diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 36ae683b..9a8373c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,8 @@ on:
       - tsconfig.json
       - .node-version
       - .github/workflows/ci.yml
+      - .github/workflows/repoctl-docs.yml
+      - .github/workflows/repoctl-docs-deploy.yml
   push:
     branches: [main]
     paths:
@@ -31,12 +33,17 @@ on:
       - tsconfig.json
       - .node-version
       - .github/workflows/ci.yml
+      - .github/workflows/repoctl-docs.yml
+      - .github/workflows/repoctl-docs-deploy.yml
   workflow_dispatch:
 
 concurrency:
   group: web-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  LEFTHOOK: '0'
+
 permissions:
   contents: read
 
@@ -45,8 +52,12 @@ jobs:
     name: Verify commercial application
     runs-on: ubuntu-24.04
     timeout-minutes: 25
+    env:
+      REPO_DOCS_CHANNEL: ${{ github.event_name == 'pull_request' && 'preview' || 'stable' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -63,6 +74,12 @@ jobs:
         run: pnpm --filter @weapp-io/web lint && pnpm --filter @weapp-io/web lint:styles && pnpm --filter @weapp-io/web check && pnpm --filter @weapp-io/web test
       - name: Build and validate
         run: pnpm --filter @weapp-io/web build
+      - name: Bind the preview artifact to this pull request
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: node scripts/docs-build.mjs web --identity-only
       - name: Install browser
         run: pnpm --filter @weapp-io/web exec playwright install --with-deps chromium
       - name: Test deployment artifact
@@ -83,114 +100,62 @@ jobs:
           path: apps/web/test-results
           retention-days: 7
 
-  deploy-production:
-    needs: verify
-    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
-    runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    environment: production
-    concurrency:
-      group: deploy-production
-      cancel-in-progress: false
-    permissions:
-      contents: read
-      deployments: write
-    env:
-      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-
-    steps:
-      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version-file: .node-version
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Download the static site
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
-        with:
-          name: web-dist
-          path: apps/web/dist
-
-      - name: Deploy to Cloudflare Workers
-        working-directory: apps/web
-        run: |
-          set -o pipefail
-          pnpm exec wrangler deploy --message "${GITHUB_SHA}" 2>&1 | tee "$GITHUB_STEP_SUMMARY"
-
   deploy-preview:
     needs: verify
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-24.04
-    timeout-minutes: 10
+    timeout-minutes: 15
     concurrency:
-      group: deploy-preview-${{ github.event.number }}
+      group: pr-preview-web-${{ github.event.number }}
       cancel-in-progress: true
     permissions:
       contents: read
       pull-requests: write
     env:
-      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID || vars.CLOUDFLARE_ACCOUNT_ID }}
       CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-
+      PR_NUMBER: ${{ github.event.number }}
+      PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
     steps:
-      - name: Check out the repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          node-version-file: .node-version
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
           cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Download the static site
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: web-dist
           path: apps/web/dist
-
-      - name: Upload a Worker version preview
+      - name: Deploy the tested PR artifact
         id: preview
-        working-directory: apps/web
-        run: |
-          set -o pipefail
-          pnpm exec wrangler versions upload \
-            --preview-alias "pr-${{ github.event.number }}" \
-            --message "${GITHUB_SHA}" \
-            2>&1 | tee "$GITHUB_STEP_SUMMARY" wrangler-preview.log
-          url="$(grep -Eo 'https://[a-zA-Z0-9._/-]+\.workers\.dev' wrangler-preview.log | head -n 1 || true)"
-          echo "url=${url}" >> "$GITHUB_OUTPUT"
-
-      - name: Comment the preview URL
+        run: node scripts/docs-deployment/cli.mjs pr web
+      - name: Update the preview comment
         if: steps.preview.outputs.url != ''
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
-          GH_TOKEN: ${{ github.token }}
           PREVIEW_URL: ${{ steps.preview.outputs.url }}
-          PR_NUMBER: ${{ github.event.number }}
-        run: |
-          marker='<!-- weapp-dev-preview -->'
-          # Keep Markdown backticks literal in the preview comment.
-          # shellcheck disable=SC2016
-          body="$(printf '%s\n\nPreview for this pull request: %s\n\nThis Worker Version is not production traffic. `weapp.dev` stays on the current production deployment.\n' "${marker}" "${PREVIEW_URL}")"
-          existing="$(gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \
-            --jq ".[] | select(.body | contains(\"${marker}\")) | .id" | head -n 1)"
-          if [ -n "${existing}" ]; then
-            gh api -X PATCH "repos/${GITHUB_REPOSITORY}/issues/comments/${existing}" -f body="${body}"
-          else
-            gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" -f body="${body}"
-          fi
+        with:
+          github-token: ${{ github.token }}
+          script: |
+            const marker = '<!-- weapp-web-preview -->'
+            const body = `${marker}\n\nweb preview: ${process.env.PREVIEW_URL}\n\nCommit: ${process.env.PR_HEAD_SHA}`
+            const issue_number = Number(process.env.PR_NUMBER)
+            const comments = await github.paginate(github.rest.issues.listComments, { ...context.repo, issue_number })
+            const existing = comments.find(comment => comment.user?.type === 'Bot' && comment.body?.includes(marker))
+            if (existing) {
+              await github.rest.issues.updateComment({ ...context.repo, comment_id: existing.id, body })
+            } else {
+              await github.rest.issues.createComment({ ...context.repo, issue_number, body })
+            }
+      - name: Retain preview deployment evidence
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: pr-web-deployment-${{ github.event.number }}
+          path: .cache/docs-deployment
+          if-no-files-found: ignore
+          retention-days: 7
diff --git a/.github/workflows/open-source.yml b/.github/workflows/open-source.yml
index f0fec51a..6a65c8e8 100644
--- a/.github/workflows/open-source.yml
+++ b/.github/workflows/open-source.yml
@@ -16,6 +16,8 @@ on:
       - tsconfig.json
       - .node-version
       - .github/workflows/open-source.yml
+      - .github/workflows/repoctl-docs.yml
+      - .github/workflows/repoctl-docs-deploy.yml
   push:
     branches: [main]
     paths:
@@ -31,12 +33,17 @@ on:
       - tsconfig.json
       - .node-version
       - .github/workflows/open-source.yml
+      - .github/workflows/repoctl-docs.yml
+      - .github/workflows/repoctl-docs-deploy.yml
   workflow_dispatch:
 
 concurrency:
   group: open-source-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+env:
+  LEFTHOOK: '0'
+
 permissions:
   contents: read
 
@@ -45,8 +52,12 @@ jobs:
     name: Verify open-source application
     runs-on: ubuntu-24.04
     timeout-minutes: 25
+    env:
+      REPO_DOCS_CHANNEL: ${{ github.event_name == 'pull_request' && 'preview' || 'stable' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -63,6 +74,12 @@ jobs:
         run: pnpm --filter @weapp-io/open-source lint && pnpm --filter @weapp-io/open-source lint:styles && pnpm --filter @weapp-io/open-source check && pnpm --filter @weapp-io/open-source test
       - name: Build and validate
         run: pnpm --filter @weapp-io/open-source build
+      - name: Bind the preview artifact to this pull request
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          PR_NUMBER: ${{ github.event.number }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: node scripts/docs-build.mjs open-source --identity-only
       - name: Install browser
         run: pnpm --filter @weapp-io/open-source exec playwright install --with-deps chromium
       - name: Test deployment artifact
@@ -83,35 +100,62 @@ jobs:
           path: apps/open-source/test-results
           retention-days: 7
 
-  deploy-pages:
+  deploy-preview:
     needs: verify
-    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-24.04
-    timeout-minutes: 10
-    environment:
-      name: github-pages
-      url: ${{ steps.pages.outputs.page_url }}
+    timeout-minutes: 15
     concurrency:
-      group: deploy-pages
-      cancel-in-progress: false
+      group: pr-preview-open-source-${{ github.event.number }}
+      cancel-in-progress: true
     permissions:
       contents: read
-      pages: write
-      id-token: write
-
+      pull-requests: write
+    env:
+      CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID || vars.CLOUDFLARE_ACCOUNT_ID }}
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      PR_NUMBER: ${{ github.event.number }}
+      PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
     steps:
-      - name: Download the GitHub Pages site
-        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: open-source-dist
-          path: dist
-
-      - name: Upload the GitHub Pages artifact
-        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+          path: apps/open-source/dist
+      - name: Deploy the tested PR artifact
+        id: preview
+        run: node scripts/docs-deployment/cli.mjs pr open-source
+      - name: Update the preview comment
+        if: steps.preview.outputs.url != ''
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        env:
+          PREVIEW_URL: ${{ steps.preview.outputs.url }}
         with:
-          path: dist
-          include-hidden-files: false
-
-      - name: Deploy to GitHub Pages
-        id: pages
-        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
+          github-token: ${{ github.token }}
+          script: |
+            const marker = '<!-- weapp-open-source-preview -->'
+            const body = `${marker}\n\nopen-source preview: ${process.env.PREVIEW_URL}\n\nCommit: ${process.env.PR_HEAD_SHA}`
+            const issue_number = Number(process.env.PR_NUMBER)
+            const comments = await github.paginate(github.rest.issues.listComments, { ...context.repo, issue_number })
+            const existing = comments.find(comment => comment.user?.type === 'Bot' && comment.body?.includes(marker))
+            if (existing) {
+              await github.rest.issues.updateComment({ ...context.repo, comment_id: existing.id, body })
+            } else {
+              await github.rest.issues.createComment({ ...context.repo, issue_number, body })
+            }
+      - name: Retain preview deployment evidence
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: pr-open-source-deployment-${{ github.event.number }}
+          path: .cache/docs-deployment
+          if-no-files-found: ignore
+          retention-days: 7
diff --git a/.github/workflows/publish-weapp.yml b/.github/workflows/publish-weapp.yml
deleted file mode 100644
index 97c42928..00000000
--- a/.github/workflows/publish-weapp.yml
+++ /dev/null
@@ -1,95 +0,0 @@
-name: Publish weapp package
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      mode:
-        description: 'Validate only, or explicitly publish a release tag'
-        required: true
-        default: preflight
-        type: choice
-        options: [preflight, publish]
-      tag:
-        description: Git ref for preflight; publish requires weapp@<version> (legacy weapp-v<version> accepted)
-        required: true
-        default: main
-        type: string
-
-permissions:
-  contents: read
-
-concurrency:
-  group: publish-weapp
-  cancel-in-progress: false
-
-jobs:
-  publish:
-    if: github.repository == 'weappjs/weapp.dev' && (github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'weapp@') || startsWith(github.event.release.tag_name, 'weapp-v'))
-    name: Validate weapp and optionally publish
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      WEAPP_PREFLIGHT_MODE: ${{ github.event_name == 'release' && 'publish' || inputs.mode }}
-      WEAPP_RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
-
-    steps:
-      - name: Check out the release ref
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ inputs.tag || github.event.release.tag_name }}
-          fetch-depth: 0
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version-file: .node-version
-          cache: pnpm
-          registry-url: https://registry.npmjs.org
-
-      - name: Install npm with trusted publishing support
-        run: npm install --global npm@12.2.1
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Verify release tag
-        if: github.event_name == 'release' || inputs.mode == 'publish'
-        run: pnpm --filter weapp exec tsx scripts/check-release.ts
-
-      - name: Verify generated catalog
-        run: pnpm --filter weapp exec tsx scripts/build.ts --check-readme
-
-      - name: Test the package
-        run: pnpm check:boundaries && pnpm --filter weapp check && pnpm --filter weapp lint && pnpm --filter weapp lint:styles && pnpm --filter weapp test
-
-      - name: Verify the package contents
-        working-directory: packages/weapp
-        run: npm pack --ignore-scripts --json
-
-      - name: Preflight identity, unpublished version, exact artifact, and OIDC exchange
-        id: preflight
-        working-directory: packages/weapp
-        run: pnpm exec tsx scripts/preflight.ts --artifact
-
-      - name: Preserve the validated artifact
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
-        with:
-          name: weapp-publication-${{ github.run_id }}
-          path: packages/weapp/${{ steps.preflight.outputs.artifact }}
-          if-no-files-found: error
-          retention-days: 14
-
-      - name: Publish with npm provenance
-        if: github.event_name == 'release' || inputs.mode == 'publish'
-        working-directory: packages/weapp
-        env:
-          WEAPP_VALIDATED_ARTIFACT: ${{ steps.preflight.outputs.artifact }}
-        run: npm publish "./$WEAPP_VALIDATED_ARTIFACT" --ignore-scripts --access public --provenance
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..3005da56
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,331 @@
+# repoctl-managed: release/v2
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: Release operation
+        required: true
+        default: auto
+        type: choice
+        options:
+          - auto
+          - prepare
+          - publish
+          - publish-unpublished
+          - reconcile
+          - oidc-audit
+          - nightly
+      package:
+        description: Package used for unpublished-version recovery
+        required: false
+        type: string
+      version:
+        description: Version used for unpublished-version recovery
+        required: false
+        type: string
+      dry-run:
+        description: Preview reconciliation or nightly publication without changes
+        required: false
+        default: false
+        type: boolean
+      source-sha:
+        description: Original commit on the selected release line (publish modes only)
+        required: false
+        type: string
+  schedule:
+    # 02:00 Asia/Shanghai every day; an already-published source is skipped.
+    - cron: '0 18 * * *'
+
+env:
+  LEFTHOOK: '0'
+  NPM_CONFIG_PROVENANCE: true
+  npm_config_registry: https://registry.npmjs.org
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  release:
+    if: ${{ github.repository == 'weappjs/weapp.dev' && github.event_name != 'schedule' && inputs.mode != 'nightly' && inputs.mode != 'oidc-audit' }}
+    name: Release
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: write
+      id-token: write
+    outputs:
+      release-record: ${{ steps.release-finalize.outputs.release-record }}
+      docs-sites: ${{ steps.release-finalize.outputs.docs-sites }}
+    steps:
+      - name: Validate GitHub App configuration
+        env:
+          APP_CLIENT_ID: ${{ vars.REPOCTL_APP_CLIENT_ID }}
+          APP_PRIVATE_KEY_CONFIGURED: ${{ secrets.REPOCTL_APP_PRIVATE_KEY != '' }}
+        run: |
+          if { [ -n "$APP_CLIENT_ID" ] && [ "$APP_PRIVATE_KEY_CONFIGURED" != 'true' ]; } ||
+             { [ -z "$APP_CLIENT_ID" ] && [ "$APP_PRIVATE_KEY_CONFIGURED" = 'true' ]; }; then
+            echo 'Configure both REPOCTL_APP_CLIENT_ID and REPOCTL_APP_PRIVATE_KEY.' >&2
+            exit 1
+          fi
+
+      - name: Create GitHub App token
+        if: ${{ vars.REPOCTL_APP_CLIENT_ID != '' }}
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.REPOCTL_APP_CLIENT_ID }}
+          private-key: ${{ secrets.REPOCTL_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-actions: write
+
+      - name: Checkout Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: pnpm
+
+      - name: Install npm with trusted publishing support
+        run: npm install --global npm@11.16.0 --registry=https://registry.npmjs.org
+
+      - name: Install Dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Release plan
+        id: release-plan
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage plan
+
+      - name: Release verify
+        id: release-verify
+        if: ${{ steps.release-plan.outputs.run == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage verify
+
+      - name: Release prepare
+        id: release-prepare
+        if: ${{ steps.release-plan.outputs.run == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage prepare
+
+      - name: Validate the version pull request
+        if: ${{ steps.release-plan.outputs.run == 'true' && steps.release-prepare.outputs.publish != 'true' }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          # Workflow-token PRs do not emit another workflow-triggering event.
+          pr_url=$(gh pr list --head release/pnpm-version --base main --state open --json url --jq '.[0].url // empty')
+          if [ -n "$pr_url" ]; then
+            printf 'Version PR: %s\n' "$pr_url" >> "$GITHUB_STEP_SUMMARY"
+            gh workflow run weapp-cli.yml --ref release/pnpm-version
+          fi
+
+      - name: Release upload
+        id: release-upload
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage upload
+
+      - name: Release confirm
+        id: release-confirm
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage confirm
+
+      - name: Release finalize
+        id: release-finalize
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage finalize
+
+      - name: Preserve npm publish progress
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: npm-publish-progress-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            pnpm-publish-summary.json
+            repoctl-publish-progress.json
+            repoctl-release-progress.json
+            repoctl-ci-progress.json
+          if-no-files-found: ignore
+          retention-days: 14
+
+  docs:
+    needs: release
+    if: ${{ !cancelled() && github.ref == 'refs/heads/main' && needs.release.outputs.release-record != '' && needs.release.outputs.docs-sites != '' && needs.release.outputs.docs-sites != '[]' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        site: ${{ fromJSON(needs.release.outputs.docs-sites) }}
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    uses: ./.github/workflows/repoctl-docs-deploy.yml
+    with:
+      site: ${{ matrix.site }}
+      channel: stable
+      release: ${{ needs.release.outputs.release-record }}
+    secrets: inherit
+
+  nightly:
+    name: Publish nightly
+    if: ${{ github.repository == 'weappjs/weapp.dev' && ((github.event_name == 'schedule' && github.event.schedule == '0 18 * * *') || (github.event_name == 'workflow_dispatch' && inputs.mode == 'nightly')) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    env:
+      REPOCTL_NIGHTLY_PROVIDER: npm
+      REPOCTL_NIGHTLY_SCHEDULE: '0 18 * * *'
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Validate nightly source
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          if [ -z "$DEFAULT_BRANCH" ] || [ "$GITHUB_REF" != "refs/heads/$DEFAULT_BRANCH" ]; then
+            echo '::error::Nightly publication requires the repository default branch.'
+            exit 1
+          fi
+
+      - name: Checkout nightly source
+        id: nightly-checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: pnpm
+
+      - name: Install npm with trusted publishing support
+        id: nightly-npm
+        run: npm install --global npm@11.16.0 --registry=https://registry.npmjs.org
+
+      - name: Install Dependencies without lifecycle scripts
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Publish nightly packages
+        id: nightly-publish
+        env:
+          REPOCTL_SNAPSHOT_PUBLISH: '1'
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: |
+          args=(--publish --output "$RUNNER_TEMP/repoctl-nightly" --json)
+          if [ "$REPO_RELEASE_DRY_RUN" = 'true' ]; then
+            args+=(--dry-run)
+          fi
+          pnpm exec repo release nightly "${args[@]}"
+
+      - name: Preserve nightly diagnostics
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: nightly-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            ${{ runner.temp }}/repoctl-nightly/*.json
+            ${{ runner.temp }}/repoctl-nightly/**/nightly-report.json
+            ${{ runner.temp }}/repoctl-nightly/**/consumer-report.json
+            ${{ runner.temp }}/repoctl-nightly/**/snapshot-report.json
+            ${{ runner.temp }}/repoctl-nightly/**/tarballs/**/*.tgz
+          if-no-files-found: ignore
+          retention-days: 14
+
+  oidc-audit:
+    name: Audit npm OIDC
+    if: ${{ github.repository == 'weappjs/weapp.dev' && github.event_name == 'workflow_dispatch' && inputs.mode == 'oidc-audit' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Setup Node.js environment
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: pnpm
+
+      - name: Install Dependencies without lifecycle scripts
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Audit every publishable package
+        env:
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --mode oidc-audit
diff --git a/.github/workflows/repoctl-docs-deploy.yml b/.github/workflows/repoctl-docs-deploy.yml
new file mode 100644
index 00000000..ca61a85a
--- /dev/null
+++ b/.github/workflows/repoctl-docs-deploy.yml
@@ -0,0 +1,166 @@
+# repoctl-managed: docs-deploy/v1
+name: Deploy documentation
+
+on:
+  workflow_call:
+    inputs:
+      site:
+        required: true
+        type: string
+      channel:
+        required: true
+        type: string
+      source-sha:
+        required: false
+        default: ''
+        type: string
+      release:
+        required: false
+        default: ''
+        type: string
+      commits:
+        required: false
+        default: ''
+        type: string
+
+env:
+  LEFTHOOK: '0'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: docs-${{ inputs.site }}-${{ inputs.channel }}
+  cancel-in-progress: false
+
+jobs:
+  cloudflare:
+    if: ${{ github.repository == 'weappjs/weapp.dev' && github.ref == 'refs/heads/main' && github.event.repository.default_branch == 'main' && (inputs.site == 'web' || inputs.channel == 'preview') }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    environment: docs-${{ inputs.site }}-${{ inputs.channel }}
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: main
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Install the validation browser
+        run: pnpm --filter @weapp-io/web exec playwright install --with-deps chromium
+      - name: Plan and deploy the selected documentation source
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REPO_DOCS_SITE: ${{ inputs.site }}
+          REPO_DOCS_CHANNEL: ${{ inputs.channel }}
+          REPO_DOCS_SOURCE_SHA: ${{ inputs.source-sha }}
+          REPO_DOCS_RELEASE: ${{ inputs.release }}
+          REPO_DOCS_COMMITS: ${{ inputs.commits }}
+          REPO_DOCS_CONCURRENCY_GROUP: docs-${{ inputs.site }}-${{ inputs.channel }}
+          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID || vars.CLOUDFLARE_ACCOUNT_ID }}
+        run: |
+          args=("$REPO_DOCS_SITE" --channel "$REPO_DOCS_CHANNEL")
+          if [ -n "$REPO_DOCS_SOURCE_SHA" ]; then args+=(--source-sha "$REPO_DOCS_SOURCE_SHA"); fi
+          if [ -n "$REPO_DOCS_RELEASE" ]; then args+=(--release "$REPO_DOCS_RELEASE"); fi
+          if [ -n "$REPO_DOCS_COMMITS" ]; then
+            read -r -a commits <<< "$REPO_DOCS_COMMITS"
+            args+=(--commits "${commits[@]}")
+          fi
+          pnpm exec repo docs plan "${args[@]}" --json
+          pnpm exec repo docs deploy "${args[@]}" --json
+      - name: Retain the tested deployment artifact
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: docs-${{ inputs.site }}-${{ inputs.channel }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .cache/docs-artifacts/${{ inputs.site }}/${{ inputs.channel }}/dist
+          if-no-files-found: ignore
+          retention-days: 30
+      - name: Retain deployment and test evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: docs-evidence-${{ inputs.site }}-${{ inputs.channel }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            .cache/docs-artifacts/${{ inputs.site }}/${{ inputs.channel }}/test-results
+            .cache/docs-deployment
+          if-no-files-found: ignore
+          retention-days: 7
+
+  pages:
+    if: ${{ github.repository == 'weappjs/weapp.dev' && github.ref == 'refs/heads/main' && github.event.repository.default_branch == 'main' && inputs.site == 'open-source' && inputs.channel == 'stable' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    environment: docs-${{ inputs.site }}-${{ inputs.channel }}
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          ref: main
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - name: Install the validation browser
+        run: pnpm --filter @weapp-io/web exec playwright install --with-deps chromium
+      # A JavaScript action exposes the runner artifact service credentials to its child.
+      - name: Plan and deploy the validated Pages artifact
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REPO_DOCS_SITE: ${{ inputs.site }}
+          REPO_DOCS_CHANNEL: ${{ inputs.channel }}
+          REPO_DOCS_SOURCE_SHA: ${{ inputs.source-sha }}
+          REPO_DOCS_RELEASE: ${{ inputs.release }}
+          REPO_DOCS_COMMITS: ${{ inputs.commits }}
+          REPO_DOCS_CONCURRENCY_GROUP: docs-${{ inputs.site }}-${{ inputs.channel }}
+        with:
+          github-token: ${{ github.token }}
+          script: |
+            const { spawnSync } = require('node:child_process')
+            const args = [process.env.REPO_DOCS_SITE, '--channel', process.env.REPO_DOCS_CHANNEL]
+            if (process.env.REPO_DOCS_SOURCE_SHA) args.push('--source-sha', process.env.REPO_DOCS_SOURCE_SHA)
+            if (process.env.REPO_DOCS_RELEASE) args.push('--release', process.env.REPO_DOCS_RELEASE)
+            if (process.env.REPO_DOCS_COMMITS) args.push('--commits', ...process.env.REPO_DOCS_COMMITS.trim().split(/\s+/))
+            for (const command of ['plan', 'deploy']) {
+              const result = spawnSync('pnpm', ['exec', 'repo', 'docs', command, ...args, '--json'], {
+                stdio: 'inherit',
+                env: process.env,
+              })
+              if (result.error || result.status !== 0) {
+                throw new Error(`repo docs ${command} failed with status ${result.status}`)
+              }
+            }
+      - name: Retain the tested deployment artifact
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: docs-${{ inputs.site }}-${{ inputs.channel }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: .cache/docs-artifacts/${{ inputs.site }}/${{ inputs.channel }}/dist
+          if-no-files-found: ignore
+          retention-days: 30
+      - name: Retain deployment and test evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: docs-evidence-${{ inputs.site }}-${{ inputs.channel }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            .cache/docs-artifacts/${{ inputs.site }}/${{ inputs.channel }}/test-results
+            .cache/docs-deployment
+          if-no-files-found: ignore
+          retention-days: 7
diff --git a/.github/workflows/repoctl-docs.yml b/.github/workflows/repoctl-docs.yml
new file mode 100644
index 00000000..d3fae659
--- /dev/null
+++ b/.github/workflows/repoctl-docs.yml
@@ -0,0 +1,88 @@
+# repoctl-managed: docs/v1
+name: Documentation
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      site:
+        description: Configured documentation site
+        required: true
+        type: string
+      channel:
+        description: Deployment channel
+        required: true
+        default: stable
+        type: choice
+        options: [stable, preview]
+      source-sha:
+        description: Exact main commit for preview
+        required: false
+        type: string
+      release:
+        description: Completed stable release ID, for deployment or retry
+        required: false
+        type: string
+      commits:
+        description: Space-separated single-parent main commits containing documentation corrections
+        required: false
+        type: string
+
+env:
+  LEFTHOOK: '0'
+
+permissions:
+  contents: read
+
+jobs:
+  sites:
+    if: ${{ github.repository == 'weappjs/weapp.dev' && github.ref == 'refs/heads/main' && github.event.repository.default_branch == 'main' }}
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    outputs:
+      sites: ${{ steps.sites.outputs.sites }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24.22.1
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - id: sites
+        env:
+          REQUESTED_SITE: ${{ inputs.site }}
+        run: |
+          node --input-type=module <<'NODE'
+          import { appendFile } from 'node:fs/promises'
+          import { loadMonorepoConfig } from 'repoctl'
+          const config = await loadMonorepoConfig(process.cwd())
+          const sites = Object.keys(config.commands?.docs?.sites ?? {}).sort()
+          const requested = process.env.REQUESTED_SITE
+          if (requested && !sites.includes(requested)) throw new Error('Unknown documentation site')
+          await appendFile(process.env.GITHUB_OUTPUT, `sites=${JSON.stringify(requested ? [requested] : sites)}\n`)
+          NODE
+
+  deploy:
+    needs: sites
+    if: ${{ needs.sites.outputs.sites != '[]' && needs.sites.outputs.sites != '' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        site: ${{ fromJSON(needs.sites.outputs.sites) }}
+    permissions:
+      contents: write
+      pages: write
+      id-token: write
+    uses: ./.github/workflows/repoctl-docs-deploy.yml
+    with:
+      site: ${{ matrix.site }}
+      channel: ${{ github.event_name == 'push' && 'preview' || inputs.channel }}
+      source-sha: ${{ github.event_name == 'push' && github.sha || inputs.source-sha }}
+      release: ${{ inputs.release }}
+      commits: ${{ inputs.commits }}
+    secrets: inherit
diff --git a/.github/workflows/sync-project-metrics.yml b/.github/workflows/sync-project-metrics.yml
index 66052288..978a139d 100644
--- a/.github/workflows/sync-project-metrics.yml
+++ b/.github/workflows/sync-project-metrics.yml
@@ -5,6 +5,9 @@ on:
     - cron: '0 1 * * 1' # Monday 09:00 Asia/Shanghai (UTC+8)
   workflow_dispatch:
 
+env:
+  LEFTHOOK: '0'
+
 concurrency:
   group: sync-project-metrics
   cancel-in-progress: false
diff --git a/.github/workflows/version-packages.yml b/.github/workflows/version-packages.yml
deleted file mode 100644
index 4e990c1e..00000000
--- a/.github/workflows/version-packages.yml
+++ /dev/null
@@ -1,65 +0,0 @@
-name: Version Packages
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  HUSKY: 0 # repoctl runs release:verify; package checks also run on the generated PR.
-
-concurrency:
-  group: version-packages
-  cancel-in-progress: false
-
-jobs:
-  prepare:
-    if: github.repository == 'weappjs/weapp.dev' && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 15
-    permissions:
-      contents: write
-      pull-requests: write
-      actions: write
-    steps:
-      - name: Check out the release line
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: main
-          fetch-depth: 0
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
-
-      - name: Set up Node.js
-        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
-        with:
-          node-version-file: .node-version
-          cache: pnpm
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Validate the versioning configuration
-        run: pnpm exec repo config validate && pnpm change check
-
-      - name: Prepare the version pull request with repoctl
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: pnpm release:prepare
-
-      - name: Validate the version pull request
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GH_REPO: ${{ github.repository }}
-        run: |
-          # Dispatch checks explicitly for PRs created with the workflow token.
-          pr_url=$(gh pr list --head release/pnpm-version --base main --state open --json url --jq '.[0].url // empty')
-          if [ -n "$pr_url" ]; then
-            printf 'Version PR: %s\n' "$pr_url" >> "$GITHUB_STEP_SUMMARY"
-            gh workflow run weapp-cli.yml --ref release/pnpm-version
-            gh workflow run publish-weapp.yml --ref release/pnpm-version -f mode=preflight -f tag=release/pnpm-version
-          fi
diff --git a/.github/workflows/weapp-cli.yml b/.github/workflows/weapp-cli.yml
index 93dc44bb..79cc1dca 100644
--- a/.github/workflows/weapp-cli.yml
+++ b/.github/workflows/weapp-cli.yml
@@ -17,8 +17,7 @@ on:
       - pnpm-workspace.yaml
       - eslint.config.js
       - .github/workflows/weapp-cli.yml
-      - .github/workflows/publish-weapp.yml
-      - .github/workflows/version-packages.yml
+      - .github/workflows/release.yml
   push:
     branches: [main]
     paths:
@@ -35,10 +34,12 @@ on:
       - pnpm-workspace.yaml
       - eslint.config.js
       - .github/workflows/weapp-cli.yml
-      - .github/workflows/publish-weapp.yml
-      - .github/workflows/version-packages.yml
+      - .github/workflows/release.yml
   workflow_dispatch:
 
+env:
+  LEFTHOOK: '0'
+
 permissions:
   contents: read
 
diff --git a/.husky/pre-commit b/.husky/pre-commit
deleted file mode 100755
index 5fc57f24..00000000
--- a/.husky/pre-commit
+++ /dev/null
@@ -1 +0,0 @@
-pnpm exec repo verify pre-commit
diff --git a/.node-version b/.node-version
index b8b23ca9..ce62013c 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-22.23.4
+24.22.1
diff --git a/.repoctl/baselines/root/0da85e683125db2a66123e080152c15de988e502daa6d2375b7199d2cb9ed9ea.json b/.repoctl/baselines/root/0da85e683125db2a66123e080152c15de988e502daa6d2375b7199d2cb9ed9ea.json
new file mode 100644
index 00000000..e7a2a32a
--- /dev/null
+++ b/.repoctl/baselines/root/0da85e683125db2a66123e080152c15de988e502daa6d2375b7199d2cb9ed9ea.json
@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "path": ".github/workflows/repoctl-docs.yml",
+  "source": {
+    "package": "@icebreakers/monorepo-templates",
+    "version": "3.0.1",
+    "assetPath": ".github/workflows/repoctl-docs.yml",
+    "hash": "a5dc95668e55c83c14a79fb4a2d1f02c0538cf8be25cb3667169f9b6203c7b83"
+  },
+  "upstream": {
+    "hash": "a5dc95668e55c83c14a79fb4a2d1f02c0538cf8be25cb3667169f9b6203c7b83",
+    "content": "IyByZXBvY3RsLW1hbmFnZWQ6IGRvY3MvdjEKbmFtZTogRG9jdW1lbnRhdGlvbgoKb246CiAgcHVzaDoKICAgIGJyYW5jaGVzOiBbbWFpbl0KICB3b3JrZmxvd19kaXNwYXRjaDoKICAgIGlucHV0czoKICAgICAgc2l0ZToKICAgICAgICBkZXNjcmlwdGlvbjogQ29uZmlndXJlZCBkb2N1bWVudGF0aW9uIHNpdGUKICAgICAgICByZXF1aXJlZDogdHJ1ZQogICAgICAgIHR5cGU6IHN0cmluZwogICAgICBjaGFubmVsOgogICAgICAgIGRlc2NyaXB0aW9uOiBEZXBsb3ltZW50IGNoYW5uZWwKICAgICAgICByZXF1aXJlZDogdHJ1ZQogICAgICAgIGRlZmF1bHQ6IHN0YWJsZQogICAgICAgIHR5cGU6IGNob2ljZQogICAgICAgIG9wdGlvbnM6IFtzdGFibGUsIHByZXZpZXddCiAgICAgIHNvdXJjZS1zaGE6CiAgICAgICAgZGVzY3JpcHRpb246IEV4YWN0IG1haW4gY29tbWl0IGZvciBwcmV2aWV3CiAgICAgICAgcmVxdWlyZWQ6IGZhbHNlCiAgICAgICAgdHlwZTogc3RyaW5nCiAgICAgIHJlbGVhc2U6CiAgICAgICAgZGVzY3JpcHRpb246IENvbXBsZXRlZCBzdGFibGUgcmVsZWFzZSBJRCwgZm9yIGRlcGxveW1lbnQgb3IgcmV0cnkKICAgICAgICByZXF1aXJlZDogZmFsc2UKICAgICAgICB0eXBlOiBzdHJpbmcKICAgICAgY29tbWl0czoKICAgICAgICBkZXNjcmlwdGlvbjogU3BhY2Utc2VwYXJhdGVkIHNpbmdsZS1wYXJlbnQgbWFpbiBjb21taXRzIGNvbnRhaW5pbmcgZG9jdW1lbnRhdGlvbiBjb3JyZWN0aW9ucwogICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgIHR5cGU6IHN0cmluZwoKcGVybWlzc2lvbnM6CiAgY29udGVudHM6IHdyaXRlCgpqb2JzOgogIHNpdGVzOgogICAgaWY6ICR7eyBnaXRodWIucmVmID09ICdyZWZzL2hlYWRzL21haW4nICYmIGdpdGh1Yi5ldmVudC5yZXBvc2l0b3J5LmRlZmF1bHRfYnJhbmNoID09ICdtYWluJyB9fQogICAgcnVucy1vbjogdWJ1bnR1LWxhdGVzdAogICAgcGVybWlzc2lvbnM6CiAgICAgIGNvbnRlbnRzOiByZWFkCiAgICBvdXRwdXRzOgogICAgICBzaXRlczogJHt7IHN0ZXBzLnNpdGVzLm91dHB1dHMuc2l0ZXMgfX0KICAgIHN0ZXBzOgogICAgICAtIHVzZXM6IGFjdGlvbnMvY2hlY2tvdXRAM2QzYzQyZTVhYWM1YmE4MDU4MjVkYTc2NDEwYzE4MTI3M2JhOTBiMSAjIHY3LjAuMQogICAgICAgIHdpdGg6CiAgICAgICAgICBwZXJzaXN0LWNyZWRlbnRpYWxzOiBmYWxzZQogICAgICAtIHVzZXM6IHBucG0vYWN0aW9uLXNldHVwQGVhMTdjNjhkZjg5MTJlZjU0MzM1MjcyM2MxNDlhODRmNTZlM2Q0MTMgIyB2Ni4xLjAKICAgICAgLSB1c2VzOiBhY3Rpb25zL3NldHVwLW5vZGVAOTQ5ZmViMjQxM2Q2NDU4Nzk0ZGNkMjQ5MWM0YmFiYmJjZTBjMTVjMSAjIHY3LjEuMAogICAgICAgIHdpdGg6CiAgICAgICAgICBub2RlLXZlcnNpb246IDI0LjIyLjEKICAgICAgICAgIGNhY2hlOiBwbnBtCiAgICAgIC0gcnVuOiBwbnBtIGluc3RhbGwgLS1mcm96ZW4tbG9ja2ZpbGUKICAgICAgLSBpZDogc2l0ZXMKICAgICAgICBlbnY6CiAgICAgICAgICBSRVFVRVNURURfU0lURTogJHt7IGlucHV0cy5zaXRlIH19CiAgICAgICAgcnVuOiB8CiAgICAgICAgICBub2RlIC0taW5wdXQtdHlwZT1tb2R1bGUgPDwnTk9ERScKICAgICAgICAgIGltcG9ydCB7IGFwcGVuZEZpbGUgfSBmcm9tICdub2RlOmZzL3Byb21pc2VzJwogICAgICAgICAgaW1wb3J0IHsgbG9hZE1vbm9yZXBvQ29uZmlnIH0gZnJvbSAncmVwb2N0bCcKICAgICAgICAgIGNvbnN0IGNvbmZpZyA9IGF3YWl0IGxvYWRNb25vcmVwb0NvbmZpZyhwcm9jZXNzLmN3ZCgpKQogICAgICAgICAgY29uc3Qgc2l0ZXMgPSBPYmplY3Qua2V5cyhjb25maWcuY29tbWFuZHM/LmRvY3M/LnNpdGVzID8/IHt9KS5zb3J0KCkKICAgICAgICAgIGNvbnN0IHJlcXVlc3RlZCA9IHByb2Nlc3MuZW52LlJFUVVFU1RFRF9TSVRFCiAgICAgICAgICBpZiAocmVxdWVzdGVkICYmICFzaXRlcy5pbmNsdWRlcyhyZXF1ZXN0ZWQpKSB0aHJvdyBuZXcgRXJyb3IoJ1Vua25vd24gZG9jdW1lbnRhdGlvbiBzaXRlJykKICAgICAgICAgIGF3YWl0IGFwcGVuZEZpbGUocHJvY2Vzcy5lbnYuR0lUSFVCX09VVFBVVCwgYHNpdGVzPSR7SlNPTi5zdHJpbmdpZnkocmVxdWVzdGVkID8gW3JlcXVlc3RlZF0gOiBzaXRlcyl9XG5gKQogICAgICAgICAgTk9ERQoKICBkZXBsb3k6CiAgICBuZWVkczogc2l0ZXMKICAgIGlmOiAke3sgbmVlZHMuc2l0ZXMub3V0cHV0cy5zaXRlcyAhPSAnW10nICYmIG5lZWRzLnNpdGVzLm91dHB1dHMuc2l0ZXMgIT0gJycgfX0KICAgIHN0cmF0ZWd5OgogICAgICBmYWlsLWZhc3Q6IGZhbHNlCiAgICAgIG1hdHJpeDoKICAgICAgICBzaXRlOiAke3sgZnJvbUpTT04obmVlZHMuc2l0ZXMub3V0cHV0cy5zaXRlcykgfX0KICAgIHVzZXM6IC4vLmdpdGh1Yi93b3JrZmxvd3MvcmVwb2N0bC1kb2NzLWRlcGxveS55bWwKICAgIHdpdGg6CiAgICAgIHNpdGU6ICR7eyBtYXRyaXguc2l0ZSB9fQogICAgICBjaGFubmVsOiAke3sgZ2l0aHViLmV2ZW50X25hbWUgPT0gJ3B1c2gnICYmICdwcmV2aWV3JyB8fCBpbnB1dHMuY2hhbm5lbCB9fQogICAgICBzb3VyY2Utc2hhOiAke3sgZ2l0aHViLmV2ZW50X25hbWUgPT0gJ3B1c2gnICYmIGdpdGh1Yi5zaGEgfHwgaW5wdXRzLnNvdXJjZS1zaGEgfX0KICAgICAgcmVsZWFzZTogJHt7IGlucHV0cy5yZWxlYXNlIH19CiAgICAgIGNvbW1pdHM6ICR7eyBpbnB1dHMuY29tbWl0cyB9fQogICAgc2VjcmV0czogaW5oZXJpdAo="
+  }
+}
diff --git a/.repoctl/baselines/root/87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34.json b/.repoctl/baselines/root/87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34.json
new file mode 100644
index 00000000..4a9d64c8
--- /dev/null
+++ b/.repoctl/baselines/root/87db21a973eed4fef5f32b267aa60fcee5cbdf03c67fafdc2a9b553bb0b15f34.json
@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "path": ".github/workflows/release.yml",
+  "source": {
+    "package": "@icebreakers/monorepo-templates",
+    "version": "3.0.1",
+    "assetPath": ".github/workflows/release.yml",
+    "hash": "5cbbc636eff5094b0974048e377c9d0924f0f35b2155dbf9b5e6fe8d0bb96020"
+  },
+  "upstream": {
+    "hash": "a74821ca181c1cfc940096b02ac25210caefb63a4ca8e2e5a0ef05a7768c2882",
+    "content": "IyByZXBvY3RsLW1hbmFnZWQ6IHJlbGVhc2UvdjIKbmFtZTogUmVsZWFzZQoKb246CiAgIyBTb3VyY2UgcmVwb3NpdG9yeSBvbmx5OiAwMzoxNyBBc2lhL1NoYW5naGFpLgogIHB1c2g6CiAgICBicmFuY2hlczoKICAgICAgLSBtYWluCiAgd29ya2Zsb3dfZGlzcGF0Y2g6CiAgICBpbnB1dHM6CiAgICAgIG1vZGU6CiAgICAgICAgZGVzY3JpcHRpb246IFJlbGVhc2Ugb3BlcmF0aW9uCiAgICAgICAgcmVxdWlyZWQ6IHRydWUKICAgICAgICBkZWZhdWx0OiBhdXRvCiAgICAgICAgdHlwZTogY2hvaWNlCiAgICAgICAgb3B0aW9uczoKICAgICAgICAgIC0gYXV0bwogICAgICAgICAgLSBwcmVwYXJlCiAgICAgICAgICAtIHB1Ymxpc2gKICAgICAgICAgIC0gcHVibGlzaC11bnB1Ymxpc2hlZAogICAgICAgICAgLSByZWNvbmNpbGUKICAgICAgICAgIC0gb2lkYy1hdWRpdAogICAgICAgICAgLSBuaWdodGx5CiAgICAgIHBhY2thZ2U6CiAgICAgICAgZGVzY3JpcHRpb246IFBhY2thZ2UgdXNlZCBmb3IgdW5wdWJsaXNoZWQtdmVyc2lvbiByZWNvdmVyeQogICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgIHR5cGU6IHN0cmluZwogICAgICB2ZXJzaW9uOgogICAgICAgIGRlc2NyaXB0aW9uOiBWZXJzaW9uIHVzZWQgZm9yIHVucHVibGlzaGVkLXZlcnNpb24gcmVjb3ZlcnkKICAgICAgICByZXF1aXJlZDogZmFsc2UKICAgICAgICB0eXBlOiBzdHJpbmcKICAgICAgZHJ5LXJ1bjoKICAgICAgICBkZXNjcmlwdGlvbjogUHJldmlldyByZWNvbmNpbGlhdGlvbiBvciBuaWdodGx5IHB1YmxpY2F0aW9uIHdpdGhvdXQgY2hhbmdlcwogICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgIGRlZmF1bHQ6IGZhbHNlCiAgICAgICAgdHlwZTogYm9vbGVhbgogICAgICBzb3VyY2Utc2hhOgogICAgICAgIGRlc2NyaXB0aW9uOiBPcmlnaW5hbCBjb21taXQgb24gdGhlIHNlbGVjdGVkIHJlbGVhc2UgbGluZSAocHVibGlzaCBtb2RlcyBvbmx5KQogICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgIHR5cGU6IHN0cmluZwogIHNjaGVkdWxlOgogICAgLSBjcm9uOiAwIDE4ICogKiAqCgplbnY6CiAgTEVGVEhPT0s6IDAKICBOUE1fQ09ORklHX1BST1ZFTkFOQ0U6IHRydWUKICBucG1fY29uZmlnX3JlZ2lzdHJ5OiBodHRwczovL3JlZ2lzdHJ5Lm5wbWpzLm9yZwoKcGVybWlzc2lvbnM6CiAgY29udGVudHM6IHdyaXRlCiAgcHVsbC1yZXF1ZXN0czogd3JpdGUKICBpZC10b2tlbjogd3JpdGUKCmNvbmN1cnJlbmN5OgogIGdyb3VwOiAke3sgZ2l0aHViLndvcmtmbG93IH19LSR7eyBnaXRodWIucmVmIH19CiAgY2FuY2VsLWluLXByb2dyZXNzOiBmYWxzZQoKam9iczoKICByZWxlYXNlOgogICAgaWY6ICR7eyBnaXRodWIuZXZlbnRfbmFtZSAhPSAnc2NoZWR1bGUnICYmIGlucHV0cy5tb2RlICE9ICduaWdodGx5JyAmJiBpbnB1dHMubW9kZSAhPSAnb2lkYy1hdWRpdCcgfX0KICAgIG5hbWU6IFJlbGVhc2UKICAgIHJ1bnMtb246IHVidW50dS1sYXRlc3QKICAgIG91dHB1dHM6CiAgICAgIHJlbGVhc2UtcmVjb3JkOiAke3sgc3RlcHMucmVsZWFzZS1maW5hbGl6ZS5vdXRwdXRzLnJlbGVhc2UtcmVjb3JkIH19CiAgICAgIGRvY3Mtc2l0ZXM6ICR7eyBzdGVwcy5yZWxlYXNlLWZpbmFsaXplLm91dHB1dHMuZG9jcy1zaXRlcyB9fQogICAgc3RlcHM6CiAgICAgIC0gbmFtZTogVmFsaWRhdGUgR2l0SHViIEFwcCBjb25maWd1cmF0aW9uCiAgICAgICAgZW52OgogICAgICAgICAgQVBQX0NMSUVOVF9JRDogJHt7IHZhcnMuUkVQT0NUTF9BUFBfQ0xJRU5UX0lEIH19CiAgICAgICAgICBBUFBfUFJJVkFURV9LRVlfQ09ORklHVVJFRDogJHt7IHNlY3JldHMuUkVQT0NUTF9BUFBfUFJJVkFURV9LRVkgIT0gJycgfX0KICAgICAgICBydW46IHwKICAgICAgICAgIGlmIHsgWyAtbiAiJEFQUF9DTElFTlRfSUQiIF0gJiYgWyAiJEFQUF9QUklWQVRFX0tFWV9DT05GSUdVUkVEIiAhPSAndHJ1ZScgXTsgfSB8fAogICAgICAgICAgICAgeyBbIC16ICIkQVBQX0NMSUVOVF9JRCIgXSAmJiBbICIkQVBQX1BSSVZBVEVfS0VZX0NPTkZJR1VSRUQiID0gJ3RydWUnIF07IH07IHRoZW4KICAgICAgICAgICAgZWNobyAnQ29uZmlndXJlIGJvdGggUkVQT0NUTF9BUFBfQ0xJRU5UX0lEIGFuZCBSRVBPQ1RMX0FQUF9QUklWQVRFX0tFWS4nID4mMgogICAgICAgICAgICBleGl0IDEKICAgICAgICAgIGZpCgogICAgICAtIG5hbWU6IENyZWF0ZSBHaXRIdWIgQXBwIHRva2VuCiAgICAgICAgaWY6ICR7eyB2YXJzLlJFUE9DVExfQVBQX0NMSUVOVF9JRCAhPSAnJyB9fQogICAgICAgIGlkOiBhcHAtdG9rZW4KICAgICAgICB1c2VzOiBhY3Rpb25zL2NyZWF0ZS1naXRodWItYXBwLXRva2VuQDY0YWI3MjlhNjI5NDAwMGY1YWE0YTRiYzBiNzNkMWYzMmJjNDU1MTAgIyB2My4zLjAKICAgICAgICB3aXRoOgogICAgICAgICAgY2xpZW50LWlkOiAke3sgdmFycy5SRVBPQ1RMX0FQUF9DTElFTlRfSUQgfX0KICAgICAgICAgIHByaXZhdGUta2V5OiAke3sgc2VjcmV0cy5SRVBPQ1RMX0FQUF9QUklWQVRFX0tFWSB9fQogICAgICAgICAgcGVybWlzc2lvbi1jb250ZW50czogd3JpdGUKICAgICAgICAgIHBlcm1pc3Npb24tcHVsbC1yZXF1ZXN0czogd3JpdGUKCiAgICAgIC0gbmFtZTogQ2hlY2tvdXQgUmVwbwogICAgICAgIHVzZXM6IGFjdGlvbnMvY2hlY2tvdXRAM2QzYzQyZTVhYWM1YmE4MDU4MjVkYTc2NDEwYzE4MTI3M2JhOTBiMSAjIHY3LjAuMQogICAgICAgIHdpdGg6CiAgICAgICAgICBmZXRjaC1kZXB0aDogMAogICAgICAgICAgdG9rZW46ICR7eyBzdGVwcy5hcHAtdG9rZW4ub3V0cHV0cy50b2tlbiB8fCBzZWNyZXRzLlJFUE9DVExfUkVMRUFTRV9UT0tFTiB8fCBzZWNyZXRzLkNIQU5HRVNFVFNfUkVMRUFTRV9UT0tFTiB8fCBnaXRodWIudG9rZW4gfX0KCiAgICAgIC0gdXNlczogcG5wbS9hY3Rpb24tc2V0dXBAZWExN2M2OGRmODkxMmVmNTQzMzUyNzIzYzE0OWE4NGY1NmUzZDQxMyAjIHY2LjEuMAoKICAgICAgLSBuYW1lOiBTZXR1cCBOb2RlLmpzIGVudmlyb25tZW50CiAgICAgICAgdXNlczogYWN0aW9ucy9zZXR1cC1ub2RlQDk0OWZlYjI0MTNkNjQ1ODc5NGRjZDI0OTFjNGJhYmJiY2UwYzE1YzEgIyB2Ny4xLjAKICAgICAgICB3aXRoOgogICAgICAgICAgbm9kZS12ZXJzaW9uOiAyNC4yMi4xCiAgICAgICAgICBjYWNoZTogcG5wbQoKICAgICAgLSBuYW1lOiBJbnN0YWxsIG5wbSB3aXRoIHRydXN0ZWQgcHVibGlzaGluZyBzdXBwb3J0CiAgICAgICAgcnVuOiBucG0gaW5zdGFsbCAtLWdsb2JhbCBucG1AMTEuMTYuMCAtLXJlZ2lzdHJ5PWh0dHBzOi8vcmVnaXN0cnkubnBtanMub3JnCgogICAgICAtIG5hbWU6IEluc3RhbGwgRGVwZW5kZW5jaWVzCiAgICAgICAgcnVuOiBwbnBtIGluc3RhbGwgLS1mcm96ZW4tbG9ja2ZpbGUKCiAgICAgIC0gbmFtZTogUmVsZWFzZSBwbGFuCiAgICAgICAgaWQ6IHJlbGVhc2UtcGxhbgogICAgICAgIGVudjoKICAgICAgICAgIEdJVEhVQl9UT0tFTjogJHt7IHN0ZXBzLmFwcC10b2tlbi5vdXRwdXRzLnRva2VuIHx8IHNlY3JldHMuUkVQT0NUTF9SRUxFQVNFX1RPS0VOIHx8IHNlY3JldHMuQ0hBTkdFU0VUU19SRUxFQVNFX1RPS0VOIHx8IGdpdGh1Yi50b2tlbiB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX01PREU6ICR7eyBpbnB1dHMubW9kZSB8fCAnYXV0bycgfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9QQUNLQUdFOiAke3sgaW5wdXRzLnBhY2thZ2UgfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9WRVJTSU9OOiAke3sgaW5wdXRzLnZlcnNpb24gfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9EUllfUlVOOiAke3sgaW5wdXRzLmRyeS1ydW4gfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9SRUNPVkVSWV9TT1VSQ0VfU0hBOiAke3sgaW5wdXRzLnNvdXJjZS1zaGEgfX0KICAgICAgICBydW46IHBucG0gZXhlYyByZXBvIHJlbGVhc2UgY2kgLS1zdGFnZSBwbGFuCgogICAgICAtIG5hbWU6IFJlbGVhc2UgdmVyaWZ5CiAgICAgICAgaWQ6IHJlbGVhc2UtdmVyaWZ5CiAgICAgICAgaWY6ICR7eyBzdGVwcy5yZWxlYXNlLXBsYW4ub3V0cHV0cy5ydW4gPT0gJ3RydWUnIH19CiAgICAgICAgZW52OgogICAgICAgICAgR0lUSFVCX1RPS0VOOiAke3sgc3RlcHMuYXBwLXRva2VuLm91dHB1dHMudG9rZW4gfHwgc2VjcmV0cy5SRVBPQ1RMX1JFTEVBU0VfVE9LRU4gfHwgc2VjcmV0cy5DSEFOR0VTRVRTX1JFTEVBU0VfVE9LRU4gfHwgZ2l0aHViLnRva2VuIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfTU9ERTogJHt7IGlucHV0cy5tb2RlIHx8ICdhdXRvJyB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1BBQ0tBR0U6ICR7eyBpbnB1dHMucGFja2FnZSB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1ZFUlNJT046ICR7eyBpbnB1dHMudmVyc2lvbiB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX0RSWV9SVU46ICR7eyBpbnB1dHMuZHJ5LXJ1biB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1JFQ09WRVJZX1NPVVJDRV9TSEE6ICR7eyBpbnB1dHMuc291cmNlLXNoYSB9fQogICAgICAgIHJ1bjogcG5wbSBleGVjIHJlcG8gcmVsZWFzZSBjaSAtLXN0YWdlIHZlcmlmeQoKICAgICAgLSBuYW1lOiBSZWxlYXNlIHByZXBhcmUKICAgICAgICBpZDogcmVsZWFzZS1wcmVwYXJlCiAgICAgICAgaWY6ICR7eyBzdGVwcy5yZWxlYXNlLXBsYW4ub3V0cHV0cy5ydW4gPT0gJ3RydWUnIH19CiAgICAgICAgZW52OgogICAgICAgICAgR0lUSFVCX1RPS0VOOiAke3sgc3RlcHMuYXBwLXRva2VuLm91dHB1dHMudG9rZW4gfHwgc2VjcmV0cy5SRVBPQ1RMX1JFTEVBU0VfVE9LRU4gfHwgc2VjcmV0cy5DSEFOR0VTRVRTX1JFTEVBU0VfVE9LRU4gfHwgZ2l0aHViLnRva2VuIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfTU9ERTogJHt7IGlucHV0cy5tb2RlIHx8ICdhdXRvJyB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1BBQ0tBR0U6ICR7eyBpbnB1dHMucGFja2FnZSB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1ZFUlNJT046ICR7eyBpbnB1dHMudmVyc2lvbiB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX0RSWV9SVU46ICR7eyBpbnB1dHMuZHJ5LXJ1biB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1JFQ09WRVJZX1NPVVJDRV9TSEE6ICR7eyBpbnB1dHMuc291cmNlLXNoYSB9fQogICAgICAgIHJ1bjogcG5wbSBleGVjIHJlcG8gcmVsZWFzZSBjaSAtLXN0YWdlIHByZXBhcmUKCiAgICAgIC0gbmFtZTogUmVsZWFzZSB1cGxvYWQKICAgICAgICBpZDogcmVsZWFzZS11cGxvYWQKICAgICAgICBpZjogJHt7IHN0ZXBzLnJlbGVhc2UtcHJlcGFyZS5vdXRwdXRzLnB1Ymxpc2ggPT0gJ3RydWUnIH19CiAgICAgICAgZW52OgogICAgICAgICAgR0lUSFVCX1RPS0VOOiAke3sgc3RlcHMuYXBwLXRva2VuLm91dHB1dHMudG9rZW4gfHwgc2VjcmV0cy5SRVBPQ1RMX1JFTEVBU0VfVE9LRU4gfHwgc2VjcmV0cy5DSEFOR0VTRVRTX1JFTEVBU0VfVE9LRU4gfHwgZ2l0aHViLnRva2VuIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfTU9ERTogJHt7IGlucHV0cy5tb2RlIHx8ICdhdXRvJyB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1BBQ0tBR0U6ICR7eyBpbnB1dHMucGFja2FnZSB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1ZFUlNJT046ICR7eyBpbnB1dHMudmVyc2lvbiB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX0RSWV9SVU46ICR7eyBpbnB1dHMuZHJ5LXJ1biB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1JFQ09WRVJZX1NPVVJDRV9TSEE6ICR7eyBpbnB1dHMuc291cmNlLXNoYSB9fQogICAgICAgIHJ1bjogcG5wbSBleGVjIHJlcG8gcmVsZWFzZSBjaSAtLXN0YWdlIHVwbG9hZAoKICAgICAgLSBuYW1lOiBSZWxlYXNlIGNvbmZpcm0KICAgICAgICBpZDogcmVsZWFzZS1jb25maXJtCiAgICAgICAgaWY6ICR7eyBzdGVwcy5yZWxlYXNlLXByZXBhcmUub3V0cHV0cy5wdWJsaXNoID09ICd0cnVlJyB9fQogICAgICAgIGVudjoKICAgICAgICAgIEdJVEhVQl9UT0tFTjogJHt7IHN0ZXBzLmFwcC10b2tlbi5vdXRwdXRzLnRva2VuIHx8IHNlY3JldHMuUkVQT0NUTF9SRUxFQVNFX1RPS0VOIHx8IHNlY3JldHMuQ0hBTkdFU0VUU19SRUxFQVNFX1RPS0VOIHx8IGdpdGh1Yi50b2tlbiB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX01PREU6ICR7eyBpbnB1dHMubW9kZSB8fCAnYXV0bycgfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9QQUNLQUdFOiAke3sgaW5wdXRzLnBhY2thZ2UgfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9WRVJTSU9OOiAke3sgaW5wdXRzLnZlcnNpb24gfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9EUllfUlVOOiAke3sgaW5wdXRzLmRyeS1ydW4gfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9SRUNPVkVSWV9TT1VSQ0VfU0hBOiAke3sgaW5wdXRzLnNvdXJjZS1zaGEgfX0KICAgICAgICBydW46IHBucG0gZXhlYyByZXBvIHJlbGVhc2UgY2kgLS1zdGFnZSBjb25maXJtCgogICAgICAtIG5hbWU6IFJlbGVhc2UgZmluYWxpemUKICAgICAgICBpZDogcmVsZWFzZS1maW5hbGl6ZQogICAgICAgIGlmOiAke3sgc3RlcHMucmVsZWFzZS1wcmVwYXJlLm91dHB1dHMucHVibGlzaCA9PSAndHJ1ZScgfX0KICAgICAgICBlbnY6CiAgICAgICAgICBHSVRIVUJfVE9LRU46ICR7eyBzdGVwcy5hcHAtdG9rZW4ub3V0cHV0cy50b2tlbiB8fCBzZWNyZXRzLlJFUE9DVExfUkVMRUFTRV9UT0tFTiB8fCBzZWNyZXRzLkNIQU5HRVNFVFNfUkVMRUFTRV9UT0tFTiB8fCBnaXRodWIudG9rZW4gfX0KICAgICAgICAgIFJFUE9fUkVMRUFTRV9NT0RFOiAke3sgaW5wdXRzLm1vZGUgfHwgJ2F1dG8nIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfUEFDS0FHRTogJHt7IGlucHV0cy5wYWNrYWdlIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfVkVSU0lPTjogJHt7IGlucHV0cy52ZXJzaW9uIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfRFJZX1JVTjogJHt7IGlucHV0cy5kcnktcnVuIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfUkVDT1ZFUllfU09VUkNFX1NIQTogJHt7IGlucHV0cy5zb3VyY2Utc2hhIH19CiAgICAgICAgcnVuOiBwbnBtIGV4ZWMgcmVwbyByZWxlYXNlIGNpIC0tc3RhZ2UgZmluYWxpemUKCiAgICAgIC0gbmFtZTogUHJlc2VydmUgbnBtIHB1Ymxpc2ggcHJvZ3Jlc3MKICAgICAgICBpZjogJHt7IGFsd2F5cygpIH19CiAgICAgICAgdXNlczogYWN0aW9ucy91cGxvYWQtYXJ0aWZhY3RAY2Y0MzBlMDMwZGRiYjViMGFiZjkzZDIyOTYyZjQ3NTJmMzY0NmNkOSAjIHY3LjAuMgogICAgICAgIHdpdGg6CiAgICAgICAgICBuYW1lOiBucG0tcHVibGlzaC1wcm9ncmVzcy0ke3sgZ2l0aHViLnJ1bl9pZCB9fS0ke3sgZ2l0aHViLnJ1bl9hdHRlbXB0IH19CiAgICAgICAgICBwYXRoOiB8CiAgICAgICAgICAgIHBucG0tcHVibGlzaC1zdW1tYXJ5Lmpzb24KICAgICAgICAgICAgcmVwb2N0bC1wdWJsaXNoLXByb2dyZXNzLmpzb24KICAgICAgICAgICAgcmVwb2N0bC1yZWxlYXNlLXByb2dyZXNzLmpzb24KICAgICAgICAgICAgcmVwb2N0bC1jaS1wcm9ncmVzcy5qc29uCiAgICAgICAgICBpZi1uby1maWxlcy1mb3VuZDogaWdub3JlCiAgICAgICAgICByZXRlbnRpb24tZGF5czogMTQKCiAgZG9jczoKICAgIG5lZWRzOiByZWxlYXNlCiAgICBpZjogJHt7ICFjYW5jZWxsZWQoKSAmJiBnaXRodWIucmVmID09ICdyZWZzL2hlYWRzL21haW4nICYmIG5lZWRzLnJlbGVhc2Uub3V0cHV0cy5yZWxlYXNlLXJlY29yZCAhPSAnJyAmJiBuZWVkcy5yZWxlYXNlLm91dHB1dHMuZG9jcy1zaXRlcyAhPSAnJyAmJiBuZWVkcy5yZWxlYXNlLm91dHB1dHMuZG9jcy1zaXRlcyAhPSAnW10nIH19CiAgICBzdHJhdGVneToKICAgICAgZmFpbC1mYXN0OiBmYWxzZQogICAgICBtYXRyaXg6CiAgICAgICAgc2l0ZTogJHt7IGZyb21KU09OKG5lZWRzLnJlbGVhc2Uub3V0cHV0cy5kb2NzLXNpdGVzKSB9fQogICAgdXNlczogLi8uZ2l0aHViL3dvcmtmbG93cy9yZXBvY3RsLWRvY3MtZGVwbG95LnltbAogICAgd2l0aDoKICAgICAgc2l0ZTogJHt7IG1hdHJpeC5zaXRlIH19CiAgICAgIGNoYW5uZWw6IHN0YWJsZQogICAgICByZWxlYXNlOiAke3sgbmVlZHMucmVsZWFzZS5vdXRwdXRzLnJlbGVhc2UtcmVjb3JkIH19CiAgICBzZWNyZXRzOiBpbmhlcml0CgogIG5pZ2h0bHk6CiAgICBuYW1lOiBQdWJsaXNoIG5pZ2h0bHkKICAgIGlmOiAke3sgKGdpdGh1Yi5ldmVudF9uYW1lID09ICdzY2hlZHVsZScgJiYgZ2l0aHViLmV2ZW50LnNjaGVkdWxlID09ICcwIDE4ICogKiAqJykgfHwgKGdpdGh1Yi5ldmVudF9uYW1lID09ICd3b3JrZmxvd19kaXNwYXRjaCcgJiYgaW5wdXRzLm1vZGUgPT0gJ25pZ2h0bHknKSB9fQogICAgcnVucy1vbjogdWJ1bnR1LWxhdGVzdAogICAgdGltZW91dC1taW51dGVzOiA5MAogICAgZW52OgogICAgICBSRVBPQ1RMX05JR0hUTFlfUFJPVklERVI6IG5wbQogICAgICBSRVBPQ1RMX05JR0hUTFlfU0NIRURVTEU6ICcwIDE4ICogKiAqJwogICAgcGVybWlzc2lvbnM6CiAgICAgIGNvbnRlbnRzOiByZWFkCiAgICAgIGlkLXRva2VuOiB3cml0ZQogICAgc3RlcHM6CiAgICAgIC0gbmFtZTogVmFsaWRhdGUgbmlnaHRseSBzb3VyY2UKICAgICAgICBlbnY6CiAgICAgICAgICBERUZBVUxUX0JSQU5DSDogJHt7IGdpdGh1Yi5ldmVudC5yZXBvc2l0b3J5LmRlZmF1bHRfYnJhbmNoIH19CiAgICAgICAgcnVuOiB8CiAgICAgICAgICBpZiBbIC16ICIkREVGQVVMVF9CUkFOQ0giIF0gfHwgWyAiJEdJVEhVQl9SRUYiICE9ICJyZWZzL2hlYWRzLyRERUZBVUxUX0JSQU5DSCIgXTsgdGhlbgogICAgICAgICAgICBlY2hvICc6OmVycm9yOjpOaWdodGx5IHB1YmxpY2F0aW9uIHJlcXVpcmVzIHRoZSByZXBvc2l0b3J5IGRlZmF1bHQgYnJhbmNoLicKICAgICAgICAgICAgZXhpdCAxCiAgICAgICAgICBmaQoKICAgICAgLSBuYW1lOiBDaGVja291dCBuaWdodGx5IHNvdXJjZQogICAgICAgIGlkOiBuaWdodGx5LWNoZWNrb3V0CiAgICAgICAgdXNlczogYWN0aW9ucy9jaGVja291dEAzZDNjNDJlNWFhYzViYTgwNTgyNWRhNzY0MTBjMTgxMjczYmE5MGIxICMgdjcuMC4xCiAgICAgICAgd2l0aDoKICAgICAgICAgIHJlZjogJHt7IGdpdGh1Yi5zaGEgfX0KICAgICAgICAgIGZldGNoLWRlcHRoOiAwCiAgICAgICAgICBwZXJzaXN0LWNyZWRlbnRpYWxzOiBmYWxzZQoKICAgICAgLSB1c2VzOiBwbnBtL2FjdGlvbi1zZXR1cEBlYTE3YzY4ZGY4OTEyZWY1NDMzNTI3MjNjMTQ5YTg0ZjU2ZTNkNDEzICMgdjYuMS4wCgogICAgICAtIG5hbWU6IFNldHVwIE5vZGUuanMgZW52aXJvbm1lbnQKICAgICAgICB1c2VzOiBhY3Rpb25zL3NldHVwLW5vZGVAOTQ5ZmViMjQxM2Q2NDU4Nzk0ZGNkMjQ5MWM0YmFiYmJjZTBjMTVjMSAjIHY3LjEuMAogICAgICAgIHdpdGg6CiAgICAgICAgICBub2RlLXZlcnNpb246IDI0LjIyLjEKICAgICAgICAgIGNhY2hlOiBwbnBtCgogICAgICAtIG5hbWU6IEluc3RhbGwgbnBtIHdpdGggdHJ1c3RlZCBwdWJsaXNoaW5nIHN1cHBvcnQKICAgICAgICBpZDogbmlnaHRseS1ucG0KICAgICAgICBydW46IG5wbSBpbnN0YWxsIC0tZ2xvYmFsIG5wbUAxMS4xNi4wIC0tcmVnaXN0cnk9aHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcKCiAgICAgIC0gbmFtZTogSW5zdGFsbCBEZXBlbmRlbmNpZXMgd2l0aG91dCBsaWZlY3ljbGUgc2NyaXB0cwogICAgICAgIHJ1bjogcG5wbSBpbnN0YWxsIC0tZnJvemVuLWxvY2tmaWxlIC0taWdub3JlLXNjcmlwdHMKCiAgICAgIC0gbmFtZTogUHVibGlzaCBuaWdodGx5IHBhY2thZ2VzCiAgICAgICAgaWQ6IG5pZ2h0bHktcHVibGlzaAogICAgICAgIGVudjoKICAgICAgICAgIFJFUE9DVExfU05BUFNIT1RfUFVCTElTSDogJzEnCiAgICAgICAgICBSRVBPX1JFTEVBU0VfUEFDS0FHRTogJHt7IGlucHV0cy5wYWNrYWdlIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfVkVSU0lPTjogJHt7IGlucHV0cy52ZXJzaW9uIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfRFJZX1JVTjogJHt7IGlucHV0cy5kcnktcnVuIH19CiAgICAgICAgICBSRVBPX1JFTEVBU0VfUkVDT1ZFUllfU09VUkNFX1NIQTogJHt7IGlucHV0cy5zb3VyY2Utc2hhIH19CiAgICAgICAgcnVuOiB8CiAgICAgICAgICBhcmdzPSgtLXB1Ymxpc2ggLS1vdXRwdXQgIiRSVU5ORVJfVEVNUC9yZXBvY3RsLW5pZ2h0bHkiIC0tanNvbikKICAgICAgICAgIGlmIFsgIiRSRVBPX1JFTEVBU0VfRFJZX1JVTiIgPSAndHJ1ZScgXTsgdGhlbgogICAgICAgICAgICBhcmdzKz0oLS1kcnktcnVuKQogICAgICAgICAgZmkKICAgICAgICAgIHBucG0gZXhlYyByZXBvIHJlbGVhc2UgbmlnaHRseSAiJHthcmdzW0BdfSIKCiAgICAgIC0gbmFtZTogUHJlc2VydmUgbmlnaHRseSBkaWFnbm9zdGljcwogICAgICAgIGlmOiAke3sgYWx3YXlzKCkgfX0KICAgICAgICB1c2VzOiBhY3Rpb25zL3VwbG9hZC1hcnRpZmFjdEBjZjQzMGUwMzBkZGJiNWIwYWJmOTNkMjI5NjJmNDc1MmYzNjQ2Y2Q5ICMgdjcuMC4yCiAgICAgICAgd2l0aDoKICAgICAgICAgIG5hbWU6IG5pZ2h0bHktJHt7IGdpdGh1Yi5ydW5faWQgfX0tJHt7IGdpdGh1Yi5ydW5fYXR0ZW1wdCB9fQogICAgICAgICAgcGF0aDogfAogICAgICAgICAgICAke3sgcnVubmVyLnRlbXAgfX0vcmVwb2N0bC1uaWdodGx5LyouanNvbgogICAgICAgICAgICAke3sgcnVubmVyLnRlbXAgfX0vcmVwb2N0bC1uaWdodGx5LyoqL25pZ2h0bHktcmVwb3J0Lmpzb24KICAgICAgICAgICAgJHt7IHJ1bm5lci50ZW1wIH19L3JlcG9jdGwtbmlnaHRseS8qKi9jb25zdW1lci1yZXBvcnQuanNvbgogICAgICAgICAgICAke3sgcnVubmVyLnRlbXAgfX0vcmVwb2N0bC1uaWdodGx5LyoqL3NuYXBzaG90LXJlcG9ydC5qc29uCiAgICAgICAgICAgICR7eyBydW5uZXIudGVtcCB9fS9yZXBvY3RsLW5pZ2h0bHkvKiovdGFyYmFsbHMvKiovKi50Z3oKICAgICAgICAgIGlmLW5vLWZpbGVzLWZvdW5kOiBpZ25vcmUKICAgICAgICAgIHJldGVudGlvbi1kYXlzOiAxNAoKICBvaWRjLWF1ZGl0OgogICAgbmFtZTogQXVkaXQgbnBtIE9JREMKICAgIGlmOiAke3sgZ2l0aHViLmV2ZW50X25hbWUgPT0gJ3dvcmtmbG93X2Rpc3BhdGNoJyAmJiBpbnB1dHMubW9kZSA9PSAnb2lkYy1hdWRpdCcgfX0KICAgIHJ1bnMtb246IHVidW50dS1sYXRlc3QKICAgIHBlcm1pc3Npb25zOgogICAgICBjb250ZW50czogcmVhZAogICAgICBpZC10b2tlbjogd3JpdGUKICAgIHN0ZXBzOgogICAgICAtIG5hbWU6IENoZWNrb3V0IFJlcG8KICAgICAgICB1c2VzOiBhY3Rpb25zL2NoZWNrb3V0QDNkM2M0MmU1YWFjNWJhODA1ODI1ZGE3NjQxMGMxODEyNzNiYTkwYjEgIyB2Ny4wLjEKICAgICAgICB3aXRoOgogICAgICAgICAgcGVyc2lzdC1jcmVkZW50aWFsczogZmFsc2UKCiAgICAgIC0gdXNlczogcG5wbS9hY3Rpb24tc2V0dXBAZWExN2M2OGRmODkxMmVmNTQzMzUyNzIzYzE0OWE4NGY1NmUzZDQxMyAjIHY2LjEuMAoKICAgICAgLSBuYW1lOiBTZXR1cCBOb2RlLmpzIGVudmlyb25tZW50CiAgICAgICAgdXNlczogYWN0aW9ucy9zZXR1cC1ub2RlQDk0OWZlYjI0MTNkNjQ1ODc5NGRjZDI0OTFjNGJhYmJiY2UwYzE1YzEgIyB2Ny4xLjAKICAgICAgICB3aXRoOgogICAgICAgICAgbm9kZS12ZXJzaW9uOiAyNC4yMi4xCiAgICAgICAgICBjYWNoZTogcG5wbQoKICAgICAgLSBuYW1lOiBJbnN0YWxsIERlcGVuZGVuY2llcyB3aXRob3V0IGxpZmVjeWNsZSBzY3JpcHRzCiAgICAgICAgcnVuOiBwbnBtIGluc3RhbGwgLS1mcm96ZW4tbG9ja2ZpbGUgLS1pZ25vcmUtc2NyaXB0cwoKICAgICAgLSBuYW1lOiBBdWRpdCBldmVyeSBwdWJsaXNoYWJsZSBwYWNrYWdlCiAgICAgICAgZW52OgogICAgICAgICAgUkVQT19SRUxFQVNFX1BBQ0tBR0U6ICR7eyBpbnB1dHMucGFja2FnZSB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1ZFUlNJT046ICR7eyBpbnB1dHMudmVyc2lvbiB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX0RSWV9SVU46ICR7eyBpbnB1dHMuZHJ5LXJ1biB9fQogICAgICAgICAgUkVQT19SRUxFQVNFX1JFQ09WRVJZX1NPVVJDRV9TSEE6ICR7eyBpbnB1dHMuc291cmNlLXNoYSB9fQogICAgICAgIHJ1bjogcG5wbSBleGVjIHJlcG8gcmVsZWFzZSBjaSAtLW1vZGUgb2lkYy1hdWRpdAo="
+  }
+}
diff --git a/.repoctl/baselines/root/ad6a01e589b8b1b214ca310dbb8d2e4314f6c612b921050c73c97455de43884d.json b/.repoctl/baselines/root/ad6a01e589b8b1b214ca310dbb8d2e4314f6c612b921050c73c97455de43884d.json
new file mode 100644
index 00000000..ab58a9a9
--- /dev/null
+++ b/.repoctl/baselines/root/ad6a01e589b8b1b214ca310dbb8d2e4314f6c612b921050c73c97455de43884d.json
@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "path": "lefthook.yml",
+  "source": {
+    "package": "@icebreakers/monorepo-templates",
+    "version": "3.0.1",
+    "assetPath": "lefthook.yml",
+    "hash": "99918e855a9eea4e01284944d6a75ff87ef66e99715cdaa98f0598b61443e638"
+  },
+  "upstream": {
+    "hash": "99918e855a9eea4e01284944d6a75ff87ef66e99715cdaa98f0598b61443e638",
+    "content": "IyByZXBvY3RsLW1hbmFnZWQ6IGhvb2tzL3YxCmdsb2JfbWF0Y2hlcjogZG91Ymxlc3RhcgoKcHJlLWNvbW1pdDoKICBwaXBlZDogdHJ1ZQogIGpvYnM6CiAgICAtIG5hbWU6IGVzbGludAogICAgICBnbG9iOiAnKiovKi57anMsanN4LG1qcyx0cyx0c3gsbXRzLGN0cyx2dWUsYXN0cm8sanNvbixtZCxtZHgsaHRtbCx5bWwseWFtbH0nCiAgICAgICMgQXZvaWQgTGVmdGhvb2sgMi4yLjIncyBXaW5kb3dzIHNoZWxsIHF1b3RpbmcgZm9yIGFwb3N0cm9waGVzIGluIHBhdGhzLgogICAgICAjIEtlZXAgdGhlc2UgR2l0IHBhdGhzcGVjcyBhbGlnbmVkIHdpdGggZ2xvYiBhYm92ZS4KICAgICAgcnVuOiA+LQogICAgICAgIGdpdCBkaWZmIC0tY2FjaGVkIC0tbmFtZS1vbmx5IC0tZGlmZi1maWx0ZXI9QUNNUiAteiAtLQogICAgICAgICcqLmpzJyAnKi5qc3gnICcqLm1qcycgJyoudHMnICcqLnRzeCcgJyoubXRzJyAnKi5jdHMnICcqLnZ1ZScgJyouYXN0cm8nCiAgICAgICAgJyouanNvbicgJyoubWQnICcqLm1keCcgJyouaHRtbCcgJyoueW1sJyAnKi55YW1sJwogICAgICAgIHwgeGFyZ3MgLTAgLXIgcG5wbSBleGVjIGVzbGludCAtLWZpeCAtLQogICAgICBzdGFnZV9maXhlZDogdHJ1ZQogICAgLSBuYW1lOiBzdHlsZWxpbnQKICAgICAgZ2xvYjogJyoqLyoue3Z1ZSxjc3Msc2NzcyxzYXNzLGxlc3N9JwogICAgICBydW46ID4tCiAgICAgICAgZ2l0IGRpZmYgLS1jYWNoZWQgLS1uYW1lLW9ubHkgLS1kaWZmLWZpbHRlcj1BQ01SIC16IC0tCiAgICAgICAgJyoudnVlJyAnKi5jc3MnICcqLnNjc3MnICcqLnNhc3MnICcqLmxlc3MnCiAgICAgICAgfCB4YXJncyAtMCAtciBwbnBtIGV4ZWMgc3R5bGVsaW50IC0tZml4IC0tYWxsb3ctZW1wdHktaW5wdXQgLS0KICAgICAgc3RhZ2VfZml4ZWQ6IHRydWUKICAgIC0gbmFtZTogdHlwZWNoZWNrCiAgICAgIHJ1bjogcG5wbSBleGVjIHJlcG8gdmVyaWZ5IHN0YWdlZC10eXBlY2hlY2sKCmNvbW1pdC1tc2c6CiAgam9iczoKICAgIC0gbmFtZTogY29tbWl0bGludAogICAgICBydW46IHBucG0gZXhlYyByZXBvIHZlcmlmeSBjb21taXQtbXNnICJ7MX0iCgpwcmUtcHVzaDoKICBwaXBlZDogdHJ1ZQogIGpvYnM6CiAgICAtIG5hbWU6IGxpbnQKICAgICAgcnVuOiBwbnBtIGxpbnQKICAgIC0gbmFtZTogdHlwZWNoZWNrCiAgICAgIHJ1bjogcG5wbSB0eXBlY2hlY2sK"
+  }
+}
diff --git a/.repoctl/baselines/root/d4ed323cdf9bc51e993369581f3bc29a355bec3f90416ab0057bb82604468391.json b/.repoctl/baselines/root/d4ed323cdf9bc51e993369581f3bc29a355bec3f90416ab0057bb82604468391.json
new file mode 100644
index 00000000..dc06835e
--- /dev/null
+++ b/.repoctl/baselines/root/d4ed323cdf9bc51e993369581f3bc29a355bec3f90416ab0057bb82604468391.json
@@ -0,0 +1,14 @@
+{
+  "schemaVersion": 1,
+  "path": ".github/workflows/repoctl-docs-deploy.yml",
+  "source": {
+    "package": "@icebreakers/monorepo-templates",
+    "version": "3.0.1",
+    "assetPath": ".github/workflows/repoctl-docs-deploy.yml",
+    "hash": "4c108756f1af591febb679f9de070b81273a80a89751821cc853e33c7f62fafe"
+  },
+  "upstream": {
+    "hash": "4c108756f1af591febb679f9de070b81273a80a89751821cc853e33c7f62fafe",
+    "content": "IyByZXBvY3RsLW1hbmFnZWQ6IGRvY3MtZGVwbG95L3YxCm5hbWU6IERlcGxveSBkb2N1bWVudGF0aW9uCgpvbjoKICB3b3JrZmxvd19jYWxsOgogICAgaW5wdXRzOgogICAgICBzaXRlOgogICAgICAgIHJlcXVpcmVkOiB0cnVlCiAgICAgICAgdHlwZTogc3RyaW5nCiAgICAgIGNoYW5uZWw6CiAgICAgICAgcmVxdWlyZWQ6IHRydWUKICAgICAgICB0eXBlOiBzdHJpbmcKICAgICAgc291cmNlLXNoYToKICAgICAgICByZXF1aXJlZDogZmFsc2UKICAgICAgICBkZWZhdWx0OiAnJwogICAgICAgIHR5cGU6IHN0cmluZwogICAgICByZWxlYXNlOgogICAgICAgIHJlcXVpcmVkOiBmYWxzZQogICAgICAgIGRlZmF1bHQ6ICcnCiAgICAgICAgdHlwZTogc3RyaW5nCiAgICAgIGNvbW1pdHM6CiAgICAgICAgcmVxdWlyZWQ6IGZhbHNlCiAgICAgICAgZGVmYXVsdDogJycKICAgICAgICB0eXBlOiBzdHJpbmcKCnBlcm1pc3Npb25zOgogIGNvbnRlbnRzOiB3cml0ZQoKY29uY3VycmVuY3k6CiAgZ3JvdXA6IGRvY3MtJHt7IGlucHV0cy5zaXRlIH19LSR7eyBpbnB1dHMuY2hhbm5lbCB9fQogIGNhbmNlbC1pbi1wcm9ncmVzczogZmFsc2UKCmpvYnM6CiAgZGVwbG95OgogICAgaWY6ICR7eyBnaXRodWIucmVmID09ICdyZWZzL2hlYWRzL21haW4nICYmIGdpdGh1Yi5ldmVudC5yZXBvc2l0b3J5LmRlZmF1bHRfYnJhbmNoID09ICdtYWluJyB9fQogICAgcnVucy1vbjogdWJ1bnR1LWxhdGVzdAogICAgZW52aXJvbm1lbnQ6IGRvY3MtJHt7IGlucHV0cy5zaXRlIH19LSR7eyBpbnB1dHMuY2hhbm5lbCB9fQogICAgc3RlcHM6CiAgICAgIC0gdXNlczogYWN0aW9ucy9jaGVja291dEAzZDNjNDJlNWFhYzViYTgwNTgyNWRhNzY0MTBjMTgxMjczYmE5MGIxICMgdjcuMC4xCiAgICAgICAgd2l0aDoKICAgICAgICAgIGZldGNoLWRlcHRoOiAwCiAgICAgICAgICByZWY6IG1haW4KICAgICAgICAgIHBlcnNpc3QtY3JlZGVudGlhbHM6IGZhbHNlCgogICAgICAtIHVzZXM6IHBucG0vYWN0aW9uLXNldHVwQGVhMTdjNjhkZjg5MTJlZjU0MzM1MjcyM2MxNDlhODRmNTZlM2Q0MTMgIyB2Ni4xLjAKCiAgICAgIC0gdXNlczogYWN0aW9ucy9zZXR1cC1ub2RlQDk0OWZlYjI0MTNkNjQ1ODc5NGRjZDI0OTFjNGJhYmJiY2UwYzE1YzEgIyB2Ny4xLjAKICAgICAgICB3aXRoOgogICAgICAgICAgbm9kZS12ZXJzaW9uOiAyNC4yMi4xCiAgICAgICAgICBjYWNoZTogcG5wbQoKICAgICAgLSBydW46IHBucG0gaW5zdGFsbCAtLWZyb3plbi1sb2NrZmlsZQoKICAgICAgLSBuYW1lOiBQbGFuIGFuZCBkZXBsb3kgdGhlIHNlbGVjdGVkIGRvY3VtZW50YXRpb24gc291cmNlCiAgICAgICAgZW52OgogICAgICAgICAgR0lUSFVCX1RPS0VOOiAke3sgZ2l0aHViLnRva2VuIH19CiAgICAgICAgICBSRVBPX0RPQ1NfU0lURTogJHt7IGlucHV0cy5zaXRlIH19CiAgICAgICAgICBSRVBPX0RPQ1NfQ0hBTk5FTDogJHt7IGlucHV0cy5jaGFubmVsIH19CiAgICAgICAgICBSRVBPX0RPQ1NfU09VUkNFX1NIQTogJHt7IGlucHV0cy5zb3VyY2Utc2hhIH19CiAgICAgICAgICBSRVBPX0RPQ1NfUkVMRUFTRTogJHt7IGlucHV0cy5yZWxlYXNlIH19CiAgICAgICAgICBSRVBPX0RPQ1NfQ09NTUlUUzogJHt7IGlucHV0cy5jb21taXRzIH19CiAgICAgICAgICBSRVBPX0RPQ1NfQ09OQ1VSUkVOQ1lfR1JPVVA6IGRvY3MtJHt7IGlucHV0cy5zaXRlIH19LSR7eyBpbnB1dHMuY2hhbm5lbCB9fQogICAgICAgICAgQ0xPVURGTEFSRV9BUElfVE9LRU46ICR7eyBzZWNyZXRzLkNMT1VERkxBUkVfQVBJX1RPS0VOIH19CiAgICAgICAgICBDTE9VREZMQVJFX0FDQ09VTlRfSUQ6ICR7eyBzZWNyZXRzLkNMT1VERkxBUkVfQUNDT1VOVF9JRCB8fCB2YXJzLkNMT1VERkxBUkVfQUNDT1VOVF9JRCB9fQogICAgICAgIHJ1bjogfAogICAgICAgICAgYXJncz0oIiRSRVBPX0RPQ1NfU0lURSIgLS1jaGFubmVsICIkUkVQT19ET0NTX0NIQU5ORUwiKQogICAgICAgICAgaWYgWyAtbiAiJFJFUE9fRE9DU19TT1VSQ0VfU0hBIiBdOyB0aGVuIGFyZ3MrPSgtLXNvdXJjZS1zaGEgIiRSRVBPX0RPQ1NfU09VUkNFX1NIQSIpOyBmaQogICAgICAgICAgaWYgWyAtbiAiJFJFUE9fRE9DU19SRUxFQVNFIiBdOyB0aGVuIGFyZ3MrPSgtLXJlbGVhc2UgIiRSRVBPX0RPQ1NfUkVMRUFTRSIpOyBmaQogICAgICAgICAgaWYgWyAtbiAiJFJFUE9fRE9DU19DT01NSVRTIiBdOyB0aGVuCiAgICAgICAgICAgIHJlYWQgLXIgLWEgY29tbWl0cyA8PDwgIiRSRVBPX0RPQ1NfQ09NTUlUUyIKICAgICAgICAgICAgYXJncys9KC0tY29tbWl0cyAiJHtjb21taXRzW0BdfSIpCiAgICAgICAgICBmaQogICAgICAgICAgcG5wbSBleGVjIHJlcG8gZG9jcyBwbGFuICIke2FyZ3NbQF19IiAtLWpzb24KICAgICAgICAgIHBucG0gZXhlYyByZXBvIGRvY3MgZGVwbG95ICIke2FyZ3NbQF19IiAtLWpzb24K"
+  }
+}
diff --git a/apps/open-source/playwright.config.ts b/apps/open-source/playwright.config.ts
index 731dbf60..88e78331 100644
--- a/apps/open-source/playwright.config.ts
+++ b/apps/open-source/playwright.config.ts
@@ -6,6 +6,8 @@ const browserChannel = process.env.PLAYWRIGHT_CHANNEL
 export default defineConfig({
   testDir: './tests/e2e',
   fullyParallel: true,
+  // Particle and canvas assertions need a bounded rendering workload on CI.
+  workers: 2,
   webServer: {
     // Serve the exact deployment artifact, including the Pages relative paths.
     command: 'node scripts/serve-test-site.mjs',
@@ -13,6 +15,7 @@ export default defineConfig({
     reuseExistingServer: false,
   },
   use: {
+    headless: true,
     baseURL: 'http://127.0.0.1:45322',
     locale: 'zh-CN',
     ...(browserChannel ? { channel: browserChannel } : {}),
diff --git a/apps/open-source/scripts/prepare-pages-content.ts b/apps/open-source/scripts/prepare-pages-content.ts
index f3d55da9..a090ccaa 100644
--- a/apps/open-source/scripts/prepare-pages-content.ts
+++ b/apps/open-source/scripts/prepare-pages-content.ts
@@ -3,10 +3,12 @@ import { basename, join, resolve } from 'node:path'
 import process from 'node:process'
 import { projectsDirectory } from '@weapp-io/project-catalog/paths'
 import { projectDefinitionSchema } from '../src/content/schemas'
+import { getBuildChannel } from '../src/lib/build-channel'
 import { getSiteProfile } from '../src/lib/deployment'
 import { createSiteResources } from '../src/lib/site-resources'
 
 const site = getSiteProfile()
+const channel = getBuildChannel()
 const root = resolve(process.argv[2] || join(import.meta.dirname, '..', site.outputDir))
 const projectDirectory = projectsDirectory
 const projects = await Promise.all((await readdir(projectDirectory)).filter(file => file.endsWith('.json')).map(async file => ({
@@ -15,9 +17,16 @@ const projects = await Promise.all((await readdir(projectDirectory)).filter(file
 })))
 projects.sort((left, right) => left.data.order - right.data.order)
 
-for (const [name, content] of Object.entries(createSiteResources(site, projects))) {
+// A repeated stable preparation must remove preview-only response headers.
+await rm(join(root, '_headers'), { force: true })
+for (const [name, content] of Object.entries(createSiteResources(site, projects, channel))) {
   await writeFile(join(root, name), content, 'utf8')
 }
 
-await writeFile(join(root, 'CNAME'), `${new URL(site.origin).hostname}\n`, 'utf8')
+if (channel === 'stable') {
+  await writeFile(join(root, 'CNAME'), `${new URL(site.origin).hostname}\n`, 'utf8')
+}
+else {
+  await rm(join(root, 'CNAME'), { force: true })
+}
 await rm(join(root, '.nojekyll'), { force: true })
diff --git a/apps/open-source/scripts/validate-build.ts b/apps/open-source/scripts/validate-build.ts
index 5d869b07..7d380f8a 100644
--- a/apps/open-source/scripts/validate-build.ts
+++ b/apps/open-source/scripts/validate-build.ts
@@ -3,10 +3,13 @@ import { join, relative, resolve } from 'node:path'
 import process from 'node:process'
 import { projectsDirectory } from '@weapp-io/project-catalog/paths'
 import { parse } from 'node-html-parser'
+import { getBuildChannel } from '../src/lib/build-channel'
 import { getSiteProfile, isRetiredOpenSourcePath } from '../src/lib/deployment'
 
 const root = resolve(import.meta.dirname, '..')
 const site = getSiteProfile()
+const channel = getBuildChannel()
+const preview = channel === 'preview'
 const dist = resolve(root, site.outputDir)
 const projectIds = (await readdir(projectsDirectory)).filter(file => file.endsWith('.json')).map(file => file.slice(0, -5))
 const expectedFiles = [
@@ -24,7 +27,9 @@ const expectedFiles = [
   'og.png',
   'og.svg',
   'bimi/logo.svg',
-  ...(['CNAME', '404/index.html']),
+  ...(preview ? ['_headers'] : []),
+  '404/index.html',
+  ...(preview ? [] : ['CNAME']),
 ]
 const retiredDocsHosts = ['tw.icebreaker.top', 'vite.icebreaker.top']
 const errors: string[] = []
@@ -79,7 +84,7 @@ for (const file of expectedFiles) {
   }
 }
 
-for (const name of ['.nojekyll', '.well-known/bimi']) {
+for (const name of ['.nojekyll', '.well-known/bimi', ...(preview ? ['CNAME'] : ['_headers'])]) {
   try {
     await access(resolve(dist, name))
     errors.push(`Forbidden build output: ${name}`)
@@ -89,14 +94,23 @@ for (const name of ['.nojekyll', '.well-known/bimi']) {
   }
 }
 
-try {
-  const cname = (await readFile(resolve(dist, 'CNAME'), 'utf8')).trim()
-  if (cname !== new URL(site.origin).hostname) {
-    errors.push(`CNAME: expected ${new URL(site.origin).hostname}, received ${cname || '(empty)'}`)
+if (!preview) {
+  try {
+    const cname = (await readFile(resolve(dist, 'CNAME'), 'utf8')).trim()
+    if (cname !== new URL(site.origin).hostname) {
+      errors.push(`CNAME: expected ${new URL(site.origin).hostname}, received ${cname || '(empty)'}`)
+    }
+  }
+  catch {
+    errors.push('CNAME: unable to read Pages hostname')
   }
 }
-catch {
-  errors.push('CNAME: unable to read Pages hostname')
+
+if (preview) {
+  const headers = await readFile(resolve(dist, '_headers'), 'utf8').catch(() => '')
+  if (!/^\/\*\n\s+X-Robots-Tag: noindex, nofollow\n$/i.test(headers)) {
+    errors.push('_headers: preview responses must disallow indexing for every path')
+  }
 }
 
 const cssFiles = (await readdir(dist, { recursive: true })).filter(file => file.endsWith('.css'))
@@ -131,6 +145,21 @@ for (const file of htmlFiles) {
   const robots = document.querySelector('meta[name="robots"]')?.getAttribute('content')
   const schemas = document.querySelectorAll('script[type="application/ld+json"]')
 
+  if (document.querySelector('html')?.getAttribute('data-site-channel') !== channel) {
+    errors.push(`${label}: build channel must be ${channel}`)
+  }
+  const notice = document.querySelector('[data-preview-notice]')
+  const expectsNotice = preview && !retiredRedirect
+  if (expectsNotice) {
+    const message = pagePath.startsWith('/en/') ? 'Preview version. Content may change.' : '预览版本，内容可能更新。'
+    if (!notice?.text.includes(message) || notice.querySelector('a')?.getAttribute('href') !== expectedCanonical) {
+      errors.push(`${label}: missing localized preview notice and production link`)
+    }
+  }
+  else if (notice) {
+    errors.push(`${label}: unexpected preview notice`)
+  }
+
   if (canonical !== expectedCanonical) {
     errors.push(`${label}: expected canonical ${expectedCanonical}, received ${canonical ?? '(missing)'}`)
   }
@@ -145,8 +174,11 @@ for (const file of htmlFiles) {
   if (descriptions.length !== 1 || !descriptions[0].getAttribute('content')?.trim()) {
     errors.push(`${label}: missing unique description`)
   }
-  if (!robots) {
-    errors.push(`${label}: missing robots directive`)
+  if (preview && robots !== 'noindex, follow') {
+    errors.push(`${label}: preview pages must be noindex`)
+  }
+  else if (!preview && !retiredRedirect && !['404.html', '404/index.html', 'en/404/index.html'].includes(label) && robots !== 'index, follow') {
+    errors.push(`${label}: stable content pages must remain indexable`)
   }
   if ((retiredRedirect || label === '404.html' || label === '404/index.html' || label === 'en/404/index.html') && !robots?.includes('noindex')) {
     errors.push(`${label}: compatibility redirects and 404 pages must be noindex`)
@@ -260,8 +292,13 @@ for (const file of [...sitemapFiles, 'robots.txt', 'llms.txt', 'llms-full.txt',
         }
       }
     }
-    if (file === 'robots.txt' && !contents.includes(`Sitemap: ${site.origin}/sitemap-index.xml`)) {
-      errors.push(`${file}: sitemap must use this site's origin`)
+    if (file === 'robots.txt') {
+      const expectedRobots = preview
+        ? 'User-agent: *\nDisallow: /\n'
+        : `User-agent: *\nAllow: /\n\nSitemap: ${site.origin}/sitemap-index.xml\n`
+      if (contents !== expectedRobots) {
+        errors.push(`${file}: incorrect crawler policy for ${channel}`)
+      }
     }
     if (file === 'releases.xml' && !contents.includes(`<link>${site.origin}/</link>`)) {
       errors.push(`${file}: release channel must use this site's origin`)
diff --git a/apps/open-source/src/components/PreviewNotice.astro b/apps/open-source/src/components/PreviewNotice.astro
new file mode 100644
index 00000000..d318d996
--- /dev/null
+++ b/apps/open-source/src/components/PreviewNotice.astro
@@ -0,0 +1,71 @@
+---
+import type { Locale } from '../types/project'
+
+interface Props {
+  locale: Locale
+  productionUrl: string
+}
+
+const { locale, productionUrl } = Astro.props
+const label = locale === 'zh-CN' ? '预览版本，内容可能更新。' : 'Preview version. Content may change.'
+const linkLabel = locale === 'zh-CN' ? '访问正式网站' : 'Visit the live website'
+---
+
+<aside data-preview-notice aria-label={locale === 'zh-CN' ? '网站预览提示' : 'Website preview notice'} class="preview-notice">
+  <div>
+    <p>{label}</p>
+    <a href={productionUrl}>{linkLabel}</a>
+  </div>
+</aside>
+
+<script is:inline>
+  (() => {
+    const notice = document.currentScript?.previousElementSibling
+    if (!(notice instanceof HTMLElement)) return
+    const updateHeight = () => {
+      document.documentElement.style.setProperty('--site-notice-height', `${notice.getBoundingClientRect().height}px`)
+    }
+    // Run before the hero is parsed; track wrapping, font and viewport changes.
+    updateHeight()
+    new ResizeObserver(updateHeight).observe(notice, { box: 'border-box' })
+  })()
+</script>
+
+<style>
+  .preview-notice {
+    color: var(--text);
+    background: var(--surface-soft);
+    border-bottom: 1px solid var(--border);
+    font-size: 0.875rem;
+    line-height: 1.5;
+  }
+  .preview-notice > div {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0 1rem;
+    align-items: center;
+    justify-content: center;
+    width: min(1240px, calc(100% - 2rem));
+    margin-inline: auto;
+    padding-block: 0.25rem;
+  }
+  .preview-notice p {
+    margin: 0;
+  }
+  .preview-notice a {
+    display: inline-flex;
+    min-height: 44px;
+    align-items: center;
+    color: var(--text);
+    font-weight: 600;
+    text-decoration: underline;
+    text-underline-offset: 0.2em;
+  }
+  .preview-notice a:hover {
+    color: var(--accent);
+  }
+  .preview-notice a:focus-visible {
+    outline: 2px solid var(--accent);
+    outline-offset: 4px;
+  }
+</style>
diff --git a/apps/open-source/src/components/ProjectRedirect.astro b/apps/open-source/src/components/ProjectRedirect.astro
index 4ea0d58c..3ee751f3 100644
--- a/apps/open-source/src/components/ProjectRedirect.astro
+++ b/apps/open-source/src/components/ProjectRedirect.astro
@@ -2,6 +2,7 @@
 import type { Locale } from '../types/project'
 import { localizePath } from '../i18n/ui'
 import { getSiteProfile } from '../lib/deployment'
+import { getBuildChannel } from '../lib/build-channel'
 import { relativeSiteUrl } from '../lib/github-pages-paths'
 
 interface Props { locale: Locale }
@@ -12,7 +13,7 @@ const relativeDestination = relativeSiteUrl(Astro.url.pathname.replace(/^\/+|\/+
 const title = locale === 'zh-CN' ? '浏览开源项目' : 'Explore open-source projects'
 ---
 <!doctype html>
-<html lang={locale === 'zh-CN' ? 'zh-CN' : 'en-US'}>
+<html lang={locale === 'zh-CN' ? 'zh-CN' : 'en-US'} data-site-channel={getBuildChannel()}>
   <head>
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width" />
diff --git a/apps/open-source/src/layouts/BaseLayout.astro b/apps/open-source/src/layouts/BaseLayout.astro
index fe2d15b3..f76c899b 100644
--- a/apps/open-source/src/layouts/BaseLayout.astro
+++ b/apps/open-source/src/layouts/BaseLayout.astro
@@ -3,11 +3,13 @@ import '@fontsource-variable/geist/index.css'
 import '@fontsource-variable/geist-mono/index.css'
 import '../styles/global.css'
 import { getSiteProfile } from '../lib/deployment'
+import { getBuildChannel } from '../lib/build-channel'
 import type { Locale } from '../types/project'
 import { alternatePath } from '../i18n/ui'
 import { localeRedirectScript } from '../lib/locale-redirect'
 import { canonicalUrl, serializeJsonLd, webPageSchema } from '../lib/seo'
 import AnalyticsPreferences from '../components/AnalyticsPreferences.astro'
+import PreviewNotice from '../components/PreviewNotice.astro'
 
 interface Props {
   locale: Locale
@@ -24,6 +26,7 @@ interface Props {
 }
 
 const profile = getSiteProfile()
+const channel = getBuildChannel()
 const {
   locale,
   title,
@@ -47,7 +50,7 @@ const skipLabel = locale === 'zh-CN' ? '跳到主要内容' : 'Skip to main cont
 ---
 
 <!doctype html>
-<html lang={languageTag} data-locale={locale}>
+<html lang={languageTag} data-locale={locale} data-site-channel={channel}>
   <head>
     <meta charset="UTF-8" />
     {localeSwitch && <link data-locale-switch href={localeSwitch} />}
@@ -57,7 +60,7 @@ const skipLabel = locale === 'zh-CN' ? '跳到主要内容' : 'Skip to main cont
     <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
     <meta name="theme-color" content="#000000" media="(prefers-color-scheme: dark)" />
     <meta name="description" content={description} />
-    <meta name="robots" content={noindex ? 'noindex, follow' : 'index, follow'} />
+    <meta name="robots" content={noindex || channel === 'preview' ? 'noindex, follow' : 'index, follow'} />
     <meta name="author" content={author} />
     <meta name="generator" content={Astro.generator} />
     <link rel="icon" href="/logo.svg" type="image/svg+xml" />
@@ -100,6 +103,7 @@ const skipLabel = locale === 'zh-CN' ? '跳到主要内容' : 'Skip to main cont
   </head>
   <body>
     <a class="fixed top-3 left-3 z-[100] -translate-y-[160%] rounded-md bg-ink px-3.5 py-2.5 text-canvas focus:translate-y-0" href="#main-content">{skipLabel}</a>
+    {channel === 'preview' && <PreviewNotice locale={locale} productionUrl={canonical} />}
     <slot />
     <AnalyticsPreferences locale={locale} />
     <script is:inline>
diff --git a/apps/open-source/src/lib/build-channel.test.ts b/apps/open-source/src/lib/build-channel.test.ts
new file mode 100644
index 00000000..d80bbf58
--- /dev/null
+++ b/apps/open-source/src/lib/build-channel.test.ts
@@ -0,0 +1,28 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getBuildChannel } from './build-channel'
+import { getSiteProfile } from './deployment'
+
+const identity = getSiteProfile()
+
+afterEach(() => vi.unstubAllEnvs())
+
+describe('deployment channel', () => {
+  it('defaults local builds to stable without changing the site identity', () => {
+    vi.stubEnv('REPO_DOCS_CHANNEL', undefined)
+    expect(getBuildChannel()).toBe('stable')
+    expect(getSiteProfile()).toEqual(identity)
+  })
+
+  it('reads the preview channel while retaining the production origin', () => {
+    vi.stubEnv('REPO_DOCS_CHANNEL', 'preview')
+    expect(getBuildChannel()).toBe('preview')
+    expect(getSiteProfile()).toEqual(identity)
+  })
+
+  it('accepts stable explicitly and rejects misspelled channels', () => {
+    expect(getBuildChannel('stable')).toBe('stable')
+    for (const invalid of ['', 'production', 'nightly', 'Preview']) {
+      expect(() => getBuildChannel(invalid)).toThrow('Unsupported REPO_DOCS_CHANNEL')
+    }
+  })
+})
diff --git a/apps/open-source/src/lib/build-channel.ts b/apps/open-source/src/lib/build-channel.ts
new file mode 100644
index 00000000..15f27860
--- /dev/null
+++ b/apps/open-source/src/lib/build-channel.ts
@@ -0,0 +1,14 @@
+import process from 'node:process'
+
+export type BuildChannel = 'stable' | 'preview'
+
+/** Build-time deployment channel; it never changes the application's identity. */
+export function getBuildChannel(value = process.env.REPO_DOCS_CHANNEL): BuildChannel {
+  if (value === undefined || value === 'stable') {
+    return 'stable'
+  }
+  if (value === 'preview') {
+    return 'preview'
+  }
+  throw new Error(`Unsupported REPO_DOCS_CHANNEL: ${value}. Expected stable or preview.`)
+}
diff --git a/apps/open-source/src/lib/site-resources.test.ts b/apps/open-source/src/lib/site-resources.test.ts
index a88691d1..34e01eb8 100644
--- a/apps/open-source/src/lib/site-resources.test.ts
+++ b/apps/open-source/src/lib/site-resources.test.ts
@@ -13,6 +13,18 @@ const projects = [
 ]
 
 describe('site resources', () => {
+  it('keeps stable pages indexable and preview resources out of search indexes', () => {
+    const site = getSiteProfile()
+    const stable = createSiteResources(site, projects, 'stable')
+    const preview = createSiteResources(site, projects, 'preview')
+    expect(stable['robots.txt']).toBe(`User-agent: *\nAllow: /\n\nSitemap: ${site.origin}/sitemap-index.xml\n`)
+    expect(stable).not.toHaveProperty('_headers')
+    expect(preview['robots.txt']).toBe('User-agent: *\nDisallow: /\n')
+    expect(preview._headers).toBe('/*\n  X-Robots-Tag: noindex, nofollow\n')
+    expect(preview['llms.txt']).toBe(stable['llms.txt'])
+    expect(preview['llms-full.txt']).toBe(stable['llms-full.txt'])
+  })
+
   it('uses its own origin while preserving official project sources', () => {
     const site = getSiteProfile()
     const resources = createSiteResources(site, projects)
diff --git a/apps/open-source/src/lib/site-resources.ts b/apps/open-source/src/lib/site-resources.ts
index 173be4ee..c25dcc84 100644
--- a/apps/open-source/src/lib/site-resources.ts
+++ b/apps/open-source/src/lib/site-resources.ts
@@ -1,4 +1,5 @@
 import type { ProjectDefinition } from '../types/project'
+import type { BuildChannel } from './build-channel'
 import type { SiteProfile } from './deployment'
 
 export interface ResourceProject {
@@ -6,7 +7,7 @@ export interface ResourceProject {
   data: ProjectDefinition
 }
 
-export function createSiteResources(site: SiteProfile, projects: ResourceProject[]) {
+export function createSiteResources(site: SiteProfile, projects: ResourceProject[], channel: BuildChannel = 'stable'): Record<string, string> {
   const url = (path: string) => new URL(path, site.origin).href
   const introduction = 'An open-source project showcase for the JavaScript mini-app ecosystem. Discover related tools, their source repositories, documentation, and ways to contribute.'
   const pages = [
@@ -53,9 +54,15 @@ export function createSiteResources(site: SiteProfile, projects: ResourceProject
     ].join('\n')
   }).join('\n\n')
 
-  return {
-    'robots.txt': `User-agent: *\nAllow: /\n\nSitemap: ${url('/sitemap-index.xml')}\n`,
+  const resources: Record<string, string> = {
+    'robots.txt': channel === 'preview'
+      ? 'User-agent: *\nDisallow: /\n'
+      : `User-agent: *\nAllow: /\n\nSitemap: ${url('/sitemap-index.xml')}\n`,
     'llms.txt': summary,
     'llms-full.txt': `# ${site.name} reference\n\n${introduction}\n\n${sources}\n${projectReferences}\n\n${canonicalPages}`,
   }
+  if (channel === 'preview') {
+    resources._headers = '/*\n  X-Robots-Tag: noindex, nofollow\n'
+  }
+  return resources
 }
diff --git a/apps/open-source/tests/e2e/open-source.spec.ts b/apps/open-source/tests/e2e/open-source.spec.ts
index c21a473d..ab1eb7fc 100644
--- a/apps/open-source/tests/e2e/open-source.spec.ts
+++ b/apps/open-source/tests/e2e/open-source.spec.ts
@@ -1,4 +1,5 @@
 import { parse } from 'node-html-parser'
+import { getBuildChannel } from '../../src/lib/build-channel'
 import { expectSiteLink, isOpenSourceSite } from './site-target'
 import { expect, test } from './test'
 
@@ -93,7 +94,12 @@ test('all indexed HTML and discovery resources keep the open-source boundary', a
     const response = await request.get(path)
     expect(response.ok(), path).toBe(true)
     const content = await response.text()
-    expect(content, path).toContain('https://weapp.js.org')
+    if (path === '/robots.txt' && getBuildChannel() === 'preview') {
+      expect(content).toBe('User-agent: *\nDisallow: /\n')
+    }
+    else {
+      expect(content, path).toContain('https://weapp.js.org')
+    }
     expect(content, path).not.toMatch(/https:\/\/(?:www\.)?weapp\.dev(?:\/|$)/)
     expect(content, path).not.toMatch(fundingCopy)
     expect(content, path).not.toMatch(/\/(?:pricing|sponsors|contributors)\//)
diff --git a/apps/open-source/tests/e2e/publication-channel.spec.ts b/apps/open-source/tests/e2e/publication-channel.spec.ts
new file mode 100644
index 00000000..4ee30b80
--- /dev/null
+++ b/apps/open-source/tests/e2e/publication-channel.spec.ts
@@ -0,0 +1,103 @@
+import { getBuildChannel } from '../../src/lib/build-channel'
+import { isOpenSourceSite, siteOrigin } from './site-target'
+import { expect, test } from './test'
+
+const channel = getBuildChannel()
+const preview = channel === 'preview'
+
+test.describe('website publication channel', () => {
+  test.use({ javaScriptEnabled: false })
+
+  for (const pathname of ['/', '/en/']) {
+    test(`renders ${channel} metadata and localized notice without JavaScript at ${pathname}`, async ({ page }) => {
+      await page.goto(pathname)
+      await expect(page.locator('html')).toHaveAttribute('data-site-channel', channel)
+      await expect(page.locator('link[rel="canonical"]')).toHaveAttribute('href', `${siteOrigin}${pathname}`)
+      await expect(page.locator('meta[name="robots"]')).toHaveAttribute('content', preview ? 'noindex, follow' : 'index, follow')
+      const notice = page.locator('[data-preview-notice]')
+      if (preview) {
+        await expect(notice).toBeVisible()
+        await expect(notice).toContainText(pathname === '/' ? '预览版本，内容可能更新。' : 'Preview version. Content may change.')
+        const liveLink = notice.getByRole('link', { name: pathname === '/' ? '访问正式网站' : 'Visit the live website' })
+        await expect(liveLink).toHaveAttribute('href', `${siteOrigin}${pathname}`)
+        await expect(liveLink).toBeVisible()
+        const bounds = await liveLink.boundingBox()
+        expect(bounds?.height).toBeGreaterThanOrEqual(44)
+        expect(await page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth)).toBe(true)
+      }
+      else {
+        await expect(notice).toHaveCount(0)
+      }
+    })
+  }
+
+  test('ships channel-specific crawler rules while preserving the official sitemap', async ({ request }) => {
+    const robots = await request.get('/robots.txt')
+    expect(robots.ok()).toBe(true)
+    expect(await robots.text()).toBe(preview
+      ? 'User-agent: *\nDisallow: /\n'
+      : `User-agent: *\nAllow: /\n\nSitemap: ${siteOrigin}/sitemap-index.xml\n`)
+    const headers = await request.get('/_headers')
+    expect(headers.status()).toBe(preview ? 200 : 404)
+    if (preview) {
+      expect(await headers.text()).toBe('/*\n  X-Robots-Tag: noindex, nofollow\n')
+    }
+    const sitemap = await request.get('/sitemap-index.xml')
+    expect(sitemap.ok()).toBe(true)
+    expect(await sitemap.text()).toContain(`${siteOrigin}/sitemap-`)
+    const cname = await request.get('/CNAME')
+    expect(cname.status()).toBe(isOpenSourceSite && !preview ? 200 : 404)
+    if (isOpenSourceSite && !preview) {
+      expect((await cname.text()).trim()).toBe(new URL(siteOrigin).hostname)
+    }
+  })
+})
+
+test.describe('preview notice viewport layout', () => {
+  test.skip(!preview, 'The stable site has no preview notice')
+
+  for (const pathname of ['/', '/en/']) {
+    test(`keeps hero controls in view as the notice wraps at ${pathname}`, async ({ page }, testInfo) => {
+      test.skip(testInfo.project.name !== 'desktop', 'The explicit viewport sequence runs once')
+      await page.setViewportSize({ width: 1280, height: 900 })
+      await page.goto(pathname)
+      await expect(page.locator('.home-hero-screen')).toHaveAttribute('data-hero-phase', 'ready')
+      const heights: number[] = []
+      for (const viewport of [{ width: 1280, height: 900 }, { width: 390, height: 844 }, { width: 1280, height: 900 }]) {
+        await page.evaluate(() => (document.activeElement as HTMLElement | null)?.blur())
+        await page.setViewportSize(viewport)
+        await page.evaluate(() => window.scrollTo(0, 0))
+        await expect(page.locator('[data-preview-notice]')).toBeInViewport()
+        await expect.poll(() => page.locator('.home-hero-screen').evaluate(element => Math.round(element.getBoundingClientRect().bottom))).toBe(viewport.height)
+        const notice = await page.locator('[data-preview-notice]').boundingBox()
+        heights.push(notice!.height)
+        for (const control of await page.locator('[data-hero-controls] button').all()) {
+          const bounds = await control.boundingBox()
+          expect(bounds!.y).toBeGreaterThanOrEqual(0)
+          expect(bounds!.y + bounds!.height).toBeLessThanOrEqual(viewport.height)
+          await control.focus()
+          await expect(control).toBeFocused()
+          expect(await page.evaluate(() => window.scrollY), 'Focusing hero controls must not scroll away from a hovered project').toBe(0)
+        }
+      }
+      expect(heights[2]).toBe(heights[0])
+      if (pathname === '/en/') {
+        expect(heights[1], 'The narrow English notice must exercise a real line wrap').toBeGreaterThan(heights[0]!)
+      }
+    })
+  }
+})
+
+test('keeps preview analytics disabled during real page initialization', async ({ page }) => {
+  test.skip(!preview, 'Production analytics are checked separately on their official host')
+  const trackerRequests: string[] = []
+  page.on('request', (request) => {
+    if (/google-analytics\.com|googletagmanager\.com|hm\.baidu\.com/.test(request.url())) {
+      trackerRequests.push(request.url())
+    }
+  })
+  await page.goto('/')
+  await expect(page.locator('.home-hero-screen')).toHaveAttribute('data-particles-ready', '')
+  await expect(page.locator('script[src*="googletagmanager"], script[src*="hm.baidu.com"]')).toHaveCount(0)
+  expect(trackerRequests).toEqual([])
+})
diff --git a/apps/open-source/tests/e2e/site.spec.ts b/apps/open-source/tests/e2e/site.spec.ts
index ec0f7b32..09a3bf0c 100644
--- a/apps/open-source/tests/e2e/site.spec.ts
+++ b/apps/open-source/tests/e2e/site.spec.ts
@@ -1,5 +1,6 @@
 import AxeBuilder from '@axe-core/playwright'
 import { siteCopy } from '../../src/i18n/ui'
+import { getBuildChannel } from '../../src/lib/build-channel'
 import { expectStaticStarfield } from './hero-fallback'
 import { heroWordmark, isOpenSourceSite, siteOrigin } from './site-target'
 import { expect, test } from './test'
@@ -75,7 +76,7 @@ test('renders the bilingual ecosystem home with valid metadata', async ({ page }
   await expect(page.locator('#projects').getByRole('heading', { name: 'Varo' })).toBeVisible()
   await expect(page.locator('link[rel="canonical"]')).toHaveAttribute('href', `${siteOrigin}/`)
   await expect(page.locator('link[hreflang="en-US"]')).toHaveAttribute('href', `${siteOrigin}/en/`)
-  await expect(page.locator('meta[name="robots"]')).toHaveAttribute('content', 'index, follow')
+  await expect(page.locator('meta[name="robots"]')).toHaveAttribute('content', getBuildChannel() === 'preview' ? 'noindex, follow' : 'index, follow')
   await expect(page.locator('meta[property="og:image"]')).toHaveAttribute('content', `${siteOrigin}/og.png`)
   await expect(page.locator('script[type="application/ld+json"]')).toHaveCount(4)
   await expect(page.locator('#about')).toContainText(isOpenSourceSite ? 'JavaScript 与 TypeScript 项目' : 'weapp-tailwindcss')
diff --git a/apps/open-source/wrangler.preview.jsonc b/apps/open-source/wrangler.preview.jsonc
new file mode 100644
index 00000000..b928ff12
--- /dev/null
+++ b/apps/open-source/wrangler.preview.jsonc
@@ -0,0 +1,12 @@
+{
+  "$schema": "https://raw.githubusercontent.com/cloudflare/workers-sdk/main/packages/wrangler/config-schema.json",
+  "name": "weapp-open-source-preview",
+  "compatibility_date": "2026-08-26",
+  "workers_dev": true,
+  "preview_urls": true,
+  "assets": {
+    "directory": "./dist/",
+    "not_found_handling": "404-page",
+    "html_handling": "auto-trailing-slash"
+  }
+}
diff --git a/apps/web/package.json b/apps/web/package.json
index e43194c7..eaaa6fb1 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -7,8 +7,7 @@
     "build": "tsx scripts/prepare-project-assets.ts && astro build && pnpm og:generate && pnpm pages:prepare && tsx scripts/validate-build.ts",
     "pages:prepare": "tsx scripts/prepare-pages-content.ts",
     "check": "astro check && tsc --noEmit",
-    "deploy": "pnpm build && wrangler deploy",
-    "deploy:dry-run": "pnpm build && wrangler deploy --dry-run",
+    "deploy:dry-run": "wrangler deploy --dry-run",
     "dev": "tsx scripts/prepare-project-assets.ts && astro dev",
     "lint": "eslint .",
     "lint:styles": "stylelint 'src/**/*.css'",
diff --git a/apps/web/playwright.config.ts b/apps/web/playwright.config.ts
index b3eeb310..06f644ff 100644
--- a/apps/web/playwright.config.ts
+++ b/apps/web/playwright.config.ts
@@ -6,6 +6,8 @@ const browserChannel = process.env.PLAYWRIGHT_CHANNEL
 export default defineConfig({
   testDir: './tests/e2e',
   fullyParallel: true,
+  // Particle and canvas assertions need a bounded rendering workload on CI.
+  workers: 2,
   webServer: {
     // Serve the exact deployment artifact, including the Pages relative paths.
     command: 'node scripts/serve-test-site.mjs',
@@ -13,6 +15,7 @@ export default defineConfig({
     reuseExistingServer: false,
   },
   use: {
+    headless: true,
     baseURL: 'http://127.0.0.1:4321',
     locale: 'zh-CN',
     ...(browserChannel ? { channel: browserChannel } : {}),
diff --git a/apps/web/scripts/prepare-pages-content.ts b/apps/web/scripts/prepare-pages-content.ts
index ffeafe6a..f713564a 100644
--- a/apps/web/scripts/prepare-pages-content.ts
+++ b/apps/web/scripts/prepare-pages-content.ts
@@ -3,10 +3,12 @@ import { basename, join, resolve } from 'node:path'
 import process from 'node:process'
 import { projectsDirectory } from '@weapp-io/project-catalog/paths'
 import { projectDefinitionSchema } from '../src/content/schemas'
+import { getBuildChannel } from '../src/lib/build-channel'
 import { getSiteProfile } from '../src/lib/deployment'
 import { createSiteResources } from '../src/lib/site-resources'
 
 const site = getSiteProfile()
+const channel = getBuildChannel()
 const root = resolve(process.argv[2] || join(import.meta.dirname, '..', site.outputDir))
 const projectDirectory = projectsDirectory
 const projects = await Promise.all((await readdir(projectDirectory)).filter(file => file.endsWith('.json')).map(async file => ({
@@ -15,7 +17,9 @@ const projects = await Promise.all((await readdir(projectDirectory)).filter(file
 })))
 projects.sort((left, right) => left.data.order - right.data.order)
 
-for (const [name, content] of Object.entries(createSiteResources(site, projects))) {
+// A repeated stable preparation must remove preview-only response headers.
+await rm(join(root, '_headers'), { force: true })
+for (const [name, content] of Object.entries(createSiteResources(site, projects, channel))) {
   await writeFile(join(root, name), content, 'utf8')
 }
 
diff --git a/apps/web/scripts/validate-build.ts b/apps/web/scripts/validate-build.ts
index 024da7f6..ecaf6e28 100644
--- a/apps/web/scripts/validate-build.ts
+++ b/apps/web/scripts/validate-build.ts
@@ -3,10 +3,13 @@ import { join, relative, resolve } from 'node:path'
 import process from 'node:process'
 import { projectsDirectory } from '@weapp-io/project-catalog/paths'
 import { parse } from 'node-html-parser'
+import { getBuildChannel } from '../src/lib/build-channel'
 import { getSiteProfile } from '../src/lib/deployment'
 
 const root = resolve(import.meta.dirname, '..')
 const site = getSiteProfile()
+const channel = getBuildChannel()
+const preview = channel === 'preview'
 const dist = resolve(root, site.outputDir)
 const projectIds = (await readdir(projectsDirectory)).filter(file => file.endsWith('.json')).map(file => file.slice(0, -5))
 const expectedFiles = [
@@ -24,6 +27,7 @@ const expectedFiles = [
   'og.png',
   'og.svg',
   'bimi/logo.svg',
+  ...(preview ? ['_headers'] : []),
 ]
 const retiredDocsHosts = ['tw.icebreaker.top', 'vite.icebreaker.top']
 const errors: string[] = []
@@ -65,7 +69,7 @@ for (const file of expectedFiles) {
   }
 }
 
-for (const name of ['CNAME', '.nojekyll', '.well-known/bimi']) {
+for (const name of ['CNAME', '.nojekyll', '.well-known/bimi', ...(preview ? [] : ['_headers'])]) {
   try {
     await access(resolve(dist, name))
     errors.push(`Forbidden build output: ${name}`)
@@ -75,6 +79,13 @@ for (const name of ['CNAME', '.nojekyll', '.well-known/bimi']) {
   }
 }
 
+if (preview) {
+  const headers = await readFile(resolve(dist, '_headers'), 'utf8').catch(() => '')
+  if (!/^\/\*\n\s+X-Robots-Tag: noindex, nofollow\n$/i.test(headers)) {
+    errors.push('_headers: preview responses must disallow indexing for every path')
+  }
+}
+
 const cssFiles = (await readdir(dist, { recursive: true })).filter(file => file.endsWith('.css'))
 for (const file of cssFiles) {
   const css = await readFile(resolve(dist, file), 'utf8')
@@ -105,6 +116,21 @@ for (const file of htmlFiles) {
   const robots = document.querySelector('meta[name="robots"]')?.getAttribute('content')
   const schemas = document.querySelectorAll('script[type="application/ld+json"]')
 
+  if (document.querySelector('html')?.getAttribute('data-site-channel') !== channel) {
+    errors.push(`${label}: build channel must be ${channel}`)
+  }
+  const notice = document.querySelector('[data-preview-notice]')
+  const expectsNotice = preview
+  if (expectsNotice) {
+    const message = pagePath.startsWith('/en/') ? 'Preview version. Content may change.' : '预览版本，内容可能更新。'
+    if (!notice?.text.includes(message) || notice.querySelector('a')?.getAttribute('href') !== expectedCanonical) {
+      errors.push(`${label}: missing localized preview notice and production link`)
+    }
+  }
+  else if (notice) {
+    errors.push(`${label}: unexpected preview notice`)
+  }
+
   if (canonical !== expectedCanonical) {
     errors.push(`${label}: expected canonical ${expectedCanonical}, received ${canonical ?? '(missing)'}`)
   }
@@ -119,8 +145,11 @@ for (const file of htmlFiles) {
   if (descriptions.length !== 1 || !descriptions[0].getAttribute('content')?.trim()) {
     errors.push(`${label}: missing unique description`)
   }
-  if (!robots) {
-    errors.push(`${label}: missing robots directive`)
+  if (preview && robots !== 'noindex, follow') {
+    errors.push(`${label}: preview pages must be noindex`)
+  }
+  else if (!preview && !['404.html', '404/index.html', 'en/404/index.html'].includes(label) && robots !== 'index, follow') {
+    errors.push(`${label}: stable content pages must remain indexable`)
   }
   if ((label === '404.html' || label === '404/index.html' || label === 'en/404/index.html') && !robots?.includes('noindex')) {
     errors.push(`${label}: 404 pages must be noindex`)
@@ -214,8 +243,13 @@ for (const file of [...sitemapFiles, 'robots.txt', 'llms.txt', 'llms-full.txt',
         }
       }
     }
-    if (file === 'robots.txt' && !contents.includes(`Sitemap: ${site.origin}/sitemap-index.xml`)) {
-      errors.push(`${file}: sitemap must use this site's origin`)
+    if (file === 'robots.txt') {
+      const expectedRobots = preview
+        ? 'User-agent: *\nDisallow: /\n'
+        : `User-agent: *\nAllow: /\n\nSitemap: ${site.origin}/sitemap-index.xml\n`
+      if (contents !== expectedRobots) {
+        errors.push(`${file}: incorrect crawler policy for ${channel}`)
+      }
     }
     if (file === 'releases.xml' && !contents.includes(`<link>${site.origin}/</link>`)) {
       errors.push(`${file}: release channel must use this site's origin`)
diff --git a/apps/web/src/components/PreviewNotice.astro b/apps/web/src/components/PreviewNotice.astro
new file mode 100644
index 00000000..d318d996
--- /dev/null
+++ b/apps/web/src/components/PreviewNotice.astro
@@ -0,0 +1,71 @@
+---
+import type { Locale } from '../types/project'
+
+interface Props {
+  locale: Locale
+  productionUrl: string
+}
+
+const { locale, productionUrl } = Astro.props
+const label = locale === 'zh-CN' ? '预览版本，内容可能更新。' : 'Preview version. Content may change.'
+const linkLabel = locale === 'zh-CN' ? '访问正式网站' : 'Visit the live website'
+---
+
+<aside data-preview-notice aria-label={locale === 'zh-CN' ? '网站预览提示' : 'Website preview notice'} class="preview-notice">
+  <div>
+    <p>{label}</p>
+    <a href={productionUrl}>{linkLabel}</a>
+  </div>
+</aside>
+
+<script is:inline>
+  (() => {
+    const notice = document.currentScript?.previousElementSibling
+    if (!(notice instanceof HTMLElement)) return
+    const updateHeight = () => {
+      document.documentElement.style.setProperty('--site-notice-height', `${notice.getBoundingClientRect().height}px`)
+    }
+    // Run before the hero is parsed; track wrapping, font and viewport changes.
+    updateHeight()
+    new ResizeObserver(updateHeight).observe(notice, { box: 'border-box' })
+  })()
+</script>
+
+<style>
+  .preview-notice {
+    color: var(--text);
+    background: var(--surface-soft);
+    border-bottom: 1px solid var(--border);
+    font-size: 0.875rem;
+    line-height: 1.5;
+  }
+  .preview-notice > div {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 0 1rem;
+    align-items: center;
+    justify-content: center;
+    width: min(1240px, calc(100% - 2rem));
+    margin-inline: auto;
+    padding-block: 0.25rem;
+  }
+  .preview-notice p {
+    margin: 0;
+  }
+  .preview-notice a {
+    display: inline-flex;
+    min-height: 44px;
+    align-items: center;
+    color: var(--text);
+    font-weight: 600;
+    text-decoration: underline;
+    text-underline-offset: 0.2em;
+  }
+  .preview-notice a:hover {
+    color: var(--accent);
+  }
+  .preview-notice a:focus-visible {
+    outline: 2px solid var(--accent);
+    outline-offset: 4px;
+  }
+</style>
diff --git a/apps/web/src/layouts/BaseLayout.astro b/apps/web/src/layouts/BaseLayout.astro
index fe2d15b3..f76c899b 100644
--- a/apps/web/src/layouts/BaseLayout.astro
+++ b/apps/web/src/layouts/BaseLayout.astro
@@ -3,11 +3,13 @@ import '@fontsource-variable/geist/index.css'
 import '@fontsource-variable/geist-mono/index.css'
 import '../styles/global.css'
 import { getSiteProfile } from '../lib/deployment'
+import { getBuildChannel } from '../lib/build-channel'
 import type { Locale } from '../types/project'
 import { alternatePath } from '../i18n/ui'
 import { localeRedirectScript } from '../lib/locale-redirect'
 import { canonicalUrl, serializeJsonLd, webPageSchema } from '../lib/seo'
 import AnalyticsPreferences from '../components/AnalyticsPreferences.astro'
+import PreviewNotice from '../components/PreviewNotice.astro'
 
 interface Props {
   locale: Locale
@@ -24,6 +26,7 @@ interface Props {
 }
 
 const profile = getSiteProfile()
+const channel = getBuildChannel()
 const {
   locale,
   title,
@@ -47,7 +50,7 @@ const skipLabel = locale === 'zh-CN' ? '跳到主要内容' : 'Skip to main cont
 ---
 
 <!doctype html>
-<html lang={languageTag} data-locale={locale}>
+<html lang={languageTag} data-locale={locale} data-site-channel={channel}>
   <head>
     <meta charset="UTF-8" />
     {localeSwitch && <link data-locale-switch href={localeSwitch} />}
@@ -57,7 +60,7 @@ const skipLabel = locale === 'zh-CN' ? '跳到主要内容' : 'Skip to main cont
     <meta name="theme-color" content="#ffffff" media="(prefers-color-scheme: light)" />
     <meta name="theme-color" content="#000000" media="(prefers-color-scheme: dark)" />
     <meta name="description" content={description} />
-    <meta name="robots" content={noindex ? 'noindex, follow' : 'index, follow'} />
+    <meta name="robots" content={noindex || channel === 'preview' ? 'noindex, follow' : 'index, follow'} />
     <meta name="author" content={author} />
     <meta name="generator" content={Astro.generator} />
     <link rel="icon" href="/logo.svg" type="image/svg+xml" />
@@ -100,6 +103,7 @@ const skipLabel = locale === 'zh-CN' ? '跳到主要内容' : 'Skip to main cont
   </head>
   <body>
     <a class="fixed top-3 left-3 z-[100] -translate-y-[160%] rounded-md bg-ink px-3.5 py-2.5 text-canvas focus:translate-y-0" href="#main-content">{skipLabel}</a>
+    {channel === 'preview' && <PreviewNotice locale={locale} productionUrl={canonical} />}
     <slot />
     <AnalyticsPreferences locale={locale} />
     <script is:inline>
diff --git a/apps/web/src/lib/build-channel.test.ts b/apps/web/src/lib/build-channel.test.ts
new file mode 100644
index 00000000..d80bbf58
--- /dev/null
+++ b/apps/web/src/lib/build-channel.test.ts
@@ -0,0 +1,28 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { getBuildChannel } from './build-channel'
+import { getSiteProfile } from './deployment'
+
+const identity = getSiteProfile()
+
+afterEach(() => vi.unstubAllEnvs())
+
+describe('deployment channel', () => {
+  it('defaults local builds to stable without changing the site identity', () => {
+    vi.stubEnv('REPO_DOCS_CHANNEL', undefined)
+    expect(getBuildChannel()).toBe('stable')
+    expect(getSiteProfile()).toEqual(identity)
+  })
+
+  it('reads the preview channel while retaining the production origin', () => {
+    vi.stubEnv('REPO_DOCS_CHANNEL', 'preview')
+    expect(getBuildChannel()).toBe('preview')
+    expect(getSiteProfile()).toEqual(identity)
+  })
+
+  it('accepts stable explicitly and rejects misspelled channels', () => {
+    expect(getBuildChannel('stable')).toBe('stable')
+    for (const invalid of ['', 'production', 'nightly', 'Preview']) {
+      expect(() => getBuildChannel(invalid)).toThrow('Unsupported REPO_DOCS_CHANNEL')
+    }
+  })
+})
diff --git a/apps/web/src/lib/build-channel.ts b/apps/web/src/lib/build-channel.ts
new file mode 100644
index 00000000..15f27860
--- /dev/null
+++ b/apps/web/src/lib/build-channel.ts
@@ -0,0 +1,14 @@
+import process from 'node:process'
+
+export type BuildChannel = 'stable' | 'preview'
+
+/** Build-time deployment channel; it never changes the application's identity. */
+export function getBuildChannel(value = process.env.REPO_DOCS_CHANNEL): BuildChannel {
+  if (value === undefined || value === 'stable') {
+    return 'stable'
+  }
+  if (value === 'preview') {
+    return 'preview'
+  }
+  throw new Error(`Unsupported REPO_DOCS_CHANNEL: ${value}. Expected stable or preview.`)
+}
diff --git a/apps/web/src/lib/site-resources.test.ts b/apps/web/src/lib/site-resources.test.ts
index b6dafade..aaba8a2b 100644
--- a/apps/web/src/lib/site-resources.test.ts
+++ b/apps/web/src/lib/site-resources.test.ts
@@ -13,6 +13,18 @@ const projects = [
 ]
 
 describe('site resources', () => {
+  it('keeps stable pages indexable and preview resources out of search indexes', () => {
+    const site = getSiteProfile()
+    const stable = createSiteResources(site, projects, 'stable')
+    const preview = createSiteResources(site, projects, 'preview')
+    expect(stable['robots.txt']).toBe(`User-agent: *\nAllow: /\n\nSitemap: ${site.origin}/sitemap-index.xml\n`)
+    expect(stable).not.toHaveProperty('_headers')
+    expect(preview['robots.txt']).toBe('User-agent: *\nDisallow: /\n')
+    expect(preview._headers).toBe('/*\n  X-Robots-Tag: noindex, nofollow\n')
+    expect(preview['llms.txt']).toBe(stable['llms.txt'])
+    expect(preview['llms-full.txt']).toBe(stable['llms-full.txt'])
+  })
+
   it('uses its own origin while preserving official project sources', () => {
     const site = getSiteProfile()
     const resources = createSiteResources(site, projects)
diff --git a/apps/web/src/lib/site-resources.ts b/apps/web/src/lib/site-resources.ts
index eecf73cf..981d1574 100644
--- a/apps/web/src/lib/site-resources.ts
+++ b/apps/web/src/lib/site-resources.ts
@@ -1,4 +1,5 @@
 import type { ProjectDefinition } from '../types/project'
+import type { BuildChannel } from './build-channel'
 import type { SiteProfile } from './deployment'
 import { donationCopy } from '../i18n/donation'
 import { projectService } from './services'
@@ -8,7 +9,7 @@ export interface ResourceProject {
   data: ProjectDefinition
 }
 
-export function createSiteResources(site: SiteProfile, projects: ResourceProject[]) {
+export function createSiteResources(site: SiteProfile, projects: ResourceProject[], channel: BuildChannel = 'stable'): Record<string, string> {
   const url = (path: string) => new URL(path, site.origin).href
   const introduction = 'Mini-app tools, project references, and scoped migration, training, and template customization for real repositories.'
   const pages = [
@@ -58,9 +59,15 @@ export function createSiteResources(site: SiteProfile, projects: ResourceProject
     ].join('\n')
   }).join('\n\n')
 
-  return {
-    'robots.txt': `User-agent: *\nAllow: /\n\nSitemap: ${url('/sitemap-index.xml')}\n`,
+  const resources: Record<string, string> = {
+    'robots.txt': channel === 'preview'
+      ? 'User-agent: *\nDisallow: /\n'
+      : `User-agent: *\nAllow: /\n\nSitemap: ${url('/sitemap-index.xml')}\n`,
     'llms.txt': summary,
     'llms-full.txt': `# ${site.name} reference\n\n${introduction}\n\n${sources}\n${projectReferences}\n\n${canonicalPages}${serviceNotes}${sponsorshipNotes}`,
   }
+  if (channel === 'preview') {
+    resources._headers = '/*\n  X-Robots-Tag: noindex, nofollow\n'
+  }
+  return resources
 }
diff --git a/apps/web/tests/e2e/publication-channel.spec.ts b/apps/web/tests/e2e/publication-channel.spec.ts
new file mode 100644
index 00000000..4ee30b80
--- /dev/null
+++ b/apps/web/tests/e2e/publication-channel.spec.ts
@@ -0,0 +1,103 @@
+import { getBuildChannel } from '../../src/lib/build-channel'
+import { isOpenSourceSite, siteOrigin } from './site-target'
+import { expect, test } from './test'
+
+const channel = getBuildChannel()
+const preview = channel === 'preview'
+
+test.describe('website publication channel', () => {
+  test.use({ javaScriptEnabled: false })
+
+  for (const pathname of ['/', '/en/']) {
+    test(`renders ${channel} metadata and localized notice without JavaScript at ${pathname}`, async ({ page }) => {
+      await page.goto(pathname)
+      await expect(page.locator('html')).toHaveAttribute('data-site-channel', channel)
+      await expect(page.locator('link[rel="canonical"]')).toHaveAttribute('href', `${siteOrigin}${pathname}`)
+      await expect(page.locator('meta[name="robots"]')).toHaveAttribute('content', preview ? 'noindex, follow' : 'index, follow')
+      const notice = page.locator('[data-preview-notice]')
+      if (preview) {
+        await expect(notice).toBeVisible()
+        await expect(notice).toContainText(pathname === '/' ? '预览版本，内容可能更新。' : 'Preview version. Content may change.')
+        const liveLink = notice.getByRole('link', { name: pathname === '/' ? '访问正式网站' : 'Visit the live website' })
+        await expect(liveLink).toHaveAttribute('href', `${siteOrigin}${pathname}`)
+        await expect(liveLink).toBeVisible()
+        const bounds = await liveLink.boundingBox()
+        expect(bounds?.height).toBeGreaterThanOrEqual(44)
+        expect(await page.evaluate(() => document.documentElement.scrollWidth <= window.innerWidth)).toBe(true)
+      }
+      else {
+        await expect(notice).toHaveCount(0)
+      }
+    })
+  }
+
+  test('ships channel-specific crawler rules while preserving the official sitemap', async ({ request }) => {
+    const robots = await request.get('/robots.txt')
+    expect(robots.ok()).toBe(true)
+    expect(await robots.text()).toBe(preview
+      ? 'User-agent: *\nDisallow: /\n'
+      : `User-agent: *\nAllow: /\n\nSitemap: ${siteOrigin}/sitemap-index.xml\n`)
+    const headers = await request.get('/_headers')
+    expect(headers.status()).toBe(preview ? 200 : 404)
+    if (preview) {
+      expect(await headers.text()).toBe('/*\n  X-Robots-Tag: noindex, nofollow\n')
+    }
+    const sitemap = await request.get('/sitemap-index.xml')
+    expect(sitemap.ok()).toBe(true)
+    expect(await sitemap.text()).toContain(`${siteOrigin}/sitemap-`)
+    const cname = await request.get('/CNAME')
+    expect(cname.status()).toBe(isOpenSourceSite && !preview ? 200 : 404)
+    if (isOpenSourceSite && !preview) {
+      expect((await cname.text()).trim()).toBe(new URL(siteOrigin).hostname)
+    }
+  })
+})
+
+test.describe('preview notice viewport layout', () => {
+  test.skip(!preview, 'The stable site has no preview notice')
+
+  for (const pathname of ['/', '/en/']) {
+    test(`keeps hero controls in view as the notice wraps at ${pathname}`, async ({ page }, testInfo) => {
+      test.skip(testInfo.project.name !== 'desktop', 'The explicit viewport sequence runs once')
+      await page.setViewportSize({ width: 1280, height: 900 })
+      await page.goto(pathname)
+      await expect(page.locator('.home-hero-screen')).toHaveAttribute('data-hero-phase', 'ready')
+      const heights: number[] = []
+      for (const viewport of [{ width: 1280, height: 900 }, { width: 390, height: 844 }, { width: 1280, height: 900 }]) {
+        await page.evaluate(() => (document.activeElement as HTMLElement | null)?.blur())
+        await page.setViewportSize(viewport)
+        await page.evaluate(() => window.scrollTo(0, 0))
+        await expect(page.locator('[data-preview-notice]')).toBeInViewport()
+        await expect.poll(() => page.locator('.home-hero-screen').evaluate(element => Math.round(element.getBoundingClientRect().bottom))).toBe(viewport.height)
+        const notice = await page.locator('[data-preview-notice]').boundingBox()
+        heights.push(notice!.height)
+        for (const control of await page.locator('[data-hero-controls] button').all()) {
+          const bounds = await control.boundingBox()
+          expect(bounds!.y).toBeGreaterThanOrEqual(0)
+          expect(bounds!.y + bounds!.height).toBeLessThanOrEqual(viewport.height)
+          await control.focus()
+          await expect(control).toBeFocused()
+          expect(await page.evaluate(() => window.scrollY), 'Focusing hero controls must not scroll away from a hovered project').toBe(0)
+        }
+      }
+      expect(heights[2]).toBe(heights[0])
+      if (pathname === '/en/') {
+        expect(heights[1], 'The narrow English notice must exercise a real line wrap').toBeGreaterThan(heights[0]!)
+      }
+    })
+  }
+})
+
+test('keeps preview analytics disabled during real page initialization', async ({ page }) => {
+  test.skip(!preview, 'Production analytics are checked separately on their official host')
+  const trackerRequests: string[] = []
+  page.on('request', (request) => {
+    if (/google-analytics\.com|googletagmanager\.com|hm\.baidu\.com/.test(request.url())) {
+      trackerRequests.push(request.url())
+    }
+  })
+  await page.goto('/')
+  await expect(page.locator('.home-hero-screen')).toHaveAttribute('data-particles-ready', '')
+  await expect(page.locator('script[src*="googletagmanager"], script[src*="hm.baidu.com"]')).toHaveCount(0)
+  expect(trackerRequests).toEqual([])
+})
diff --git a/apps/web/tests/e2e/sponsors.spec.ts b/apps/web/tests/e2e/sponsors.spec.ts
index 58aba1c1..bda40e63 100644
--- a/apps/web/tests/e2e/sponsors.spec.ts
+++ b/apps/web/tests/e2e/sponsors.spec.ts
@@ -247,6 +247,9 @@ test('does not initialize a detached component after a delayed import', async ({
   await page.evaluate(() => new Promise(resolve => requestAnimationFrame(() => requestAnimationFrame(resolve))))
   expect(await component!.evaluate(element => element.querySelectorAll('canvas').length)).toBe(0)
   await component!.evaluate(element => document.querySelector('main')!.append(element))
+  // Reconnection still honors lazy visibility, even when the preview notice
+  // pushes the appended component beyond the observer's preload margin.
+  await page.locator('[data-sponsor-graphs]').scrollIntoViewIfNeeded()
   await expect(page.locator('[data-sponsor-graphs]')).toHaveAttribute('data-ready', 'true')
   await expect(page.locator('[data-sponsor-graphs] canvas')).toHaveCount(2)
   await expect(page.locator('[data-graph-loading]')).toBeHidden()
diff --git a/apps/web/wrangler.preview.jsonc b/apps/web/wrangler.preview.jsonc
new file mode 100644
index 00000000..a7d5c444
--- /dev/null
+++ b/apps/web/wrangler.preview.jsonc
@@ -0,0 +1,12 @@
+{
+  "$schema": "./node_modules/wrangler/config-schema.json",
+  "name": "weapp-dev-preview",
+  "compatibility_date": "2026-08-26",
+  "workers_dev": true,
+  "preview_urls": true,
+  "assets": {
+    "directory": "./dist/",
+    "not_found_handling": "404-page",
+    "html_handling": "auto-trailing-slash"
+  }
+}
diff --git a/docs/maintenance.md b/docs/maintenance.md
index 2f137cbc..feb15c2c 100644
--- a/docs/maintenance.md
+++ b/docs/maintenance.md
@@ -54,11 +54,15 @@ pnpm metrics:sync
 
 ## CI 与发布
 
-版本由 repoctl 5.10.3 和 pnpm 原生 versioning 管理。功能或修复在开发分支记录 `pnpm change weapp --bump minor --summary "变更说明"`（修复使用 `patch`），提交 `.changeset/*.md` 后合入 `main`。这只是 pnpm 的 change intent 目录，不使用 Changesets CLI 或 action。`pnpm release:plan --json` 只读预览版本和 release notes，`pnpm change check` 检查 intent。`pnpm-workspace.yaml` 的 `versioning.ignore` 使用精确包名，排除私有 root 与四个 `@weapp-io/*` workspace；该字段不支持通配符，新增私有包时必须同步名单。
+[2026-10-23 repoctl 6.0.1 迁移与上线记录](repoctl-migration-2026-10-23.md) 记录历史 0.3.0 补发、隔离 nightly 制品验证、部署环境配置以及仍待完成的真实上线验收。
 
-`.github/workflows/version-packages.yml` 在 `main` push 或手动运行时调用 `repo release ci --mode prepare`，创建或更新 `release/pnpm-version` → `main` 的版本 PR。repoctl 执行 `release:verify`，pnpm 消费 intent、升版、生成包内 `CHANGELOG.md` 和 `.changeset/ledger.yaml`，然后 `afterVersion` 构建最新版本的 CLI 快照。自动任务禁用开发者 Git hooks，使用显式质量脚本和 PR 的 CLI CI。版本 PR 不自动合并，prepare job 没有 OIDC 权限且不会发布 npm。
+版本与发布由 repoctl 6.0.1 统一管理，底层继续使用 pnpm 12 原生 versioning。开发分支用 `pnpm change weapp --bump minor --summary "变更说明"` 记录功能（修复用 `patch`）；`.changeset/*.md` 是 pnpm change intent，不使用 Changesets CLI/action。`pnpm release:plan --json` 只读预览，`pnpm change check` 检查 intent。`pnpm-workspace.yaml` 的 `versioning.ignore` 精确排除 root 与四个私有 workspace，新增私有包时同步名单。
 
-仓库允许 GitHub Actions 创建 PR，但默认 token 权限仍为 read；只有 prepare job 授予 contents / pull-requests / actions write。它使用内置 `GITHUB_TOKEN`，不需要 PAT 或 npm token，并显式 dispatch 版本分支的 CLI CI 和 `publish-weapp.yml` 的 preflight，以便检查真正待合并的版本。后者的 `--ref` 与 `tag` 输入均为 `release/pnpm-version`。当前代码版本与待处理 intent 决定下一版本，维护时以只读 release plan 为准。版本 PR 与发布分别处理。
+受管 `.github/workflows/release.yml` 在 main push 时执行 repoctl 的 plan、verify、prepare、upload、confirm、finalize 阶段。有待处理 intent 时维护 `release/pnpm-version` → main 的版本 PR；审查并合并版本 PR 后，由下一次 main 运行完成 npm 正式发布、canonical tag、GitHub Release 和 release record。版本 PR 不自动合并，prepare 不发布包。`release:verify` 保留边界、类型、lint、单测和独立 tarball 检查；`afterVersion` 构建并检查新的 CLI 版本，避免 nightly 或正式版本号与 `dist/data/meta.json` 不一致。
+
+开发者提交门禁统一使用 repoctl 的 Lefthook 配置，根目录 `prepare` 只在实际开发 checkout 安装 hooks：CI、`LEFTHOOK=0` 和没有自身 `.git` 的发布源码归档会跳过，开发环境中的真实安装错误仍会失败。CI 显式设置 `LEFTHOOK=0` 并执行质量脚本，不再依赖 Husky。默认 GitHub token 权限为 read，release job 单独授予 contents、pull-requests、actions 和 OIDC 权限。内置 token 创建的版本 PR 不会自动触发其他工作流，因此 release workflow 显式 dispatch `weapp-cli.yml` 验证该版本分支。受管模板保留可选 GitHub App 配置；无需为日常版本准备增加 PAT。
+
+Nightly 每日北京时间 02:00（UTC `0 18 * * *`）检查 main，已经发布过相同来源提交与 nightly 构建身份时跳过，使用 npm `snapshot-nightly` dist-tag。也可手动运行 `release.yml` 的 `mode=nightly`；`dry-run=true` 只检查。repoctl 在隔离目录设置快照版本、重建并验证包，不消费正式 change intent、不修改 main 版本、不移动 `latest`、不创建正式 Release。试用命令为 `npx weapp@snapshot-nightly`，需要安装依赖时使用 `npm install weapp@snapshot-nightly`。
 
 weapp CLI 单独由 `.github/workflows/weapp-cli.yml` 验证：目录与 Logo 构建、双语命令/只读诊断/脚手架适配单测、真实 PTY 恢复、后台浏览器实验室及独立 tarball。Node 18 的兼容任务只安装真实 tarball 并运行 plain ESM smoke，不运行要求新 Node 的 Vitest。CLI 开发与命令说明见 `packages/weapp/README.md`，新增项目能力应从中立 catalog 生成，不另写手工名单。交互默认六项由 `ecosystem=weapp` 筛选，查询和 JSON 保留十一项；真实 Logo 构建时由公共 assets 导出打包，运行时只允许固定资源表。大厅首帧后异步识别项目，识别期间 Enter 不排队、C 仍可创建；目录与模板驱动星图，创建成功展示实际包管理器和脚本；整个状态机保留单一输入所有者，20 FPS 上限同时约束按键更新，按行差分与背压避免输出积压。
 
@@ -68,26 +72,26 @@ CLI 命令与数据按需加载；QR core/SVG、semver、string-width、cross-sp
 
 [2026-10-15 CLI 启动与创建验收](weapp-startup-2026-10-15.md) 记录本机基线、依赖闭包、npx 对比、真实创建和平台验证范围。构建后用 `pnpm --filter weapp exec tsx scripts/benchmark-startup.ts` 测新进程帮助/版本/dry-run；真实 PTY 的首个可操作帧记录在 `packages/weapp/.cache/qa/terminal-metrics.json`。CI 检查行为与结构，不给不同机器设置同一毫秒硬门槛。
 
-CLI 发布与预检共用 `.github/workflows/publish-weapp.yml` 和 GitHub 托管 runner，`id-token: write` 仅授予其 publish job，不新增 environment。手动运行默认 `mode=preflight`、`tag=main`，tag 字段此时可为 Git ref。预检检查 manifest 的 weapp 身份、仓库、Node 18、public access、npm 版本未发布及 tarball 的运行时与实验室资源，安装并 smoke 测试同一 tarball 后上传产物。构建后本地 `pnpm --filter weapp preflight` 仅执行 npm metadata 与 pack dry-run，明确不检查 CI OIDC。
+本地 `pnpm --filter weapp preflight` 只验证包身份、Node 18、public access、资源清单、bundle policy 和构建版本；`--artifact <tarball>` 还会安装并 smoke 测试指定 tarball、确认验证前后 SHA256 不变。这些检查不请求发布凭据。npm registry 状态、认证、上传、确认与恢复由 repoctl 管理，不保留另一套手写 OIDC 或 tag 发布实现。
 
-CI 预检使用 GitHub ID token endpoint 显式请求 `audience=npm:registry.npmjs.org` JWT，再向 npm package OIDC exchange endpoint 发起无 body 的 POST；任何请求失败、非成功状态或缺少 token 均使工作流失败。JWT 与 token 掩码后丢弃，错误只报告阶段与 HTTP 状态，不写凭据文件、不把交换 token 传给发布命令。交换成功仅说明交换完成，不能单独证明允许发布；npm 页面上的 trusted publisher 配置与历史实际发布可辅助核对。`npm publish --dry-run` 无凭据时也可能仅警告，不作为认证验收。
+npm trusted publisher 必须配置 owner `weappjs`、repository `weapp.dev`、workflow filename `release.yml`、空 environment；release/nightly/audit 都通过同一文件和 GitHub 托管 runner 使用 OIDC。迁移前用旧发布身份补齐已有 0.3.0 的 npm、canonical tag 和 GitHub Release，再切换 publisher 身份和合并迁移。新身份可用 `gh workflow run release.yml --ref main -f mode=oidc-audit` 审计；`npm publish --dry-run` 不证明 OIDC 可用。异常恢复使用受管 `reconcile` 或 `publish-unpublished` 模式并明确 package/version/source-sha，不另行手工上传。
 
-合并版本 PR 后，正式发布使用 repoctl 的 canonical 标签 `weapp@<packages/weapp/package.json 的版本>`，指向该 PR 的合并提交；创建并发布同名 GitHub Release 才触发 npm 发布。旧 `weapp-v<version>` 仍接受用于兼容，但 repoctl 后续消费新 intent 前要求上一版本的 npm 包、canonical tag 和非 draft GitHub Release 均完成，因此新的自动版本流程应使用 canonical 名称。main 尚处于已发布基线时，npm 预检会按预期拒绝重复版本，应预检待发布的版本分支。
+网站也由 repoctl 管理。`repoctl-docs.yml` 的 main push 为 `web` 和 `open-source` 分别部署固定 preview；正式网站由成功 release record 触发，或明确选择已完成的 release ID 重试。正式站不会因普通 main push 更新。`repoctl-docs-deploy.yml` 保持 `docs-<site>-<channel>` 环境与同名、不可取消的并发组；Cloudflare 与 Pages 分开授予权限。每个站在隔离源码中通过边界、lint、类型、单测、构建验证和桌面/移动 E2E 后，部署同一产物并核对部署身份。
 
-只有明确 `mode=publish` 或 `release: published` 才执行 npm 发布。标签的解引用提交必须等于检出的 HEAD；工作流的 `GITHUB_REF` 必须为同一 `refs/tags/...`，`GITHUB_SHA` 也必须等于 HEAD，以免 provenance 记录手动 dispatch 的另一个来源提交。版本仍须未发布。发布同一验证过的 tarball，禁用 lifecycle scripts，npm 自行获取 trusted-publishing 凭据。预检用 `gh workflow run publish-weapp.yml --ref release/pnpm-version -f mode=preflight -f tag=release/pnpm-version`；只有获准发布并创建正确 tag 后，才用 `gh workflow run publish-weapp.yml --ref weapp@0.1.0 -f mode=publish -f tag=weapp@0.1.0`。仅手动 dispatch 发布 npm 时还须补齐 canonical GitHub Release，才能开始下一轮版本 PR。npm trusted publisher 应匹配 owner `weappjs`、repository `weapp.dev`、workflow filename `publish-weapp.yml` 与当前空 environment；不要为预检创建 release/tag 或调用实际 publish。
+商业正式站保留 Worker `weapp-dev`、`weapp.dev` 和 `www.weapp.dev` 以及现有 www Redirect Rule；固定预览使用独立 Worker `weapp-dev-preview`。开源正式站继续使用 GitHub Pages 和 `weapp.js.org`，固定预览使用 `weapp-open-source-preview`。预览产物包含 noindex、禁用生产统计、保留生产 canonical；Pages 正式产物继续包含 CNAME、兼容 `/weapp.dev/` 路径、不生成 `.nojekyll`。两个 preview Worker 先完成 main 预览部署，后续 PR 才能上传 Worker Version。
 
-Commercial CI 和 Open source CI 独立验证、部署和并发控制。各应用路径改动只触发自身流程；共享包、锁文件、根配置和边界检查工具变更触发两站。单站失败不阻塞另一站。按新的工作流检查名称更新 GitHub branch protection；路径过滤的工作流不应被设为对所有 PR 无条件必需的检查。
+Commercial CI 和 Open source CI 保留独立验证以及同仓 PR 的临时 Worker Version 预览。PR 构建完成后记录 site、PR head SHA、deployment ID，再执行 E2E；部署任务只下载并验证该产物，不重新构建。fork PR 只运行验证，不注入 Cloudflare 凭据。PR 关闭不会改变固定预览或正式流量。Cloudflare 凭据在对应 docs 环境中配置；PR 任务使用 repo-level 凭据。GitHub Pages 的 `pages: write`、`id-token: write` 只授予开源正式部署 job；其 JavaScript action 将 artifact 服务环境传给 repoctl，避免独立 shell 丢失上传上下文。
 
-商业站继续发布到 Worker weapp-dev，域名为 weapp.dev 和 www.weapp.dev。Cloudflare 凭据只注入商业部署任务；www 的现有 Redirect Rule 保留。PR 保留 Worker Version 预览。
+站点配置的 `releaseInputs` 除 `weapp` 本身外，也包含 CLI 打包所需的中立 catalog、Logo 与共享 UI 输入，以及根 `package.json`、锁文件、workspace 配置和 dependency patches。`patchPaths` 为空，尚不允许绕过正式发布追加文档修补提交。普通站点内容更新可先在 main preview 验收，正式上线绑定下一条已完成 release record。首条受管正式部署必须来自包含本次迁移配置、构建脚本和 adapter 的新版本 release record；补齐历史 0.3.0 发布只完成 npm 基线，不会把新部署代码加入历史源码。不要以旧 0.3.0 记录启动新网站部署，也不要修改旧 tag。双站互不导入，开源产物继续扫描商业文案、联系方式与私有资源。
 
-开源站使用 GitHub Pages，直接发布已构建的静态产物，不经过 Jekyll。产物保留 CNAME，不生成 .nojekyll，并改写相对资源链接以兼容 /weapp.dev/ 子路径；重复执行资源准备时会清理旧的 .nojekyll，产物验证也会拒绝该文件。Pages 发布权限仅出现在该部署任务。保留现有仓库 Pages 设置与域名申请，不通过此次代码变更迁移域名。
+上线前建立 `docs-web-preview`、`docs-web-stable`、`docs-open-source-preview`、`docs-open-source-stable` 四个 GitHub environment。正式环境继承原 production/github-pages 的审批与分支限制，保留或收紧已有规则；当前原 github-pages 仅允许 main。Cloudflare secrets 只配置到对应部署环境及同仓 PR 所需的仓库级入口，不向 fork PR 开放。环境缺失时不要依赖 workflow 自动创建无保护环境。
 
-每站仅在该站 lint、类型、单测、产物验证、桌面/移动 E2E 通过后发布。依赖边界检查阻止跨应用导入。开源验证同时扫描 HTML、JS、JSON、SVG 和文本资源，防止商业文案及联系方式进入产物。
+受管文件通过 `repo upgrade --dry-run` 检查三方合并，确认后 `repo upgrade --apply` 更新；保留 `.repoctl/baselines/root`，不将应用 CI 的本地定制覆盖成上游源码仓库工作流。受管目标仅包含 release 与两条 repoctl docs workflow。路径过滤的应用 CI 不应设为所有 PR 无条件必需的检查。
 
 ## 发布与回滚验收
 
-每次通过验证的产物保存 30 天，名称分别为 web-dist 和 open-source-dist。发布前记录上一成功部署对应的运行号与提交；若接近保留期，先下载该运行的产物备份，再发布。
+PR 验证产物仍为 web-dist 和 open-source-dist；受管部署产物名称包含 site、channel、run ID 与 attempt，保存 30 天，测试和部署证据保存 7 天。发布前记录上一成功部署对应的运行号与提交；若接近保留期，先下载该运行的产物备份，再发布。
 
-商业站回滚可使用 Cloudflare 中上一 Worker 版本，或下载上一成功运行的 web-dist，放到 apps/web/dist 后直接部署该产物。不要先重新构建覆盖回滚文件。开源站回滚使用上一成功运行的 open-source-dist 重新发布到 Pages，或回退相关应用提交并由该站 CI 发布。两站可分别回滚；共享包回退前需评估两站影响。
+同一条失败或未完成的部署可按其 release ID 重试；repoctl 6 不允许较旧来源覆盖已完成的新来源，因此选择旧 release record 不能用于常规回滚。需要恢复旧行为时，在 main 提交 forward revert 并完成新的稳定发布，保留来源单调前进。紧急情况下可在 Cloudflare 回滚至上一 Worker Version，或把已归档的开源产物重新部署到 Pages；这属于平台直接恢复，必须记录实际版本、产物身份及与 repoctl 状态的差异，随后用新的稳定发布重新对齐。不要重新构建覆盖待回滚文件。两站可分别恢复；共享包回退前评估两站影响。
 
 上线后核对中英文首页、项目目录、一个确认服务项目与规划中项目、隐私页、sitemap、静态资源和统计请求；开源站额外验证 /weapp.dev/ 子路径及历史跳转，商业站额外验证联系方式与赞助页面。只有真实部署后的检查通过，才能报告线上验收完成。
diff --git a/docs/repoctl-migration-2026-10-23.md b/docs/repoctl-migration-2026-10-23.md
new file mode 100644
index 00000000..abe96384
--- /dev/null
+++ b/docs/repoctl-migration-2026-10-23.md
@@ -0,0 +1,92 @@
+# repoctl 6.0.1 迁移与上线记录
+
+本次迁移统一 CLI 发布和双站部署，继续使用 pnpm 原生 versioning。开发与发布工具链使用 Node 24.22.1，发布的 `weapp` CLI 仍支持 Node 18。
+
+本文记录迁移过程中的实际验证与外部状态。代码验证、发布身份配置和真实线上验收分别记录；待完成项不能视为已经上线。
+
+## 发布与托管约定
+
+- `release.yml` 管理版本 PR、正式 npm 发布、canonical tag、GitHub Release 和 release record。版本 PR 保留人工审核与合并。
+- Nightly 每日北京时间 02:00（UTC `0 18 * * *`）检查 main，保留手动入口；npm dist-tag 为 `snapshot-nightly`，安装命令为 `npx weapp@snapshot-nightly`。
+- 两站 main 预览使用精确源码 SHA，同仓 PR 保留各自预览 Worker 的 version alias；公开预览链接指向固定版本，绑定该次 PR head SHA。fork PR 仅验证，无部署凭据。
+- 正式网站只接受完整稳定发布记录和对应源码、锁文件。`releaseInputs` 显式包含 CLI 所需的共享 catalog、Logo、构建输入，以及根 manifest、锁文件、workspace 配置和 dependency patches。每站独立构建、验证和部署同一产物，`patchPaths: []`。
+
+| 站点          | main / PR 预览 Worker       | 正式托管                             |
+| ------------- | --------------------------- | ------------------------------------ |
+| `web`         | `weapp-dev-preview`         | `weapp-dev`，`https://weapp.dev`     |
+| `open-source` | `weapp-open-source-preview` | GitHub Pages，`https://weapp.js.org` |
+
+预览包含中英文提示、禁止索引并保持生产统计禁用。正式 canonical、Pages CNAME、`/weapp.dev/` 子路径兼容和双应用内容边界继续由构建与浏览器检查保护。
+
+## 已完成的外部变更
+
+历史 `weapp@0.3.0` 已从原始版本提交 `1fe201176b55f965e76bc81941a02edaed57553c` 补齐发布，未改写原 ledger：
+
+| 验证或变更                            | 结果与证据                                                                                                                                                                                                                                                                                                                             |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| 原提交包预检与旧身份 OIDC 交换        | [预检运行 39936937257](https://github.com/weappjs/weapp.dev/actions/runs/39936937257) 成功                                                                                                                                                                                                                                             |
+| 以原 `publish-weapp.yml` 身份发布 npm | [发布运行 39938924495](https://github.com/weappjs/weapp.dev/actions/runs/39938924495) 成功，运行 ref 为 `weapp@0.3.0`                                                                                                                                                                                                                  |
+| canonical tag 与 GitHub Release       | [weapp@0.3.0](https://github.com/weappjs/weapp.dev/releases/tag/weapp%400.3.0)，指向原始版本提交                                                                                                                                                                                                                                       |
+| npm 独立安装                          | `npm exec --yes --package=weapp@0.3.0 -- weapp --version` 返回 `0.3.0`                                                                                                                                                                                                                                                                 |
+| 旧发布工作流                          | `publish-weapp.yml` 已停用，避免补建 GitHub Release 时重复发布                                                                                                                                                                                                                                                                         |
+| GitHub 部署环境                       | 四个 `docs-<site>-<channel>` 环境已创建，均仅允许 main 分支                                                                                                                                                                                                                                                                            |
+| Cloudflare 账号与部署凭据             | 仓库变量 `CLOUDFLARE_ACCOUNT_ID` 已设置；组织级 `CLOUDFLARE_ACCOUNT_ID` 和 `CLOUDFLARE_API_TOKEN` 已继承，PR 部署请求得到 Cloudflare API 响应。复用现有组织凭据，无需创建新 token；未提交的创建表单已关闭                                                                                                                              |
+| Cloudflare 旧 Git 构建                | 生产 Worker `weapp-dev` 的旧 `sonofmagic/weapp.dev` 构建已执行 Disable builds 并保存；截图 `.cache/repoctl-migration/cloudflare-builds-disabled.png`                                                                                                                                                                                   |
+| Cloudflare 生产版本复核               | `.cache/repoctl-migration/production-cloudflare-after.json` 确认 `unchanged: true`，生产 Worker 版本与流量分配未变                                                                                                                                                                                                                     |
+| CLI GitHub CI                         | [运行 39943800403](https://github.com/weappjs/weapp.dev/actions/runs/39943800403) 对 `818384680a37302b8a7351c1271754d41ae031d1` 成功；Linux Node 18/22、Windows Node 18/24、macOS Node 24 五项真实 tarball 安装均通过                                                                                                                  |
+| web GitHub CI                         | [验证 job 120381392388](https://github.com/weappjs/weapp.dev/actions/runs/39943800404/job/120381392388) 成功，E2E 为 539 项通过、61 项跳过；证据 `ci-web-verify.log`。随后预览部署因 `weapp-dev-preview` 尚未初始化停止                                                                                                                |
+| open-source GitHub CI                 | [验证 job 120381392718](https://github.com/weappjs/weapp.dev/actions/runs/39943800530/job/120381392718) 成功，E2E 为 495 项通过、61 项跳过；证据 `ci-open-source-verify.log`。随后[部署 job 120386447843](https://github.com/weappjs/weapp.dev/actions/runs/39943800530/job/120386447843) 因预览 Worker 尚未初始化失败，部署凭据已注入 |
+
+补齐 0.3.0 只建立 npm 发布基线。它的原始源码没有本次网站部署适配器，不能作为两站首条受管正式部署记录。现有 `.changeset/thin-tables-boil.md` minor intent 保留；最终只读 release plan 为 `ready`、无 blocker，明确计划将 `weapp` 从 0.3.0 升到 0.4.0（`.cache/repoctl-migration/release-plan-final.json`）。此计划没有执行升版或合并版本 PR。
+
+Cloudflare 旧 Git 账号虽已断连，原构建入口仍未禁用，因此本次明确关闭了该入口。此设置变更没有向生产 Worker 部署新版本，当前正式站内容保持原状。
+
+## 本地验证
+
+以下证据保存在本次工作目录的 `.cache/repoctl-migration/`，不包含发布凭据。
+
+| 范围                           | 已验证结果                                                      | 证据                                             |
+| ------------------------------ | --------------------------------------------------------------- | ------------------------------------------------ |
+| repoctl 配置与升级幂等         | 配置有效；四个受管资产均 `identical`，无 blocker                | `config-final.json`、`upgrade-final.json`        |
+| repoctl doctor                 | 34 pass、4 warn、0 fail                                         | `doctor-final.json`                              |
+| 根工具与发布生命周期           | lint、包边界与 65 项测试通过                                    | `root-check-final.log`                           |
+| 工作区 lint、样式、类型与单测  | 最终复验 19/19 个任务通过，CLI lab 保留 4 条非错误 lint warning | `workspace-check-final.log`                      |
+| CLI 后台浏览器                 | 通过，含桌面、移动、减少动态效果与静态降级                      | `cli-browser.log`                                |
+| CLI 真实终端                   | 28 个 PTY 场景通过，终端恢复正常                                | `cli-pty.log`                                    |
+| CLI tarball                    | 独立安装与 artifact smoke 通过                                  | `cli-pack.log`                                   |
+| CLI 发布前包检查               | 身份、资源、bundle、构建版本检查通过                            | `cli-preflight.log`                              |
+| Nightly 隔离制品准备           | `prepared`、`published: false`，consumer smoke 通过             | `nightly/registry-fixed/validation-summary.json` |
+| web 预览部署预演               | Wrangler `--dry-run` 通过，无真实上传                           | `wrangler-web-preview-dry-run.log`               |
+| open-source 预览部署预演       | Wrangler `--dry-run` 通过，无真实上传                           | `wrangler-open-source-preview-dry-run.log`       |
+| web 正式产物浏览器全量         | 535 项通过、65 项跳过                                           | `web-stable-e2e.log`                             |
+| open-source 正式产物构建       | 45 项必需输出、38 个页面、SEO 资源和全部内部链接通过            | `open-source-stable-build.log`                   |
+| open-source 正式产物浏览器全量 | 491 项通过、65 项跳过                                           | `open-source-stable-e2e.log`                     |
+
+Doctor 的四条 warning 分别为三个受管工作流的本地定制，以及 nightly schedule 的触发与路由同步提示。升级复检保留这些本地变更，没有待写入的受管资产；nightly 的实际调度仍需在线工作流验证。
+
+Nightly 验证使用独立源码快照，生成的 tarball manifest、`dist/data/meta.json` 与独立安装后的 `weapp --version` 完全一致。原仓库 manifest、intent、ledger、changelog、tags 和 HEAD 未改变。快照 tarball 的 SHA256 为 `49d1d88c87fc36e0522f04da5c7a3e368069efe9821cdc285e36bf52025d75bb`；临时源码与安装目录已清理。此项验证没有向 npm 发布 nightly 包。
+
+真实预演发现并修复了两个发布入口问题：源码归档没有 `.git` 时跳过 Lefthook 安装，同时保持开发 checkout 的真实安装失败可见；包身份校验接受 npm 官方 registry 根 URL 有无尾斜杠的等价形式，仍拒绝其他来源或额外 URL 内容。
+
+部署适配器回归覆盖 32 项测试，包括 PR 预览公开链接绑定固定 Worker version、Pages 回执写入响应丢失后回读确认，以及同一 workflow run 的 artifact 名称使用 UUID 防止碰撞。根检查日志中的模拟发布中断消息来自恢复测试，最终 65 项测试全部通过。
+
+Web 预览首次全量测试报告 534 项通过、3 项失败。失败定位到提示条占用首屏空间后的几何布局，以及测试重挂载图表后未恢复其懒加载可见条件。修复按提示条实际高度扣除 hero 可用空间，并让 caption 根据实际 stage 容器高度响应；重挂载测试先恢复图表可见性，以遵守原有懒加载边界。
+
+修复后的 hero layout 与 publication channel 复验为 56 项通过、2 项跳过（`web-preview-layout-final.log`）；图表重挂载和预览统计隔离复验为 4 项通过（`web-preview-remaining.log`）。首次全量运行中发现的三项失败均已通过针对性复验，没有已知未解决失败。
+
+开源站预览首次全量测试为 491 项通过、61 项跳过、4 项失败（`open-source-preview-e2e.log`）。四项失败来自桌面和移动端复用的旧 SEO 断言，没有区分预览的 noindex 与正式站索引规则。断言按发布渠道修正后，四项定向复验全部通过（`open-source-preview-remaining.log`）。两站正式产物本地验证已通过；两站远程预览 E2E 均已通过，真实线上验收尚未完成。
+
+## 待完成的上线步骤
+
+| 步骤                                                       | 当前状态                                                                                                                                       | 完成时应记录                                               |
+| ---------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
+| npm Trusted Publisher 切换为 `release.yml`、空 environment | 新连接保存再次要求 npm 二次验证；尚未确认生效                                                                                                  | 新连接状态与 OIDC audit 运行链接                           |
+| 合并迁移并启用受管工作流                                   | [迁移草稿 PR #20](https://github.com/weappjs/weapp.dev/pull/20) 已创建；CLI 和两站验证均通过，待 npm 身份保存完成后合并激活                    | 合并 SHA 与最终检查结果                                    |
+| 两站 main 预览初始化                                       | 待合并后先初始化两个 Worker；两站 PR 部署均按该前置条件停止，没有上传预览版本                                                                  | 各站精确 source SHA、version ID 与预览 URL                 |
+| 同仓 PR 与 fork 检查                                       | web / open-source 预览 E2E 分别 539 / 495 项通过；PR 部署待 main 初始化后重试；fork 凭据隔离已由事件校验和工作流条件覆盖，尚未运行真实 fork PR | PR 运行链接、预览 URL、fork 无凭据结果                     |
+| Nightly 真实发布与安装                                     | 待执行                                                                                                                                         | 发布版本、安装结果、重复来源跳过及 `latest` 保持不变的证据 |
+| 重复正式自动部署排查                                       | Cloudflare 旧 Git 构建已禁用；旧 main 正式部署 workflow 待随迁移关闭                                                                           | 新工作流启用后核对仅保留受管正式部署入口                   |
+| 下一版本 PR                                                | release plan 已确认 0.4.0 minor；待 repoctl 创建版本 PR                                                                                        | PR 链接与人工审核合并记录                                  |
+| 首次受管正式网站部署                                       | 等待人工合并版本 PR 后的完整稳定发布                                                                                                           | release ID、两站独立部署回执和线上验收结果                 |
+
+两个正式站在首条受管稳定部署完成前继续提供原有内容。上线后分别核对中英文页面、静态资源、canonical、统计隔离与预览禁止索引；开源站额外检查 Pages 子路径和历史跳转。失败重试、未知部署结果处理与两站独立恢复规则见[维护手册](maintenance.md#发布与回滚验收)和[部署适配器说明](../scripts/docs-deployment/README.md)。
diff --git a/lefthook.yml b/lefthook.yml
new file mode 100644
index 00000000..de3013e6
--- /dev/null
+++ b/lefthook.yml
@@ -0,0 +1,38 @@
+# repoctl-managed: hooks/v1
+glob_matcher: doublestar
+
+pre-commit:
+  piped: true
+  jobs:
+    - name: eslint
+      glob: '**/*.{js,jsx,mjs,ts,tsx,mts,cts,vue,astro,json,md,mdx,html,yml,yaml}'
+      # Avoid Lefthook 2.2.2's Windows shell quoting for apostrophes in paths.
+      # Keep these Git pathspecs aligned with glob above.
+      run: >-
+        git diff --cached --name-only --diff-filter=ACMR -z --
+        '*.js' '*.jsx' '*.mjs' '*.ts' '*.tsx' '*.mts' '*.cts' '*.vue' '*.astro'
+        '*.json' '*.md' '*.mdx' '*.html' '*.yml' '*.yaml'
+        | xargs -0 -r pnpm exec eslint --fix --
+      stage_fixed: true
+    - name: stylelint
+      glob: '**/*.{vue,css,scss,sass,less}'
+      run: >-
+        git diff --cached --name-only --diff-filter=ACMR -z --
+        '*.vue' '*.css' '*.scss' '*.sass' '*.less'
+        | xargs -0 -r pnpm exec stylelint --fix --allow-empty-input --
+      stage_fixed: true
+    - name: typecheck
+      run: pnpm exec repo verify staged-typecheck
+
+commit-msg:
+  jobs:
+    - name: commitlint
+      run: pnpm exec repo verify commit-msg "{1}"
+
+pre-push:
+  piped: true
+  jobs:
+    - name: lint
+      run: pnpm lint
+    - name: typecheck
+      run: pnpm typecheck
diff --git a/lint-staged.config.js b/lint-staged.config.js
deleted file mode 100644
index 706145ff..00000000
--- a/lint-staged.config.js
+++ /dev/null
@@ -1,3 +0,0 @@
-import { defineLintStagedConfig } from 'repoctl/tooling'
-
-export default await defineLintStagedConfig()
diff --git a/package.json b/package.json
index cdcf6113..bcd0bdce 100644
--- a/package.json
+++ b/package.json
@@ -5,14 +5,14 @@
   "private": true,
   "packageManager": "pnpm@12.14.0",
   "engines": {
-    "node": "^22.22.1 || >=24.11.0"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   },
   "scripts": {
-    "build": "turbo run build",
+    "build": "turbo run build && pnpm --filter weapp preflight",
     "build:cloudflare": "pnpm --filter @weapp-io/web build",
     "check": "pnpm check:boundaries && turbo run lint lint:styles check test",
     "dev": "turbo run dev --filter=@weapp-io/web",
-    "lint": "turbo run lint lint:styles",
+    "lint": "pnpm lint:tooling && turbo run lint lint:styles",
     "metrics": "pnpm --filter @weapp-io/project-catalog metrics",
     "metrics:sync": "pnpm --filter @weapp-io/project-catalog metrics:sync",
     "preview": "pnpm --filter @weapp-io/web preview",
@@ -23,25 +23,35 @@
     "release:plan": "repo release plan",
     "release:prepare": "repo release ci --mode prepare",
     "release:verify": "pnpm check:boundaries && pnpm --filter weapp check && pnpm --filter weapp lint && pnpm --filter weapp lint:styles && pnpm --filter weapp test && pnpm --filter weapp test:pack",
-    "release:build": "pnpm --filter weapp build",
+    "release:build": "pnpm --filter weapp build && pnpm --filter weapp preflight",
     "test": "turbo run test",
-    "prepare": "husky",
+    "prepare": "node scripts/install-hooks.mjs",
     "typecheck": "turbo run check",
     "build:pages": "pnpm --filter @weapp-io/open-source build",
     "dev:pages": "pnpm --filter @weapp-io/open-source dev",
     "preview:pages": "pnpm --filter @weapp-io/open-source preview",
-    "check:boundaries": "node scripts/check-boundaries.mjs && vitest run --config scripts/vitest.config.ts"
+    "check:boundaries": "pnpm lint:tooling && node scripts/check-boundaries.mjs && vitest run --config scripts/vitest.config.ts",
+    "release:audit": "repo release ci --mode oidc-audit",
+    "docs:web:build": "node scripts/docs-build.mjs web",
+    "docs:open-source:build": "node scripts/docs-build.mjs open-source",
+    "docs:deploy": "node scripts/docs-deployment/cli.mjs managed",
+    "docs:preview:pr:web": "node scripts/docs-deployment/cli.mjs pr web",
+    "docs:preview:pr:open-source": "node scripts/docs-deployment/cli.mjs pr open-source",
+    "docs:test": "vitest run --config scripts/vitest.config.ts scripts/docs-deployment scripts/docs-build.test.mjs",
+    "lint:tooling": "eslint scripts repoctl.config.ts .github/workflows"
   },
   "devDependencies": {
+    "@actions/artifact": "6.3.1",
+    "@actions/core": "3.0.1",
     "@commitlint/cli": "21.2.4",
     "@vitest/coverage-v8": "5.0.5",
     "eslint": "10.13.0",
-    "husky": "9.1.7",
-    "lint-staged": "17.6.0",
-    "repoctl": "5.10.3",
+    "lefthook": "2.2.2",
+    "repoctl": "6.0.1",
     "stylelint": "17.16.0",
     "turbo": "2.11.10",
     "typescript": "6.0.3",
-    "vitest": "5.0.5"
+    "vitest": "5.0.5",
+    "yaml": "2.9.1"
   }
 }
diff --git a/packages/site-ui/src/styles/hero.css b/packages/site-ui/src/styles/hero.css
index 8ec6732a..5c6bfa84 100644
--- a/packages/site-ui/src/styles/hero.css
+++ b/packages/site-ui/src/styles/hero.css
@@ -8,11 +8,12 @@
 .home-hero-screen {
   position: relative;
   isolation: isolate;
+  container: hero-stage / size;
   display: block;
   height: var(--hero-stage-height);
   min-height: var(--hero-stage-height);
 
-  --hero-stage-height: max(22rem, calc(100svh - 64px));
+  --hero-stage-height: max(22rem, calc(100svh - 64px - var(--site-notice-height, 0px)));
   --hero-title-size: clamp(4.25rem, 14vw, 11rem);
   --hero-center-y: 50%;
   --hero-brand-height: var(--hero-stage-height);
@@ -497,7 +498,7 @@
 }
 @media (max-width: 900px) {
   .home-hero-screen {
-    --hero-stage-height: max(22rem, calc(100svh - 58px));
+    --hero-stage-height: max(22rem, calc(100svh - 58px - var(--site-notice-height, 0px)));
     --orbit-rx: 38vw;
     --orbit-ry: 28svh;
   }
@@ -546,7 +547,7 @@
 }
 @media (min-width: 1024px) {
   .home-hero-screen {
-    --hero-stage-height: max(26rem, calc(100svh - 64px));
+    --hero-stage-height: max(26rem, calc(100svh - 64px - var(--site-notice-height, 0px)));
     --hero-center-y: calc(50% - 2rem);
     --hero-brand-height: calc(var(--hero-stage-height) - 4rem);
     --hero-title-size: clamp(4.25rem, 10vw, 9rem);
@@ -653,19 +654,21 @@
   }
 }
 
-/* Short stages keep the caption in the reserved strip after assembly too. */
-@media (min-width: 1024px) and (max-height: 700px) {
-  .home-hero-screen .home-hero-spotlight:not([hidden]) {
-    top: auto;
-    bottom: 16px;
-    left: 24px;
-    display: flex;
-    gap: 12px;
-    align-items: baseline;
-    width: max-content;
-    max-width: min(36rem, calc(100% - 160px));
-    text-align: left;
-    translate: none;
+/* Use the actual stage height: preview notices can reduce it on tall viewports. */
+@media (min-width: 1024px) {
+  @container hero-stage (max-height: 704px) {
+    .home-hero-screen .home-hero-spotlight:not([hidden]) {
+      top: auto;
+      bottom: 16px;
+      left: 24px;
+      display: flex;
+      gap: 12px;
+      align-items: baseline;
+      width: max-content;
+      max-width: min(36rem, calc(100% - 160px));
+      text-align: left;
+      translate: none;
+    }
   }
 }
 @media (prefers-reduced-motion: no-preference) {
diff --git a/packages/weapp/README.md b/packages/weapp/README.md
index e537f1be..e3b76687 100644
--- a/packages/weapp/README.md
+++ b/packages/weapp/README.md
@@ -116,23 +116,25 @@ node packages/weapp/dist/cli.js
 
 The CLI, lab, tests, and validation scripts are written in strict TypeScript. `tsdown` bundles the Node CLI for Node 18 and the browser lab separately; the artifact smoke script is also compiled so it can run directly on Node 18. `check` validates the Node/tooling and browser types. Static catalog snapshots, logos, fonts, and licenses are copied alongside the bundles.
 
-The published tarball contains runtime JavaScript, an embedded catalog and Logo point cloud, the lab's licensed assets, and `dist/THIRD_PARTY_NOTICES.txt` for bundled libraries. Commands and their data load on demand. Pure JavaScript tools are bundled; `open@10` remains an installed dependency to preserve its platform resources. The package does not depend on the monorepo, Astro, or either website. `test:pack` installs the actual tarball in a temporary directory and runs artifact smoke checks. Release tags use `weapp@<version>`; legacy `weapp-v<version>` tags remain accepted.
+The published tarball contains runtime JavaScript, an embedded catalog and Logo point cloud, the lab's licensed assets, and `dist/THIRD_PARTY_NOTICES.txt` for bundled libraries. Commands and their data load on demand. Pure JavaScript tools are bundled; `open@10` remains an installed dependency to preserve its platform resources. The package does not depend on the monorepo, Astro, or either website. `test:pack` installs the actual tarball in a temporary directory and runs artifact smoke checks. Canonical release tags use `weapp@<version>`.
 
-Versions and changelogs are prepared by repoctl using pnpm's native change intents. Record `pnpm change weapp --bump patch --summary "Describe the fix"` on your development branch, commit the intent, and merge it into `main`. Use `minor` for new features and `pnpm release:plan --json` for a read-only preview. The Version Packages workflow creates or updates `release/pnpm-version`, then runs CLI CI and OIDC preflight on that PR. Private workspaces are excluded explicitly. The release plan determines the next version from the current baseline and pending intents; version PRs are reviewed and merged separately from publication.
+Versions, changelogs, npm publication, and GitHub Releases are managed by repoctl 6.0.1 using pnpm's native change intents. Record `pnpm change weapp --bump patch --summary "Describe the fix"` on your development branch, commit the intent, and merge it into `main`. Use `minor` for new features and `pnpm release:plan --json` for a read-only preview. The managed `release.yml` creates or updates `release/pnpm-version` and explicitly runs CLI CI on the version PR. Review and merge that PR; the next release workflow publishes the stable package, confirms it in npm, and finalizes the canonical tag, GitHub Release, and release record. Private workspaces remain excluded.
 
-## Release preflight
+## Package validation and nightly releases
 
-After building, `pnpm --filter weapp preflight` checks package identity, Node 18 support, public access, the unpublished npm version, and the pack dry-run's resources. This local check does **not** check CI OIDC or prove permission to publish.
+After building, `pnpm --filter weapp preflight` checks package identity, Node 18 support, public access, resources, bundled dependencies, and the built CLI version. `preflight --artifact <tarball>` additionally installs and smoke-tests that exact tarball and verifies that its SHA256 stays unchanged. These package checks do not request publishing credentials; repoctl owns registry checks and publication.
 
-The `publish-weapp.yml` manual workflow defaults to `mode=preflight`, `tag=main`. On a GitHub-hosted runner it tests and installs one exact tarball, validates its manifest and resources, and explicitly requests a GitHub JWT for `npm:registry.npmjs.org` before exchanging it with npm. Missing credentials or a failed exchange stop the run. The JWT and exchange token are masked, never saved or passed to `npm publish`, and the run uploads the validated artifact without publishing. A successful exchange verifies that exchange only; it does not independently prove publishing permission.
+Nightly runs every day at 02:00 Asia/Shanghai and skips an already-published source commit and nightly build identity. It publishes an isolated main snapshot under the `snapshot-nightly` npm tag without consuming stable change intents, changing `latest`, or creating stable GitHub Releases. Try it with `npx weapp@snapshot-nightly`. Building after version selection keeps the manifest and CLI version consistent.
 
-After merging the version PR, publish a GitHub Release named `weapp@<version>` with its tag pointing to the merge commit. This triggers the existing publishing workflow. An explicit `mode=publish` dispatch from that tag remains available; repoctl requires the canonical tag and GitHub Release as well as the npm version before preparing the next release. The workflow's GitHub ref, provenance commit, checked-out commit, and resolved tag commit must agree, and the version must still be unpublished. Publication uses the validated tarball with lifecycle scripts disabled and npm's own trusted-publishing authentication. The npm trusted publisher must match `weappjs/weapp.dev`, workflow filename `publish-weapp.yml`, and the workflow's environment (currently empty). `npm publish --dry-run` is not an OIDC authentication check.
+The npm trusted publisher must match `weappjs/weapp.dev`, workflow filename `release.yml`, and an empty environment. Stable, nightly, and OIDC audit use that workflow on GitHub-hosted runners. `npm publish --dry-run` is not an OIDC authentication check. The two websites deploy fixed previews from main and production from a completed stable release record.
 
 ```bash
-# Validate the prepared version PR without publishing:
-gh workflow run publish-weapp.yml --ref release/pnpm-version -f mode=preflight -f tag=release/pnpm-version
-# Only after authorizing publication and creating the matching release tag:
-gh workflow run publish-weapp.yml --ref weapp@0.1.0 -f mode=publish -f tag=weapp@0.1.0
+# Inspect the planned release without publishing:
+pnpm release:plan --json
+# Audit the configured npm trusted publisher without publishing:
+gh workflow run release.yml --ref main -f mode=oidc-audit
+# Inspect nightly source selection without uploading packages:
+gh workflow run release.yml --ref main -f mode=nightly -f dry-run=true
 ```
 
 [Website](https://weapp.js.org/) · [Projects](https://weapp.js.org/en/projects/) · [GitHub](https://github.com/weappjs) · [Issues](https://github.com/weappjs/weapp.dev/issues)
@@ -183,11 +185,13 @@ npx weapp palette '#07c160' --output colors.css --format css
 
 开发代码、实验室、测试和验收脚本统一使用严格 TypeScript，`pnpm --filter weapp check` 检查 Node／工具脚本和浏览器类型。`tsdown` 分别打包 Node 18 CLI、浏览器实验室及可直接在 Node 18 执行的 artifact smoke。运行 `pnpm --filter weapp build` 后可执行 `node packages/weapp/dist/cli.js`；npm 包只交付 JavaScript bundles 与目录、Logo、字体和许可证等静态资源。
 
-构建后执行 `pnpm --filter weapp preflight` 可本地检查包身份、Node 18、公开访问、版本未发布和打包资源；它不会检查 CI OIDC，也不证明发布权限。`publish-weapp.yml` 手动运行默认 `mode=preflight`、`tag=main`：在 GitHub 托管 runner 上安装并测试同一 tarball，显式请求 GitHub JWT 并调用 npm OIDC exchange。凭据缺失或 exchange 失败即终止；JWT 与 token 仅掩码后丢弃，不落盘、不交给发布命令。交换成功只证明该交换完成，预检上传验证后的 tarball，整个模式不会发布 npm 包。
+构建后执行 `pnpm --filter weapp preflight` 检查包身份、Node 18、公开访问、资源清单、依赖边界和 CLI 构建版本；加 `--artifact <tarball>` 会安装并 smoke 测试指定 tarball，确认 SHA256 未变。该检查不请求发布凭据，registry 状态与实际发布统一交给 repoctl。
 
-版本与 changelog 由 repoctl 和 pnpm 原生 change intents 管理。在开发分支运行 `pnpm change weapp --bump patch --summary "修复说明"`，提交 intent 并合入 main；新功能使用 `minor`，`pnpm release:plan --json` 可只读预览。Version Packages 工作流维护 `release/pnpm-version` → main 的版本 PR，主动运行该分支的 CLI CI 和 OIDC 预检，明确排除私有 workspace。下一版本以当前基线与待处理 intent 的 release plan 为准；main 仍为已发布基线时，应预检版本分支。版本 PR 需要单独审查、合并，不会自动发布。
+版本与 changelog 由 repoctl 6.0.1 和 pnpm 原生 change intents 管理。开发分支运行 `pnpm change weapp --bump patch --summary "修复说明"`，新功能使用 `minor`；`pnpm release:plan --json` 可只读预览。受管 `release.yml` 维护 `release/pnpm-version` → main 的版本 PR，并显式运行该分支 CLI CI。版本 PR 经审查、合并后，后续 main workflow 发布 npm、确认 registry 状态，再完成 canonical tag、GitHub Release 和 release record；私有 workspace 不参与发布。
 
-合并版本 PR 后，发布 `weapp@<version>` 的 GitHub Release，标签指向合并提交，再由既有工作流发布 npm。旧 `weapp-v<version>` 标签保持兼容；新的自动版本流程使用 canonical 名称，因为 repoctl 消费下一批 intent 前要求上一版本的 npm、canonical tag 和 GitHub Release 完整。手动发布仍须明确 `mode=publish`，使用 `--ref weapp@0.1.0 -f mode=publish -f tag=weapp@0.1.0`；仅手动发布 npm 时还须补齐 canonical Release。GitHub ref、provenance SHA、检出的 HEAD 与 tag 对应提交必须一致。npm trusted publisher 应匹配 `weappjs/weapp.dev`、`publish-weapp.yml` 及当前空 environment。`npm publish --dry-run` 不能作为 OIDC 认证证明。
+Nightly 每日北京时间 02:00 检查 main，相同来源提交与构建身份已经发布时跳过，发布使用 `snapshot-nightly` dist-tag。使用 `npx weapp@snapshot-nightly` 试用。快照在隔离目录中改版本、重建与验证，不消费正式 intent、不修改 `latest`、不创建正式 Release；`dist/data/meta.json` 必须与 manifest 版本一致。手动预检用 `gh workflow run release.yml --ref main -f mode=nightly -f dry-run=true`。
+
+npm trusted publisher 应匹配 `weappjs/weapp.dev`、`release.yml` 与空 environment。正式发布、nightly、`mode=oidc-audit` 共用该工作流身份和 GitHub 托管 runner。双站 main 更新固定预览，正式网站绑定完成的 stable release record。`npm publish --dry-run` 不能作为 OIDC 认证证明。
 
 <!-- catalog:zh-CN:start -->
 
diff --git a/packages/weapp/scripts/check-release.ts b/packages/weapp/scripts/check-release.ts
deleted file mode 100644
index 657e9808..00000000
--- a/packages/weapp/scripts/check-release.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { spawnSync } from 'node:child_process'
-import { readFile } from 'node:fs/promises'
-import process from 'node:process'
-import { PreflightError, validateManifest, validateReleaseTag } from './preflight.js'
-
-const manifest = validateManifest(JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8')) as unknown)
-const tag = validateReleaseTag(manifest, process.env, (args) => {
-  const result = spawnSync('git', args, { encoding: 'utf8', timeout: 10_000 })
-  if (result.status !== 0) {
-    throw new PreflightError('release', 'release tag is unavailable')
-  }
-  return result.stdout
-})
-process.stdout.write(`Release tag verified: ${tag}\n`)
diff --git a/packages/weapp/scripts/preflight.ts b/packages/weapp/scripts/preflight.ts
index 14bb538c..0716ae90 100644
--- a/packages/weapp/scripts/preflight.ts
+++ b/packages/weapp/scripts/preflight.ts
@@ -13,35 +13,15 @@ import { bundleReportPath, noticesPath, validatePublishedBundle } from './bundle
 
 const registry = 'https://registry.npmjs.org'
 const repository = 'weappjs/weapp.dev'
-const workflow = '.github/workflows/publish-weapp.yml'
 const packageRoot = fileURLToPath(new URL('../', import.meta.url))
 export interface PackageIdentity {
   name: 'weapp'
   version: string
 }
-export interface PreflightResponse {
-  ok: boolean
-  status: number
-  json: () => Promise<unknown>
-}
-export interface PreflightRequest {
-  method?: string
-  headers?: Record<string, string>
-  signal?: AbortSignal
-}
-export type PreflightFetcher = (url: string, init: PreflightRequest) => Promise<PreflightResponse>
-export interface OidcOptions {
-  env: NodeJS.ProcessEnv
-  name?: string
-  fetcher?: PreflightFetcher
-  mask?: (value: string) => unknown
-}
 export interface PreflightOptions {
   argv?: string[]
   env?: NodeJS.ProcessEnv
-  fetcher?: PreflightFetcher
   log?: (message: string) => unknown
-  mask?: (value: string) => unknown
 }
 export const requiredPaths = Object.freeze([
   'package.json',
@@ -121,8 +101,9 @@ export function validateManifest(manifest: unknown): PackageIdentity {
     'publication access must be public',
   )
   requireCheck(
-    !manifest.publishConfig.registry
-    || manifest.publishConfig.registry === registry,
+    manifest.publishConfig.registry === undefined
+    || manifest.publishConfig.registry === registry
+    || manifest.publishConfig.registry === `${registry}/`,
     stage,
     'publication registry must be npmjs.org',
   )
@@ -204,143 +185,13 @@ export function validatePaths(paths: unknown): void {
   )
 }
 
-export function validateRegistryMetadata(metadata: unknown, manifest: PackageIdentity): void {
-  requireCheck(
-    isRecord(metadata)
-    && metadata.name === manifest.name
-    && isRecord(metadata.versions),
-    'metadata',
-    'registry package identity or versions are invalid',
-  )
-  requireCheck(
-    !Object.hasOwn(metadata.versions, manifest.version),
-    'metadata',
-    'this version is already published',
-  )
-}
-
-export function validateCiIdentity(env: NodeJS.ProcessEnv): void {
-  requireCheck(
-    env.GITHUB_ACTIONS === 'true',
-    'ci',
-    'OIDC verification requires GitHub Actions',
-  )
-  requireCheck(
-    env.RUNNER_ENVIRONMENT === 'github-hosted',
-    'ci',
-    'OIDC verification requires a GitHub-hosted runner',
-  )
-  requireCheck(
-    env.GITHUB_REPOSITORY === repository,
-    'ci',
-    'repository must be weappjs/weapp.dev',
-  )
-  requireCheck(
-    typeof env.GITHUB_WORKFLOW_REF === 'string'
-    && env.GITHUB_WORKFLOW_REF.startsWith(`${repository}/${workflow}@`),
-    'ci',
-    'workflow identity must be publish-weapp.yml',
-  )
-}
-
-async function requestJson(fetcher: PreflightFetcher, url: string, init: PreflightRequest, stage: string): Promise<unknown> {
-  let response: PreflightResponse
-  try {
-    response = await fetcher(url, {
-      ...init,
-      signal: AbortSignal.timeout(20_000),
-    })
-  }
-  catch {
-    throw new PreflightError(stage, 'request failed')
-  }
-  if (!response.ok) {
-    throw new PreflightError(stage, 'request rejected', response.status)
-  }
-  try {
-    return await response.json()
-  }
-  catch {
-    throw new PreflightError(stage, 'invalid JSON response', response.status)
-  }
-}
-
-export async function verifyUnpublished(manifest: PackageIdentity, fetcher: PreflightFetcher = fetch): Promise<void> {
-  const metadata = await requestJson(
-    fetcher,
-    `${registry}/${encodeURIComponent(manifest.name)}`,
-    { headers: { Accept: 'application/json' } },
-    'metadata',
-  )
-  validateRegistryMetadata(metadata, manifest)
-}
-
-/** Explicitly prove the npm trusted-publisher exchange. Never persist or reuse its token. */
-export async function verifyOidc({
-  env,
-  name = 'weapp',
-  fetcher = fetch,
-  mask = () => {},
-}: OidcOptions): Promise<{ verified: true }> {
-  validateCiIdentity(env)
-  requireCheck(name === 'weapp', 'oidc', 'package identity must be weapp')
+/** The CLI version must be rebuilt after repoctl selects a stable or nightly version. */
+export function validateBuiltVersion(metadata: unknown, manifest: PackageIdentity): void {
   requireCheck(
-    typeof env.ACTIONS_ID_TOKEN_REQUEST_TOKEN === 'string'
-    && env.ACTIONS_ID_TOKEN_REQUEST_TOKEN.trim(),
-    'oidc-request',
-    'GitHub request token is unavailable',
-  )
-  let tokenUrl: URL
-  try {
-    tokenUrl = new URL(env.ACTIONS_ID_TOKEN_REQUEST_URL || '')
-  }
-  catch {
-    throw new PreflightError(
-      'oidc-request',
-      'GitHub token endpoint is unavailable',
-    )
-  }
-  requireCheck(
-    tokenUrl.protocol === 'https:' && !tokenUrl.username && !tokenUrl.password,
-    'oidc-request',
-    'GitHub token endpoint must use HTTPS',
-  )
-  tokenUrl.searchParams.set('audience', 'npm:registry.npmjs.org')
-  mask(env.ACTIONS_ID_TOKEN_REQUEST_TOKEN)
-  const result = await requestJson(
-    fetcher,
-    tokenUrl.toString(),
-    {
-      method: 'GET',
-      headers: {
-        Authorization: `Bearer ${env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
-      },
-    },
-    'oidc-request',
-  )
-  requireCheck(
-    isRecord(result) && typeof result.value === 'string'
-    && /^[\w-]+\.[\w-]+\.[\w-]+$/.test(result.value),
-    'oidc-request',
-    'GitHub did not return a JWT',
-  )
-  mask(result.value)
-  const exchange = await requestJson(
-    fetcher,
-    `${registry}/-/npm/v1/oidc/token/exchange/package/${encodeURIComponent(name)}`,
-    {
-      method: 'POST',
-      headers: { Authorization: `Bearer ${result.value}` },
-    },
-    'oidc-exchange',
-  )
-  requireCheck(
-    isRecord(exchange) && typeof exchange.token === 'string' && exchange.token.trim(),
-    'oidc-exchange',
-    'npm did not return an exchange token',
+    isRecord(metadata) && metadata.version === manifest.version,
+    'artifact',
+    'built CLI version must match the package manifest; rebuild after versioning',
   )
-  mask(exchange.token)
-  return { verified: true }
 }
 
 function execute(command: string, args: string[], cwd: string, stage: string): string {
@@ -353,40 +204,6 @@ function execute(command: string, args: string[], cwd: string, stage: string): s
   return result.stdout
 }
 
-export function validateReleaseTag(manifest: PackageIdentity, env: NodeJS.ProcessEnv, executeGit: (args: string[]) => string): string {
-  const accepted = [`weapp@${manifest.version}`, `weapp-v${manifest.version}`]
-  const expected = env.WEAPP_RELEASE_TAG
-  requireCheck(
-    typeof expected === 'string' && accepted.includes(expected),
-    'release',
-    'release tag must match the package version',
-  )
-  const tag = executeGit([
-    'show-ref',
-    '--verify',
-    '--hash',
-    `refs/tags/${expected}`,
-  ]).trim()
-  requireCheck(
-    /^[a-f0-9]{40,64}$/.test(tag),
-    'release',
-    'release ref must be an existing Git tag',
-  )
-  const commit = executeGit([
-    'rev-parse',
-    `refs/tags/${expected}^{commit}`,
-  ]).trim()
-  const head = executeGit(['rev-parse', 'HEAD']).trim()
-  requireCheck(
-    commit === head && /^[a-f0-9]{40,64}$/.test(head),
-    'release',
-    'checked-out commit must match the release tag',
-  )
-  requireCheck(env.GITHUB_REF === `refs/tags/${expected}`, 'release', 'workflow must run from the actual release tag')
-  requireCheck(env.GITHUB_SHA === head, 'release', 'workflow provenance commit must match the checked-out tag commit')
-  return expected
-}
-
 async function verifyArtifact(artifact: string, manifest: PackageIdentity): Promise<{ filename: string, hash: string }> {
   const original = await readFile(artifact)
   const hash = createHash('sha256').update(original).digest('hex')
@@ -411,6 +228,12 @@ async function verifyArtifact(artifact: string, manifest: PackageIdentity): Prom
     ),
   )
   const identity = validateManifest(packed)
+  validateBuiltVersion(JSON.parse(execute(
+    'tar',
+    ['-xOzf', artifact, 'package/dist/data/meta.json'],
+    packageRoot,
+    'artifact',
+  )) as unknown, manifest)
   requireCheck(
     identity.name === manifest.name && identity.version === manifest.version,
     'artifact',
@@ -455,21 +278,11 @@ async function verifyArtifact(artifact: string, manifest: PackageIdentity): Prom
   return { filename: basename(artifact), hash }
 }
 
-function githubMask(value: string): void {
-  const escaped = value
-    .replaceAll('%', '%25')
-    .replaceAll('\r', '%0D')
-    .replaceAll('\n', '%0A')
-  process.stdout.write(`::add-mask::${escaped}\n`)
-}
-
 export async function preflight({
   argv = [],
   env = process.env,
-  fetcher = fetch,
   log = message => process.stdout.write(`${message}\n`),
-  mask = githubMask,
-}: PreflightOptions = {}): Promise<PackageIdentity & { oidc: boolean }> {
+}: PreflightOptions = {}): Promise<PackageIdentity> {
   requireCheck(
     argv.length <= 2
     && (argv.length === 0
@@ -481,28 +294,6 @@ export async function preflight({
     await readFile(join(packageRoot, 'package.json'), 'utf8'),
   ) as unknown)
   const ci = env.GITHUB_ACTIONS === 'true'
-  if (ci) {
-    validateCiIdentity(env)
-  }
-  const mode = env.WEAPP_PREFLIGHT_MODE || 'preflight'
-  requireCheck(
-    ['preflight', 'publish'].includes(mode),
-    'mode',
-    'expected preflight or publish',
-  )
-  if (mode === 'publish') {
-    requireCheck(
-      ci,
-      'release',
-      'publication validation requires GitHub Actions',
-    )
-    validateReleaseTag(manifest, env, args =>
-      execute('git', args, packageRoot, 'release'))
-  }
-  await verifyUnpublished(manifest, fetcher)
-  log(
-    `Registry verified: ${manifest.name}@${manifest.version} is unpublished.`,
-  )
   let artifact: string
   if (argv[0] === '--artifact') {
     if (argv[1]) {
@@ -538,11 +329,6 @@ export async function preflight({
     }
   }
   else {
-    requireCheck(
-      !ci,
-      'artifact',
-      'CI must validate the exact publication tarball with --artifact',
-    )
     const packed: unknown = JSON.parse(
       execute(
         'npm',
@@ -564,19 +350,12 @@ export async function preflight({
       return file.path
     })
     validatePaths(paths)
+    validateBuiltVersion(JSON.parse(await readFile(join(packageRoot, 'dist/data/meta.json'), 'utf8')) as unknown, manifest)
     await validatePublishedBundle(join(packageRoot, 'dist'))
     log('Local pack dry-run verified.')
   }
-  if (ci) {
-    await verifyOidc({ env, name: manifest.name, fetcher, mask })
-    log(
-      'CI npm OIDC exchange verified. The exchange token was discarded; no package was published.',
-    )
-  }
-  else {
-    log('CI OIDC exchange was not checked; this does not prove publication authorization.')
-  }
-  return { name: manifest.name, version: manifest.version, oidc: ci }
+  log('Package validation completed without publishing or requesting credentials.')
+  return manifest
 }
 
 async function main() {
@@ -584,7 +363,7 @@ async function main() {
     await preflight({ argv: process.argv.slice(2) })
   }
   catch (error) {
-    // Response bodies, fetch errors, process output, JWTs, and credentials are never logged.
+    // Keep command output and environment details out of validation errors.
     process.stderr.write(
       `${error instanceof PreflightError ? error.message : 'preflight: unexpected validation failure'}\n`,
     )
diff --git a/packages/weapp/test/release.test.ts b/packages/weapp/test/release.test.ts
index a135203b..c34caabe 100644
--- a/packages/weapp/test/release.test.ts
+++ b/packages/weapp/test/release.test.ts
@@ -1,51 +1,22 @@
-import type { PreflightFetcher, PreflightResponse } from '../scripts/preflight.js'
 import { readFileSync } from 'node:fs'
 import { cp, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { describe, expect, it, vi } from 'vitest'
+import { describe, expect, it } from 'vitest'
 import { bundledDependencies, bundleReportPath, noticesPath, thirdPartyNotices, validateBundleCode, validatePublishedBundle } from '../scripts/bundle-policy.js'
 import {
   PreflightError,
   requiredPaths,
-  validateCiIdentity,
+  validateBuiltVersion,
   validateManifest,
   validatePaths,
-  validateRegistryMetadata,
-  validateReleaseTag,
-  verifyOidc,
-  verifyUnpublished,
 } from '../scripts/preflight.js'
 
 const rawManifest: unknown = JSON.parse(
   readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
 )
 const manifest = validateManifest(rawManifest)
-const workflow = readFileSync(
-  new URL('../../../.github/workflows/publish-weapp.yml', import.meta.url),
-  'utf8',
-)
-const script = readFileSync(
-  new URL('../scripts/preflight.ts', import.meta.url),
-  'utf8',
-)
-const jwt
-  = 'eyJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJucG06cmVnaXN0cnkubnBtanMub3JnIn0.c2lnbmF0dXJl'
-const credential = 'npm_secret_exchange_credential'
-const env = {
-  GITHUB_ACTIONS: 'true',
-  RUNNER_ENVIRONMENT: 'github-hosted',
-  GITHUB_REPOSITORY: 'weappjs/weapp.dev',
-  GITHUB_WORKFLOW_REF:
-    'weappjs/weapp.dev/.github/workflows/publish-weapp.yml@refs/heads/main',
-  ACTIONS_ID_TOKEN_REQUEST_URL:
-    'https://actions.example.test/token?existing=value&audience=old',
-  ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'github-secret-request-token',
-}
-function response(body: unknown, status = 200): PreflightResponse {
-  return { ok: status >= 200 && status < 300, status, json: async () => body }
-}
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
 }
@@ -70,26 +41,16 @@ function changed(path: string, value: unknown): Record<string, unknown> {
   cursor[keys[keys.length - 1]] = value
   return cloned
 }
-async function expectSafeFailure(promise: Promise<unknown>, stage: string, status?: number): Promise<PreflightError> {
-  const result: unknown = await promise.catch((error: unknown) => error)
-  expect(result).toBeInstanceOf(PreflightError)
-  if (!(result instanceof PreflightError)) {
-    throw new Error('Expected a safe publication failure')
-  }
-  expect(result.stage).toBe(stage)
-  expect(result.status).toBe(status)
-  expect(result.message).not.toContain(jwt)
-  expect(result.message).not.toContain(credential)
-  expect(result.message).not.toContain(env.ACTIONS_ID_TOKEN_REQUEST_TOKEN)
-  return result
-}
-
 describe('weapp publication identity and artifact boundaries', () => {
   it('accepts only the public weapp package with the intended repository and minimum Node', () => {
     expect(validateManifest(rawManifest)).toEqual({
       name: 'weapp',
       version: manifest.version,
     })
+    // repoctl normalizes a snapshot's npm registry URL with a root slash.
+    for (const registry of [undefined, 'https://registry.npmjs.org', 'https://registry.npmjs.org/']) {
+      expect(validateManifest(changed('publishConfig.registry', registry))).toEqual(manifest)
+    }
     for (const [path, value] of [
       ['name', '@weapp-io/site-ui'],
       ['private', true],
@@ -101,6 +62,12 @@ describe('weapp publication identity and artifact boundaries', () => {
       ['repository.type', 'svn'],
       ['publishConfig.access', 'restricted'],
       ['publishConfig.registry', 'https://registry.example.test'],
+      ['publishConfig.registry', 'http://registry.npmjs.org/'],
+      ['publishConfig.registry', 'https://registry.npmjs.org/private/'],
+      ['publishConfig.registry', 'https://user@registry.npmjs.org/'],
+      ['publishConfig.registry', 'https://registry.npmjs.org/?registry=other'],
+      ['publishConfig.registry', false],
+      ['publishConfig.registry', ''],
       ['engines.node', '>=20'],
       ['engines.node', '>=16'],
       ['engines.node', 'invalid'],
@@ -203,304 +170,13 @@ describe('weapp publication identity and artifact boundaries', () => {
     }
   })
 
-  it('rejects existing versions and a different registry identity', () => {
-    expect(() =>
-      validateRegistryMetadata(
-        { name: 'weapp', versions: { '0.0.0': {} } },
-        manifest,
-      ),
-    ).not.toThrow()
-    expect(() =>
-      validateRegistryMetadata(
-        { name: 'weapp', versions: { [manifest.version]: {} } },
-        manifest,
-      ),
-    ).toThrow('already published')
-    for (const metadata of [
-      null,
-      {},
-      { name: 'other', versions: {} },
-      { name: 'weapp', versions: [] },
-    ]) {
-      expect(() => validateRegistryMetadata(metadata, manifest)).toThrow(
-        PreflightError,
-      )
-    }
-  })
-
-  it('queries npm metadata without credentials and fails closed on network or status errors', async () => {
-    const fetcher = vi.fn<PreflightFetcher>(async () =>
-      response({ name: 'weapp', versions: { '0.0.0': {} } }),
-    )
-    await verifyUnpublished(manifest, fetcher)
-    expect(fetcher.mock.calls[0][0]).toBe('https://registry.npmjs.org/weapp')
-    expect(fetcher.mock.calls[0][1].headers).not.toHaveProperty(
-      'Authorization',
-    )
-    await expectSafeFailure(
-      verifyUnpublished(manifest, async () => {
-        throw new Error(credential)
-      }),
-      'metadata',
-    )
-    const body = vi.fn<() => Promise<unknown>>()
-    const failure = await expectSafeFailure(
-      verifyUnpublished(manifest, async () => ({
-        ok: false,
-        status: 503,
-        json: body,
-      })),
-      'metadata',
-      503,
-    )
-    expect(failure.message).toContain('HTTP 503')
-    expect(body).not.toHaveBeenCalled()
-  })
-
-  it.each(['weapp@', 'weapp-v'])('requires a real matching %s tag and the same checked-out commit', (prefix) => {
-    const sha = 'a'.repeat(40)
-    const releaseTag = `${prefix}${manifest.version}`
-    const releaseEnv = { WEAPP_RELEASE_TAG: releaseTag, GITHUB_REF: `refs/tags/${releaseTag}`, GITHUB_SHA: sha }
-    const git = vi.fn<(args: string[]) => string>(() => sha)
-    expect(validateReleaseTag(manifest, releaseEnv, git)).toBe(releaseTag)
-    expect(git.mock.calls[0][0]).toEqual([
-      'show-ref',
-      '--verify',
-      '--hash',
-      `refs/tags/${releaseTag}`,
-    ])
-    expect(git.mock.calls[1][0]).toEqual([
-      'rev-parse',
-      `refs/tags/${releaseTag}^{commit}`,
-    ])
-    expect(() =>
-      validateReleaseTag(manifest, { WEAPP_RELEASE_TAG: 'main' }, git),
-    ).toThrow('tag must match')
-    expect(() => validateReleaseTag(manifest, releaseEnv, () => '')).toThrow(
-      'existing Git tag',
-    )
-    expect(() =>
-      validateReleaseTag(manifest, releaseEnv, args =>
-        args[1] === 'HEAD' ? 'b'.repeat(40) : sha),
-    ).toThrow('checked-out commit')
-    expect(() => validateReleaseTag(manifest, { ...releaseEnv, GITHUB_REF: 'refs/heads/main' }, git)).toThrow('workflow must run from the actual release tag')
-    expect(() => validateReleaseTag(manifest, { ...releaseEnv, GITHUB_SHA: 'b'.repeat(40) }, git)).toThrow('workflow provenance commit')
-  })
-
-  it('rejects tag lookalikes, mismatched versions, and mixed canonical/legacy provenance', () => {
-    const sha = 'a'.repeat(40)
-    const git = vi.fn<(args: string[]) => string>(() => sha)
-    for (const tag of [
-      `weapp@v${manifest.version}`,
-      `weapp-vv${manifest.version}`,
-      `weapp@${manifest.version}-other`,
-      `weapp-v${manifest.version}-other`,
-      `refs/tags/weapp@${manifest.version}`,
-      `weapp@${manifest.version}/extra`,
-      'other@0.1.0',
-      'weapp@99.99.99',
-    ]) {
-      expect(() => validateReleaseTag(manifest, { WEAPP_RELEASE_TAG: tag, GITHUB_REF: `refs/tags/${tag}`, GITHUB_SHA: sha }, git), tag).toThrow('tag must match')
-    }
-    expect(git).not.toHaveBeenCalled()
-    for (const [tag, workflowTag] of [[`weapp@${manifest.version}`, `weapp-v${manifest.version}`], [`weapp-v${manifest.version}`, `weapp@${manifest.version}`]]) {
-      expect(() => validateReleaseTag(manifest, { WEAPP_RELEASE_TAG: tag, GITHUB_REF: `refs/tags/${workflowTag}`, GITHUB_SHA: sha }, git)).toThrow('workflow must run from the actual release tag')
-    }
-  })
-})
-
-describe('explicit CI npm OIDC exchange', () => {
-  it('requires the canonical repository/workflow and GitHub-hosted CI', () => {
-    expect(() => validateCiIdentity(env)).not.toThrow()
-    for (const [key, value] of [
-      ['GITHUB_ACTIONS', 'false'],
-      ['RUNNER_ENVIRONMENT', 'self-hosted'],
-      ['GITHUB_REPOSITORY', 'sonofmagic/weapp.dev'],
-      [
-        'GITHUB_WORKFLOW_REF',
-        'weappjs/weapp.dev/.github/workflows/weapp-cli.yml@refs/heads/main',
-      ],
-    ]) {
-      expect(() => validateCiIdentity({ ...env, [key]: value }), key).toThrow(
-        PreflightError,
-      )
-    }
-  })
-
-  it('requests the exact audience and exchanges JWT without a body or persistent token', async () => {
-    const fetcher = vi
-      .fn<PreflightFetcher>()
-      .mockResolvedValueOnce(response({ value: jwt }))
-      .mockResolvedValueOnce(response({ token: credential }))
-    const mask = vi.fn<(value: string) => void>()
-    expect(await verifyOidc({ env, fetcher, mask })).toEqual({
-      verified: true,
-    })
-    const [url, request] = fetcher.mock.calls[0]
-    expect(new URL(url).searchParams.get('audience')).toBe(
-      'npm:registry.npmjs.org',
-    )
-    expect(new URL(url).searchParams.get('existing')).toBe('value')
-    expect(request.method).toBe('GET')
-    expect(request.headers?.Authorization).toBe(
-      `Bearer ${env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
-    )
-    const [exchangeUrl, exchange] = fetcher.mock.calls[1]
-    expect(exchangeUrl).toBe(
-      'https://registry.npmjs.org/-/npm/v1/oidc/token/exchange/package/weapp',
-    )
-    expect(exchange.method).toBe('POST')
-    expect(exchange.headers?.Authorization).toBe(`Bearer ${jwt}`)
-    expect(exchange).not.toHaveProperty('body')
-    expect(mask.mock.calls.map(([value]) => value)).toEqual([
-      env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,
-      jwt,
-      credential,
-    ])
-    expect(script).not.toMatch(
-      /(?:writeFile|execute)\([^\n]*(?:exchange\.token|result\.value)/,
-    )
-    expect(script).not.toMatch(
-      /execute\([^\n]*['"]publish['"]|npm publish --dry-run/,
-    )
-  })
-
-  it('never falls back when credentials or a valid JWT are absent', async () => {
-    const fetcher = vi.fn<PreflightFetcher>()
-    for (const badEnv of [
-      { ...env, ACTIONS_ID_TOKEN_REQUEST_TOKEN: '' },
-      { ...env, ACTIONS_ID_TOKEN_REQUEST_URL: '' },
-      {
-        ...env,
-        ACTIONS_ID_TOKEN_REQUEST_URL: 'http://actions.example.test/token',
-      },
-    ]) {
-      await expectSafeFailure(
-        verifyOidc({ env: badEnv, fetcher }),
-        'oidc-request',
-      )
-    }
-    expect(fetcher).not.toHaveBeenCalled()
-    for (const body of [null, {}, { value: '' }, { value: credential }]) {
-      const invalid = vi.fn<PreflightFetcher>(async () => response(body))
-      await expectSafeFailure(
-        verifyOidc({ env, fetcher: invalid }),
-        'oidc-request',
-      )
-      expect(invalid).toHaveBeenCalledTimes(1)
-    }
-  })
-
-  it('reports stage/status without reading a rejected response or leaking network errors', async () => {
-    const body = vi.fn(async () => ({ token: credential, value: jwt }))
-    const rejected = vi
-      .fn<PreflightFetcher>()
-      .mockResolvedValueOnce(response({ value: jwt }))
-      .mockResolvedValueOnce({ ok: false, status: 403, json: body })
-    const error = await expectSafeFailure(
-      verifyOidc({ env, fetcher: rejected }),
-      'oidc-exchange',
-      403,
-    )
-    expect(error.message).toBe('oidc-exchange: request rejected (HTTP 403)')
-    expect(body).not.toHaveBeenCalled()
-    await expectSafeFailure(
-      verifyOidc({
-        env,
-        fetcher: async () => {
-          throw new Error(`${credential} ${jwt}`)
-        },
-      }),
-      'oidc-request',
-    )
-    await expectSafeFailure(
-      verifyOidc({
-        env,
-        fetcher: async () => ({
-          ok: true,
-          status: 200,
-          json: async () => {
-            throw new Error(jwt)
-          },
-        }),
-      }),
-      'oidc-request',
-      200,
-    )
-  })
-
-  it('fails on missing exchange token and masks no rejected response text', async () => {
-    for (const body of [
-      null,
-      {},
-      { token: '' },
-      { token: '  ' },
-      { token: 123 },
-    ]) {
-      const fetcher = vi
-        .fn<PreflightFetcher>()
-        .mockResolvedValueOnce(response({ value: jwt }))
-        .mockResolvedValueOnce(response(body))
-      const mask = vi.fn<(value: string) => void>()
-      await expectSafeFailure(
-        verifyOidc({ env, fetcher, mask }),
-        'oidc-exchange',
-      )
-      expect(mask.mock.calls.map(([value]) => value)).toEqual([
-        env.ACTIONS_ID_TOKEN_REQUEST_TOKEN,
-        jwt,
-      ])
+  it('accepts stable and nightly artifacts only when their built version matches the manifest', () => {
+    for (const version of ['0.3.0', `0.4.0-snapshot.nightly.c${'a'.repeat(40)}.b${'b'.repeat(64)}`]) {
+      const identity = validateManifest(changed('version', version))
+      expect(() => validateBuiltVersion({ version }, identity)).not.toThrow()
+      for (const metadata of [null, {}, { version: '0.2.0' }, { version: 3 }]) {
+        expect(() => validateBuiltVersion(metadata, identity)).toThrow('rebuild after versioning')
+      }
     }
   })
 })
-
-describe('publication workflow mode boundaries', () => {
-  it('defaults dispatch to preflight/main and retains release publishing', () => {
-    expect(workflow).toMatch(
-      /mode:\n\s+description:[^\n]+\n\s+required: true\n\s+default: preflight\n\s+type: choice\n\s+options: \[preflight, publish\]/,
-    )
-    expect(workflow).toMatch(
-      /tag:\n\s+description:[^\n]+\n\s+required: true\n\s+default: main/,
-    )
-    expect(workflow).toMatch(/release:\n\s+types: \[published\]/)
-    expect(workflow).toContain('startsWith(github.event.release.tag_name, \'weapp@\')')
-    expect(workflow).toContain('startsWith(github.event.release.tag_name, \'weapp-v\')')
-    expect(workflow).toContain(
-      `WEAPP_PREFLIGHT_MODE: \${{ github.event_name == 'release' && 'publish' || inputs.mode }}`,
-    )
-    expect(workflow).toContain('fetch-depth: 0')
-  })
-
-  it('only gives OIDC permission to the GitHub-hosted publish job and never defines an environment', () => {
-    const [beforeJobs, jobs] = workflow.split('\njobs:\n')
-    expect(beforeJobs).not.toContain('id-token: write')
-    expect(jobs).toContain('  publish:')
-    expect(jobs).toContain('runs-on: ubuntu-24.04')
-    expect(jobs).toContain('id-token: write')
-    expect(workflow.match(/id-token: write/g)).toHaveLength(1)
-    expect(workflow).not.toMatch(/^\s+environment:/m)
-  })
-
-  it('requires preflight success before the one guarded publish call on its exact artifact', () => {
-    expect(workflow).toContain('pnpm exec tsx scripts/preflight.ts --artifact')
-    expect(workflow).toContain('pnpm --filter weapp exec tsx scripts/check-release.ts')
-    expect(workflow).not.toContain('continue-on-error: true')
-    expect(workflow).not.toMatch(/npm publish[^\n]*--dry-run/)
-    const publishStep = workflow.slice(
-      workflow.indexOf('      - name: Publish with npm provenance'),
-    )
-    expect(publishStep).toContain(
-      'if: github.event_name == \'release\' || inputs.mode == \'publish\'',
-    )
-    expect(publishStep).toContain(
-      `WEAPP_VALIDATED_ARTIFACT: \${{ steps.preflight.outputs.artifact }}`,
-    )
-    expect(publishStep).toContain(
-      'npm publish "./$WEAPP_VALIDATED_ARTIFACT" --ignore-scripts --access public --provenance',
-    )
-    expect(workflow.match(/run: npm publish/g)).toHaveLength(1)
-    expect(workflow.indexOf('id: preflight')).toBeLessThan(
-      workflow.indexOf('      - name: Publish with npm provenance'),
-    )
-  })
-})
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index eca7aa54..2a5020c9 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -172,6 +172,12 @@ importers:
 
   .:
     devDependencies:
+      '@actions/artifact':
+        specifier: 6.3.1
+        version: 6.3.1(supports-color@10.2.2)
+      '@actions/core':
+        specifier: 3.0.1
+        version: 3.0.1
       '@commitlint/cli':
         specifier: 21.2.4
         version: 21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3)
@@ -181,15 +187,12 @@ importers:
       eslint:
         specifier: 10.13.0
         version: 10.13.0(jiti@2.7.0)(supports-color@10.2.2)
-      husky:
-        specifier: 9.1.7
-        version: 9.1.7
-      lint-staged:
-        specifier: 17.6.0
-        version: 17.6.0
+      lefthook:
+        specifier: 2.2.2
+        version: 2.2.2
       repoctl:
-        specifier: 5.10.3
-        version: 5.10.3(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))(vitest@5.0.5)
+        specifier: 6.0.1
+        version: 6.0.1(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))(vitest@5.0.5)
       stylelint:
         specifier: 17.16.0
         version: 17.16.0(supports-color@10.2.2)(typescript@6.0.3)
@@ -201,7 +204,10 @@ importers:
         version: 6.0.3
       vitest:
         specifier: 5.0.5
-        version: 5.0.5(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+        version: 5.0.5(@types/node@22.20.5)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+      yaml:
+        specifier: 2.9.1
+        version: 2.9.1
 
   apps/open-source:
     dependencies:
@@ -216,7 +222,7 @@ importers:
         version: 5.3.0
       '@lucide/astro':
         specifier: 1.61.0
-        version: 1.61.0(astro@7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+        version: 1.61.0(astro@7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
       '@weapp-io/project-catalog':
         specifier: workspace:*
         version: link:../../packages/project-catalog
@@ -225,7 +231,7 @@ importers:
         version: link:../../packages/site-ui
       astro:
         specifier: 7.4.1
-        version: 7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
+        version: 7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
     devDependencies:
       '@astrojs/check':
         specifier: 0.9.11
@@ -271,7 +277,7 @@ importers:
         version: 5.3.0
       '@lucide/astro':
         specifier: 1.61.0
-        version: 1.61.0(astro@7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+        version: 1.61.0(astro@7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
       '@weapp-io/project-catalog':
         specifier: workspace:*
         version: link:../../packages/project-catalog
@@ -280,7 +286,7 @@ importers:
         version: link:../../packages/site-ui
       astro:
         specifier: 7.4.1
-        version: 7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
+        version: 7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
       echarts:
         specifier: 6.1.0
         version: 6.1.0
@@ -323,7 +329,7 @@ importers:
     dependencies:
       astro:
         specifier: 7.4.1
-        version: 7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
+        version: 7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
     devDependencies:
       '@types/node':
         specifier: 24.19.2
@@ -345,13 +351,13 @@ importers:
         version: 5.3.0
       '@lucide/astro':
         specifier: 1.61.0
-        version: 1.61.0(astro@7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+        version: 1.61.0(astro@7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
       '@weapp-io/project-catalog':
         specifier: workspace:*
         version: link:../project-catalog
       astro:
         specifier: 7.4.1
-        version: 7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
+        version: 7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
     devDependencies:
       '@astrojs/check':
         specifier: 0.9.11
@@ -429,6 +435,27 @@ importers:
 
 packages:
 
+  '@actions/artifact@6.3.1':
+    resolution: {integrity: sha512-DBXgdB9T4yj2KSe0tFg+MTi9T5se+16bdrFQh+3Y6Nq1lZ3gYQk1BjHoTof+7Zf36bEAlfVMf+8ifRKeyGJugQ==}
+
+  '@actions/core@3.0.1':
+    resolution: {integrity: sha512-a6d/Nwahm9fliVGRhdhofo40HjHQasUPusmc7vBfyky+7Z+P2A1J68zyFVaNcEclc/Se+eO595oAr5nwEIoIUA==}
+
+  '@actions/exec@3.0.0':
+    resolution: {integrity: sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==}
+
+  '@actions/github@9.1.1':
+    resolution: {integrity: sha512-tL5JbYOBZHc0ngEnCsaDcryUizIUIlQyIMwy1Wkx93H5HzbBJ7TbiPx2PnFjBwZW0Vh05JmfFZhecE6gglYegA==}
+
+  '@actions/http-client@3.0.2':
+    resolution: {integrity: sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==}
+
+  '@actions/http-client@4.0.1':
+    resolution: {integrity: sha512-+Nvd1ImaOZBSoPbsUtEhv+1z99H12xzncCkz0a3RuehINE81FZSe2QTj3uvAPTcJX/SCzUQHQ0D1GrPMbrPitg==}
+
+  '@actions/io@3.0.2':
+    resolution: {integrity: sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==}
+
   '@andrewbranch/untar.js@1.0.4':
     resolution: {integrity: sha512-pVXSwPsLuw8IGLo2Di0EaOfsk+ntVvpkk942J/sHYIkwvtKUakEcPh7HBgZ6tuimgzKSEHgCvO4XgQ05DEbwDw==}
 
@@ -628,6 +655,61 @@ packages:
     peerDependencies:
       playwright-core: '>= 1.0.0'
 
+  '@azure/abort-controller@2.2.0':
+    resolution: {integrity: sha512-fNAjWnA/nZ2jz31kxR/AqRaUT8ewHBw/WuBIosK0moMy1C9e5ValbDfFdIxJzVOOYaYkV/b2F1S4H/aHiqfVQg==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/core-auth@1.11.0':
+    resolution: {integrity: sha512-IUZydyTUkDnYdstOW9pFOOUQlBjAepK5teihDE3x6yxsPJs/hsAaaYpeGxdxrgtOiJbBKSjKW7MDk7AEhb4LRg==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/core-client@1.11.1':
+    resolution: {integrity: sha512-2QygG2F76ZpMP2eMztiJvAiFMu71M9rDeU7vO/QKg5Css7MgM4frUOslFjhVjRhbGaCNPtz/S8M6y46/fFKVuQ==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/core-http-compat@2.5.0':
+    resolution: {integrity: sha512-BoSmXPx2er1Ai+wKlDvj29jIQespCNBwEmKyZVHO2kEFsWbGjAjwMCGzug3DJM5/QYIV3vej0S1zcU5bq9fa8w==}
+    engines: {node: '>=22.0.0'}
+    peerDependencies:
+      '@azure/core-client': ^1.10.0
+      '@azure/core-rest-pipeline': ^1.22.0
+
+  '@azure/core-lro@2.7.2':
+    resolution: {integrity: sha512-0YIpccoX8m/k00O7mDDMdJpbr6mf1yWo2dfmxt5A8XVZVVMz2SSKaEbMCeJRvgQ0IaSlqhjT47p4hVIRRy90xw==}
+    engines: {node: '>=18.0.0'}
+
+  '@azure/core-paging@1.7.0':
+    resolution: {integrity: sha512-7GEAoIsaoBr6KELNRb8nypowCqvk8dnCHFCYg4XD4lOQGY2GqjQg5IhkRjyBFRO18CGSMq05PaNqSOE9GQro3g==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/core-rest-pipeline@1.25.0':
+    resolution: {integrity: sha512-bMs8ekJLjX8wPV+9IPBges1SLPyuDtE9g5gLDWOpxzKcoOFQnpLGkbcT1tdw3FaAmDS1gnPmMmJ6y/T5B96kIA==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/core-tracing@1.4.0':
+    resolution: {integrity: sha512-eGwxD0AtncrxeBM4tG8R55Pc3rdX1hNW2WibJAgYpCVA6E93mvvVH+LcssoVjOBrSKWS55yEIHsk0X8ctHmfOQ==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/core-util@1.14.0':
+    resolution: {integrity: sha512-9n2pWK61veAuN0V20t9lOuoV4CFMdyAZ1ygZzvBGk/pBBJRib/PjL9PLXa/aI2CcPpyHfqVsxxqLCYl6uZlfDw==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/core-xml@1.6.0':
+    resolution: {integrity: sha512-e7lX/dk//F6Qf7BB6PTY4+p2yuOQtyOeHGyapYHNwqSp2OnYpwQt49A/Nin2XmKBQ69pwagR4k/lQBq8lbHQkA==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/logger@1.4.0':
+    resolution: {integrity: sha512-rbAE25KUfjU/s3XHUdJgceoCP5dEOpMx85J04kF+QMdta73XkuG9JGHHinch+XIoKpBdqljin+KqURpJriSzLA==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/storage-blob@12.34.0':
+    resolution: {integrity: sha512-cXDTCAMwDx8Ng9yUe82kOOd2kPnZ8AQqe4FkLMcpaQ3Mvr3/PXVdvRhyP0FtY5/U5Oh6JGk3EcEibaFOymRLFw==}
+    engines: {node: '>=22.0.0'}
+
+  '@azure/storage-common@12.5.0':
+    resolution: {integrity: sha512-bttzuhQiCIwrkzjPDA+AtAR7dg19L/CC6ztcqJ5LfvWpXuys9mHp0UQ0udYnoUvv9SCT9KTR5kqFvFr0e6k0lQ==}
+    engines: {node: '>=22.0.0'}
+
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
@@ -1695,16 +1777,17 @@ packages:
     resolution: {integrity: sha512-bV0Tgo9K4hfPCek+aMAn81RppFKv2ySDQeMoSZuvTASywNTnVJCArCZE2FWqpvIatKu7VMRLWlR1EazvVhDyhQ==}
     engines: {node: '>=18.18'}
 
-  '@icebreakers/commitlint-config@4.1.2':
-    resolution: {integrity: sha512-Wi9lvtj4af51U7O26+Y3eKwpS8k27XgWymKhlKf3xVfSK/jNW+eXNunVnpb8h2YMaQ+Og6gyZcUm3WwZCt7j7A==}
-    engines: {node: '>=22.13.0'}
+  '@icebreakers/commitlint-config@4.1.4':
+    resolution: {integrity: sha512-t8Pfr8jUBsVNDQXj+KQNPeXpAsjxWZ6ekfjOLqHL16ok5aXXllPRTg3WqUjk+LnGuQF6gsBFlitis2PqI+1mMw==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
     peerDependencies:
       conventional-changelog-conventionalcommits: '>=10.4.1'
 
-  '@icebreakers/eslint-config@8.0.9':
-    resolution: {integrity: sha512-jAw6GImydwa9LsaGT8HHxvccKv29REl9Kxlz9LGrMrsIFM0AQHvcjLwg6avkVwzEYeSI7/DQipd3ppGSGRlVEg==}
-    engines: {node: '>=22.13.0'}
+  '@icebreakers/eslint-config@8.0.11':
+    resolution: {integrity: sha512-iMyxQfRh//kYpxowUxVw3QV+/1BRinasLX1Zgsw3A32Bsi/7lNqLAzwrWgtnHVqH4Rrb7edD3nwOTQbwUSd6Ww==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
     peerDependencies:
+      eslint: ^9.10.0 || ^10.0.0
       eslint-plugin-pnpm: ^1.9.1
       tailwindcss: ^3.3.0 || ^4.1.17
     peerDependenciesMeta:
@@ -1713,13 +1796,13 @@ packages:
       tailwindcss:
         optional: true
 
-  '@icebreakers/monorepo-templates@2.3.3':
-    resolution: {integrity: sha512-7Q8oD5Ggr0BAAbckuOxX0pJPSqiglAtNCppDTpuIV6xyhYltCiw8QIwjIy+5fBX4if8otJdZ6wYfERPhOdThwQ==}
-    engines: {node: '>=22.13.0'}
+  '@icebreakers/monorepo-templates@3.0.1':
+    resolution: {integrity: sha512-FqpL4JU+Pq8YpsB9x332MVVgFaj/hG1S6rUK5YeYHCM+PCcOkpVYMHJA35YeoLsiAaHHNei0xqxgmareXENRiw==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
 
-  '@icebreakers/monorepo@5.10.3':
-    resolution: {integrity: sha512-gQsphl0iGrfoiFKtxB7Yw3QjAEHQy2iWMoQooSH5koaoD6vUmqf6RMpYsiv2iPYicZ8OXhjfiieiPygu0hFKSQ==}
-    engines: {node: '>=22.13.0'}
+  '@icebreakers/monorepo@6.0.1':
+    resolution: {integrity: sha512-HhHG1JWqJl18j6E3ErtGMqKZbBZJQdZ3HqFPF0Vr4h3V/CU3nm8/7qbXzbPXBhKC90R269n5rh5n1alpUaFU1g==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
     hasBin: true
     peerDependencies:
       '@commitlint/cli': ^21.2.3
@@ -1736,9 +1819,9 @@ packages:
       typescript:
         optional: true
 
-  '@icebreakers/stylelint-config@5.1.3':
-    resolution: {integrity: sha512-3pI6VJxPQmcOmoLmfIi8ICGnuVhgZfhze+8lUhc5GzuHeAyZD83SW47mPhdLv6ZJ3sTvvtQXYtkvViyv3pp5qA==}
-    engines: {node: '>=22.13.0'}
+  '@icebreakers/stylelint-config@5.1.5':
+    resolution: {integrity: sha512-auqRZaCKUNo641E6hX4FVzx3vLMRcXT1ed0dAiJoMPRXOoebIFaMhg13VjPe0wwd0uYuOgZM49aWlZ772sFPvw==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
     hasBin: true
 
   '@img/colour@1.1.0':
@@ -1965,6 +2048,10 @@ packages:
       '@types/node':
         optional: true
 
+  '@isaacs/cliui@8.0.2':
+    resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
+    engines: {node: '>=12'}
+
   '@isaacs/fs-minipass@4.0.1':
     resolution: {integrity: sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==}
     engines: {node: '>=18.0.0'}
@@ -2028,6 +2115,9 @@ packages:
       '@emnapi/core': ^1.7.1 || ^2.0.0-alpha.4
       '@emnapi/runtime': ^1.7.1 || ^2.0.0-alpha.4
 
+  '@nodable/entities@3.1.0':
+    resolution: {integrity: sha512-LsS/DjHr+uDM647Gru/cA8+J3a3HfhttwCKLyuoyN7yXTFCxKBtSgMQBvrW9yNPa2/zDRUNuGPaH5QUFoa4arQ==}
+
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
     engines: {node: '>= 8'}
@@ -2089,6 +2179,72 @@ packages:
     resolution: {integrity: sha512-mGUWr1uMnf0le2TwfOZY4SFxZGXGfm4Jtay/nwAa2FLNAKXUoUwaGwBMNH36UHPtinWfTSJ3nqFQr0091CxVGg==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  '@octokit/auth-token@6.0.0':
+    resolution: {integrity: sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==}
+    engines: {node: '>= 20'}
+
+  '@octokit/core@7.0.8':
+    resolution: {integrity: sha512-L7y8eYc+AwxGr2PWI4WFt1VG4TiJ66c26BD16mXpYIlXxG0SMigM1+m4aTSlYyBr5BlQsGAlz8uDCoZN4SEMcg==}
+    engines: {node: '>= 20'}
+
+  '@octokit/endpoint@11.0.5':
+    resolution: {integrity: sha512-iXa654H3yFafF/ieHkukfbgWo2rmXD2ceD0ZOtrPhw1bc3FDch1d9N/TNs0FQ1/cIbwb7kspUX8jzIs8nzb9DQ==}
+    engines: {node: '>= 20'}
+
+  '@octokit/graphql@9.0.5':
+    resolution: {integrity: sha512-bt/hm03LeU6Vy7FwTrkkC9p3XGT/lBwClglMqxBSe5/q0E5CdJTXeAqEI0vlw89/LF/G6tryTIH8HirZ3prMVg==}
+    engines: {node: '>= 20'}
+
+  '@octokit/openapi-types@27.0.0':
+    resolution: {integrity: sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==}
+
+  '@octokit/openapi-types@28.0.0':
+    resolution: {integrity: sha512-0rFyLuyHvIj6uuZWuDslxkowFYdPXoNIkeAv4b27dzm2Tf4vGWXnPsMcxs7d65kLdMERgP3wc1AEPlqMz8e1cQ==}
+
+  '@octokit/openapi-types@29.0.1':
+    resolution: {integrity: sha512-9qWOMFNxxLokERcms42rU0PTLqQmVs7g5E41TI4mCOxmpFayD1rfC7XxOL55cG9MBZLFlC31BrR37myMKardwg==}
+
+  '@octokit/plugin-paginate-rest@14.0.0':
+    resolution: {integrity: sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==}
+    engines: {node: '>= 20'}
+    peerDependencies:
+      '@octokit/core': '>=6'
+
+  '@octokit/plugin-request-log@6.0.0':
+    resolution: {integrity: sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==}
+    engines: {node: '>= 20'}
+    peerDependencies:
+      '@octokit/core': '>=6'
+
+  '@octokit/plugin-rest-endpoint-methods@17.0.0':
+    resolution: {integrity: sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==}
+    engines: {node: '>= 20'}
+    peerDependencies:
+      '@octokit/core': '>=6'
+
+  '@octokit/plugin-retry@8.1.1':
+    resolution: {integrity: sha512-VCVvZ/R1+u3WuiBWpNavZ0mY4aaJNAsENrpBP9aLSR2QyOpQgd7DhM5j4AW7z4MQpnJYgwBPf0XqPQoNBRdQwg==}
+    engines: {node: '>= 20'}
+    peerDependencies:
+      '@octokit/core': '>=7'
+
+  '@octokit/request-error@7.1.2':
+    resolution: {integrity: sha512-XZRuT3xZ84D3gYErI1DZvhJ33dCWVV6uzBtWkaBB4TvA/L6eOeTZodxLFVB44bBEEo3vEx7y00UfX1tBLrtLRg==}
+    engines: {node: '>= 20'}
+
+  '@octokit/request@10.0.16':
+    resolution: {integrity: sha512-A0zWGjHzISIb+9ccG8s0dq7LKO5zVpJLRICjgUb+sJxEWqn8RUHB1rD3AE51+PECvXHIxqZ1VVvs4fHTSD9nUQ==}
+    engines: {node: '>= 20'}
+
+  '@octokit/types@16.0.0':
+    resolution: {integrity: sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==}
+
+  '@octokit/types@17.0.0':
+    resolution: {integrity: sha512-ByP1v7YL5SMveFPP7+sj0/ZuWCOOg/Chs4NafOMpq6WNIM/hdGY0S7C0TCGDBWu1aGmOxmUIhMx3cO+IdwYZ1Q==}
+
+  '@octokit/types@18.0.0':
+    resolution: {integrity: sha512-l6bAF43PNxkJp6g+W4PjoUSSkxHomXw2nOum5CTftJz1NlV3vu93NImgOYtLf6CbBUb5j+fiuzW0PPQ5JTSvZA==}
+
   '@oslojs/encoding@1.1.0':
     resolution: {integrity: sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ==}
 
@@ -2343,6 +2499,10 @@ packages:
     cpu: [x64]
     os: [win32]
 
+  '@pkgjs/parseargs@0.11.0':
+    resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
+    engines: {node: '>=14'}
+
   '@pkgr/core@0.3.6':
     resolution: {integrity: sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==}
     engines: {node: ^14.18.0 || >=16.0.0}
@@ -2431,6 +2591,12 @@ packages:
   '@poppinss/exception@1.2.3':
     resolution: {integrity: sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==}
 
+  '@protobuf-ts/runtime-rpc@2.11.1':
+    resolution: {integrity: sha512-4CqqUmNA+/uMz00+d3CYKgElXO9VrEbucjnBFEjqI4GuDrEQ32MaI3q+9qPBvIGOlL4PmHXrzM32vBPWRhQKWQ==}
+
+  '@protobuf-ts/runtime@2.11.1':
+    resolution: {integrity: sha512-KuDaT1IfHkugM2pyz+FwiY80ejWrkH1pAtOBOZFuR6SXEFTsnb/jiQWQ1rCIrcKx2BtyxnxW6BWwsVSA/Ie+WQ==}
+
   '@publint/pack@0.1.7':
     resolution: {integrity: sha512-4EDEmvxWtgsCnnVeBvtFIFZtUhPPt1+bA9JrSwU4Sa//6oKtzCSlGGXYJr44OD9aGISymbieJ4mCKHUygUDU+g==}
     engines: {node: '>=18'}
@@ -2799,9 +2965,15 @@ packages:
   '@types/nlcst@2.0.3':
     resolution: {integrity: sha512-vSYNSDe6Ix3q+6Z7ri9lyWqgGhJTmzRjZRqyq15N0Z/1/UnVsno9G/N40NBijoYx2seFDIl0+B2mgAb9mezUCA==}
 
+  '@types/node@22.20.5':
+    resolution: {integrity: sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==}
+
   '@types/node@24.19.2':
     resolution: {integrity: sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ==}
 
+  '@types/node@25.9.9':
+    resolution: {integrity: sha512-b4e2xxj/yMeT2hNlD6x7zNFiQK2Dlmkb9CQ6v3/1G2RezKN4YS2lcEv8lzGm1mhs4f2lM4yNAMI/zUDBZBBt7w==}
+
   '@types/parse-path@7.0.3':
     resolution: {integrity: sha512-LriObC2+KYZD3FzCrgWGv/qufdUy4eXrxcLgQMfYXgPbLIecKIsVBaQgUPmxSSLcjmYbDTQbMgr6qr6l/eb7Bg==}
 
@@ -2886,14 +3058,18 @@ packages:
     resolution: {integrity: sha512-E2mroviasaWecDzTGiGMtuEguuLVOeRggnrIn93CJuxYJzQBHbyymlT08aVQydbBal5538o+JkBKXh2sRuCyIA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@typespec/ts-http-runtime@0.3.9':
+    resolution: {integrity: sha512-edSdeAqkdxBVzA1yL1LrLCml1YjyCVvPMtMqJpbF+6K609tHe8V6sQUzFQSGcYNhcuhOceZtjvN32+mpIth30A==}
+    engines: {node: '>=22.0.0'}
+
   '@ungap/structured-clone@1.4.0':
     resolution: {integrity: sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==}
 
-  '@unocss/config@66.10.5':
-    resolution: {integrity: sha512-ddmmmsJ+Vjg9oS4c5ElP8vR1oftID9dqG0yASDWLsLNY4uKo295EuCQXIBVbkyRnBZcdjpnOUfo71iwElaCeyA==}
+  '@unocss/config@66.11.0':
+    resolution: {integrity: sha512-ohpkpfN4GAY7itfDJmeKH+KFbAUoKOVRa3ChJLvUgMPFcpnwjxhDB0ePREqTe60K6kL6AblrcfSW2Vs46z9bGQ==}
 
-  '@unocss/core@66.10.5':
-    resolution: {integrity: sha512-fukv4bL32z/kWIiKgDy5ih452Jzf7S76p8RnP4N+3utqMFeqWayEApiqRidGv5b6NwPguTsKXaLsy+mbK9aMfA==}
+  '@unocss/core@66.11.0':
+    resolution: {integrity: sha512-eDMgNWF0LnpNQJXiBEofsAbh2EusQjkVDefBC526U5vOqRwMmqNuYs32rvUwYxf4O/ryIEgFJQAvDv+JpwfSKg==}
 
   '@valibot/to-json-schema@1.8.0':
     resolution: {integrity: sha512-a0M+uwCuQZEPAo65NYkFSJ14O5c213KoSZmPdoCfuFvUhfULi4T2Z6Tpjv6lTVMW9RoLm74RpRAjNEa43KcN+g==}
@@ -3192,6 +3368,10 @@ packages:
     resolution: {integrity: sha512-a1wflyaL0tHtJSmLSOVybYhy22vRih4eduhhrkcjgrWGnRfrZtovJ2FRjxuTtkkj47O/baf0R86QU5OuYpz8fA==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  abort-controller@3.0.0:
+    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
+    engines: {node: '>=6.5'}
+
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
     peerDependencies:
@@ -3253,6 +3433,21 @@ packages:
     resolution: {integrity: sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==}
     engines: {node: '>= 8'}
 
+  anynum@1.0.1:
+    resolution: {integrity: sha512-N6//FLET/tXYNM/F6ABca1oH6fWB+KlTt909Le28WMDBk8oaT4vY17DCrwg2MvmuqUKt3Ni4N5dGJ/EoBgcO6A==}
+
+  apache-arrow@21.2.0:
+    resolution: {integrity: sha512-Hxe6Agq26gQOM954qpzYSllJBPJl+e16U5CkfuMUhLrNba+5nKkttIVlflaovN6oaTratqMGAO8H5u/aNhmHWQ==}
+    hasBin: true
+
+  archiver-utils@5.0.2:
+    resolution: {integrity: sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA==}
+    engines: {node: '>= 14'}
+
+  archiver@7.0.1:
+    resolution: {integrity: sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==}
+    engines: {node: '>= 14'}
+
   are-docs-informative@0.1.1:
     resolution: {integrity: sha512-sqRsNQBwbKLRX0jV5Cu5uzmtflf892n4Vukz7T659ebL4pz3mpOqCMU7lxMoBTFwnp10E3YB5ZcyHM41W5bcDA==}
     engines: {node: '>=18'}
@@ -3274,9 +3469,17 @@ packages:
     resolution: {integrity: sha512-COROpnaoap1E2F000S62r6A60uHZnmlvomhfyT2DlTcrY1OrBKn2UhH7qn5wTC9zMvD0AY7csdPSNwKP+7WiQw==}
     engines: {node: '>= 0.4'}
 
+  array-buffer-byte-length@1.0.2:
+    resolution: {integrity: sha512-LHE+8BuR7RYGDKvnrmcuSq3tDcKv9OFEXQt/HpbZhY7V6h0zlUXutnAD82GiFx9rdieCMjkvtcsPqBwgUl1Iiw==}
+    engines: {node: '>= 0.4'}
+
   array-timsort@1.0.3:
     resolution: {integrity: sha512-/+3GRL7dDAGEfM6TseQk/U+mi18TU2Ms9I3UlLdUMhz2hbvGNTKdj9xniwXfUqgYhHxRx0+8UnKkvlNwVU+cWQ==}
 
+  arraybuffer.prototype.slice@1.0.4:
+    resolution: {integrity: sha512-BNoCY6SXXPQ7gF2opIP4GBE+Xw7U+pHMYKuzjgCN3GwiaIR09UUeKfheyIry77QtrCBlC0KK0q5/TER/tYh3PQ==}
+    engines: {node: '>= 0.4'}
+
   assertion-error@2.0.1:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
@@ -3298,6 +3501,13 @@ packages:
       '@astrojs/markdown-remark':
         optional: true
 
+  async-function@1.0.0:
+    resolution: {integrity: sha512-hsU18Ae8CDTR6Kgu9DYf0EbCr/a5iGL0rytQDobUcdpYOKokk8LEjVphnXkDkgpi0wYVsqrXuP0bZxJaTqdgoA==}
+    engines: {node: '>= 0.4'}
+
+  async@3.2.6:
+    resolution: {integrity: sha512-htCUDlxyyCLMgaM3xXg0C0LW2xqfuQ6p05pCEIsXuyQ+a1koYKTuBMzRNwmybfLgvJDMd0r1LTn4+E0Ti6C2AA==}
+
   autoprefixer@10.6.1:
     resolution: {integrity: sha512-cL1Qz6ADZhcEbny/8HPfe99J6HhNoYtpX2LFLIbhgGE7Q1hlQVkYFdetDN7Id3KiQxhDrHwzlHr/YQCnZ8+xSA==}
     engines: {node: ^10 || ^12 || >=14}
@@ -3305,6 +3515,10 @@ packages:
     peerDependencies:
       postcss: ^8.1.0
 
+  available-typed-arrays@1.0.7:
+    resolution: {integrity: sha512-wvUjBtSGN7+7SjNpq/9M2Tg350UZD3q62IFZLbRAR1bSMlCo1ZaeW+BJ+D090e4hIIZLBcTDWe4Mh4jvUDajzQ==}
+    engines: {node: '>= 0.4'}
+
   axe-core@4.14.0:
     resolution: {integrity: sha512-9WTZxEjsZ7b13TH8JPmbV2z8CHbl80/2hm3XPEG4JgNdQLK81IBRXmSxHfMAOkSqQeRxT/0dwNDz2GOm3zzpcQ==}
     engines: {node: '>=4'}
@@ -3313,18 +3527,75 @@ packages:
     resolution: {integrity: sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ==}
     engines: {node: '>= 0.4'}
 
+  b4a@1.9.0:
+    resolution: {integrity: sha512-dpfcF9fDNR6++cthXR67iyhgqWy9CBouAvIWhIntzBG6cvK/cnIPiZQjBwi/ZqjjBEDGfoNDtmB0kTjroOJ3pQ==}
+    peerDependencies:
+      react-native-b4a: '*'
+    peerDependenciesMeta:
+      react-native-b4a:
+        optional: true
+
   bail@2.0.2:
     resolution: {integrity: sha512-0xO6mYd7JB2YesxDKplafRpsiOzPt9V02ddPCLbY1xYGPOX24NTyN50qnUxgCPcSoYMhKpAuBTjQoRZCAkUDRw==}
 
+  balanced-match@1.0.2:
+    resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
+
   balanced-match@4.0.4:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
     engines: {node: 18 || 20 || >=22}
 
+  bare-events@2.9.2:
+    resolution: {integrity: sha512-AIPKioV7/Y/8KfZ3AAhjPJxLLbY49S64Ym5DakZlUg75qQiTgUq9hEJoEwa4eUezPUlXRy/i5NpsKvo9jgKmoA==}
+    peerDependencies:
+      bare-abort-controller: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+
+  bare-fs@4.8.4:
+    resolution: {integrity: sha512-MPC2eyrpbk3A873sK4y6rk+Iv4o2enxTjHZ8zH3HO0mjrpm5XjnguY2XmfidIsDV6vnjpbMBKUAJpV0ISD2SsQ==}
+    engines: {bare: '>=1.28.0'}
+    peerDependencies:
+      bare-buffer: '*'
+    peerDependenciesMeta:
+      bare-buffer:
+        optional: true
+
+  bare-path@3.1.2:
+    resolution: {integrity: sha512-ZyKbsuuqK6Ag0K8pX6V5Txq6XeJRvY+wXucnFGRjiyVYP9YWDpIQugk/b+enRYrEYBJaqLzghRQpXPMR7341Nw==}
+
+  bare-stream@2.13.4:
+    resolution: {integrity: sha512-PcrQ8lVLbiJscNm1Kez+Yp4Gy4AHGcN1lzwjvf5NybWen7VvEgUfyfnXYJ2zNqWnzOfCb1Abq6lH8ti0syQszA==}
+    peerDependencies:
+      bare-abort-controller: '*'
+      bare-buffer: '*'
+      bare-events: '*'
+    peerDependenciesMeta:
+      bare-abort-controller:
+        optional: true
+      bare-buffer:
+        optional: true
+      bare-events:
+        optional: true
+
+  bare-url@2.5.5:
+    resolution: {integrity: sha512-iM9qJCruvpt2rPaLsrumVDru9pogI7PHziHIa9kTNRFt8C8HuSa+kI9kFezK+NvHEFnnz71rKGZ1EAilq/3V/Q==}
+
+  base64-js@1.5.1:
+    resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
+
   baseline-browser-mapping@2.11.30:
     resolution: {integrity: sha512-YJs6Pz17RMNv8HoyKREtCY38E3BV1nPkWVmIb+XN1uHC1Vqt3KZCH/uJH9ZKRoiKb/icZ6tvehyee6RZNbFfRA==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
+  before-after-hook@4.0.0:
+    resolution: {integrity: sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==}
+
+  binary@0.3.0:
+    resolution: {integrity: sha512-D4H1y5KYwpJgK8wk1Cue5LLPgmwHKYSChkbspQg5JtVuR5ulGckxfR62H3AE9UDkdMC8yyXlqYihuz3Aqg2XZg==}
+
   blake3-wasm@2.1.5:
     resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==}
 
@@ -3334,6 +3605,12 @@ packages:
   boolbase@1.0.0:
     resolution: {integrity: sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww==}
 
+  bottleneck@2.19.5:
+    resolution: {integrity: sha512-VHiNCbI1lKdl44tGrhNfU3lup0Tj/ZBMJB5/2ZbNXRCPuRCO7ed2mgcK4r17y+KB2EfuYuRaVlwNbAeaWGSpbw==}
+
+  brace-expansion@2.1.7:
+    resolution: {integrity: sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==}
+
   brace-expansion@5.0.12:
     resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
     engines: {node: 20 || >=22}
@@ -3347,6 +3624,17 @@ packages:
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
+  buffer-crc32@1.0.0:
+    resolution: {integrity: sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==}
+    engines: {node: '>=8.0.0'}
+
+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
+  buffers@0.1.1:
+    resolution: {integrity: sha512-9q/rDEGSb/Qsvv2qvzIzdluL5k7AaJOTrw23z9reQthrbF7is4CtlT0DXyO1oei2DCp4uojjzQ7igaSHp1kAEQ==}
+    engines: {node: '>=0.2.0'}
+
   builtin-modules@5.4.0:
     resolution: {integrity: sha512-JCWSCdun+4Ovd9BhM/Vtlmwb7oD6Wl4YiPRXXwhAuwlPhW1un/MKgXn7GZoFm53ginnoNzus69V8JWx0K393jg==}
     engines: {node: '>=18.20'}
@@ -3374,6 +3662,18 @@ packages:
   cacheable@2.5.0:
     resolution: {integrity: sha512-60cyAOytib/OzBw1JNSoSV/boK1AtHryDIjvVBk7XbN4ugfkM3+Sry7fEjNgPMGgOjuaZPAp8ruZ0Cxafwyq9g==}
 
+  call-bind-apply-helpers@1.0.2:
+    resolution: {integrity: sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bind@1.0.9:
+    resolution: {integrity: sha512-a/hy+pNsFUTR+Iz8TCJvXudKVLAnz/DyeSUo10I5yvFDQJBFU2s9uqQpoSrJlroHUKoKqzg+epxyP9lqFdzfBQ==}
+    engines: {node: '>= 0.4'}
+
+  call-bound@1.0.4:
+    resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
+    engines: {node: '>= 0.4'}
+
   callsites@3.1.0:
     resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
     engines: {node: '>=6'}
@@ -3392,6 +3692,9 @@ packages:
     resolution: {integrity: sha512-XWAtwJ6OHO+tj0EKCs0Y2UamnyOxseZWltU4x2U2wh8g4AigdjwvtUjvLP2tqkA/avxHEtzxNaqGq/YGNwckKg==}
     engines: {node: '>=18'}
 
+  chainsaw@0.1.0:
+    resolution: {integrity: sha512-75kWfWt6MEKNC8xYXIdRpDehRYY/tNSgwKaJq+dbbDcxORuVrrQ+SEHoWsniVn9XPYfP4gmdWIeDk/4YNp1rNQ==}
+
   chalk@4.1.2:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
@@ -3485,6 +3788,10 @@ packages:
   compare-versions@6.1.1:
     resolution: {integrity: sha512-4hm4VPpIecmlg59CHXnRDnqGplJFrbLG4aFEl5vl6cK1u76ws3LLvX7ikFnTDl5vo39sjWD6AaDPYodJp/NNHg==}
 
+  compress-commons@6.0.2:
+    resolution: {integrity: sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==}
+    engines: {node: '>= 14'}
+
   confbox@0.1.8:
     resolution: {integrity: sha512-RMtmw0iFkeR4YV+fUOSucriAQNb9g8zFR52MWCtl+cCZOFRNL6zeB395vPzFhEjjn4fMxXudmELnl/KF/WrK6w==}
 
@@ -3502,6 +3809,10 @@ packages:
     resolution: {integrity: sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==}
     engines: {node: '>=18'}
 
+  content-type@3.1.1:
+    resolution: {integrity: sha512-GW4qUsfFo59d0HbUibDlWv5wPz+vAAcaTWbKIuKCf0JkC7wWkSyf8f13IpXn5JkeMlB2P8iTSSIjwXljorg2vA==}
+    engines: {node: '>=22'}
+
   conventional-changelog-angular@9.4.0:
     resolution: {integrity: sha512-HdxRxuS8bBXVIuo4V82gvSwAXT0vYQUizrjs/izmPg5JdDstr8v8I5hduGL3iQbG+o310dUDxC4+LetuS5hu9w==}
     engines: {node: '>=22'}
@@ -3537,6 +3848,9 @@ packages:
     resolution: {integrity: sha512-52r6fkXgxv4GLMjmFcMWRx7X9bw071xTTdrDcdyPGRqU2oE+9pCG0bAOMifSBdLw0JRBZKEF0q3B55qPlLuE8g==}
     engines: {node: '>=6.4.0'}
 
+  core-util-is@1.0.3:
+    resolution: {integrity: sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==}
+
   cosmiconfig@9.0.2:
     resolution: {integrity: sha512-gtTZxTDau1wL7Y7zifc2dd8jHSK/k6BTx/2Xp/BpdlAdnlYWFVt7qhJqgwi7637yRwRQ3qL4ZidbB4I8tA5VOg==}
     engines: {node: '>=14'}
@@ -3546,6 +3860,15 @@ packages:
       typescript:
         optional: true
 
+  crc-32@1.2.2:
+    resolution: {integrity: sha512-ROmzCKrTnOwybPcJApAA6WBWij23HVfGVNKqqrZpuyZOHqK2CwHSvpGuyt/UNNvaIjEd8X5IFGp4Mh+Ie1IHJQ==}
+    engines: {node: '>=0.8'}
+    hasBin: true
+
+  crc32-stream@6.0.0:
+    resolution: {integrity: sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g==}
+    engines: {node: '>= 14'}
+
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -3609,6 +3932,18 @@ packages:
     resolution: {integrity: sha512-0LrrStPOdJj+SPCCrGhzryycLjwcgUSHBtxNA8aIDxf0GLsRh1cKYhB00Gd1lDOS4yGH69+SNn13+TWbVHETFQ==}
     engines: {node: ^10 || ^12.20.0 || ^14.13.0 || >=15.0.0, npm: '>=7.0.0'}
 
+  data-view-buffer@1.0.2:
+    resolution: {integrity: sha512-EmKO5V3OLXh1rtK2wgXRansaK1/mtVdTUEiEI0W8RkvgT05kfxaH29PliLnpLP73yYO6142Q72QNa8Wx/A5CqQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-length@1.0.2:
+    resolution: {integrity: sha512-tuhGbE6CfTM9+5ANGf+oQb72Ky/0+s3xKUpHvShfiz2RxMFgFPjsXuRLBVMtvMs15awe45SRb83D6wH4ew6wlQ==}
+    engines: {node: '>= 0.4'}
+
+  data-view-byte-offset@1.0.1:
+    resolution: {integrity: sha512-BS8PfmtDGnrgYdOonGZQdLZslWIeCGFP9tpan0hi1Co2Zr2NKADsvGYA8XxuG/4UWgJ6Cjtv+YJnB6MM69QGlQ==}
+    engines: {node: '>= 0.4'}
+
   debug@4.4.3:
     resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
     engines: {node: '>=6.0'}
@@ -3636,10 +3971,18 @@ packages:
     resolution: {integrity: sha512-m1pAzaJgZ/gssEqlOhJkPJp8Xly7QyW6xcrkUa2KKcDeDSEMP7X8xipU3snUcfisTQx0w1AGae+9UtJSfVnXGw==}
     engines: {node: '>=18'}
 
+  define-data-property@1.1.4:
+    resolution: {integrity: sha512-rBMvIzlpA8v6E+SJZoo++HAYqsLrkg7MSfIinMPFhmkorw7X+dOXVJQs+QT69zGkzMyfDnIMN2Wid1+NbL3T+A==}
+    engines: {node: '>= 0.4'}
+
   define-lazy-prop@3.0.0:
     resolution: {integrity: sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==}
     engines: {node: '>=12'}
 
+  define-properties@1.2.1:
+    resolution: {integrity: sha512-8QmQKqEASLd5nx0U1B1okLElbUuuttJ/AnYmRXbbbGDWh6uS208EjD4Xqq/I9wK7u0v6O08XhTWnt5XtEbR6Dg==}
+    engines: {node: '>= 0.4'}
+
   defu@6.1.7:
     resolution: {integrity: sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==}
 
@@ -3722,6 +4065,13 @@ packages:
       oxc-resolver:
         optional: true
 
+  dunder-proto@1.0.1:
+    resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
+    engines: {node: '>= 0.4'}
+
+  eastasianwidth@0.2.0:
+    resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
+
   echarts@6.1.0:
     resolution: {integrity: sha512-q0yaFPggC9FUdsWH4blavRWFmxdrIodbkoKNAjJudAI6CA9gNPxHtV2RcZNEepZVlk4yvBYkOkbk6HIVpIyHZA==}
 
@@ -3737,6 +4087,9 @@ packages:
   emoji-regex@8.0.0:
     resolution: {integrity: sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==}
 
+  emoji-regex@9.2.2:
+    resolution: {integrity: sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==}
+
   empathic@2.1.0:
     resolution: {integrity: sha512-AnfC1ATldl49/cvZdLPDjBfrRNwbDO05aibiOtzQu3qtlbJtomNLhF30HEtn/7iBz50dlMECqATo3fG0LrdEgw==}
     engines: {node: '>=14'}
@@ -3767,12 +4120,40 @@ packages:
   error-stack-parser-es@1.0.5:
     resolution: {integrity: sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==}
 
+  es-abstract-get@1.0.0:
+    resolution: {integrity: sha512-6PMWXpdhshVvFp+FoWYs1EvG1Nj0tvk0dZM+XcK0xMEM1czRVcP6ohqPWHy6qPagSpC8j4+p89WXlT+xXJs/fg==}
+    engines: {node: '>= 0.4'}
+
+  es-abstract@1.24.2:
+    resolution: {integrity: sha512-2FpH9Q5i2RRwyEP1AylXe6nYLR5OhaJTZwmlcP0dL/+JCbgg7yyEo/sEK6HeGZRf3dFpWwThaRHVApXSkW3xeg==}
+    engines: {node: '>= 0.4'}
+
+  es-define-property@1.0.1:
+    resolution: {integrity: sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==}
+    engines: {node: '>= 0.4'}
+
+  es-errors@1.3.0:
+    resolution: {integrity: sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==}
+    engines: {node: '>= 0.4'}
+
   es-module-lexer@2.3.2:
     resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
 
   es-module-lexer@3.0.4:
     resolution: {integrity: sha512-BldNY5mwkVu+cQ5Ymn3e6hB9Sx8XHx4ZevWbiUyZbfKxJxYO27Hf0wfzkxIaD5CAJMaGl3YspKELj0ff/7nCMA==}
 
+  es-object-atoms@1.1.2:
+    resolution: {integrity: sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw==}
+    engines: {node: '>= 0.4'}
+
+  es-set-tostringtag@2.1.0:
+    resolution: {integrity: sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==}
+    engines: {node: '>= 0.4'}
+
+  es-to-primitive@1.3.4:
+    resolution: {integrity: sha512-yPDz7wqpg1/mmHLmS3tcfTfbw5f1eryXvyghYBffGdERwe+mV7ZcWzTR8LR17Kvqt3qfPurjlonmnq3MKXIOXw==}
+    engines: {node: '>= 0.4'}
+
   es-toolkit@1.52.0:
     resolution: {integrity: sha512-XTNEJQh1tY1ZJVcf6ayP/2n4ZPyaHlW2FWs7xvw5ddPuhUVjLD3olQVQS7kf58JbAB48iL0uL/jerTrjtV3lDA==}
 
@@ -4117,9 +4498,20 @@ packages:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
+  event-target-shim@5.0.1:
+    resolution: {integrity: sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==}
+    engines: {node: '>=6'}
+
   eventemitter3@5.0.4:
     resolution: {integrity: sha512-mlsTRyGaPBjPedk6Bvw+aqbsXDtoAyAzm5MO7JgU+yVRyMQ5O8bD4Kcci7BS85f93veegeCPkL8R4GLClnjLFw==}
 
+  events-universal@1.0.1:
+    resolution: {integrity: sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw==}
+
+  events@3.3.0:
+    resolution: {integrity: sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==}
+    engines: {node: '>=0.8.x'}
+
   expect-type@1.4.0:
     resolution: {integrity: sha512-KfYbmpRm0VbLjEvVa9yGwCi9GI34xvi7A/HXYWQO65CSD2u3MczUJSuwXKFIxlGsgBQizV9q5J9NHj4VG0n+pA==}
     engines: {node: '>=12.0.0'}
@@ -4139,6 +4531,9 @@ packages:
   fast-diff@1.3.0:
     resolution: {integrity: sha512-VxPP4NqbUjj6MaAOafWeUn2cXWLcCtljklUtZf0Ind4XQ+QPtmA0b18zZy0jIQx+ExRVCR/ZQpBmik5lXshNsw==}
 
+  fast-fifo@1.3.2:
+    resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==}
+
   fast-glob@3.3.3:
     resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
     engines: {node: '>=8.6.0'}
@@ -4164,6 +4559,13 @@ packages:
   fast-wrap-ansi@0.2.2:
     resolution: {integrity: sha512-7F2Fl+TjRSenLqlU3UjSH0iyqopqoZIu7eZVpEirP2g1GtWa2G/ecEmBdgz31+Mxr+ELclgg6sokpSFIQiZ02Q==}
 
+  fast-xml-builder@1.3.1:
+    resolution: {integrity: sha512-pIM/1n3ntFXKYrUZwW7QCK0gAW7XY+wzj1YMIV3tLDvPj/V+zTGJK5e3/4WJfwj0qWw2ElNXiTixda/R+3YSug==}
+
+  fast-xml-parser@5.11.2:
+    resolution: {integrity: sha512-R9iDuNrQYeQut46cn2r2wHKn4HYzVDvDm5J1wW+koZewykv0yuO2HChTYeZtrULyHIDM9cj9TUXloCsueCQUog==}
+    hasBin: true
+
   fastest-levenshtein@1.0.16:
     resolution: {integrity: sha512-eRnCtTTtGZFpQCwhJiUOuxPQWRXVKYDn0b2PeHfXL6/Zi53SLAzAHfVhVWK2AryC/WH05kGfxhFIPvTF0SXQzg==}
     engines: {node: '>= 4.9.1'}
@@ -4208,6 +4610,9 @@ packages:
   flat-cache@6.1.23:
     resolution: {integrity: sha512-f++BY9pTk+983xK1FLzlLpmM0i0z+jHmx3QESGkURMXujQZz1k5wzwX6hjnQ8goaD0B+sYnDK1yZ6MTyZfUaqA==}
 
+  flatbuffers@25.9.23:
+    resolution: {integrity: sha512-MI1qs7Lo4Syw0EOzUl0xjs2lsoeqFku44KpngfIduHBYvzm8h2+7K8YMQh1JtVVVrUvhLpNwqVi4DERegUJhPQ==}
+
   flatted@3.4.4:
     resolution: {integrity: sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==}
 
@@ -4225,6 +4630,14 @@ packages:
     resolution: {integrity: sha512-Wp1zXWPVUPBmfoa3Cqc9ctaKuzKAV6uLstRqlR56kSjplf5uAce+qeyYym7F+PHbGTk+tCEdkCW6RD7DX/gBZw==}
     engines: {node: '>=20'}
 
+  for-each@0.3.5:
+    resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
+    engines: {node: '>= 0.4'}
+
+  foreground-child@3.3.1:
+    resolution: {integrity: sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==}
+    engines: {node: '>=14'}
+
   format@0.2.2:
     resolution: {integrity: sha512-wzsgA6WOq+09wrU1tsJ09udeR/YZRaeArL9e1wPbFg3GG2yDnC2ldKpxs4xunpFF9DgqCqOIra3bc1HWrJ37Ww==}
     engines: {node: '>=0.4.x'}
@@ -4241,10 +4654,24 @@ packages:
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
     os: [darwin]
 
+  function-bind@1.1.2:
+    resolution: {integrity: sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==}
+
   function-timeout@1.0.2:
     resolution: {integrity: sha512-939eZS4gJ3htTHAldmyyuzlrD58P03fHG49v2JfFXbV6OhvZKRC9j2yAtdHw/zrp2zXHuv05zMIy40F0ge7spA==}
     engines: {node: '>=18'}
 
+  function.prototype.name@1.2.0:
+    resolution: {integrity: sha512-jObKIik1P2QjPHP5nz5BaOtUlfgS0fWo8IUByNXkM+o+02sJOi94em77GwJKQSJ3gfPHdgzLNrHc1uokV4P/ew==}
+    engines: {node: '>= 0.4'}
+
+  functions-have-names@1.2.3:
+    resolution: {integrity: sha512-xckBUXyTIqT97tq2x2AMb+g163b5JFysYk0x4qxNFwbfQkmNZoiRHb6sPzI9/QV33WeuvVYBUIiD4NzNIyqaRQ==}
+
+  generator-function@2.0.1:
+    resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
+    engines: {node: '>= 0.4'}
+
   gensync@1.0.0-beta.2:
     resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
     engines: {node: '>=6.9.0'}
@@ -4257,6 +4684,18 @@ packages:
     resolution: {integrity: sha512-XjH1AECxf0giL2V1aU8vKyRR2ppRUb5c0EvT7zuJTokQ74bNo52zOtghqdWIqrhUD79fo3x0WfKZdOqxF6LG1Q==}
     engines: {node: '>=18'}
 
+  get-intrinsic@1.3.0:
+    resolution: {integrity: sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==}
+    engines: {node: '>= 0.4'}
+
+  get-proto@1.0.1:
+    resolution: {integrity: sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==}
+    engines: {node: '>= 0.4'}
+
+  get-symbol-description@1.1.0:
+    resolution: {integrity: sha512-w9UMqWwJxHNOvoNzSJ2oPF5wvYcvP7jUvYzhp67yEhTi17ZDBBC1z9pTdGuzjD+EFIqLSYRweZjqfiPzQ06Ebg==}
+    engines: {node: '>= 0.4'}
+
   get-tsconfig@4.14.3:
     resolution: {integrity: sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA==}
 
@@ -4288,6 +4727,11 @@ packages:
     resolution: {integrity: sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==}
     engines: {node: '>=10.13.0'}
 
+  glob@10.5.0:
+    resolution: {integrity: sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==}
+    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
+    hasBin: true
+
   glob@13.0.6:
     resolution: {integrity: sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==}
     engines: {node: 18 || 20 || >=22}
@@ -4312,6 +4756,10 @@ packages:
     resolution: {integrity: sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==}
     engines: {node: '>=18'}
 
+  globalthis@1.0.4:
+    resolution: {integrity: sha512-DpLKbNU4WylpxJykQujfCcwYWiV/Jhm50Goo0wrVILAv5jOr9d+H+UR3PhSCD2rCCEIg0uc+G+muBTwD54JhDQ==}
+    engines: {node: '>= 0.4'}
+
   globby@16.2.4:
     resolution: {integrity: sha512-c8B/VNLmxRcmqqenRA9t+9IyOjf9+V6lTxPaUJLqOCONdQkWZ0ETYgX0qbtJqPsgCNusT9MZ5Jeidw8Eb9tn2g==}
     engines: {node: '>=20'}
@@ -4322,12 +4770,20 @@ packages:
   globrex@0.1.2:
     resolution: {integrity: sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==}
 
+  gopd@1.2.0:
+    resolution: {integrity: sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==}
+    engines: {node: '>= 0.4'}
+
   graceful-fs@4.2.11:
     resolution: {integrity: sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==}
 
   h3@1.15.11:
     resolution: {integrity: sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg==}
 
+  has-bigints@1.1.0:
+    resolution: {integrity: sha512-R3pbpkcIqv2Pm3dUwgjclDRVmWpTJW2DcMzcIhEXEx1oh/CEMObMm3KLmRJOdvhM7o4uQBnwr8pzRK2sJWIqfg==}
+    engines: {node: '>= 0.4'}
+
   has-flag@4.0.0:
     resolution: {integrity: sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==}
     engines: {node: '>=8'}
@@ -4336,10 +4792,29 @@ packages:
     resolution: {integrity: sha512-CsNUt5x9LUdx6hnk/E2SZLsDyvfqANZSUq4+D3D8RzDJ2M+HDTIkF60ibS1vHaK55vzgiZw1bEPFG9yH7l33wA==}
     engines: {node: '>=12'}
 
+  has-property-descriptors@1.0.2:
+    resolution: {integrity: sha512-55JNKuIW+vq4Ke1BjOTjM2YctQIvCT7GFzHwmfZPGo5wnrgkid0YQtnAleFSqumZm4az3n2BS+erby5ipJdgrg==}
+
+  has-proto@1.2.0:
+    resolution: {integrity: sha512-KIL7eQPfHQRC8+XluaIw7BHUwwqL19bQn4hzNgdr+1wXoU0KKj6rufu47lhY7KbJR2C6T6+PfyN0Ea7wkSS+qQ==}
+    engines: {node: '>= 0.4'}
+
+  has-symbols@1.1.0:
+    resolution: {integrity: sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==}
+    engines: {node: '>= 0.4'}
+
+  has-tostringtag@1.0.2:
+    resolution: {integrity: sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==}
+    engines: {node: '>= 0.4'}
+
   hashery@1.5.1:
     resolution: {integrity: sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==}
     engines: {node: '>=20'}
 
+  hasown@2.0.4:
+    resolution: {integrity: sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A==}
+    engines: {node: '>= 0.4'}
+
   hast-util-to-html@9.0.5:
     resolution: {integrity: sha512-OguPdidb+fbHQSU4Q4ZiLKnzWo8Wwsf5bZfbvu7//a9oTYoqD/fWpe96NuHkoS9h0ccGOTe0C4NGXdtS0iObOw==}
 
@@ -4396,11 +4871,6 @@ packages:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
-  husky@9.1.7:
-    resolution: {integrity: sha512-5gs5ytaNjBrh5Ow3zrvdUUY+0VxIuWVL4i9irt6friV+BqdCfmV11CQTWMiBYWHbXhco+J1kHfTOUkePhCDvMA==}
-    engines: {node: '>=18'}
-    hasBin: true
-
   iconv-lite@0.7.3:
     resolution: {integrity: sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==}
     engines: {node: '>=0.10.0'}
@@ -4409,6 +4879,9 @@ packages:
     resolution: {integrity: sha512-SLX4H/vtcYlYnL7XqnuJKHU7Z8517TgsW9nmQiGOgMCjQ8V/deLYu6bEmbGoXe7WMMhc9+EUGyFFneHja8KabA==}
     engines: {node: '>=18'}
 
+  ieee754@1.2.1:
+    resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
+
   ignore-walk@8.0.0:
     resolution: {integrity: sha512-FCeMZT4NiRQGh+YkeKMtWrOmBgWjHjMJ26WQWrRQyoyzqevdaGSakUaJW5xQYmjLlUVk2qUnCjYVBax9EKKg8A==}
     engines: {node: ^20.17.0 || >=22.9.0}
@@ -4443,6 +4916,9 @@ packages:
   individual@3.0.0:
     resolution: {integrity: sha512-rUY5vtT748NMRbEMrTNiFfy29BgGZwGXUi2NFUVMWQrogSLzlJvQV9eeMWi+g1aVaQ53tpyLAQtd5x/JH0Nh1g==}
 
+  inherits@2.0.4:
+    resolution: {integrity: sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==}
+
   ini@1.3.8:
     resolution: {integrity: sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==}
 
@@ -4450,6 +4926,10 @@ packages:
     resolution: {integrity: sha512-IBTdIkzZNOpqm7q3dRqJvMaldXjDHWkEDfrwGEQTs5eaQMWV+djAhR+wahyNNMAa+qpbDUhBMVt4ZKNwpPm7xQ==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  internal-slot@1.1.0:
+    resolution: {integrity: sha512-4gd7VpWNQNB4UKKCFFVcp1AVv+FMOgs9NKzjHKusc8jTMhd5eL1NqQqOpE0KzMds804/yHlglp3uxgluOqAPLw==}
+    engines: {node: '>= 0.4'}
+
   ip-address@10.7.4:
     resolution: {integrity: sha512-DWBMKyeM25D70nrIiTkgQth59/G+naKOTep6huF9j+GmeK3DMD60Zvxg5d5qQnz+38AHgou6ean2LECX+lrKDg==}
     engines: {node: '>= 12'}
@@ -4457,13 +4937,41 @@ packages:
   iron-webcrypto@1.2.1:
     resolution: {integrity: sha512-feOM6FaSr6rEABp/eDfVseKyTMDt+KGpeB35SkVn9Tyn0CqvVsY3EwI0v5i8nMHyJnzCIQf7nsy3p41TPkJZhg==}
 
+  is-array-buffer@3.0.5:
+    resolution: {integrity: sha512-DDfANUiiG2wC1qawP66qlTugJeL5HyzMpfr8lLK+jMQirGzNod0B12cFB/9q838Ru27sBwfw78/rdoU7RERz6A==}
+    engines: {node: '>= 0.4'}
+
   is-arrayish@0.2.1:
     resolution: {integrity: sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg==}
 
+  is-async-function@2.1.1:
+    resolution: {integrity: sha512-9dgM/cZBnNvjzaMYHVoxxfPj2QXt22Ev7SuuPrs+xav0ukGB0S6d4ydZdEiM48kLx5kDV+QBPrpVnFyefL8kkQ==}
+    engines: {node: '>= 0.4'}
+
+  is-bigint@1.1.0:
+    resolution: {integrity: sha512-n4ZT37wG78iz03xPRKJrHTdZbe3IicyucEtdRsV5yglwc3GyUfbAfpSeD0FJ41NbUNSt5wbhqfp1fS+BgnvDFQ==}
+    engines: {node: '>= 0.4'}
+
+  is-boolean-object@1.2.2:
+    resolution: {integrity: sha512-wa56o2/ElJMYqjCjGkXri7it5FbebW5usLw/nPmCMs5DeZ7eziSYZhSmPRn0txqeW4LnAmQQU7FgqLpsEFKM4A==}
+    engines: {node: '>= 0.4'}
+
   is-builtin-module@5.0.0:
     resolution: {integrity: sha512-f4RqJKBUe5rQkJ2eJEJBXSticB3hGbN9j0yxxMQFqIW89Jp9WYFtzfTcRlstDKVUTRzSOTLKRfO9vIztenwtxA==}
     engines: {node: '>=18.20'}
 
+  is-callable@1.2.7:
+    resolution: {integrity: sha512-1BC0BVFhS/p0qtw6enp8e+8OD0UrK0oFLztSjNzhcKA3WDuJxxAPXzPuPtKkjEY9UUoEWlX/8fgKeu2S8i9JTA==}
+    engines: {node: '>= 0.4'}
+
+  is-data-view@1.0.2:
+    resolution: {integrity: sha512-RKtWF8pGmS87i2D6gqQu/l7EYRlVdfzemCJN/P3UOs//x1QE7mfhvzHIApBTRf7axvT6DMGwSwBXYCT0nfB9xw==}
+    engines: {node: '>= 0.4'}
+
+  is-date-object@1.1.0:
+    resolution: {integrity: sha512-PwwhEakHVKTdRNVOw+/Gyh0+MzlCl4R6qKvkhuvLtPMggI1WAHt9sOwZxQLSGpUaDnrdyDsomoRgNnCfKNSXXg==}
+    engines: {node: '>= 0.4'}
+
   is-docker@3.0.0:
     resolution: {integrity: sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -4474,14 +4982,26 @@ packages:
     engines: {node: '>=20'}
     hasBin: true
 
+  is-document.all@1.0.0:
+    resolution: {integrity: sha512-+XSoyS05OdBbhFuELhgTCpFNHkpBOJqtsZfUFFpe5QTw+9Sjbh8zitxhQkYAo6wV7e1Vb8cAPvpCk9jGam/82g==}
+    engines: {node: '>= 0.4'}
+
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
 
+  is-finalizationregistry@1.1.1:
+    resolution: {integrity: sha512-1pC6N8qWJbWoPtEjgcL2xyhQOP491EQjeUo3qTKcmV8YSDDJrOepfG8pcC7h/QgnQHYSv0mJ3Z/ZWxmatVrysg==}
+    engines: {node: '>= 0.4'}
+
   is-fullwidth-code-point@3.0.0:
     resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
     engines: {node: '>=8'}
 
+  is-generator-function@1.1.2:
+    resolution: {integrity: sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==}
+    engines: {node: '>= 0.4'}
+
   is-glob@4.0.3:
     resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
     engines: {node: '>=0.10.0'}
@@ -4495,6 +5015,18 @@ packages:
     engines: {node: '>=14.16'}
     hasBin: true
 
+  is-map@2.0.3:
+    resolution: {integrity: sha512-1Qed0/Hr2m+YqxnM09CjA2d/i6YZNfF6R2oRAOj36eUdS6qIV/huPJNSEpKbupewFs+ZsJlxsjjPbc0/afW6Lw==}
+    engines: {node: '>= 0.4'}
+
+  is-negative-zero@2.0.3:
+    resolution: {integrity: sha512-5KoIu2Ngpyek75jXodFvnafB6DJgr3u8uuK0LEZJjrU19DrMD3EVERaR8sjz8CCGgpZvxPl9SuE1GMVPFHx1mw==}
+    engines: {node: '>= 0.4'}
+
+  is-number-object@1.1.1:
+    resolution: {integrity: sha512-lZhclumE1G6VYD8VHe35wFaIif+CTy5SJIi5+3y4psDgWu4wPDoBhF8NxUOinEc7pHgiTsT6MaBb92rKhhD+Xw==}
+    engines: {node: '>= 0.4'}
+
   is-number@7.0.0:
     resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
     engines: {node: '>=0.12.0'}
@@ -4519,17 +5051,66 @@ packages:
     resolution: {integrity: sha512-GljRxhWvlCNRfZyORiH77FwdFwGcMO620o37EOYC0ORWdq+WYNVqW0w2Juzew4M+L81l6/QS3t5gkkihyRqv9w==}
     engines: {node: '>=0.10.0'}
 
+  is-regex@1.2.1:
+    resolution: {integrity: sha512-MjYsKHO5O7mCsmRGxWcLWheFqN9DJ/2TmngvjKXihe6efViPqc274+Fx/4fYj/r03+ESvBdTXK0V6tA3rgez1g==}
+    engines: {node: '>= 0.4'}
+
+  is-set@2.0.3:
+    resolution: {integrity: sha512-iPAjerrse27/ygGLxw+EBR9agv9Y6uLeYVJMu+QNCoouJ1/1ri0mGrcWpfCqFZuzzx3WjtwxG098X+n4OuRkPg==}
+    engines: {node: '>= 0.4'}
+
+  is-shared-array-buffer@1.0.4:
+    resolution: {integrity: sha512-ISWac8drv4ZGfwKl5slpHG9OwPNty4jOWPRIhBpxOoD+hqITiwuipOQ2bNthAzwA3B4fIjO4Nln74N0S9byq8A==}
+    engines: {node: '>= 0.4'}
+
   is-ssh@1.4.1:
     resolution: {integrity: sha512-JNeu1wQsHjyHgn9NcWTaXq6zWSR6hqE0++zhfZlkFBbScNkyvxCdeV8sRkSBaeLKxmbpR21brail63ACNxJ0Tg==}
 
-  is-windows@1.0.2:
-    resolution: {integrity: sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
-    engines: {node: '>=0.10.0'}
+  is-stream@2.0.1:
+    resolution: {integrity: sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==}
+    engines: {node: '>=8'}
 
-  is-wsl@3.1.1:
+  is-string@1.1.1:
+    resolution: {integrity: sha512-BtEeSsoaQjlSPBemMQIrY1MY0uM6vnS1g5fmufYOtnxLGUZM2178PKbhsk7Ffv58IX+ZtcvoGwccYsh0PglkAA==}
+    engines: {node: '>= 0.4'}
+
+  is-symbol@1.1.1:
+    resolution: {integrity: sha512-9gGx6GTtCQM73BgmHQXfDmLtfjjTUDSyoxTCbp5WtoixAhfgsDirWIcVQ/IHpvI5Vgd5i/J5F7B9cN/WlVbC/w==}
+    engines: {node: '>= 0.4'}
+
+  is-typed-array@1.1.15:
+    resolution: {integrity: sha512-p3EcsicXjit7SaskXHs1hA91QxgTw46Fv6EFKKGS5DRFLD8yKnohjF3hxoju94b/OcMZoQukzpPpBE9uLVKzgQ==}
+    engines: {node: '>= 0.4'}
+
+  is-unsafe@2.0.2:
+    resolution: {integrity: sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ==}
+
+  is-weakmap@2.0.2:
+    resolution: {integrity: sha512-K5pXYOm9wqY1RgjpL3YTkF39tni1XajUIkawTLUo9EZEVUFga5gSQJF8nNS7ZwJQ02y+1YCNYcMh+HIf1ZqE+w==}
+    engines: {node: '>= 0.4'}
+
+  is-weakref@1.1.1:
+    resolution: {integrity: sha512-6i9mGWSlqzNMEqpCp93KwRS1uUOodk2OJ6b+sq7ZPDSy2WuI5NFIxp/254TytR8ftefexkWn5xNiHUNpPOfSew==}
+    engines: {node: '>= 0.4'}
+
+  is-weakset@2.0.4:
+    resolution: {integrity: sha512-mfcwb6IzQyOKTs84CQMrOwW4gQcaTOAWJ0zzJCl2WSPDrWk/OzDaImWFH3djXhb24g4eudZfLRozAvPGw4d9hQ==}
+    engines: {node: '>= 0.4'}
+
+  is-windows@1.0.2:
+    resolution: {integrity: sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
+    engines: {node: '>=0.10.0'}
+
+  is-wsl@3.1.1:
     resolution: {integrity: sha512-e6rvdUCiQCAuumZslxRJWR/Doq4VpPR82kqclvcS0efgt430SlGIk05vdCN58+VrzgtIcfNODjozVielycD4Sw==}
     engines: {node: '>=16'}
 
+  isarray@1.0.0:
+    resolution: {integrity: sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==}
+
+  isarray@2.0.5:
+    resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
+
   isexe@2.0.0:
     resolution: {integrity: sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==}
 
@@ -4541,6 +5122,9 @@ packages:
     resolution: {integrity: sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==}
     engines: {node: '>=0.10.0'}
 
+  jackspeak@3.4.3:
+    resolution: {integrity: sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==}
+
   jiti@2.7.0:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
@@ -4595,6 +5179,9 @@ packages:
   json-stable-stringify-without-jsonify@1.0.1:
     resolution: {integrity: sha512-Bdboy+l7tA3OGW6FjyFHWkP5LuByj1Tk33Ljyq0axyzdk9//JSi2u3fP1QSmd1KNwq6VOKYGlAu87CisVir6Pw==}
 
+  json-with-bigint@3.5.12:
+    resolution: {integrity: sha512-uwbF/wSSuOgC7qqlq27Xp5B6a2MHVug3t0idZdTqu0JnlFvgJuH7ju+KAk/J06C7GfhoYy2gnb9wz2INqcne7w==}
+
   json5@2.2.3:
     resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
     engines: {node: '>=6'}
@@ -4616,6 +5203,10 @@ packages:
   jsqr@1.4.0:
     resolution: {integrity: sha512-dxLob7q65Xg2DvstYkRpkYtmKm2sPJ9oFhrhmudT1dZvNFFTlroai3AWSpLey/w5vMcLBXRgOJsbXpdN9HzU/A==}
 
+  jwt-decode@4.0.0:
+    resolution: {integrity: sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==}
+    engines: {node: '>=18'}
+
   katex@0.16.47:
     resolution: {integrity: sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==}
     hasBin: true
@@ -4638,6 +5229,69 @@ packages:
   known-css-properties@0.37.0:
     resolution: {integrity: sha512-JCDrsP4Z1Sb9JwG0aJ8Eo2r7k4Ou5MwmThS/6lcIe1ICyb7UBJKGRIUUdqc2ASdE/42lgz6zFUnzAIhtXnBVrQ==}
 
+  lazystream@1.0.1:
+    resolution: {integrity: sha512-b94GiNHQNy6JNTrt5w6zNyffMrNkXZb3KTkCZJb2V1xaEGCk093vkZ2jk3tpaeP33/OiXC+WvK9AxUebnf5nbw==}
+    engines: {node: '>= 0.6.3'}
+
+  lefthook-android-arm64@2.2.2:
+    resolution: {integrity: sha512-wb9rQQFLX7u1dJLxvMrq9VUfMYi5kxM7tJQ6Y4mWEOwaU+SmIm2wjoT/nromKq27Y8fh2Qd7FgCD3G1wfW8CnQ==}
+    cpu: [arm64]
+    os: [android]
+
+  lefthook-darwin-arm64@2.2.2:
+    resolution: {integrity: sha512-6V8D3bLnD/60Xhqn0o2EQD6H3Fe/U9LGkt4WF1O/3eBHbux+5ZJqoH0hfrC+Bi9Dy1Ve1AWxiAY7U2asYl8qVA==}
+    cpu: [arm64]
+    os: [darwin]
+
+  lefthook-darwin-x64@2.2.2:
+    resolution: {integrity: sha512-fH/kArZ9ZZ65wCFtvBMgGcq25qwQpkQ5jp93ba+8wpjgxxzjczYGluwHvM/NQDJWLOFXuKXW0yFs76SramQkyQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  lefthook-freebsd-arm64@2.2.2:
+    resolution: {integrity: sha512-MCRsU01ju989QQffOfS3gCeFfyVDXs5B/FzR65fmrNvqcxb98fldvfzzoAbnK2q6SBJlRT3QT1tNEMCxddCwlA==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  lefthook-freebsd-x64@2.2.2:
+    resolution: {integrity: sha512-LkKuJU0S2oLimeoHwPTy1TLWB6GcN0t5lLxiXNlsBKUkr6R47QRcvPMZMoXmu3IetQtd+WliXMLE8qTwi2fqBg==}
+    cpu: [x64]
+    os: [freebsd]
+
+  lefthook-linux-arm64@2.2.2:
+    resolution: {integrity: sha512-d+HFtS2DEKaOnD7vRU0tUz8pNgHwsUYmQ22+1dyXpOrXGyzNXR0AqX5KsIRF36JGhVvO5X5Anw5QYgR3mxVSuA==}
+    cpu: [arm64]
+    os: [linux]
+
+  lefthook-linux-x64@2.2.2:
+    resolution: {integrity: sha512-N/OlQyAhcU6RAXjrwFxLsh70sn96rBoi+XkuLJ8CVBkk9Ci3VDXQayDZTNz5B1xML8RwoMcV8Wblniy1xFOmSA==}
+    cpu: [x64]
+    os: [linux]
+
+  lefthook-openbsd-arm64@2.2.2:
+    resolution: {integrity: sha512-6G/gKXcpIwC+XcODg7ELZYP/hIrVIHQxhy2GoRdVyecmpGMFj+BZo3iqcUmeWusQMuL+UdNexbkrUaeJalIkNw==}
+    cpu: [arm64]
+    os: [openbsd]
+
+  lefthook-openbsd-x64@2.2.2:
+    resolution: {integrity: sha512-eMJGi3/tqKEqu7XCZlqwQWRtK5JlL/9diaqqgRlEdlRD7GxwzHZN21z6awbITum9emea3lALvXFe6V8odQLGOA==}
+    cpu: [x64]
+    os: [openbsd]
+
+  lefthook-windows-arm64@2.2.2:
+    resolution: {integrity: sha512-4P1EaQb5xG1zhYD1RLJ6TEGdFkmHkB+Slqx6yRDPKuBDNxMiD0+kTAAdUY2E8xPuRR35xHpVPR+b3/HtzPrjQQ==}
+    cpu: [arm64]
+    os: [win32]
+
+  lefthook-windows-x64@2.2.2:
+    resolution: {integrity: sha512-9Ck4zancQilBfXT3ZeRipm7Lcq4RQfxyMpy8SAVINw0t/BrbjsT25V46ZuziERcwdajnE4myfMzC33GoCBwr7g==}
+    cpu: [x64]
+    os: [win32]
+
+  lefthook@2.2.2:
+    resolution: {integrity: sha512-37fYHAhL12r1twaEV0PA5TwoIT491eTGGYjhhXxlYNMq3DSkiGZBQ++Jfk5maXj0vq52NRauLtMikBKtbNJs3Q==}
+    hasBin: true
+
   levn@0.4.1:
     resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
     engines: {node: '>= 0.8.0'}
@@ -4797,11 +5451,6 @@ packages:
   lines-and-columns@1.2.4:
     resolution: {integrity: sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg==}
 
-  lint-staged@17.6.0:
-    resolution: {integrity: sha512-nOhBfYkZEwkFtNzD5pK9s9LkcWoxJ+whLzEnhqi9nl7zTB5n7tg8+9iYgMGx2Wm3VlLu8cbNj0RACzY+nWi5iQ==}
-    engines: {node: '>=22.22.1'}
-    hasBin: true
-
   local-pkg@1.2.1:
     resolution: {integrity: sha512-++gUqRDEvcnN6Zhqrr+y/CkVEHhlrR96vZn3nZZPYzMcBUyBtTKzB9NadClFIsIVSsu+3i9tfk/erqy9kAmt7Q==}
     engines: {node: '>=14'}
@@ -4820,9 +5469,15 @@ packages:
   lodash.truncate@4.4.2:
     resolution: {integrity: sha512-jttmRe7bRse52OsWIMDLaXxWqRAmtIUccAQ3garviCqJjafXOfNMO0yMfNpdD6zbGaTU0P5Nz7e7gAT6cKmJRw==}
 
+  lodash@4.18.1:
+    resolution: {integrity: sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==}
+
   longest-streak@3.1.0:
     resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==}
 
+  lru-cache@10.4.3:
+    resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
+
   lru-cache@11.5.3:
     resolution: {integrity: sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==}
     engines: {node: 20 || >=22}
@@ -4850,6 +5505,10 @@ packages:
   markdown-table@3.0.4:
     resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==}
 
+  math-intrinsics@1.1.0:
+    resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==}
+    engines: {node: '>= 0.4'}
+
   mathml-tag-names@4.0.0:
     resolution: {integrity: sha512-aa6AU2Pcx0VP/XWnh8IGL0SYSgQHDT6Ucror2j2mXeFAlN3ahaNs8EZtG1YiticMkSLj3Gt6VPFfZogt7G5iFQ==}
 
@@ -5017,6 +5676,14 @@ packages:
     resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
     engines: {node: 18 || 20 || >=22}
 
+  minimatch@5.1.9:
+    resolution: {integrity: sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==}
+    engines: {node: '>=10'}
+
+  minimatch@9.0.9:
+    resolution: {integrity: sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==}
+    engines: {node: '>=16 || 14 >=14.17'}
+
   minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
 
@@ -5052,6 +5719,10 @@ packages:
     resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
     engines: {node: '>= 18'}
 
+  mkdirp@0.5.6:
+    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
+    hasBin: true
+
   mlly@1.8.2:
     resolution: {integrity: sha512-d+ObxMQFmbt10sretNDytwt85VrbkhhUA/JBGm1MPaWJ65Cl4wOgLaB1NYvJSZ0Ef03MMEU/0xpPMXUIQ29UfA==}
 
@@ -5169,6 +5840,18 @@ packages:
   object-deep-merge@2.0.1:
     resolution: {integrity: sha512-aKttDKcU3pyZqKcCkDhsMn70WmZFG2JGDQLP9EcLyTSIFQRCPWLAmBZRLJnrVUrhPG1jETEEbfdgbNtJf1LyMg==}
 
+  object-inspect@1.13.4:
+    resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
+    engines: {node: '>= 0.4'}
+
+  object-keys@1.1.1:
+    resolution: {integrity: sha512-NuAESUOUMrlIXOfHKzD6bpPu3tYt3xvjNdRIQ+FeT0lNb4K8WR70CaDxhuNguS2XG+GjkyMwOzsN5ZktImfhLA==}
+    engines: {node: '>= 0.4'}
+
+  object.assign@4.1.7:
+    resolution: {integrity: sha512-nK28WOo+QIjBkDduTINE4JkF/UJJKyf2EJxvJKfblDpyg0Q+pkOHNTL0Qwy6NP6FhE/EnzV73BxxqcJaXY9anw==}
+    engines: {node: '>= 0.4'}
+
   obug@3.0.0:
     resolution: {integrity: sha512-5vvB5+W7ePv+p3uqxi+RcW1XAzLW0/hxt3/4X4Lc4qHudzOhmBiBwOY6DRob4WnanAEGvNcLjF+KNOufrUoEQw==}
     engines: {node: '>=12.20.0'}
@@ -5193,6 +5876,10 @@ packages:
     resolution: {integrity: sha512-6IpQ7mKUxRcZNLIObR0hz7lxsapSSIYNZJwXPGeF0mTVqGKFIXj1DQcMoT22S3ROcLyY/rz0PWaWZ9ayWmad9g==}
     engines: {node: '>= 0.8.0'}
 
+  own-keys@1.0.2:
+    resolution: {integrity: sha512-19YVAg7T+WTrxggPukVq7DjTv6+PJ867TmhCvBsYwmbFCsZd344rq2Ld1p0wo8f8Qrrhgp82c6FJRqdXWtSEhg==}
+    engines: {node: '>= 0.4'}
+
   oxc-parser@0.154.0:
     resolution: {integrity: sha512-Gr/6fkjZwi937c4Tsz8y0iO4U0FLPkZI6JSVucLAIvQyqh379px7RS8ORIc0HOORbFjXZ6zyqWLl53qxhSeofw==}
     engines: {node: ^20.19.0 || >=22.12.0}
@@ -5268,6 +5955,9 @@ packages:
     resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
     engines: {node: '>=6'}
 
+  package-json-from-dist@1.0.1:
+    resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
+
   package-manager-detector@1.9.0:
     resolution: {integrity: sha512-zAMfbta9nPA8AKkA4WdmNAT8R8s6Dk0/xwPsqNnRidMFcLo1YkLuPDTgs2f64XdzS8vbLNnoJ+uUIkgbz7oRHA==}
 
@@ -5308,10 +5998,18 @@ packages:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
     engines: {node: '>=8'}
 
+  path-expression-matcher@1.6.2:
+    resolution: {integrity: sha512-enSlaiat05iasnzmgNxRj8reFdj3puY2QpNgP1aPIaVfT6nn9ICuPoFlKHk8EN22HcwewshO+mN2DGbkCEOtqQ==}
+    engines: {node: '>=14.0.0'}
+
   path-key@3.1.1:
     resolution: {integrity: sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==}
     engines: {node: '>=8'}
 
+  path-scurry@1.11.1:
+    resolution: {integrity: sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==}
+    engines: {node: '>=16 || 14 >=14.18'}
+
   path-scurry@2.0.2:
     resolution: {integrity: sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==}
     engines: {node: 18 || 20 || >=22}
@@ -5339,6 +6037,10 @@ packages:
     resolution: {integrity: sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==}
     engines: {node: '>=12'}
 
+  pkg-pr-new@0.0.91:
+    resolution: {integrity: sha512-FQPmjspKRKYV4MlHQnun9snJqlYm6Yhmo12x1O3pgE2Akim/y/BZjMOppK//BFdh222WOj6WGqlmeZfrtUtfgQ==}
+    hasBin: true
+
   pkg-types@1.3.1:
     resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
 
@@ -5366,6 +6068,10 @@ packages:
   pnpm-workspace-yaml@1.9.1:
     resolution: {integrity: sha512-Xj/T2X6DNAWbtk/9UQ0/TJRswltiHZevmcMjqoL7WrpJi67lu3qaslU4+I+zJ8wtwqmuvAE0KkB8rbv2ZdogBg==}
 
+  possible-typed-array-names@1.1.0:
+    resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
+    engines: {node: '>= 0.4'}
+
   postcss-attribute-case-insensitive@8.0.2:
     resolution: {integrity: sha512-vziJbOnUBWOzSwDpXJSVmBKz2KPP51/QNNXTZ/Vg3md/7BHbWrXCayHWbf8ekJoJDusqfkZcUdfM/i5txlK2sw==}
     engines: {node: '>=20.19.0'}
@@ -5598,9 +6304,9 @@ packages:
     peerDependencies:
       postcss: ^8.4.20
 
-  postcss-tailwindcss@3.1.3:
-    resolution: {integrity: sha512-qn1R/SNHa75x61mjSFJkwwupuYZYoH644vWL4XjJZdNzTB4YjgP3FSs+3GFD0rkAXEAN+e3kIq1YibGiCqKgeg==}
-    engines: {node: '>=22.13.0'}
+  postcss-tailwindcss@3.1.5:
+    resolution: {integrity: sha512-uI7NaILvSvwcI/qCLQAgCPE/q9dXeKU++kIPFg1/W1gc5002tIbMGi51k+eVO7EW7yNOPJwCxpse0dHBSyKtUA==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
 
   postcss-value-parser@4.2.0:
     resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==}
@@ -5634,6 +6340,13 @@ packages:
     resolution: {integrity: sha512-tGqJW/UnclpYASFcM6Xh8D8l/BMtaQ9+CSG0vlJSJTcdMM4lDRv4c6H0Pdcsfted+bVczdYSfk2fdukg2gQkZg==}
     engines: {node: '>=18.0.0'}
 
+  process-nextick-args@2.0.1:
+    resolution: {integrity: sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==}
+
+  process@0.11.10:
+    resolution: {integrity: sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==}
+    engines: {node: '>= 0.6.0'}
+
   promise-make-naked@3.0.2:
     resolution: {integrity: sha512-B+b+kQ1YrYS7zO7P7bQcoqqMUizP06BOyNSBEnB5VJKDSWo8fsVuDkfSmwdjF0JsRtaNh83so5MMFJ95soH5jg==}
 
@@ -5684,6 +6397,16 @@ packages:
     resolution: {integrity: sha512-UkRNRIwnhG+y7hpqnycCL/xbTk7+ia9VuVTC0S+zVbwd65DI9eUpRMfsWIGrCWxTU/mi+JW8cHQCrv+zfCbEPQ==}
     engines: {node: '>=10.13'}
 
+  readable-stream@2.3.8:
+    resolution: {integrity: sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==}
+
+  readable-stream@4.8.0:
+    resolution: {integrity: sha512-2jhTTU3Eilp/2DMT71gbcoqC35eQHasMJH0RHkYxwlxIv3+FR6Y5xAFZIwEGLxKkjZYEFlsiMNIdwUqjK2lLHQ==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+
+  readdir-glob@1.1.3:
+    resolution: {integrity: sha512-v05I2k7xN8zXvPD9N+z/uhXPaj0sUFCe2rcWZIpBsqxfP7xXFQ0tipAd/wjj1YxWyWtUS5IDJpOG82JKt2EAVA==}
+
   readdirp@5.1.1:
     resolution: {integrity: sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==}
     engines: {node: '>= 20.19.0'}
@@ -5692,6 +6415,10 @@ packages:
     resolution: {integrity: sha512-J8rn6v4DBb2nnFqkqwy6/NnTYMcgLA+sLr0iIO41qpv0n+ngb7ksag2tMRl0inb1bbO/esUwzW1vbJi7K0sI0g==}
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
 
+  reflect.getprototypeof@1.0.10:
+    resolution: {integrity: sha512-00o4I+DVrefhv+nX0ulyi3biSHCPDe+yLv5o/p6d/UVlirijB8E16FtfwSAi4g3tcqrQ4lRAqQSoFEZJehYEcw==}
+    engines: {node: '>= 0.4'}
+
   regex-recursion@6.0.2:
     resolution: {integrity: sha512-0YCaSCq2VRIebiaUviZNs0cBz1kg5kVS2UKUfNIx8YVs1cN3AV7NTctO5FOKBA+UT2BPJIWZauYHPqJODG50cg==}
 
@@ -5705,20 +6432,24 @@ packages:
     resolution: {integrity: sha512-sZuz1dYW/ZsfG17WSAG7eS85r5a0dDsvg+7BiiYR5o6lKCAtUrEwdmRmaGF6rwVj3LcmAeYkOWKEPlbPzN3Y3A==}
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
 
+  regexp.prototype.flags@1.5.4:
+    resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
+    engines: {node: '>= 0.4'}
+
   regjsparser@0.13.4:
     resolution: {integrity: sha512-EWV80YgFaVgFrjGCAsV7oybp4GOxbls5RzBg8OB0nKEVXsBJR1JlV8Di1JhCROg3MzTfe1RI8yitIm1eOs68iA==}
     hasBin: true
 
-  repoctl@5.10.3:
-    resolution: {integrity: sha512-MF83KLIKGO49hsnT8u/EX6UMk4GyoGXrTxl9kx7foWhFT9IklLiwvTe8IeEEHVzr/w2/yRKGDVGOV2aFzl132w==}
-    engines: {node: '>=22.13.0'}
+  repoctl@6.0.1:
+    resolution: {integrity: sha512-5jA1GZY9OLoSYgXBRSqZBxYXXdJSInUQJewYl22D+yKAAI4cZlgRddMyE1gxaHFrx2ibjFqx4lsa/30Po4ld8w==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
     hasBin: true
     peerDependencies:
       '@commitlint/cli': ^21.2.3
       eslint: ^9.0.0 || ^10.0.0
       stylelint: ^17.16.0
       typescript: ^5.0.0 || ^6.0.0
-      vitest: ^5.0.3
+      vitest: ^5.0.5
     peerDependenciesMeta:
       '@commitlint/cli':
         optional: true
@@ -5808,6 +6539,24 @@ packages:
     resolution: {integrity: sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A==}
     engines: {node: '>=6'}
 
+  safe-array-concat@1.1.4:
+    resolution: {integrity: sha512-wtZlHyOje6OZTGqAoaDKxFkgRtkF9CnHAVnCHKfuj200wAgL+bSJhdsCD2l0Qx/2ekEXjPWcyKkfGb5CPboslg==}
+    engines: {node: '>=0.4'}
+
+  safe-buffer@5.1.2:
+    resolution: {integrity: sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==}
+
+  safe-buffer@5.2.1:
+    resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
+
+  safe-push-apply@1.0.0:
+    resolution: {integrity: sha512-iKE9w/Z7xCzUMIZqdBsp6pEQvwuEebH4vdpjcDWnyzaI6yl6O9FHvVpmGelvEHNsoY6wGblkxR6Zty/h00WiSA==}
+    engines: {node: '>= 0.4'}
+
+  safe-regex-test@1.1.0:
+    resolution: {integrity: sha512-x/+Cz4YrimQxQccJf5mKEbIa1NzeCRNI5Ecl/ekmlYaampdNLPalVyIcCZNNH3MvmqBugV5TMYZXv0ljslUlaw==}
+    engines: {node: '>= 0.4'}
+
   safer-buffer@2.1.2:
     resolution: {integrity: sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg==}
 
@@ -5834,6 +6583,18 @@ packages:
   set-blocking@2.0.0:
     resolution: {integrity: sha512-KiKBS8AnWGEyLzofFfmvKwpdPzqiy16LvQfK3yv/fVH7Bj13/wl3JSR1J+rfgRE9q7xUJK4qvgS8raSOeLUehw==}
 
+  set-function-length@1.2.2:
+    resolution: {integrity: sha512-pgRc4hJ4/sNjWCSS9AmnS40x3bNMDTknHgL5UaMBTMyJnU90EgWh1Rz+MC9eFu4BuN/UwZjKQuY/1v3rM7HMfg==}
+    engines: {node: '>= 0.4'}
+
+  set-function-name@2.0.2:
+    resolution: {integrity: sha512-7PGFlmtwsEADb0WYyvCMa1t+yke6daIG4Wirafur5kcf+MhUnPms1UeR0CKQdTZD81yESwMHbtn+TR+dMviakQ==}
+    engines: {node: '>= 0.4'}
+
+  set-proto@1.0.0:
+    resolution: {integrity: sha512-RJRdvCo6IAnPdsvP/7m6bsQqNnn1FCBX5ZNtFL98MmFF/4xAIJTIg1YbHW5DC2W5SKZanrC6i4HsJqlajw/dZw==}
+    engines: {node: '>= 0.4'}
+
   set-value@4.1.0:
     resolution: {integrity: sha512-zTEg4HL0RwVrqcWs3ztF+x1vkxfm0lP+MQQFPiMJTKVceBwEV0A569Ou8l9IYQG8jOZdMVI1hGsc0tmeD2o/Lw==}
     engines: {node: '>=11.0'}
@@ -5859,6 +6620,22 @@ packages:
     resolution: {integrity: sha512-OcRW72ngQvc+MSVWBRIovC/BTW589iUE/Vxav7VeM4RcY9MUjqB+IR6ILG1k9nuW6LiG/nct9uma4/MBtnZbmQ==}
     engines: {node: '>=20'}
 
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-map@1.0.1:
+    resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
+    engines: {node: '>= 0.4'}
+
+  side-channel-weakmap@1.0.2:
+    resolution: {integrity: sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==}
+    engines: {node: '>= 0.4'}
+
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
+    engines: {node: '>= 0.4'}
+
   signal-exit@4.1.0:
     resolution: {integrity: sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==}
     engines: {node: '>=14'}
@@ -5932,9 +6709,12 @@ packages:
   std-env@4.3.0:
     resolution: {integrity: sha512-OtU/EgQ1kIm5KwqQpBC6ZEMXrZRui11w8zgfTWp8cdO9B8OaPsbA8bTHO2P+HNo1VlUTGMVBwPhydu6poeXiag==}
 
-  string-argv@0.3.2:
-    resolution: {integrity: sha512-aqD2Q0144Z+/RqG52NeHEkZauTAUWJO8c6yTftGJKO3Tja5tUgIfmIl6kExvhtxSDP7fXB6DvzkfMpCd/F3G+Q==}
-    engines: {node: '>=0.6.19'}
+  stop-iteration-iterator@1.1.0:
+    resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
+    engines: {node: '>= 0.4'}
+
+  streamx@2.28.1:
+    resolution: {integrity: sha512-zEzXb0s5Cds7tqMH6rhZ05lcJydCWiQPEwiNngVqzsxCc962vLY4Uw+mW7od8kDH258k2Uz/JrOkdIAAhSh9VA==}
 
   string-ts@2.3.1:
     resolution: {integrity: sha512-xSJq+BS52SaFFAVxuStmx6n5aYZU571uYUnUrPXkPFCfdHyZMMlbP2v2Wx5sNBnAVzq/2+0+mcBLBa3Xa5ubYw==}
@@ -5943,6 +6723,10 @@ packages:
     resolution: {integrity: sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==}
     engines: {node: '>=8'}
 
+  string-width@5.1.2:
+    resolution: {integrity: sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==}
+    engines: {node: '>=12'}
+
   string-width@7.2.0:
     resolution: {integrity: sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==}
     engines: {node: '>=18'}
@@ -5951,6 +6735,24 @@ packages:
     resolution: {integrity: sha512-ZbmZM0JCihQN91dWnxoipT2KOEyHqEyfRXUyjuRhW8b/xnqPDoq4gWEVApTVa9db2wN8mmoikgFBbjh71+cGeQ==}
     engines: {node: '>=20'}
 
+  string.prototype.trim@1.2.11:
+    resolution: {integrity: sha512-PwvK7BU+CMTJGYQCTZb5RWXIML92lftJLhQz1tBzgKiqGxJaMlBAa48POXaNAC2s4y8jr3EFqrkF9+44neS46w==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimend@1.0.10:
+    resolution: {integrity: sha512-2+3aDAOmPTmuFwjDnmJG2ctEkQKVki7vOSqaxkv42Mowj1V6PnvuwFCRrR5lChUux1TBskPjfkeTOhqczDMxTw==}
+    engines: {node: '>= 0.4'}
+
+  string.prototype.trimstart@1.0.8:
+    resolution: {integrity: sha512-UXSH262CSZY1tfu3G3Secr6uGLCFVPMhIqHjlgCUtCCcgihYc/xKs9djMTMUOb2j1mVSeU8EU6NWc/iQKU6Gfg==}
+    engines: {node: '>= 0.4'}
+
+  string_decoder@1.1.1:
+    resolution: {integrity: sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==}
+
+  string_decoder@1.3.0:
+    resolution: {integrity: sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==}
+
   stringify-entities@4.0.4:
     resolution: {integrity: sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg==}
 
@@ -5977,6 +6779,9 @@ packages:
     resolution: {integrity: sha512-SlyRoSkdh1dYP0PzclLE7r0M9sgbFKKMFXpFRUMNuKhQSbC6VQIGzq3E0qsfvGJaUFJPGv6Ws1NZ/haTAjfbMA==}
     engines: {node: '>=12'}
 
+  strnum@2.5.1:
+    resolution: {integrity: sha512-UM4nTLWzQiDBseVxUGxN0wJzIk0UU89Qi7pKXz9qISo+lhviJikTuikBsK/oFRlpvYHvSdz0TVoLyQ+sEpYwxA==}
+
   stylelint-config-html@2.0.0:
     resolution: {integrity: sha512-Lk1NPEdUxzHkPv3ehktjpiOk4MPaqQ3H8fkvhxdWlQpaZCm9ze0SoMbRQLqkUxEMfPE1G9/x968uxm/+d2njoA==}
     engines: {node: ^22.12 || >=24}
@@ -6041,11 +6846,11 @@ packages:
     peerDependencies:
       stylelint: ^16.18.0 || ^17.0.0
 
-  stylelint-plugin-tailwindcss@3.1.3:
-    resolution: {integrity: sha512-IhlJqPD2qnRlO0P+gRjvZt4qocaqNsGMueCSSedRMLZQUDtkeQJlHLt+Ey7PeY/3S3psomAVkXfB5y/GjhuqCQ==}
-    engines: {node: '>=22.13.0'}
+  stylelint-plugin-tailwindcss@3.1.5:
+    resolution: {integrity: sha512-4suvE46C9mFBMV/Fm11fZ2/knwD3+FGr3yAUf3fGxPXJ9hk29FHBkQ5Z6Gma0sMQ1CNfp9Jl7PEniVb/gUkR6w==}
+    engines: {node: ^22.23.4 || ^24.22.1 || >=26.12.1}
     peerDependencies:
-      stylelint: ^17.15.0
+      stylelint: ^17.16.0
       tailwindcss: ^3.4.0 || ^4.0.0
     peerDependenciesMeta:
       tailwindcss:
@@ -6123,10 +6928,19 @@ packages:
     resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
     engines: {node: '>=6'}
 
+  tar-stream@3.2.2:
+    resolution: {integrity: sha512-+8NeqHRjQWH9nYlwo2gamAMImZCVzI4UoEgDpWorBt9OEfppiZn+uSkskzQKPWIZyji/C8fpWO7u69G0DX0tbg==}
+
   tar@7.5.22:
     resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==}
     engines: {node: '>=18'}
 
+  teex@1.0.1:
+    resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}
+
+  text-decoder@1.2.7:
+    resolution: {integrity: sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==}
+
   time-span@5.1.0:
     resolution: {integrity: sha512-75voc/9G4rDIJleOo4jPvN4/YC4GRZrY8yy1uU4lwrB3XEQbWve8zXoO5No4eFrGcTAMYyoY67p8jRQdtA1HbA==}
     engines: {node: '>=12'}
@@ -6173,6 +6987,10 @@ packages:
     resolution: {integrity: sha512-A5F0cM6+mDleacLIEUkmfpkBbnHJFV1d2rprHU2MXNk7mlxHq2zGojA+SRvQD1RoMo9gqjZPWEaKG4v1BQ48lw==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
+  traverse@0.3.10:
+    resolution: {integrity: sha512-pd6fq5qmiFuPA3TpdqBCqJXlOrSdCSt0l9IZDg83Vbf4x3m/X18prEwMMVM5LXp9vGL9NxjeiDGBrTasqyngXQ==}
+    engines: {node: '>= 0.4'}
+
   tree-kill@1.2.2:
     resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
     hasBin: true
@@ -6249,6 +7067,10 @@ packages:
     resolution: {integrity: sha512-50QV99kCKH5P/Vs4E2Gzp7BopNV+KzTXqWeaxrfu5IQJBOULRsTIS9seSsOVT8ZnGXzCyx55nYWAi4qJzpZKEQ==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  tunnel@0.0.6:
+    resolution: {integrity: sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==}
+    engines: {node: '>=0.6.11 <=0.7.0 || >=0.7.3'}
+
   turbo@2.11.10:
     resolution: {integrity: sha512-3GJYwig8ygEI89oaOZdduJX8/aw6O9eRPYHoIt6T3FZl9hkKjiyIspufJoVgqXihPoJu8M5CSV0DlZvzfohBCw==}
     hasBin: true
@@ -6261,6 +7083,26 @@ packages:
     resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
     engines: {node: '>=16'}
 
+  typed-array-buffer@1.0.3:
+    resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-length@1.0.3:
+    resolution: {integrity: sha512-BaXgOuIxz8n8pIq3e7Atg/7s+DpiYrxn4vdot3w9KbnBhcRQq6o3xemQdIfynqSeXeDrF32x+WvfzmOjPiY9lg==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-byte-offset@1.0.5:
+    resolution: {integrity: sha512-0FHJvLPqZ7KJzp17O13jfsAjsqazgrxBu2zEK95PmUz8lv2+GjRuxUInCr2Rk9Dms3ihN21zJ929ZO43yJ95QQ==}
+    engines: {node: '>= 0.4'}
+
+  typed-array-length@1.0.8:
+    resolution: {integrity: sha512-phPGCwqr2+Qo0fwniCE8e4pKnGu/yFb5nD5Y8bf0EEeiI5GklnACYA9GFy/DrAeRrKHXvHn+1SUsOWgJp6RO+g==}
+    engines: {node: '>= 0.4'}
+
+  typedarray.prototype.slice@1.0.6:
+    resolution: {integrity: sha512-r+7YvGfM5TkTiDQ5EqWi/Z4L4KP3jUI+YCmTtWg1tmTHUw6xladLJqzR2heMaHBIM0TTFLZmn/EkIaEHYs/bIA==}
+    engines: {node: '>= 0.4'}
+
   typesafe-path@0.2.2:
     resolution: {integrity: sha512-OJabfkAg1WLZSqJAJ0Z6Sdt3utnbzr/jh+NAHoyWHJe8CMSy79Gm085094M9nvTPy22KzTVn5Zq5mbapCI/hPA==}
 
@@ -6283,6 +7125,10 @@ packages:
   ultrahtml@1.7.0:
     resolution: {integrity: sha512-2xRd0VHoAQE4M+vF/DvFFB7pUV0ZxTW1TLi7lHQWnF/Sb5TPeEUV/l+hxcNnGO00ZXGnR0voCMmYRKQf+rvJ2g==}
 
+  unbox-primitive@1.1.0:
+    resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
+    engines: {node: '>= 0.4'}
+
   unconfig-core@7.5.0:
     resolution: {integrity: sha512-Su3FauozOGP44ZmKdHy2oE6LPjk51M/TRRjHv2HNCWiDvfvCoxC2lno6jevMA91MYAdCdwP05QnWdWpSbncX/w==}
 
@@ -6292,6 +7138,9 @@ packages:
   uncrypto@0.1.3:
     resolution: {integrity: sha512-Ql87qFHB3s/De2ClA9e0gsnS6zXG27SkTiSJwjCc9MebbfapQfuPzumMIUMi38ezPZVNFcHI9sUIepeQfw8J8Q==}
 
+  undici-types@6.21.0:
+    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
+
   undici-types@7.24.6:
     resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
 
@@ -6338,6 +7187,9 @@ packages:
   unist-util-visit@5.1.0:
     resolution: {integrity: sha512-m+vIdyeCOpdr/QeQCu2EzxX/ohgS8KbnPDgFni4dQsfSCtpz8UqDyY5GjRru8PDKuYn7Fq19j1CQ+nJSsGKOzg==}
 
+  universal-user-agent@7.0.3:
+    resolution: {integrity: sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==}
+
   unstorage@1.17.6:
     resolution: {integrity: sha512-gjKtcmn/KwZuJZO9o2sc0esAQnhmTw0LviDHwevTXbJMYs0dRTp8ZEEWXHU0vTpzbN3cA0yxlTeyXssMp3zDqw==}
     peerDependencies:
@@ -6400,6 +7252,9 @@ packages:
       uploadthing:
         optional: true
 
+  unzip-stream@0.3.4:
+    resolution: {integrity: sha512-PyofABPVv+d7fL7GOpusx7eRT9YETY2X04PhwbSipdj6bMxVCFJrr+nm0Mxqbf9hUiTin/UsnuFWBXlDZFy0Cw==}
+
   update-browserslist-db@1.3.4:
     resolution: {integrity: sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==}
     hasBin: true
@@ -6678,9 +7533,25 @@ packages:
   web-worker@1.5.0:
     resolution: {integrity: sha512-RiMReJrTAiA+mBjGONMnjVDP2u3p9R1vkcGz6gDIrOMT3oGuYwX2WRMYI9ipkphSuE5XKEhydbhNEJh4NY9mlw==}
 
+  which-boxed-primitive@1.1.1:
+    resolution: {integrity: sha512-TbX3mj8n0odCBFVlY8AxkqcHASw3L60jIuF8jFP78az3C2YhmGvqbHBpAjTRH2/xqYunrJ9g1jSyjCjpoWzIAA==}
+    engines: {node: '>= 0.4'}
+
+  which-builtin-type@1.2.1:
+    resolution: {integrity: sha512-6iBczoX+kDQ7a3+YJBnh3T+KZRxM/iYNPXicqk66/Qfm1b93iu+yOImkg0zHbj5LNOcNv1TEADiZ0xa34B4q6Q==}
+    engines: {node: '>= 0.4'}
+
+  which-collection@1.0.2:
+    resolution: {integrity: sha512-K4jVyjnBdgvc86Y6BkaLZEN933SwYOuBFkdmBu9ZfkcAbdVbpITnDmjvZ/aQjRXQrv5EPkTnD1s39GiiqbngCw==}
+    engines: {node: '>= 0.4'}
+
   which-module@2.0.1:
     resolution: {integrity: sha512-iBdZ57RDvnOR9AGBhML2vFZf7h8vmBjhoaZqODJBFWHVtKkDmKuHai3cx5PgVMrX5YDNp27AofYbAwctSS+vhQ==}
 
+  which-typed-array@1.1.24:
+    resolution: {integrity: sha512-wk4Mf4pR5mRP7eYuuTBCIQ9d0ud2Fv2jRLQpfgnRjbOxAFHmjKFValgTpitVKzJJS8ajnYQV2Du1SZ8j6b/EUQ==}
+    engines: {node: '>= 0.4'}
+
   which@1.3.1:
     resolution: {integrity: sha512-HxJdYWq1MTIQbJ3nw0cqssHoTNU267KlrDuGZ1WYlxDStUtKUhOaJmh112/TZmHxxUfuJqPXSOm7tDyas0OSIQ==}
     hasBin: true
@@ -6723,6 +7594,14 @@ packages:
     resolution: {integrity: sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA==}
     engines: {node: '>=8'}
 
+  wrap-ansi@7.0.0:
+    resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
+    engines: {node: '>=10'}
+
+  wrap-ansi@8.1.0:
+    resolution: {integrity: sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==}
+    engines: {node: '>=12'}
+
   wrap-ansi@9.0.2:
     resolution: {integrity: sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww==}
     engines: {node: '>=18'}
@@ -6759,6 +7638,10 @@ packages:
     resolution: {integrity: sha512-EvGK8EJ3DhaHfbRlETOWAS5pO9MZITeauHKJyb8wyajUfQUenkIg2MvLDTZ4T/TgIcm3HU0TFBgWWboAZ30UHg==}
     engines: {node: '>=18'}
 
+  xml-naming@0.3.0:
+    resolution: {integrity: sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==}
+    engines: {node: '>=16.0.0'}
+
   xxhash-wasm@1.1.0:
     resolution: {integrity: sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA==}
 
@@ -6843,6 +7726,10 @@ packages:
     resolution: {integrity: sha512-XrBh9ZiQK5mJVRxZBAvD6LwRyAYrK3MFtH3+onyuxFL5hFD44EC3QOmIC1FjTj6H2MMwq46/NAI+NZxLZPZgxg==}
     engines: {node: '>=14.18.0'}
 
+  zip-stream@6.0.1:
+    resolution: {integrity: sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA==}
+    engines: {node: '>= 14'}
+
   zod-validation-error@4.0.2:
     resolution: {integrity: sha512-Q6/nZLe6jxuU80qb/4uJ4t5v2VEZ44lzQjPDhYJNztRQ4wyWc6VF3D3Kb/fAuPetZQnhS3hnajCf9CsWesghLQ==}
     engines: {node: '>=18.0.0'}
@@ -6860,6 +7747,59 @@ packages:
 
 snapshots:
 
+  '@actions/artifact@6.3.1(supports-color@10.2.2)':
+    dependencies:
+      '@actions/core': 3.0.1
+      '@actions/github': 9.1.1
+      '@actions/http-client': 4.0.1
+      '@azure/storage-blob': 12.34.0(supports-color@10.2.2)
+      '@octokit/core': 7.0.8
+      '@octokit/plugin-request-log': 6.0.0(@octokit/core@7.0.8)
+      '@octokit/plugin-retry': 8.1.1(@octokit/core@7.0.8)
+      '@octokit/request': 10.0.16
+      '@octokit/request-error': 7.1.2
+      '@protobuf-ts/runtime': 2.11.1
+      '@protobuf-ts/runtime-rpc': 2.11.1
+      archiver: 7.0.1
+      jwt-decode: 4.0.0
+      unzip-stream: 0.3.4
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+      - supports-color
+
+  '@actions/core@3.0.1':
+    dependencies:
+      '@actions/exec': 3.0.0
+      '@actions/http-client': 4.0.1
+
+  '@actions/exec@3.0.0':
+    dependencies:
+      '@actions/io': 3.0.2
+
+  '@actions/github@9.1.1':
+    dependencies:
+      '@actions/http-client': 3.0.2
+      '@octokit/core': 7.0.8
+      '@octokit/plugin-paginate-rest': 14.0.0(@octokit/core@7.0.8)
+      '@octokit/plugin-rest-endpoint-methods': 17.0.0(@octokit/core@7.0.8)
+      '@octokit/request': 10.0.16
+      '@octokit/request-error': 7.1.2
+      undici: 6.29.1
+
+  '@actions/http-client@3.0.2':
+    dependencies:
+      tunnel: 0.0.6
+      undici: 6.29.1
+
+  '@actions/http-client@4.0.1':
+    dependencies:
+      tunnel: 0.0.6
+      undici: 6.29.1
+
+  '@actions/io@3.0.2': {}
+
   '@andrewbranch/untar.js@1.0.4': {}
 
   '@antfu/eslint-config@9.5.1(@eslint-react/eslint-plugin@5.28.4(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(@typescript-eslint/typescript-estree@8.72.0(supports-color@10.2.2)(typescript@6.0.3))(@typescript-eslint/utils@8.72.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(@vue/compiler-sfc@3.5.44)(eslint-plugin-format@2.0.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint-plugin-react-refresh@0.5.7(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)(vitest@5.0.5)':
@@ -7070,6 +8010,120 @@ snapshots:
       axe-core: 4.14.0
       playwright-core: 1.64.1
 
+  '@azure/abort-controller@2.2.0':
+    dependencies:
+      tslib: 2.8.1
+
+  '@azure/core-auth@1.11.0(supports-color@10.2.2)':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@azure/core-util': 1.14.0(supports-color@10.2.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@azure/core-client@1.11.1(supports-color@10.2.2)':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@azure/core-auth': 1.11.0(supports-color@10.2.2)
+      '@azure/core-rest-pipeline': 1.25.0(supports-color@10.2.2)
+      '@azure/core-tracing': 1.4.0
+      '@azure/core-util': 1.14.0(supports-color@10.2.2)
+      '@azure/logger': 1.4.0(supports-color@10.2.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@azure/core-http-compat@2.5.0(@azure/core-client@1.11.1(supports-color@10.2.2))(@azure/core-rest-pipeline@1.25.0(supports-color@10.2.2))':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@azure/core-client': 1.11.1(supports-color@10.2.2)
+      '@azure/core-rest-pipeline': 1.25.0(supports-color@10.2.2)
+
+  '@azure/core-lro@2.7.2(supports-color@10.2.2)':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@azure/core-util': 1.14.0(supports-color@10.2.2)
+      '@azure/logger': 1.4.0(supports-color@10.2.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@azure/core-paging@1.7.0':
+    dependencies:
+      tslib: 2.8.1
+
+  '@azure/core-rest-pipeline@1.25.0(supports-color@10.2.2)':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@azure/core-auth': 1.11.0(supports-color@10.2.2)
+      '@azure/core-tracing': 1.4.0
+      '@azure/core-util': 1.14.0(supports-color@10.2.2)
+      '@azure/logger': 1.4.0(supports-color@10.2.2)
+      '@typespec/ts-http-runtime': 0.3.9(supports-color@10.2.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@azure/core-tracing@1.4.0':
+    dependencies:
+      tslib: 2.8.1
+
+  '@azure/core-util@1.14.0(supports-color@10.2.2)':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@typespec/ts-http-runtime': 0.3.9(supports-color@10.2.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@azure/core-xml@1.6.0':
+    dependencies:
+      fast-xml-parser: 5.11.2
+      tslib: 2.8.1
+
+  '@azure/logger@1.4.0(supports-color@10.2.2)':
+    dependencies:
+      '@typespec/ts-http-runtime': 0.3.9(supports-color@10.2.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@azure/storage-blob@12.34.0(supports-color@10.2.2)':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@azure/core-auth': 1.11.0(supports-color@10.2.2)
+      '@azure/core-client': 1.11.1(supports-color@10.2.2)
+      '@azure/core-http-compat': 2.5.0(@azure/core-client@1.11.1(supports-color@10.2.2))(@azure/core-rest-pipeline@1.25.0(supports-color@10.2.2))
+      '@azure/core-lro': 2.7.2(supports-color@10.2.2)
+      '@azure/core-paging': 1.7.0
+      '@azure/core-rest-pipeline': 1.25.0(supports-color@10.2.2)
+      '@azure/core-tracing': 1.4.0
+      '@azure/core-util': 1.14.0(supports-color@10.2.2)
+      '@azure/core-xml': 1.6.0
+      '@azure/logger': 1.4.0(supports-color@10.2.2)
+      '@azure/storage-common': 12.5.0(@azure/core-client@1.11.1(supports-color@10.2.2))(supports-color@10.2.2)
+      apache-arrow: 21.2.0
+      events: 3.3.0
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@azure/storage-common@12.5.0(@azure/core-client@1.11.1(supports-color@10.2.2))(supports-color@10.2.2)':
+    dependencies:
+      '@azure/abort-controller': 2.2.0
+      '@azure/core-auth': 1.11.0(supports-color@10.2.2)
+      '@azure/core-http-compat': 2.5.0(@azure/core-client@1.11.1(supports-color@10.2.2))(@azure/core-rest-pipeline@1.25.0(supports-color@10.2.2))
+      '@azure/core-rest-pipeline': 1.25.0(supports-color@10.2.2)
+      '@azure/core-tracing': 1.4.0
+      '@azure/core-util': 1.14.0(supports-color@10.2.2)
+      '@azure/logger': 1.4.0(supports-color@10.2.2)
+      events: 3.3.0
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - '@azure/core-client'
+      - supports-color
+
   '@babel/code-frame@7.29.7':
     dependencies:
       '@babel/helper-validator-identifier': 7.29.7
@@ -8137,29 +9191,34 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.3': {}
 
-  '@icebreakers/commitlint-config@4.1.2(conventional-changelog-conventionalcommits@10.4.1)':
+  '@icebreakers/commitlint-config@4.1.4(conventional-changelog-conventionalcommits@10.4.1)':
     dependencies:
       '@commitlint/config-conventional': 21.2.4
       '@commitlint/types': 21.2.3
       conventional-changelog-conventionalcommits: 10.4.1
 
-  '@icebreakers/eslint-config@8.0.9(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vitest@5.0.5)':
+  '@icebreakers/eslint-config@8.0.11(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vitest@5.0.5)':
     dependencies:
       '@antfu/eslint-config': 9.5.1(@eslint-react/eslint-plugin@5.28.4(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(@typescript-eslint/typescript-estree@8.72.0(supports-color@10.2.2)(typescript@6.0.3))(@typescript-eslint/utils@8.72.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(@vue/compiler-sfc@3.5.44)(eslint-plugin-format@2.0.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint-plugin-react-refresh@0.5.7(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)(vitest@5.0.5)
       '@eslint-react/eslint-plugin': 5.28.4(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
-      '@icebreakers/stylelint-config': 5.1.3(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)
+      '@icebreakers/stylelint-config': 5.1.5(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)
+      '@stylistic/eslint-plugin': 5.10.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))
+      '@typescript-eslint/parser': 8.72.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript-eslint/rule-tester': 8.72.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript-eslint/typescript-estree': 8.72.0(supports-color@10.2.2)(typescript@6.0.3)
       '@typescript-eslint/utils': 8.72.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
       '@vue/compiler-sfc': 3.5.44
       '@weapp-vite/eslint': 0.2.10(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))
       defu: 6.1.7
+      eslint: 10.13.0(jiti@2.7.0)(supports-color@10.2.2)
+      eslint-config-flat-gitignore: 2.4.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))
       eslint-flat-config-utils: 3.2.0
       eslint-plugin-better-tailwindcss: 4.10.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(tailwindcss@4.3.3)(typescript@6.0.3)
       eslint-plugin-format: 2.0.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))
       eslint-plugin-react-hooks: 7.1.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)
       eslint-plugin-react-refresh: 0.5.7(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))
       eslint-plugin-tailwindcss: 4.4.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)
+      eslint-processor-vue-blocks: 2.0.0(@vue/compiler-sfc@3.5.44)(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))
     optionalDependencies:
       eslint-plugin-pnpm: 1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))
       tailwindcss: 4.3.3
@@ -8173,7 +9232,6 @@ snapshots:
       - '@prettier/plugin-xml'
       - '@unocss/eslint-plugin'
       - astro-eslint-parser
-      - eslint
       - eslint-plugin-astro
       - eslint-plugin-erasable-syntax-only
       - eslint-plugin-jsx-a11y
@@ -8194,31 +9252,32 @@ snapshots:
       - typescript
       - vitest
 
-  '@icebreakers/monorepo-templates@2.3.3(@types/node@24.19.2)':
+  '@icebreakers/monorepo-templates@3.0.1(@types/node@22.20.5)':
     dependencies:
-      '@inquirer/checkbox': 5.2.7(@types/node@24.19.2)
-      '@inquirer/input': 5.1.8(@types/node@24.19.2)
-      '@inquirer/password': 5.2.4(@types/node@24.19.2)
-      '@inquirer/select': 5.2.7(@types/node@24.19.2)
+      '@inquirer/checkbox': 5.2.7(@types/node@22.20.5)
+      '@inquirer/input': 5.1.8(@types/node@22.20.5)
+      '@inquirer/password': 5.2.4(@types/node@22.20.5)
+      '@inquirer/select': 5.2.7(@types/node@22.20.5)
       commander: 15.0.0
-      nanoexec: 1.1.0(@types/node@24.19.2)
+      nanoexec: 1.1.0(@types/node@22.20.5)
       yaml: 2.9.1
     transitivePeerDependencies:
       - '@types/node'
 
-  '@icebreakers/monorepo@5.10.3(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
+  '@icebreakers/monorepo@6.0.1(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
     dependencies:
       '@arethetypeswrong/core': 0.18.5
       '@babel/parser': 7.29.9
-      '@icebreakers/commitlint-config': 4.1.2(conventional-changelog-conventionalcommits@10.4.1)
-      '@icebreakers/eslint-config': 8.0.9(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vitest@5.0.5)
-      '@icebreakers/monorepo-templates': 2.3.3(@types/node@24.19.2)
-      '@icebreakers/stylelint-config': 5.1.3(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)
+      '@icebreakers/commitlint-config': 4.1.4(conventional-changelog-conventionalcommits@10.4.1)
+      '@icebreakers/eslint-config': 8.0.11(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vitest@5.0.5)
+      '@icebreakers/monorepo-templates': 3.0.1(@types/node@22.20.5)
+      '@icebreakers/stylelint-config': 5.1.5(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)
       '@npmcli/config': 10.14.0
       '@pnpm/find-workspace-dir': 1000.1.5
       '@pnpm/fs.find-packages': 1000.0.24(@pnpm/logger@1001.0.1)
       '@pnpm/types': 1102.1.1
       '@pnpm/workspace.read-manifest': 1000.3.1
+      '@types/node': 22.20.5
       c12: 3.3.4(magicast@0.5.5)
       commander: 15.0.0
       comment-json: 5.0.0
@@ -8228,20 +9287,20 @@ snapshots:
       git-url-parse: 16.1.0
       json5: 2.2.3
       klaw: 4.1.0
-      lint-staged: 17.6.0
       micromatch: 4.0.8
       node-diff3: 3.2.1
       p-queue: 9.3.5
       pacote: 21.5.1(supports-color@10.2.2)
       pathe: 2.0.3
       picocolors: 1.1.1
+      pkg-pr-new: 0.0.91
       publint: 0.3.25
       semver: 7.8.5
       simple-git: 4.0.2(supports-color@10.2.2)
       tar: 7.5.22
       tinyglobby: 0.2.17
       validate-npm-package-name: 7.0.2
-      vitest: 5.0.5(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+      vitest: 5.0.5(@types/node@22.20.5)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
       yaml: 2.9.1
     optionalDependencies:
       '@commitlint/cli': 21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3)
@@ -8259,7 +9318,6 @@ snapshots:
       - '@opentelemetry/api'
       - '@pnpm/logger'
       - '@prettier/plugin-xml'
-      - '@types/node'
       - '@unocss/eslint-plugin'
       - '@vitest/browser-playwright'
       - '@vitest/browser-preview'
@@ -8293,7 +9351,7 @@ snapshots:
       - ts-declaration-location
       - vite
 
-  '@icebreakers/stylelint-config@5.1.3(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)':
+  '@icebreakers/stylelint-config@5.1.5(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)':
     dependencies:
       comment-json: 5.0.0
       postcss-html: 2.0.0(postcss@8.5.31)
@@ -8303,7 +9361,7 @@ snapshots:
       stylelint-config-recommended-vue: 2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint-config-recommended-scss@17.0.1(postcss@8.5.31)(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint-config-recommended@18.0.0(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))
       stylelint-config-standard-scss: 17.0.0(postcss@8.5.31)(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))
       stylelint-order: 8.1.2(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))
-      stylelint-plugin-tailwindcss: 3.1.3(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)
+      stylelint-plugin-tailwindcss: 3.1.5(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3)
     transitivePeerDependencies:
       - postcss
       - stylelint
@@ -8418,56 +9476,65 @@ snapshots:
 
   '@inquirer/ansi@2.0.9': {}
 
-  '@inquirer/checkbox@5.2.7(@types/node@24.19.2)':
+  '@inquirer/checkbox@5.2.7(@types/node@22.20.5)':
     dependencies:
       '@inquirer/ansi': 2.0.9
-      '@inquirer/core': 12.0.5(@types/node@24.19.2)
+      '@inquirer/core': 12.0.5(@types/node@22.20.5)
       '@inquirer/figures': 2.0.9
-      '@inquirer/type': 4.2.0(@types/node@24.19.2)
+      '@inquirer/type': 4.2.0(@types/node@22.20.5)
     optionalDependencies:
-      '@types/node': 24.19.2
+      '@types/node': 22.20.5
 
-  '@inquirer/core@12.0.5(@types/node@24.19.2)':
+  '@inquirer/core@12.0.5(@types/node@22.20.5)':
     dependencies:
       '@inquirer/ansi': 2.0.9
       '@inquirer/figures': 2.0.9
-      '@inquirer/type': 4.2.0(@types/node@24.19.2)
+      '@inquirer/type': 4.2.0(@types/node@22.20.5)
       cli-width: 4.1.0
       fast-wrap-ansi: 0.2.2
       mute-stream: 3.0.0
       signal-exit: 4.1.0
     optionalDependencies:
-      '@types/node': 24.19.2
+      '@types/node': 22.20.5
 
   '@inquirer/figures@2.0.9': {}
 
-  '@inquirer/input@5.1.8(@types/node@24.19.2)':
+  '@inquirer/input@5.1.8(@types/node@22.20.5)':
     dependencies:
-      '@inquirer/core': 12.0.5(@types/node@24.19.2)
-      '@inquirer/type': 4.2.0(@types/node@24.19.2)
+      '@inquirer/core': 12.0.5(@types/node@22.20.5)
+      '@inquirer/type': 4.2.0(@types/node@22.20.5)
     optionalDependencies:
-      '@types/node': 24.19.2
+      '@types/node': 22.20.5
 
-  '@inquirer/password@5.2.4(@types/node@24.19.2)':
+  '@inquirer/password@5.2.4(@types/node@22.20.5)':
     dependencies:
       '@inquirer/ansi': 2.0.9
-      '@inquirer/core': 12.0.5(@types/node@24.19.2)
-      '@inquirer/type': 4.2.0(@types/node@24.19.2)
+      '@inquirer/core': 12.0.5(@types/node@22.20.5)
+      '@inquirer/type': 4.2.0(@types/node@22.20.5)
     optionalDependencies:
-      '@types/node': 24.19.2
+      '@types/node': 22.20.5
 
-  '@inquirer/select@5.2.7(@types/node@24.19.2)':
+  '@inquirer/select@5.2.7(@types/node@22.20.5)':
     dependencies:
       '@inquirer/ansi': 2.0.9
-      '@inquirer/core': 12.0.5(@types/node@24.19.2)
+      '@inquirer/core': 12.0.5(@types/node@22.20.5)
       '@inquirer/figures': 2.0.9
-      '@inquirer/type': 4.2.0(@types/node@24.19.2)
+      '@inquirer/type': 4.2.0(@types/node@22.20.5)
     optionalDependencies:
-      '@types/node': 24.19.2
+      '@types/node': 22.20.5
 
-  '@inquirer/type@4.2.0(@types/node@24.19.2)':
+  '@inquirer/type@4.2.0(@types/node@22.20.5)':
     optionalDependencies:
-      '@types/node': 24.19.2
+      '@types/node': 22.20.5
+
+  '@isaacs/cliui@8.0.2':
+    dependencies:
+      string-width: 5.1.2
+      string-width-cjs: string-width@4.2.3
+      strip-ansi: 7.2.0
+      strip-ansi-cjs: strip-ansi@6.0.1
+      wrap-ansi: 8.1.0
+      wrap-ansi-cjs: wrap-ansi@7.0.0
 
   '@isaacs/fs-minipass@4.0.1':
     dependencies:
@@ -8522,9 +9589,9 @@ snapshots:
     dependencies:
       '@braidai/lang': 1.1.2
 
-  '@lucide/astro@1.61.0(astro@7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
+  '@lucide/astro@1.61.0(astro@7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
     dependencies:
-      astro: 7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
+      astro: 7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
 
   '@napi-rs/wasm-runtime@1.2.4(@emnapi/core@1.11.3)(@emnapi/runtime@1.11.3)':
     dependencies:
@@ -8546,6 +9613,8 @@ snapshots:
       '@tybys/wasm-util': 0.10.4
     optional: true
 
+  '@nodable/entities@3.1.0': {}
+
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -8634,7 +9703,82 @@ snapshots:
       node-gyp: 12.4.0
       proc-log: 6.1.0
 
-  '@oslojs/encoding@1.1.0': {}
+  '@octokit/auth-token@6.0.0': {}
+
+  '@octokit/core@7.0.8':
+    dependencies:
+      '@octokit/auth-token': 6.0.0
+      '@octokit/graphql': 9.0.5
+      '@octokit/request': 10.0.16
+      '@octokit/request-error': 7.1.2
+      '@octokit/types': 18.0.0
+      before-after-hook: 4.0.0
+      universal-user-agent: 7.0.3
+
+  '@octokit/endpoint@11.0.5':
+    dependencies:
+      '@octokit/types': 18.0.0
+      universal-user-agent: 7.0.3
+
+  '@octokit/graphql@9.0.5':
+    dependencies:
+      '@octokit/request': 10.0.16
+      '@octokit/types': 18.0.0
+      universal-user-agent: 7.0.3
+
+  '@octokit/openapi-types@27.0.0': {}
+
+  '@octokit/openapi-types@28.0.0': {}
+
+  '@octokit/openapi-types@29.0.1': {}
+
+  '@octokit/plugin-paginate-rest@14.0.0(@octokit/core@7.0.8)':
+    dependencies:
+      '@octokit/core': 7.0.8
+      '@octokit/types': 16.0.0
+
+  '@octokit/plugin-request-log@6.0.0(@octokit/core@7.0.8)':
+    dependencies:
+      '@octokit/core': 7.0.8
+
+  '@octokit/plugin-rest-endpoint-methods@17.0.0(@octokit/core@7.0.8)':
+    dependencies:
+      '@octokit/core': 7.0.8
+      '@octokit/types': 16.0.0
+
+  '@octokit/plugin-retry@8.1.1(@octokit/core@7.0.8)':
+    dependencies:
+      '@octokit/core': 7.0.8
+      '@octokit/request-error': 7.1.2
+      '@octokit/types': 17.0.0
+      bottleneck: 2.19.5
+
+  '@octokit/request-error@7.1.2':
+    dependencies:
+      '@octokit/types': 18.0.0
+
+  '@octokit/request@10.0.16':
+    dependencies:
+      '@octokit/endpoint': 11.0.5
+      '@octokit/request-error': 7.1.2
+      '@octokit/types': 18.0.0
+      content-type: 3.1.1
+      json-with-bigint: 3.5.12
+      universal-user-agent: 7.0.3
+
+  '@octokit/types@16.0.0':
+    dependencies:
+      '@octokit/openapi-types': 27.0.0
+
+  '@octokit/types@17.0.0':
+    dependencies:
+      '@octokit/openapi-types': 28.0.0
+
+  '@octokit/types@18.0.0':
+    dependencies:
+      '@octokit/openapi-types': 29.0.1
+
+  '@oslojs/encoding@1.1.0': {}
 
   '@ota-meshi/ast-token-store@0.3.0': {}
 
@@ -8754,6 +9898,9 @@ snapshots:
   '@oxfmt/binding-win32-x64-msvc@0.35.0':
     optional: true
 
+  '@pkgjs/parseargs@0.11.0':
+    optional: true
+
   '@pkgr/core@0.3.6': {}
 
   '@playwright/test@1.64.1':
@@ -8862,6 +10009,12 @@ snapshots:
 
   '@poppinss/exception@1.2.3': {}
 
+  '@protobuf-ts/runtime-rpc@2.11.1':
+    dependencies:
+      '@protobuf-ts/runtime': 2.11.1
+
+  '@protobuf-ts/runtime@2.11.1': {}
+
   '@publint/pack@0.1.7':
     dependencies:
       tinyexec: 1.3.1
@@ -9152,10 +10305,18 @@ snapshots:
     dependencies:
       '@types/unist': 3.0.3
 
+  '@types/node@22.20.5':
+    dependencies:
+      undici-types: 6.21.0
+
   '@types/node@24.19.2':
     dependencies:
       undici-types: 7.24.6
 
+  '@types/node@25.9.9':
+    dependencies:
+      undici-types: 7.24.6
+
   '@types/parse-path@7.0.3': {}
 
   '@types/picomatch@4.0.3': {}
@@ -9277,16 +10438,24 @@ snapshots:
       '@typescript-eslint/types': 8.72.0
       eslint-visitor-keys: 5.0.1
 
+  '@typespec/ts-http-runtime@0.3.9(supports-color@10.2.2)':
+    dependencies:
+      http-proxy-agent: 7.0.2(supports-color@10.2.2)
+      https-proxy-agent: 7.0.6(supports-color@10.2.2)
+      tslib: 2.8.1
+    transitivePeerDependencies:
+      - supports-color
+
   '@ungap/structured-clone@1.4.0': {}
 
-  '@unocss/config@66.10.5':
+  '@unocss/config@66.11.0':
     dependencies:
-      '@unocss/core': 66.10.5
+      '@unocss/core': 66.11.0
       colorette: 2.0.20
       consola: 3.4.2
       unconfig: 7.5.0
 
-  '@unocss/core@66.10.5': {}
+  '@unocss/core@66.11.0': {}
 
   '@valibot/to-json-schema@1.8.0(valibot@1.5.0(typescript@6.0.3))':
     dependencies:
@@ -9302,7 +10471,7 @@ snapshots:
       obug: 3.0.0
       std-env: 4.3.0
       tinyrainbow: 3.2.0
-      vitest: 5.0.5(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+      vitest: 5.0.5(@types/node@22.20.5)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
 
   '@vitest/eslint-plugin@1.6.27(@typescript-eslint/eslint-plugin@8.72.0(@typescript-eslint/parser@8.72.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)(vitest@5.0.5)':
     dependencies:
@@ -9312,7 +10481,7 @@ snapshots:
     optionalDependencies:
       '@typescript-eslint/eslint-plugin': 8.72.0(@typescript-eslint/parser@8.72.0(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(supports-color@10.2.2)(typescript@6.0.3)
       typescript: 6.0.3
-      vitest: 5.0.5(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+      vitest: 5.0.5(@types/node@22.20.5)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
     transitivePeerDependencies:
       - supports-color
 
@@ -9322,6 +10491,15 @@ snapshots:
     dependencies:
       '@vitest/istanbul-lib-coverage': 1.0.2
 
+  '@vitest/mocker@5.0.5(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.31
+      '@vitest/spy': 5.0.5
+      estree-walker: 3.0.3
+      magic-string: 1.4.3
+    optionalDependencies:
+      vite: 8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
+
   '@vitest/mocker@5.0.5(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))':
     dependencies:
       '@jridgewell/trace-mapping': 0.3.31
@@ -9574,6 +10752,10 @@ snapshots:
 
   abbrev@4.0.0: {}
 
+  abort-controller@3.0.0:
+    dependencies:
+      event-target-shim: 5.0.1
+
   acorn-jsx@5.3.2(acorn@8.19.0):
     dependencies:
       acorn: 8.19.0
@@ -9625,6 +10807,39 @@ snapshots:
       normalize-path: 3.0.0
       picomatch: 2.3.2
 
+  anynum@1.0.1: {}
+
+  apache-arrow@21.2.0:
+    dependencies:
+      '@types/node': 25.9.9
+      flatbuffers: 25.9.23
+      json-with-bigint: 3.5.12
+      tslib: 2.8.1
+
+  archiver-utils@5.0.2:
+    dependencies:
+      glob: 10.5.0
+      graceful-fs: 4.2.11
+      is-stream: 2.0.1
+      lazystream: 1.0.1
+      lodash: 4.18.1
+      normalize-path: 3.0.0
+      readable-stream: 4.8.0
+
+  archiver@7.0.1:
+    dependencies:
+      archiver-utils: 5.0.2
+      async: 3.2.6
+      buffer-crc32: 1.0.0
+      readable-stream: 4.8.0
+      readdir-glob: 1.1.3
+      tar-stream: 3.2.2
+      zip-stream: 6.0.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
   are-docs-informative@0.1.1: {}
 
   arg@5.0.2: {}
@@ -9637,8 +10852,23 @@ snapshots:
 
   aria-query@5.3.2: {}
 
+  array-buffer-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      is-array-buffer: 3.0.5
+
   array-timsort@1.0.3: {}
 
+  arraybuffer.prototype.slice@1.0.4:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      is-array-buffer: 3.0.5
+
   assertion-error@2.0.1: {}
 
   ast-v8-to-istanbul@1.0.7:
@@ -9649,7 +10879,7 @@ snapshots:
 
   astral-regex@2.0.0: {}
 
-  astro@7.4.1(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1):
+  astro@7.4.1(@azure/storage-blob@12.34.0(supports-color@10.2.2))(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1):
     dependencies:
       '@astrojs/compiler-rs': 0.5.2
       '@astrojs/internal-helpers': 0.13.0
@@ -9696,7 +10926,7 @@ snapshots:
       tinyps: 0.5.0
       ultrahtml: 1.7.0
       unifont: 1.0.3
-      unstorage: 1.17.6
+      unstorage: 1.17.6(@azure/storage-blob@12.34.0(supports-color@10.2.2))
       verkit: 0.5.0
       vite: 8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
       vitefu: 1.1.3(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
@@ -9738,6 +10968,10 @@ snapshots:
       - uploadthing
       - yaml
 
+  async-function@1.0.0: {}
+
+  async@3.2.6: {}
+
   autoprefixer@10.6.1(postcss@8.5.31):
     dependencies:
       browserslist: 4.29.4
@@ -9747,16 +10981,62 @@ snapshots:
       postcss: 8.5.31
       postcss-value-parser: 4.2.0
 
+  available-typed-arrays@1.0.7:
+    dependencies:
+      possible-typed-array-names: 1.1.0
+
   axe-core@4.14.0: {}
 
   axobject-query@4.1.0: {}
 
+  b4a@1.9.0: {}
+
   bail@2.0.2: {}
 
+  balanced-match@1.0.2: {}
+
   balanced-match@4.0.4: {}
 
+  bare-events@2.9.2: {}
+
+  bare-fs@4.8.4:
+    dependencies:
+      bare-events: 2.9.2
+      bare-path: 3.1.2
+      bare-stream: 2.13.4(bare-events@2.9.2)
+      bare-url: 2.5.5
+      fast-fifo: 1.3.2
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
+  bare-path@3.1.2: {}
+
+  bare-stream@2.13.4(bare-events@2.9.2):
+    dependencies:
+      b4a: 1.9.0
+      streamx: 2.28.1
+      teex: 1.0.1
+    optionalDependencies:
+      bare-events: 2.9.2
+    transitivePeerDependencies:
+      - react-native-b4a
+
+  bare-url@2.5.5:
+    dependencies:
+      bare-path: 3.1.2
+
+  base64-js@1.5.1: {}
+
   baseline-browser-mapping@2.11.30: {}
 
+  before-after-hook@4.0.0: {}
+
+  binary@0.3.0:
+    dependencies:
+      buffers: 0.1.1
+      chainsaw: 0.1.0
+
   blake3-wasm@2.1.5: {}
 
   bole@5.0.29:
@@ -9766,6 +11046,12 @@ snapshots:
 
   boolbase@1.0.0: {}
 
+  bottleneck@2.19.5: {}
+
+  brace-expansion@2.1.7:
+    dependencies:
+      balanced-match: 1.0.2
+
   brace-expansion@5.0.12:
     dependencies:
       balanced-match: 4.0.4
@@ -9782,6 +11068,15 @@ snapshots:
       node-releases: 2.0.59
       update-browserslist-db: 1.3.4(browserslist@4.29.4)
 
+  buffer-crc32@1.0.0: {}
+
+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
+  buffers@0.1.1: {}
+
   builtin-modules@5.4.0: {}
 
   bundle-name@4.1.1:
@@ -9828,6 +11123,23 @@ snapshots:
       keyv: 5.6.0
       qified: 0.10.1
 
+  call-bind-apply-helpers@1.0.2:
+    dependencies:
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+
+  call-bind@1.0.9:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      get-intrinsic: 1.3.0
+      set-function-length: 1.2.2
+
+  call-bound@1.0.4:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      get-intrinsic: 1.3.0
+
   callsites@3.1.0: {}
 
   camelcase@5.3.1: {}
@@ -9838,6 +11150,10 @@ snapshots:
 
   chai@6.3.0: {}
 
+  chainsaw@0.1.0:
+    dependencies:
+      traverse: 0.3.10
+
   chalk@4.1.2:
     dependencies:
       ansi-styles: 4.3.0
@@ -9908,6 +11224,14 @@ snapshots:
 
   compare-versions@6.1.1: {}
 
+  compress-commons@6.0.2:
+    dependencies:
+      crc-32: 1.2.2
+      crc32-stream: 6.0.0
+      is-stream: 2.0.1
+      normalize-path: 3.0.0
+      readable-stream: 4.8.0
+
   confbox@0.1.8: {}
 
   confbox@0.2.4: {}
@@ -9918,6 +11242,8 @@ snapshots:
 
   content-type@2.1.0: {}
 
+  content-type@3.1.1: {}
+
   conventional-changelog-angular@9.4.0:
     dependencies:
       '@conventional-changelog/template': 1.4.0
@@ -9945,6 +11271,8 @@ snapshots:
     dependencies:
       browserslist: 4.29.4
 
+  core-util-is@1.0.3: {}
+
   cosmiconfig@9.0.2(typescript@6.0.3):
     dependencies:
       env-paths: 2.2.1
@@ -9954,6 +11282,13 @@ snapshots:
     optionalDependencies:
       typescript: 6.0.3
 
+  crc-32@1.2.2: {}
+
+  crc32-stream@6.0.0:
+    dependencies:
+      crc-32: 1.2.2
+      readable-stream: 4.8.0
+
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -10020,6 +11355,24 @@ snapshots:
     dependencies:
       css-tree: 2.2.1
 
+  data-view-buffer@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-length@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
+  data-view-byte-offset@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-data-view: 1.0.2
+
   debug@4.4.3(supports-color@10.2.2):
     dependencies:
       ms: 2.1.3
@@ -10041,8 +11394,20 @@ snapshots:
       bundle-name: 4.1.1
       default-browser-id: 5.0.1
 
+  define-data-property@1.1.4:
+    dependencies:
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
   define-lazy-prop@3.0.0: {}
 
+  define-properties@1.2.1:
+    dependencies:
+      define-data-property: 1.1.4
+      has-property-descriptors: 1.0.2
+      object-keys: 1.1.1
+
   defu@6.1.7: {}
 
   dequal@2.0.3: {}
@@ -10107,6 +11472,14 @@ snapshots:
 
   dts-resolver@3.0.0: {}
 
+  dunder-proto@1.0.1:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-errors: 1.3.0
+      gopd: 1.2.0
+
+  eastasianwidth@0.2.0: {}
+
   echarts@6.1.0:
     dependencies:
       tslib: 2.3.0
@@ -10123,6 +11496,8 @@ snapshots:
 
   emoji-regex@8.0.0: {}
 
+  emoji-regex@9.2.2: {}
+
   empathic@2.1.0: {}
 
   enhanced-resolve@5.26.0:
@@ -10144,10 +11519,98 @@ snapshots:
 
   error-stack-parser-es@1.0.5: {}
 
+  es-abstract-get@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      is-callable: 1.2.7
+      object-inspect: 1.13.4
+
+  es-abstract@1.24.2:
+    dependencies:
+      array-buffer-byte-length: 1.0.2
+      arraybuffer.prototype.slice: 1.0.4
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      data-view-buffer: 1.0.2
+      data-view-byte-length: 1.0.2
+      data-view-byte-offset: 1.0.1
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      es-set-tostringtag: 2.1.0
+      es-to-primitive: 1.3.4
+      function.prototype.name: 1.2.0
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      get-symbol-description: 1.1.0
+      globalthis: 1.0.4
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+      has-proto: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.4
+      internal-slot: 1.1.0
+      is-array-buffer: 3.0.5
+      is-callable: 1.2.7
+      is-data-view: 1.0.2
+      is-negative-zero: 2.0.3
+      is-regex: 1.2.1
+      is-set: 2.0.3
+      is-shared-array-buffer: 1.0.4
+      is-string: 1.1.1
+      is-typed-array: 1.1.15
+      is-weakref: 1.1.1
+      math-intrinsics: 1.1.0
+      object-inspect: 1.13.4
+      object-keys: 1.1.1
+      object.assign: 4.1.7
+      own-keys: 1.0.2
+      regexp.prototype.flags: 1.5.4
+      safe-array-concat: 1.1.4
+      safe-push-apply: 1.0.0
+      safe-regex-test: 1.1.0
+      set-proto: 1.0.0
+      stop-iteration-iterator: 1.1.0
+      string.prototype.trim: 1.2.11
+      string.prototype.trimend: 1.0.10
+      string.prototype.trimstart: 1.0.8
+      typed-array-buffer: 1.0.3
+      typed-array-byte-length: 1.0.3
+      typed-array-byte-offset: 1.0.5
+      typed-array-length: 1.0.8
+      unbox-primitive: 1.1.0
+      which-typed-array: 1.1.24
+
+  es-define-property@1.0.1: {}
+
+  es-errors@1.3.0: {}
+
   es-module-lexer@2.3.2: {}
 
   es-module-lexer@3.0.4: {}
 
+  es-object-atoms@1.1.2:
+    dependencies:
+      es-errors: 1.3.0
+
+  es-set-tostringtag@2.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+
+  es-to-primitive@1.3.4:
+    dependencies:
+      es-abstract-get: 1.0.0
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      is-callable: 1.2.7
+      is-date-object: 1.1.0
+      is-symbol: 1.1.1
+
   es-toolkit@1.52.0: {}
 
   esbuild@0.28.2:
@@ -10643,8 +12106,18 @@ snapshots:
 
   esutils@2.0.3: {}
 
+  event-target-shim@5.0.1: {}
+
   eventemitter3@5.0.4: {}
 
+  events-universal@1.0.1:
+    dependencies:
+      bare-events: 2.9.2
+    transitivePeerDependencies:
+      - bare-abort-controller
+
+  events@3.3.0: {}
+
   expect-type@1.4.0: {}
 
   exponential-backoff@3.1.3: {}
@@ -10657,6 +12130,8 @@ snapshots:
 
   fast-diff@1.3.0: {}
 
+  fast-fifo@1.3.2: {}
+
   fast-glob@3.3.3:
     dependencies:
       '@nodelib/fs.stat': 2.0.5
@@ -10683,6 +12158,20 @@ snapshots:
     dependencies:
       fast-string-width: 3.0.2
 
+  fast-xml-builder@1.3.1:
+    dependencies:
+      path-expression-matcher: 1.6.2
+      xml-naming: 0.3.0
+
+  fast-xml-parser@5.11.2:
+    dependencies:
+      '@nodable/entities': 3.1.0
+      fast-xml-builder: 1.3.1
+      is-unsafe: 2.0.2
+      path-expression-matcher: 1.6.2
+      strnum: 2.5.1
+      xml-naming: 0.3.0
+
   fastest-levenshtein@1.0.16: {}
 
   fastq@1.20.3:
@@ -10725,6 +12214,8 @@ snapshots:
       flatted: 3.4.4
       hookified: 1.15.1
 
+  flatbuffers@25.9.23: {}
+
   flatted@3.4.4: {}
 
   flattie@1.1.1: {}
@@ -10739,6 +12230,15 @@ snapshots:
     dependencies:
       tiny-inflate: 1.0.3
 
+  for-each@0.3.5:
+    dependencies:
+      is-callable: 1.2.7
+
+  foreground-child@3.3.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      signal-exit: 4.1.0
+
   format@0.2.2: {}
 
   fraction.js@5.3.4: {}
@@ -10750,14 +12250,56 @@ snapshots:
   fsevents@2.3.3:
     optional: true
 
+  function-bind@1.1.2: {}
+
   function-timeout@1.0.2: {}
 
+  function.prototype.name@1.2.0:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+      hasown: 2.0.4
+      is-callable: 1.2.7
+      is-document.all: 1.0.0
+
+  functions-have-names@1.2.3: {}
+
+  generator-function@2.0.1: {}
+
   gensync@1.0.0-beta.2: {}
 
   get-caller-file@2.0.5: {}
 
   get-east-asian-width@1.7.0: {}
 
+  get-intrinsic@1.3.0:
+    dependencies:
+      call-bind-apply-helpers: 1.0.2
+      es-define-property: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      function-bind: 1.1.2
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-symbols: 1.1.0
+      hasown: 2.0.4
+      math-intrinsics: 1.1.0
+
+  get-proto@1.0.1:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-object-atoms: 1.1.2
+
+  get-symbol-description@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+
   get-tsconfig@4.14.3:
     dependencies:
       resolve-pkg-maps: 1.0.0
@@ -10789,6 +12331,15 @@ snapshots:
     dependencies:
       is-glob: 4.0.3
 
+  glob@10.5.0:
+    dependencies:
+      foreground-child: 3.3.1
+      jackspeak: 3.4.3
+      minimatch: 9.0.9
+      minipass: 7.1.3
+      package-json-from-dist: 1.0.1
+      path-scurry: 1.11.1
+
   glob@13.0.6:
     dependencies:
       minimatch: 10.2.6
@@ -10813,6 +12364,11 @@ snapshots:
 
   globals@17.13.0: {}
 
+  globalthis@1.0.4:
+    dependencies:
+      define-properties: 1.2.1
+      gopd: 1.2.0
+
   globby@16.2.4:
     dependencies:
       '@sindresorhus/merge-streams': 4.0.0
@@ -10827,6 +12383,8 @@ snapshots:
 
   globrex@0.1.2: {}
 
+  gopd@1.2.0: {}
+
   graceful-fs@4.2.11: {}
 
   h3@1.15.11:
@@ -10841,14 +12399,34 @@ snapshots:
       ufo: 1.6.4
       uncrypto: 0.1.3
 
+  has-bigints@1.1.0: {}
+
   has-flag@4.0.0: {}
 
   has-flag@5.0.1: {}
 
+  has-property-descriptors@1.0.2:
+    dependencies:
+      es-define-property: 1.0.1
+
+  has-proto@1.2.0:
+    dependencies:
+      dunder-proto: 1.0.1
+
+  has-symbols@1.1.0: {}
+
+  has-tostringtag@1.0.2:
+    dependencies:
+      has-symbols: 1.1.0
+
   hashery@1.5.1:
     dependencies:
       hookified: 1.15.1
 
+  hasown@2.0.4:
+    dependencies:
+      function-bind: 1.1.2
+
   hast-util-to-html@9.0.5:
     dependencies:
       '@types/hast': 3.0.5
@@ -10921,8 +12499,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  husky@9.1.7: {}
-
   iconv-lite@0.7.3:
     dependencies:
       safer-buffer: 2.1.2
@@ -10932,6 +12508,8 @@ snapshots:
     dependencies:
       reserved-identifiers: 1.2.0
 
+  ieee754@1.2.1: {}
+
   ignore-walk@8.0.0:
     dependencies:
       minimatch: 10.2.6
@@ -10955,28 +12533,88 @@ snapshots:
 
   individual@3.0.0: {}
 
+  inherits@2.0.4: {}
+
   ini@1.3.8: {}
 
   ini@6.0.0: {}
 
+  internal-slot@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      hasown: 2.0.4
+      side-channel: 1.1.1
+
   ip-address@10.7.4: {}
 
   iron-webcrypto@1.2.1: {}
 
+  is-array-buffer@3.0.5:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
   is-arrayish@0.2.1: {}
 
+  is-async-function@2.1.1:
+    dependencies:
+      async-function: 1.0.0
+      call-bound: 1.0.4
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
+  is-bigint@1.1.0:
+    dependencies:
+      has-bigints: 1.1.0
+
+  is-boolean-object@1.2.2:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
   is-builtin-module@5.0.0:
     dependencies:
       builtin-modules: 5.4.0
 
+  is-callable@1.2.7: {}
+
+  is-data-view@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      is-typed-array: 1.1.15
+
+  is-date-object@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
   is-docker@3.0.0: {}
 
   is-docker@4.0.0: {}
 
+  is-document.all@1.0.0:
+    dependencies:
+      call-bound: 1.0.4
+
   is-extglob@2.1.1: {}
 
+  is-finalizationregistry@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
   is-fullwidth-code-point@3.0.0: {}
 
+  is-generator-function@1.1.2:
+    dependencies:
+      call-bound: 1.0.4
+      generator-function: 2.0.1
+      get-proto: 1.0.1
+      has-tostringtag: 1.0.2
+      safe-regex-test: 1.1.0
+
   is-glob@4.0.3:
     dependencies:
       is-extglob: 2.1.1
@@ -10990,6 +12628,15 @@ snapshots:
     dependencies:
       is-docker: 3.0.0
 
+  is-map@2.0.3: {}
+
+  is-negative-zero@2.0.3: {}
+
+  is-number-object@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
   is-number@7.0.0: {}
 
   is-path-inside@4.0.0: {}
@@ -11004,22 +12651,75 @@ snapshots:
 
   is-primitive@3.0.1: {}
 
+  is-regex@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+      hasown: 2.0.4
+
+  is-set@2.0.3: {}
+
+  is-shared-array-buffer@1.0.4:
+    dependencies:
+      call-bound: 1.0.4
+
   is-ssh@1.4.1:
     dependencies:
       protocols: 2.0.2
 
+  is-stream@2.0.1: {}
+
+  is-string@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-tostringtag: 1.0.2
+
+  is-symbol@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+      has-symbols: 1.1.0
+      safe-regex-test: 1.1.0
+
+  is-typed-array@1.1.15:
+    dependencies:
+      which-typed-array: 1.1.24
+
+  is-unsafe@2.0.2: {}
+
+  is-weakmap@2.0.2: {}
+
+  is-weakref@1.1.1:
+    dependencies:
+      call-bound: 1.0.4
+
+  is-weakset@2.0.4:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+
   is-windows@1.0.2: {}
 
   is-wsl@3.1.1:
     dependencies:
       is-inside-container: 1.0.0
 
+  isarray@1.0.0: {}
+
+  isarray@2.0.5: {}
+
   isexe@2.0.0: {}
 
   isexe@4.0.0: {}
 
   isobject@3.0.1: {}
 
+  jackspeak@3.4.3:
+    dependencies:
+      '@isaacs/cliui': 8.0.2
+    optionalDependencies:
+      '@pkgjs/parseargs': 0.11.0
+
   jiti@2.7.0: {}
 
   js-tokens@10.0.0: {}
@@ -11060,6 +12760,8 @@ snapshots:
 
   json-stable-stringify-without-jsonify@1.0.1: {}
 
+  json-with-bigint@3.5.12: {}
+
   json5@2.2.3: {}
 
   jsonc-eslint-parser@3.3.0:
@@ -11076,6 +12778,8 @@ snapshots:
 
   jsqr@1.4.0: {}
 
+  jwt-decode@4.0.0: {}
+
   katex@0.16.47:
     dependencies:
       commander: 8.3.0
@@ -11092,6 +12796,57 @@ snapshots:
 
   known-css-properties@0.37.0: {}
 
+  lazystream@1.0.1:
+    dependencies:
+      readable-stream: 2.3.8
+
+  lefthook-android-arm64@2.2.2:
+    optional: true
+
+  lefthook-darwin-arm64@2.2.2:
+    optional: true
+
+  lefthook-darwin-x64@2.2.2:
+    optional: true
+
+  lefthook-freebsd-arm64@2.2.2:
+    optional: true
+
+  lefthook-freebsd-x64@2.2.2:
+    optional: true
+
+  lefthook-linux-arm64@2.2.2:
+    optional: true
+
+  lefthook-linux-x64@2.2.2:
+    optional: true
+
+  lefthook-openbsd-arm64@2.2.2:
+    optional: true
+
+  lefthook-openbsd-x64@2.2.2:
+    optional: true
+
+  lefthook-windows-arm64@2.2.2:
+    optional: true
+
+  lefthook-windows-x64@2.2.2:
+    optional: true
+
+  lefthook@2.2.2:
+    optionalDependencies:
+      lefthook-android-arm64: 2.2.2
+      lefthook-darwin-arm64: 2.2.2
+      lefthook-darwin-x64: 2.2.2
+      lefthook-freebsd-arm64: 2.2.2
+      lefthook-freebsd-x64: 2.2.2
+      lefthook-linux-arm64: 2.2.2
+      lefthook-linux-x64: 2.2.2
+      lefthook-openbsd-arm64: 2.2.2
+      lefthook-openbsd-x64: 2.2.2
+      lefthook-windows-arm64: 2.2.2
+      lefthook-windows-x64: 2.2.2
+
   levn@0.4.1:
     dependencies:
       prelude-ls: 1.2.1
@@ -11199,14 +12954,6 @@ snapshots:
 
   lines-and-columns@1.2.4: {}
 
-  lint-staged@17.6.0:
-    dependencies:
-      picomatch: 4.0.7
-      string-argv: 0.3.2
-      tinyexec: 1.3.1
-    optionalDependencies:
-      yaml: 2.9.1
-
   local-pkg@1.2.1:
     dependencies:
       mlly: 1.8.2
@@ -11225,8 +12972,12 @@ snapshots:
 
   lodash.truncate@4.4.2: {}
 
+  lodash@4.18.1: {}
+
   longest-streak@3.1.0: {}
 
+  lru-cache@10.4.3: {}
+
   lru-cache@11.5.3: {}
 
   lru-cache@5.1.1:
@@ -11272,6 +13023,8 @@ snapshots:
 
   markdown-table@3.0.4: {}
 
+  math-intrinsics@1.1.0: {}
+
   mathml-tag-names@4.0.0: {}
 
   mdast-util-find-and-replace@3.0.3:
@@ -11659,6 +13412,14 @@ snapshots:
     dependencies:
       brace-expansion: 5.0.12
 
+  minimatch@5.1.9:
+    dependencies:
+      brace-expansion: 2.1.7
+
+  minimatch@9.0.9:
+    dependencies:
+      brace-expansion: 2.1.7
+
   minimist@1.2.8: {}
 
   minipass-collect@2.0.1:
@@ -11695,6 +13456,10 @@ snapshots:
     dependencies:
       minipass: 7.1.3
 
+  mkdirp@0.5.6:
+    dependencies:
+      minimist: 1.2.8
+
   mlly@1.8.2:
     dependencies:
       acorn: 8.19.0
@@ -11714,9 +13479,9 @@ snapshots:
 
   mute-stream@3.0.0: {}
 
-  nanoexec@1.1.0(@types/node@24.19.2):
+  nanoexec@1.1.0(@types/node@22.20.5):
     dependencies:
-      '@types/node': 24.19.2
+      '@types/node': 22.20.5
       promise-make-naked: 3.0.2
 
   nanoid@3.3.20: {}
@@ -11815,6 +13580,19 @@ snapshots:
 
   object-deep-merge@2.0.1: {}
 
+  object-inspect@1.13.4: {}
+
+  object-keys@1.1.1: {}
+
+  object.assign@4.1.7:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+      has-symbols: 1.1.0
+      object-keys: 1.1.1
+
   obug@3.0.0: {}
 
   ofetch@1.5.1:
@@ -11849,6 +13627,13 @@ snapshots:
       type-check: 0.4.0
       word-wrap: 1.2.5
 
+  own-keys@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      object-keys: 1.1.1
+      safe-push-apply: 1.0.0
+
   oxc-parser@0.154.0:
     dependencies:
       '@oxc-project/types': 0.154.0
@@ -11946,6 +13731,8 @@ snapshots:
 
   p-try@2.2.0: {}
 
+  package-json-from-dist@1.0.1: {}
+
   package-manager-detector@1.9.0: {}
 
   pacote@21.5.1(supports-color@10.2.2):
@@ -12002,8 +13789,15 @@ snapshots:
 
   path-exists@4.0.0: {}
 
+  path-expression-matcher@1.6.2: {}
+
   path-key@3.1.1: {}
 
+  path-scurry@1.11.1:
+    dependencies:
+      lru-cache: 10.4.3
+      minipass: 7.1.3
+
   path-scurry@2.0.2:
     dependencies:
       lru-cache: 11.5.3
@@ -12023,6 +13817,8 @@ snapshots:
 
   picomatch@4.0.7: {}
 
+  pkg-pr-new@0.0.91: {}
+
   pkg-types@1.3.1:
     dependencies:
       confbox: 0.1.8
@@ -12049,6 +13845,8 @@ snapshots:
     dependencies:
       yaml: 2.9.1
 
+  possible-typed-array-names@1.1.0: {}
+
   postcss-attribute-case-insensitive@8.0.2(postcss@8.5.31):
     dependencies:
       postcss: 8.5.31
@@ -12341,7 +14139,7 @@ snapshots:
     dependencies:
       postcss: 8.5.31
 
-  postcss-tailwindcss@3.1.3:
+  postcss-tailwindcss@3.1.5:
     dependencies:
       enhanced-resolve: 5.26.0
       get-tsconfig: 4.14.3
@@ -12371,6 +14169,10 @@ snapshots:
 
   process-ancestry@0.1.0: {}
 
+  process-nextick-args@2.0.1: {}
+
+  process@0.11.10: {}
+
   promise-make-naked@3.0.2: {}
 
   property-information@7.2.0: {}
@@ -12416,12 +14218,45 @@ snapshots:
       js-yaml: 4.3.2
       strip-bom: 4.0.0
 
+  readable-stream@2.3.8:
+    dependencies:
+      core-util-is: 1.0.3
+      inherits: 2.0.4
+      isarray: 1.0.0
+      process-nextick-args: 2.0.1
+      safe-buffer: 5.1.2
+      string_decoder: 1.1.1
+      util-deprecate: 1.0.2
+
+  readable-stream@4.8.0:
+    dependencies:
+      abort-controller: 3.0.0
+      buffer: 6.0.3
+      events: 3.3.0
+      process: 0.11.10
+      string_decoder: 1.3.0
+
+  readdir-glob@1.1.3:
+    dependencies:
+      minimatch: 5.1.9
+
   readdirp@5.1.1: {}
 
   refa@0.12.1:
     dependencies:
       '@eslint-community/regexpp': 4.12.2
 
+  reflect.getprototypeof@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+      get-intrinsic: 1.3.0
+      get-proto: 1.0.1
+      which-builtin-type: 1.2.1
+
   regex-recursion@6.0.2:
     dependencies:
       regex-utilities: 2.3.0
@@ -12437,19 +14272,28 @@ snapshots:
       '@eslint-community/regexpp': 4.12.2
       refa: 0.12.1
 
+  regexp.prototype.flags@1.5.4:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-errors: 1.3.0
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      set-function-name: 2.0.2
+
   regjsparser@0.13.4:
     dependencies:
       jsesc: 3.1.0
 
-  repoctl@5.10.3(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))(vitest@5.0.5):
+  repoctl@6.0.1(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))(vitest@5.0.5):
     dependencies:
-      '@icebreakers/monorepo': 5.10.3(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+      '@icebreakers/monorepo': 6.0.1(@commitlint/cli@21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3))(@pnpm/logger@1001.0.1)(@vitest/coverage-v8@5.0.5)(conventional-changelog-conventionalcommits@10.4.1)(eslint-plugin-pnpm@1.9.1(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2)))(eslint@10.13.0(jiti@2.7.0)(supports-color@10.2.2))(magicast@0.5.5)(postcss@8.5.31)(stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(supports-color@10.2.2)(tailwindcss@4.3.3)(typescript@6.0.3)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
     optionalDependencies:
       '@commitlint/cli': 21.2.4(conventional-commits-parser@7.1.3)(typescript@6.0.3)
       eslint: 10.13.0(jiti@2.7.0)(supports-color@10.2.2)
       stylelint: 17.16.0(supports-color@10.2.2)(typescript@6.0.3)
       typescript: 6.0.3
-      vitest: 5.0.5(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+      vitest: 5.0.5(@types/node@22.20.5)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
     transitivePeerDependencies:
       - '@angular-eslint/eslint-plugin'
       - '@angular-eslint/eslint-plugin-template'
@@ -12461,7 +14305,6 @@ snapshots:
       - '@opentelemetry/api'
       - '@pnpm/logger'
       - '@prettier/plugin-xml'
-      - '@types/node'
       - '@unocss/eslint-plugin'
       - '@vitest/browser-playwright'
       - '@vitest/browser-preview'
@@ -12567,6 +14410,29 @@ snapshots:
     dependencies:
       mri: 1.2.0
 
+  safe-array-concat@1.1.4:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      get-intrinsic: 1.3.0
+      has-symbols: 1.1.0
+      isarray: 2.0.5
+
+  safe-buffer@5.1.2: {}
+
+  safe-buffer@5.2.1: {}
+
+  safe-push-apply@1.0.0:
+    dependencies:
+      es-errors: 1.3.0
+      isarray: 2.0.5
+
+  safe-regex-test@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-regex: 1.2.1
+
   safer-buffer@2.1.2:
     optional: true
 
@@ -12601,6 +14467,28 @@ snapshots:
 
   set-blocking@2.0.0: {}
 
+  set-function-length@1.2.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      function-bind: 1.1.2
+      get-intrinsic: 1.3.0
+      gopd: 1.2.0
+      has-property-descriptors: 1.0.2
+
+  set-function-name@2.0.2:
+    dependencies:
+      define-data-property: 1.1.4
+      es-errors: 1.3.0
+      functions-have-names: 1.2.3
+      has-property-descriptors: 1.0.2
+
+  set-proto@1.0.0:
+    dependencies:
+      dunder-proto: 1.0.1
+      es-errors: 1.3.0
+      es-object-atoms: 1.1.2
+
   set-value@4.1.0:
     dependencies:
       is-plain-object: 2.0.4
@@ -12656,6 +14544,34 @@ snapshots:
       '@shikijs/vscode-textmate': 10.1.0
       '@types/hast': 3.0.5
 
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-map@1.0.1:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+
+  side-channel-weakmap@1.0.2:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      get-intrinsic: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-map: 1.0.1
+
+  side-channel@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
   signal-exit@4.1.0: {}
 
   sigstore@4.1.1(supports-color@10.2.2):
@@ -12739,7 +14655,19 @@ snapshots:
 
   std-env@4.3.0: {}
 
-  string-argv@0.3.2: {}
+  stop-iteration-iterator@1.1.0:
+    dependencies:
+      es-errors: 1.3.0
+      internal-slot: 1.1.0
+
+  streamx@2.28.1:
+    dependencies:
+      events-universal: 1.0.1
+      fast-fifo: 1.3.2
+      text-decoder: 1.2.7
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
 
   string-ts@2.3.1: {}
 
@@ -12749,6 +14677,12 @@ snapshots:
       is-fullwidth-code-point: 3.0.0
       strip-ansi: 6.0.1
 
+  string-width@5.1.2:
+    dependencies:
+      eastasianwidth: 0.2.0
+      emoji-regex: 9.2.2
+      strip-ansi: 7.2.0
+
   string-width@7.2.0:
     dependencies:
       emoji-regex: 10.6.0
@@ -12760,6 +14694,38 @@ snapshots:
       get-east-asian-width: 1.7.0
       strip-ansi: 7.2.0
 
+  string.prototype.trim@1.2.11:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-data-property: 1.1.4
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-object-atoms: 1.1.2
+      has-property-descriptors: 1.0.2
+      safe-regex-test: 1.1.0
+
+  string.prototype.trimend@1.0.10:
+    dependencies:
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  string.prototype.trimstart@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-object-atoms: 1.1.2
+
+  string_decoder@1.1.1:
+    dependencies:
+      safe-buffer: 5.1.2
+
+  string_decoder@1.3.0:
+    dependencies:
+      safe-buffer: 5.2.1
+
   stringify-entities@4.0.4:
     dependencies:
       character-entities-html4: 2.1.0
@@ -12781,6 +14747,10 @@ snapshots:
 
   strip-indent@4.1.1: {}
 
+  strnum@2.5.1:
+    dependencies:
+      anynum: 1.0.1
+
   stylelint-config-html@2.0.0(postcss-html@2.0.0(postcss@8.5.31))(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3)):
     dependencies:
       postcss-html: 2.0.0(postcss@8.5.31)
@@ -12833,12 +14803,12 @@ snapshots:
       postcss-sorting: 10.0.0(postcss@8.5.31)
       stylelint: 17.16.0(supports-color@10.2.2)(typescript@6.0.3)
 
-  stylelint-plugin-tailwindcss@3.1.3(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3):
+  stylelint-plugin-tailwindcss@3.1.5(stylelint@17.16.0(supports-color@10.2.2)(typescript@6.0.3))(tailwindcss@4.3.3):
     dependencies:
-      '@unocss/config': 66.10.5
-      '@unocss/core': 66.10.5
+      '@unocss/config': 66.11.0
+      '@unocss/core': 66.11.0
       postcss: 8.5.31
-      postcss-tailwindcss: 3.1.3
+      postcss-tailwindcss: 3.1.5
       stylelint: 17.16.0(supports-color@10.2.2)(typescript@6.0.3)
     optionalDependencies:
       tailwindcss: 4.3.3
@@ -12964,6 +14934,17 @@ snapshots:
 
   tapable@2.3.3: {}
 
+  tar-stream@3.2.2:
+    dependencies:
+      b4a: 1.9.0
+      bare-fs: 4.8.4
+      fast-fifo: 1.3.2
+      streamx: 2.28.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - bare-buffer
+      - react-native-b4a
+
   tar@7.5.22:
     dependencies:
       '@isaacs/fs-minipass': 4.0.1
@@ -12972,6 +14953,19 @@ snapshots:
       minizlib: 3.1.0
       yallist: 5.0.0
 
+  teex@1.0.1:
+    dependencies:
+      streamx: 2.28.1
+    transitivePeerDependencies:
+      - bare-abort-controller
+      - react-native-b4a
+
+  text-decoder@1.2.7:
+    dependencies:
+      b4a: 1.9.0
+    transitivePeerDependencies:
+      - react-native-b4a
+
   time-span@5.1.0:
     dependencies:
       convert-hrtime: 5.0.0
@@ -13008,6 +15002,14 @@ snapshots:
     dependencies:
       eslint-visitor-keys: 5.0.1
 
+  traverse@0.3.10:
+    dependencies:
+      define-data-property: 1.1.4
+      es-to-primitive: 1.3.4
+      gopd: 1.2.0
+      typedarray.prototype.slice: 1.0.6
+      which-typed-array: 1.1.24
+
   tree-kill@1.2.2: {}
 
   trim-lines@3.0.1: {}
@@ -13079,6 +15081,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  tunnel@0.0.6: {}
+
   turbo@2.11.10:
     optionalDependencies:
       '@turbo/darwin-64': 2.11.10
@@ -13094,6 +15098,49 @@ snapshots:
 
   type-fest@4.41.0: {}
 
+  typed-array-buffer@1.0.3:
+    dependencies:
+      call-bound: 1.0.4
+      es-errors: 1.3.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-length@1.0.3:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      has-proto: 1.2.0
+      is-typed-array: 1.1.15
+
+  typed-array-byte-offset@1.0.5:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      is-typed-array: 1.1.15
+      reflect.getprototypeof: 1.0.10
+
+  typed-array-length@1.0.8:
+    dependencies:
+      call-bind: 1.0.9
+      for-each: 0.3.5
+      gopd: 1.2.0
+      is-typed-array: 1.1.15
+      possible-typed-array-names: 1.1.0
+      reflect.getprototypeof: 1.0.10
+
+  typedarray.prototype.slice@1.0.6:
+    dependencies:
+      call-bind: 1.0.9
+      define-properties: 1.2.1
+      es-abstract: 1.24.2
+      es-errors: 1.3.0
+      get-proto: 1.0.1
+      math-intrinsics: 1.1.0
+      typed-array-buffer: 1.0.3
+      typed-array-byte-offset: 1.0.5
+
   typesafe-path@0.2.2: {}
 
   typescript-auto-import-cache@0.3.6:
@@ -13108,6 +15155,13 @@ snapshots:
 
   ultrahtml@1.7.0: {}
 
+  unbox-primitive@1.1.0:
+    dependencies:
+      call-bound: 1.0.4
+      has-bigints: 1.1.0
+      has-symbols: 1.1.0
+      which-boxed-primitive: 1.1.1
+
   unconfig-core@7.5.0:
     dependencies:
       '@quansync/fs': 1.1.0
@@ -13123,6 +15177,8 @@ snapshots:
 
   uncrypto@0.1.3: {}
 
+  undici-types@6.21.0: {}
+
   undici-types@7.24.6: {}
 
   undici@6.29.1: {}
@@ -13182,7 +15238,9 @@ snapshots:
       unist-util-is: 6.0.1
       unist-util-visit-parents: 6.0.2
 
-  unstorage@1.17.6:
+  universal-user-agent@7.0.3: {}
+
+  unstorage@1.17.6(@azure/storage-blob@12.34.0(supports-color@10.2.2)):
     dependencies:
       anymatch: 3.1.3
       chokidar: 5.0.0
@@ -13192,6 +15250,13 @@ snapshots:
       node-fetch-native: 1.6.7
       ofetch: 1.5.1
       ufo: 1.6.4
+    optionalDependencies:
+      '@azure/storage-blob': 12.34.0(supports-color@10.2.2)
+
+  unzip-stream@0.3.4:
+    dependencies:
+      binary: 0.3.0
+      mkdirp: 0.5.6
 
   update-browserslist-db@1.3.4(browserslist@4.29.4):
     dependencies:
@@ -13229,6 +15294,21 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
+  vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1):
+    dependencies:
+      lightningcss: 1.33.0
+      picomatch: 4.0.7
+      postcss: 8.5.31
+      rolldown: 1.2.14
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      '@types/node': 22.20.5
+      esbuild: 0.28.2
+      fsevents: 2.3.3
+      jiti: 2.7.0
+      tsx: 4.23.15
+      yaml: 2.9.1
+
   vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1):
     dependencies:
       lightningcss: 1.33.0
@@ -13248,6 +15328,28 @@ snapshots:
     optionalDependencies:
       vite: 8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
 
+  vitest@5.0.5(@types/node@22.20.5)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)):
+    dependencies:
+      '@types/chai': 5.2.3
+      '@vitest/mocker': 5.0.5(vite@8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))
+      chai: 6.3.0
+      es-module-lexer: 2.3.2
+      expect-type: 1.4.0
+      magic-string: 1.4.3
+      obug: 3.0.0
+      picomatch: 4.0.7
+      std-env: 4.3.0
+      tinybench: 6.2.2
+      tinyexec: 1.3.1
+      tinyglobby: 0.2.17
+      vite: 8.3.5(@types/node@22.20.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)
+      why-is-node-running: 3.2.1
+    optionalDependencies:
+      '@types/node': 22.20.5
+      '@vitest/coverage-v8': 5.0.5(vitest@5.0.5)
+    transitivePeerDependencies:
+      - msw
+
   vitest@5.0.5(@types/node@24.19.2)(@vitest/coverage-v8@5.0.5)(vite@8.3.5(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)):
     dependencies:
       '@types/chai': 5.2.3
@@ -13446,8 +15548,49 @@ snapshots:
 
   web-worker@1.5.0: {}
 
+  which-boxed-primitive@1.1.1:
+    dependencies:
+      is-bigint: 1.1.0
+      is-boolean-object: 1.2.2
+      is-number-object: 1.1.1
+      is-string: 1.1.1
+      is-symbol: 1.1.1
+
+  which-builtin-type@1.2.1:
+    dependencies:
+      call-bound: 1.0.4
+      function.prototype.name: 1.2.0
+      has-tostringtag: 1.0.2
+      is-async-function: 2.1.1
+      is-date-object: 1.1.0
+      is-finalizationregistry: 1.1.1
+      is-generator-function: 1.1.2
+      is-regex: 1.2.1
+      is-weakref: 1.1.1
+      isarray: 2.0.5
+      which-boxed-primitive: 1.1.1
+      which-collection: 1.0.2
+      which-typed-array: 1.1.24
+
+  which-collection@1.0.2:
+    dependencies:
+      is-map: 2.0.3
+      is-set: 2.0.3
+      is-weakmap: 2.0.2
+      is-weakset: 2.0.4
+
   which-module@2.0.1: {}
 
+  which-typed-array@1.1.24:
+    dependencies:
+      available-typed-arrays: 1.0.7
+      call-bind: 1.0.9
+      call-bound: 1.0.4
+      for-each: 0.3.5
+      get-proto: 1.0.1
+      gopd: 1.2.0
+      has-tostringtag: 1.0.2
+
   which@1.3.1:
     dependencies:
       isexe: 2.0.0
@@ -13495,6 +15638,18 @@ snapshots:
       string-width: 4.2.3
       strip-ansi: 6.0.1
 
+  wrap-ansi@7.0.0:
+    dependencies:
+      ansi-styles: 4.3.0
+      string-width: 4.2.3
+      strip-ansi: 6.0.1
+
+  wrap-ansi@8.1.0:
+    dependencies:
+      ansi-styles: 6.2.3
+      string-width: 5.1.2
+      strip-ansi: 7.2.0
+
   wrap-ansi@9.0.2:
     dependencies:
       ansi-styles: 6.2.3
@@ -13523,6 +15678,8 @@ snapshots:
 
   xml-name-validator@5.0.0: {}
 
+  xml-naming@0.3.0: {}
+
   xxhash-wasm@1.1.0: {}
 
   y18n@4.0.3: {}
@@ -13636,6 +15793,12 @@ snapshots:
       '@yuku-toolchain/types': 0.19.0
       yuku-core: 0.19.0
 
+  zip-stream@6.0.1:
+    dependencies:
+      archiver-utils: 5.0.2
+      compress-commons: 6.0.2
+      readable-stream: 4.8.0
+
   zod-validation-error@4.0.2(zod@4.6.7):
     dependencies:
       zod: 4.6.7
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 5b99755d..b608b1e6 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -13,6 +13,7 @@ versioning:
     storage: repository
 allowBuilds:
   esbuild: true
+  lefthook: true
   msgpackr-extract: true
   workerd: true
 overrides:
@@ -21,3 +22,12 @@ overrides:
 patchedDependencies:
   # Remove after upstream includes Astro templates in source scanning and HMR.
   '@weapp-tailwindcss/source-scan@0.1.2': patches/@weapp-tailwindcss__source-scan@0.1.2.patch
+minimumReleaseAgeExclude:
+  - '@icebreakers/commitlint-config@4.1.4'
+  - '@icebreakers/eslint-config@8.0.11'
+  - '@icebreakers/monorepo-templates@3.0.1'
+  - '@icebreakers/monorepo@6.0.1'
+  - '@icebreakers/stylelint-config@5.1.5'
+  - postcss-tailwindcss@3.1.5
+  - repoctl@6.0.1
+  - stylelint-plugin-tailwindcss@3.1.5
diff --git a/repoctl.config.ts b/repoctl.config.ts
index a16c1cde..46119f62 100644
--- a/repoctl.config.ts
+++ b/repoctl.config.ts
@@ -1,11 +1,69 @@
 import { defineMonorepoConfig } from 'repoctl'
 
+// These private workspaces are build inputs, not npm release candidates.
+// Explicit inputs replace repoctl's default package-directory coverage.
+const releaseInputs = {
+  weapp: [
+    // Frozen dependency resolution and patches can change the bundled CLI
+    // without changing a source import or the package's own manifest.
+    'package.json',
+    'pnpm-lock.yaml',
+    'pnpm-workspace.yaml',
+    'patches/**',
+    'packages/weapp/**',
+    '!packages/weapp/test/**',
+    '!packages/weapp/CHANGELOG.md',
+    'packages/project-catalog/package.json',
+    'packages/project-catalog/src/paths.ts',
+    'packages/project-catalog/src/content/schemas.ts',
+    'packages/project-catalog/src/lib/npm.ts',
+    'packages/project-catalog/src/content/projects/**',
+    'packages/project-catalog/public/brands/**',
+    'packages/site-ui/package.json',
+    'packages/site-ui/src/scripts/hero-logo.ts',
+    'packages/site-ui/src/scripts/hero-logo-data.ts',
+    'packages/site-ui/src/lib/hero-brand.ts',
+    'tsconfig.json',
+  ],
+}
+
 export default defineMonorepoConfig({
   commands: {
+    upgrade: {
+      // Application CI and tooling already have repository-specific contracts.
+      mergeTargets: false,
+      targets: [
+        '.github/workflows/release.yml',
+        '.github/workflows/repoctl-docs.yml',
+        '.github/workflows/repoctl-docs-deploy.yml',
+        'lefthook.yml',
+      ],
+    },
     release: {
       branches: { stable: 'main', prerelease: [] },
+      nightly: { provider: 'npm', schedule: '0 18 * * *' },
       qualityScripts: ['release:verify'],
       hooks: { afterVersion: ['release:build'] },
     },
+    docs: {
+      sites: {
+        'web': {
+          packages: ['weapp'],
+          releaseInputs,
+          buildScript: 'docs:web:build',
+          preview: { deployScript: 'docs:deploy' },
+          stable: { deployScript: 'docs:deploy', url: 'https://weapp.dev' },
+          patchPaths: [],
+        },
+        'open-source': {
+          packages: ['weapp'],
+          releaseInputs,
+          buildScript: 'docs:open-source:build',
+          preview: { deployScript: 'docs:deploy' },
+          stable: { deployScript: 'docs:deploy', url: 'https://weapp.js.org' },
+          patchPaths: [],
+        },
+      },
+    },
   },
 })
diff --git a/scripts/docs-build.mjs b/scripts/docs-build.mjs
new file mode 100644
index 00000000..44c415c6
--- /dev/null
+++ b/scripts/docs-build.mjs
@@ -0,0 +1,86 @@
+import { cp, mkdir } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { prContext, run, sites, writeBuildIdentity } from './docs-deployment/context.mjs'
+
+export async function prepareIdentity(site, cwd, env) {
+  if (!Object.hasOwn(sites, site)) {
+    throw new Error(`Unknown site: ${site}`)
+  }
+  let identityEnv = { ...env, REPO_DOCS_SITE: site }
+  if (env.GITHUB_EVENT_NAME === 'pull_request') {
+    const { identity } = await prContext(site, env, cwd)
+    identityEnv = {
+      ...identityEnv,
+      REPO_DOCS_CHANNEL: identity.channel,
+      REPO_DOCS_SOURCE_SHA: identity.sourceSha,
+      REPO_DOCS_RELEASE_ID: identity.releaseId,
+      REPO_DOCS_DEPLOYMENT_ID: identity.deploymentId,
+    }
+  }
+  await writeBuildIdentity(path.join(cwd, sites[site].directory, 'dist'), identityEnv)
+}
+
+async function retainEvidence(site, cwd, env) {
+  if (env.GITHUB_ACTIONS !== 'true' || !env.GITHUB_WORKSPACE) {
+    return
+  }
+  const destination = path.join(env.GITHUB_WORKSPACE, '.cache/docs-artifacts', site, env.REPO_DOCS_CHANNEL)
+  await mkdir(destination, { recursive: true })
+  for (const directory of ['dist', 'test-results']) {
+    try {
+      await cp(path.join(cwd, sites[site].directory, directory), path.join(destination, directory), { recursive: true })
+    }
+    catch (error) {
+      if (error.code !== 'ENOENT') {
+        throw error
+      }
+    }
+  }
+}
+
+export async function buildSite(site, { cwd = process.cwd(), env = process.env, execute = run, identityOnly = false } = {}) {
+  if (!Object.hasOwn(sites, site)) {
+    throw new Error(`Unknown site: ${site}`)
+  }
+  if (!['stable', 'preview'].includes(env.REPO_DOCS_CHANNEL)) {
+    throw new Error('Website builds require REPO_DOCS_CHANNEL=stable or preview.')
+  }
+  if (env.REPO_DOCS_SITE && env.REPO_DOCS_SITE !== site) {
+    throw new Error('The build script does not match the selected repoctl site.')
+  }
+  if (identityOnly) {
+    return prepareIdentity(site, cwd, env)
+  }
+
+  const buildEnv = { ...env, REPO_DOCS_SITE: site, HUSKY: '0', LEFTHOOK: '0', PLAYWRIGHT_MCP_HEADLESS: 'true' }
+  const command = args => execute('pnpm', args, { cwd, env: buildEnv })
+  const application = site === 'web' ? '@weapp-io/web' : '@weapp-io/open-source'
+  try {
+    await command(['check:boundaries'])
+    for (const [workspace, scripts] of [
+      ['@weapp-io/project-catalog', ['check', 'lint', 'test']],
+      ['@weapp-io/site-ui', ['lint', 'lint:styles', 'check', 'test']],
+      [application, ['lint', 'lint:styles', 'check', 'test', 'build']],
+    ]) {
+      for (const script of scripts) {
+        await command(['--filter', workspace, script])
+      }
+    }
+    await prepareIdentity(site, cwd, buildEnv)
+    await command(['--filter', application, 'exec', 'playwright', 'install', ...(env.CI ? ['--with-deps'] : []), 'chromium'])
+    await command(['--filter', application, 'exec', 'playwright', 'test'])
+  }
+  finally {
+    await retainEvidence(site, cwd, buildEnv)
+  }
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const [site, option, ...extra] = process.argv.slice(2)
+  if (extra.length || (option && option !== '--identity-only')) {
+    throw new Error('Usage: docs-build.mjs <web|open-source> [--identity-only]')
+  }
+  await buildSite(site, { identityOnly: option === '--identity-only' })
+}
diff --git a/scripts/docs-build.test.mjs b/scripts/docs-build.test.mjs
new file mode 100644
index 00000000..9810dc05
--- /dev/null
+++ b/scripts/docs-build.test.mjs
@@ -0,0 +1,63 @@
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+import { buildSite } from './docs-build.mjs'
+
+describe('frozen website verification', () => {
+  it('tests the identified build and retains that exact artifact for deployment diagnostics', async () => {
+    const cwd = await mkdtemp(path.join(os.tmpdir(), 'weapp-docs-build-'))
+    const commands = []
+    const env = {
+      GITHUB_ACTIONS: 'true',
+      GITHUB_WORKSPACE: path.join(cwd, 'runner'),
+      REPO_DOCS_SITE: 'web',
+      REPO_DOCS_CHANNEL: 'preview',
+      REPO_DOCS_SOURCE_SHA: 'a'.repeat(40),
+      REPO_DOCS_DEPLOYMENT_ID: 'b'.repeat(64),
+    }
+    try {
+      const dist = path.join(cwd, 'apps/web/dist')
+      await buildSite('web', { cwd, env, execute: async (command, args, options) => {
+        commands.push(args)
+        expect(command).toBe('pnpm')
+        expect(options.cwd).toBe(cwd)
+        expect(options.env.REPO_DOCS_CHANNEL).toBe('preview')
+        if (args.at(-1) === 'build') {
+          await mkdir(dist, { recursive: true })
+          await writeFile(path.join(dist, 'index.html'), '<h1>frozen source</h1>')
+        }
+        if (args.includes('playwright') && args.at(-1) === 'test') {
+          const identity = JSON.parse(await readFile(path.join(dist, 'repoctl-deployment.json'), 'utf8'))
+          expect(identity.sourceSha).toBe(env.REPO_DOCS_SOURCE_SHA)
+          expect(identity.deploymentId).toBe(env.REPO_DOCS_DEPLOYMENT_ID)
+        }
+      } })
+      expect(commands.filter(args => args.at(-1) === 'build')).toHaveLength(1)
+      expect(await readFile(path.join(cwd, 'runner/.cache/docs-artifacts/web/preview/dist/index.html'), 'utf8')).toBe('<h1>frozen source</h1>')
+    }
+    finally {
+      await rm(cwd, { recursive: true, force: true })
+    }
+  })
+
+  it('fails before building when a quality gate fails', async () => {
+    const commands = []
+    await expect(buildSite('web', {
+      env: { REPO_DOCS_CHANNEL: 'stable' },
+      execute: async (_command, args) => {
+        commands.push(args)
+        throw new Error('boundary violation')
+      },
+    })).rejects.toThrow('boundary violation')
+    expect(commands).toEqual([['check:boundaries']])
+  })
+
+  it('rejects an ambiguous channel or a mismatched configured site before executing anything', async () => {
+    const execute = async () => {
+      throw new Error('must not execute')
+    }
+    await expect(buildSite('web', { env: {}, execute })).rejects.toThrow('REPO_DOCS_CHANNEL')
+    await expect(buildSite('web', { env: { REPO_DOCS_CHANNEL: 'preview', REPO_DOCS_SITE: 'open-source' }, execute })).rejects.toThrow('does not match')
+  })
+})
diff --git a/scripts/docs-deployment/README.md b/scripts/docs-deployment/README.md
new file mode 100644
index 00000000..c05ce61c
--- /dev/null
+++ b/scripts/docs-deployment/README.md
@@ -0,0 +1,109 @@
+# Website deployment adapters
+
+These scripts are provider adapters for `repo docs deploy`. They do not select
+release sources or advance repoctl's deployment pointer. repoctl owns those
+operations and invokes the adapter inside its frozen checkout.
+
+## Commands and build integration
+
+- `node scripts/docs-deployment/cli.mjs managed`: deploy the site and channel in
+  `REPO_DOCS_*`; write the confirmed result to `REPO_DOCS_RESULT_FILE`.
+- `node scripts/docs-deployment/cli.mjs pr web` (or `open-source`): upload a Worker
+  version from an already tested PR artifact; emit `url` and `versionId` through
+  `GITHUB_OUTPUT`. This never writes repoctl state or changes Worker traffic.
+
+Before testing the build, call `writeBuildIdentity(dist, env)` from `context.mjs`.
+The resulting `repoctl-deployment.json` contains `schemaVersion: 1`, `site`,
+`channel`, `sourceSha`, `releaseId`, and `deploymentId`. The adapter compares every
+field before uploading. `buildIdentity(env)` is available when a build needs to
+inspect these values. Ordinary local builds may have empty source/release IDs;
+those artifacts cannot pass the managed deployment gate.
+
+For a PR artifact, `await prContext(site, env, cwd)` returns the complete identity
+computed from the trusted event. Write that exact identity to the artifact before
+its tests. The page build still uses its preview/noindex presentation; the
+artifact identity uses `channel: "pr"`. PR context requires `PR_NUMBER`,
+`PR_HEAD_SHA`, and GitHub's `GITHUB_EVENT_PATH`; forks and non-PR events fail.
+Both build and deployment jobs must explicitly check out the PR head SHA.
+`prContext` also reads the actual Git HEAD and rejects synthetic merge commits
+or any other checkout whose source differs from that head. Tests can inject
+`{ readHead: () => sha }` as its fourth argument.
+
+Managed deployment requires the `weappjs/weapp.dev` main workflow, a complete
+source SHA, repoctl deployment ID and result path, and concurrency group
+`docs-<site>-<channel>`. Stable requires a completed release ID. The build and
+deployment receive the same environment from repoctl.
+
+## Cloudflare targets
+
+| Site/channel                        | Worker                      | Configuration                             |
+| ----------------------------------- | --------------------------- | ----------------------------------------- |
+| web/stable                          | `weapp-dev`                 | `apps/web/wrangler.jsonc`                 |
+| web/preview and PR versions         | `weapp-dev-preview`         | `apps/web/wrangler.preview.jsonc`         |
+| open-source/preview and PR versions | `weapp-open-source-preview` | `apps/open-source/wrangler.preview.jsonc` |
+
+Wrangler is resolved from `@weapp-io/web`. Configurations use plain JSON syntax;
+the preview configurations must enable `workers_dev` and `preview_urls`, omit
+production routes, and point `assets.directory` at their application's `dist`.
+The configured name and artifact directory are checked before invoking Wrangler.
+Without a configured preview URL, the adapter queries the account's workers.dev
+subdomain. Credentials are `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN`.
+
+Wrangler's `WRANGLER_OUTPUT_FILE_PATH` JSONL is the version source. The adapter
+then independently verifies Cloudflare's active version, 100% traffic and
+`workers/message` annotation. An already active matching deployment is reused.
+PR upload reads `version-upload` output and verifies the version message and
+alias. The uploaded version must not receive active traffic; a concurrent managed
+main preview deployment may legitimately change the active version. PR comments
+link to the immutable version preview URL, whose prefix must match the verified
+version ID. The reusable `pr-N` alias is never used as the returned artifact link:
+a cancelled upload or a later PR revision could move it to another commit.
+
+New preview Workers require one managed main preview deployment first. Wrangler
+4.151.3 explicitly rejects `versions upload` when the Worker does not yet exist.
+After merging the migration to main, run Documentation for `web/preview` and
+`open-source/preview` (or let its main-push run initialize both), then rerun PR
+preview jobs. The PR adapter never substitutes `wrangler deploy` for this step.
+
+## GitHub Pages
+
+Only open-source/stable uses Pages, retaining `https://weapp.js.org`. The root
+workspace installs exact `@actions/artifact` and `@actions/core` dependencies.
+Execute repoctl from a Node.js action (for example a pinned
+`actions/github-script` spawning `pnpm` with inherited `process.env`) so the
+artifact SDK receives `ACTIONS_RUNTIME_TOKEN` and `ACTIONS_RESULTS_URL`.
+A plain shell step does not supply the complete artifact runtime environment.
+
+The job needs `contents: write`, `pages: write`, `id-token: write`, and
+`GITHUB_TOKEN`. Both reusable-workflow callers must permit those permissions.
+Use the `docs-open-source-stable` environment restricted to `main`, matching the
+environment in the Pages REST request and repoctl's concurrency group.
+
+The adapter uploads the official `artifact.tar` format, requests OIDC, creates
+a Pages deployment, and polls the returned deployment ID. It only writes the
+repoctl result after Pages reports success and the public identity file matches
+the exact build. Every upload has a unique artifact name, so a safe retry within
+the same workflow run does not collide with an earlier artifact. Tokens are never
+included in reports.
+
+Provider receipts are separate files on `repoctl-release-state`:
+`provider-receipts/pages/<deploymentId>.json`. Each update uses the file revision
+as a compare-and-swap condition. If a receipt write response is lost, the adapter
+accepts it only after reading back the exact bytes and committed revision; a
+different or unreadable state remains an error. These receipts never replace
+repoctl's own state files. A known provider ID resumes polling without another upload. A lost
+POST response is recovered only when the exact public artifact proves success;
+otherwise the request remains pending and a second POST is prohibited. A known
+terminal provider failure or definite creation rejection (400/401/403/404/422)
+is recorded and can be retried, retaining its previous attempt. Conflicts, server
+errors and connection failures preserve the unknown request. Keep the state
+branch and receipts for recovery.
+
+The CLI saves a sanitized success or failure summary under
+`$GITHUB_WORKSPACE/.cache/docs-deployment/<site>-<channel>.json` for workflow
+artifact collection. Outside Actions it uses the current workspace. Reports
+contain the validated identity and provider result or failure phase, never the
+environment or credentials.
+
+Provider tests inject requests, commands, artifact clients, clocks and receipt
+storage; running them performs no external deployment or publication.
diff --git a/scripts/docs-deployment/cli.mjs b/scripts/docs-deployment/cli.mjs
new file mode 100644
index 00000000..06455f79
--- /dev/null
+++ b/scripts/docs-deployment/cli.mjs
@@ -0,0 +1,38 @@
+import { appendFile } from 'node:fs/promises'
+import process from 'node:process'
+import { deployCloudflare, uploadPrPreview } from './cloudflare.mjs'
+import { managedContext, prContext } from './context.mjs'
+import { sanitizeMessage, writeDiagnostic } from './diagnostics.mjs'
+import { deployPages } from './pages.mjs'
+
+const [command, site] = process.argv.slice(2)
+let context
+let phase = 'context'
+try {
+  if (!['managed', 'pr'].includes(command)) {
+    throw new Error('Usage: node scripts/docs-deployment/cli.mjs managed | pr <site>')
+  }
+  context = command === 'managed' ? managedContext() : await prContext(site)
+  phase = 'provider'
+  const result = command === 'pr'
+    ? await uploadPrPreview(context)
+    : context.site === 'open-source' && context.channel === 'stable'
+      ? await deployPages(context)
+      : await deployCloudflare(context)
+  phase = 'output'
+  if (command === 'pr' && process.env.GITHUB_OUTPUT) {
+    await appendFile(process.env.GITHUB_OUTPUT, `url=${result.url}\nversionId=${result.versionId}\n`)
+  }
+  await writeDiagnostic({ context, result, phase: 'complete' })
+  console.log(JSON.stringify(result))
+}
+catch (error) {
+  try {
+    await writeDiagnostic({ context, site: command === 'pr' ? site : process.env.REPO_DOCS_SITE, channel: command === 'pr' ? 'pr' : process.env.REPO_DOCS_CHANNEL, phase, error })
+  }
+  catch (diagnosticError) {
+    console.error(`Could not save deployment diagnostics: ${sanitizeMessage(diagnosticError.message)}`)
+  }
+  console.error(sanitizeMessage(error.message ?? error))
+  process.exitCode = 1
+}
diff --git a/scripts/docs-deployment/cloudflare.mjs b/scripts/docs-deployment/cloudflare.mjs
new file mode 100644
index 00000000..c73ac83a
--- /dev/null
+++ b/scripts/docs-deployment/cloudflare.mjs
@@ -0,0 +1,156 @@
+import { mkdtemp, readFile, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { run, verifyArtifact, writeResult } from './context.mjs'
+
+export const deploymentMessage = identity => `repoctl-docs:${identity.deploymentId}`
+
+export function cloudflareClient(env, request = fetch) {
+  if (!env.CLOUDFLARE_API_TOKEN || !/^[a-f\d]{32}$/i.test(env.CLOUDFLARE_ACCOUNT_ID ?? '')) {
+    throw new Error('Cloudflare deployment requires an API token and account ID.')
+  }
+  return async (endpoint, allowMissing = false) => {
+    const response = await request(`https://api.cloudflare.com/client/v4/accounts/${env.CLOUDFLARE_ACCOUNT_ID}/workers/${endpoint}`, {
+      headers: { Authorization: `Bearer ${env.CLOUDFLARE_API_TOKEN}` },
+      signal: AbortSignal.timeout(30000),
+    })
+    const payload = await response.json()
+    if (allowMissing && response.status === 404 && payload.errors?.some(error => error.code === 10007)) {
+      return undefined
+    }
+    if (!response.ok || !payload.success) {
+      throw new Error(`Cloudflare verification failed (HTTP ${response.status}).`)
+    }
+    return payload.result
+  }
+}
+
+export async function activeVersion(client, worker) {
+  const result = await client(`scripts/${worker}/deployments`, true)
+  if (result === undefined) {
+    return undefined
+  }
+  if (!Array.isArray(result.deployments)) {
+    throw new TypeError('Invalid Cloudflare deployments response.')
+  }
+  const latest = [...result.deployments].sort((a, b) => b.created_on.localeCompare(a.created_on))[0]
+  if (!latest) {
+    return undefined
+  }
+  if (latest.versions?.length !== 1 || latest.versions[0].percentage !== 100) {
+    throw new Error('The site Worker must serve one active version at 100% traffic.')
+  }
+  const id = latest.versions[0].version_id
+  if (typeof id !== 'string' || !/^[a-f\d-]{36}$/i.test(id)) {
+    throw new Error('Invalid Cloudflare active version ID.')
+  }
+  const version = await client(`scripts/${worker}/versions/${id}`)
+  if (version.id !== id) {
+    throw new Error('Cloudflare version identity mismatch.')
+  }
+  return { id, message: version.annotations?.['workers/message'] }
+}
+
+export function readWranglerOutput(output, worker, type) {
+  const entries = output.split(/\r?\n/).filter(line => line.trim()).map(line => JSON.parse(line))
+  const result = entries.findLast(entry => entry.type === type && entry.worker_name === worker && !entry.wrangler_environment)
+  if (typeof result?.version_id !== 'string' || !/^[a-f\d-]{36}$/i.test(result.version_id)) {
+    throw new Error(`Wrangler did not report a ${type} version for ${worker}.`)
+  }
+  return result
+}
+
+export async function verifyWorkerTarget(context) {
+  // These repository-owned JSONC files deliberately use JSON syntax so target
+  // validation does not execute config code or depend on Wrangler internals.
+  const config = JSON.parse(await readFile(context.config, 'utf8'))
+  if (config.name !== context.worker || typeof config.assets?.directory !== 'string'
+    || path.resolve(path.dirname(context.config), config.assets.directory) !== context.dist) {
+    throw new Error('Wrangler configuration does not target this Worker and validated site artifact.')
+  }
+  if (context.channel !== 'stable' && (config.route || config.routes?.length || config.workers_dev !== true || config.preview_urls !== true)) {
+    throw new Error('Preview Workers require workers.dev and version previews without production routes.')
+  }
+}
+
+async function invokeWrangler(context, args, execute) {
+  const directory = await mkdtemp(path.join(tmpdir(), 'weapp-docs-wrangler-'))
+  const output = path.join(directory, 'output.jsonl')
+  try {
+    await execute('pnpm', ['--filter', '@weapp-io/web', 'exec', 'wrangler', ...args, '--config', context.config, '--message', deploymentMessage(context.identity)], {
+      cwd: context.cwd,
+      env: { ...context.env, WRANGLER_OUTPUT_FILE_PATH: output },
+    })
+    return await readFile(output, 'utf8')
+  }
+  finally {
+    await rm(directory, { recursive: true, force: true })
+  }
+}
+
+async function workerUrl(context, client) {
+  if (context.url) {
+    return context.url
+  }
+  const result = await client('subdomain')
+  if (!/^[a-z\d-]+$/.test(result?.subdomain ?? '')) {
+    throw new Error('Cloudflare account has no valid workers.dev subdomain.')
+  }
+  return `https://${context.worker}.${result.subdomain}.workers.dev`
+}
+
+export async function deployCloudflare(context, options = {}) {
+  if (!context.worker) {
+    throw new Error('This site channel does not use Cloudflare.')
+  }
+  await verifyWorkerTarget(context)
+  await verifyArtifact(context)
+  const client = options.client ?? cloudflareClient(context.env, options.fetch)
+  const expected = deploymentMessage(context.identity)
+  let active = await activeVersion(client, context.worker)
+  if (active?.message !== expected) {
+    const output = await invokeWrangler(context, ['deploy'], options.run ?? run)
+    const uploaded = readWranglerOutput(output, context.worker, 'deploy')
+    active = await activeVersion(client, context.worker)
+    if (active?.id !== uploaded.version_id || active.message !== expected) {
+      throw new Error('Cloudflare did not confirm this exact version at 100% traffic; retry the same deployment.')
+    }
+  }
+  return writeResult(context, { versionId: active.id, url: await workerUrl(context, client) })
+}
+
+export async function uploadPrPreview(context, options = {}) {
+  if (context.channel !== 'pr' || !context.alias) {
+    throw new Error('Version preview requires a verified PR context.')
+  }
+  await verifyWorkerTarget(context)
+  await verifyArtifact(context)
+  const client = options.client ?? cloudflareClient(context.env, options.fetch)
+  const before = await activeVersion(client, context.worker)
+  if (!before) {
+    throw new Error(`Preview Worker ${context.worker} is not initialized. Run its managed main preview deployment before uploading PR versions.`)
+  }
+  const output = await invokeWrangler(context, ['versions', 'upload', '--preview-alias', context.alias], options.run ?? run)
+  const uploaded = readWranglerOutput(output, context.worker, 'version-upload')
+  const version = await client(`scripts/${context.worker}/versions/${uploaded.version_id}`)
+  if (version.id !== uploaded.version_id || version.annotations?.['workers/message'] !== deploymentMessage(context.identity)
+    || version.annotations?.['workers/alias'] !== context.alias) {
+    throw new Error('Cloudflare did not confirm the uploaded PR version identity.')
+  }
+  const after = await activeVersion(client, context.worker)
+  if (after?.id === uploaded.version_id) {
+    throw new Error('The PR upload version unexpectedly received active Worker traffic; inspect the deployment.')
+  }
+  // PR jobs may be cancelled while Cloudflare is still finishing an upload.
+  // A reusable alias can therefore move independently of this job's SHA; only
+  // the version URL is a stable link to the artifact verified above.
+  const url = uploaded.preview_url
+  const parsed = new URL(url)
+  const suffix = `-${context.worker}.`
+  if (parsed.protocol !== 'https:' || parsed.username || parsed.password || parsed.port || parsed.pathname !== '/'
+    || parsed.search || parsed.hash || !parsed.hostname.endsWith('.workers.dev')
+    || !parsed.hostname.startsWith(`${uploaded.version_id.slice(0, 8)}${suffix}`)) {
+    throw new Error('Wrangler returned an invalid preview URL.')
+  }
+  return { versionId: uploaded.version_id, url }
+}
diff --git a/scripts/docs-deployment/context.mjs b/scripts/docs-deployment/context.mjs
new file mode 100644
index 00000000..58bdad09
--- /dev/null
+++ b/scripts/docs-deployment/context.mjs
@@ -0,0 +1,134 @@
+import { execFileSync, spawn } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { readFile, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+
+export const identityFilename = 'repoctl-deployment.json'
+export const sites = {
+  'web': { directory: 'apps/web', worker: 'weapp-dev', previewWorker: 'weapp-dev-preview', stableUrl: 'https://weapp.dev' },
+  'open-source': { directory: 'apps/open-source', previewWorker: 'weapp-open-source-preview', stableUrl: 'https://weapp.js.org' },
+}
+
+export function managedContext(env = process.env, cwd = process.cwd()) {
+  const site = env.REPO_DOCS_SITE
+  const channel = env.REPO_DOCS_CHANNEL
+  if (!Object.hasOwn(sites, site ?? '') || !['preview', 'stable'].includes(channel)
+    || !/^[a-f\d]{40}$/.test(env.REPO_DOCS_SOURCE_SHA ?? '')
+    || !/^[a-f\d]{64}$/.test(env.REPO_DOCS_DEPLOYMENT_ID ?? '')
+    || !env.REPO_DOCS_RESULT_FILE) {
+    throw new Error('Deployment requires repo docs deploy with a complete site, channel and source identity.')
+  }
+  if (env.GITHUB_ACTIONS !== 'true' || !env.GITHUB_RUN_ID || env.GITHUB_REF !== 'refs/heads/main'
+    || env.GITHUB_REPOSITORY !== 'weappjs/weapp.dev'
+    || env.REPO_DOCS_CONCURRENCY_GROUP !== `docs-${site}-${channel}`) {
+    throw new Error('Deployment requires the managed main workflow and matching site concurrency group.')
+  }
+  if (channel === 'stable' && !env.REPO_DOCS_RELEASE_ID) {
+    throw new Error('Stable deployment requires a completed release record.')
+  }
+  const target = sites[site]
+  const url = env.REPO_DOCS_URL || (channel === 'stable' ? target.stableUrl : undefined)
+  if (url && (new URL(url).protocol !== 'https:' || (channel === 'stable' && url !== target.stableUrl))) {
+    throw new Error('Unexpected deployment URL.')
+  }
+  return {
+    site,
+    channel,
+    env,
+    cwd,
+    url,
+    directory: path.join(cwd, target.directory),
+    dist: path.join(cwd, target.directory, 'dist'),
+    worker: channel === 'stable' ? target.worker : target.previewWorker,
+    config: path.join(cwd, target.directory, channel === 'stable' ? 'wrangler.jsonc' : 'wrangler.preview.jsonc'),
+    identity: {
+      schemaVersion: 1,
+      site,
+      channel,
+      sourceSha: env.REPO_DOCS_SOURCE_SHA,
+      releaseId: env.REPO_DOCS_RELEASE_ID || '',
+      deploymentId: env.REPO_DOCS_DEPLOYMENT_ID,
+    },
+  }
+}
+
+export function buildIdentity(env = process.env) {
+  return {
+    schemaVersion: 1,
+    site: env.REPO_DOCS_SITE,
+    channel: env.REPO_DOCS_CHANNEL || 'preview',
+    sourceSha: env.REPO_DOCS_SOURCE_SHA || '',
+    releaseId: env.REPO_DOCS_RELEASE_ID || '',
+    deploymentId: env.REPO_DOCS_DEPLOYMENT_ID || '',
+  }
+}
+
+export async function writeBuildIdentity(dist, env = process.env) {
+  await writeFile(path.join(dist, identityFilename), `${JSON.stringify(buildIdentity(env))}\n`)
+}
+
+export function assertIdentity(actual, expected) {
+  if (!actual || Object.entries(expected).some(([key, value]) => actual[key] !== value)) {
+    throw new Error('The site artifact does not match this deployment identity; rebuild the selected source.')
+  }
+}
+
+export async function verifyArtifact(context) {
+  assertIdentity(JSON.parse(await readFile(path.join(context.dist, identityFilename), 'utf8')), context.identity)
+}
+
+export async function prContext(site, env = process.env, cwd = process.cwd(), options = {}) {
+  if (!Object.hasOwn(sites, site) || env.GITHUB_ACTIONS !== 'true' || env.GITHUB_EVENT_NAME !== 'pull_request'
+    || env.GITHUB_REPOSITORY !== 'weappjs/weapp.dev' || !env.GITHUB_EVENT_PATH) {
+    throw new Error('PR previews require a same-repository pull_request workflow.')
+  }
+  const event = JSON.parse(await readFile(env.GITHUB_EVENT_PATH, 'utf8'))
+  const pr = event.pull_request
+  if (pr?.head?.repo?.full_name !== env.GITHUB_REPOSITORY || pr?.base?.repo?.full_name !== env.GITHUB_REPOSITORY
+    || String(event.number) !== env.PR_NUMBER || pr.head.sha !== env.PR_HEAD_SHA
+    || !/^[a-f\d]{40}$/.test(env.PR_HEAD_SHA ?? '') || !/^[1-9]\d*$/.test(env.PR_NUMBER ?? '')) {
+    throw new Error('PR preview identity does not match the trusted event.')
+  }
+  const readHead = options.readHead ?? (() => execFileSync('git', ['rev-parse', 'HEAD'], {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: 10000,
+  }).trim())
+  if (await readHead() !== env.PR_HEAD_SHA) {
+    throw new Error('PR preview checkout must be the exact PR head SHA; merge commits cannot be labelled as the PR source.')
+  }
+  const target = sites[site]
+  const deploymentId = createHash('sha256').update(`${env.GITHUB_REPOSITORY}:${site}:${env.PR_NUMBER}:${env.PR_HEAD_SHA}`).digest('hex')
+  return {
+    site,
+    channel: 'pr',
+    cwd,
+    env,
+    worker: target.previewWorker,
+    config: path.join(cwd, target.directory, 'wrangler.preview.jsonc'),
+    directory: path.join(cwd, target.directory),
+    dist: path.join(cwd, target.directory, 'dist'),
+    alias: `pr-${env.PR_NUMBER}`,
+    identity: { schemaVersion: 1, site, channel: 'pr', sourceSha: env.PR_HEAD_SHA, releaseId: '', deploymentId },
+  }
+}
+
+export function run(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: 'inherit', shell: false, ...options })
+    child.on('error', reject)
+    child.on('exit', (code, signal) => code === 0 ? resolve() : reject(new Error(`${command} failed (${signal || code}).`)))
+  })
+}
+
+export const pause = milliseconds => new Promise(resolve => setTimeout(resolve, milliseconds))
+
+export async function writeResult(context, result) {
+  if (!result.versionId || !result.url || new URL(result.url).protocol !== 'https:') {
+    throw new Error('Invalid provider deployment result.')
+  }
+  await writeFile(context.env.REPO_DOCS_RESULT_FILE, `${JSON.stringify(result)}\n`)
+  return result
+}
diff --git a/scripts/docs-deployment/deployment.test.mjs b/scripts/docs-deployment/deployment.test.mjs
new file mode 100644
index 00000000..d264acac
--- /dev/null
+++ b/scripts/docs-deployment/deployment.test.mjs
@@ -0,0 +1,391 @@
+import { Buffer } from 'node:buffer'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { describe, expect, it, vi } from 'vitest'
+import { activeVersion, cloudflareClient, deployCloudflare, deploymentMessage, readWranglerOutput, uploadPrPreview, verifyWorkerTarget } from './cloudflare.mjs'
+import { assertIdentity, managedContext, prContext, writeBuildIdentity } from './context.mjs'
+import { sanitizeMessage, writeDiagnostic } from './diagnostics.mjs'
+import { pagesReceiptStore } from './github.mjs'
+import { deployPages, waitForPages } from './pages.mjs'
+
+const sha = 'a'.repeat(40)
+const identity = 'b'.repeat(64)
+const version = '11111111-1111-4111-8111-111111111111'
+const oldVersion = '22222222-2222-4222-8222-222222222222'
+const env = {
+  GITHUB_ACTIONS: 'true',
+  GITHUB_RUN_ID: '123',
+  GITHUB_RUN_ATTEMPT: '1',
+  GITHUB_REPOSITORY: 'weappjs/weapp.dev',
+  GITHUB_REF: 'refs/heads/main',
+  REPO_DOCS_SITE: 'web',
+  REPO_DOCS_CHANNEL: 'stable',
+  REPO_DOCS_SOURCE_SHA: sha,
+  REPO_DOCS_RELEASE_ID: 'release-1',
+  REPO_DOCS_DEPLOYMENT_ID: identity,
+  REPO_DOCS_RESULT_FILE: '/unused',
+  REPO_DOCS_CONCURRENCY_GROUP: 'docs-web-stable',
+}
+
+async function fixture(site, callback) {
+  const cwd = await mkdtemp(path.join(tmpdir(), 'weapp-deploy-test-'))
+  try {
+    const values = { ...env, REPO_DOCS_SITE: site, REPO_DOCS_CONCURRENCY_GROUP: `docs-${site}-stable`, REPO_DOCS_RESULT_FILE: path.join(cwd, 'result.json') }
+    const context = managedContext(values, cwd)
+    await mkdir(context.dist, { recursive: true })
+    await writeBuildIdentity(context.dist, values)
+    await writeFile(context.config, JSON.stringify({ name: context.worker, assets: { directory: './dist' } }))
+    await callback(context)
+  }
+  finally {
+    await rm(cwd, { recursive: true, force: true })
+  }
+}
+
+async function prFixture(callback) {
+  return fixture('web', async (original) => {
+    const context = { ...original, channel: 'pr', worker: 'weapp-dev-preview', alias: 'pr-7', identity: { ...original.identity, channel: 'pr' } }
+    await writeFile(path.join(context.dist, 'repoctl-deployment.json'), JSON.stringify(context.identity))
+    await writeFile(context.config, JSON.stringify({ name: context.worker, assets: { directory: './dist' }, workers_dev: true, preview_urls: true }))
+    await callback(context)
+  })
+}
+
+function receiptStore(initial) {
+  let current = initial
+  let revision = initial ? '0' : undefined
+  return {
+    read: vi.fn(async () => ({ value: current, revision })),
+    write: vi.fn(async (value, expected) => {
+      expect(expected).toBe(revision)
+      current = structuredClone(value)
+      revision = String(Number(revision || 0) + 1)
+      return revision
+    }),
+    current: () => current,
+  }
+}
+
+describe('deployment identity', () => {
+  it('requires managed source, release, repository and concurrency for stable deployments', () => {
+    expect(managedContext(env).worker).toBe('weapp-dev')
+    for (const values of [
+      { REPO_DOCS_SOURCE_SHA: 'main' },
+      { REPO_DOCS_DEPLOYMENT_ID: '' },
+      { REPO_DOCS_RELEASE_ID: '' },
+      { GITHUB_REF: 'refs/pull/1/merge' },
+      { GITHUB_REPOSITORY: 'fork/repo' },
+      { REPO_DOCS_CONCURRENCY_GROUP: 'another-lock' },
+      { REPO_DOCS_URL: 'https://other.example' },
+    ]) { expect(() => managedContext({ ...env, ...values })).toThrow() }
+  })
+
+  it('rejects a built artifact from a different source', () => {
+    expect(() => assertIdentity({ sourceSha: 'old' }, { sourceSha: sha })).toThrow(/does not match/)
+  })
+
+  it('rejects forks and mismatched PR heads before upload', async () => {
+    const cwd = await mkdtemp(path.join(tmpdir(), 'weapp-pr-test-'))
+    try {
+      const eventFile = path.join(cwd, 'event.json')
+      const values = { ...env, GITHUB_EVENT_NAME: 'pull_request', GITHUB_EVENT_PATH: eventFile, PR_NUMBER: '7', PR_HEAD_SHA: sha }
+      const event = { number: 7, pull_request: { head: { sha, repo: { full_name: env.GITHUB_REPOSITORY } }, base: { repo: { full_name: env.GITHUB_REPOSITORY } } } }
+      await writeFile(eventFile, JSON.stringify(event))
+      const context = await prContext('web', values, cwd, { readHead: () => sha })
+      expect(context.worker).toBe('weapp-dev-preview')
+      expect(context.alias).toBe('pr-7')
+      expect(context.identity.deploymentId).toMatch(/^[a-f\d]{64}$/)
+      await expect(prContext('web', values, cwd, { readHead: () => 'd'.repeat(40) })).rejects.toThrow(/merge commits cannot be labelled/)
+      await expect(prContext('web', { ...values, PR_HEAD_SHA: 'c'.repeat(40) }, cwd)).rejects.toThrow(/trusted event/)
+      event.pull_request.head.repo.full_name = 'fork/repo'
+      await writeFile(eventFile, JSON.stringify(event))
+      await expect(prContext('web', values, cwd)).rejects.toThrow(/trusted event/)
+    }
+    finally {
+      await rm(cwd, { recursive: true, force: true })
+    }
+  })
+})
+
+describe('Cloudflare provider', () => {
+  it('only treats an explicit missing Worker as absent', async () => {
+    const values = { CLOUDFLARE_API_TOKEN: 'redacted', CLOUDFLARE_ACCOUNT_ID: 'a'.repeat(32) }
+    const missing = cloudflareClient(values, async () => new Response(JSON.stringify({ success: false, errors: [{ code: 10007 }] }), { status: 404 }))
+    expect(await missing('scripts/new/deployments', true)).toBeUndefined()
+    const denied = cloudflareClient(values, async () => new Response('{}', { status: 403 }))
+    await expect(denied('scripts/new/deployments', true)).rejects.toThrow(/HTTP 403/)
+  })
+
+  it('rejects split traffic rather than guessing the deployed version', async () => {
+    await expect(activeVersion(async () => ({ deployments: [{ created_on: '2026-10-23', versions: [{ version_id: version, percentage: 50 }] }] }), 'worker')).rejects.toThrow(/100%/)
+  })
+
+  it('requires structured output for the intended Worker and environment', () => {
+    const entry = { type: 'deploy', worker_name: 'weapp-dev', version_id: version }
+    expect(readWranglerOutput(JSON.stringify(entry), 'weapp-dev', 'deploy').version_id).toBe(version)
+    expect(() => readWranglerOutput(JSON.stringify({ ...entry, worker_name: 'other' }), 'weapp-dev', 'deploy')).toThrow()
+    expect(() => readWranglerOutput(JSON.stringify({ ...entry, wrangler_environment: 'other' }), 'weapp-dev', 'deploy')).toThrow()
+  })
+
+  it('rejects a configuration that could deploy an unrelated artifact or production route', async () => fixture('web', async (context) => {
+    await writeFile(context.config, JSON.stringify({ name: context.worker, assets: { directory: '../other/dist' } }))
+    await expect(verifyWorkerTarget(context)).rejects.toThrow(/validated site artifact/)
+    await writeFile(context.config, JSON.stringify({ name: context.worker, assets: { directory: './dist' }, workers_dev: true, preview_urls: true, routes: [{ pattern: 'weapp.dev' }] }))
+    await expect(verifyWorkerTarget({ ...context, channel: 'pr' })).rejects.toThrow(/without production routes/)
+  }))
+
+  it('reconciles an already active deployment without running Wrangler', async () => fixture('web', async (context) => {
+    const client = vi.fn(async endpoint => endpoint.endsWith('/deployments')
+      ? { deployments: [{ created_on: '2026-10-23', versions: [{ version_id: version, percentage: 100 }] }] }
+      : { id: version, annotations: { 'workers/message': deploymentMessage(context.identity) } })
+    const execute = vi.fn()
+    expect(await deployCloudflare(context, { client, run: execute })).toEqual({ versionId: version, url: 'https://weapp.dev' })
+    expect(execute).not.toHaveBeenCalled()
+    expect(JSON.parse(await readFile(context.env.REPO_DOCS_RESULT_FILE, 'utf8')).versionId).toBe(version)
+  }))
+
+  it('does not record an uploaded version until the API confirms it active', async () => fixture('web', async (context) => {
+    const client = async endpoint => endpoint.endsWith('/deployments')
+      ? { deployments: [{ created_on: '2026-10-23', versions: [{ version_id: oldVersion, percentage: 100 }] }] }
+      : { id: oldVersion, annotations: { 'workers/message': 'old' } }
+    const execute = vi.fn(async (_command, args, options) => {
+      expect(args).toContain('deploy')
+      await writeFile(options.env.WRANGLER_OUTPUT_FILE_PATH, JSON.stringify({ type: 'deploy', worker_name: context.worker, version_id: version }))
+    })
+    await expect(deployCloudflare(context, { client, run: execute })).rejects.toThrow(/exact version/)
+    await expect(readFile(context.env.REPO_DOCS_RESULT_FILE)).rejects.toMatchObject({ code: 'ENOENT' })
+  }))
+
+  it('uploads PR versions without changing active traffic', async () => prFixture(async (context) => {
+    const client = async endpoint => endpoint.endsWith('/deployments')
+      ? { deployments: [{ created_on: '2026-10-23', versions: [{ version_id: oldVersion, percentage: 100 }] }] }
+      : endpoint.endsWith(version)
+        ? { id: version, annotations: { 'workers/message': deploymentMessage(context.identity), 'workers/alias': context.alias } }
+        : { id: oldVersion, annotations: { 'workers/message': 'existing main preview' } }
+    const execute = vi.fn(async (_command, args, options) => {
+      expect(args.slice(4, 8)).toEqual(['versions', 'upload', '--preview-alias', 'pr-7'])
+      await writeFile(options.env.WRANGLER_OUTPUT_FILE_PATH, JSON.stringify({ type: 'version-upload', worker_name: context.worker, version_id: version, preview_url: 'https://11111111-weapp-dev-preview.account.workers.dev', preview_alias_url: 'https://pr-7-weapp-dev-preview.account.workers.dev' }))
+    })
+    const result = await uploadPrPreview(context, { client, run: execute })
+    expect(result.versionId).toBe(version)
+    expect(result.url).toBe('https://11111111-weapp-dev-preview.account.workers.dev')
+    await expect(readFile(context.env.REPO_DOCS_RESULT_FILE)).rejects.toMatchObject({ code: 'ENOENT' })
+  }))
+
+  it('requires managed initialization without deploying a missing preview Worker from a PR', async () => prFixture(async (context) => {
+    const execute = vi.fn()
+    await expect(uploadPrPreview(context, { client: async () => undefined, run: execute })).rejects.toThrow(/not initialized/)
+    expect(execute).not.toHaveBeenCalled()
+  }))
+
+  it.each([false, true])('allows concurrent main preview changes but rejects PR traffic activation (%s)', async activePr => prFixture(async (context) => {
+    const nextMainVersion = '33333333-3333-4333-8333-333333333333'
+    let reads = 0
+    const client = async (endpoint) => {
+      if (endpoint.endsWith('/deployments')) {
+        const id = reads++ === 0 ? oldVersion : activePr ? version : nextMainVersion
+        return { deployments: [{ created_on: '2026-10-23', versions: [{ version_id: id, percentage: 100 }] }] }
+      }
+      const id = endpoint.split('/').at(-1)
+      return { id, annotations: { 'workers/message': id === version ? deploymentMessage(context.identity) : 'main preview', 'workers/alias': context.alias } }
+    }
+    const execute = async (_command, _args, options) => {
+      await writeFile(options.env.WRANGLER_OUTPUT_FILE_PATH, JSON.stringify({ type: 'version-upload', worker_name: context.worker, version_id: version, preview_url: 'https://11111111-weapp-dev-preview.account.workers.dev', preview_alias_url: 'https://pr-7-weapp-dev-preview.account.workers.dev' }))
+    }
+    const result = uploadPrPreview(context, { client, run: execute })
+    if (activePr) {
+      await expect(result).rejects.toThrow(/unexpectedly received active Worker traffic/)
+    }
+    else {
+      await expect(result).resolves.toMatchObject({ versionId: version })
+    }
+  }))
+
+  it.each([
+    'https://pr-7-weapp-dev-preview.account.workers.dev',
+    'https://22222222-weapp-dev-preview.account.workers.dev',
+    'https://11111111-other-worker.account.workers.dev',
+  ])('rejects a preview URL that does not identify the verified PR version: %s', async previewUrl => prFixture(async (context) => {
+    const client = async endpoint => endpoint.endsWith('/deployments')
+      ? { deployments: [{ created_on: '2026-10-23', versions: [{ version_id: oldVersion, percentage: 100 }] }] }
+      : endpoint.endsWith(version)
+        ? { id: version, annotations: { 'workers/message': deploymentMessage(context.identity), 'workers/alias': context.alias } }
+        : { id: oldVersion, annotations: { 'workers/message': 'main preview' } }
+    const execute = async (_command, _args, options) => {
+      await writeFile(options.env.WRANGLER_OUTPUT_FILE_PATH, JSON.stringify({ type: 'version-upload', worker_name: context.worker, version_id: version, preview_url: previewUrl }))
+    }
+    await expect(uploadPrPreview(context, { client, run: execute })).rejects.toThrow(/invalid preview URL/)
+  }))
+})
+
+describe('Pages provider', () => {
+  it('uploads a tar, persists its request, confirms Pages and checks the served identity', async () => fixture('open-source', async (context) => {
+    const store = receiptStore()
+    const client = vi.fn(async (endpoint, options) => {
+      if (options?.method === 'POST') {
+        expect(store.current().phase).toBe('submitting')
+        expect(options.body).toEqual({ artifact_id: 42, environment: 'docs-open-source-stable', pages_build_version: identity, oidc_token: 'secret-token' })
+        return { id: 'pages-123', page_url: 'https://weapp.js.org/' }
+      }
+      expect(endpoint).toBe('pages/deployments/pages-123')
+      return { status: 'succeed' }
+    })
+    const artifact = { uploadArtifact: vi.fn(async (_name, files, root) => {
+      expect(files).toEqual([path.join(root, 'artifact.tar')])
+      return { id: 42 }
+    }) }
+    const execute = vi.fn(async (_command, args) => {
+      expect(args).toContain(context.dist)
+    })
+    const result = await deployPages(context, { store, client, artifact, run: execute, getIDToken: async () => 'secret-token', fetch: async () => Response.json(context.identity) })
+    expect(result).toEqual({ versionId: 'pages-123', url: 'https://weapp.js.org' })
+    expect(store.current().phase).toBe('complete')
+    expect(artifact.uploadArtifact).toHaveBeenCalledOnce()
+  }))
+
+  it('resumes the recorded provider deployment without re-upload or a second POST', async () => fixture('open-source', async (context) => {
+    const store = receiptStore({ schemaVersion: 1, deploymentId: identity, phase: 'created', pagesId: 'previous-id' })
+    const client = vi.fn(async () => ({ status: 'succeed' }))
+    const artifact = { uploadArtifact: vi.fn() }
+    const result = await deployPages(context, { store, client, artifact, fetch: async () => Response.json(context.identity) })
+    expect(result.versionId).toBe('previous-id')
+    expect(client).toHaveBeenCalledExactlyOnceWith('pages/deployments/previous-id')
+    expect(artifact.uploadArtifact).not.toHaveBeenCalled()
+  }))
+
+  it('retries a definite Pages rejection while preserving the failed attempt', async () => fixture('open-source', async (context) => {
+    const store = receiptStore()
+    const rejection = Object.assign(new Error('GitHub request failed (HTTP 403).'), { method: 'POST', status: 403 })
+    const client = vi.fn()
+      .mockRejectedValueOnce(rejection)
+      .mockResolvedValueOnce({ id: 'retry-id', page_url: 'https://weapp.js.org/' })
+      .mockResolvedValueOnce({ status: 'succeed' })
+    const names = new Set()
+    const artifact = { uploadArtifact: vi.fn(async (name) => {
+      if (names.has(name)) {
+        throw new Error('Artifact names cannot be reused within a workflow run')
+      }
+      names.add(name)
+      return { id: 42 }
+    }) }
+    const options = { store, client, artifact, run: async () => {}, getIDToken: async () => 'secret-token', fetch: async () => Response.json(context.identity) }
+    await expect(deployPages(context, options)).rejects.toThrow(/HTTP 403/)
+    expect(store.current()).toMatchObject({ phase: 'failed', rejectedStatus: 403 })
+    await expect(deployPages(context, options)).resolves.toMatchObject({ versionId: 'retry-id' })
+    expect(store.current().previousAttempts).toEqual([{ artifactId: 42, phase: 'failed' }])
+    expect(artifact.uploadArtifact).toHaveBeenCalledTimes(2)
+    expect(names.size).toBe(2)
+  }))
+
+  it.each([409, 500, undefined])('keeps an uncertain Pages creation pending after HTTP %s or a lost response', async status => fixture('open-source', async (context) => {
+    const store = receiptStore()
+    const error = Object.assign(new Error('provider request uncertain'), { method: 'POST', status })
+    const client = vi.fn(async () => {
+      throw error
+    })
+    const artifact = { uploadArtifact: vi.fn(async () => ({ id: 42 })) }
+    const options = { store, client, artifact, run: async () => {}, getIDToken: async () => 'secret-token', fetch: async () => new Response('', { status: 404 }), pollLimit: 1, sleep: async () => {} }
+    await expect(deployPages(context, options)).rejects.toThrow(/provider request uncertain/)
+    expect(store.current().phase).toBe('submitting')
+    await expect(deployPages(context, options)).rejects.toThrow(/unknown outcome/)
+    expect(client).toHaveBeenCalledOnce()
+    expect(artifact.uploadArtifact).toHaveBeenCalledOnce()
+  }))
+
+  it('leaves an unknown POST outcome pending and never submits again', async () => fixture('open-source', async (context) => {
+    const store = receiptStore({ schemaVersion: 1, deploymentId: identity, phase: 'submitting', artifactId: 42 })
+    const client = vi.fn()
+    const artifact = { uploadArtifact: vi.fn() }
+    await expect(deployPages(context, { store, client, artifact, fetch: async () => new Response('', { status: 404 }), pollLimit: 1, sleep: async () => {} })).rejects.toThrow(/unknown outcome/)
+    expect(client).not.toHaveBeenCalled()
+    expect(artifact.uploadArtifact).not.toHaveBeenCalled()
+    expect(store.current().phase).toBe('submitting')
+  }))
+
+  it('recovers a lost POST response only when the exact identity is publicly served', async () => fixture('open-source', async (context) => {
+    const store = receiptStore({ schemaVersion: 1, deploymentId: identity, phase: 'submitting', artifactId: 42 })
+    const client = vi.fn()
+    expect((await deployPages(context, { store, client, fetch: async () => Response.json(context.identity) })).versionId).toBe(identity)
+    expect(client).not.toHaveBeenCalled()
+    expect(store.current().phase).toBe('complete')
+  }))
+
+  it('does not mistake successful Pages status for the expected public artifact', async () => fixture('open-source', async (context) => {
+    const store = receiptStore({ schemaVersion: 1, deploymentId: identity, phase: 'created', pagesId: 'previous-id' })
+    await expect(deployPages(context, { store, client: async () => ({ status: 'succeed' }), fetch: async () => Response.json({ ...context.identity, sourceSha: 'c'.repeat(40) }), pollLimit: 1, sleep: async () => {} })).rejects.toThrow(/does not match/)
+    expect(store.current().phase).toBe('created')
+    await expect(readFile(context.env.REPO_DOCS_RESULT_FILE)).rejects.toMatchObject({ code: 'ENOENT' })
+  }))
+
+  it('distinguishes terminal failures from timeouts', async () => {
+    await expect(waitForPages(async () => ({ status: 'deployment_failed' }), 'id')).rejects.toMatchObject({ deploymentFailed: true })
+    await expect(waitForPages(async () => ({ status: 'deployment_in_progress' }), 'id', { pollLimit: 1, sleep: async () => {} })).rejects.toThrow(/Timed out/)
+  })
+
+  it('uses a revision compare-and-swap for receipts and fails closed on state access errors', async () => {
+    const value = { schemaVersion: 1, deploymentId: identity, phase: 'created', pagesId: 'pages-1' }
+    const client = vi.fn(async (_endpoint, options) => options?.method === 'PUT'
+      ? { content: { sha: 'next-revision' } }
+      : { sha: 'previous-revision', encoding: 'base64', content: Buffer.from(JSON.stringify(value)).toString('base64') })
+    const store = pagesReceiptStore(client, identity)
+    expect(await store.read()).toEqual({ value, revision: 'previous-revision' })
+    expect(await store.write(value, 'previous-revision')).toBe('next-revision')
+    expect(client.mock.calls.at(-1)[1].body.sha).toBe('previous-revision')
+    expect(client.mock.calls.at(-1)[1].body.branch).toBe('repoctl-release-state')
+    const denied = pagesReceiptStore(async () => {
+      throw new Error('permission denied')
+    }, identity)
+    await expect(denied.read()).rejects.toThrow(/permission denied/)
+  })
+
+  it('recovers the revision when a Pages receipt write commits but its response is lost', async () => {
+    const value = { schemaVersion: 1, deploymentId: identity, phase: 'submitting', artifactId: 42 }
+    let persisted
+    const client = vi.fn(async (_endpoint, options) => {
+      if (options?.method === 'PUT') {
+        persisted = options.body.content
+        throw new Error('lost write response')
+      }
+      return { sha: 'committed-revision', encoding: 'base64', content: persisted }
+    })
+    expect(await pagesReceiptStore(client, identity).write(value, undefined)).toBe('committed-revision')
+    expect(client).toHaveBeenCalledTimes(2)
+    expect(client.mock.calls[1][0]).toContain('?ref=repoctl-release-state')
+  })
+
+  it.each(['different', 'unreadable'])('does not overwrite or accept %s receipt state after a write failure', async (outcome) => {
+    const value = { schemaVersion: 1, deploymentId: identity, phase: 'submitting', artifactId: 42 }
+    const client = vi.fn(async (_endpoint, options) => {
+      if (options?.method === 'PUT') {
+        throw new Error('receipt write conflict')
+      }
+      if (outcome === 'unreadable') {
+        throw new Error('read failed')
+      }
+      return { sha: 'other-revision', encoding: 'base64', content: Buffer.from(`${JSON.stringify({ ...value, artifactId: 43 })}\n`).toString('base64') }
+    })
+    await expect(pagesReceiptStore(client, identity).write(value, 'old-revision')).rejects.toThrow(/receipt write conflict/)
+    expect(client.mock.calls.filter(([, options]) => options?.method === 'PUT')).toHaveLength(1)
+  })
+})
+
+describe('deployment diagnostics', () => {
+  it('redacts environment credentials, bearer tokens and runtime JWTs', () => {
+    expect(sanitizeMessage('error cf-secret ghp_abc123 Bearer unknown eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.signature', { CLOUDFLARE_API_TOKEN: 'cf-secret' }))
+      .toBe('error [REDACTED] [REDACTED TOKEN] Bearer [REDACTED] [REDACTED JWT]')
+  })
+
+  it('writes validated success and failure records in the original workspace without provider internals', async () => fixture('web', async (context) => {
+    const values = { GITHUB_WORKSPACE: path.join(context.cwd, 'original'), GITHUB_TOKEN: 'sensitive-token' }
+    const result = { versionId: version, url: 'https://weapp.dev', response: { token: 'sensitive-token' } }
+    const file = await writeDiagnostic({ context, result, phase: 'complete', env: values, cwd: '/isolated-checkout' })
+    expect(file).toBe(path.join(values.GITHUB_WORKSPACE, '.cache/docs-deployment/web-stable.json'))
+    expect(JSON.parse(await readFile(file, 'utf8'))).toEqual({ schemaVersion: 1, site: 'web', channel: 'stable', phase: 'complete', status: 'success', identity: context.identity, result: { versionId: version, url: 'https://weapp.dev' } })
+    await writeDiagnostic({ context, phase: 'provider', error: new Error('provider sensitive-token Bearer temporary-token'), env: values })
+    expect(JSON.parse(await readFile(file, 'utf8'))).toMatchObject({ status: 'failed', phase: 'provider', message: 'provider [REDACTED] Bearer [REDACTED]' })
+    const invalidFile = await writeDiagnostic({ site: '../../outside', channel: '../invalid', phase: 'context', error: new Error('invalid context'), env: values })
+    expect(invalidFile).toBe(path.join(values.GITHUB_WORKSPACE, '.cache/docs-deployment/unknown-unknown.json'))
+    expect(JSON.parse(await readFile(invalidFile, 'utf8')).identity).toBeUndefined()
+  }))
+})
diff --git a/scripts/docs-deployment/diagnostics.mjs b/scripts/docs-deployment/diagnostics.mjs
new file mode 100644
index 00000000..c7ce57f3
--- /dev/null
+++ b/scripts/docs-deployment/diagnostics.mjs
@@ -0,0 +1,42 @@
+import { mkdir, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import process from 'node:process'
+import { sites } from './context.mjs'
+
+export function sanitizeMessage(value, env = process.env) {
+  let message = String(value)
+  const secrets = Object.entries(env)
+    .filter(([key, secret]) => /token|secret|password|private.?key|authorization|credential|access.?key|api.?key/i.test(key) && typeof secret === 'string' && secret.length >= 4)
+    .map(([, secret]) => secret)
+    .sort((left, right) => right.length - left.length)
+  for (const secret of secrets) {
+    message = message.replaceAll(secret, '[REDACTED]')
+  }
+  return message
+    .replace(/\beyJ[\w-]+\.[\w-]+\.[\w-]+\b/g, '[REDACTED JWT]')
+    .replace(/\b(?:gh[pousr]_\w+|github_pat_\w+)\b/g, '[REDACTED TOKEN]')
+    .replace(/\bBearer\s+[^\s,;]+/gi, 'Bearer [REDACTED]')
+}
+
+export async function writeDiagnostic({ context, site, channel, result, error, phase, env = process.env, cwd = process.cwd() }) {
+  const safeSite = Object.hasOwn(sites, context?.site ?? site ?? '') ? (context?.site ?? site) : 'unknown'
+  const safeChannel = ['preview', 'stable', 'pr'].includes(context?.channel ?? channel) ? (context?.channel ?? channel) : 'unknown'
+  const directory = path.join(env.GITHUB_WORKSPACE || cwd, '.cache/docs-deployment')
+  const file = path.join(directory, `${safeSite}-${safeChannel}.json`)
+  const diagnostic = {
+    schemaVersion: 1,
+    site: safeSite,
+    channel: safeChannel,
+    phase,
+    status: error ? 'failed' : 'success',
+    ...(context && { identity: Object.fromEntries(['schemaVersion', 'site', 'channel', 'sourceSha', 'releaseId', 'deploymentId']
+      .map(key => [key, typeof context.identity[key] === 'string' ? sanitizeMessage(context.identity[key], env) : context.identity[key]])) }),
+    ...(result && { result: { url: sanitizeMessage(result.url, env), versionId: sanitizeMessage(result.versionId, env) } }),
+    ...(error && { message: sanitizeMessage(error.message ?? error, env).slice(0, 4000) }),
+  }
+  await mkdir(directory, { recursive: true })
+  // Serialize only explicitly selected fields; never persist the environment,
+  // provider request/response bodies, error objects or stack traces.
+  await writeFile(file, `${JSON.stringify(diagnostic)}\n`)
+  return file
+}
diff --git a/scripts/docs-deployment/github.mjs b/scripts/docs-deployment/github.mjs
new file mode 100644
index 00000000..44252675
--- /dev/null
+++ b/scripts/docs-deployment/github.mjs
@@ -0,0 +1,92 @@
+import { Buffer } from 'node:buffer'
+
+const stateBranch = 'repoctl-release-state'
+
+export function githubClient(env, request = fetch) {
+  const token = env.GITHUB_TOKEN
+  if (!token || env.GITHUB_REPOSITORY !== 'weappjs/weapp.dev') {
+    throw new Error('GitHub deployment credentials are missing.')
+  }
+  return async (endpoint, options = {}) => {
+    const response = await request(`https://api.github.com/repos/${env.GITHUB_REPOSITORY}/${endpoint}`, {
+      method: options.method || 'GET',
+      headers: {
+        'Authorization': `Bearer ${token}`,
+        'Accept': 'application/vnd.github+json',
+        'X-GitHub-Api-Version': '2026-03-10',
+        ...(options.body ? { 'Content-Type': 'application/json' } : {}),
+      },
+      ...(options.body ? { body: JSON.stringify(options.body) } : {}),
+      signal: AbortSignal.timeout(30000),
+    })
+    if (options.allowMissing && response.status === 404) {
+      return undefined
+    }
+    if (!response.ok) {
+      const error = new Error(`GitHub ${options.method || 'GET'} ${endpoint.split('?')[0]} failed (HTTP ${response.status}).`)
+      error.status = response.status
+      error.method = options.method || 'GET'
+      throw error
+    }
+    return response.status === 204 ? undefined : response.json()
+  }
+}
+
+/** Provider receipts are separate files; never replace repoctl's own state documents. */
+export function pagesReceiptStore(client, deploymentId) {
+  if (!/^[a-f\d]{64}$/.test(deploymentId)) {
+    throw new Error('Invalid receipt identity.')
+  }
+  const endpoint = `contents/provider-receipts/pages/${deploymentId}.json`
+  return {
+    async read() {
+      // A missing state branch or denied access must not masquerade as a new deployment.
+      await client(`git/ref/heads/${stateBranch}`)
+      const file = await client(`${endpoint}?ref=${stateBranch}`, { allowMissing: true })
+      if (!file) {
+        return { value: undefined, revision: undefined }
+      }
+      if (file.encoding !== 'base64' || !file.sha) {
+        throw new Error('Invalid Pages receipt response.')
+      }
+      const value = JSON.parse(Buffer.from(file.content, 'base64').toString('utf8'))
+      if (value.schemaVersion !== 1 || value.deploymentId !== deploymentId
+        || !['submitting', 'created', 'complete', 'failed'].includes(value.phase)) {
+        throw new Error('Invalid Pages deployment receipt.')
+      }
+      return { value, revision: file.sha }
+    },
+    async write(value, revision) {
+      const content = `${JSON.stringify(value)}\n`
+      try {
+        const result = await client(endpoint, {
+          method: 'PUT',
+          body: {
+            message: `docs: record Pages deployment ${deploymentId.slice(0, 12)}`,
+            branch: stateBranch,
+            content: Buffer.from(content).toString('base64'),
+            ...(revision ? { sha: revision } : {}),
+          },
+        })
+        if (!result?.content?.sha) {
+          throw new Error('GitHub did not confirm the Pages receipt revision.')
+        }
+        return result.content.sha
+      }
+      catch (error) {
+        // A committed PUT with a lost response must not strand the caller
+        // before it has even submitted Pages. Reconcile the exact bytes only;
+        // a concurrent revision or unreadable state must still fail closed.
+        try {
+          const file = await client(`${endpoint}?ref=${stateBranch}`, { allowMissing: true })
+          if (file?.encoding === 'base64' && file.sha
+            && Buffer.from(file.content, 'base64').toString('utf8') === content) {
+            return file.sha
+          }
+        }
+        catch {}
+        throw error
+      }
+    },
+  }
+}
diff --git a/scripts/docs-deployment/pages.mjs b/scripts/docs-deployment/pages.mjs
new file mode 100644
index 00000000..8bcfb37d
--- /dev/null
+++ b/scripts/docs-deployment/pages.mjs
@@ -0,0 +1,177 @@
+import { randomUUID } from 'node:crypto'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import { assertIdentity, identityFilename, pause, run, verifyArtifact, writeResult } from './context.mjs'
+import { githubClient, pagesReceiptStore } from './github.mjs'
+
+const failedStatuses = new Set(['deployment_cancelled', 'deployment_failed', 'deployment_content_failed', 'deployment_lost'])
+
+export async function publicIdentityMatches(context, request = fetch) {
+  const url = new URL(identityFilename, `${context.url}/`)
+  url.searchParams.set('deployment', context.identity.deploymentId)
+  url.searchParams.set('check', Date.now().toString())
+  const response = await request(url, { cache: 'no-store', redirect: 'error', signal: AbortSignal.timeout(30000) })
+  if (response.status === 404) {
+    return false
+  }
+  if (!response.ok) {
+    throw new Error(`Public deployment verification failed (HTTP ${response.status}).`)
+  }
+  let value
+  try {
+    value = await response.json()
+  }
+  catch {
+    return false
+  }
+  try {
+    assertIdentity(value, context.identity)
+    return true
+  }
+  catch {
+    return false
+  }
+}
+
+export async function waitForPages(client, id, options = {}) {
+  const wait = options.sleep ?? pause
+  for (let attempt = 0; attempt < (options.pollLimit ?? 60); attempt++) {
+    const result = await client(`pages/deployments/${encodeURIComponent(id)}`)
+    if (result?.status === 'succeed') {
+      return
+    }
+    if (failedStatuses.has(result?.status)) {
+      const error = new Error(`GitHub Pages deployment ended with ${result.status}.`)
+      error.deploymentFailed = true
+      throw error
+    }
+    if (!['deployment_in_progress', 'syncing_files', 'finished_file_sync', 'updating_pages', 'purging_cdn', 'deployment_attempt_error'].includes(result?.status)) {
+      throw new Error('GitHub Pages returned an unknown deployment status; keep this deployment pending.')
+    }
+    await wait(10000)
+  }
+  throw new Error('Timed out confirming the Pages deployment; retry the same deployment identity.')
+}
+
+async function waitForPublicIdentity(context, options) {
+  for (let attempt = 0; attempt < (options.pollLimit ?? 60); attempt++) {
+    if (await publicIdentityMatches(context, options.fetch)) {
+      return true
+    }
+    await (options.sleep ?? pause)(10000)
+  }
+  return false
+}
+
+async function uploadArtifact(context, options) {
+  const temporary = await mkdtemp(path.join(tmpdir(), 'weapp-pages-'))
+  try {
+    const tar = path.join(temporary, 'artifact.tar')
+    await (options.run ?? run)('tar', ['--dereference', '--hard-dereference', '--directory', context.dist, '-cf', tar, '--exclude=.git', '--exclude=.github', '--exclude=.[^/]*', '.'], { env: context.env })
+    const artifact = options.artifact ?? new (await import('@actions/artifact')).DefaultArtifactClient()
+    // Artifact v2+ names are unique within a workflow run, including retries
+    // after a definite Pages rejection or an OIDC failure before submission.
+    const name = `pages-${context.site}-${context.identity.deploymentId.slice(0, 12)}-${context.env.GITHUB_RUN_ID}-${context.env.GITHUB_RUN_ATTEMPT || '1'}-${randomUUID()}`
+    const uploaded = await artifact.uploadArtifact(name, [tar], temporary, { retentionDays: 14 })
+    if (!Number.isSafeInteger(uploaded.id) || uploaded.id < 1) {
+      throw new Error('Artifact service did not return an artifact ID.')
+    }
+    return uploaded.id
+  }
+  finally {
+    await rm(temporary, { recursive: true, force: true })
+  }
+}
+
+/** All remote writes stay inside the single repo docs execution and its concurrency lock. */
+export async function deployPages(context, options = {}) {
+  if (context.site !== 'open-source' || context.channel !== 'stable' || context.url !== 'https://weapp.js.org') {
+    throw new Error('GitHub Pages only hosts the open-source stable site.')
+  }
+  await verifyArtifact(context)
+  const client = options.client ?? githubClient(context.env, options.fetch)
+  const store = options.store ?? pagesReceiptStore(client, context.identity.deploymentId)
+  let { value: receipt, revision } = await store.read()
+  const save = async (value) => {
+    revision = await store.write(value, revision)
+    receipt = value
+  }
+  const finish = async (versionId) => {
+    await save({ ...receipt, phase: 'complete', versionId })
+    return writeResult(context, { versionId, url: context.url })
+  }
+
+  if (receipt && !['failed'].includes(receipt.phase)) {
+    if (receipt.pagesId) {
+      try {
+        await waitForPages(client, receipt.pagesId, options)
+      }
+      catch (error) {
+        if (error.deploymentFailed) {
+          await save({ ...receipt, phase: 'failed' })
+        }
+        throw error
+      }
+      if (!await waitForPublicIdentity(context, options)) {
+        throw new Error('Pages reports success but the public deployment identity does not match.')
+      }
+      return finish(String(receipt.pagesId))
+    }
+    // A lost POST response is ambiguous. Serving the exact identity proves that
+    // the requested build reached Pages; otherwise never issue a second POST.
+    if (await waitForPublicIdentity(context, options)) {
+      return finish(context.identity.deploymentId)
+    }
+    throw new Error('The previous Pages request has an unknown outcome. Inspect the provider receipt; no replacement deployment was submitted.')
+  }
+
+  const artifactId = await uploadArtifact(context, options)
+  const idToken = await (options.getIDToken ?? (await import('@actions/core')).getIDToken)()
+  const previousAttempts = receipt
+    ? [...(receipt.previousAttempts ?? []), {
+        artifactId: receipt.artifactId,
+        pagesId: receipt.pagesId,
+        phase: receipt.phase,
+      }]
+    : []
+  await save({ schemaVersion: 1, deploymentId: context.identity.deploymentId, phase: 'submitting', artifactId, runId: context.env.GITHUB_RUN_ID, previousAttempts })
+  let deployment
+  try {
+    deployment = await client('pages/deployments', {
+      method: 'POST',
+      body: {
+        artifact_id: artifactId,
+        environment: 'docs-open-source-stable',
+        pages_build_version: context.identity.deploymentId,
+        oidc_token: idToken,
+      },
+    })
+  }
+  catch (error) {
+    // A definite rejection can be retried. Conflict, server errors and lost
+    // responses may have created a deployment, so retain the submitting state.
+    if (error.method === 'POST' && [400, 401, 403, 404, 422].includes(error.status)) {
+      await save({ ...receipt, phase: 'failed', rejectedStatus: error.status })
+    }
+    throw error
+  }
+  if (!['string', 'number'].includes(typeof deployment?.id) || !String(deployment.id).trim()
+    || new URL(deployment.page_url).hostname !== 'weapp.js.org') {
+    throw new Error('Pages returned an invalid deployment response; its request remains pending.')
+  }
+  await save({ ...receipt, phase: 'created', pagesId: String(deployment.id) })
+  try {
+    await waitForPages(client, receipt.pagesId, options)
+  }
+  catch (error) {
+    if (error.deploymentFailed) {
+      await save({ ...receipt, phase: 'failed' })
+    }
+    throw error
+  }
+  if (!await waitForPublicIdentity(context, options)) {
+    throw new Error('Pages deployment is not yet serving the expected identity; retry the same deployment.')
+  }
+  return finish(receipt.pagesId)
+}
diff --git a/scripts/install-hooks.mjs b/scripts/install-hooks.mjs
new file mode 100644
index 00000000..bfacc522
--- /dev/null
+++ b/scripts/install-hooks.mjs
@@ -0,0 +1,40 @@
+import { spawnSync } from 'node:child_process'
+import { existsSync, realpathSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+
+/** Git hooks belong to developer checkouts, never release source archives. */
+export function installHooks({ cwd = process.cwd(), env = process.env, execute = spawnSync, log = console.log } = {}) {
+  if (env.LEFTHOOK === '0' || /^(?:1|true)$/i.test(env.CI ?? '')) {
+    log('Skipping Git hooks in CI or with LEFTHOOK=0.')
+    return 'disabled'
+  }
+  const root = realpathSync(cwd)
+  // A source archive can live under another checkout; Git discovery alone would
+  // install hooks into that parent repository. Worktree .git files are valid.
+  if (!existsSync(path.join(root, '.git'))) {
+    log('Skipping Git hooks outside a Git checkout.')
+    return 'archive'
+  }
+  const git = execute('git', ['rev-parse', '--show-toplevel'], { cwd: root, env, encoding: 'utf8' })
+  if (git.error || git.status !== 0) {
+    throw new Error('Cannot inspect the developer Git checkout.', { cause: git.error })
+  }
+  if (realpathSync(git.stdout.trim()) !== root) {
+    throw new Error('Refusing to install hooks into a different Git checkout.')
+  }
+  // Execute the package's Node entry directly, including on Windows where the
+  // package-manager bin shim is a .cmd file rather than a native executable.
+  const lefthook = createRequire(import.meta.url).resolve('lefthook')
+  const result = execute(process.execPath, [lefthook, 'install'], { cwd: root, env, stdio: 'inherit' })
+  if (result.error || result.status !== 0) {
+    throw new Error(`Lefthook installation failed (${result.status ?? result.signal ?? 'spawn error'}).`, { cause: result.error })
+  }
+  return 'installed'
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  installHooks()
+}
diff --git a/scripts/install-hooks.test.mjs b/scripts/install-hooks.test.mjs
new file mode 100644
index 00000000..f02db993
--- /dev/null
+++ b/scripts/install-hooks.test.mjs
@@ -0,0 +1,57 @@
+import { strict as assert } from 'node:assert'
+import { mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises'
+import { createRequire } from 'node:module'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+import { it } from 'vitest'
+import { installHooks } from './install-hooks.mjs'
+
+async function fixture(run) {
+  const cwd = await realpath(await mkdtemp(path.join(tmpdir(), 'weapp-hooks-')))
+  try {
+    await run(cwd)
+  }
+  finally {
+    await rm(cwd, { recursive: true, force: true })
+  }
+}
+
+it('does not inspect Git or install hooks in CI or when disabled', () => {
+  for (const env of [{ CI: 'true' }, { CI: '1' }, { LEFTHOOK: '0' }]) {
+    assert.equal(installHooks({ cwd: '/missing/archive', env, execute: () => assert.fail('No commands expected'), log: () => {} }), 'disabled')
+  }
+})
+
+it('skips archives even when they are nested under a developer checkout', async () => {
+  await fixture(async (cwd) => {
+    await mkdir(path.join(cwd, '.git'))
+    const archive = path.join(cwd, 'archive')
+    await mkdir(archive)
+    assert.equal(installHooks({ cwd: archive, env: {}, execute: () => assert.fail('Do not discover parent Git'), log: () => {} }), 'archive')
+  })
+})
+
+it('installs in a developer worktree and preserves installation failures', async () => {
+  await fixture(async (cwd) => {
+    await writeFile(path.join(cwd, '.git'), 'gitdir: /fixture/worktree\n')
+    const calls = []
+    const execute = (command, args, options) => {
+      calls.push({ command, args, cwd: options.cwd })
+      return command === 'git' ? { status: 0, stdout: `${cwd}\n` } : { status: 0 }
+    }
+    assert.equal(installHooks({ cwd, env: { CI: 'false' }, execute }), 'installed')
+    assert.deepEqual(calls.map(({ command, args }) => [command, args]), [
+      ['git', ['rev-parse', '--show-toplevel']],
+      [process.execPath, [createRequire(import.meta.url).resolve('lefthook'), 'install']],
+    ])
+    assert.ok(calls.every(call => call.cwd === cwd))
+    assert.throws(() => installHooks({
+      cwd,
+      env: {},
+      execute: command => command === 'git' ? { status: 0, stdout: `${cwd}\n` } : { status: 1 },
+    }), /Lefthook installation failed/)
+    assert.throws(() => installHooks({ cwd, env: {}, execute: () => ({ status: 128, stdout: '' }) }), /Cannot inspect/)
+    assert.throws(() => installHooks({ cwd, env: {}, execute: () => ({ status: 0, stdout: `${path.dirname(cwd)}\n` }) }), /different Git checkout/)
+  })
+})
diff --git a/scripts/release-inputs.test.mjs b/scripts/release-inputs.test.mjs
new file mode 100644
index 00000000..fe322cb5
--- /dev/null
+++ b/scripts/release-inputs.test.mjs
@@ -0,0 +1,86 @@
+import { strict as assert } from 'node:assert'
+import { readdirSync, readFileSync, realpathSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { loadMonorepoConfig } from 'repoctl'
+import ts from 'typescript'
+import { it } from 'vitest'
+
+const repository = path.resolve(fileURLToPath(new URL('..', import.meta.url)))
+
+// Follow actual build imports, including private workspace exports. A new
+// transitive helper must not silently escape the released-source coverage.
+function buildSources() {
+  const pending = [
+    'packages/weapp/scripts/build.ts',
+    'packages/weapp/tsdown.config.ts',
+    'packages/weapp/src/cli.ts',
+    'packages/weapp/src/index.ts',
+    'packages/weapp/src/terminal/session.ts',
+    'packages/weapp/lab/app.ts',
+  ].map(filename => path.join(repository, filename))
+  const visited = new Set()
+  while (pending.length) {
+    const filename = pending.pop()
+    if (visited.has(filename)) {
+      continue
+    }
+    visited.add(filename)
+    const source = ts.createSourceFile(filename, readFileSync(filename, 'utf8'), ts.ScriptTarget.Latest, true)
+    const visit = (node) => {
+      if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node))
+        && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)
+        && !node.isTypeOnly && !node.importClause?.isTypeOnly) {
+        const resolution = ts.resolveModuleName(node.moduleSpecifier.text, filename, {
+          moduleResolution: ts.ModuleResolutionKind.Bundler,
+          module: ts.ModuleKind.ESNext,
+        }, ts.sys).resolvedModule
+        if (resolution) {
+          const target = realpathSync(resolution.resolvedFileName)
+          if (target.startsWith(`${repository}${path.sep}`) && !target.includes(`${path.sep}node_modules${path.sep}`)
+            && !target.endsWith('.d.ts')) {
+            pending.push(target)
+          }
+        }
+      }
+      ts.forEachChild(node, visit)
+    }
+    visit(source)
+  }
+  return [...visited].map(filename => path.relative(repository, filename).split(path.sep).join('/'))
+}
+
+it('covers the CLI build import graph in every website release source check', async () => {
+  const config = await loadMonorepoConfig(repository)
+  const sources = buildSources()
+  assert.ok(sources.includes('packages/site-ui/src/lib/hero-brand.ts'))
+  assert.ok(sources.includes('packages/project-catalog/src/lib/npm.ts'))
+  for (const [site, settings] of Object.entries(config.commands.docs.sites)) {
+    const patterns = settings.releaseInputs.weapp
+    const included = patterns.filter(pattern => !pattern.startsWith('!'))
+    const excluded = patterns.filter(pattern => pattern.startsWith('!')).map(pattern => pattern.slice(1))
+    const missing = sources.filter(filename => !included.some(pattern => path.matchesGlob(filename, pattern))
+      || excluded.some(pattern => path.matchesGlob(filename, pattern)))
+    assert.deepEqual(missing, [], `${site} can otherwise deploy CLI inputs that differ from the published package source`)
+  }
+})
+
+it('requires a fresh publication when root dependency resolution or patches change', async () => {
+  const config = await loadMonorepoConfig(repository)
+  const inputs = [
+    'package.json',
+    'pnpm-lock.yaml',
+    'pnpm-workspace.yaml',
+    ...readdirSync(path.join(repository, 'patches')).map(filename => `patches/${filename}`),
+    // A new patch must be covered before it appears in an import graph.
+    'patches/new-bundled-dependency.patch',
+  ]
+  for (const [site, settings] of Object.entries(config.commands.docs.sites)) {
+    const patterns = settings.releaseInputs.weapp
+    const included = patterns.filter(pattern => !pattern.startsWith('!'))
+    const excluded = patterns.filter(pattern => pattern.startsWith('!')).map(pattern => pattern.slice(1))
+    const missing = inputs.filter(filename => !included.some(pattern => path.matchesGlob(filename, pattern))
+      || excluded.some(pattern => path.matchesGlob(filename, pattern)))
+    assert.deepEqual(missing, [], `${site} must reject dependency inputs newer than the published package source`)
+  }
+})
diff --git a/scripts/release-versioning.test.mjs b/scripts/release-versioning.test.mjs
index 5d62a192..32931896 100644
--- a/scripts/release-versioning.test.mjs
+++ b/scripts/release-versioning.test.mjs
@@ -2,12 +2,13 @@ import { strict as assert } from 'node:assert'
 import { spawn, spawnSync } from 'node:child_process'
 import { once } from 'node:events'
 import { existsSync } from 'node:fs'
-import { cp, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { cp, mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { createReleasePullRequest, resolveCommandConfig } from 'repoctl'
+import { createReleasePullRequest, createSnapshotPlan, resolveCommandConfig } from 'repoctl'
 import { it } from 'vitest'
+import { parse } from 'yaml'
 
 const repository = fileURLToPath(new URL('..', import.meta.url))
 const intentName = 'weapp-cli-toolbox'
@@ -54,7 +55,7 @@ async function json(directory, filename) {
 }
 
 async function withFixture(intent, run) {
-  const directory = await mkdtemp(path.join(tmpdir(), 'weapp-release-'))
+  const directory = await realpath(await mkdtemp(path.join(tmpdir(), 'weapp-release-')))
   const cwd = path.join(directory, 'workspace')
   const remote = path.join(directory, 'origin.git')
   const registryLog = path.join(directory, 'registry.jsonl')
@@ -249,3 +250,82 @@ it('rejects a release intent targeting an ignored private package before pushing
     await assert.rejects(readFile(path.join(cwd, '.changeset/ledger.yaml')), { code: 'ENOENT' })
   })
 }, 60000)
+
+it('plans nightly versions without consuming stable intents or changing the source repository', async () => {
+  await withFixture(`---\n"weapp": minor\n---\n\n${summary}\n`, async ({ cwd, source, options, git }) => {
+    const before = await readFile(path.join(cwd, `.changeset/${intentName}.md`), 'utf8')
+    const report = await createSnapshotPlan({
+      ...options,
+      identity: { kind: 'nightly', commit: source, buildId: 'migration-fixture' },
+      dryRun: true,
+    })
+    assert.equal(report.status, 'planned')
+    assert.equal(report.tag, 'snapshot-nightly')
+    assert.deepEqual(report.packages.map(pkg => pkg.name), ['weapp'])
+    assert.match(report.packages[0].version, /-snapshot\.nightly\./)
+    assert.equal((await json(cwd, 'packages/weapp/package.json')).version, '0.0.1')
+    assert.equal(await readFile(path.join(cwd, `.changeset/${intentName}.md`), 'utf8'), before)
+    assert.equal(git('rev-parse', 'HEAD'), source)
+    assert.equal(git('status', '--porcelain'), '')
+    assert.equal(git('for-each-ref', '--format=%(refname)', 'refs/tags'), '')
+  })
+}, 60000)
+
+it('keeps package publication and stable websites behind the managed release stages', async () => {
+  const workflow = parse(await readFile(path.join(repository, '.github/workflows/release.yml'), 'utf8'))
+  const steps = workflow.jobs.release.steps
+  const stages = steps.filter(step => step.run?.startsWith('pnpm exec repo release ci --stage')).map(step => step.run.split(' ').at(-1))
+  assert.deepEqual(stages, ['plan', 'verify', 'prepare', 'upload', 'confirm', 'finalize'])
+  for (const id of ['release-upload', 'release-confirm', 'release-finalize']) {
+    assert.match(steps.find(step => step.id === id).if, /release-prepare.outputs.publish == 'true'/)
+  }
+  assert.match(workflow.jobs.docs.if, /needs.release.outputs.release-record != ''/)
+  assert.equal(workflow.jobs.docs.with.channel, 'stable')
+  assert.match(workflow.jobs.docs.with.release, /^\$\{\{ needs\.release\.outputs\.release-record \}\}$/)
+  assert.deepEqual(workflow.on.schedule, [{ cron: '0 18 * * *' }])
+  assert.match(workflow.jobs.nightly.if, /github.event_name == 'schedule'/)
+  assert.equal(workflow.jobs.nightly.permissions.contents, 'read')
+  assert.equal(workflow.jobs.nightly.permissions['id-token'], 'write')
+  assert.equal(workflow.jobs.nightly.env.REPOCTL_NIGHTLY_PROVIDER, 'npm')
+  assert.equal(workflow.concurrency['cancel-in-progress'], false)
+  assert.equal(steps.some(step => step.run?.includes('gh workflow run weapp-cli.yml --ref release/pnpm-version')), true)
+  for (const legacy of ['publish-weapp.yml', 'version-packages.yml']) {
+    assert.equal(existsSync(path.join(repository, '.github/workflows', legacy)), false)
+  }
+})
+
+it('separates Pages credentials from Cloudflare and keeps PR deploys on validated artifacts', async () => {
+  const deploy = parse(await readFile(path.join(repository, '.github/workflows/repoctl-docs-deploy.yml'), 'utf8'))
+  assert.match(deploy.concurrency.group, /^docs-\$\{\{ inputs\.site \}\}-\$\{\{ inputs\.channel \}\}$/)
+  assert.equal(deploy.concurrency['cancel-in-progress'], false)
+  assert.deepEqual(deploy.jobs.cloudflare.permissions, { contents: 'write' })
+  assert.deepEqual(deploy.jobs.pages.permissions, { 'contents': 'write', 'pages': 'write', 'id-token': 'write' })
+  assert.match(deploy.jobs.pages.if, /inputs.site == 'open-source' && inputs.channel == 'stable'/)
+  const pages = deploy.jobs.pages.steps.find(step => step.uses?.startsWith('actions/github-script@'))
+  assert.match(pages.with.script, /env: process.env/)
+  assert.match(pages.with.script, /\['plan', 'deploy'\]/)
+  assert.equal(pages.env.CLOUDFLARE_API_TOKEN, undefined)
+  for (const filename of ['ci.yml', 'open-source.yml']) {
+    const workflow = parse(await readFile(path.join(repository, '.github/workflows', filename), 'utf8'))
+    assert.deepEqual(Object.keys(workflow.jobs).sort(), ['deploy-preview', 'verify'])
+    const verify = workflow.jobs.verify
+    assert.match(verify.env.REPO_DOCS_CHANNEL, /github.event_name == 'pull_request' && 'preview' \|\| 'stable'/)
+    for (const job of [verify, workflow.jobs['deploy-preview']]) {
+      const checkout = job.steps.find(step => step.uses?.startsWith('actions/checkout@'))
+      assert.match(checkout.with.ref, /github.event.pull_request.head.sha \|\| github.sha/)
+    }
+    const identity = verify.steps.findIndex(step => step.run?.includes('--identity-only'))
+    const e2e = verify.steps.findIndex(step => step.run?.endsWith('exec playwright test'))
+    const artifact = verify.steps.findIndex(step => step.uses?.startsWith('actions/upload-artifact@'))
+    assert.ok(identity >= 0 && identity < e2e && e2e < artifact)
+    const preview = workflow.jobs['deploy-preview']
+    assert.equal(preview.needs, 'verify')
+    assert.match(preview.if, /github.event.pull_request.head.repo.full_name == github.repository/)
+    const download = preview.steps.findIndex(step => step.uses?.startsWith('actions/download-artifact@'))
+    const upload = preview.steps.findIndex(step => step.run?.startsWith('node scripts/docs-deployment/cli.mjs pr '))
+    assert.ok(download >= 0 && download < upload)
+    assert.equal(preview.steps.some(step => /pnpm .*build/.test(step.run ?? '')), false)
+    assert.equal(preview.permissions['id-token'], undefined)
+    assert.equal(preview.permissions.pages, undefined)
+  }
+})
diff --git a/scripts/repoctl-lifecycle.test.mjs b/scripts/repoctl-lifecycle.test.mjs
new file mode 100644
index 00000000..d18c56af
--- /dev/null
+++ b/scripts/repoctl-lifecycle.test.mjs
@@ -0,0 +1,296 @@
+import { strict as assert } from 'node:assert'
+import { spawnSync } from 'node:child_process'
+import { readFileSync, writeFileSync } from 'node:fs'
+import { mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+import { createReleasePullRequest, deployDocs, planDocsDeployment, releaseCi } from 'repoctl'
+import { it } from 'vitest'
+
+const candidate = { name: 'weapp', version: '0.3.0' }
+const repository = 'weappjs/weapp.dev'
+const releaseConfig = { branches: { stable: 'main', prerelease: [] }, qualityScripts: [] }
+const site = {
+  packages: ['weapp'],
+  buildScript: 'site:build',
+  preview: { deployScript: 'site:deploy', url: 'https://preview.example.invalid' },
+  stable: { deployScript: 'site:deploy', url: 'https://weapp.dev' },
+  patchPaths: [],
+}
+const docsConfig = { sites: { web: site } }
+
+async function write(cwd, filename, content) {
+  const target = path.join(cwd, filename)
+  await mkdir(path.dirname(target), { recursive: true })
+  await writeFile(target, content)
+}
+
+// Exercise the installed public API against real temporary Git history. Only
+// Git commands can execute; npm and GitHub transports are deterministic fakes.
+async function withLifecycle(run) {
+  const directory = await realpath(await mkdtemp(path.join(tmpdir(), 'weapp-lifecycle-')))
+  const cwd = path.join(directory, 'workspace')
+  try {
+    await mkdir(cwd)
+    const env = { ...process.env }
+    for (const key of Object.keys(env)) {
+      if (/^(?:GIT_|GITHUB_|GH_|NPM_CONFIG_|npm_config_)/.test(key) || /TOKEN|AUTH|PROXY/i.test(key)) {
+        delete env[key]
+      }
+    }
+    Object.assign(env, {
+      GITHUB_REPOSITORY: repository,
+      GITHUB_REF_NAME: 'main',
+      GITHUB_REF: 'refs/heads/main',
+      GITHUB_ACTIONS: 'true',
+      GITHUB_RUN_ID: 'fixture-1',
+      GITHUB_EVENT_NAME: 'workflow_dispatch',
+      npm_config_registry: 'https://registry.npmjs.org',
+      npm_config_userconfig: path.join(directory, 'empty-user.npmrc'),
+      npm_config_globalconfig: path.join(directory, 'empty-global.npmrc'),
+      COREPACK_ENABLE_NETWORK: '0',
+      LEFTHOOK: '0',
+    })
+    await writeFile(env.npm_config_userconfig, '')
+    await writeFile(env.npm_config_globalconfig, '')
+    const calls = []
+    let publishTransport
+    const execute = (command, args, options = {}) => {
+      calls.push({ command, args })
+      assert.equal(path.resolve(options.cwd ?? cwd), cwd)
+      if (command === 'pnpm' && args[0] === 'publish' && publishTransport) {
+        return publishTransport(args)
+      }
+      assert.equal(command, 'git', `Unexpected subprocess: ${command} ${args.join(' ')}`)
+      return spawnSync(command, args, { ...options, cwd, env, encoding: 'utf8', stdio: 'pipe', timeout: 10000 })
+    }
+    const git = (...args) => {
+      const result = execute('git', args)
+      assert.equal(result.status, 0, result.stderr || result.error?.message)
+      return result.stdout.trim()
+    }
+    await write(cwd, 'package.json', `${JSON.stringify({ name: 'release-fixture', version: '0.0.0', private: true, packageManager: 'pnpm@12.8.1', scripts: { 'site:build': 'true', 'site:deploy': 'true' } })}\n`)
+    await write(cwd, 'pnpm-workspace.yaml', 'packages:\n  - packages/*\n')
+    await write(cwd, 'repoctl.config.mjs', `export default ${JSON.stringify({ commands: { release: releaseConfig, docs: docsConfig } })}\n`)
+    await write(cwd, '.gitignore', '.cache/\nrepoctl-*-progress.json\npnpm-publish-summary.json\n')
+    await write(cwd, 'packages/weapp/package.json', `${JSON.stringify({ ...candidate, version: '0.2.0' })}\n`)
+    await write(cwd, 'packages/weapp/index.js', 'export const source = "released"\n')
+    git('init', '--initial-branch=main')
+    git('config', 'user.name', 'Lifecycle fixture')
+    git('config', 'user.email', 'lifecycle@example.invalid')
+    git('config', 'commit.gpgsign', 'false')
+    git('add', '-A')
+    git('commit', '-m', 'feat: previous release')
+    await write(cwd, 'packages/weapp/package.json', `${JSON.stringify(candidate)}\n`)
+    await write(cwd, 'packages/weapp/CHANGELOG.md', '# weapp\n\n## 0.3.0\n\n### Minor Changes\n\n- Add the new CLI.\n\n## 0.2.0\n\n- Previous release.\n')
+    await write(cwd, '.changeset/ledger.yaml', 'weapp@0.3.0:\n  dir: packages/weapp\n  intents:\n    - prior-release\n')
+    git('add', '-A')
+    git('commit', '-m', 'chore(release): version packages')
+    const source = git('rev-parse', 'HEAD')
+    const remote = path.join(directory, 'origin.git')
+    git('init', '--bare', remote)
+    git('remote', 'add', 'origin', remote)
+    git('push', '-u', 'origin', 'main')
+    const states = new Map()
+    const automation = new Map()
+    const releases = new Map()
+    const tags = new Map()
+    const writes = []
+    let rejectMetadata = false
+    let registryPresent = true
+    let remoteHead = source
+    const cas = (map, key, value, revision, kind) => {
+      assert.equal(revision, map.get(key)?.revision, `${kind} must use the previous revision`)
+      const next = String(Number(revision || 0) + 1)
+      map.set(key, { revision: next, [kind]: structuredClone(value) })
+      writes.push({ key, value: structuredClone(value) })
+      return next
+    }
+    const github = {
+      readReleaseState: async key => structuredClone(states.get(key)),
+      writeReleaseState: async (key, state, revision) => cas(states, key, state, revision, 'state'),
+      readAutomationState: async key => structuredClone(automation.get(key)),
+      writeAutomationState: async (key, value, revision) => cas(automation, key, value, revision, 'value'),
+      readBranchHead: async () => remoteHead,
+      listReleases: async () => [...releases.values()],
+      readTagTarget: async tag => tags.get(tag),
+      ensureTag: async ({ tag, target }) => {
+        assert.equal(target, source)
+        tags.set(tag, target)
+      },
+      ensureRelease: async (request) => {
+        if (rejectMetadata) {
+          throw new Error('simulated metadata interruption')
+        }
+        const release = { id: 1, tag_name: request.tag, target_commitish: request.target, draft: false, prerelease: false, html_url: 'https://example.invalid/release/1' }
+        releases.set(request.tag, release)
+        return release
+      },
+      ensurePullRequest: async () => { throw new Error('Unexpected release PR write') },
+    }
+    const requests = []
+    const registryFetch = async (url, options) => {
+      assert.equal(options.method ?? 'GET', 'GET')
+      requests.push(String(url))
+      const pathname = new URL(url).pathname
+      if (pathname === '/-/package/weapp/dist-tags') {
+        return Response.json({ latest: '0.3.0' })
+      }
+      assert.equal(pathname, '/weapp/0.3.0')
+      return registryPresent ? Response.json({ ...candidate, gitHead: source }) : new Response('{}', { status: 404 })
+    }
+    const options = { cwd, env, branch: 'main', config: releaseConfig, spawn: execute, github, registryFetch, sleep: async () => {} }
+    const completeRelease = async () => {
+      await releaseCi({ ...options, mode: 'publish' })
+      const record = [...automation.entries()].find(([key]) => key.startsWith('releases/'))?.[1].value
+      assert.ok(record, 'Only the real completed release lifecycle may establish the docs baseline')
+      return record
+    }
+    await run({
+      cwd,
+      source,
+      env,
+      git,
+      options,
+      calls,
+      writes,
+      states,
+      automation,
+      tags,
+      releases,
+      requests,
+      completeRelease,
+      setRegistryPresent(value) {
+        registryPresent = value
+      },
+      setRejectMetadata(value) {
+        rejectMetadata = value
+      },
+      setRemoteHead(value) {
+        remoteHead = value
+      },
+      setPublishTransport(value) {
+        publishTransport = value
+      },
+    })
+  }
+  finally {
+    await rm(directory, { recursive: true, force: true })
+  }
+}
+
+it.each(['unpublished', 'unfinished checkpoint'])('blocks new intents when the prepared previous version is %s', async failure => withLifecycle(async (fixture) => {
+  const { cwd, source, options, calls, git } = fixture
+  await write(cwd, '.changeset/new-release.md', '---\n"weapp": minor\n---\n\nAnother change.\n')
+  git('add', '-A')
+  git('commit', '-m', 'feat: another change')
+  const head = git('rev-parse', 'HEAD')
+  if (failure === 'unpublished') {
+    fixture.setRegistryPresent(false)
+  }
+  else {
+    fixture.tags.set('weapp@0.3.0', source)
+    fixture.releases.set('weapp@0.3.0', { tag_name: 'weapp@0.3.0', draft: false, prerelease: false })
+    options.github.readReleaseState = async () => ({ revision: '1', state: { schemaVersion: 1, complete: false, packages: [{ ...candidate, target: source }] } })
+  }
+  await assert.rejects(createReleasePullRequest(options), /Prepared releases must finish before consuming new intents/)
+  assert.equal(git('rev-parse', 'HEAD'), head)
+  assert.equal(git('status', '--porcelain'), '')
+  assert.equal(JSON.parse(await readFile(path.join(cwd, 'packages/weapp/package.json'), 'utf8')).version, '0.3.0')
+  assert.ok(await readFile(path.join(cwd, '.changeset/new-release.md'), 'utf8'))
+  assert.equal(calls.some(call => call.command === 'pnpm'), false)
+}), 30000)
+
+it('recovers stable publication after metadata interruption without uploading an accepted version again', async () => withLifecycle(async (fixture) => {
+  fixture.setRejectMetadata(true)
+  await assert.rejects(releaseCi({ ...fixture.options, mode: 'publish' }), /simulated metadata interruption/)
+  const interrupted = [...fixture.states.values()][0].state
+  assert.equal(interrupted.npm, 'complete')
+  assert.equal(interrupted.complete, false)
+  assert.deepEqual(interrupted.accepted, [candidate])
+  assert.equal(fixture.automation.size, 0)
+  fixture.setRejectMetadata(false)
+  const completion = await fixture.completeRelease()
+  assert.equal(completion.sourceSha, fixture.source)
+  assert.deepEqual(completion.packages, [{ ...candidate, sourceSha: fixture.source }])
+  assert.equal([...fixture.states.values()][0].state.complete, true)
+  assert.equal(fixture.calls.some(call => call.args.includes('publish')), false)
+  assert.equal(fixture.git('for-each-ref', '--format=%(refname)', 'refs/tags'), '')
+}), 30000)
+
+it('resumes an interrupted upload command from its accepted package evidence without uploading it twice', async () => withLifecycle(async (fixture) => {
+  fixture.setRegistryPresent(false)
+  fixture.setPublishTransport((args) => {
+    assert.deepEqual(args.slice(-4), ['--tag', 'latest', '--filter', 'weapp'])
+    writeFileSync(path.join(fixture.cwd, 'pnpm-publish-summary.json'), JSON.stringify({ publishedPackages: [candidate] }))
+    fixture.setRegistryPresent(true)
+    return { status: 1, stdout: '', stderr: 'simulated command interruption after acceptance' }
+  })
+  await assert.rejects(releaseCi({ ...fixture.options, mode: 'publish' }), /command failed: pnpm publish/)
+  const interrupted = [...fixture.states.values()][0].state
+  assert.deepEqual(interrupted.accepted, [candidate])
+  assert.equal(interrupted.npm, 'failed')
+  assert.equal(interrupted.complete, false)
+  const record = await fixture.completeRelease()
+  assert.equal(record.sourceSha, fixture.source)
+  assert.equal([...fixture.states.values()][0].state.complete, true)
+  assert.equal(fixture.calls.filter(call => call.command === 'pnpm' && call.args[0] === 'publish').length, 1)
+}), 30000)
+
+it('keeps a missing docs result pending and retries the frozen release source and configuration after main advances', async () => withLifecycle(async (fixture) => {
+  const record = await fixture.completeRelease()
+  let produceResult = false
+  const commands = []
+  const spawn = (command, args, settings) => {
+    assert.equal(command, 'pnpm')
+    assert.notEqual(settings.cwd, fixture.cwd)
+    assert.equal(settings.env.REPO_DOCS_SOURCE_SHA, fixture.source)
+    assert.equal(settings.env.REPO_DOCS_RELEASE_ID, record.id)
+    assert.equal(readFileSync(path.join(settings.cwd, 'packages/weapp/index.js'), 'utf8'), 'export const source = "released"\n')
+    assert.equal(spawnSync('git', ['rev-parse', 'HEAD'], { cwd: settings.cwd, encoding: 'utf8' }).stdout.trim(), fixture.source)
+    commands.push(args.join(' '))
+    if (args[1] === 'site:deploy' && produceResult) {
+      writeFileSync(settings.env.REPO_DOCS_RESULT_FILE, JSON.stringify({ versionId: 'provider-version', url: 'https://weapp.dev' }))
+    }
+    return { status: 0, stdout: '', stderr: '' }
+  }
+  const options = { cwd: fixture.cwd, site: 'web', channel: 'stable', release: record.id, config: docsConfig, github: fixture.options.github, env: { ...fixture.env, REPO_DOCS_CONCURRENCY_GROUP: 'docs-web-stable' }, spawn }
+  await assert.rejects(deployDocs(options), /did not produce valid JSON at REPO_DOCS_RESULT_FILE/)
+  const pending = fixture.automation.get('docs/web/stable').value
+  assert.equal(pending.pending.phase, 'deploying')
+  assert.equal(pending.current, undefined)
+  const deploymentId = pending.pending.deploymentId
+  await write(fixture.cwd, 'packages/weapp/index.js', 'export const source = "unreleased main"\n')
+  fixture.git('add', '-A')
+  fixture.git('commit', '-m', 'feat: unreleased change')
+  fixture.git('push', 'origin', 'main')
+  fixture.setRemoteHead(fixture.git('rev-parse', 'HEAD'))
+  await assert.rejects(deployDocs({ ...options, release: 'd'.repeat(64) }), /unfinished deploying operation/)
+  await assert.rejects(planDocsDeployment({ ...options, sourceSha: fixture.git('rev-parse', 'HEAD') }), /never an arbitrary source SHA/)
+  produceResult = true
+  const recovered = await deployDocs({ ...options, config: { sites: { web: { ...site, buildScript: 'unreleased:build', stable: { deployScript: 'unreleased:deploy' } } } } })
+  assert.equal(recovered.plan.deploymentId, deploymentId)
+  assert.equal(recovered.plan.sourceSha, fixture.source)
+  assert.equal(recovered.status, 'deployed')
+  assert.deepEqual(commands, ['install --frozen-lockfile', 'run site:build', 'run site:deploy', 'install --frozen-lockfile', 'run site:build', 'run site:deploy'])
+  const current = fixture.automation.get('docs/web/stable').value
+  assert.equal(current.current.versionId, 'provider-version')
+  assert.equal(current.current.deploymentId, deploymentId)
+  assert.equal(current.pending, undefined)
+}), 30000)
+
+it('refuses preview upload when main advances during the build and clears the unused claim', async () => withLifecycle(async (fixture) => {
+  const commands = []
+  const spawn = (_command, args) => {
+    commands.push(args.join(' '))
+    if (args[1] === 'site:build') {
+      fixture.setRemoteHead('f'.repeat(40))
+    }
+    return { status: 0, stdout: '', stderr: '' }
+  }
+  await assert.rejects(deployDocs({ cwd: fixture.cwd, site: 'web', channel: 'preview', sourceSha: fixture.source, config: docsConfig, github: fixture.options.github, env: { ...fixture.env, REPO_DOCS_CONCURRENCY_GROUP: 'docs-web-preview' }, spawn }), /Main advanced during the preview build/)
+  assert.deepEqual(commands, ['install --frozen-lockfile', 'run site:build'])
+  assert.equal(fixture.automation.get('docs/web/preview').value.pending, undefined)
+  assert.equal(fixture.automation.get('docs/web/preview').value.current, undefined)
+}), 30000)
diff --git a/scripts/repoctl-nightly-boundaries.test.mjs b/scripts/repoctl-nightly-boundaries.test.mjs
new file mode 100644
index 00000000..76402e39
--- /dev/null
+++ b/scripts/repoctl-nightly-boundaries.test.mjs
@@ -0,0 +1,189 @@
+import { strict as assert } from 'node:assert'
+import { spawnSync } from 'node:child_process'
+import { createHash } from 'node:crypto'
+import { mkdir, mkdtemp, readFile, realpath, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import process from 'node:process'
+import { fileURLToPath } from 'node:url'
+import { createNightlyPlan, createSnapshotPlan, releaseNightly, resolveCommandConfig } from 'repoctl'
+import { it } from 'vitest'
+
+const repository = fileURLToPath(new URL('..', import.meta.url))
+
+async function fixture(run) {
+  const temporary = await realpath(await mkdtemp(path.join(tmpdir(), 'weapp-nightly-boundary-')))
+  const cwd = path.join(temporary, 'source')
+  const env = { ...process.env }
+  for (const key of Object.keys(env)) {
+    if (/^(?:GIT_|GITHUB_|GH_|NPM_CONFIG_|npm_config_)/.test(key) || /TOKEN|AUTH/.test(key)) {
+      delete env[key]
+    }
+  }
+  Object.assign(env, { CI: 'true', COREPACK_ENABLE_NETWORK: '0', COREPACK_ENABLE_AUTO_PIN: '0', NO_COLOR: '1' })
+  const calls = []
+  const execute = (command, args, options = {}) => {
+    calls.push({ command, args })
+    assert.equal(path.resolve(options.cwd ?? cwd), cwd, 'Nightly inspection must stay in its source fixture')
+    if (command === 'pnpm') {
+      const output = new Map([
+        ['--version', '12.14.0'],
+        ['version --help', '--dry-run --json'],
+        ['version -r --dry-run --json --no-git-checks', '[]'],
+      ]).get(args.filter(arg => !arg.startsWith('--config.')).join(' '))
+      assert.notEqual(output, undefined, `Inspection must not install, build, publish, or mutate a tag: pnpm ${args.join(' ')}`)
+      return { status: 0, stdout: output, stderr: '' }
+    }
+    assert.equal(command, 'git')
+    return spawnSync(command, args, { ...options, cwd, env, encoding: 'utf8', stdio: 'pipe', timeout: 10000 })
+  }
+  const git = (...args) => {
+    const result = execute('git', args)
+    assert.equal(result.status, 0, result.stderr || result.error?.message)
+    return result.stdout.trim()
+  }
+  try {
+    await mkdir(path.join(cwd, 'packages/weapp'), { recursive: true })
+    await mkdir(path.join(cwd, 'packages/helper'), { recursive: true })
+    await writeFile(path.join(cwd, 'package.json'), JSON.stringify({ name: 'nightly-fixture', private: true, packageManager: 'pnpm@12.14.0' }))
+    await writeFile(path.join(cwd, 'pnpm-workspace.yaml'), 'packages:\n  - packages/*\n')
+    await writeFile(path.join(cwd, 'packages/weapp/package.json'), JSON.stringify({ name: 'weapp', version: '0.3.0' }))
+    await writeFile(path.join(cwd, 'packages/helper/package.json'), JSON.stringify({ name: 'weapp-nightly-helper', version: '0.1.0' }))
+    git('init', '--initial-branch=main')
+    git('config', 'user.name', 'Nightly fixture')
+    git('config', 'user.email', 'nightly@example.invalid')
+    git('config', 'commit.gpgsign', 'false')
+    git('add', '-A')
+    git('commit', '-m', 'test: nightly source')
+    const source = git('rev-parse', 'HEAD')
+    const event = { repository: { full_name: 'weappjs/weapp.dev', default_branch: 'main' }, schedule: '0 18 * * *' }
+    const eventFile = path.join(temporary, 'event.json')
+    await writeFile(eventFile, JSON.stringify(event))
+    Object.assign(env, {
+      GITHUB_ACTIONS: 'true',
+      GITHUB_REPOSITORY: 'weappjs/weapp.dev',
+      GITHUB_SHA: source,
+      GITHUB_REF: 'refs/heads/main',
+      GITHUB_RUN_ID: '123',
+      GITHUB_RUN_ATTEMPT: '1',
+      GITHUB_EVENT_NAME: 'schedule',
+      GITHUB_EVENT_PATH: eventFile,
+      REPOCTL_NIGHTLY_PROVIDER: 'npm',
+    })
+    const config = await resolveCommandConfig('release', repository)
+    const requests = []
+    const registry = new Map()
+    const registryFetch = async (url, settings) => {
+      const parsed = new URL(url)
+      requests.push({ pathname: parsed.pathname, method: settings?.method ?? 'GET' })
+      assert.equal(parsed.origin, 'https://registry.npmjs.org')
+      assert.equal(settings?.method ?? 'GET', 'GET', 'The fixture registry rejects every write and credential exchange')
+      const entry = registry.get(parsed.pathname)
+      return entry ? Response.json(entry) : new Response(null, { status: 404 })
+    }
+    const options = { cwd, env, config, spawn: execute, registryFetch, outputDirectory: path.join(temporary, 'reports') }
+    const publishMetadata = async (buildId) => {
+      // Generate versions and metadata using repoctl's public planner, so these
+      // tests do not duplicate the snapshot identity/hash implementation.
+      const report = await createSnapshotPlan({ cwd, env, spawn: execute, identity: { kind: 'nightly', commit: source, buildId } })
+      return report.packages.map(pkg => ({
+        name: pkg.name,
+        version: pkg.version,
+        repoctlSnapshot: { ...report.identity, identityKey: report.identityKey, tag: report.tag },
+        dist: { integrity: `sha512-${createHash('sha512').update(pkg.name).digest('base64')}` },
+      }))
+    }
+    const setChannel = (metadata) => {
+      for (const value of metadata) {
+        registry.set(`/-/package/${value.name}/dist-tags`, { 'latest': '0.2.0', 'snapshot-nightly': value.version })
+        registry.set(`/${value.name}/${value.version}`, value)
+      }
+    }
+    calls.length = 0
+    await run({ cwd, source, env, event, eventFile, options, calls, requests, registry, publishMetadata, setChannel, git })
+  }
+  finally {
+    await rm(temporary, { recursive: true, force: true })
+  }
+}
+
+it('skips a scheduled nightly when all packages already share the source and prior build, without touching latest', async () => {
+  await fixture(async ({ options, source, calls, requests, registry, publishMetadata, setChannel, git }) => {
+    setChannel(await publishMetadata('122-1'))
+    const before = JSON.stringify([...registry])
+    calls.length = 0
+    const report = await releaseNightly({ ...options, publish: true })
+    assert.equal(report.status, 'skipped', report.error)
+    assert.equal(report.commit, source)
+    assert.equal(report.buildId, '123-1')
+    assert.match(report.reason, /same nightly build identity/)
+    assert.deepEqual(report.latest, { 'weapp': '0.2.0', 'weapp-nightly-helper': '0.2.0' })
+    assert.equal(JSON.stringify([...registry]), before)
+    assert.equal(requests.length, 4)
+    assert.ok(requests.every(request => request.method === 'GET'))
+    assert.equal(calls.some(call => call.command === 'pnpm' && call.args.includes('publish')), false)
+    assert.equal(report.oidc, undefined)
+    assert.equal(report.snapshot.tag, 'snapshot-nightly')
+    assert.equal(git('rev-parse', 'HEAD'), source)
+    assert.equal(git('status', '--porcelain'), '')
+    assert.equal(JSON.parse(await readFile(path.join(report.outputDirectory, 'nightly-report.json'), 'utf8')).status, 'skipped')
+  })
+})
+
+it('does not skip a partial channel containing different build identities for the same source', async () => {
+  await fixture(async ({ options, publishMetadata, setChannel }) => {
+    const first = await publishMetadata('121-1')
+    const second = await publishMetadata('122-1')
+    setChannel([first[0], second[1]])
+    const report = await createNightlyPlan(options)
+    assert.equal(report.status, 'planned', report.error)
+    assert.equal(report.reason, undefined)
+    assert.equal(report.snapshot.tag, 'snapshot-nightly')
+    assert.deepEqual(report.packages.map(pkg => pkg.locator), ['weapp@snapshot-nightly', 'weapp-nightly-helper@snapshot-nightly'])
+  })
+})
+
+it('does not treat an invalid snapshot identity as evidence that nightly is current', async () => {
+  await fixture(async ({ options, publishMetadata, setChannel }) => {
+    const metadata = await publishMetadata('122-1')
+    metadata[0].repoctlSnapshot.identityKey = '0'.repeat(64)
+    setChannel(metadata)
+    assert.equal((await createNightlyPlan(options)).status, 'planned')
+  })
+})
+
+it('plans a new nightly when the committed source advances beyond the complete published channel', async () => {
+  await fixture(async ({ cwd, options, env, source, publishMetadata, setChannel, git }) => {
+    setChannel(await publishMetadata('122-1'))
+    await writeFile(path.join(cwd, 'packages/weapp/index.js'), 'export const changed = true\n')
+    git('add', '-A')
+    git('commit', '-m', 'feat: change nightly input')
+    env.GITHUB_SHA = git('rev-parse', 'HEAD')
+    assert.notEqual(env.GITHUB_SHA, source)
+    const report = await createNightlyPlan(options)
+    assert.equal(report.status, 'planned', report.error)
+    assert.equal(report.commit, env.GITHUB_SHA)
+    assert.ok(report.packages.every(pkg => pkg.version.includes(env.GITHUB_SHA)))
+  })
+})
+
+it('leaves explicit nightly dispatch available even when the scheduled channel is current', async () => {
+  await fixture(async ({ options, env, event, eventFile, publishMetadata, setChannel }) => {
+    setChannel(await publishMetadata('122-1'))
+    env.GITHUB_EVENT_NAME = 'workflow_dispatch'
+    await writeFile(eventFile, JSON.stringify({ ...event, inputs: { mode: 'nightly' } }))
+    const report = await createNightlyPlan(options)
+    assert.equal(report.status, 'planned', report.error)
+    assert.equal(report.eventName, 'workflow_dispatch')
+  })
+})
+
+it('fails closed on an unavailable npm registry instead of treating the channel as absent', async () => {
+  await fixture(async ({ options, calls }) => {
+    const report = await releaseNightly({ ...options, publish: true, registryFetch: async () => new Response(null, { status: 503 }) })
+    assert.equal(report.status, 'failed')
+    assert.match(report.error, /HTTP 503.*publication state is unknown/)
+    assert.equal(report.oidc, undefined)
+    assert.equal(calls.some(call => call.command === 'pnpm' && call.args.includes('publish')), false)
+  })
+})
diff --git a/scripts/vitest.config.ts b/scripts/vitest.config.ts
index e1fadc02..b75ccf5a 100644
--- a/scripts/vitest.config.ts
+++ b/scripts/vitest.config.ts
@@ -1,3 +1,15 @@
 import { defineConfig } from 'vitest/config'
 
-export default defineConfig({ test: { include: ['scripts/**/*.test.mjs'] } })
+export default defineConfig({
+  // Exercise installed release tooling using its published Node exports.
+  // ATTW's development export is raw TypeScript inside node_modules.
+  plugins: [{
+    name: 'published-node-exports',
+    configResolved(config) {
+      // Vitest appends development|production after user resolve.conditions.
+      // Its native workers must use the same exports as the installed CLI.
+      config.ssr.resolve!.conditions = ['node']
+    },
+  }],
+  test: { include: ['scripts/**/*.test.mjs'] },
+})
diff --git a/turbo.json b/turbo.json
index 7e06008f..3043e300 100644
--- a/turbo.json
+++ b/turbo.json
@@ -2,6 +2,7 @@
   "$schema": "https://turbo.build/schema.json",
   "tasks": {
     "build": {
+      "env": ["REPO_DOCS_CHANNEL"],
       "dependsOn": [
         "^build"
       ],