From 2575ab400ddf654ca15bf390590d8791875fbf92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 14:40:38 +0200
Subject: [PATCH 01/15] runner: migrate example installs to pnpm

---
 runner/config/frameworks.json              | 32 +++++++-------
 runner/containers/angular/Dockerfile       | 11 -----
 runner/containers/angular/package.json     | 40 ------------------
 runner/containers/astro/Dockerfile         | 11 -----
 runner/containers/astro/package.json       | 25 -----------
 runner/containers/next-shadcn/Dockerfile   | 11 -----
 runner/containers/next-shadcn/package.json | 40 ------------------
 runner/containers/next/Dockerfile          | 11 -----
 runner/containers/next/package.json        | 35 ----------------
 runner/containers/nuxt/Dockerfile          | 11 -----
 runner/containers/nuxt/package.json        | 21 ----------
 runner/containers/remix/Dockerfile         | 11 -----
 runner/containers/remix/package.json       | 49 ----------------------
 runner/pipeline/import-docs.mjs            | 16 +++----
 runner/pipeline/import.mjs                 |  4 +-
 runner/pipeline/wrap-docs-example.mjs      |  4 ++
 runner/scripts/prepare-container.mjs       | 48 ++++++++++++++-------
 runner/workers/api/src/index.ts            |  8 ++--
 18 files changed, 68 insertions(+), 320 deletions(-)
 delete mode 100644 runner/containers/angular/Dockerfile
 delete mode 100644 runner/containers/angular/package.json
 delete mode 100644 runner/containers/astro/Dockerfile
 delete mode 100644 runner/containers/astro/package.json
 delete mode 100644 runner/containers/next-shadcn/Dockerfile
 delete mode 100644 runner/containers/next-shadcn/package.json
 delete mode 100644 runner/containers/next/Dockerfile
 delete mode 100644 runner/containers/next/package.json
 delete mode 100644 runner/containers/nuxt/Dockerfile
 delete mode 100644 runner/containers/nuxt/package.json
 delete mode 100644 runner/containers/remix/Dockerfile
 delete mode 100644 runner/containers/remix/package.json

diff --git a/runner/config/frameworks.json b/runner/config/frameworks.json
index c3d2d39a..56b25785 100644
--- a/runner/config/frameworks.json
+++ b/runner/config/frameworks.json
@@ -14,7 +14,7 @@
       "buildCommand": "tsc && vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "javascript": {
       "tier": 1,
@@ -28,7 +28,7 @@
       "buildCommand": "vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "typescript": {
       "tier": 1,
@@ -42,7 +42,7 @@
       "buildCommand": "tsc && vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "react": {
       "tier": 1,
@@ -56,7 +56,7 @@
       "buildCommand": "tsc -b && vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "react-js": {
       "tier": 1,
@@ -71,7 +71,7 @@
       "buildCommand": "vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "ant-design": {
       "tier": 1,
@@ -86,7 +86,7 @@
       "buildCommand": "vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "mui": {
       "tier": 1,
@@ -101,7 +101,7 @@
       "buildCommand": "tsc -b && vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "base-web": {
       "tier": 1,
@@ -116,7 +116,7 @@
       "buildCommand": "tsc -b && vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "vue": {
       "tier": 1,
@@ -130,7 +130,7 @@
       "buildCommand": "vite build",
       "outputDir": "dist",
       "port": null,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "angular": {
       "tier": 2,
@@ -139,12 +139,12 @@
       "htWrappers": ["@handsontable/angular-wrapper"],
       "entry": "src/main.ts",
       "htmlEntry": "src/index.html",
-      "devCommand": "npm run start -- --host 0.0.0.0 --disable-host-check --port 3000",
+      "devCommand": "pnpm run start -- --host 0.0.0.0 --disable-host-check --port 3000",
       "buildCommand": "ng build",
       "outputDir": "dist",
       "outputGlob": "dist/*/browser",
       "port": 3000,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "next.js": {
       "tier": 2,
@@ -157,7 +157,7 @@
       "outputDir": "out",
       "staticExport": true,
       "port": 3000,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "next-shadcn.js": {
       "tier": 2,
@@ -170,7 +170,7 @@
       "outputDir": "out",
       "staticExport": true,
       "port": 3000,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "astro": {
       "tier": 2,
@@ -182,7 +182,7 @@
       "buildCommand": "astro build",
       "outputDir": "dist",
       "port": 4321,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "nuxt": {
       "tier": 2,
@@ -194,7 +194,7 @@
       "buildCommand": "nuxt generate",
       "outputDir": ".output/public",
       "port": 3000,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     },
     "remix": {
       "tier": 2,
@@ -207,7 +207,7 @@
       "outputDir": "build/client",
       "spaMode": true,
       "port": 5173,
-      "installCommand": "npm install"
+      "installCommand": "pnpm install --frozen-lockfile"
     }
   }
 }
diff --git a/runner/containers/angular/Dockerfile b/runner/containers/angular/Dockerfile
deleted file mode 100644
index cdb44163..00000000
--- a/runner/containers/angular/Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Generated by scripts/prepare-container.mjs — do not edit by hand.
-# Tier-2 base image with dependencies baked for a fast warm dev server.
-# Per-session source files are written into /app at runtime by the Worker.
-FROM docker.io/cloudflare/sandbox:0.12.3
-
-WORKDIR /app
-
-COPY package.json ./
-RUN npm install --legacy-peer-deps --no-audit --no-fund --loglevel=error
-
-EXPOSE 4200
diff --git a/runner/containers/angular/package.json b/runner/containers/angular/package.json
deleted file mode 100644
index 19662e85..00000000
--- a/runner/containers/angular/package.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "name": "sandbox",
-  "version": "0.0.0",
-  "scripts": {
-    "ng": "ng",
-    "start": "ng serve --disable-host-check  --port 3000",
-    "build": "ng build",
-    "watch": "ng build --watch --configuration development",
-    "test": "ng test"
-  },
-  "private": true,
-  "dependencies": {
-    "@angular/animations": "^21.1.0",
-    "@angular/common": "^21.1.0",
-    "@angular/compiler": "^21.1.0",
-    "@angular/core": "^21.1.0",
-    "@angular/forms": "^21.1.0",
-    "@angular/platform-browser": "^21.1.0",
-    "@angular/platform-browser-dynamic": "^21.1.0",
-    "@angular/router": "^21.1.0",
-    "@handsontable/angular-wrapper": "latest",
-    "handsontable": "latest",
-    "rxjs": "~7.8.0",
-    "tslib": "^2.6.2",
-    "zone.js": "~0.15.0"
-  },
-  "devDependencies": {
-    "@angular-devkit/build-angular": "^21.1.0",
-    "@angular/cli": "^21.1.0",
-    "@angular/compiler-cli": "^21.1.0",
-    "@types/jasmine": "3.6.9",
-    "@types/node": "12.20.7",
-    "typescript": "~5.9.0"
-  },
-  "config": {
-    "codesandbox": {
-      "templateId": "chnr97"
-    }
-  }
-}
diff --git a/runner/containers/astro/Dockerfile b/runner/containers/astro/Dockerfile
deleted file mode 100644
index cdd36e95..00000000
--- a/runner/containers/astro/Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Generated by scripts/prepare-container.mjs — do not edit by hand.
-# Tier-2 base image with dependencies baked for a fast warm dev server.
-# Per-session source files are written into /app at runtime by the Worker.
-FROM docker.io/cloudflare/sandbox:0.12.3
-
-WORKDIR /app
-
-COPY package.json ./
-RUN npm install --no-audit --no-fund --loglevel=error
-
-EXPOSE 4321
diff --git a/runner/containers/astro/package.json b/runner/containers/astro/package.json
deleted file mode 100644
index 2a5f49b7..00000000
--- a/runner/containers/astro/package.json
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  "name": "@example/basics",
-  "type": "module",
-  "version": "0.0.1",
-  "private": true,
-  "scripts": {
-    "dev": "astro dev --port 8080",
-    "start": "astro dev",
-    "build": "astro build",
-    "preview": "astro preview",
-    "astro": "astro"
-  },
-  "dependencies": {
-    "astro": "^4.16.19",
-    "handsontable": "18.0.0"
-  },
-  "config": {
-    "codesandbox": {
-      "templateId": "438vfj"
-    },
-    "stackblitz": {
-      "template": "node"
-    }
-  }
-}
diff --git a/runner/containers/next-shadcn/Dockerfile b/runner/containers/next-shadcn/Dockerfile
deleted file mode 100644
index 09994b26..00000000
--- a/runner/containers/next-shadcn/Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Generated by scripts/prepare-container.mjs — do not edit by hand.
-# Tier-2 base image with dependencies baked for a fast warm dev server.
-# Per-session source files are written into /app at runtime by the Worker.
-FROM docker.io/cloudflare/sandbox:0.12.3
-
-WORKDIR /app
-
-COPY package.json ./
-RUN npm install --no-audit --no-fund --loglevel=error
-
-EXPOSE 3001
diff --git a/runner/containers/next-shadcn/package.json b/runner/containers/next-shadcn/package.json
deleted file mode 100644
index e0bb2fb7..00000000
--- a/runner/containers/next-shadcn/package.json
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  "name": "my-app",
-  "version": "0.1.0",
-  "private": true,
-  "scripts": {
-    "dev": "next dev",
-    "build": "next build",
-    "start": "next start",
-    "lint": "eslint"
-  },
-  "dependencies": {
-    "@handsontable/react-wrapper": "17.0.1",
-    "handsontable": "17.0.1",
-    "class-variance-authority": "^0.7.1",
-    "clsx": "^2.1.1",
-    "lucide-react": "^0.563.0",
-    "next": "16.1.6",
-    "radix-ui": "^1.4.3",
-    "react": "19.2.3",
-    "react-dom": "19.2.3",
-    "tailwind-merge": "^3.4.0",
-    "tailwindcss": "^4",
-    "@tailwindcss/postcss": "^4",
-    "tw-animate-css": "^1.4.0"
-  },
-  "devDependencies": {
-    "@types/node": "^20",
-    "@types/react": "^19",
-    "@types/react-dom": "^19",
-    "eslint": "^9",
-    "eslint-config-next": "16.1.6",
-    "shadcn": "^3.8.4",
-    "typescript": "^5"
-  },
-  "config": {
-    "codesandbox": {
-      "templateId": "8y5qy5"
-    }
-  }
-}
diff --git a/runner/containers/next/Dockerfile b/runner/containers/next/Dockerfile
deleted file mode 100644
index 09994b26..00000000
--- a/runner/containers/next/Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Generated by scripts/prepare-container.mjs — do not edit by hand.
-# Tier-2 base image with dependencies baked for a fast warm dev server.
-# Per-session source files are written into /app at runtime by the Worker.
-FROM docker.io/cloudflare/sandbox:0.12.3
-
-WORKDIR /app
-
-COPY package.json ./
-RUN npm install --no-audit --no-fund --loglevel=error
-
-EXPOSE 3001
diff --git a/runner/containers/next/package.json b/runner/containers/next/package.json
deleted file mode 100644
index bbf73327..00000000
--- a/runner/containers/next/package.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "name": "nextjs",
-  "version": "0.1.0",
-  "private": true,
-  "scripts": {
-    "dev": "next dev",
-    "build": "next build",
-    "start": "next start",
-    "lint": "next lint"
-  },
-  "dependencies": {
-    "@handsontable/react-wrapper": "17.0.1",
-    "handsontable": "17.0.1",
-    "@types/node": "20.6.2",
-    "@types/react": "18.2.22",
-    "@types/react-dom": "18.2.7",
-    "autoprefixer": "10.4.15",
-    "eslint": "8.49.0",
-    "eslint-config-next": "13.5.1",
-    "next": "13.5.1",
-    "postcss": "8.4.30",
-    "react": "18.2.0",
-    "react-dom": "18.2.0",
-    "tailwindcss": "3.3.3",
-    "typescript": "5.2.2"
-  },
-  "config": {
-    "codesandbox": {
-      "templateId": "5l26fv"
-    },
-    "stackblitz": {
-      "template": "node"
-    }
-  }
-}
diff --git a/runner/containers/nuxt/Dockerfile b/runner/containers/nuxt/Dockerfile
deleted file mode 100644
index 09994b26..00000000
--- a/runner/containers/nuxt/Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Generated by scripts/prepare-container.mjs — do not edit by hand.
-# Tier-2 base image with dependencies baked for a fast warm dev server.
-# Per-session source files are written into /app at runtime by the Worker.
-FROM docker.io/cloudflare/sandbox:0.12.3
-
-WORKDIR /app
-
-COPY package.json ./
-RUN npm install --no-audit --no-fund --loglevel=error
-
-EXPOSE 3001
diff --git a/runner/containers/nuxt/package.json b/runner/containers/nuxt/package.json
deleted file mode 100644
index d894549f..00000000
--- a/runner/containers/nuxt/package.json
+++ /dev/null
@@ -1,21 +0,0 @@
-{
-  "private": true,
-  "type": "module",
-  "scripts": {
-    "build": "nuxt build",
-    "dev": "HOST=0.0.0.0 PORT=8080 nuxt dev",
-    "generate": "nuxt generate",
-    "preview": "nuxt preview",
-    "postinstall": "nuxt prepare"
-  },
-  "dependencies": {
-    "@handsontable/vue3": "18.0.0",
-    "handsontable": "18.0.0",
-    "nuxt": "^3.21.8"
-  },
-  "config": {
-    "codesandbox": {
-      "templateId": "nj3gp2"
-    }
-  }
-}
diff --git a/runner/containers/remix/Dockerfile b/runner/containers/remix/Dockerfile
deleted file mode 100644
index 6acedfdd..00000000
--- a/runner/containers/remix/Dockerfile
+++ /dev/null
@@ -1,11 +0,0 @@
-# Generated by scripts/prepare-container.mjs — do not edit by hand.
-# Tier-2 base image with dependencies baked for a fast warm dev server.
-# Per-session source files are written into /app at runtime by the Worker.
-FROM docker.io/cloudflare/sandbox:0.12.3
-
-WORKDIR /app
-
-COPY package.json ./
-RUN npm install --no-audit --no-fund --loglevel=error
-
-EXPOSE 5173
diff --git a/runner/containers/remix/package.json b/runner/containers/remix/package.json
deleted file mode 100644
index 2f078e98..00000000
--- a/runner/containers/remix/package.json
+++ /dev/null
@@ -1,49 +0,0 @@
-{
-  "private": true,
-  "sideEffects": false,
-  "type": "module",
-  "scripts": {
-    "build": "remix vite:build",
-    "dev": "remix vite:dev",
-    "lint": "eslint --ignore-path .gitignore --cache --cache-location ./node_modules/.cache/eslint .",
-    "start": "remix-serve ./build/server/index.js",
-    "typecheck": "tsc"
-  },
-  "dependencies": {
-    "@remix-run/node": "^2.17.5",
-    "@remix-run/react": "^2.17.5",
-    "@remix-run/serve": "^2.17.5",
-    "isbot": "^4.1.0",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0",
-    "@handsontable/react-wrapper": "^17.1.0",
-    "handsontable": "^17.1.0"
-  },
-  "devDependencies": {
-    "@remix-run/dev": "*",
-    "@types/react": "^18.2.20",
-    "@types/react-dom": "^18.2.7",
-    "@typescript-eslint/eslint-plugin": "^6.7.4",
-    "@typescript-eslint/parser": "^6.7.4",
-    "eslint": "^8.38.0",
-    "eslint-import-resolver-typescript": "^3.6.1",
-    "eslint-plugin-import": "^2.28.1",
-    "eslint-plugin-jsx-a11y": "^6.7.1",
-    "eslint-plugin-react": "^7.33.2",
-    "eslint-plugin-react-hooks": "^4.6.0",
-    "typescript": "^5.1.6",
-    "vite": "^5.4.21",
-    "vite-tsconfig-paths": "^4.2.1"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "config": {
-    "codesandbox": {
-      "templateId": "m4k8vw"
-    },
-    "stackblitz": {
-      "template": "node"
-    }
-  }
-}
diff --git a/runner/pipeline/import-docs.mjs b/runner/pipeline/import-docs.mjs
index 6a8d27bc..592e1db5 100644
--- a/runner/pipeline/import-docs.mjs
+++ b/runner/pipeline/import-docs.mjs
@@ -99,14 +99,14 @@ const RUNNER = {
     sandpackTemplate: "vanilla", sandpackEnvironment: "parcel", container: null, htWrappers: [],
     entry: "/src/main.js", htmlEntry: "/index.html",
     devCommand: null, buildCommand: "vite build", outputDir: "dist", outputGlob: null,
-    staticExport: false, spaMode: false, port: null, installCommand: "npm install",
+    staticExport: false, spaMode: false, port: null, installCommand: "pnpm install",
   },
   typescript: {
     framework: "typescript", displayName: "TypeScript", tier: 1, engine: "sandpack",
     sandpackTemplate: "vanilla-ts", sandpackEnvironment: "parcel", container: null, htWrappers: [],
     entry: "/src/main.ts", htmlEntry: "/index.html",
     devCommand: null, buildCommand: "vite build", outputDir: "dist", outputGlob: null,
-    staticExport: false, spaMode: false, port: null, installCommand: "npm install",
+    staticExport: false, spaMode: false, port: null, installCommand: "pnpm install",
   },
   react: {
     framework: "react", displayName: "React (TS)", tier: 1, engine: "sandpack",
@@ -114,7 +114,7 @@ const RUNNER = {
     container: null, htWrappers: ["@handsontable/react-wrapper"],
     entry: "/src/main.tsx", htmlEntry: "/index.html",
     devCommand: null, buildCommand: "vite build", outputDir: "dist", outputGlob: null,
-    staticExport: false, spaMode: false, port: null, installCommand: "npm install",
+    staticExport: false, spaMode: false, port: null, installCommand: "pnpm install",
   },
   "react-js": {
     framework: "react-js", displayName: "React (JS)", tier: 1, engine: "sandpack",
@@ -122,7 +122,7 @@ const RUNNER = {
     container: null, htWrappers: ["@handsontable/react-wrapper"],
     entry: "/src/main.jsx", htmlEntry: "/index.html",
     devCommand: null, buildCommand: "vite build", outputDir: "dist", outputGlob: null,
-    staticExport: false, spaMode: false, port: null, installCommand: "npm install",
+    staticExport: false, spaMode: false, port: null, installCommand: "pnpm install",
   },
   // Vue 3 docs examples use `<script setup>`, which the in-browser (classic)
   // bundler cannot compile — they run on the container engine (real Vite dev).
@@ -131,18 +131,18 @@ const RUNNER = {
     sandpackTemplate: null, sandpackEnvironment: null, container: "vue",
     htWrappers: ["@handsontable/vue3"],
     entry: "/src/main.ts", htmlEntry: "/index.html",
-    devCommand: "npx --no-install vite --host 0.0.0.0 --port 5173",
+    devCommand: "pnpm exec vite --host 0.0.0.0 --port 5173",
     buildCommand: "vite build", outputDir: "dist", outputGlob: null,
-    staticExport: false, spaMode: false, port: 5173, installCommand: "npm install",
+    staticExport: false, spaMode: false, port: 5173, installCommand: "pnpm install",
   },
   angular: {
     framework: "angular", displayName: "Angular", tier: 2, engine: "container",
     sandpackTemplate: null, sandpackEnvironment: null, container: "angular",
     htWrappers: ["@handsontable/angular-wrapper"],
     entry: "/src/main.ts", htmlEntry: "/src/index.html",
-    devCommand: "npm run start -- --host 0.0.0.0 --disable-host-check --port 3000",
+    devCommand: "pnpm run start -- --host 0.0.0.0 --disable-host-check --port 3000",
     buildCommand: "ng build", outputDir: "dist", outputGlob: "dist/*/browser",
-    staticExport: false, spaMode: false, port: 3000, installCommand: "npm install --legacy-peer-deps",
+    staticExport: false, spaMode: false, port: 3000, installCommand: "pnpm install",
   },
 };
 
diff --git a/runner/pipeline/import.mjs b/runner/pipeline/import.mjs
index 896e7349..d21987cb 100644
--- a/runner/pipeline/import.mjs
+++ b/runner/pipeline/import.mjs
@@ -42,10 +42,10 @@ const EXCLUDE_DIRS = new Set([
   ".changelog-prs-cache",
 ]);
 
-// Files never copied: lockfiles are regenerated after version injection.
+// npm and Yarn lockfiles are never copied. The catalog preserves pnpm locks so
+// default-version sessions can use deterministic frozen installs.
 const EXCLUDE_FILES = new Set([
   "package-lock.json",
-  "pnpm-lock.yaml",
   "yarn.lock",
   ".DS_Store",
 ]);
diff --git a/runner/pipeline/wrap-docs-example.mjs b/runner/pipeline/wrap-docs-example.mjs
index f93cf775..23a80c6d 100644
--- a/runner/pipeline/wrap-docs-example.mjs
+++ b/runner/pipeline/wrap-docs-example.mjs
@@ -90,6 +90,7 @@ function buildJsProject(hotVersion, exampleId, userFiles, extraDeps) {
     name: 'handsontable-example',
     version: '1.0.0',
     private: true,
+    packageManager: 'pnpm@10.34.5',
     dependencies: deps,
     scripts: { start: 'vite', build: 'vite build' },
   }, null, 2);
@@ -165,6 +166,7 @@ function buildReactProject(hotVersion, exampleId, userFiles, extraDeps) {
     name: 'handsontable-react-example',
     version: '1.0.0',
     private: true,
+    packageManager: 'pnpm@10.34.5',
     dependencies: deps,
     scripts: { start: 'vite', build: 'vite build' },
   }, null, 2);
@@ -243,6 +245,7 @@ function buildVueProject(hotVersion, exampleId, userFiles, extraDeps) {
     name: 'handsontable-vue-example',
     version: '1.0.0',
     private: true,
+    packageManager: 'pnpm@10.34.5',
     dependencies: deps,
     scripts: { start: 'vite', build: 'vite build' },
   }, null, 2);
@@ -369,6 +372,7 @@ function buildAngularProject(hotVersion, exampleId, userFiles, extraDeps) {
     name: 'handsontable-angular-example',
     version: '1.0.0',
     private: true,
+    packageManager: 'pnpm@10.34.5',
     scripts: { ng: 'ng', start: 'ng serve', build: 'ng build' },
     dependencies: deps,
     devDependencies: Object.assign(
diff --git a/runner/scripts/prepare-container.mjs b/runner/scripts/prepare-container.mjs
index b4613f95..c7e8abd2 100644
--- a/runner/scripts/prepare-container.mjs
+++ b/runner/scripts/prepare-container.mjs
@@ -13,6 +13,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
+import { execFileSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -20,23 +21,26 @@ const RUNNER_DIR = path.resolve(__dirname, "..");
 
 // Base image tag MUST match the installed @cloudflare/sandbox version.
 const SANDBOX_IMAGE = "docker.io/cloudflare/sandbox:0.12.3";
+const PNPM_VERSION = "10.34.5";
+// sandbox:0.12.3 bundles Corepack but omits its command shim.
+const COREPACK_BIN = "node /usr/local/lib/node_modules/corepack/dist/corepack.js";
 
 // Dev-server command + port per framework. NOTE: port 3000 is reserved by the
 // Cloudflare Sandbox control plane — dev servers must use another port.
 const DEV = {
-  remix: { cmd: "npm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
-  angular: { cmd: "npx --no-install ng serve --host 0.0.0.0 --port 4200 --disable-host-check", port: 4200 },
-  "next.js": { cmd: "npx --no-install next dev -p 3001 -H 0.0.0.0", port: 3001 },
-  "next-shadcn.js": { cmd: "npx --no-install next dev -p 3001 -H 0.0.0.0", port: 3001 },
-  astro: { cmd: "npx --no-install astro dev --host 0.0.0.0 --port 4321", port: 4321 },
-  nuxt: { cmd: "npx --no-install nuxt dev -H 0.0.0.0 -p 3001", port: 3001 },
-  "react-js": { cmd: "npm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
-  "ant-design": { cmd: "npm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
-  mui: { cmd: "npm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
-  "base-web": { cmd: "npm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
+  remix: { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
+  angular: { cmd: "pnpm exec ng serve --host 0.0.0.0 --port 4200 --disable-host-check", port: 4200 },
+  "next.js": { cmd: "pnpm exec next dev -p 3001 -H 0.0.0.0", port: 3001 },
+  "next-shadcn.js": { cmd: "pnpm exec next dev -p 3001 -H 0.0.0.0", port: 3001 },
+  astro: { cmd: "pnpm exec astro dev --host 0.0.0.0 --port 4321", port: 4321 },
+  nuxt: { cmd: "pnpm exec nuxt dev -H 0.0.0.0 -p 3001", port: 3001 },
+  "react-js": { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
+  "ant-design": { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
+  mui: { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
+  "base-web": { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
   // Documentation-guide Vue examples use `<script setup>` (unsupported by the
   // in-browser bundler), so they run on the container engine via real Vite.
-  vue: { cmd: "npx --no-install vite --host 0.0.0.0 --port 5173", port: 5173 },
+  vue: { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },
 };
 
 // Container frameworks that are NOT catalog starters but must still be baked
@@ -46,7 +50,7 @@ const EXTRA_CONTAINER = [
   {
     framework: "vue",
     tier: 1,
-    installCommand: "npm install",
+    installCommand: "pnpm install --frozen-lockfile",
     buildCommand: "vite build",
     outputDir: "dist",
     outputGlob: null,
@@ -56,6 +60,7 @@ const EXTRA_CONTAINER = [
           name: "handsontable-vue-docs",
           version: "1.0.0",
           private: true,
+          packageManager: `pnpm@${PNPM_VERSION}`,
           dependencies: {
             handsontable: "18.0.0",
             "@handsontable/vue3": "18.0.0",
@@ -81,6 +86,15 @@ const containerExamples = catalog.examples.filter((e) => e.engine === "container
 // examples plus the docs-only extras (e.g. Vue).
 const bakeExamples = [...containerExamples, ...EXTRA_CONTAINER];
 
+function writeExtraLock(dir) {
+  execFileSync(
+    "corepack",
+    ["pnpm", "install", "--lockfile-only", "--ignore-scripts", "--ignore-workspace"],
+    { cwd: dir, stdio: "inherit" },
+  );
+  return fs.readFileSync(path.join(dir, "pnpm-lock.yaml"), "utf8");
+}
+
 function writeBakedContexts() {
   const liveDir = path.join(RUNNER_DIR, "containers", "live");
   const bakedRoot = path.join(liveDir, "baked");
@@ -93,21 +107,25 @@ function writeBakedContexts() {
     const dir = path.join(bakedRoot, key);
     fs.mkdirSync(dir, { recursive: true });
     fs.writeFileSync(path.join(dir, "package.json"), e.files["/package.json"]);
-    const install = `${e.installCommand} --no-audit --no-fund --loglevel=error`;
+    const lock = e.files["/pnpm-lock.yaml"] ?? writeExtraLock(dir);
+    fs.writeFileSync(path.join(dir, "pnpm-lock.yaml"), lock);
     steps.push(
-      `# ${e.framework}\nCOPY baked/${key}/package.json /baked/${key}/package.json\nRUN cd /baked/${key} && ${install}`,
+      `# ${e.framework}\nCOPY baked/${key}/package.json baked/${key}/pnpm-lock.yaml /baked/${key}/\nRUN cd /baked/${key} && ${e.installCommand}`,
     );
   }
 
   const dockerfile = `# Generated by scripts/prepare-container.mjs — do not edit by hand.
 # One generic Tier-2 image. Each framework's node_modules is baked into
 # /baked/<key>; the Worker hardlink-copies the right one into /app at session
-# start so a default-version boot skips \`npm install\`. proxyToSandbox requires
+# start so a default-version boot skips \`pnpm install\`. proxyToSandbox requires
 # a single \`Sandbox\` namespace, hence one shared image.
 FROM ${SANDBOX_IMAGE}
 
 WORKDIR /app
 
+RUN ${COREPACK_BIN} enable --install-directory /usr/local/bin \\
+  && ${COREPACK_BIN} prepare pnpm@${PNPM_VERSION} --activate
+
 ${steps.join("\n\n")}
 
 EXPOSE ${EXPOSE_PORTS.join(" ")}
diff --git a/runner/workers/api/src/index.ts b/runner/workers/api/src/index.ts
index 79643fca..b64d37ac 100644
--- a/runner/workers/api/src/index.ts
+++ b/runner/workers/api/src/index.ts
@@ -14,7 +14,7 @@ import { createDemo, getDemo, getDemoSource, invalidateDemo, serveDemoAsset, upd
 
 // proxyToSandbox() hard-requires a single DO namespace literally named `Sandbox`,
 // so live-preview sessions all use ONE class backed by one generic image that
-// installs each demo's deps at session start (per-framework images can't be
+// resolves each demo's deps at session start (per-framework images can't be
 // previewed by the SDK). The builder (no preview) keeps its own class.
 // Idle window before a live-preview container scales to zero. While a demo tab
 // is open the client keepalive + HMR WebSocket keep resetting this timer, so the
@@ -152,7 +152,9 @@ export default {
         // Boot asynchronously (returns immediately; UI polls /status for live
         // progress). Dependency resolution, fastest first:
         //   1. restore node_modules from the per-(framework,version) R2 cache;
-        //   2. else seed from the image's baked deps + `npm install` (delta),
+        //   2. else seed from the image's baked deps + a frozen pnpm install;
+        //      fall back to non-frozen only when the editor or version injection
+        //      changed package metadata relative to its source lockfile,
         //      then upload the result to the cache for next time.
         const cacheVer = (body.htVersion || "default").replace(/[^a-zA-Z0-9._-]/g, "-");
         const cacheUrl = `${url.origin}/api/nmcache/${encodeURIComponent(body.framework)}/${encodeURIComponent(cacheVer)}`;
@@ -163,7 +165,7 @@ export default {
           `else`,
           `  echo '::installing dependencies (first run for this version)::'`,
           `  cp -al /baked/${dev.bakedKey}/node_modules ./node_modules 2>/dev/null || true`,
-          `  ${cfg.installCommand} --no-audit --no-fund`,
+          `  ${cfg.installCommand} || pnpm install --no-frozen-lockfile`,
           // Upload the cache in the background so it never delays the dev server.
           `  ( tar czf /tmp/nm.tgz node_modules 2>/dev/null && curl -fsS -X PUT --data-binary @/tmp/nm.tgz ${shq(cacheUrl)} >/dev/null 2>&1 ) &`,
           `fi`,

From 3247dca0104e8c73a8b938324f767b563bb2cab4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 14:40:48 +0200
Subject: [PATCH 02/15] runner: isolate pnpm dependency cache

---
 runner/scripts/prepare-container.mjs          | 13 ++++++-
 runner/workers/api/src/dependency-metadata.ts | 21 ++++++++++++
 runner/workers/api/src/index.ts               | 34 +++++++++++++++----
 3 files changed, 60 insertions(+), 8 deletions(-)
 create mode 100644 runner/workers/api/src/dependency-metadata.ts

diff --git a/runner/scripts/prepare-container.mjs b/runner/scripts/prepare-container.mjs
index c7e8abd2..6b736edb 100644
--- a/runner/scripts/prepare-container.mjs
+++ b/runner/scripts/prepare-container.mjs
@@ -14,6 +14,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -80,6 +81,10 @@ const EXPOSE_PORTS = [...new Set(Object.values(DEV).map((d) => d.port))].sort();
 
 const catalog = JSON.parse(fs.readFileSync(path.join(RUNNER_DIR, "catalog.json"), "utf8"));
 const bakedKey = (framework) => framework.toLowerCase().replace(/[^a-z0-9]+/g, "-");
+const dependencyMetadataFingerprint = ({ packageJson, pnpmLock }) => {
+  const part = (name, value) => value === undefined ? `${name}:missing\n` : `${name}:${value.length}:${value}\n`;
+  return createHash("sha256").update(`${part("package.json", packageJson)}${part("pnpm-lock.yaml", pnpmLock)}`).digest("hex");
+};
 
 const containerExamples = catalog.examples.filter((e) => e.engine === "container");
 // Everything baked into the image + given a dev command: catalog container
@@ -137,7 +142,12 @@ EXPOSE ${EXPOSE_PORTS.join(" ")}
 function writeGenerated() {
   const devRows = bakeExamples.map((e) => {
     const d = DEV[e.framework];
-    return `  ${JSON.stringify(e.framework)}: { cmd: ${JSON.stringify(d.cmd)}, port: ${d.port}, bakedKey: ${JSON.stringify(bakedKey(e.framework))} },`;
+    const bakedDir = path.join(RUNNER_DIR, "containers", "live", "baked", bakedKey(e.framework));
+    const sourceDependencyFingerprint = dependencyMetadataFingerprint({
+      packageJson: fs.readFileSync(path.join(bakedDir, "package.json"), "utf8"),
+      pnpmLock: fs.readFileSync(path.join(bakedDir, "pnpm-lock.yaml"), "utf8"),
+    });
+    return `  ${JSON.stringify(e.framework)}: { cmd: ${JSON.stringify(d.cmd)}, port: ${d.port}, bakedKey: ${JSON.stringify(bakedKey(e.framework))}, sourceDependencyFingerprint: ${JSON.stringify(sourceDependencyFingerprint)} },`;
   });
   const buildRows = catalog.examples.map((e) =>
     `  ${JSON.stringify(e.framework)}: { tier: ${e.tier}, installCommand: ${JSON.stringify(e.installCommand)}, buildCommand: ${JSON.stringify(e.buildCommand)}, outputDir: ${JSON.stringify(e.outputDir)}, outputGlob: ${e.outputGlob ? JSON.stringify(e.outputGlob) : "null"} },`,
@@ -150,6 +160,7 @@ export interface FrameworkDev {
   cmd: string;
   port: number;
   bakedKey: string;
+  sourceDependencyFingerprint: string;
 }
 
 export const FRAMEWORK_DEV: Record<string, FrameworkDev> = {
diff --git a/runner/workers/api/src/dependency-metadata.ts b/runner/workers/api/src/dependency-metadata.ts
new file mode 100644
index 00000000..c9916306
--- /dev/null
+++ b/runner/workers/api/src/dependency-metadata.ts
@@ -0,0 +1,21 @@
+export interface DependencyMetadata {
+  packageJson: string | undefined;
+  pnpmLock: string | undefined;
+}
+
+/**
+ * Serialize dependency metadata unambiguously. Explicit markers ensure an absent
+ * lockfile cannot collide with an empty lockfile or a package file's contents.
+ */
+export function dependencyMetadataInput({ packageJson, pnpmLock }: DependencyMetadata): string {
+  const part = (name: string, value: string | undefined) =>
+    value === undefined ? `${name}:missing\n` : `${name}:${value.length}:${value}\n`;
+  return `${part("package.json", packageJson)}${part("pnpm-lock.yaml", pnpmLock)}`;
+}
+
+/** SHA-256 fingerprint using the Web Crypto API available in Cloudflare Workers. */
+export async function dependencyMetadataFingerprint(metadata: DependencyMetadata): Promise<string> {
+  const bytes = new TextEncoder().encode(dependencyMetadataInput(metadata));
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
diff --git a/runner/workers/api/src/index.ts b/runner/workers/api/src/index.ts
index b64d37ac..d6d8c029 100644
--- a/runner/workers/api/src/index.ts
+++ b/runner/workers/api/src/index.ts
@@ -9,6 +9,7 @@
 import { getSandbox, proxyToSandbox, Sandbox as SandboxBase } from "@cloudflare/sandbox";
 import type { Env } from "./env.js";
 import { FRAMEWORK_DEV, BUILD_CONFIG } from "./frameworks.generated.js";
+import { dependencyMetadataFingerprint } from "./dependency-metadata.js";
 import { authenticate } from "./auth.js";
 import { createDemo, getDemo, getDemoSource, invalidateDemo, serveDemoAsset, updateDemo, type DemoRow } from "./share.js";
 
@@ -151,21 +152,38 @@ export default {
         await writeFiles(sandbox, body.files);
         // Boot asynchronously (returns immediately; UI polls /status for live
         // progress). Dependency resolution, fastest first:
-        //   1. restore node_modules from the per-(framework,version) R2 cache;
+        //   1. restore node_modules from the per-(framework,version,metadata) R2 cache;
         //   2. else seed from the image's baked deps + a frozen pnpm install;
         //      fall back to non-frozen only when the editor or version injection
         //      changed package metadata relative to its source lockfile,
         //      then upload the result to the cache for next time.
         const cacheVer = (body.htVersion || "default").replace(/[^a-zA-Z0-9._-]/g, "-");
-        const cacheUrl = `${url.origin}/api/nmcache/${encodeURIComponent(body.framework)}/${encodeURIComponent(cacheVer)}`;
+        const dependencyFingerprint = await dependencyMetadataFingerprint({
+          packageJson: body.files["/package.json"],
+          pnpmLock: body.files["/pnpm-lock.yaml"],
+        });
+        const metadataDiffersFromStarter = dependencyFingerprint !== dev.sourceDependencyFingerprint;
+        const cacheUrl = `${url.origin}/api/nmcache/${encodeURIComponent(body.framework)}/${encodeURIComponent(cacheVer)}/${dependencyFingerprint}`;
+        const installDependencies = body.files["/pnpm-lock.yaml"] !== undefined
+          ? [
+              `if ! pnpm install --frozen-lockfile; then`,
+              metadataDiffersFromStarter
+                ? `  echo '::frozen install failed for custom metadata; retrying non-frozen::'; pnpm install --no-frozen-lockfile`
+                : `  echo '::error::frozen install failed for generated starter metadata; refusing to modify its lockfile' >&2; exit 1`,
+              `fi`,
+            ]
+          : metadataDiffersFromStarter
+            ? [`echo '::no lockfile for custom metadata; installing non-frozen::'; pnpm install --no-frozen-lockfile`]
+            : [`echo '::error::generated starter is missing its lockfile; refusing non-frozen install' >&2; exit 1`];
         const script = [
+          `set -e`,
           `cd ${CONTAINER_ROOT}`,
           `if curl -fsS ${shq(cacheUrl)} -o /tmp/nm.tgz 2>/dev/null && [ -s /tmp/nm.tgz ]; then`,
           `  echo '::restoring cached dependencies::'; tar xzf /tmp/nm.tgz`,
           `else`,
           `  echo '::installing dependencies (first run for this version)::'`,
           `  cp -al /baked/${dev.bakedKey}/node_modules ./node_modules 2>/dev/null || true`,
-          `  ${cfg.installCommand} || pnpm install --no-frozen-lockfile`,
+          ...installDependencies.map((line) => `  ${line}`),
           // Upload the cache in the background so it never delays the dev server.
           `  ( tar czf /tmp/nm.tgz node_modules 2>/dev/null && curl -fsS -X PUT --data-binary @/tmp/nm.tgz ${shq(cacheUrl)} >/dev/null 2>&1 ) &`,
           `fi`,
@@ -208,12 +226,14 @@ export default {
         return cors(new Response(null, { status: 204 }));
       }
 
-      // node_modules cache per (framework, version): GET restores, PUT stores.
-      // Keeps Tier-2 boots fast across versions (containers curl these directly).
-      if (parts[0] === "api" && parts[1] === "nmcache" && parts.length === 4) {
+      // node_modules cache per (framework, version, dependency metadata): GET
+      // restores, PUT stores. Keeps Tier-2 boots fast without sharing deps
+      // across package or lockfile contents.
+      if (parts[0] === "api" && parts[1] === "nmcache" && parts.length === 5) {
         const fw = parts[2]!.replace(/[^a-zA-Z0-9._-]/g, "-");
         const ver = parts[3]!.replace(/[^a-zA-Z0-9._-]/g, "-");
-        const key = `nmcache/${fw}/${ver}.tgz`;
+        const metadata = parts[4]!.replace(/[^a-f0-9]/g, "-");
+        const key = `nmcache/${fw}/${ver}/${metadata}.tgz`;
         if (request.method === "GET") {
           const obj = await env.ARTIFACTS.get(key);
           if (!obj) return new Response("miss", { status: 404 });

From 82f837b2996fddb75862c0dbc4c463e1488e20d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 14:40:52 +0200
Subject: [PATCH 03/15] runner: remove unsafe dependency cache

---
 runner/workers/api/src/index.ts | 44 ++++++---------------------------
 1 file changed, 7 insertions(+), 37 deletions(-)

diff --git a/runner/workers/api/src/index.ts b/runner/workers/api/src/index.ts
index d6d8c029..9bcc6729 100644
--- a/runner/workers/api/src/index.ts
+++ b/runner/workers/api/src/index.ts
@@ -151,19 +151,14 @@ export default {
 
         await writeFiles(sandbox, body.files);
         // Boot asynchronously (returns immediately; UI polls /status for live
-        // progress). Dependency resolution, fastest first:
-        //   1. restore node_modules from the per-(framework,version,metadata) R2 cache;
-        //   2. else seed from the image's baked deps + a frozen pnpm install;
-        //      fall back to non-frozen only when the editor or version injection
-        //      changed package metadata relative to its source lockfile,
-        //      then upload the result to the cache for next time.
-        const cacheVer = (body.htVersion || "default").replace(/[^a-zA-Z0-9._-]/g, "-");
+        // progress). Seed each session from the immutable baked dependencies,
+        // then reconcile them with pnpm. Keep submitted starters frozen; only
+        // custom package or lock metadata may update the lockfile.
         const dependencyFingerprint = await dependencyMetadataFingerprint({
           packageJson: body.files["/package.json"],
           pnpmLock: body.files["/pnpm-lock.yaml"],
         });
         const metadataDiffersFromStarter = dependencyFingerprint !== dev.sourceDependencyFingerprint;
-        const cacheUrl = `${url.origin}/api/nmcache/${encodeURIComponent(body.framework)}/${encodeURIComponent(cacheVer)}/${dependencyFingerprint}`;
         const installDependencies = body.files["/pnpm-lock.yaml"] !== undefined
           ? [
               `if ! pnpm install --frozen-lockfile; then`,
@@ -178,15 +173,10 @@ export default {
         const script = [
           `set -e`,
           `cd ${CONTAINER_ROOT}`,
-          `if curl -fsS ${shq(cacheUrl)} -o /tmp/nm.tgz 2>/dev/null && [ -s /tmp/nm.tgz ]; then`,
-          `  echo '::restoring cached dependencies::'; tar xzf /tmp/nm.tgz`,
-          `else`,
-          `  echo '::installing dependencies (first run for this version)::'`,
-          `  cp -al /baked/${dev.bakedKey}/node_modules ./node_modules 2>/dev/null || true`,
-          ...installDependencies.map((line) => `  ${line}`),
-          // Upload the cache in the background so it never delays the dev server.
-          `  ( tar czf /tmp/nm.tgz node_modules 2>/dev/null && curl -fsS -X PUT --data-binary @/tmp/nm.tgz ${shq(cacheUrl)} >/dev/null 2>&1 ) &`,
-          `fi`,
+          `echo '::seeding immutable baked dependencies::'`,
+          `cp -al /baked/${dev.bakedKey}/node_modules ./node_modules 2>/dev/null || true`,
+          `echo '::reconciling dependencies with pnpm::'`,
+          ...installDependencies,
           `echo '::starting dev server::'`,
           dev.cmd,
         ].join("\n");
@@ -226,26 +216,6 @@ export default {
         return cors(new Response(null, { status: 204 }));
       }
 
-      // node_modules cache per (framework, version, dependency metadata): GET
-      // restores, PUT stores. Keeps Tier-2 boots fast without sharing deps
-      // across package or lockfile contents.
-      if (parts[0] === "api" && parts[1] === "nmcache" && parts.length === 5) {
-        const fw = parts[2]!.replace(/[^a-zA-Z0-9._-]/g, "-");
-        const ver = parts[3]!.replace(/[^a-zA-Z0-9._-]/g, "-");
-        const metadata = parts[4]!.replace(/[^a-f0-9]/g, "-");
-        const key = `nmcache/${fw}/${ver}/${metadata}.tgz`;
-        if (request.method === "GET") {
-          const obj = await env.ARTIFACTS.get(key);
-          if (!obj) return new Response("miss", { status: 404 });
-          return new Response(obj.body, { headers: { "Content-Type": "application/gzip" } });
-        }
-        if (request.method === "PUT") {
-          if (!request.body) return new Response("no body", { status: 400 });
-          await env.ARTIFACTS.put(key, request.body);
-          return new Response(null, { status: 204 });
-        }
-      }
-
       // GET /api/session/:id/status?port=NNNN -> { ready, log } (boot progress)
       if (request.method === "GET" && parts[0] === "api" && parts[1] === "session" && parts[3] === "status") {
         const sandbox = liveSbx(env, parts[2]!);

From 4936536d6e22d7791e57e094f3e6f1405563adbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 14:40:56 +0200
Subject: [PATCH 04/15] runner: isolate sandbox dependency files

---
 runner/workers/api/src/index.ts | 53 ++++++++++++++++++++++++---------
 1 file changed, 39 insertions(+), 14 deletions(-)

diff --git a/runner/workers/api/src/index.ts b/runner/workers/api/src/index.ts
index 9bcc6729..c0271acf 100644
--- a/runner/workers/api/src/index.ts
+++ b/runner/workers/api/src/index.ts
@@ -32,6 +32,29 @@ const BOOT_LOG = "/tmp/boot.log";
 /** Single-quote a string for embedding in `sh -lc '...'`. */
 const shq = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`;
 
+class InvalidFilePathError extends Error {}
+
+/**
+ * Resolve the FilesMap's root-relative path convention under CONTAINER_ROOT.
+ * A single leading slash is accepted for compatibility, but never treated as
+ * a filesystem-absolute path.
+ */
+function resolveContainerPath(path: string): string {
+  if (typeof path !== "string" || path.length === 0) throw new InvalidFilePathError("file path is required");
+  const relative = path.startsWith("/") ? path.slice(1) : path;
+  const segments = relative.split("/");
+  if (
+    relative.length === 0
+    || path.startsWith("//")
+    || path.includes("\\")
+    || path.includes("\0")
+    || segments.some((segment) => segment.length === 0 || segment === "." || segment === ".." || segment === "node_modules")
+  ) {
+    throw new InvalidFilePathError(`invalid file path: ${path}`);
+  }
+  return `${CONTAINER_ROOT}/${segments.join("/")}`;
+}
+
 // Minimal structural view of the Sandbox stub — avoids deep instantiation of the
 // full RPC proxy type (TS2589) while typing exactly the methods we call.
 type SandboxLike = {
@@ -99,11 +122,14 @@ function publicView(row: DemoRow) {
   };
 }
 
-/** Write a FilesMap ("/path" -> contents) into CONTAINER_ROOT, creating dirs. */
+/** Write a validated FilesMap into CONTAINER_ROOT, creating directories. */
 async function writeFiles(sandbox: SandboxLike, files: Record<string, string>) {
   const dirs = new Set<string>();
-  for (const p of Object.keys(files)) {
-    const full = CONTAINER_ROOT + (p.startsWith("/") ? p : `/${p}`);
+  const resolvedFiles = Object.entries(files).map(([path, contents]) => ({
+    full: resolveContainerPath(path),
+    contents,
+  }));
+  for (const { full } of resolvedFiles) {
     const dir = full.slice(0, full.lastIndexOf("/"));
     if (dir && dir !== CONTAINER_ROOT) dirs.add(dir);
   }
@@ -114,8 +140,7 @@ async function writeFiles(sandbox: SandboxLike, files: Record<string, string>) {
       /* dir may exist */
     }
   }
-  for (const [p, contents] of Object.entries(files)) {
-    const full = CONTAINER_ROOT + (p.startsWith("/") ? p : `/${p}`);
+  for (const { full, contents } of resolvedFiles) {
     await sandbox.writeFile(full, contents);
   }
 }
@@ -151,9 +176,9 @@ export default {
 
         await writeFiles(sandbox, body.files);
         // Boot asynchronously (returns immediately; UI polls /status for live
-        // progress). Seed each session from the immutable baked dependencies,
-        // then reconcile them with pnpm. Keep submitted starters frozen; only
-        // custom package or lock metadata may update the lockfile.
+        // progress). Start with immutable baked dependencies, then reconcile
+        // them with pnpm. Keep submitted starters frozen; only custom package
+        // or lock metadata may update the lockfile.
         const dependencyFingerprint = await dependencyMetadataFingerprint({
           packageJson: body.files["/package.json"],
           pnpmLock: body.files["/pnpm-lock.yaml"],
@@ -174,7 +199,8 @@ export default {
           `set -e`,
           `cd ${CONTAINER_ROOT}`,
           `echo '::seeding immutable baked dependencies::'`,
-          `cp -al /baked/${dev.bakedKey}/node_modules ./node_modules 2>/dev/null || true`,
+          `rm -rf ./node_modules`,
+          `cp -al /baked/${dev.bakedKey}/node_modules ./node_modules`,
           `echo '::reconciling dependencies with pnpm::'`,
           ...installDependencies,
           `echo '::starting dev server::'`,
@@ -196,7 +222,7 @@ export default {
         const sessionId = parts[2]!;
         const body = (await request.json()) as { path: string; contents: string };
         const sandbox = liveSbx(env, sessionId);
-        const full = CONTAINER_ROOT + (body.path.startsWith("/") ? body.path : `/${body.path}`);
+        const full = resolveContainerPath(body.path);
         const dir = full.slice(0, full.lastIndexOf("/"));
         if (dir && dir !== CONTAINER_ROOT) {
           try { await sandbox.mkdir(dir, { recursive: true }); } catch { /* exists */ }
@@ -209,10 +235,8 @@ export default {
       if (request.method === "DELETE" && parts[0] === "api" && parts[1] === "session" && parts[3] === "file") {
         const sandbox = liveSbx(env, parts[2]!);
         const p = url.searchParams.get("path") ?? "";
-        if (p) {
-          const full = CONTAINER_ROOT + (p.startsWith("/") ? p : `/${p}`);
-          try { await sandbox.exec(`sh -lc "rm -f ${shq(full)}"`); } catch { /* best effort */ }
-        }
+        const full = resolveContainerPath(p);
+        try { await sandbox.exec(`sh -lc "rm -f ${shq(full)}"`); } catch { /* best effort */ }
         return cors(new Response(null, { status: 204 }));
       }
 
@@ -401,6 +425,7 @@ export default {
 
       return cors(new Response("Not found", { status: 404 }));
     } catch (err) {
+      if (err instanceof InvalidFilePathError) return json({ error: err.message }, 400);
       return json({ error: err instanceof Error ? err.message : String(err) }, 500);
     }
   },

From 2e530e6cb025c5b133f54cb4cd650f8442f21d25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 14:41:06 +0200
Subject: [PATCH 05/15] runner: validate sandbox file operations

---
 runner/packages/runtime/src/container.ts | 17 ++++--
 runner/scripts/prepare-container.mjs     |  6 +--
 runner/scripts/warm.ts                   |  5 +-
 runner/workers/api/src/index.ts          | 66 ++++++++++++++++--------
 4 files changed, 65 insertions(+), 29 deletions(-)

diff --git a/runner/packages/runtime/src/container.ts b/runner/packages/runtime/src/container.ts
index b8de75a1..2f826427 100644
--- a/runner/packages/runtime/src/container.ts
+++ b/runner/packages/runtime/src/container.ts
@@ -11,6 +11,17 @@
 import type { CatalogEntry, DemoRuntime, FilesMap, HandsontableVersionRef } from "./types.js";
 import { applyHandsontableVersion } from "./version.js";
 
+/** The live-session API accepts only relative POSIX paths. */
+function relativeFiles(files: FilesMap): FilesMap {
+  return Object.fromEntries(
+    Object.entries(files).map(([path, contents]) => [relativePath(path), contents]),
+  );
+}
+
+function relativePath(path: string): string {
+  return path.startsWith("/") ? path.slice(1) : path;
+}
+
 export interface ContainerRuntimeOptions {
   /** The shell's preview-iframe slot; its src is set to the container preview URL. */
   iframe: HTMLIFrameElement;
@@ -85,7 +96,7 @@ export class ContainerRuntime implements DemoRuntime {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({
         framework: this.entry.framework,
-        files: this.files,
+        files: relativeFiles(this.files),
         sessionId: this.opts.sessionId,
         htVersion: this.opts.version?.ref,
       }),
@@ -169,7 +180,7 @@ export class ContainerRuntime implements DemoRuntime {
     delete next[path];
     this.files = next;
     void fetch(
-      `${this.opts.apiBase}/api/session/${this.sessionId}/file?path=${encodeURIComponent(path)}`,
+      `${this.opts.apiBase}/api/session/${this.sessionId}/file?path=${encodeURIComponent(relativePath(path))}`,
       { method: "DELETE" },
     ).catch(() => {});
   }
@@ -195,7 +206,7 @@ export class ContainerRuntime implements DemoRuntime {
         await fetch(`${this.opts.apiBase}/api/session/${this.sessionId}/file`, {
           method: "POST",
           headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ path, contents }),
+          body: JSON.stringify({ path: relativePath(path), contents }),
         });
       } catch (e) {
         this.emitError(e instanceof Error ? e : new Error(String(e)));
diff --git a/runner/scripts/prepare-container.mjs b/runner/scripts/prepare-container.mjs
index 6b736edb..fff5c979 100644
--- a/runner/scripts/prepare-container.mjs
+++ b/runner/scripts/prepare-container.mjs
@@ -1,13 +1,13 @@
 // Generate the Tier-2 container assets from the catalog:
 //   - containers/live/Dockerfile        one generic image with each container
 //                                       framework's node_modules baked into
-//                                       /baked/<key> (fast, install-free boots)
+//                                       /baked/<key> (fast frozen pnpm reconciliation)
 //   - containers/live/baked/<key>/package.json   deps to bake (default version)
 //   - workers/api/src/frameworks.generated.ts    FRAMEWORK_DEV + BUILD_CONFIG
 //
 // The live image is shared by ALL container-engine examples (proxyToSandbox
 // needs one `Sandbox` namespace). At session start the Worker hardlink-copies
-// the baked node_modules into /app, so a default-version boot skips install.
+// the baked node_modules into /app, then runs fast frozen pnpm reconciliation.
 //
 // Usage: node scripts/prepare-container.mjs
 
@@ -122,7 +122,7 @@ function writeBakedContexts() {
   const dockerfile = `# Generated by scripts/prepare-container.mjs — do not edit by hand.
 # One generic Tier-2 image. Each framework's node_modules is baked into
 # /baked/<key>; the Worker hardlink-copies the right one into /app at session
-# start so a default-version boot skips \`pnpm install\`. proxyToSandbox requires
+# start, then runs fast frozen pnpm reconciliation. proxyToSandbox requires
 # a single \`Sandbox\` namespace, hence one shared image.
 FROM ${SANDBOX_IMAGE}
 
diff --git a/runner/scripts/warm.ts b/runner/scripts/warm.ts
index 8014c613..75f53d3a 100644
--- a/runner/scripts/warm.ts
+++ b/runner/scripts/warm.ts
@@ -80,11 +80,14 @@ async function warmRender(framework: string, version: string) {
 
 async function warmTier2Container(framework: string) {
   const ex = catalog.examples.find((e: { framework: string }) => e.framework === framework);
+  const files = Object.fromEntries(
+    Object.entries(ex.files).map(([path, contents]) => [path.startsWith("/") ? path.slice(1) : path, contents]),
+  );
   try {
     const res = await fetch(`${API_BASE}/api/session`, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ framework, files: ex.files }),
+      body: JSON.stringify({ framework, files }),
     });
     console.log(`[warm] container ${framework}: HTTP ${res.status}`);
   } catch (e) {
diff --git a/runner/workers/api/src/index.ts b/runner/workers/api/src/index.ts
index c0271acf..bef27c10 100644
--- a/runner/workers/api/src/index.ts
+++ b/runner/workers/api/src/index.ts
@@ -29,23 +29,18 @@ export class BuilderSandbox extends SandboxBase {}
 
 const CONTAINER_ROOT = "/app";
 const BOOT_LOG = "/tmp/boot.log";
-/** Single-quote a string for embedding in `sh -lc '...'`. */
+/** Single-quote a trusted command fragment for embedding in `sh -lc`. */
 const shq = (s: string) => `'${s.replace(/'/g, `'\\''`)}'`;
-
 class InvalidFilePathError extends Error {}
 
 /**
- * Resolve the FilesMap's root-relative path convention under CONTAINER_ROOT.
- * A single leading slash is accepted for compatibility, but never treated as
- * a filesystem-absolute path.
+ * Resolve a nonempty relative POSIX path under CONTAINER_ROOT.
  */
-function resolveContainerPath(path: string): string {
+function resolveContainerPath(path: unknown): string {
   if (typeof path !== "string" || path.length === 0) throw new InvalidFilePathError("file path is required");
-  const relative = path.startsWith("/") ? path.slice(1) : path;
-  const segments = relative.split("/");
+  const segments = path.split("/");
   if (
-    relative.length === 0
-    || path.startsWith("//")
+    path.startsWith("/")
     || path.includes("\\")
     || path.includes("\0")
     || segments.some((segment) => segment.length === 0 || segment === "." || segment === ".." || segment === "node_modules")
@@ -55,11 +50,36 @@ function resolveContainerPath(path: string): string {
   return `${CONTAINER_ROOT}/${segments.join("/")}`;
 }
 
+function isPlainRecord(value: unknown): value is Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+
+/** Validate the full file map before creating any directories or files. */
+function validateFiles(files: unknown): Record<string, string> {
+  if (!isPlainRecord(files)) throw new InvalidFilePathError("files must be a plain record");
+  for (const [path, contents] of Object.entries(files)) {
+    resolveContainerPath(path);
+    if (typeof contents !== "string") throw new InvalidFilePathError(`contents must be a string: ${path}`);
+  }
+  return files as Record<string, string>;
+}
+
+function validateFileWrite(body: unknown): { path: string; contents: string } {
+  if (!isPlainRecord(body)) throw new InvalidFilePathError("file write must be a plain record");
+  const { path, contents } = body;
+  const full = resolveContainerPath(path);
+  if (typeof contents !== "string") throw new InvalidFilePathError("contents must be a string");
+  return { path: full, contents };
+}
+
 // Minimal structural view of the Sandbox stub — avoids deep instantiation of the
 // full RPC proxy type (TS2589) while typing exactly the methods we call.
 type SandboxLike = {
   mkdir(path: string, opts?: { recursive?: boolean }): Promise<unknown>;
   writeFile(path: string, contents: string): Promise<unknown>;
+  deleteFile(path: string): Promise<unknown>;
   exec(cmd: string): Promise<{ success?: boolean; stdout?: string; stderr?: string }>;
   startProcess(cmd: string, opts?: { cwd?: string; env?: Record<string, string> }): Promise<unknown>;
   exposePort(port: number, opts?: { hostname?: string }): Promise<{ url?: string; exposedAt?: string }>;
@@ -161,30 +181,32 @@ export default {
     try {
       // POST /api/session  { framework, files, sessionId? } -> { sessionId, previewUrl }
       if (request.method === "POST" && parts[0] === "api" && parts[1] === "session" && parts.length === 2) {
-        const body = (await request.json()) as {
+        const body = await request.json() as {
           framework: string;
-          files: Record<string, string>;
+          files: unknown;
           sessionId?: string;
           htVersion?: string;
         };
+        if (!isPlainRecord(body)) return json({ error: "request body must be a plain record" }, 400);
         const dev = FRAMEWORK_DEV[body.framework];
         const cfg = BUILD_CONFIG[body.framework];
         if (!dev || !cfg) return json({ error: `Tier-2 not wired for framework: ${body.framework}` }, 400);
+        const files = validateFiles(body.files);
 
         const sessionId = body.sessionId?.trim() || sessionIdFor(body.framework);
         const sandbox = liveSbx(env, sessionId);
 
-        await writeFiles(sandbox, body.files);
+        await writeFiles(sandbox, files);
         // Boot asynchronously (returns immediately; UI polls /status for live
-        // progress). Start with immutable baked dependencies, then reconcile
-        // them with pnpm. Keep submitted starters frozen; only custom package
-        // or lock metadata may update the lockfile.
+        // progress). Default boot seeds immutable baked dependencies, then runs
+        // fast frozen pnpm reconciliation. Keep submitted starters frozen; only
+        // custom package or lock metadata may update the lockfile.
         const dependencyFingerprint = await dependencyMetadataFingerprint({
-          packageJson: body.files["/package.json"],
-          pnpmLock: body.files["/pnpm-lock.yaml"],
+          packageJson: files["package.json"],
+          pnpmLock: files["pnpm-lock.yaml"],
         });
         const metadataDiffersFromStarter = dependencyFingerprint !== dev.sourceDependencyFingerprint;
-        const installDependencies = body.files["/pnpm-lock.yaml"] !== undefined
+        const installDependencies = files["pnpm-lock.yaml"] !== undefined
           ? [
               `if ! pnpm install --frozen-lockfile; then`,
               metadataDiffersFromStarter
@@ -220,9 +242,9 @@ export default {
       // POST /api/session/:id/file  { path, contents } -> 204   (streams an edit; HMR picks it up)
       if (request.method === "POST" && parts[0] === "api" && parts[1] === "session" && parts[3] === "file") {
         const sessionId = parts[2]!;
-        const body = (await request.json()) as { path: string; contents: string };
+        const body = validateFileWrite(await request.json());
         const sandbox = liveSbx(env, sessionId);
-        const full = resolveContainerPath(body.path);
+        const full = body.path;
         const dir = full.slice(0, full.lastIndexOf("/"));
         if (dir && dir !== CONTAINER_ROOT) {
           try { await sandbox.mkdir(dir, { recursive: true }); } catch { /* exists */ }
@@ -236,7 +258,7 @@ export default {
         const sandbox = liveSbx(env, parts[2]!);
         const p = url.searchParams.get("path") ?? "";
         const full = resolveContainerPath(p);
-        try { await sandbox.exec(`sh -lc "rm -f ${shq(full)}"`); } catch { /* best effort */ }
+        try { await sandbox.deleteFile(full); } catch { /* best effort */ }
         return cors(new Response(null, { status: 204 }));
       }
 

From 529ffbd6e3effb6b0662b65e2e426f56d5fc8611 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 15:23:36 +0200
Subject: [PATCH 06/15] runner: fix stale container-engine unreachable error
 message

The message named only Vue/Angular from when those were the only
container-engine examples; it now covers react-js, ant-design, mui,
and base-web too, and was masking real session-start errors behind
confusing wording.
---
 runner/apps/authoring/src/App.tsx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/runner/apps/authoring/src/App.tsx b/runner/apps/authoring/src/App.tsx
index d06a9eab..0a4aaebe 100644
--- a/runner/apps/authoring/src/App.tsx
+++ b/runner/apps/authoring/src/App.tsx
@@ -49,7 +49,7 @@ function docsPageUrl(framework: string, permalink: string): string {
 function describeRuntimeError(e: unknown, engine: string): string {
   const msg = e instanceof Error ? e.message : String(e);
   if (engine === "container" && /failed to fetch|networkerror|load failed|session start failed|fetch/i.test(msg)) {
-    return "Vue and Angular examples run on the container engine, which needs the demo server (Cloudflare Sandbox). It isn't reachable here — run the local API worker (requires Docker) or open this example on the deployed demos.handsontable.com.";
+    return "This example runs on the container engine, which needs the demo server (Cloudflare Sandbox). It isn't reachable here — run the local API worker (requires Docker) or open this example on the deployed demos.handsontable.com.";
   }
   return msg;
 }

From 6ec55bb2cb3499d90d1d00b260f57d62787960cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 15:33:17 +0200
Subject: [PATCH 07/15] runner: use pnpm exec for container dev servers, not
 pnpm run -- --flags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pnpm (10.33-10.34), unlike npm, does not strip the -- separator when
the target script resolves to a real binary — it forwards a literal
"--" as the script's first argument. Vite's CLI treats that as "stop
parsing options," so --host/--port silently become inert positional
args instead of flags, and the dev server never actually binds where
the readiness probe expects it (stuck "Booting preview..." forever).

Switch react-js/ant-design/mui/base-web/remix to `pnpm exec <bin>
<flags>`, matching vue's already-correct invocation.
---
 runner/scripts/prepare-container.mjs | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/runner/scripts/prepare-container.mjs b/runner/scripts/prepare-container.mjs
index fff5c979..38ae1e6e 100644
--- a/runner/scripts/prepare-container.mjs
+++ b/runner/scripts/prepare-container.mjs
@@ -28,17 +28,21 @@ const COREPACK_BIN = "node /usr/local/lib/node_modules/corepack/dist/corepack.js
 
 // Dev-server command + port per framework. NOTE: port 3000 is reserved by the
 // Cloudflare Sandbox control plane — dev servers must use another port.
+// NOTE: use `pnpm exec <bin> <flags>`, not `pnpm run <script> -- <flags>` — pnpm
+// (unlike npm) does not strip the `--` separator when the script resolves to a
+// real binary, so the binary receives a literal "--" as its first arg and its
+// CLI treats everything after it as positional, silently dropping --host/--port.
 const DEV = {
-  remix: { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
+  remix: { cmd: "pnpm exec remix vite:dev --host 0.0.0.0 --port 5173", port: 5173 },
   angular: { cmd: "pnpm exec ng serve --host 0.0.0.0 --port 4200 --disable-host-check", port: 4200 },
   "next.js": { cmd: "pnpm exec next dev -p 3001 -H 0.0.0.0", port: 3001 },
   "next-shadcn.js": { cmd: "pnpm exec next dev -p 3001 -H 0.0.0.0", port: 3001 },
   astro: { cmd: "pnpm exec astro dev --host 0.0.0.0 --port 4321", port: 4321 },
   nuxt: { cmd: "pnpm exec nuxt dev -H 0.0.0.0 -p 3001", port: 3001 },
-  "react-js": { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
-  "ant-design": { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
-  mui: { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
-  "base-web": { cmd: "pnpm run dev -- --host 0.0.0.0 --port 5173", port: 5173 },
+  "react-js": { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },
+  "ant-design": { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },
+  mui: { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },
+  "base-web": { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },
   // Documentation-guide Vue examples use `<script setup>` (unsupported by the
   // in-browser bundler), so they run on the container engine via real Vite.
   vue: { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },

From 902b0eff334e27563840c12af28b938b7c236558 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 15:43:39 +0200
Subject: [PATCH 08/15] runner: document PREVIEW_HOST local-dev override

wrangler.jsonc sets PREVIEW_HOST to demos.handsontable.com unconditionally
(vars apply to both wrangler dev and wrangler deploy), a real public
wildcard that routes to the deployed worker, not the local one. Container
preview sessions started via local wrangler dev were getting a previewUrl
on that domain, so the iframe hit prod and got INVALID_TOKEN for a
session/token prod never issued. Overriding PREVIEW_HOST="" in .dev.vars
falls back to the request host, resolving as *.localhost:8787 (RFC 6761)
back to the local worker.
---
 runner/docs/run-and-deploy.md | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/runner/docs/run-and-deploy.md b/runner/docs/run-and-deploy.md
index d78e89c1..0595929a 100644
--- a/runner/docs/run-and-deploy.md
+++ b/runner/docs/run-and-deploy.md
@@ -25,7 +25,7 @@ pnpm --filter @handsontable/demo-runtime build
 pnpm --filter @handsontable/demo-authoring dev        # http://localhost:5173
 
 # Full stack (Tier-2 containers + sharing): needs Docker.
-cd workers/api && printf 'DEV_AUTH_EMAIL="dev@handsontable.com"\n' > .dev.vars
+cd workers/api && printf 'DEV_AUTH_EMAIL="dev@handsontable.com"\nPREVIEW_HOST=""\n' > .dev.vars
 npx wrangler d1 execute handsontable-demos --local --file=migrations/0001_init.sql -y
 npx wrangler d1 execute handsontable-demos --local --file=migrations/0002_buildkey_nonunique.sql -y
 npx wrangler dev --port 8787                          # builds the container images
@@ -36,6 +36,12 @@ npx vite --port 5173
 ```
 
 `.dev.vars` and `.env.local` are gitignored dev-only bypasses — never used in prod.
+`PREVIEW_HOST=""` overrides the `wrangler.jsonc` default (`demos.handsontable.com`,
+a real public wildcard that routes to the *deployed* worker) so container preview
+URLs fall back to the request host — resolving as `*.localhost:8787`, which every
+browser/OS treats as `127.0.0.1` (RFC 6761) and reaches your local `wrangler dev`.
+Without it, Tier-2/container sessions boot fine but the preview iframe fails with
+`INVALID_TOKEN` — the token is only known to your local session, not to prod.
 
 ## Deploy (main Handsontable account)
 

From bdfbd985e392160212d89c92f486d12935f3f972 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 16:57:23 +0200
Subject: [PATCH 09/15] runner: move worker routes to deploy-time flags to
 unbreak local preview
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When routes are declared in wrangler.jsonc, wrangler dev simulates the
first route's host on every request (request.url and Host both become
demos.handsontable.com regardless of the actual request hostname; only
the pathname passes through). That destroys the
<port>-<sandboxId>-<token>.* preview hostnames the Sandbox SDK's
proxyToSandbox() routes by, so Tier-2 local preview could never work —
no PREVIEW_HOST value could fix it. There is no config key or CLI flag
to disable the simulation (wrangler gates it on inferOriginFromRoutes,
which only the programmatic startWorker API can set).

Declare no routes in wrangler.jsonc and attach the production routes
via `wrangler deploy --routes …` in the deploy script instead. With no
routes, wrangler dev passes the real Host through verbatim, so
*.localhost:8787 preview URLs (PREVIEW_HOST="localhost:8787" in
.dev.vars) flow through the exact same proxyToSandbox() path as
production — HTML, assets, and the HMR WebSocket all verified working
locally, including two concurrent sessions and token rejection.

Also corrects the local-dev docs from the previous commit: an
empty-string PREVIEW_HOST override is silently ignored by wrangler; it
must be set to a real value, and removing routes from the dev config is
the other required half of the recipe.

Caveat: the --routes flags cannot carry zone_name; wrangler infers the
zone on real deploys (dry-run validated the flags but not inference) —
watch the first production deploy.
---
 runner/docs/run-and-deploy.md     | 30 +++++++++++++++++++-----------
 runner/workers/api/package.json   |  2 +-
 runner/workers/api/wrangler.jsonc | 21 ++++++++++-----------
 3 files changed, 30 insertions(+), 23 deletions(-)

diff --git a/runner/docs/run-and-deploy.md b/runner/docs/run-and-deploy.md
index 0595929a..21b8dedf 100644
--- a/runner/docs/run-and-deploy.md
+++ b/runner/docs/run-and-deploy.md
@@ -25,7 +25,7 @@ pnpm --filter @handsontable/demo-runtime build
 pnpm --filter @handsontable/demo-authoring dev        # http://localhost:5173
 
 # Full stack (Tier-2 containers + sharing): needs Docker.
-cd workers/api && printf 'DEV_AUTH_EMAIL="dev@handsontable.com"\nPREVIEW_HOST=""\n' > .dev.vars
+cd workers/api && printf 'DEV_AUTH_EMAIL="dev@handsontable.com"\nPREVIEW_HOST="localhost:8787"\n' > .dev.vars
 npx wrangler d1 execute handsontable-demos --local --file=migrations/0001_init.sql -y
 npx wrangler d1 execute handsontable-demos --local --file=migrations/0002_buildkey_nonunique.sql -y
 npx wrangler dev --port 8787                          # builds the container images
@@ -36,13 +36,20 @@ npx vite --port 5173
 ```
 
 `.dev.vars` and `.env.local` are gitignored dev-only bypasses — never used in prod.
-`PREVIEW_HOST=""` overrides the `wrangler.jsonc` default (`demos.handsontable.com`,
-a real public wildcard that routes to the *deployed* worker) so container preview
-URLs fall back to the request host — resolving as `*.localhost:8787`, which every
-browser/OS treats as `127.0.0.1` (RFC 6761) and reaches your local `wrangler dev`.
+`PREVIEW_HOST="localhost:8787"` overrides the `wrangler.jsonc` default
+(`demos.handsontable.com`, a real public wildcard that routes to the *deployed*
+worker) so container preview URLs come out as `*.localhost:8787`, which browsers
+treat as `127.0.0.1` (RFC 6761) and reach your local `wrangler dev`. It must be a
+real host value — wrangler silently ignores empty-string `.dev.vars` overrides.
 Without it, Tier-2/container sessions boot fine but the preview iframe fails with
 `INVALID_TOKEN` — the token is only known to your local session, not to prod.
 
+This only works because `wrangler.jsonc` declares **no `routes`**: when routes
+are present, `wrangler dev` simulates the first route's host on every request,
+destroying the preview subdomain before `proxyToSandbox()` can route on it.
+That's why the production routes live in the `deploy` script instead — don't
+move them back into `wrangler.jsonc`.
+
 ## Deploy (main Handsontable account)
 
 ```bash
@@ -52,7 +59,7 @@ export CLOUDFLARE_ACCOUNT_ID=15111272c53ed0aaf84a908f0c9c7f8b
 cd workers/api
 npx wrangler d1 execute handsontable-demos --remote --file=migrations/0001_init.sql -y
 npx wrangler d1 execute handsontable-demos --remote --file=migrations/0002_buildkey_nonunique.sql -y
-npx wrangler deploy
+pnpm run deploy   # wrangler deploy --routes … (attaches the demos.handsontable.com routes)
 # -> https://handsontable-demos-api.handsoncode.workers.dev
 
 # Authoring app (static SPA worker):
@@ -67,11 +74,12 @@ npx wrangler deploy
 Container preview URLs need a wildcard custom domain (`*.workers.dev` won't work —
 ADR-0011):
 
-1. Create `*.demos.handsontable.com` (proxied) → the `handsontable-demos-api`
-   Worker (Dashboard → Workers Routes / custom domain on the `handsontable.com`
-   zone). Requires DNS-edit permission on the zone.
-2. Set the Worker var `PREVIEW_HOST=demos.handsontable.com` in `wrangler.jsonc`
-   and `wrangler deploy`.
+1. Create the `*.demos.handsontable.com` DNS record (proxied) on the
+   `handsontable.com` zone. Requires DNS-edit permission on the zone.
+2. Keep the Worker var `PREVIEW_HOST=demos.handsontable.com` in `wrangler.jsonc`
+   and run `pnpm run deploy` — the worker routes themselves are attached by the
+   deploy script's `--routes` flags (they are deliberately not in
+   `wrangler.jsonc`; see "Run locally" above).
 
 Static shares (`/d/:id`) and docs embeds (`/embed/:id`) do **not** need this.
 
diff --git a/runner/workers/api/package.json b/runner/workers/api/package.json
index 05f46ec4..ad91233b 100644
--- a/runner/workers/api/package.json
+++ b/runner/workers/api/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "scripts": {
     "dev": "wrangler dev",
-    "deploy": "wrangler deploy",
+    "deploy": "wrangler deploy --routes '*.demos.handsontable.com/*' --routes 'demos.handsontable.com/api/*' --routes 'demos.handsontable.com/d/*' --routes 'demos.handsontable.com/embed/*'",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
diff --git a/runner/workers/api/wrangler.jsonc b/runner/workers/api/wrangler.jsonc
index 4e56d336..063dabaa 100644
--- a/runner/workers/api/wrangler.jsonc
+++ b/runner/workers/api/wrangler.jsonc
@@ -8,7 +8,8 @@
   "compatibility_date": "2026-06-01",
   "compatibility_flags": ["nodejs_compat"],
   "observability": { "enabled": true },
-  // Keep the workers.dev URL enabled alongside the custom wildcard route.
+  // Keep the workers.dev URL enabled alongside the custom-domain routes
+  // (attached at deploy time — see the `deploy` script and the routes note below).
   "workers_dev": true,
 
   // Public, non-secret config.
@@ -20,16 +21,14 @@
     "PREVIEW_HOST": "demos.handsontable.com"
   },
 
-  // Routes on demos.handsontable.com: the wildcard serves container preview URLs;
-  // the base-host path routes serve the API, shared demos, and embeds
-  // (the authoring app owns the catch-all demos.handsontable.com/*).
-  // workers.dev stays enabled too.
-  "routes": [
-    { "pattern": "*.demos.handsontable.com/*", "zone_name": "handsontable.com" },
-    { "pattern": "demos.handsontable.com/api/*", "zone_name": "handsontable.com" },
-    { "pattern": "demos.handsontable.com/d/*", "zone_name": "handsontable.com" },
-    { "pattern": "demos.handsontable.com/embed/*", "zone_name": "handsontable.com" }
-  ],
+  // Routes on demos.handsontable.com are deliberately NOT declared here — they
+  // are passed via `--routes` in the `deploy` script (package.json). When routes
+  // are present in this file, `wrangler dev` simulates the first route's host on
+  // EVERY request (request.url and Host become demos.handsontable.com), which
+  // destroys the <port>-<sandboxId>-<token>.* preview hostnames that
+  // proxyToSandbox() routes by, breaking Tier-2 local preview entirely.
+  // With no routes here, wrangler dev passes the real Host through and
+  // *.localhost:8787 preview URLs hit the same proxy path as production.
 
   // D1 — demo metadata + short ids (account 15111272, region EEUR).
   "d1_databases": [

From f544a0c13c496fab1adebc6826101dc273fc401e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Tue, 14 Jul 2026 17:00:34 +0200
Subject: [PATCH 10/15] =?UTF-8?q?runner:=20ADR-0020=20=E2=80=94=20worker?=
 =?UTF-8?q?=20routes=20live=20in=20the=20deploy=20command?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Records why wrangler.jsonc must not declare routes (wrangler dev
simulates the first route's host on every request, destroying the
preview hostnames proxyToSandbox routes by), corrects ADR-0011's
local-dev claim, and documents the rejected path-based-proxy
alternative and the deploy-time zone-inference caveat.
---
 ...020-routes-in-deploy-command-not-config.md | 37 +++++++++++++++++++
 runner/docs/adr/README.md                     |  3 +-
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 runner/docs/adr/0020-routes-in-deploy-command-not-config.md

diff --git a/runner/docs/adr/0020-routes-in-deploy-command-not-config.md b/runner/docs/adr/0020-routes-in-deploy-command-not-config.md
new file mode 100644
index 00000000..e6558460
--- /dev/null
+++ b/runner/docs/adr/0020-routes-in-deploy-command-not-config.md
@@ -0,0 +1,37 @@
+# ADR-0020: Worker routes live in the deploy command, not wrangler.jsonc
+
+**Status:** Accepted
+
+## Context
+When `wrangler.jsonc` declares `routes`, `wrangler dev` simulates the first
+route's host on every request: `request.url` and `Host` become
+`demos.handsontable.com` no matter what hostname the request actually targeted;
+only the pathname passes through. This destroys the
+`<port>-<sandboxId>-<token>.*` preview hostnames that the Sandbox SDK's
+`proxyToSandbox()` routes by, so Tier-2 local preview can never work while
+routes are in the config — no `PREVIEW_HOST` value helps. Wrangler has no
+config key or CLI flag to disable the simulation (`inferOriginFromRoutes` is
+only settable via the programmatic `startWorker` API); `--host` merely
+simulates a different fixed host. This corrects ADR-0011's claim that local
+`wrangler dev` "works via `*.localhost`" — that was true only before the
+routes block was added. An alternative (path-based `/__preview/<encoded>/`
+proxying with Referer-based asset routing) was rejected: it would exercise a
+different code path locally than in production and likely break HMR, since
+WebSocket upgrades don't reliably carry `Referer`.
+
+## Decision
+Declare no `routes` in `wrangler.jsonc`. Attach the production routes at
+deploy time via `wrangler deploy --routes …` in the api worker's `deploy`
+script (package.json), keeping the patterns versioned. Local dev sets
+`PREVIEW_HOST="localhost:8787"` in `.dev.vars` (a real value — wrangler
+silently ignores empty-string overrides).
+
+## Consequences
+- `wrangler dev` passes the real `Host` through, so `*.localhost:8787` preview
+  URLs flow through the same `proxyToSandbox()` path as production — verified:
+  HTML, assets, HMR WebSocket, live file edits, concurrent sessions.
+- `--routes` cannot carry `zone_name`; wrangler infers the zone on real
+  deploys (errors loudly if it can't). Unverified as of this ADR — watch the
+  first deploy; fallback is dashboard-managed routes.
+- Routes must never move back into `wrangler.jsonc`; doing so silently breaks
+  local Tier-2 preview for every container-engine framework.
diff --git a/runner/docs/adr/README.md b/runner/docs/adr/README.md
index 356285fe..8ed656e4 100644
--- a/runner/docs/adr/README.md
+++ b/runner/docs/adr/README.md
@@ -16,7 +16,7 @@ once Accepted.
 | [0008](0008-per-user-demos-and-fork-flow.md) | Per-user demos + fork flow | Accepted |
 | [0009](0009-docs-only-embed.md) | Docs-only embeddable URL (frame-ancestors) | Accepted |
 | [0010](0010-deploy-to-main-handsontable-account.md) | Deploy to the main Handsontable Cloudflare account | Accepted |
-| [0011](0011-tier2-preview-urls-need-wildcard-domain.md) | Tier-2 preview URLs need a wildcard custom domain | Accepted |
+| [0011](0011-tier2-preview-urls-need-wildcard-domain.md) | Tier-2 preview URLs need a wildcard custom domain | Accepted (local-dev claim corrected by 0020) |
 | [0012](0012-one-image-and-do-class-per-framework.md) | One container image + DO class per framework | Accepted |
 | [0013](0013-sandpack-classic-bundler.md) | Sandpack classic in-browser bundler for Tier 1 | Accepted |
 | [0014](0014-storage-d1-r2-kv.md) | Storage split: D1 + R2 + KV | Accepted |
@@ -25,3 +25,4 @@ once Accepted.
 | [0017](0017-keep-render-ms-until-replaced.md) | Keep render-ms running; compat shim; remove later | Superseded by 0019 |
 | [0018](0018-no-ai-attribution.md) | No AI attribution in history or code | Accepted |
 | [0019](0019-docs-guide-examples-and-render-ms-removal.md) | Documentation-guide examples in the runner; remove render-ms | Accepted |
+| [0020](0020-routes-in-deploy-command-not-config.md) | Worker routes live in the deploy command, not wrangler.jsonc | Accepted |

From 6c808ca12aa5a4f68f00963f48a374ed9f085688 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Wed, 15 Jul 2026 09:18:47 +0200
Subject: [PATCH 11/15] runner: fix nuxt container dev command host flag
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nuxt's CLI has no -H alias (host is --host/-h), so `nuxt dev -H 0.0.0.0`
made citty treat -H as a boolean flag and swallow 0.0.0.0 as the
positional rootDir: the dev server served an empty auto-created
/app/0.0.0.0 project — Nuxt's default welcome page instead of the demo.
Present since the original scaffold (ee4110f) but never observable
until local preview started working. Next.js keeps -H; that alias is
valid there.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 runner/config/frameworks.json        | 2 +-
 runner/scripts/prepare-container.mjs | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/runner/config/frameworks.json b/runner/config/frameworks.json
index 56b25785..68d1ce5f 100644
--- a/runner/config/frameworks.json
+++ b/runner/config/frameworks.json
@@ -190,7 +190,7 @@
       "container": "nuxt",
       "htWrappers": ["@handsontable/vue3"],
       "entry": "app.vue",
-      "devCommand": "nuxt dev -H 0.0.0.0 -p 3000",
+      "devCommand": "nuxt dev --host 0.0.0.0 --port 3000",
       "buildCommand": "nuxt generate",
       "outputDir": ".output/public",
       "port": 3000,
diff --git a/runner/scripts/prepare-container.mjs b/runner/scripts/prepare-container.mjs
index 38ae1e6e..542416d8 100644
--- a/runner/scripts/prepare-container.mjs
+++ b/runner/scripts/prepare-container.mjs
@@ -38,7 +38,9 @@ const DEV = {
   "next.js": { cmd: "pnpm exec next dev -p 3001 -H 0.0.0.0", port: 3001 },
   "next-shadcn.js": { cmd: "pnpm exec next dev -p 3001 -H 0.0.0.0", port: 3001 },
   astro: { cmd: "pnpm exec astro dev --host 0.0.0.0 --port 4321", port: 4321 },
-  nuxt: { cmd: "pnpm exec nuxt dev -H 0.0.0.0 -p 3001", port: 3001 },
+  // NOTE: nuxt's CLI has no `-H` alias (host is `--host`/`-h`); an unknown flag
+  // makes it swallow `0.0.0.0` as the positional rootDir and serve an empty app.
+  nuxt: { cmd: "pnpm exec nuxt dev --host 0.0.0.0 --port 3001", port: 3001 },
   "react-js": { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },
   "ant-design": { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },
   mui: { cmd: "pnpm exec vite --host 0.0.0.0 --port 5173", port: 5173 },

From 5492232bae05b4e59cdf8a8a8282b39bb9d20260 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Wed, 15 Jul 2026 09:18:47 +0200
Subject: [PATCH 12/15] examples: prebundle handsontable deps in remix vite
 config
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On a fresh Tier-2 session's first load, the Remix vite plugin discovers
handsontable/plugins, handsontable/cellTypes and
@handsontable/react-wrapper one-by-one during hydration; each discovery
re-runs the dep optimizer, and the page ends up importing chunks from
mixed optimizer generations — two React copies, "Invalid hook call",
and a hydration crash (reload recovered, but every new session crashed
on first load). Prebundling the three imports keeps the first optimizer
pass complete, so first loads are clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 examples/remix/vite.config.ts | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/examples/remix/vite.config.ts b/examples/remix/vite.config.ts
index 8865eb1c..414163b8 100644
--- a/examples/remix/vite.config.ts
+++ b/examples/remix/vite.config.ts
@@ -9,5 +9,16 @@ export default defineConfig({
   plugins: [remix(), tsconfigPaths()],
   server: {
     allowedHosts: true,
-  }
+  },
+  optimizeDeps: {
+    // Remix discovers these client-side imports one-by-one during the first
+    // hydration; each discovery re-runs the dep optimizer, and the page ends up
+    // with chunks from mixed optimizer generations — two React copies and an
+    // "Invalid hook call" hydration crash. Prebundle them in the first pass.
+    include: [
+      "handsontable/plugins",
+      "handsontable/cellTypes",
+      "@handsontable/react-wrapper",
+    ],
+  },
 });

From 316fe4d4fa016c94723ee32910b9610e18a301a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Wed, 15 Jul 2026 09:38:54 +0200
Subject: [PATCH 13/15] runner: exclude framework build caches from catalog
 import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

examples/angular had a local .angular/ CLI build cache on disk, and the
catalog importer's EXCLUDE_DIRS (.next/.nuxt/.output/.astro/...) did
not cover it, so 12 .angular/cache/** files leaked into the angular
starter — visible in the authoring editor's file tree and written into
every session container. Add .angular and .vite to the exclusions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 runner/pipeline/import.mjs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/runner/pipeline/import.mjs b/runner/pipeline/import.mjs
index d21987cb..e93df89e 100644
--- a/runner/pipeline/import.mjs
+++ b/runner/pipeline/import.mjs
@@ -36,6 +36,8 @@ const EXCLUDE_DIRS = new Set([
   ".nuxt",
   ".output",
   ".astro",
+  ".angular", // Angular CLI build cache (ng serve/build run locally in the example)
+  ".vite",
   ".codesandbox", // CodeSandbox-specific config; we are replacing CodeSandbox
   ".devcontainer",
   ".vscode",

From 728b940f00482822a38afde04dafd088c528e629 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Wed, 15 Jul 2026 09:38:54 +0200
Subject: [PATCH 14/15] runner: restore workspace pnpm-lock.yaml

019d267 ("chore: Updated pnpm version to latest v10") deleted the
runner workspace lockfile, leaving runner installs non-deterministic.
The restored file is byte-identical to the pre-deletion version.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 runner/pnpm-lock.yaml | 2442 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 2442 insertions(+)
 create mode 100644 runner/pnpm-lock.yaml

diff --git a/runner/pnpm-lock.yaml b/runner/pnpm-lock.yaml
new file mode 100644
index 00000000..46932bd5
--- /dev/null
+++ b/runner/pnpm-lock.yaml
@@ -0,0 +1,2442 @@
+lockfileVersion: '9.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+importers:
+
+  .:
+    devDependencies:
+      typescript:
+        specifier: ~5.6.0
+        version: 5.6.3
+
+  apps/authoring:
+    dependencies:
+      '@handsontable/demo-editor-shell':
+        specifier: workspace:*
+        version: link:../../packages/editor-shell
+      '@handsontable/demo-runtime':
+        specifier: workspace:*
+        version: link:../../packages/runtime
+      fflate:
+        specifier: ^0.8.2
+        version: 0.8.3
+      react:
+        specifier: ^19.0.0
+        version: 19.2.7
+      react-dom:
+        specifier: ^19.0.0
+        version: 19.2.7(react@19.2.7)
+    devDependencies:
+      '@types/react':
+        specifier: ^19.0.0
+        version: 19.2.17
+      '@types/react-dom':
+        specifier: ^19.0.0
+        version: 19.2.3(@types/react@19.2.17)
+      '@vitejs/plugin-react':
+        specifier: ^4.3.4
+        version: 4.7.0(vite@6.4.3)
+      typescript:
+        specifier: ~5.6.0
+        version: 5.6.3
+      vite:
+        specifier: ^6.0.0
+        version: 6.4.3
+
+  packages/editor-shell:
+    dependencies:
+      '@codemirror/lang-css':
+        specifier: ^6.3.1
+        version: 6.3.1
+      '@codemirror/lang-html':
+        specifier: ^6.4.9
+        version: 6.4.11
+      '@codemirror/lang-javascript':
+        specifier: ^6.2.4
+        version: 6.2.5
+      '@codemirror/lang-json':
+        specifier: ^6.0.2
+        version: 6.0.2
+      '@codemirror/lang-vue':
+        specifier: ^0.1.3
+        version: 0.1.3
+      '@codemirror/theme-one-dark':
+        specifier: ^6.1.3
+        version: 6.1.3
+      '@handsontable/demo-runtime':
+        specifier: workspace:*
+        version: link:../runtime
+      '@uiw/react-codemirror':
+        specifier: ^4.25.2
+        version: 4.25.10(@babel/runtime@8.0.0)(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.1)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.6)(codemirror@6.0.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+    devDependencies:
+      '@types/react':
+        specifier: ^19.0.0
+        version: 19.2.17
+      '@types/react-dom':
+        specifier: ^19.0.0
+        version: 19.2.3(@types/react@19.2.17)
+      react:
+        specifier: ^19.0.0
+        version: 19.2.7
+      react-dom:
+        specifier: ^19.0.0
+        version: 19.2.7(react@19.2.7)
+
+  packages/runtime:
+    dependencies:
+      '@codesandbox/sandpack-client':
+        specifier: ^2.19.8
+        version: 2.19.8
+      semver:
+        specifier: ^7.7.4
+        version: 7.8.5
+    devDependencies:
+      '@types/semver':
+        specifier: ^7.5.8
+        version: 7.7.1
+
+  workers/api:
+    dependencies:
+      '@cloudflare/sandbox':
+        specifier: ^0.12.3
+        version: 0.12.3
+      '@handsontable/demo-runtime':
+        specifier: workspace:*
+        version: link:../../packages/runtime
+    devDependencies:
+      '@cloudflare/workers-types':
+        specifier: ^4.20250101.0
+        version: 4.20260702.1
+      typescript:
+        specifier: ~5.6.0
+        version: 5.6.3
+      wrangler:
+        specifier: ^4.108.0
+        version: 4.108.0(@cloudflare/workers-types@4.20260702.1)
+
+packages:
+
+  '@babel/code-frame@7.29.7':
+    resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/compat-data@7.29.7':
+    resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/core@7.29.7':
+    resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/generator@7.29.7':
+    resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-compilation-targets@7.29.7':
+    resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-globals@7.29.7':
+    resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-imports@7.29.7':
+    resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-module-transforms@7.29.7':
+    resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0
+
+  '@babel/helper-plugin-utils@7.29.7':
+    resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-string-parser@7.29.7':
+    resolution: {integrity: sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-identifier@7.29.7':
+    resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helper-validator-option@7.29.7':
+    resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/parser@7.29.7':
+    resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7':
+    resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7':
+    resolution: {integrity: sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==}
+    engines: {node: '>=6.9.0'}
+    peerDependencies:
+      '@babel/core': ^7.0.0-0
+
+  '@babel/runtime@8.0.0':
+    resolution: {integrity: sha512-sL6cvO2IfkSu/iU+zs2S/w01B7A8V7suXSIKEN4hPFFdZoiPGxrj5pAG0lCaqLWiEIrjKzdznIWuaLcxPR53qw==}
+
+  '@babel/template@7.29.7':
+    resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/traverse@7.29.7':
+    resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/types@7.29.7':
+    resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
+    engines: {node: '>=6.9.0'}
+
+  '@cloudflare/containers@0.3.7':
+    resolution: {integrity: sha512-DM9dm3FnIBSyiSJ1FLavKwl/lk3oAmTaynCzZQ9pZR0ncRPquSxkxd8Nu2MFILxmDDsPkxKsSNEh9mHHMty4Fw==}
+
+  '@cloudflare/kv-asset-handler@0.5.0':
+    resolution: {integrity: sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg==}
+    engines: {node: '>=22.0.0'}
+
+  '@cloudflare/sandbox@0.12.3':
+    resolution: {integrity: sha512-4yx+PtBCZBrS3eZteefwBfGOm+8MTZahLH8/fG/qsvqoNflzno9780FsM6HZf02gGuoDy+s9jQrXbg/h5gEvgw==}
+    peerDependencies:
+      '@openai/agents': ^0.3.3
+      '@opencode-ai/sdk': ^1.1.40
+      '@xterm/xterm': '>=5.0.0'
+    peerDependenciesMeta:
+      '@openai/agents':
+        optional: true
+      '@opencode-ai/sdk':
+        optional: true
+      '@xterm/xterm':
+        optional: true
+
+  '@cloudflare/unenv-preset@2.16.1':
+    resolution: {integrity: sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw==}
+    peerDependencies:
+      unenv: 2.0.0-rc.24
+      workerd: '>1.20260305.0 <2.0.0-0'
+    peerDependenciesMeta:
+      workerd:
+        optional: true
+
+  '@cloudflare/workerd-darwin-64@1.20260706.1':
+    resolution: {integrity: sha512-61XleG5EaE+Zam2Y/fwOcMInMrjd3QMKIG0/+pHycZcVZC5Oxs5GfHSTnvyhcniigGW/bcIkvn1PptWbxlVleQ==}
+    engines: {node: '>=16'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@cloudflare/workerd-darwin-arm64@1.20260706.1':
+    resolution: {integrity: sha512-jbwuMEuhgrXEk+9MD8eHPRsXWlxqtNMqqCMBLJauTHk+NR+U2O6hJXElPqlAVlUTh0A0GPM+DfATupRXm7Ml8w==}
+    engines: {node: '>=16'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@cloudflare/workerd-linux-64@1.20260706.1':
+    resolution: {integrity: sha512-kppCFkt6WHTNmcE83aUj4chWV13hdQKOgXxn53sqpLiVnPi6HEIOWB1DNRAljG9IDt3KMgni9HdzCYVzq2drJA==}
+    engines: {node: '>=16'}
+    cpu: [x64]
+    os: [linux]
+
+  '@cloudflare/workerd-linux-arm64@1.20260706.1':
+    resolution: {integrity: sha512-H4xpocM1vXNfIVrP/JiOhLooWBXi5erE81hBj2wmCvPIUcf+49CuvZEthpVwFYn9SFop/Y8+bUiV0vVrWf8xuw==}
+    engines: {node: '>=16'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@cloudflare/workerd-windows-64@1.20260706.1':
+    resolution: {integrity: sha512-SPWuI+kBNtr/mhcKE7XOECgRWOaidmzVmvtmDrRZX5Y4/+XqD/heRAU5Oa17wOZm3eQ1CB8Xzxjrr/6uQaP8YA==}
+    engines: {node: '>=16'}
+    cpu: [x64]
+    os: [win32]
+
+  '@cloudflare/workers-types@4.20260702.1':
+    resolution: {integrity: sha512-mOhf5TUEB1m2vPrxtqoIGfz0fUC9xyxRDx5gWHy5s+OCo6dcV+g7wI1R7gYCMFohhqF/2y2xeKVwMwCJjfn/WA==}
+
+  '@codemirror/autocomplete@6.20.3':
+    resolution: {integrity: sha512-tlosUqb+3BbxCxZdu4tKeRghPFC+QM7q4X5YhKV2eCmPG+1r2F3f4AaSz5sCrFqUtX4Jh20VFTKecl16MgiV9g==}
+
+  '@codemirror/commands@6.10.4':
+    resolution: {integrity: sha512-Ryk9y9T0FFVF0cUGhAknveAyUOl/A1qReTFi+qPKtOh2Z9F4AUBz3XOrYD4ZEgZirdugVzHvd/2/Wcwy5OliTg==}
+
+  '@codemirror/lang-css@6.3.1':
+    resolution: {integrity: sha512-kr5fwBGiGtmz6l0LSJIbno9QrifNMUusivHbnA1H6Dmqy4HZFte3UAICix1VuKo0lMPKQr2rqB+0BkKi/S3Ejg==}
+
+  '@codemirror/lang-html@6.4.11':
+    resolution: {integrity: sha512-9NsXp7Nwp891pQchI7gPdTwBuSuT3K65NGTHWHNJ55HjYcHLllr0rbIZNdOzas9ztc1EUVBlHou85FFZS4BNnw==}
+
+  '@codemirror/lang-javascript@6.2.5':
+    resolution: {integrity: sha512-zD4e5mS+50htS7F+TYjBPsiIFGanfVqg4HyUz6WNFikgOPf2BgKlx+TQedI1w6n/IqRBVBbBWmGFdLB/7uxO4A==}
+
+  '@codemirror/lang-json@6.0.2':
+    resolution: {integrity: sha512-x2OtO+AvwEHrEwR0FyyPtfDUiloG3rnVTSZV1W8UteaLL8/MajQd8DpvUb2YVzC+/T18aSDv0H9mu+xw0EStoQ==}
+
+  '@codemirror/lang-vue@0.1.3':
+    resolution: {integrity: sha512-QSKdtYTDRhEHCfo5zOShzxCmqKJvgGrZwDQSdbvCRJ5pRLWBS7pD/8e/tH44aVQT6FKm0t6RVNoSUWHOI5vNug==}
+
+  '@codemirror/language@6.12.4':
+    resolution: {integrity: sha512-1q4PaT+o6PbgpkJt4Q8Fv5XJxTy4FUZ4MWETtyiDw3J0Pyr9E2vqcKL+k9wcvjNTIsauxvE7OfmWj3FRPHQ76A==}
+
+  '@codemirror/lint@6.9.7':
+    resolution: {integrity: sha512-28/+iWLYxKxsvGYhSYL7zaCZqLz5+FFFDq9tVsvGv9kv8RY4fFAchJ5WX9M3YrrRlTIsECjsXPqeNgnSmNP2dg==}
+
+  '@codemirror/search@6.7.1':
+    resolution: {integrity: sha512-uMe5UO6PamJtSHrXhhHOzSX3ReWtiJrva6GnPMwSOrZtiExb5X5eExhr2OUZQVvdxPsKpY3Ro2mFbQadpPWmHA==}
+
+  '@codemirror/state@6.7.1':
+    resolution: {integrity: sha512-9QzNDgE4EYDnAHfrTlR2lwiPciiOymLtwKK+8yHQzCc7GXhAP9xdEbEJFy2IWB1j9UGUl9BsgMmTo/ImA02T7A==}
+
+  '@codemirror/theme-one-dark@6.1.3':
+    resolution: {integrity: sha512-NzBdIvEJmx6fjeremiGp3t/okrLPYT0d9orIc7AFun8oZcRk58aejkqhv6spnz4MLAevrKNPMQYXEWMg4s+sKA==}
+
+  '@codemirror/view@6.43.6':
+    resolution: {integrity: sha512-EVunGSYN1wz1p75WY1s3Xg7t3i8Yol0kGZGizNdX9BUFgMFILYVe8/u6EVpo7Ff5PwbZuILb4QAq7IZoKzIEQA==}
+
+  '@codesandbox/nodebox@0.1.8':
+    resolution: {integrity: sha512-2VRS6JDSk+M+pg56GA6CryyUSGPjBEe8Pnae0QL3jJF1mJZJVMDKr93gJRtBbLkfZN6LD/DwMtf+2L0bpWrjqg==}
+
+  '@codesandbox/sandpack-client@2.19.8':
+    resolution: {integrity: sha512-CMV4nr1zgKzVpx4I3FYvGRM5YT0VaQhALMW9vy4wZRhEyWAtJITQIqZzrTGWqB1JvV7V72dVEUCUPLfYz5hgJQ==}
+
+  '@cspotcode/source-map-support@0.8.1':
+    resolution: {integrity: sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==}
+    engines: {node: '>=12'}
+
+  '@emnapi/runtime@1.11.2':
+    resolution: {integrity: sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA==}
+
+  '@esbuild/aix-ppc64@0.25.12':
+    resolution: {integrity: sha512-Hhmwd6CInZ3dwpuGTF8fJG6yoWmsToE+vYgD4nytZVxcu1ulHpUQRAB1UJ8+N1Am3Mz4+xOByoQoSZf4D+CpkA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/aix-ppc64@0.28.1':
+    resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
+  '@esbuild/android-arm64@0.25.12':
+    resolution: {integrity: sha512-6AAmLG7zwD1Z159jCKPvAxZd4y/VTO0VkprYy+3N2FtJ8+BQWFXU+OxARIwA46c5tdD9SsKGZ/1ocqBS/gAKHg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm64@0.28.1':
+    resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
+  '@esbuild/android-arm@0.25.12':
+    resolution: {integrity: sha512-VJ+sKvNA/GE7Ccacc9Cha7bpS8nyzVv0jdVgwNDaR4gDMC/2TTRc33Ip8qrNYUcpkOHUT5OZ0bUcNNVZQ9RLlg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-arm@0.28.1':
+    resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
+  '@esbuild/android-x64@0.25.12':
+    resolution: {integrity: sha512-5jbb+2hhDHx5phYR2By8GTWEzn6I9UqR11Kwf22iKbNpYrsmRB18aX/9ivc5cabcUiAT/wM+YIZ6SG9QO6a8kg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/android-x64@0.28.1':
+    resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
+  '@esbuild/darwin-arm64@0.25.12':
+    resolution: {integrity: sha512-N3zl+lxHCifgIlcMUP5016ESkeQjLj/959RxxNYIthIg+CQHInujFuXeWbWMgnTo4cp5XVHqFPmpyu9J65C1Yg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-arm64@0.28.1':
+    resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.25.12':
+    resolution: {integrity: sha512-HQ9ka4Kx21qHXwtlTUVbKJOAnmG1ipXhdWTmNXiPzPfWKpXqASVcWdnf2bnL73wgjNrFXAa3yYvBSd9pzfEIpA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/darwin-x64@0.28.1':
+    resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    resolution: {integrity: sha512-gA0Bx759+7Jve03K1S0vkOu5Lg/85dou3EseOGUes8flVOGxbhDDh/iZaoek11Y8mtyKPGF3vP8XhnkDEAmzeg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-arm64@0.28.1':
+    resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.25.12':
+    resolution: {integrity: sha512-TGbO26Yw2xsHzxtbVFGEXBFH0FRAP7gtcPE7P5yP7wGy7cXK2oO7RyOhL5NLiqTlBh47XhmIUXuGciXEqYFfBQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/freebsd-x64@0.28.1':
+    resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@esbuild/linux-arm64@0.25.12':
+    resolution: {integrity: sha512-8bwX7a8FghIgrupcxb4aUmYDLp8pX06rGh5HqDT7bB+8Rdells6mHvrFHHW2JAOPZUbnjUpKTLg6ECyzvas2AQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm64@0.28.1':
+    resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.25.12':
+    resolution: {integrity: sha512-lPDGyC1JPDou8kGcywY0YILzWlhhnRjdof3UlcoqYmS9El818LLfJJc3PXXgZHrHCAKs/Z2SeZtDJr5MrkxtOw==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-arm@0.28.1':
+    resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.25.12':
+    resolution: {integrity: sha512-0y9KrdVnbMM2/vG8KfU0byhUN+EFCny9+8g202gYqSSVMonbsCfLjUO+rCci7pM0WBEtz+oK/PIwHkzxkyharA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-ia32@0.28.1':
+    resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.25.12':
+    resolution: {integrity: sha512-h///Lr5a9rib/v1GGqXVGzjL4TMvVTv+s1DPoxQdz7l/AYv6LDSxdIwzxkrPW438oUXiDtwM10o9PmwS/6Z0Ng==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-loong64@0.28.1':
+    resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.25.12':
+    resolution: {integrity: sha512-iyRrM1Pzy9GFMDLsXn1iHUm18nhKnNMWscjmp4+hpafcZjrr2WbT//d20xaGljXDBYHqRcl8HnxbX6uaA/eGVw==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-mips64el@0.28.1':
+    resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.25.12':
+    resolution: {integrity: sha512-9meM/lRXxMi5PSUqEXRCtVjEZBGwB7P/D4yT8UG/mwIdze2aV4Vo6U5gD3+RsoHXKkHCfSxZKzmDssVlRj1QQA==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-ppc64@0.28.1':
+    resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.25.12':
+    resolution: {integrity: sha512-Zr7KR4hgKUpWAwb1f3o5ygT04MzqVrGEGXGLnj15YQDJErYu/BGg+wmFlIDOdJp0PmB0lLvxFIOXZgFRrdjR0w==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-riscv64@0.28.1':
+    resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.25.12':
+    resolution: {integrity: sha512-MsKncOcgTNvdtiISc/jZs/Zf8d0cl/t3gYWX8J9ubBnVOwlk65UIEEvgBORTiljloIWnBzLs4qhzPkJcitIzIg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-s390x@0.28.1':
+    resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.25.12':
+    resolution: {integrity: sha512-uqZMTLr/zR/ed4jIGnwSLkaHmPjOjJvnm6TVVitAa08SLS9Z0VM8wIRx7gWbJB5/J54YuIMInDquWyYvQLZkgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/linux-x64@0.28.1':
+    resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.25.12':
+    resolution: {integrity: sha512-Ld5pTlzPy3YwGec4OuHh1aCVCRvOXdH8DgRjfDy/oumVovmuSzWfnSJg+VtakB9Cm0gxNO9BzWkj6mtO1FMXkQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/netbsd-x64@0.28.1':
+    resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.25.12':
+    resolution: {integrity: sha512-MZyXUkZHjQxUvzK7rN8DJ3SRmrVrke8ZyRusHlP+kuwqTcfWLyqMOE3sScPPyeIXN/mDJIfGXvcMqCgYKekoQw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openbsd-x64@0.28.1':
+    resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/openharmony-arm64@0.28.1':
+    resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@esbuild/sunos-x64@0.25.12':
+    resolution: {integrity: sha512-3wGSCDyuTHQUzt0nV7bocDy72r2lI33QL3gkDNGkod22EsYl04sMf0qLb8luNKTOmgF/eDEDP5BFNwoBKH441w==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/sunos-x64@0.28.1':
+    resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
+  '@esbuild/win32-arm64@0.25.12':
+    resolution: {integrity: sha512-rMmLrur64A7+DKlnSuwqUdRKyd3UE7oPJZmnljqEptesKM8wx9J8gx5u0+9Pq0fQQW8vqeKebwNXdfOyP+8Bsg==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-arm64@0.28.1':
+    resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.25.12':
+    resolution: {integrity: sha512-HkqnmmBoCbCwxUKKNPBixiWDGCpQGVsrQfJoVGYLPT41XWF8lHuE5N6WhVia2n4o5QK5M4tYr21827fNhi4byQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-ia32@0.28.1':
+    resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.25.12':
+    resolution: {integrity: sha512-alJC0uCZpTFrSL0CCDjcgleBXPnCrEAhTBILpeAp7M/OFgoqtAetfBzX0xM00MUsVVPpVjlPuMbREqnZCXaTnA==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@esbuild/win32-x64@0.28.1':
+    resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@img/colour@1.1.0':
+    resolution: {integrity: sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ==}
+    engines: {node: '>=18'}
+
+  '@img/sharp-darwin-arm64@0.34.5':
+    resolution: {integrity: sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-darwin-x64@0.34.5':
+    resolution: {integrity: sha512-YNEFAF/4KQ/PeW0N+r+aVVsoIY0/qxxikF2SWdp+NRkmMB7y9LBZAVqQ4yhGCm/H3H270OSykqmQMKLBhBJDEw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    resolution: {integrity: sha512-zqjjo7RatFfFoP0MkQ51jfuFZBnVE2pRiaydKJ1G/rHZvnsrHAOcQALIi9sA5co5xenQdTugCvtb1cuf78Vf4g==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    resolution: {integrity: sha512-1IOd5xfVhlGwX+zXv2N93k0yMONvUlANylbJw1eTah8K/Jtpi15KC+WSiaX/nBmbm2HxRM1gZ0nSdjSsrZbGKg==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    resolution: {integrity: sha512-excjX8DfsIcJ10x1Kzr4RcWe1edC9PquDRRPx3YVCvQv+U5p7Yin2s32ftzikXojb1PIFc/9Mt28/y+iRklkrw==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    resolution: {integrity: sha512-bFI7xcKFELdiNCVov8e44Ia4u2byA+l3XtsAj+Q8tfCwO6BQ8iDojYdvoPMqsKDkuoOo+X6HZA0s0q11ANMQ8A==}
+    cpu: [arm]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    resolution: {integrity: sha512-FMuvGijLDYG6lW+b/UvyilUWu5Ayu+3r2d1S8notiGCIyYU/76eig1UfMmkZ7vwgOrzKzlQbFSuQfgm7GYUPpA==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    resolution: {integrity: sha512-oVDbcR4zUC0ce82teubSm+x6ETixtKZBh/qbREIOcI3cULzDyb18Sr/Wcyx7NRQeQzOiHTNbZFF1UwPS2scyGA==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    resolution: {integrity: sha512-qmp9VrzgPgMoGZyPvrQHqk02uyjA0/QrTO26Tqk6l4ZV0MPWIW6LTkqOIov+J1yEu7MbFQaDpwdwJKhbJvuRxQ==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    resolution: {integrity: sha512-tJxiiLsmHc9Ax1bz3oaOYBURTXGIRDODBqhveVHonrHJ9/+k89qbLl0bcJns+e4t4rvaNBxaEZsFtSfAdquPrw==}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    resolution: {integrity: sha512-FVQHuwx1IIuNow9QAbYUzJ+En8KcVm9Lk5+uGUQJHaZmMECZmOlix9HnH7n1TRkXMS0pGxIJokIVB9SuqZGGXw==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    resolution: {integrity: sha512-+LpyBk7L44ZIXwz/VYfglaX/okxezESc6UxDSoyo2Ks6Jxc4Y7sGjpgU9s4PMgqgjj1gZCylTieNamqA1MF7Dg==}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-linux-arm64@0.34.5':
+    resolution: {integrity: sha512-bKQzaJRY/bkPOXyKx5EVup7qkaojECG6NLYswgktOZjaXecSAeCWiZwwiFf3/Y+O1HrauiE3FVsGxFg8c24rZg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-linux-arm@0.34.5':
+    resolution: {integrity: sha512-9dLqsvwtg1uuXBGZKsxem9595+ujv0sJ6Vi8wcTANSFpwV/GONat5eCkzQo/1O6zRIkh0m/8+5BjrRr7jDUSZw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm]
+    os: [linux]
+
+  '@img/sharp-linux-ppc64@0.34.5':
+    resolution: {integrity: sha512-7zznwNaqW6YtsfrGGDA6BRkISKAAE1Jo0QdpNYXNMHu2+0dTrPflTLNkpc8l7MUP5M16ZJcUvysVWWrMefZquA==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@img/sharp-linux-riscv64@0.34.5':
+    resolution: {integrity: sha512-51gJuLPTKa7piYPaVs8GmByo7/U7/7TZOq+cnXJIHZKavIRHAP77e3N2HEl3dgiqdD/w0yUfiJnII77PuDDFdw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@img/sharp-linux-s390x@0.34.5':
+    resolution: {integrity: sha512-nQtCk0PdKfho3eC5MrbQoigJ2gd1CgddUMkabUj+rBevs8tZ2cULOx46E7oyX+04WGfABgIwmMC0VqieTiR4jg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [s390x]
+    os: [linux]
+
+  '@img/sharp-linux-x64@0.34.5':
+    resolution: {integrity: sha512-MEzd8HPKxVxVenwAa+JRPwEC7QFjoPWuS5NZnBt6B3pu7EG2Ge0id1oLHZpPJdn3OQK+BQDiw9zStiHBTJQQQQ==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    resolution: {integrity: sha512-fprJR6GtRsMt6Kyfq44IsChVZeGN97gTD331weR1ex1c1rypDEABN6Tm2xa1wE6lYb5DdEnk03NZPqA7Id21yg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [linux]
+
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    resolution: {integrity: sha512-Jg8wNT1MUzIvhBFxViqrEhWDGzqymo3sV7z7ZsaWbZNDLXRJZoRGrjulp60YYtV4wfY8VIKcWidjojlLcWrd8Q==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [linux]
+
+  '@img/sharp-wasm32@0.34.5':
+    resolution: {integrity: sha512-OdWTEiVkY2PHwqkbBI8frFxQQFekHaSSkUIJkwzclWZe64O1X4UlUjqqqLaPbUpMOQk6FBu/HtlGXNblIs0huw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [wasm32]
+
+  '@img/sharp-win32-arm64@0.34.5':
+    resolution: {integrity: sha512-WQ3AgWCWYSb2yt+IG8mnC6Jdk9Whs7O0gxphblsLvdhSpSTtmu69ZG1Gkb6NuvxsNACwiPV6cNSZNzt0KPsw7g==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [arm64]
+    os: [win32]
+
+  '@img/sharp-win32-ia32@0.34.5':
+    resolution: {integrity: sha512-FV9m/7NmeCmSHDD5j4+4pNI8Cp3aW+JvLoXcTUo0IqyjSfAZJ8dIUmijx1qaJsIiU+Hosw6xM5KijAWRJCSgNg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [ia32]
+    os: [win32]
+
+  '@img/sharp-win32-x64@0.34.5':
+    resolution: {integrity: sha512-+29YMsqY2/9eFEiW93eqWnuLcWcufowXewwSNIT6UwZdUUCrM3oFjMWH/Z6/TMmb4hlFenmfAVbpWeup2jryCw==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+    cpu: [x64]
+    os: [win32]
+
+  '@jridgewell/gen-mapping@0.3.13':
+    resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
+
+  '@jridgewell/remapping@2.3.5':
+    resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==}
+
+  '@jridgewell/resolve-uri@3.1.2':
+    resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==}
+    engines: {node: '>=6.0.0'}
+
+  '@jridgewell/sourcemap-codec@1.5.5':
+    resolution: {integrity: sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
+
+  '@jridgewell/trace-mapping@0.3.9':
+    resolution: {integrity: sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==}
+
+  '@lezer/common@1.5.2':
+    resolution: {integrity: sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ==}
+
+  '@lezer/css@1.3.4':
+    resolution: {integrity: sha512-N+tn9tej2hPvyKgHEApMOQfHczDJCwxrRFS3SPn9QjYN+uwHvEDnCgKRrb3mxDYxRS8sKMM8fhC3+lc04Abz5Q==}
+
+  '@lezer/highlight@1.2.3':
+    resolution: {integrity: sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g==}
+
+  '@lezer/html@1.3.13':
+    resolution: {integrity: sha512-oI7n6NJml729m7pjm9lvLvmXbdoMoi2f+1pwSDJkl9d68zGr7a9Btz8NdHTGQZtW2DA25ybeuv/SyDb9D5tseg==}
+
+  '@lezer/javascript@1.5.4':
+    resolution: {integrity: sha512-vvYx3MhWqeZtGPwDStM2dwgljd5smolYD2lR2UyFcHfxbBQebqx8yjmFmxtJ/E6nN6u1D9srOiVWm3Rb4tmcUA==}
+
+  '@lezer/json@1.0.3':
+    resolution: {integrity: sha512-BP9KzdF9Y35PDpv04r0VeSTKDeox5vVr3efE7eBbx3r4s3oNLfunchejZhjArmeieBH+nVOpgIiBJpEAv8ilqQ==}
+
+  '@lezer/lr@1.4.10':
+    resolution: {integrity: sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A==}
+
+  '@marijn/find-cluster-break@1.0.3':
+    resolution: {integrity: sha512-FY+MKLBoTsLNJF/eLWaOsXGdz6uh3Iu1axjPf6TUq92IYumcTcXWHoS747JARLkcdlJ/Waiaxc5wQfFO8jC6NA==}
+
+  '@open-draft/deferred-promise@2.2.0':
+    resolution: {integrity: sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA==}
+
+  '@poppinss/colors@4.1.6':
+    resolution: {integrity: sha512-H9xkIdFswbS8n1d6vmRd8+c10t2Qe+rZITbbDHHkQixH5+2x1FDGmi/0K+WgWiqQFKPSlIYB7jlH6Kpfn6Fleg==}
+
+  '@poppinss/dumper@0.6.5':
+    resolution: {integrity: sha512-NBdYIb90J7LfOI32dOewKI1r7wnkiH6m920puQ3qHUeZkxNkQiFnXVWoE6YtFSv6QOiPPf7ys6i+HWWecDz7sw==}
+
+  '@poppinss/exception@1.2.3':
+    resolution: {integrity: sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw==}
+
+  '@rolldown/pluginutils@1.0.0-beta.27':
+    resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
+
+  '@rollup/rollup-android-arm-eabi@4.62.2':
+    resolution: {integrity: sha512-6o7ZLZK+BeenkZCFNDXqpbjw9bD6nuWonvS/lwQJp7NoVVxm6p3qE7qQ5jGuBjiFsgvqjD8mZAU5oWxTmbOeOg==}
+    cpu: [arm]
+    os: [android]
+
+  '@rollup/rollup-android-arm64@4.62.2':
+    resolution: {integrity: sha512-BaH7BllCACHoH1LguOU56UItGfUWjujlO65kS9LAodViaN4bwIKd7oeW/ZHJ/4ljr/7MIiENnNy3HJ0zXv8Zkw==}
+    cpu: [arm64]
+    os: [android]
+
+  '@rollup/rollup-darwin-arm64@4.62.2':
+    resolution: {integrity: sha512-v39RCCvj4He82I9sFmk+M1VZ0PLM9sfsLVikjfx2hYBNALhrrOR2D3JjQA6AhlaSOgcR+RzrKY7e1+bT6SUO/A==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@rollup/rollup-darwin-x64@4.62.2':
+    resolution: {integrity: sha512-yl0y2vq3S3lHeuXhEdss6TWfKW8vkujImO12tn4ZkG/4oghr09LvdYm2RElVjokTQiUvDUGXLGsYeLqUMCKpGA==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@rollup/rollup-freebsd-arm64@4.62.2':
+    resolution: {integrity: sha512-tT4pvt4qXD+vEoezupCWi+a1F0vvDiksiHc+PxRlYTOH1I6/X4id9jPxTP+Fg+545euaFT1jJVs4CEdHZAU1vw==}
+    cpu: [arm64]
+    os: [freebsd]
+
+  '@rollup/rollup-freebsd-x64@4.62.2':
+    resolution: {integrity: sha512-6nU5F2wCW+qvCBhTn1pdIU3bzsIoF7EUwsCDRxilWGprQR6yd508YnH9+OKFCwpfS8pjZqDUmnCAr7exax0XCg==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+    resolution: {integrity: sha512-n1GJHPOvpIfhi3TmrCeh6S6URt9BFCt0KQE3qvexyGCTAKpR4Lg+eWvNZEqu7epxwus/8ElT3hacYEucm49SZg==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+    resolution: {integrity: sha512-JqgflS8wEB+UXV/vS1RpRbifGBeN4D5lz8D8oOFbFZw4vedvdOgCFAjfBmIMdW3yL10XpQQ0Ambepw6MXrhOnA==}
+    cpu: [arm]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-gnu@4.62.2':
+    resolution: {integrity: sha512-wnFJkogWvN4jm/hQRF2UBaeUmk20j5+DmHvoyWii2b8HJDyvz1MF2OU/6ynXt2KR63rbZLWkFpoytpdc/yBuSA==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-arm64-musl@4.62.2':
+    resolution: {integrity: sha512-HVu2bp0zhvJ8xHEV9+UUs7S90VadmBSY3LcIMvozbPo4AuMGDWlz3ymHLHZPX4hR67TKTt8Qp5PJ5RBg/i+RMQ==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@rollup/rollup-linux-loong64-gnu@4.62.2':
+    resolution: {integrity: sha512-mQqqAV8QaoSgr9I2fKDLY2BAVvmKjWoGiu/cSYQonsLvtqwEn1E4QYfnCOcp5zoEqNhsDYin1s6jx/VJmrxlZg==}
+    cpu: [loong64]
+    os: [linux]
+
+  '@rollup/rollup-linux-loong64-musl@4.62.2':
+    resolution: {integrity: sha512-IxKLoxCQ2IWi6bT2akyDUBGsOImDKB+sPp4EsTmwFQ/fMwpCKm8uLSSgP/Kx/QYUgKis6SEZ5/Nlhup0DIA0PQ==}
+    cpu: [loong64]
+    os: [linux]
+
+  '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+    resolution: {integrity: sha512-Mk5ha2RQSgyFfmYYLkBpPnUk8D8FriBxesO1u9O75X0mHgXL1UQcH5Itl2lurWL2tj0RxV9b9tJgipac0hRY9A==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rollup/rollup-linux-ppc64-musl@4.62.2':
+    resolution: {integrity: sha512-CjvEnqJL/0/TQ3TXX3OPIJ/kmBellrWd4heXUmHeJlTnmwjKpSJzoehLaL6Xk0ZnMHBu9dZuFADNOrtjF4v+2w==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+    resolution: {integrity: sha512-1SiZbzwdkaDURsew/tSOrooKiYy7EQGT6m8ufavAi9NEyQb/6VuIxFXAL1fqa4iZe3g4NbNk4P7J32z2tw5Mgg==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-riscv64-musl@4.62.2':
+    resolution: {integrity: sha512-nQts12zJ3NQRoE6uYljOH89v7szzLDvG2JD/vsX+vGXU8w/At1GowTZ5/7qeFQ8m7L55rpR8Okugnuo5bgjy2Q==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@rollup/rollup-linux-s390x-gnu@4.62.2':
+    resolution: {integrity: sha512-E9/ll019jhPIJgpzfZoIkBGhcz+kKNgVWYRY0zr9srBdPPFVpvOKW8VaJKUbeK+eZXyQF9ltME+Kk6affeaPgg==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-gnu@4.62.2':
+    resolution: {integrity: sha512-5BqxR/pshjey51iliyzTD5Xi3EN0aLmQ2lZ3lvefVV9c82BvrLo2/6OT55iifpWBufs6kdwWbuOKS841DrmK9A==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-linux-x64-musl@4.62.2':
+    resolution: {integrity: sha512-uNN83XxQrRAh/w0/pmAfibcwyb6YWt4gP+dpnQKPVJshAloQ785ii8CT8ZCIxkGg9opVsvAlGhFitSm6D1Jjpg==}
+    cpu: [x64]
+    os: [linux]
+
+  '@rollup/rollup-openbsd-x64@4.62.2':
+    resolution: {integrity: sha512-srjEIxSH3LRnJN6THczDHWQplqEMFiAJrTab0msUryh9kwNpkICf3Ea6q6MN/2cZwRFUNx5w+h6Hpi4QuHS6Zg==}
+    cpu: [x64]
+    os: [openbsd]
+
+  '@rollup/rollup-openharmony-arm64@4.62.2':
+    resolution: {integrity: sha512-8hOJnxgbyObnCm5AlRA3A931xX19xq80RjVTKgJOvEKWqJruP/Uf12IbAOaDjjEXYRewwHLfmF0YRIdK3OwKWA==}
+    cpu: [arm64]
+    os: [openharmony]
+
+  '@rollup/rollup-win32-arm64-msvc@4.62.2':
+    resolution: {integrity: sha512-mmF4AY1i0hG/bLWUctUq59gtmgaSIRa3cu/A3JFRp/sCNEme2bgDEiDS22P9FbnJB8NJNF4jPJiSP5RHQpUTDg==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@rollup/rollup-win32-ia32-msvc@4.62.2':
+    resolution: {integrity: sha512-DZgkknc6jhHrk46V25vbAM0zZkyP0nSDkJB8/dRkLTxv470dOmWDqGoEJl/9A0dFfS7yE3REOwNDxpHwSLSt0Q==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-gnu@4.62.2':
+    resolution: {integrity: sha512-T6xr6ucWSFto+VGajA8YH26LdpHRuP4YLHEKAtCWvJDOlnmWcDZVCI2Jmjr+IFHDlt2zRaTAKE4tfjTaWLgJBg==}
+    cpu: [x64]
+    os: [win32]
+
+  '@rollup/rollup-win32-x64-msvc@4.62.2':
+    resolution: {integrity: sha512-BfzEnDJOt9T8M989/lA37EcJgat01wLRnoi5dQf3QzOH7jzpqTAzdDbVfRljVr5r+jzKqpbHeyOfAaXxAd0PAA==}
+    cpu: [x64]
+    os: [win32]
+
+  '@sindresorhus/is@7.2.0':
+    resolution: {integrity: sha512-P1Cz1dWaFfR4IR+U13mqqiGsLFf1KbayybWwdd2vfctdV6hDpUkgCY0nKOLLTMSoRd/jJNjtbqzf13K8DCCXQw==}
+    engines: {node: '>=18'}
+
+  '@speed-highlight/core@1.2.17':
+    resolution: {integrity: sha512-Z92FwKpCtfaW1V0jTU/fh3QzYEZN8wDwrzRIBoADCJfn4mJCNcJN/XegifX7BDrQ8/h9Xh/JnbyMchL0FqXrkg==}
+
+  '@types/babel__core@7.20.5':
+    resolution: {integrity: sha512-qoQprZvz5wQFJwMDqeseRXWv3rqMvhgpbXFfVyWhbx9X47POIA6i/+dXefEmZKoAgOaTdaIgNSMqMIU61yRyzA==}
+
+  '@types/babel__generator@7.27.0':
+    resolution: {integrity: sha512-ufFd2Xi92OAVPYsy+P4n7/U7e68fex0+Ee8gSG9KX7eo084CWiQ4sdxktvdl0bOPupXtVJPY19zk6EwWqUQ8lg==}
+
+  '@types/babel__template@7.4.4':
+    resolution: {integrity: sha512-h/NUaSyG5EyxBIp8YRxo4RMe2/qQgvyowRwVMzhYhBCONbW8PUsg4lkFMrhgZhUe5z3L3MiLDuvyJ/CaPa2A8A==}
+
+  '@types/babel__traverse@7.28.0':
+    resolution: {integrity: sha512-8PvcXf70gTDZBgt9ptxJ8elBeBjcLOAcOtoO/mPJjtji1+CdGbHgm77om1GrsPxsiE+uXIpNSK64UYaIwQXd4Q==}
+
+  '@types/estree@1.0.9':
+    resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
+
+  '@types/react-dom@19.2.3':
+    resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
+    peerDependencies:
+      '@types/react': ^19.2.0
+
+  '@types/react@19.2.17':
+    resolution: {integrity: sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==}
+
+  '@types/semver@7.7.1':
+    resolution: {integrity: sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==}
+
+  '@uiw/codemirror-extensions-basic-setup@4.25.10':
+    resolution: {integrity: sha512-P3vytLlpE62KYSWrMUnwDCv2lvaQDuDZzyj03mHntuHo5bSl34fRZpjTY3kQTPGuXHxkGSYpoPFFj+hMTqaaMQ==}
+    peerDependencies:
+      '@codemirror/autocomplete': '>=6.0.0'
+      '@codemirror/commands': '>=6.0.0'
+      '@codemirror/language': '>=6.0.0'
+      '@codemirror/lint': '>=6.0.0'
+      '@codemirror/search': '>=6.0.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+
+  '@uiw/react-codemirror@4.25.10':
+    resolution: {integrity: sha512-DzgSMwM5qzB7v1FIb4gEeriYt67iiay756/HIOM9mAbeOVK0MO7rqefHf0O5c0269pJKMW7AH9FjclExD23V9w==}
+    peerDependencies:
+      '@babel/runtime': '>=7.11.0'
+      '@codemirror/state': '>=6.0.0'
+      '@codemirror/theme-one-dark': '>=6.0.0'
+      '@codemirror/view': '>=6.0.0'
+      codemirror: '>=6.0.0'
+      react: '>=17.0.0'
+      react-dom: '>=17.0.0'
+
+  '@vitejs/plugin-react@4.7.0':
+    resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==}
+    engines: {node: ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+
+  aws4fetch@1.0.20:
+    resolution: {integrity: sha512-/djoAN709iY65ETD6LKCtyyEI04XIBP5xVvfmNxsEP0uJB5tyaGBztSryRr4HqMStr9R06PisQE7m9zDTXKu6g==}
+
+  base64-js@1.5.1:
+    resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
+
+  baseline-browser-mapping@2.10.42:
+    resolution: {integrity: sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==}
+    engines: {node: '>=6.0.0'}
+    hasBin: true
+
+  blake3-wasm@2.1.5:
+    resolution: {integrity: sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g==}
+
+  browserslist@4.28.5:
+    resolution: {integrity: sha512-Cu2E6QejHWzuDMTkuwgpABFgDfZrXLQq5V13YOACZx4mFAG4IwGTbTfHPMr4WtxlHoXSM8FIuRwYYCz5XiabaQ==}
+    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
+    hasBin: true
+
+  buffer@6.0.3:
+    resolution: {integrity: sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==}
+
+  caniuse-lite@1.0.30001803:
+    resolution: {integrity: sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg==}
+
+  capnweb@0.8.0:
+    resolution: {integrity: sha512-BK/TuXUiyfLSKsmjojn70yN7oYG/JJzoURZ3tckjg5Zj2KcygPm0A5jyOlswK7SYB4f0Gh9tt+RZ132b80iLfA==}
+
+  codemirror@6.0.2:
+    resolution: {integrity: sha512-VhydHotNW5w1UGK0Qj96BwSk/Zqbp9WbnyK2W/eVMv4QyF41INRGpjUhFJY7/uDNuudSc33a/PKr4iDqRduvHw==}
+
+  convert-source-map@2.0.0:
+    resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
+
+  cookie@1.1.1:
+    resolution: {integrity: sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==}
+    engines: {node: '>=18'}
+
+  crelt@1.0.7:
+    resolution: {integrity: sha512-aK6BbWfhf4U/wCcLHKPJl/xa6VkVstRaPywWtMKGwuOLc/wZTyQYuoxgvZnNsBvv7Kg3YTBQYYBCggcviQczuA==}
+
+  csstype@3.2.3:
+    resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
+
+  debug@4.4.3:
+    resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
+    engines: {node: '>=6.0'}
+    peerDependencies:
+      supports-color: '*'
+    peerDependenciesMeta:
+      supports-color:
+        optional: true
+
+  dequal@2.0.3:
+    resolution: {integrity: sha512-0je+qPKHEMohvfRTCEo3CrPG6cAzAYgmzKyxRiYSSDkS6eGJdyVJm7WaYA5ECaAD9wLB2T4EEeymA5aFVcYXCA==}
+    engines: {node: '>=6'}
+
+  detect-libc@2.1.2:
+    resolution: {integrity: sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==}
+    engines: {node: '>=8'}
+
+  dotenv@16.6.1:
+    resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
+    engines: {node: '>=12'}
+
+  electron-to-chromium@1.5.389:
+    resolution: {integrity: sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==}
+
+  error-stack-parser-es@1.0.5:
+    resolution: {integrity: sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA==}
+
+  esbuild@0.25.12:
+    resolution: {integrity: sha512-bbPBYYrtZbkt6Os6FiTLCTFxvq4tt3JKall1vRwshA3fdVztsLAatFaZobhkBC8/BrPetoa0oksYoKXoG4ryJg==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  esbuild@0.28.1:
+    resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
+    engines: {node: '>=18'}
+    hasBin: true
+
+  escalade@3.2.0:
+    resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
+    engines: {node: '>=6'}
+
+  fdir@6.5.0:
+    resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
+    engines: {node: '>=12.0.0'}
+    peerDependencies:
+      picomatch: ^3 || ^4
+    peerDependenciesMeta:
+      picomatch:
+        optional: true
+
+  fflate@0.8.3:
+    resolution: {integrity: sha512-tbZNuJrLwGUp3zshBtdy4W+ORxZuIh8a5ilyIEQDC5rY1f3U20JMry0Ll3WBzU58EZKsEuJFXhb5gwv8CsPvgA==}
+
+  fsevents@2.3.3:
+    resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
+  gensync@1.0.0-beta.2:
+    resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
+    engines: {node: '>=6.9.0'}
+
+  hono@4.12.28:
+    resolution: {integrity: sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==}
+    engines: {node: '>=16.9.0'}
+
+  ieee754@1.2.1:
+    resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
+
+  js-tokens@4.0.0:
+    resolution: {integrity: sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==}
+
+  jsesc@3.1.0:
+    resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  json5@2.2.3:
+    resolution: {integrity: sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==}
+    engines: {node: '>=6'}
+    hasBin: true
+
+  kleur@4.1.5:
+    resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
+    engines: {node: '>=6'}
+
+  lru-cache@5.1.1:
+    resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
+
+  mime-db@1.54.0:
+    resolution: {integrity: sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==}
+    engines: {node: '>= 0.6'}
+
+  miniflare@4.20260706.0:
+    resolution: {integrity: sha512-UiqGo9Es/D7kJvDVpjhTQ/M2ppCSCsRc5EEKec6i4BvnCkFCRaZHRmFkMHzLhlg+daSZ+zvBaycWmgLZHn/1tQ==}
+    engines: {node: '>=22.0.0'}
+    hasBin: true
+
+  ms@2.1.3:
+    resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
+
+  nanoid@3.3.15:
+    resolution: {integrity: sha512-y7Wygv/7mEOvxTuEQDB8StXdMRBWf1kR/tlhAzBRUFkB2jfcLOAxO/SHmOO2zgz1pVgK29/kyupn059/bCHdjA==}
+    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
+    hasBin: true
+
+  node-releases@2.0.50:
+    resolution: {integrity: sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==}
+    engines: {node: '>=18'}
+
+  outvariant@1.4.0:
+    resolution: {integrity: sha512-AlWY719RF02ujitly7Kk/0QlV+pXGFDHrHf9O2OKqyqgBieaPOIeuSkL8sRK6j2WK+/ZAURq2kZsY0d8JapUiw==}
+
+  path-to-regexp@6.3.0:
+    resolution: {integrity: sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ==}
+
+  pathe@2.0.3:
+    resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
+
+  picocolors@1.1.1:
+    resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
+
+  picomatch@4.0.5:
+    resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
+    engines: {node: '>=12'}
+
+  postcss@8.5.16:
+    resolution: {integrity: sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==}
+    engines: {node: ^10 || ^12 || >=14}
+
+  react-dom@19.2.7:
+    resolution: {integrity: sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==}
+    peerDependencies:
+      react: ^19.2.7
+
+  react-refresh@0.17.0:
+    resolution: {integrity: sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==}
+    engines: {node: '>=0.10.0'}
+
+  react@19.2.7:
+    resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==}
+    engines: {node: '>=0.10.0'}
+
+  rollup@4.62.2:
+    resolution: {integrity: sha512-RFnrW4lhXA3s3eqHDZvN654g8OTjzRfqpIRJYczCGB6HzphckVAi/Qh4tbPUbRuDi7s1Llv8g/NspLkttY3gTA==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  scheduler@0.27.0:
+    resolution: {integrity: sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==}
+
+  semver@6.3.1:
+    resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
+    hasBin: true
+
+  semver@7.8.5:
+    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+    engines: {node: '>=10'}
+    hasBin: true
+
+  sharp@0.34.5:
+    resolution: {integrity: sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg==}
+    engines: {node: ^18.17.0 || ^20.3.0 || >=21.0.0}
+
+  source-map-js@1.2.1:
+    resolution: {integrity: sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==}
+    engines: {node: '>=0.10.0'}
+
+  static-browser-server@1.0.3:
+    resolution: {integrity: sha512-ZUyfgGDdFRbZGGJQ1YhiM930Yczz5VlbJObrQLlk24+qNHVQx4OlLcYswEUo3bIyNAbQUIUR9Yr5/Hqjzqb4zA==}
+
+  strict-event-emitter@0.4.6:
+    resolution: {integrity: sha512-12KWeb+wixJohmnwNFerbyiBrAlq5qJLwIt38etRtKtmmHyDSoGlIqFE9wx+4IwG0aDjI7GV8tc8ZccjWZZtTg==}
+
+  style-mod@4.1.3:
+    resolution: {integrity: sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ==}
+
+  supports-color@10.2.2:
+    resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
+    engines: {node: '>=18'}
+
+  tinyglobby@0.2.17:
+    resolution: {integrity: sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==}
+    engines: {node: '>=12.0.0'}
+
+  tslib@2.8.1:
+    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
+
+  typescript@5.6.3:
+    resolution: {integrity: sha512-hjcS1mhfuyi4WW8IWtjP7brDrG2cuDZukyrYrSauoXGNgx0S7zceP07adYkJycEr56BOUTNPzbInooiN3fn1qw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
+  undici@7.28.0:
+    resolution: {integrity: sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==}
+    engines: {node: '>=20.18.1'}
+
+  unenv@2.0.0-rc.24:
+    resolution: {integrity: sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw==}
+
+  update-browserslist-db@1.2.3:
+    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+    hasBin: true
+    peerDependencies:
+      browserslist: '>= 4.21.0'
+
+  vite@6.4.3:
+    resolution: {integrity: sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==}
+    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+    hasBin: true
+    peerDependencies:
+      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
+      jiti: '>=1.21.0'
+      less: '*'
+      lightningcss: ^1.21.0
+      sass: '*'
+      sass-embedded: '*'
+      stylus: '*'
+      sugarss: '*'
+      terser: ^5.16.0
+      tsx: ^4.8.1
+      yaml: ^2.4.2
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+      jiti:
+        optional: true
+      less:
+        optional: true
+      lightningcss:
+        optional: true
+      sass:
+        optional: true
+      sass-embedded:
+        optional: true
+      stylus:
+        optional: true
+      sugarss:
+        optional: true
+      terser:
+        optional: true
+      tsx:
+        optional: true
+      yaml:
+        optional: true
+
+  w3c-keyname@2.2.8:
+    resolution: {integrity: sha512-dpojBhNsCNN7T82Tm7k26A6G9ML3NkhDsnw9n/eoxSRlVBB4CEtIQ/KTCLI2Fwf3ataSXRhYFkQi3SlnFwPvPQ==}
+
+  workerd@1.20260706.1:
+    resolution: {integrity: sha512-0DOmgysJiPZRwtlg9Bh70aDnHuVech70fKVM4721RbdfewL29ODxn4TpgkusybLYrQAkgHkW53SUt2AdkBa+Og==}
+    engines: {node: '>=16'}
+    hasBin: true
+
+  wrangler@4.108.0:
+    resolution: {integrity: sha512-mJnY6vf2Tminfo0Jy5OreBgUjIKW3iM1TQtOrZZRpFUyiQvAYUDVN0aRcDn8/aEfF0bmZgcixRdwwVHZMZaE7w==}
+    engines: {node: '>=22.0.0'}
+    hasBin: true
+    peerDependencies:
+      '@cloudflare/workers-types': ^5.20260706.1
+    peerDependenciesMeta:
+      '@cloudflare/workers-types':
+        optional: true
+
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
+    engines: {node: '>=10.0.0'}
+    peerDependencies:
+      bufferutil: ^4.0.1
+      utf-8-validate: '>=5.0.2'
+    peerDependenciesMeta:
+      bufferutil:
+        optional: true
+      utf-8-validate:
+        optional: true
+
+  yallist@3.1.1:
+    resolution: {integrity: sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==}
+
+  youch-core@0.3.3:
+    resolution: {integrity: sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA==}
+
+  youch@4.1.0-beta.10:
+    resolution: {integrity: sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ==}
+
+snapshots:
+
+  '@babel/code-frame@7.29.7':
+    dependencies:
+      '@babel/helper-validator-identifier': 7.29.7
+      js-tokens: 4.0.0
+      picocolors: 1.1.1
+
+  '@babel/compat-data@7.29.7': {}
+
+  '@babel/core@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-compilation-targets': 7.29.7
+      '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/remapping': 2.3.5
+      convert-source-map: 2.0.0
+      debug: 4.4.3
+      gensync: 1.0.0-beta.2
+      json5: 2.2.3
+      semver: 6.3.1
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/generator@7.29.7':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
+  '@babel/helper-compilation-targets@7.29.7':
+    dependencies:
+      '@babel/compat-data': 7.29.7
+      '@babel/helper-validator-option': 7.29.7
+      browserslist: 4.28.5
+      lru-cache: 5.1.1
+      semver: 6.3.1
+
+  '@babel/helper-globals@7.29.7': {}
+
+  '@babel/helper-module-imports@7.29.7':
+    dependencies:
+      '@babel/traverse': 7.29.7
+      '@babel/types': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-module-transforms@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-module-imports': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+      '@babel/traverse': 7.29.7
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/helper-plugin-utils@7.29.7': {}
+
+  '@babel/helper-string-parser@7.29.7': {}
+
+  '@babel/helper-validator-identifier@7.29.7': {}
+
+  '@babel/helper-validator-option@7.29.7': {}
+
+  '@babel/helpers@7.29.7':
+    dependencies:
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/parser@7.29.7':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/plugin-transform-react-jsx-source@7.29.7(@babel/core@7.29.7)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
+
+  '@babel/runtime@8.0.0': {}
+
+  '@babel/template@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@babel/traverse@7.29.7':
+    dependencies:
+      '@babel/code-frame': 7.29.7
+      '@babel/generator': 7.29.7
+      '@babel/helper-globals': 7.29.7
+      '@babel/parser': 7.29.7
+      '@babel/template': 7.29.7
+      '@babel/types': 7.29.7
+      debug: 4.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  '@babel/types@7.29.7':
+    dependencies:
+      '@babel/helper-string-parser': 7.29.7
+      '@babel/helper-validator-identifier': 7.29.7
+
+  '@cloudflare/containers@0.3.7': {}
+
+  '@cloudflare/kv-asset-handler@0.5.0': {}
+
+  '@cloudflare/sandbox@0.12.3':
+    dependencies:
+      '@cloudflare/containers': 0.3.7
+      aws4fetch: 1.0.20
+      capnweb: 0.8.0
+      hono: 4.12.28
+
+  '@cloudflare/unenv-preset@2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260706.1)':
+    dependencies:
+      unenv: 2.0.0-rc.24
+    optionalDependencies:
+      workerd: 1.20260706.1
+
+  '@cloudflare/workerd-darwin-64@1.20260706.1':
+    optional: true
+
+  '@cloudflare/workerd-darwin-arm64@1.20260706.1':
+    optional: true
+
+  '@cloudflare/workerd-linux-64@1.20260706.1':
+    optional: true
+
+  '@cloudflare/workerd-linux-arm64@1.20260706.1':
+    optional: true
+
+  '@cloudflare/workerd-windows-64@1.20260706.1':
+    optional: true
+
+  '@cloudflare/workers-types@4.20260702.1': {}
+
+  '@codemirror/autocomplete@6.20.3':
+    dependencies:
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      '@lezer/common': 1.5.2
+
+  '@codemirror/commands@6.10.4':
+    dependencies:
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      '@lezer/common': 1.5.2
+
+  '@codemirror/lang-css@6.3.1':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.3
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.1
+      '@lezer/common': 1.5.2
+      '@lezer/css': 1.3.4
+
+  '@codemirror/lang-html@6.4.11':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.3
+      '@codemirror/lang-css': 6.3.1
+      '@codemirror/lang-javascript': 6.2.5
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      '@lezer/common': 1.5.2
+      '@lezer/css': 1.3.4
+      '@lezer/html': 1.3.13
+
+  '@codemirror/lang-javascript@6.2.5':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.3
+      '@codemirror/language': 6.12.4
+      '@codemirror/lint': 6.9.7
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      '@lezer/common': 1.5.2
+      '@lezer/javascript': 1.5.4
+
+  '@codemirror/lang-json@6.0.2':
+    dependencies:
+      '@codemirror/language': 6.12.4
+      '@lezer/json': 1.0.3
+
+  '@codemirror/lang-vue@0.1.3':
+    dependencies:
+      '@codemirror/lang-html': 6.4.11
+      '@codemirror/lang-javascript': 6.2.5
+      '@codemirror/language': 6.12.4
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.10
+
+  '@codemirror/language@6.12.4':
+    dependencies:
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.10
+      style-mod: 4.1.3
+
+  '@codemirror/lint@6.9.7':
+    dependencies:
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      crelt: 1.0.7
+
+  '@codemirror/search@6.7.1':
+    dependencies:
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      crelt: 1.0.7
+
+  '@codemirror/state@6.7.1':
+    dependencies:
+      '@marijn/find-cluster-break': 1.0.3
+
+  '@codemirror/theme-one-dark@6.1.3':
+    dependencies:
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+      '@lezer/highlight': 1.2.3
+
+  '@codemirror/view@6.43.6':
+    dependencies:
+      '@codemirror/state': 6.7.1
+      crelt: 1.0.7
+      style-mod: 4.1.3
+      w3c-keyname: 2.2.8
+
+  '@codesandbox/nodebox@0.1.8':
+    dependencies:
+      outvariant: 1.4.0
+      strict-event-emitter: 0.4.6
+
+  '@codesandbox/sandpack-client@2.19.8':
+    dependencies:
+      '@codesandbox/nodebox': 0.1.8
+      buffer: 6.0.3
+      dequal: 2.0.3
+      mime-db: 1.54.0
+      outvariant: 1.4.0
+      static-browser-server: 1.0.3
+
+  '@cspotcode/source-map-support@0.8.1':
+    dependencies:
+      '@jridgewell/trace-mapping': 0.3.9
+
+  '@emnapi/runtime@1.11.2':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
+  '@esbuild/aix-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/aix-ppc64@0.28.1':
+    optional: true
+
+  '@esbuild/android-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/android-arm@0.25.12':
+    optional: true
+
+  '@esbuild/android-arm@0.28.1':
+    optional: true
+
+  '@esbuild/android-x64@0.25.12':
+    optional: true
+
+  '@esbuild/android-x64@0.28.1':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/darwin-x64@0.25.12':
+    optional: true
+
+  '@esbuild/darwin-x64@0.28.1':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/freebsd-x64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-arm@0.25.12':
+    optional: true
+
+  '@esbuild/linux-arm@0.28.1':
+    optional: true
+
+  '@esbuild/linux-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ia32@0.28.1':
+    optional: true
+
+  '@esbuild/linux-loong64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-loong64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.25.12':
+    optional: true
+
+  '@esbuild/linux-mips64el@0.28.1':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-ppc64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-riscv64@0.28.1':
+    optional: true
+
+  '@esbuild/linux-s390x@0.25.12':
+    optional: true
+
+  '@esbuild/linux-s390x@0.28.1':
+    optional: true
+
+  '@esbuild/linux-x64@0.25.12':
+    optional: true
+
+  '@esbuild/linux-x64@0.28.1':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/netbsd-x64@0.28.1':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.25.12':
+    optional: true
+
+  '@esbuild/openbsd-x64@0.28.1':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/openharmony-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/sunos-x64@0.25.12':
+    optional: true
+
+  '@esbuild/sunos-x64@0.28.1':
+    optional: true
+
+  '@esbuild/win32-arm64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-arm64@0.28.1':
+    optional: true
+
+  '@esbuild/win32-ia32@0.25.12':
+    optional: true
+
+  '@esbuild/win32-ia32@0.28.1':
+    optional: true
+
+  '@esbuild/win32-x64@0.25.12':
+    optional: true
+
+  '@esbuild/win32-x64@0.28.1':
+    optional: true
+
+  '@img/colour@1.1.0': {}
+
+  '@img/sharp-darwin-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-darwin-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-darwin-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-libvips-darwin-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-darwin-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-arm@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-ppc64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-riscv64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-s390x@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linux-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-arm64@1.2.4':
+    optional: true
+
+  '@img/sharp-libvips-linuxmusl-x64@1.2.4':
+    optional: true
+
+  '@img/sharp-linux-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-arm@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-arm': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-ppc64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-riscv64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-s390x@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+    optional: true
+
+  '@img/sharp-linux-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linux-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-arm64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+    optional: true
+
+  '@img/sharp-linuxmusl-x64@0.34.5':
+    optionalDependencies:
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+    optional: true
+
+  '@img/sharp-wasm32@0.34.5':
+    dependencies:
+      '@emnapi/runtime': 1.11.2
+    optional: true
+
+  '@img/sharp-win32-arm64@0.34.5':
+    optional: true
+
+  '@img/sharp-win32-ia32@0.34.5':
+    optional: true
+
+  '@img/sharp-win32-x64@0.34.5':
+    optional: true
+
+  '@jridgewell/gen-mapping@0.3.13':
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/remapping@2.3.5':
+    dependencies:
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+
+  '@jridgewell/resolve-uri@3.1.2': {}
+
+  '@jridgewell/sourcemap-codec@1.5.5': {}
+
+  '@jridgewell/trace-mapping@0.3.31':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@jridgewell/trace-mapping@0.3.9':
+    dependencies:
+      '@jridgewell/resolve-uri': 3.1.2
+      '@jridgewell/sourcemap-codec': 1.5.5
+
+  '@lezer/common@1.5.2': {}
+
+  '@lezer/css@1.3.4':
+    dependencies:
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.10
+
+  '@lezer/highlight@1.2.3':
+    dependencies:
+      '@lezer/common': 1.5.2
+
+  '@lezer/html@1.3.13':
+    dependencies:
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.10
+
+  '@lezer/javascript@1.5.4':
+    dependencies:
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.10
+
+  '@lezer/json@1.0.3':
+    dependencies:
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.10
+
+  '@lezer/lr@1.4.10':
+    dependencies:
+      '@lezer/common': 1.5.2
+
+  '@marijn/find-cluster-break@1.0.3': {}
+
+  '@open-draft/deferred-promise@2.2.0': {}
+
+  '@poppinss/colors@4.1.6':
+    dependencies:
+      kleur: 4.1.5
+
+  '@poppinss/dumper@0.6.5':
+    dependencies:
+      '@poppinss/colors': 4.1.6
+      '@sindresorhus/is': 7.2.0
+      supports-color: 10.2.2
+
+  '@poppinss/exception@1.2.3': {}
+
+  '@rolldown/pluginutils@1.0.0-beta.27': {}
+
+  '@rollup/rollup-android-arm-eabi@4.62.2':
+    optional: true
+
+  '@rollup/rollup-android-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-darwin-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-darwin-x64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-freebsd-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-freebsd-x64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm-musleabihf@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-arm64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-loong64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-ppc64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-riscv64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-s390x-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-x64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-linux-x64-musl@4.62.2':
+    optional: true
+
+  '@rollup/rollup-openbsd-x64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-openharmony-arm64@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-arm64-msvc@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-ia32-msvc@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-x64-gnu@4.62.2':
+    optional: true
+
+  '@rollup/rollup-win32-x64-msvc@4.62.2':
+    optional: true
+
+  '@sindresorhus/is@7.2.0': {}
+
+  '@speed-highlight/core@1.2.17': {}
+
+  '@types/babel__core@7.20.5':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@types/babel__generator': 7.27.0
+      '@types/babel__template': 7.4.4
+      '@types/babel__traverse': 7.28.0
+
+  '@types/babel__generator@7.27.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/babel__template@7.4.4':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+
+  '@types/babel__traverse@7.28.0':
+    dependencies:
+      '@babel/types': 7.29.7
+
+  '@types/estree@1.0.9': {}
+
+  '@types/react-dom@19.2.3(@types/react@19.2.17)':
+    dependencies:
+      '@types/react': 19.2.17
+
+  '@types/react@19.2.17':
+    dependencies:
+      csstype: 3.2.3
+
+  '@types/semver@7.7.1': {}
+
+  '@uiw/codemirror-extensions-basic-setup@4.25.10(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.4)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)':
+    dependencies:
+      '@codemirror/autocomplete': 6.20.3
+      '@codemirror/commands': 6.10.4
+      '@codemirror/language': 6.12.4
+      '@codemirror/lint': 6.9.7
+      '@codemirror/search': 6.7.1
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+
+  '@uiw/react-codemirror@4.25.10(@babel/runtime@8.0.0)(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.1)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.6)(codemirror@6.0.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+    dependencies:
+      '@babel/runtime': 8.0.0
+      '@codemirror/commands': 6.10.4
+      '@codemirror/state': 6.7.1
+      '@codemirror/theme-one-dark': 6.1.3
+      '@codemirror/view': 6.43.6
+      '@uiw/codemirror-extensions-basic-setup': 4.25.10(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.4)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.1)(@codemirror/view@6.43.6)
+      codemirror: 6.0.2
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+    transitivePeerDependencies:
+      - '@codemirror/autocomplete'
+      - '@codemirror/language'
+      - '@codemirror/lint'
+      - '@codemirror/search'
+
+  '@vitejs/plugin-react@4.7.0(vite@6.4.3)':
+    dependencies:
+      '@babel/core': 7.29.7
+      '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
+      '@rolldown/pluginutils': 1.0.0-beta.27
+      '@types/babel__core': 7.20.5
+      react-refresh: 0.17.0
+      vite: 6.4.3
+    transitivePeerDependencies:
+      - supports-color
+
+  aws4fetch@1.0.20: {}
+
+  base64-js@1.5.1: {}
+
+  baseline-browser-mapping@2.10.42: {}
+
+  blake3-wasm@2.1.5: {}
+
+  browserslist@4.28.5:
+    dependencies:
+      baseline-browser-mapping: 2.10.42
+      caniuse-lite: 1.0.30001803
+      electron-to-chromium: 1.5.389
+      node-releases: 2.0.50
+      update-browserslist-db: 1.2.3(browserslist@4.28.5)
+
+  buffer@6.0.3:
+    dependencies:
+      base64-js: 1.5.1
+      ieee754: 1.2.1
+
+  caniuse-lite@1.0.30001803: {}
+
+  capnweb@0.8.0: {}
+
+  codemirror@6.0.2:
+    dependencies:
+      '@codemirror/autocomplete': 6.20.3
+      '@codemirror/commands': 6.10.4
+      '@codemirror/language': 6.12.4
+      '@codemirror/lint': 6.9.7
+      '@codemirror/search': 6.7.1
+      '@codemirror/state': 6.7.1
+      '@codemirror/view': 6.43.6
+
+  convert-source-map@2.0.0: {}
+
+  cookie@1.1.1: {}
+
+  crelt@1.0.7: {}
+
+  csstype@3.2.3: {}
+
+  debug@4.4.3:
+    dependencies:
+      ms: 2.1.3
+
+  dequal@2.0.3: {}
+
+  detect-libc@2.1.2: {}
+
+  dotenv@16.6.1: {}
+
+  electron-to-chromium@1.5.389: {}
+
+  error-stack-parser-es@1.0.5: {}
+
+  esbuild@0.25.12:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.25.12
+      '@esbuild/android-arm': 0.25.12
+      '@esbuild/android-arm64': 0.25.12
+      '@esbuild/android-x64': 0.25.12
+      '@esbuild/darwin-arm64': 0.25.12
+      '@esbuild/darwin-x64': 0.25.12
+      '@esbuild/freebsd-arm64': 0.25.12
+      '@esbuild/freebsd-x64': 0.25.12
+      '@esbuild/linux-arm': 0.25.12
+      '@esbuild/linux-arm64': 0.25.12
+      '@esbuild/linux-ia32': 0.25.12
+      '@esbuild/linux-loong64': 0.25.12
+      '@esbuild/linux-mips64el': 0.25.12
+      '@esbuild/linux-ppc64': 0.25.12
+      '@esbuild/linux-riscv64': 0.25.12
+      '@esbuild/linux-s390x': 0.25.12
+      '@esbuild/linux-x64': 0.25.12
+      '@esbuild/netbsd-arm64': 0.25.12
+      '@esbuild/netbsd-x64': 0.25.12
+      '@esbuild/openbsd-arm64': 0.25.12
+      '@esbuild/openbsd-x64': 0.25.12
+      '@esbuild/openharmony-arm64': 0.25.12
+      '@esbuild/sunos-x64': 0.25.12
+      '@esbuild/win32-arm64': 0.25.12
+      '@esbuild/win32-ia32': 0.25.12
+      '@esbuild/win32-x64': 0.25.12
+
+  esbuild@0.28.1:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.1
+      '@esbuild/android-arm': 0.28.1
+      '@esbuild/android-arm64': 0.28.1
+      '@esbuild/android-x64': 0.28.1
+      '@esbuild/darwin-arm64': 0.28.1
+      '@esbuild/darwin-x64': 0.28.1
+      '@esbuild/freebsd-arm64': 0.28.1
+      '@esbuild/freebsd-x64': 0.28.1
+      '@esbuild/linux-arm': 0.28.1
+      '@esbuild/linux-arm64': 0.28.1
+      '@esbuild/linux-ia32': 0.28.1
+      '@esbuild/linux-loong64': 0.28.1
+      '@esbuild/linux-mips64el': 0.28.1
+      '@esbuild/linux-ppc64': 0.28.1
+      '@esbuild/linux-riscv64': 0.28.1
+      '@esbuild/linux-s390x': 0.28.1
+      '@esbuild/linux-x64': 0.28.1
+      '@esbuild/netbsd-arm64': 0.28.1
+      '@esbuild/netbsd-x64': 0.28.1
+      '@esbuild/openbsd-arm64': 0.28.1
+      '@esbuild/openbsd-x64': 0.28.1
+      '@esbuild/openharmony-arm64': 0.28.1
+      '@esbuild/sunos-x64': 0.28.1
+      '@esbuild/win32-arm64': 0.28.1
+      '@esbuild/win32-ia32': 0.28.1
+      '@esbuild/win32-x64': 0.28.1
+
+  escalade@3.2.0: {}
+
+  fdir@6.5.0(picomatch@4.0.5):
+    optionalDependencies:
+      picomatch: 4.0.5
+
+  fflate@0.8.3: {}
+
+  fsevents@2.3.3:
+    optional: true
+
+  gensync@1.0.0-beta.2: {}
+
+  hono@4.12.28: {}
+
+  ieee754@1.2.1: {}
+
+  js-tokens@4.0.0: {}
+
+  jsesc@3.1.0: {}
+
+  json5@2.2.3: {}
+
+  kleur@4.1.5: {}
+
+  lru-cache@5.1.1:
+    dependencies:
+      yallist: 3.1.1
+
+  mime-db@1.54.0: {}
+
+  miniflare@4.20260706.0:
+    dependencies:
+      '@cspotcode/source-map-support': 0.8.1
+      sharp: 0.34.5
+      undici: 7.28.0
+      workerd: 1.20260706.1
+      ws: 8.21.0
+      youch: 4.1.0-beta.10
+    transitivePeerDependencies:
+      - bufferutil
+      - utf-8-validate
+
+  ms@2.1.3: {}
+
+  nanoid@3.3.15: {}
+
+  node-releases@2.0.50: {}
+
+  outvariant@1.4.0: {}
+
+  path-to-regexp@6.3.0: {}
+
+  pathe@2.0.3: {}
+
+  picocolors@1.1.1: {}
+
+  picomatch@4.0.5: {}
+
+  postcss@8.5.16:
+    dependencies:
+      nanoid: 3.3.15
+      picocolors: 1.1.1
+      source-map-js: 1.2.1
+
+  react-dom@19.2.7(react@19.2.7):
+    dependencies:
+      react: 19.2.7
+      scheduler: 0.27.0
+
+  react-refresh@0.17.0: {}
+
+  react@19.2.7: {}
+
+  rollup@4.62.2:
+    dependencies:
+      '@types/estree': 1.0.9
+    optionalDependencies:
+      '@rollup/rollup-android-arm-eabi': 4.62.2
+      '@rollup/rollup-android-arm64': 4.62.2
+      '@rollup/rollup-darwin-arm64': 4.62.2
+      '@rollup/rollup-darwin-x64': 4.62.2
+      '@rollup/rollup-freebsd-arm64': 4.62.2
+      '@rollup/rollup-freebsd-x64': 4.62.2
+      '@rollup/rollup-linux-arm-gnueabihf': 4.62.2
+      '@rollup/rollup-linux-arm-musleabihf': 4.62.2
+      '@rollup/rollup-linux-arm64-gnu': 4.62.2
+      '@rollup/rollup-linux-arm64-musl': 4.62.2
+      '@rollup/rollup-linux-loong64-gnu': 4.62.2
+      '@rollup/rollup-linux-loong64-musl': 4.62.2
+      '@rollup/rollup-linux-ppc64-gnu': 4.62.2
+      '@rollup/rollup-linux-ppc64-musl': 4.62.2
+      '@rollup/rollup-linux-riscv64-gnu': 4.62.2
+      '@rollup/rollup-linux-riscv64-musl': 4.62.2
+      '@rollup/rollup-linux-s390x-gnu': 4.62.2
+      '@rollup/rollup-linux-x64-gnu': 4.62.2
+      '@rollup/rollup-linux-x64-musl': 4.62.2
+      '@rollup/rollup-openbsd-x64': 4.62.2
+      '@rollup/rollup-openharmony-arm64': 4.62.2
+      '@rollup/rollup-win32-arm64-msvc': 4.62.2
+      '@rollup/rollup-win32-ia32-msvc': 4.62.2
+      '@rollup/rollup-win32-x64-gnu': 4.62.2
+      '@rollup/rollup-win32-x64-msvc': 4.62.2
+      fsevents: 2.3.3
+
+  scheduler@0.27.0: {}
+
+  semver@6.3.1: {}
+
+  semver@7.8.5: {}
+
+  sharp@0.34.5:
+    dependencies:
+      '@img/colour': 1.1.0
+      detect-libc: 2.1.2
+      semver: 7.8.5
+    optionalDependencies:
+      '@img/sharp-darwin-arm64': 0.34.5
+      '@img/sharp-darwin-x64': 0.34.5
+      '@img/sharp-libvips-darwin-arm64': 1.2.4
+      '@img/sharp-libvips-darwin-x64': 1.2.4
+      '@img/sharp-libvips-linux-arm': 1.2.4
+      '@img/sharp-libvips-linux-arm64': 1.2.4
+      '@img/sharp-libvips-linux-ppc64': 1.2.4
+      '@img/sharp-libvips-linux-riscv64': 1.2.4
+      '@img/sharp-libvips-linux-s390x': 1.2.4
+      '@img/sharp-libvips-linux-x64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-arm64': 1.2.4
+      '@img/sharp-libvips-linuxmusl-x64': 1.2.4
+      '@img/sharp-linux-arm': 0.34.5
+      '@img/sharp-linux-arm64': 0.34.5
+      '@img/sharp-linux-ppc64': 0.34.5
+      '@img/sharp-linux-riscv64': 0.34.5
+      '@img/sharp-linux-s390x': 0.34.5
+      '@img/sharp-linux-x64': 0.34.5
+      '@img/sharp-linuxmusl-arm64': 0.34.5
+      '@img/sharp-linuxmusl-x64': 0.34.5
+      '@img/sharp-wasm32': 0.34.5
+      '@img/sharp-win32-arm64': 0.34.5
+      '@img/sharp-win32-ia32': 0.34.5
+      '@img/sharp-win32-x64': 0.34.5
+
+  source-map-js@1.2.1: {}
+
+  static-browser-server@1.0.3:
+    dependencies:
+      '@open-draft/deferred-promise': 2.2.0
+      dotenv: 16.6.1
+      mime-db: 1.54.0
+      outvariant: 1.4.0
+
+  strict-event-emitter@0.4.6: {}
+
+  style-mod@4.1.3: {}
+
+  supports-color@10.2.2: {}
+
+  tinyglobby@0.2.17:
+    dependencies:
+      fdir: 6.5.0(picomatch@4.0.5)
+      picomatch: 4.0.5
+
+  tslib@2.8.1:
+    optional: true
+
+  typescript@5.6.3: {}
+
+  undici@7.28.0: {}
+
+  unenv@2.0.0-rc.24:
+    dependencies:
+      pathe: 2.0.3
+
+  update-browserslist-db@1.2.3(browserslist@4.28.5):
+    dependencies:
+      browserslist: 4.28.5
+      escalade: 3.2.0
+      picocolors: 1.1.1
+
+  vite@6.4.3:
+    dependencies:
+      esbuild: 0.25.12
+      fdir: 6.5.0(picomatch@4.0.5)
+      picomatch: 4.0.5
+      postcss: 8.5.16
+      rollup: 4.62.2
+      tinyglobby: 0.2.17
+    optionalDependencies:
+      fsevents: 2.3.3
+
+  w3c-keyname@2.2.8: {}
+
+  workerd@1.20260706.1:
+    optionalDependencies:
+      '@cloudflare/workerd-darwin-64': 1.20260706.1
+      '@cloudflare/workerd-darwin-arm64': 1.20260706.1
+      '@cloudflare/workerd-linux-64': 1.20260706.1
+      '@cloudflare/workerd-linux-arm64': 1.20260706.1
+      '@cloudflare/workerd-windows-64': 1.20260706.1
+
+  wrangler@4.108.0(@cloudflare/workers-types@4.20260702.1):
+    dependencies:
+      '@cloudflare/kv-asset-handler': 0.5.0
+      '@cloudflare/unenv-preset': 2.16.1(unenv@2.0.0-rc.24)(workerd@1.20260706.1)
+      blake3-wasm: 2.1.5
+      esbuild: 0.28.1
+      miniflare: 4.20260706.0
+      path-to-regexp: 6.3.0
+      unenv: 2.0.0-rc.24
+      workerd: 1.20260706.1
+    optionalDependencies:
+      '@cloudflare/workers-types': 4.20260702.1
+      fsevents: 2.3.3
+    transitivePeerDependencies:
+      - bufferutil
+      - utf-8-validate
+
+  ws@8.21.0: {}
+
+  yallist@3.1.1: {}
+
+  youch-core@0.3.3:
+    dependencies:
+      '@poppinss/exception': 1.2.3
+      error-stack-parser-es: 1.0.5
+
+  youch@4.1.0-beta.10:
+    dependencies:
+      '@poppinss/colors': 4.1.6
+      '@poppinss/dumper': 0.6.5
+      '@speed-highlight/core': 1.2.17
+      cookie: 1.1.1
+      youch-core: 0.3.3

From fc5263cb9aedd04bec8366f5e09e8d63c8168d8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Artur=20M=C4=99dryga=C5=82?=
 <artur.medrygal@handsontable.com>
Date: Wed, 15 Jul 2026 09:55:34 +0200
Subject: [PATCH 15/15] runner: use pnpm exec in angular devCommand metadata
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The angular devCommand in frameworks.json and import-docs.mjs still
carried the `pnpm run start -- --flags` pattern this branch documents
as broken (pnpm forwards the literal `--`, so --host/--port go inert).
Nothing executes devCommand — container sessions run the generated
FRAMEWORK_DEV cmd from prepare-container.mjs — but catalog and
docs-example metadata shouldn't advertise a known-broken invocation.
Flagged by Bugbot on #41.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 runner/config/frameworks.json   | 2 +-
 runner/pipeline/import-docs.mjs | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/runner/config/frameworks.json b/runner/config/frameworks.json
index 68d1ce5f..4f7e9c0b 100644
--- a/runner/config/frameworks.json
+++ b/runner/config/frameworks.json
@@ -139,7 +139,7 @@
       "htWrappers": ["@handsontable/angular-wrapper"],
       "entry": "src/main.ts",
       "htmlEntry": "src/index.html",
-      "devCommand": "pnpm run start -- --host 0.0.0.0 --disable-host-check --port 3000",
+      "devCommand": "pnpm exec ng serve --host 0.0.0.0 --disable-host-check --port 3000",
       "buildCommand": "ng build",
       "outputDir": "dist",
       "outputGlob": "dist/*/browser",
diff --git a/runner/pipeline/import-docs.mjs b/runner/pipeline/import-docs.mjs
index 592e1db5..858ae4fa 100644
--- a/runner/pipeline/import-docs.mjs
+++ b/runner/pipeline/import-docs.mjs
@@ -140,7 +140,7 @@ const RUNNER = {
     sandpackTemplate: null, sandpackEnvironment: null, container: "angular",
     htWrappers: ["@handsontable/angular-wrapper"],
     entry: "/src/main.ts", htmlEntry: "/src/index.html",
-    devCommand: "pnpm run start -- --host 0.0.0.0 --disable-host-check --port 3000",
+    devCommand: "pnpm exec ng serve --host 0.0.0.0 --disable-host-check --port 3000",
     buildCommand: "ng build", outputDir: "dist", outputGlob: "dist/*/browser",
     staticExport: false, spaMode: false, port: 3000, installCommand: "pnpm install",
   },