
 
+  mkdirp-classic@0.5.3: {}
+
   mkdirp@0.5.6:
     dependencies:
       minimist: 1.2.8
 
+  mkdirp@3.0.1: {}
+
   module-alias@2.3.4: {}
 
   module-details-from-path@1.0.4: {}
@@ -15169,9 +14168,10 @@ snapshots:
 
   mute-stream@2.0.0: {}
 
-  nanoid@3.3.15: {}
+  nan@2.28.0:
+    optional: true
 
-  natural-compare@1.4.0: {}
+  nanoid@3.3.15: {}
 
   negotiator@1.0.0: {}
 
@@ -15218,8 +14218,6 @@ snapshots:
     dependencies:
       whatwg-url: 5.0.0
 
-  node-int64@0.4.0: {}
-
   node-releases@2.0.19: {}
 
   node-releases@2.0.51: {}
@@ -15414,10 +14412,6 @@ snapshots:
     dependencies:
       p-limit: 2.3.0
 
-  p-locate@4.1.0:
-    dependencies:
-      p-limit: 2.3.0
-
   p-locate@5.0.0:
     dependencies:
       p-limit: 3.1.0
@@ -15469,14 +14463,17 @@ snapshots:
 
   path-exists@4.0.0: {}
 
-  path-is-absolute@1.0.1: {}
-
   path-key@3.1.1: {}
 
   path-key@4.0.0: {}
 
   path-parse@1.0.7: {}
 
+  path-scurry@1.11.1:
+    dependencies:
+      lru-cache: 10.4.3
+      minipass: 7.1.3
+
   path-scurry@2.0.0:
     dependencies:
       lru-cache: 11.1.0
@@ -15546,8 +14543,6 @@ snapshots:
 
   picomatch@2.3.1: {}
 
-  picomatch@2.3.2: {}
-
   picomatch@4.0.2: {}
 
   picomatch@4.0.4: {}
@@ -15574,8 +14569,6 @@ snapshots:
       sonic-boom: 4.2.1
       thread-stream: 4.2.0
 
-  pirates@4.0.7: {}
-
   piscina@4.9.2:
     optionalDependencies:
       '@napi-rs/nice': 1.0.4
@@ -15586,10 +14579,6 @@ snapshots:
 
   pkce-challenge@5.0.1: {}
 
-  pkg-dir@4.2.0:
-    dependencies:
-      find-up: 4.1.0
-
   pkg-up@3.1.0:
     dependencies:
       find-up: 3.0.0
@@ -15657,18 +14646,16 @@ snapshots:
       ansi-styles: 5.2.0
       react-is: 17.0.2
 
-  pretty-format@29.7.0:
-    dependencies:
-      '@jest/schemas': 29.6.3
-      ansi-styles: 5.2.0
-      react-is: 18.3.1
-
   pretty-ms@9.3.0:
     dependencies:
       parse-ms: 4.0.0
 
+  process-nextick-args@2.0.1: {}
+
   process-warning@5.0.0: {}
 
+  process@0.11.10: {}
+
   progress@2.0.3: {}
 
   prompts@2.4.2:
@@ -15676,8 +14663,35 @@ snapshots:
       kleur: 3.0.3
       sisteransi: 1.0.5
 
+  proper-lockfile@4.1.2:
+    dependencies:
+      graceful-fs: 4.2.11
+      retry: 0.12.0
+      signal-exit: 3.0.7
+
+  properties-reader@3.0.1:
+    dependencies:
+      '@kwsites/file-exists': 1.1.1
+      mkdirp: 3.0.1
+    transitivePeerDependencies:
+      - supports-color
+
   property-information@7.1.0: {}
 
+  protobufjs@7.6.5:
+    dependencies:
+      '@protobufjs/aspromise': 1.1.2
+      '@protobufjs/base64': 1.1.2
+      '@protobufjs/codegen': 2.0.5
+      '@protobufjs/eventemitter': 1.1.1
+      '@protobufjs/fetch': 1.1.1
+      '@protobufjs/float': 1.0.2
+      '@protobufjs/path': 1.1.2
+      '@protobufjs/pool': 1.1.0
+      '@protobufjs/utf8': 1.1.2
+      '@types/node': 26.1.1
+      long: 5.3.2
+
   proxy-addr@2.0.7:
     dependencies:
       forwarded: 0.2.0
@@ -15685,9 +14699,12 @@ snapshots:
 
   proxy-from-env@1.1.0: {}
 
-  punycode@2.3.1: {}
+  pump@3.0.4:
+    dependencies:
+      end-of-stream: 1.4.5
+      once: 1.4.0
 
-  pure-rand@6.1.0: {}
+  punycode@2.3.1: {}
 
   qs@6.14.0:
     dependencies:
@@ -15747,8 +14764,6 @@ snapshots:
 
   react-is@17.0.2: {}
 
-  react-is@18.3.1: {}
-
   react-markdown@10.1.0(@types/react@19.0.10)(react@19.2.7):
     dependencies:
       '@types/hast': 3.0.4
@@ -15796,12 +14811,34 @@ snapshots:
 
   react@19.2.7: {}
 
+  readable-stream@2.3.8:
+    dependencies:
+      core-util-is: 1.0.3
+      inherits: 2.0.4
+      isarray: 1.0.0
+      process-nextick-args: 2.0.1
+      safe-buffer: 5.1.2
+      string_decoder: 1.1.1
+      util-deprecate: 1.0.2
+
   readable-stream@3.6.2:
     dependencies:
       inherits: 2.0.4
       string_decoder: 1.3.0
       util-deprecate: 1.0.2
 
+  readable-stream@4.7.0:
+    dependencies:
+      abort-controller: 3.0.0
+      buffer: 6.0.3
+      events: 3.3.0
+      process: 0.11.10
+      string_decoder: 1.3.0
+
+  readdir-glob@1.1.3:
+    dependencies:
+      minimatch: 5.1.9
+
   readdirp@4.1.2: {}
 
   real-require@0.2.0: {}
@@ -15907,18 +14944,10 @@ snapshots:
 
   resolve-alpn@1.2.1: {}
 
-  resolve-cwd@3.0.0:
-    dependencies:
-      resolve-from: 5.0.0
-
   resolve-from@4.0.0: {}
 
-  resolve-from@5.0.0: {}
-
   resolve-pkg-maps@1.0.0: {}
 
-  resolve.exports@2.0.3: {}
-
   resolve@1.22.10:
     dependencies:
       is-core-module: 2.16.1
@@ -15939,6 +14968,8 @@ snapshots:
       onetime: 7.0.0
       signal-exit: 4.1.0
 
+  retry@0.12.0: {}
+
   reusify@1.0.4: {}
 
   robust-predicates@3.0.3: {}
@@ -16003,6 +15034,8 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
+  safe-buffer@5.1.2: {}
+
   safe-buffer@5.2.1: {}
 
   safe-stable-stringify@2.5.0: {}
@@ -16247,11 +15280,6 @@ snapshots:
 
   source-map-js@1.2.1: {}
 
-  source-map-support@0.5.13:
-    dependencies:
-      buffer-from: 1.1.2
-      source-map: 0.6.1
-
   source-map-support@0.5.21:
     dependencies:
       buffer-from: 1.1.2
@@ -16265,15 +15293,24 @@ snapshots:
 
   space-separated-tokens@2.0.2: {}
 
-  split2@4.2.0: {}
+  split-ca@1.0.1: {}
 
-  sprintf-js@1.0.3: {}
+  split2@4.2.0: {}
 
   sqids@0.3.0: {}
 
-  stack-utils@2.0.6:
+  ssh-remote-port-forward@1.0.4:
+    dependencies:
+      '@types/ssh2': 0.5.52
+      ssh2: 1.17.0
+
+  ssh2@1.17.0:
     dependencies:
-      escape-string-regexp: 2.0.0
+      asn1: 0.2.6
+      bcrypt-pbkdf: 1.0.2
+    optionalDependencies:
+      cpu-features: 0.0.10
+      nan: 2.28.0
 
   stackback@0.0.2: {}
 
@@ -16357,10 +15394,14 @@ snapshots:
     optionalDependencies:
       bare-events: 2.6.0
 
-  string-length@4.0.2:
+  streamx@2.28.0:
     dependencies:
-      char-regex: 1.0.2
-      strip-ansi: 6.0.1
+      events-universal: 1.0.1
+      fast-fifo: 1.3.2
+      text-decoder: 1.2.3
+    transitivePeerDependencies:
+      - bare-abort-controller
+    optional: true
 
   string-width@4.2.3:
     dependencies:
@@ -16380,6 +15421,10 @@ snapshots:
       get-east-asian-width: 1.6.0
       strip-ansi: 7.1.0
 
+  string_decoder@1.1.1:
+    dependencies:
+      safe-buffer: 5.1.2
+
   string_decoder@1.3.0:
     dependencies:
       safe-buffer: 5.2.1
@@ -16405,8 +15450,6 @@ snapshots:
 
   strip-bom@3.0.0: {}
 
-  strip-bom@4.0.0: {}
-
   strip-dirs@3.0.0:
     dependencies:
       inspect-with-kind: 1.0.5
@@ -16422,8 +15465,6 @@ snapshots:
 
   strip-indent@4.1.1: {}
 
-  strip-json-comments@3.1.1: {}
-
   strtok3@10.3.4:
     dependencies:
       '@tokenizer/token': 0.3.0
@@ -16502,12 +15543,46 @@ snapshots:
 
   tapable@2.3.3: {}
 
+  tar-fs@2.1.5:
+    dependencies:
+      chownr: 1.1.4
+      mkdirp-classic: 0.5.3
+      pump: 3.0.4
+      tar-stream: 2.2.0
+
+  tar-fs@3.1.3:
+    dependencies:
+      pump: 3.0.4
+      tar-stream: 3.1.7
+    optionalDependencies:
+      bare-fs: 4.7.4
+      bare-path: 3.1.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
+  tar-stream@2.2.0:
+    dependencies:
+      bl: 4.1.0
+      end-of-stream: 1.4.5
+      fs-constants: 1.0.0
+      inherits: 2.0.4
+      readable-stream: 3.6.2
+
   tar-stream@3.1.7:
     dependencies:
       b4a: 1.6.7
       fast-fifo: 1.3.2
       streamx: 2.22.1
 
+  teex@1.0.1:
+    dependencies:
+      streamx: 2.28.0
+    transitivePeerDependencies:
+      - bare-abort-controller
+    optional: true
+
   terser-webpack-plugin@5.3.14(@swc/core@1.13.2)(esbuild@0.25.5)(webpack@5.100.2(@swc/core@1.13.2)(esbuild@0.25.5)):
     dependencies:
       '@jridgewell/trace-mapping': 0.3.29
@@ -16538,11 +15613,28 @@ snapshots:
       commander: 2.20.3
       source-map-support: 0.5.21
 
-  test-exclude@6.0.0:
+  testcontainers@12.0.4:
     dependencies:
-      '@istanbuljs/schema': 0.1.3
-      glob: 7.2.3
-      minimatch: 3.1.2
+      '@balena/dockerignore': 1.0.2
+      '@types/dockerode': 4.0.1
+      archiver: 7.0.1
+      async-lock: 1.4.1
+      byline: 5.0.0
+      debug: 4.4.3
+      docker-compose: 1.4.2
+      dockerode: 5.0.1
+      get-port: 5.1.1
+      proper-lockfile: 4.1.2
+      properties-reader: 3.0.1
+      ssh-remote-port-forward: 1.0.4
+      tar-fs: 3.1.3
+      tmp: 0.2.7
+      undici: 8.9.0
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+      - supports-color
 
   text-decoder@1.2.3:
     dependencies:
@@ -16593,7 +15685,7 @@ snapshots:
     dependencies:
       os-tmpdir: 1.0.2
 
-  tmpl@1.0.5: {}
+  tmp@0.2.7: {}
 
   to-regex-range@5.0.1:
     dependencies:
@@ -16626,62 +15718,11 @@ snapshots:
 
   ts-dedent@2.3.0: {}
 
-  ts-jest@29.4.0(@babel/core@7.28.0)(@jest/transform@29.7.0)(@jest/types@29.6.3)(babel-jest@29.7.0(@babel/core@7.28.0))(esbuild@0.25.5)(jest-util@29.7.0)(jest@29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3)))(typescript@5.7.3):
-    dependencies:
-      bs-logger: 0.2.6
-      ejs: 3.1.10
-      fast-json-stable-stringify: 2.1.0
-      jest: 29.7.0(@types/node@22.16.5)(ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3))
-      json5: 2.2.3
-      lodash.memoize: 4.1.2
-      make-error: 1.3.6
-      semver: 7.7.2
-      type-fest: 4.41.0
-      typescript: 5.7.3
-      yargs-parser: 21.1.1
-    optionalDependencies:
-      '@babel/core': 7.28.0
-      '@jest/transform': 29.7.0
-      '@jest/types': 29.6.3
-      babel-jest: 29.7.0(@babel/core@7.28.0)
-      esbuild: 0.25.5
-      jest-util: 29.7.0
-
-  ts-loader@9.5.2(typescript@5.7.3)(webpack@5.100.2(@swc/core@1.13.2)(esbuild@0.25.5)):
-    dependencies:
-      chalk: 4.1.2
-      enhanced-resolve: 5.18.1
-      micromatch: 4.0.8
-      semver: 7.7.2
-      source-map: 0.7.6
-      typescript: 5.7.3
-      webpack: 5.100.2(@swc/core@1.13.2)(esbuild@0.25.5)
-
   ts-morph@26.0.0:
     dependencies:
       '@ts-morph/common': 0.27.0
       code-block-writer: 13.0.3
 
-  ts-node@10.9.2(@swc/core@1.13.2)(@types/node@22.16.5)(typescript@5.7.3):
-    dependencies:
-      '@cspotcode/source-map-support': 0.8.1
-      '@tsconfig/node10': 1.0.11
-      '@tsconfig/node12': 1.0.11
-      '@tsconfig/node14': 1.0.3
-      '@tsconfig/node16': 1.0.4
-      '@types/node': 22.16.5
-      acorn: 8.15.0
-      acorn-walk: 8.3.4
-      arg: 4.1.3
-      create-require: 1.1.1
-      diff: 4.0.2
-      make-error: 1.3.6
-      typescript: 5.7.3
-      v8-compile-cache-lib: 3.0.1
-      yn: 3.1.1
-    optionalDependencies:
-      '@swc/core': 1.13.2
-
   tsconfck@3.1.6(typescript@5.7.3):
     optionalDependencies:
       typescript: 5.7.3
@@ -16719,14 +15760,12 @@ snapshots:
 
   tw-animate-css@1.2.4: {}
 
-  type-detect@4.0.8: {}
+  tweetnacl@0.14.5: {}
 
   type-fest@0.21.3: {}
 
   type-fest@0.7.1: {}
 
-  type-fest@4.41.0: {}
-
   type-fest@5.7.0:
     dependencies:
       tagged-tag: 1.0.0
@@ -16768,12 +15807,16 @@ snapshots:
       buffer: 5.7.1
       through: 2.3.8
 
+  undici-types@5.26.5: {}
+
   undici-types@6.21.0: {}
 
   undici-types@8.3.0: {}
 
   undici@7.28.0: {}
 
+  undici@8.9.0: {}
+
   unicorn-magic@0.3.0: {}
 
   unified@11.0.5:
@@ -16813,6 +15856,15 @@ snapshots:
 
   unpipe@1.0.0: {}
 
+  unplugin-swc@1.5.9(@swc/core@1.13.2)(rollup@4.62.2):
+    dependencies:
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.2)
+      '@swc/core': 1.13.2
+      load-tsconfig: 0.2.5
+      unplugin: 2.3.11
+    transitivePeerDependencies:
+      - rollup
+
   unplugin@2.3.11:
     dependencies:
       '@jridgewell/remapping': 2.3.5
@@ -16869,14 +15921,6 @@ snapshots:
 
   uuid@14.0.0: {}
 
-  v8-compile-cache-lib@3.0.1: {}
-
-  v8-to-istanbul@9.3.0:
-    dependencies:
-      '@jridgewell/trace-mapping': 0.3.29
-      '@types/istanbul-lib-coverage': 2.0.6
-      convert-source-map: 2.0.0
-
   valibot@1.2.0(typescript@5.7.3):
     optionalDependencies:
       typescript: 5.7.3
@@ -16989,10 +16033,6 @@ snapshots:
     dependencies:
       xml-name-validator: 5.0.0
 
-  walker@1.0.8:
-    dependencies:
-      makeerror: 1.0.12
-
   watchpack@2.4.4:
     dependencies:
       glob-to-regexp: 0.4.1
@@ -17128,11 +16168,6 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  write-file-atomic@4.0.2:
-    dependencies:
-      imurmurhash: 0.1.4
-      signal-exit: 3.0.7
-
   ws@8.21.0: {}
 
   wsl-utils@0.1.0:
@@ -17154,12 +16189,11 @@ snapshots:
 
   yallist@3.1.1: {}
 
-  yaml@2.8.0:
-    optional: true
+  yaml@2.8.0: {}
 
   yargs-parser@21.1.1: {}
 
-  yargs@17.7.2:
+  yargs@17.7.3:
     dependencies:
       cliui: 8.0.1
       escalade: 3.2.0
@@ -17174,8 +16208,6 @@ snapshots:
       buffer-crc32: 0.2.13
       pend: 1.2.0
 
-  yn@3.1.1: {}
-
   yocto-queue@0.1.0: {}
 
   yocto-spinner@1.2.2:
@@ -17186,6 +16218,12 @@ snapshots:
 
   yoctocolors@2.1.2: {}
 
+  zip-stream@6.0.1:
+    dependencies:
+      archiver-utils: 5.0.2
+      compress-commons: 6.0.2
+      readable-stream: 4.7.0
+
   zod-to-json-schema@3.25.2(zod@3.25.76):
     dependencies:
       zod: 3.25.76
diff --git a/turbo.json b/turbo.json
index b257e02c..e486959f 100644
--- a/turbo.json
+++ b/turbo.json
@@ -9,28 +9,40 @@
       "inputs": ["$TURBO_DEFAULT$", ".env*"],
       "outputs": []
     },
-    "lint": {},
+    // transit: today no linted package's verdict depends on another workspace
+    // package (api's type-aware tsgolint has no workspace deps and its
+    // tsconfig extends nothing shared) — the edge is cheap insurance so the
+    // cached verdict stays honest the day one does.
+    "lint": {
+      "dependsOn": ["transit"]
+    },
     // Transit node: a scriptless graph edge that folds a dependency's SOURCE
     // into a task's hash without forcing the dependency's task to run first.
-    // Used by typecheck/test below so they run in parallel yet still cache-bust
-    // when an imported workspace package changes. https://turborepo.dev/docs/crafting-your-repository/configuring-tasks#dependent-tasks-that-can-be-run-in-parallel
+    // Used by the cached lint/typecheck tasks so they run in parallel yet
+    // still cache-bust when an imported workspace package changes. https://turborepo.dev/docs/crafting-your-repository/configuring-tasks#dependent-tasks-that-can-be-run-in-parallel
     "transit": {
       "dependsOn": ["^transit"]
     },
     "typecheck": {
       "dependsOn": ["transit"]
     },
-    // `transit` (not `^build`): no package emits build output that tests
-    // consume (ui is JIT source, api/web tests compile from source), so tests
-    // shouldn't wait on dependency builds — they only need the cache-busting
-    // edge, which transit provides while everything runs in parallel.
+    // No dependsOn: nothing tests consume is built (ui is JIT source, api/web
+    // tests compile from source), and with caching off there is no hash left
+    // for a transit edge to bust — tests just run, in parallel with everything.
+    // Never cached, unlike build/typecheck. A cache hit is only as honest as
+    // the declared inputs, and a test can depend on things turbo cannot see
+    // (an undeclared env var, the clock, a stray global) — this repo has
+    // already shipped two such gaps. Worse, turbo caches only SUCCESSES, so a
+    // flaky test that passed once is replayed green forever for that hash.
+    // A test gate exists to be executed; ~20s is the wrong thing to optimise.
     "test": {
-      "dependsOn": ["transit"]
+      "cache": false
     },
     // Storybook browser tests need Playwright browsers, so they stay out of
     // the plain `test` task (which CI runs without them).
     "test:storybook": {
-      "dependsOn": ["transit"]
+      // Same reasoning as `test`: a gate must run.
+      "cache": false
     },
     "dev": {
       "cache": false,