docs: update plan for migration of backend

test: Add tests for auth workflow

.nuxtrc

@@ -0,0 +1 @@
+setups.@nuxt/test-utils="4.0.2"

app/middleware/auth.ts

@@ -1,10 +1,7 @@
+import { checkAuthRedirect } from '~/utils/auth'
+
 export default defineNuxtRouteMiddleware((to) => {
   const user = useSupabaseUser()
-
+  const redirect = checkAuthRedirect(user.value, to.path)
-  const publicRoutes = ['/', '/login', '/signup', '/auth/callback']
+  if (redirect) return navigateTo(redirect)
-  if (publicRoutes.includes(to.path)) return
-
-  if (!user.value) {
-    return navigateTo('/')
-  }
 })

app/pages/auth/callback.vue

@@ -1,13 +1,59 @@
 <template>
   <IonPage>
     <IonContent class="ion-padding ion-text-center">
-      <p>Signing you in...</p>
+      <div class="callback-state">
+        <IonSpinner v-if="!errorMessage" name="crescent" class="callback-spinner" />
+        <IonIcon v-else :icon="alertCircleOutline" class="callback-error-icon" color="danger" />
+        <p>{{ errorMessage || 'Signing you in...' }}</p>
+      </div>
     </IonContent>
   </IonPage>
 </template>
 
 <script setup lang="ts">
-import { IonPage, IonContent } from '@ionic/vue'
+import { IonPage, IonContent, IonSpinner, IonIcon } from '@ionic/vue'
+import { alertCircleOutline } from 'ionicons/icons'
 
 definePageMeta({ layout: false })
+
+const supabase = useSupabaseClient()
+const user = useSupabaseUser()
+const route = useRoute()
+const errorMessage = ref('')
+
+onMounted(async () => {
+  const code = route.query.code as string | undefined
+  if (code) {
+    const { error } = await supabase.auth.exchangeCodeForSession(code)
+    if (error) {
+      errorMessage.value = 'Sign-in failed. Please try again.'
+      return
+    }
+  }
+})
+
+// Navigate home once session is established (handles both hash-based and PKCE flows)
+watch(user, (value) => {
+  if (value) navigateTo('/')
+}, { immediate: true })
 </script>
+
+<style scoped>
+.callback-state {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  height: 100%;
+  gap: 1rem;
+}
+
+.callback-spinner {
+  width: 2.5rem;
+  height: 2.5rem;
+}
+
+.callback-error-icon {
+  font-size: 2.5rem;
+}
+</style>

app/utils/auth.ts

@@ -0,0 +1,14 @@
+export const PUBLIC_ROUTES = ['/', '/login', '/signup', '/auth/callback'] as const
+
+/**
+ * Pure auth decision logic — no Nuxt/Supabase dependencies.
+ * Returns the path to redirect to, or null if no redirect is needed.
+ */
+export function checkAuthRedirect(
+  userValue: { id: string } | null,
+  path: string,
+): string | null {
+  if ((PUBLIC_ROUTES as readonly string[]).includes(path)) return null
+  if (!userValue) return '/'
+  return null
+}

docs/context/sdlc-architecture.md

@@ -0,0 +1,192 @@
+# SDLC Architecture — oysqn.app
+
+**Date:** 2026-04-12
+**Status:** Decided — no open items
+
+## Project Topology
+
+| Repo | Purpose | Status |
+|------|---------|--------|
+| `oysqn.app` | Nuxt PWA + Supabase schema/migrations + all tests | Active |
+| `bab-backend-ansible` | Infra provisioning, deployment orchestration, day2 ops | Needs rewrite (Appwrite → Supabase) |
+
+## Lifecycle Phases
+
+1. **Local Dev** — `yarn dev` + `npx supabase start` (Podman)
+2. **Dev server** — `https://bab.toal.ca` (nginx on `bab1.mgmt.toal.ca`, webroot `/usr/share/nginx/html/`); backend = supabase.com
+3. **Production** — static site on AWS S3; backend = supabase.com
+
+## Backend Hosting
+
+**supabase.com** (free tier initially; may self-host if free plan limits are exceeded).
+- supabase.com provides direct Postgres access (connection string) on all tiers including free.
+- Backups: `pg_dump` via Postgres connection string → compressed → stored to `bab1.mgmt.toal.ca` via SSH.
+- Migrations: `supabase db push` against remote project (Supabase CLI).
+- Rollback strategy: pre-migration `pg_dump` backup + rollback SQL scripts (see Down-Migration Convention).
+
+## Supabase Projects
+
+Two separate supabase.com projects — isolated credentials and migration state:
+
+| Project | Purpose |
+|---------|---------|
+| `oysqn-dev` | Development + staging |
+| `oysqn-prod` | Production |
+
+Migrations promoted dev → prod only after E2E validation on dev.
+
+## Down-Migration Convention
+
+Supabase CLI only runs forward migrations. Rollback scripts are separate files executed by AAP on failure.
+
+```
+supabase/
+  migrations/
+    20260325000000_initial_schema.sql      ← forward (applied by supabase db push)
+    20260412120000_add_boats_table.sql
+  rollback/
+    20260412120000_add_boats_table.sql     ← reverse SQL, same filename, separate dir
+```
+
+Rules:
+- Every forward migration **must** have a corresponding rollback file before the PR merges
+- Rollback files are plain SQL executed by AAP via `psql` on rollback
+- If a migration is irreversible (e.g., data-destroying DROP), document this explicitly at the top of the rollback file — AAP alerts and halts rather than executing
+
+## Secrets Management
+
+**All secrets in HashiCorp Vault:** `http://nas.lan.toal.ca:8200` — KV path prefix: `kv/oys/`
+
+Format: `kv/oys/(dev|prod|shared)/(supabase|app|infra)/<secretname>`
+
+| Secret | Vault path | Consumers |
+|--------|-----------|-----------|
+| Supabase dev API URL | `kv/oys/dev/supabase/url` | Gitea Actions (ENV_FILE), AAP |
+| Supabase dev anon key | `kv/oys/dev/supabase/anon_key` | Gitea Actions (ENV_FILE), AAP |
+| Supabase dev service role key | `kv/oys/dev/supabase/service_role_key` | AAP (migrations) |
+| Supabase prod API URL | `kv/oys/prod/supabase/url` | Gitea Actions (ENV_FILE), AAP |
+| Supabase prod anon key | `kv/oys/prod/supabase/anon_key` | Gitea Actions (ENV_FILE), AAP |
+| Supabase prod service role key | `kv/oys/prod/supabase/service_role_key` | AAP (migrations, pg_dump) |
+| Supabase prod Postgres conn string | `kv/oys/prod/supabase/postgres_url` | AAP (pg_dump) |
+| AWS access key ID | `kv/oys/prod/app/aws_access_key_id` | AAP (S3 deploy) |
+| AWS secret access key | `kv/oys/prod/app/aws_secret_access_key` | AAP (S3 deploy) |
+| AWS S3 bucket name | `kv/oys/prod/app/aws_s3_bucket` | AAP (S3 deploy) |
+| SSH private key (bab1) | `kv/oys/shared/infra/ssh_private_key` | AAP (backup, nginx deploy) |
+| Gitea API token | `kv/oys/shared/infra/gitea_token` | AAP (fetch artifacts, sync secrets) |
+
+**Local dev:** Secrets in `.env` (git-ignored). Do not put real values in `.env.example`.
+**AAP:** Vault lookup plugin as a credential type.
+**Gitea Actions:** Variable `ENV_FILE` (per branch) populated by AAP sync playbook (see below).
+**Gitea URL:** `https://gitea.toal.ca/`
+**Gitea artifact download token:** `kv/oys/bab_gitea` (pre-existing secret; deviates from naming convention — use as-is).
+
+### Gitea Actions Secret Injection
+
+Follows the same `ENV_FILE` pattern as `bab-app`. AAP runs a `sync-gitea-secrets` playbook:
+- **Trigger:** Scheduled daily + on-demand job template
+- **Action:** Reads `url` + `anon_key` from Vault, constructs `.env` content, updates Gitea repo variable via API (`PUT /api/v1/repos/{owner}/{repo}/actions/variables/ENV_FILE_DEV` and `ENV_FILE_PROD`)
+- **In workflow:** `echo "${{ vars.ENV_FILE_DEV }}" > .env` (dev branch) / `ENV_FILE_PROD` (main branch)
+
+## CI/CD Toolchain
+
+- **SCM:** Gitea
+- **CI:** Gitea Actions — unit tests + build + semantic-release → Gitea Release artifact
+- **CD + ops:** Ansible + EDA — triggered by Gitea webhook; backup, migrate, deploy, smoke test, rollback
+- **Branch strategy:** `dev` → dev server; `main` → production (manual approval gate in AAP)
+
+### Pipeline Architecture
+
+```
+Gitea push (dev or main)
+    │
+    ▼
+Gitea Actions (.gitea/workflows/build.yaml)
+    ├── yarn test              (unit tests — no external deps)
+    ├── echo $ENV_FILE_DEV > .env  (or ENV_FILE_PROD for main)
+    ├── yarn semantic-release  (bumps version, builds tarball, publishes Gitea Release)
+    │     └── prepareCmd: yarn generate → tar release-<version>.tar.gz
+    │     └── publishCmd: attaches tarball to Gitea Release, sets VERSION output
+    └── webhook → EDA (artifact_url, branch, version)
+            │
+            ▼
+        EDA rulebook receives webhook
+            │
+            ▼
+        AAP workflow template
+            ├── pre-deploy: pg_dump → bab1.mgmt.toal.ca (pre-migration snapshot)
+            ├── migrate: supabase db push → if fails, run rollback SQL + abort
+            ├── deploy: fetch artifact → S3 sync (prod) or nginx swap (dev)
+            ├── post-deploy: yarn test:e2e BASE_URL=<deployed-url>
+            ├── on failure: psql rollback script, redeploy previous artifact, notify
+            └── on success: notify
+```
+
+### Artifact Pattern (Matches bab-app)
+
+- `semantic-release` + `@saithodev/semantic-release-gitea`
+- Tarball: `release-<version>.tar.gz` of `.output/public/`
+- Attached to Gitea Release
+- Webhook payload: `{ "artifact_url": "...", "version": "...", "branch": "..." }`
+
+## Backup Policy
+
+**Scope:** Production only. Dev database is ephemeral — no backups.
+**Location:** `bab1.mgmt.toal.ca:/var/backups/oysqn/` (confirm path before first production backup)
+
+| Type | Retention | Max count |
+|------|-----------|-----------|
+| Regular (daily + pre-migration) | 90 days | 30 |
+| Monthly | 12 months | 12 |
+
+Monthly backups taken on the 1st of each month. AAP rotation playbook enforces limits after each backup run.
+
+Filename convention:
+- Regular: `oysqn-prod-<YYYYMMDD-HHMMSS>.sql.gz`
+- Monthly: `oysqn-prod-<YYYY-MM>-monthly.sql.gz`
+
+## Test Strategy
+
+### Test Tiers
+
+| Tier | Tool | Runs in | Requires |
+|------|------|---------|---------|
+| Unit | Vitest | Gitea Actions + local | Nothing |
+| Integration | Vitest (node) | Local only | Local Supabase + `SUPABASE_SERVICE_ROLE_KEY` |
+| E2E | Playwright | Local + AAP post-deploy | Running app + Supabase |
+
+### Unit Test Scope
+
+- **Test:** pure business logic, auth middleware, Pinia store actions, utility functions
+- **Do NOT unit test:** Vue components that primarily compose Ionic/PrimeVue — E2E covers these
+- **Reason:** Mocking Nuxt auto-imports (`#imports`) creates brittle tests that test mocks, not code
+
+### Integration Test Scope
+
+- Supabase RLS policy correctness (one suite per role)
+- Auth flows and session creation
+- Run locally: `SUPABASE_SERVICE_ROLE_KEY=<key> yarn test:integration`
+
+### E2E Test Strategy
+
+- **Lives in:** `oysqn.app/tests/e2e/` — versioned with app code, tool: Playwright
+- **Parameterized by:** `BASE_URL` env var
+- **Local:** `BASE_URL=http://localhost:3000 yarn test:e2e`
+- **Post-deploy:** AAP calls `yarn test:e2e` with deployed URL
+- **Not in Gitea CI** — runner has no Docker/Podman for local Supabase
+
+## bab-backend-ansible Rewrite Scope
+
+New responsibilities (all Appwrite playbooks retired):
+1. **Infra provisioning** — dev server nginx setup, cert management, monitoring
+2. **Supabase migrations** — `supabase db push` against supabase.com; rollback on failure
+3. **Backup** — prod only; scheduled daily + pre-migration `pg_dump` → `bab1.mgmt.toal.ca`; rotation enforcing retention policy
+4. **Frontend deployment** — S3 sync (prod), nginx artifact swap (dev)
+5. **Day2 ops** — cert renewal, log rotation, health checks
+6. **Secret sync** — `sync-gitea-secrets` playbook populates Gitea `ENV_FILE_DEV` / `ENV_FILE_PROD` variables from Vault
+7. **EDA rulebooks** — Gitea push webhook → trigger AAP workflow template
+
+## Assumptions
+
+- `main` branch → production requires manual approval gate in AAP before deploy
+- Gitea Actions runner is `ubuntu-latest` (same as bab-app)
+- Backup path on bab1.mgmt.toal.ca: `/var/backups/oysqn/` (confirm before first production backup)

docs/summaries/handoff-2026-04-12-splash-and-login.md

@@ -0,0 +1,78 @@
+# Session Handoff: Splash Page & Magic Link Login
+**Date:** 2026-04-12
+**Session Duration:** ~30 minutes
+**Session Focus:** Implement unauthenticated splash page with logo and login button; implement magic link login page
+**Context Usage at Handoff:** Low
+
+## What Was Accomplished
+
+1. **Splash page implemented** → `app/pages/index.vue` — unauthenticated users see centered logo + "Log In" button; authenticated users see home content with header/menu
+2. **Login page implemented** → `app/pages/login.vue` — email input, sends magic link via `auth.sendMagicLink()`, shows confirmation state with mail icon after send
+3. **Auth middleware updated** → `app/middleware/auth.ts` — added `/` to public routes; unauthenticated users redirected to `/` (not `/login`)
+4. **Supabase redirect config updated** → `nuxt.config.ts` — `login` redirect changed from `/login` to `/`; `/` added to `exclude` list
+
+## Exact State of Work in Progress
+
+- Splash + login pages coded but not yet tested end-to-end against local Supabase
+- `auth/callback.vue` still a skeleton — magic link redirect will land there; not yet implemented
+
+## Decisions Made This Session
+
+- USE `/` as the unauthenticated landing route INSTEAD OF `/login` BECAUSE the splash/logo page IS the unauthenticated entry point; `/login` is a detail page reached from it — STATUS: confirmed
+- MAGIC LINK ONLY on login page (not OTP) BECAUSE user stated "sends a magic link" — STATUS: confirmed; OTP flow (`sendOtp` + `verifyOtp`) exists in auth store but unused by login page
+
+## Key Numbers Generated or Discovered This Session
+
+- Logo file: `public/oysqn_logo.png` (confirmed present)
+- Max logo display width: 280px (CSS)
+- Max login form width: 400px (CSS)
+
+## Files Created or Modified
+
+| File Path | Action | Description |
+|-----------|--------|-------------|
+| `app/pages/index.vue` | Modified | Splash (unauthenticated) + home (authenticated) in single page, toggled by `useSupabaseUser()` |
+| `app/pages/login.vue` | Modified | Email input → `sendMagicLink()` → confirmation state; uses `IonBackButton` to return to splash |
+| `app/middleware/auth.ts` | Modified | Added `/` to public routes; redirects unauthenticated to `/` |
+| `nuxt.config.ts` | Modified | `supabase.redirectOptions.login` = `/`; added `/` to `exclude` |
+
+## What the NEXT Session Should Do
+
+1. **First**: Test the auth flow end-to-end: load app → confirm splash shows logo + Login button → tap Login → enter email → check Mailpit (http://127.0.0.1:54324) for magic link → click link → confirm redirect to `/auth/callback` → confirm redirect to `/` (home state)
+2. **Then**: Implement `app/pages/auth/callback.vue` — handle magic link redirect (Supabase sets session from URL hash; page should show a spinner, then navigate to `/`)
+3. **Then**: Verify `useAuthStore` is auto-imported by Pinia Nuxt module (currently explicitly imported in `login.vue` with `import { useAuthStore } from '~/stores/auth'` — check if explicit import is still needed or if auto-import covers it)
+4. **Then**: Run `npx supabase gen types typescript --local > app/types/supabase.ts` to replace placeholder types
+5. **Then**: Implement `app/pages/index.vue` home content (authenticated state) — boat list or welcome state
+
+## Open Questions Requiring User Input
+
+- [ ] Should the login page also support OTP (enter token from email) as a fallback, or magic link only? — `sendOtp` + `verifyOtp` exist in auth store but unused — impacts login page UI
+- [ ] Should `auth/callback.vue` redirect to a specific page after login (e.g., boats list) or always to `/`? — impacts callback implementation
+
+## Assumptions That Need Validation
+
+- ASSUMED: `@nuxtjs/ionic` + `@pinia/nuxt` auto-imports `useAuthStore` — currently explicitly imported; validate by removing explicit import and testing
+- ASSUMED: `sendMagicLink()` in auth store correctly sets `emailRedirectTo` to `/auth/callback` — validate by clicking the email link and checking where it lands
+- ASSUMED: `IonRouterOutlet` handles `router-link` on `IonButton` correctly — validate by tapping Login button in browser
+
+## Files to Load Next Session
+
+- `app/pages/auth/callback.vue` — primary implementation target
+- `app/pages/index.vue` — may need home content (authenticated state) built out
+- `app/stores/auth.ts` — reference for `sendMagicLink` signature and redirect URL
+
+## Dev Environment Reference
+
+```
+# Start local Supabase (if not running):
+DOCKER_HOST=unix:///run/user/1000/podman/podman.sock npx supabase start
+
+# Start app:
+yarn dev
+
+# Mailpit (view magic link emails):
+http://127.0.0.1:54324
+
+# Supabase Studio:
+http://127.0.0.1:54323
+```

docs/summaries/plan-bab-backend-ansible-rewrite.md

@@ -0,0 +1,214 @@
+# Plan: bab-backend-ansible Rewrite
+**Date:** 2026-04-12
+**Status:** DRAFT — awaiting confirmation before execution
+**Target repo:** `/home/ptoal/Dev/Projects/bab-backend-ansible`
+**Architecture reference:** `docs/context/sdlc-architecture.md`
+
+---
+
+## What Gets Retired
+
+These playbooks are Appwrite-specific and have no equivalent in the new architecture. Delete them.
+
+| File | Reason |
+|------|--------|
+| `playbooks/install_appwrite.yml` | Appwrite self-hosted, replaced by supabase.com |
+| `playbooks/bootstrap_appwrite.yml` | Appwrite self-hosted |
+| `playbooks/upgrade_appwrite.yml` | Appwrite self-hosted |
+| `playbooks/backup_appwrite.yml` | Appwrite Docker volumes + MariaDB; replaced by pg_dump |
+| `playbooks/provision_database.yml` | Appwrite collection/attribute schema; replaced by Supabase migrations |
+| `playbooks/provision_users.yml` | Appwrite user provisioning; replaced by Supabase Auth admin API |
+| `playbooks/load_data.yml` | Appwrite seed data |
+| `playbooks/read_database.yml` | Appwrite diagnostic |
+| `playbooks/tasks/patch_appwrite_compose.yml` | Appwrite-specific |
+| `playbooks/tasks/upgrade_appwrite_step.yml` | Appwrite-specific |
+| `playbooks/templates/appwrite*.j2` | Appwrite config templates |
+| `appwrite.json` | Appwrite project definition |
+
+---
+
+## What Gets Kept / Adapted
+
+| File | Action | Notes |
+|------|--------|-------|
+| `playbooks/install_nginx.yml` | **Keep** | Dev server nginx still needed |
+| `playbooks/configure_act_runner.yml` | **Keep** | Gitea runner still on bab1 |
+| `playbooks/install_node_exporter.yml` | **Keep** | Monitoring unchanged |
+| `playbooks/clean_logs.yml` | **Keep** | Day2 ops unchanged |
+| `update_certificates.yml` | **Keep** | TLS cert renewal unchanged |
+| `playbooks/deploy_application.yml` | **Adapt** | See below |
+| `rulebooks/gitea_webhook.yml` | **Adapt** | See below |
+| `rulebooks/alertmanager_listener.yml` | **Keep** | Alerting unchanged |
+| `requirements.yml` | **Update** | Remove Appwrite collections; add `community.postgresql` |
+
+### `deploy_application.yml` adaptation
+Split into two playbooks:
+- `deploy_dev.yml` — nginx artifact swap on bab1 (keep existing logic, update paths/vars)
+- `deploy_prod.yml` — S3 sync: fetch artifact tarball → extract → `aws s3 sync` to `{{ s3_bucket }}`
+
+### `rulebooks/gitea_webhook.yml` adaptation
+Add branch-based routing: `dev` branch → `oysqn-deploy-dev` job template; `main` branch → `oysqn-deploy-prod` job template (AAP manual approval gate in the workflow).
+
+Updated payload contract: `{ artifact_url, version, branch }` (already matches bab-app pattern).
+
+---
+
+## New Playbooks
+
+### 1. `playbooks/migrate_supabase.yml`
+Runs `supabase db push` against the target environment. On failure, executes the matching rollback SQL from `supabase/rollback/` via `psql`, then aborts.
+
+**Vars:** `supabase_project_ref`, `supabase_db_password` (from Vault)
+**Steps:**
+1. Pre-migration `pg_dump` snapshot → `bab1.mgmt.toal.ca:/var/backups/oysqn/` (pre-migration label)
+2. `supabase db push --project-ref {{ supabase_project_ref }}` (via `supabase` CLI on control node or EE)
+3. On failure: identify failing migration filename → run `supabase/rollback/<filename>.sql` via psql → fail with message
+4. On irreversible migration (rollback file contains `IRREVERSIBLE` marker): halt, alert, do not run rollback SQL
+
+### 2. `playbooks/backup_supabase_prod.yml`
+Performs `pg_dump` of production Supabase DB → compressed → stored on bab1 via SSH. Enforces retention policy.
+
+**Vars:** `supabase_postgres_url` (from Vault at `kv/oys/prod/supabase/postgres_url`)
+**Steps:**
+1. Determine backup type: monthly (1st of month → `oysqn-prod-YYYY-MM-monthly.sql.gz`) or regular (`oysqn-prod-YYYYMMDD-HHMMSS.sql.gz`)
+2. `pg_dump "{{ supabase_postgres_url }}" | gzip` → SSH copy to `bab1.mgmt.toal.ca:/var/backups/oysqn/`
+3. Rotate: delete regular backups older than 90 days or count > 30; delete monthly backups older than 12 months or count > 12
+
+**Note:** `pg_dump` runs from the AAP EE or control node (not bab1) — postgres_url is the direct Supabase.com connection string.
+
+### 3. `playbooks/sync_gitea_secrets.yml`
+Reads `url` + `anon_key` from Vault, constructs `.env` content, updates Gitea repo variables via API.
+
+**Steps:**
+1. Vault lookup: `kv/oys/dev/supabase/{url,anon_key}` and `kv/oys/prod/supabase/{url,anon_key}`
+2. Construct `ENV_FILE_DEV` and `ENV_FILE_PROD` content (multiline env file format)
+3. `PUT /api/v1/repos/{{ gitea_owner }}/{{ gitea_repo }}/actions/variables/ENV_FILE_DEV` (Gitea API, token from `kv/oys/shared/infra/gitea_token`)
+4. Same for `ENV_FILE_PROD`
+
+**Trigger:** AAP schedule (daily) + on-demand job template
+
+### 4. `playbooks/deploy_dev.yml`
+Fetch artifact tarball → extract → nginx swap on bab1.
+
+**Vars:** `artifact_url`, `version`
+**Steps:**
+1. Download artifact from Gitea Release URL (auth header: `kv/oys/shared/infra/gitea_token`)
+2. Extract to tempdir
+3. Rsync/copy to nginx webroot (e.g. `/usr/share/nginx/html/oysqn/`)
+4. Cleanup tempdir
+
+### 5. `playbooks/deploy_prod.yml`
+Fetch artifact tarball → extract → `aws s3 sync`.
+
+**Vars:** `artifact_url`, `version`
+**Steps:**
+1. Download artifact (Gitea token auth)
+2. Extract to tempdir
+3. `aws s3 sync <tempdir>/ s3://{{ s3_bucket }}/ --delete` (AWS creds from Vault `kv/oys/prod/app/`)
+4. Cleanup tempdir
+
+---
+
+## EDA Rulebook (updated)
+
+`rulebooks/gitea_webhook.yml` — routes by branch:
+
+```yaml
+rules:
+  - name: Deploy to dev
+    condition:
+      all:
+        - event.payload.data.artifact_url is defined
+        - event.payload.data.branch == "dev"
+    action:
+      run_job_template:
+        name: oysqn-deploy-dev
+        organization: OYS
+        job_args:
+          extra_vars:
+            artifact_url: "{{ event.payload.data.artifact_url }}"
+            version: "{{ event.payload.data.version }}"
+
+  - name: Deploy to prod (approval gate in AAP workflow)
+    condition:
+      all:
+        - event.payload.data.artifact_url is defined
+        - event.payload.data.branch == "main"
+    action:
+      run_job_template:
+        name: oysqn-deploy-prod
+        organization: OYS
+        job_args:
+          extra_vars:
+            artifact_url: "{{ event.payload.data.artifact_url }}"
+            version: "{{ event.payload.data.version }}"
+```
+
+---
+
+## AAP Workflow Templates
+
+### `oysqn-deploy-dev`
+```
+pre-migration backup (backup_supabase_prod) [SKIP if no migrations]
+→ migrate (migrate_supabase — dev project)
+→ deploy (deploy_dev)
+→ E2E smoke test (yarn test:e2e BASE_URL=https://dev.oysqn.app)
+→ on failure: rollback migration (handled in migrate_supabase), redeploy previous artifact, notify
+→ on success: notify
+```
+
+### `oysqn-deploy-prod`
+```
+[manual approval gate]
+→ pre-migration backup (backup_supabase_prod)
+→ migrate (migrate_supabase — prod project)
+→ deploy (deploy_prod)
+→ E2E smoke test (yarn test:e2e BASE_URL=https://oysqn.app)
+→ on failure: rollback migration, redeploy previous S3 artifact, notify
+→ on success: notify
+```
+
+---
+
+## Implementation Sequence
+
+1. **Rename/archive existing Appwrite playbooks** — move to `playbooks/archive/appwrite/`; do not delete until new playbooks are tested
+2. **Update `requirements.yml`** — add `community.postgresql`, remove Appwrite-specific collections
+3. **Write `sync_gitea_secrets.yml`** — lowest risk, standalone, no deploy dependency; test in isolation
+4. **Write `backup_supabase_prod.yml`** — test against dev Supabase project first (with a throwaway postgres URL)
+5. **Write `migrate_supabase.yml`** — needs `supabase` CLI in EE or on control node; verify CLI availability first
+6. **Adapt `deploy_dev.yml`** from existing `deploy_application.yml`
+7. **Write `deploy_prod.yml`** (new — S3)
+8. **Update EDA rulebook** — branch routing
+9. **Configure AAP** — create job templates, workflow templates, approval gate, schedule for backup + secret sync
+10. **Decommission Appwrite** — after prod cutover confirmed
+
+---
+
+## Open Questions
+
+- [x] **Supabase CLI in EE**: Not present — added to `ee-demo` via `append_final` build step. `SUPABASE_VERSION` build arg required. Verify asset URL against GitHub releases before first build.
+- [x] **pg_dump location**: Not present — added `postgresql [platform:rpm]` to `ee-demo` system deps. Runs from AAP EE control node against Supabase.com postgres_url.
+- [x] **EE image**: `amazon.aws` collection added to `ee-demo` `requirements.yml`; `boto3`/`botocore` added to `requirements.txt`. S3 sync via `amazon.aws.s3_sync` module.
+- [x] **Dev server URL**: `https://bab.toal.ca` — E2E `BASE_URL` for dev workflow.
+- [x] **nginx webroot path for dev**: `/usr/share/nginx/html/` on `bab1.mgmt.toal.ca` — confirmed.
+- [x] **Gitea artifact auth**: Token at `kv/oys/bab_gitea` (note: deviates from `kv/oys/(dev|prod|shared)/...` convention — existing secret, use as-is). Gitea base URL: `https://gitea.toal.ca/`. Pass as `Authorization: token <value>` header in `get_url`.
+- [ ] **dev postgres_url**: Architecture doc has no `postgres_url` in Vault for dev (`kv/oys/dev/supabase/`). Migration playbook needs it to run rollback SQL via psql. Add `kv/oys/dev/supabase/postgres_url` to Vault before first migration run.
+
+---
+
+## Files Created/Modified Summary
+
+| Action | Path |
+|--------|------|
+| Retire (move to archive) | `playbooks/install_appwrite.yml` and 9 others (see above) |
+| Keep | `install_nginx.yml`, `configure_act_runner.yml`, `install_node_exporter.yml`, `clean_logs.yml`, `update_certificates.yml` |
+| Adapt | `deploy_application.yml` → split into `deploy_dev.yml` + `deploy_prod.yml` |
+| Adapt | `rulebooks/gitea_webhook.yml` |
+| Update | `requirements.yml` |
+| New | `migrate_supabase.yml` |
+| New | `backup_supabase_prod.yml` |
+| New | `sync_gitea_secrets.yml` |
+| New | `deploy_dev.yml` |
+| New | `deploy_prod.yml` |

package.json

@@ -10,7 +10,8 @@
     "postinstall": "nuxt prepare",
     "typecheck": "nuxt typecheck",
     "test": "vitest run",
-    "test:watch": "vitest"
+    "test:watch": "vitest",
+    "test:integration": "vitest run --config vitest.integration.config.ts"
   },
   "engines": {
     "node": ">=22"
@@ -31,7 +32,10 @@
     "vue-router": "^5.0.3"
   },
   "devDependencies": {
+    "@nuxt/test-utils": "^4.0.2",
     "@vite-pwa/nuxt": "^1.1.1",
+    "@vue/test-utils": "^2.4.6",
+    "happy-dom": "^20.8.9",
     "sass-embedded": "^1.98.0",
     "supabase": "^2.84.4",
     "vitest": "^4.1.0",

tests/integration/auth-session.test.ts

@@ -0,0 +1,126 @@
+/**
+ * Integration tests for auth session creation via magic link flow.
+ *
+ * Requires local Supabase to be running:
+ *   DOCKER_HOST=unix:///run/user/1000/podman/podman.sock npx supabase start
+ *
+ * Run with:
+ *   yarn test:integration
+ *
+ * Uses Supabase admin API (service role key) to:
+ *   1. Create a temporary test user
+ *   2. Generate a magic link token
+ *   3. Exchange the token for a session
+ *   4. Verify the session is valid
+ *   5. Clean up the test user
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest'
+import { createClient } from '@supabase/supabase-js'
+
+// Local Supabase defaults (from `npx supabase status`)
+const SUPABASE_URL = process.env.SUPABASE_URL ?? 'http://localhost:54321'
+const SUPABASE_ANON_KEY = process.env.SUPABASE_KEY ?? ''
+const SUPABASE_SERVICE_ROLE_KEY = process.env.SUPABASE_SERVICE_ROLE_KEY ?? ''
+
+const TEST_EMAIL = `test-auth-${Date.now()}@oysqn.test`
+
+let adminClient: ReturnType<typeof createClient>
+let anonClient: ReturnType<typeof createClient>
+let testUserId: string | undefined
+
+beforeAll(() => {
+  if (!SUPABASE_SERVICE_ROLE_KEY) {
+    throw new Error(
+      'SUPABASE_SERVICE_ROLE_KEY is required for integration tests.\n' +
+      'Run `npx supabase status` to get the service_role key and set it as an env var.'
+    )
+  }
+  adminClient = createClient(SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, {
+    auth: { autoRefreshToken: false, persistSession: false },
+  })
+  anonClient = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
+    auth: { autoRefreshToken: false, persistSession: false },
+  })
+})
+
+afterAll(async () => {
+  if (testUserId) {
+    await adminClient.auth.admin.deleteUser(testUserId)
+  }
+})
+
+describe('magic link login — session creation', () => {
+  it('creates a confirmed test user via admin API', async () => {
+    const { data, error } = await adminClient.auth.admin.createUser({
+      email: TEST_EMAIL,
+      email_confirm: true,
+    })
+    expect(error).toBeNull()
+    expect(data.user).toBeDefined()
+    expect(data.user!.email).toBe(TEST_EMAIL)
+    testUserId = data.user!.id
+  })
+
+  it('generates a magic link token for the test user', async () => {
+    const { data, error } = await adminClient.auth.admin.generateLink({
+      type: 'magiclink',
+      email: TEST_EMAIL,
+    })
+    expect(error).toBeNull()
+    expect(data.properties?.hashed_token).toBeTruthy()
+  })
+
+  it('exchanging the OTP token creates a valid session in Supabase', async () => {
+    // Generate a fresh link for this test (tokens are single-use)
+    const { data: linkData, error: linkError } = await adminClient.auth.admin.generateLink({
+      type: 'magiclink',
+      email: TEST_EMAIL,
+    })
+    expect(linkError).toBeNull()
+
+    const token = linkData.properties?.hashed_token
+    expect(token).toBeTruthy()
+
+    // Exchange the token — this is what happens when the user clicks the magic link
+    // and /auth/callback calls supabase.auth.verifyOtp (hash-based) or
+    // supabase.auth.exchangeCodeForSession (PKCE)
+    const { data: sessionData, error: sessionError } = await anonClient.auth.verifyOtp({
+      email: TEST_EMAIL,
+      token: token!,
+      type: 'magiclink',
+    })
+
+    expect(sessionError).toBeNull()
+    expect(sessionData.session).not.toBeNull()
+    expect(sessionData.session!.access_token).toBeTruthy()
+    expect(sessionData.session!.user.email).toBe(TEST_EMAIL)
+  })
+
+  it('session allows access to authenticated Supabase queries', async () => {
+    const { data: linkData } = await adminClient.auth.admin.generateLink({
+      type: 'magiclink',
+      email: TEST_EMAIL,
+    })
+
+    const { data: sessionData } = await anonClient.auth.verifyOtp({
+      email: TEST_EMAIL,
+      token: linkData.properties!.hashed_token!,
+      type: 'magiclink',
+    })
+
+    // Create an authenticated client using the session token
+    const authedClient = createClient(SUPABASE_URL, SUPABASE_ANON_KEY, {
+      auth: { autoRefreshToken: false, persistSession: false },
+      global: {
+        headers: { Authorization: `Bearer ${sessionData.session!.access_token}` },
+      },
+    })
+
+    // Verify the session resolves to the correct user
+    const { data: { user }, error } = await authedClient.auth.getUser()
+    expect(error).toBeNull()
+    expect(user).not.toBeNull()
+    expect(user!.email).toBe(TEST_EMAIL)
+  })
+})

tests/unit/auth-middleware.test.ts

@@ -0,0 +1,24 @@
+// @vitest-environment node
+import { describe, it, expect } from 'vitest'
+import { checkAuthRedirect } from '~/utils/auth'
+
+describe('checkAuthRedirect', () => {
+  it.each(['/', '/login', '/signup', '/auth/callback'])(
+    'returns null for unauthenticated user on public route: %s',
+    (path) => {
+      expect(checkAuthRedirect(null, path)).toBeNull()
+    }
+  )
+
+  it('returns "/" for unauthenticated user on protected route', () => {
+    expect(checkAuthRedirect(null, '/boats')).toBe('/')
+  })
+
+  it('returns null for authenticated user on protected route', () => {
+    expect(checkAuthRedirect({ id: 'user-123' }, '/boats')).toBeNull()
+  })
+
+  it('returns null for authenticated user on public route', () => {
+    expect(checkAuthRedirect({ id: 'user-123' }, '/')).toBeNull()
+  })
+})

vitest.config.ts

@@ -0,0 +1,17 @@
+import { defineVitestConfig } from '@nuxt/test-utils/config'
+
+export default defineVitestConfig({
+  test: {
+    environment: 'nuxt',
+    environmentOptions: {
+      nuxt: {
+        mock: {
+          intersectionObserver: true,
+          indexedDb: true,
+        },
+      },
+    },
+    include: ['tests/unit/**/*.test.ts'],
+    exclude: ['tests/integration/**'],
+  },
+})

vitest.integration.config.ts

@@ -0,0 +1,14 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    include: ['tests/integration/**/*.test.ts'],
+    testTimeout: 30000,
+  },
+  resolve: {
+    alias: {
+      '~': new URL('./app', import.meta.url).pathname,
+    },
+  },
+})

yarn.lock

@@ -870,6 +870,24 @@
   dependencies:
     sisteransi "^1.0.5"
 
+"@clack/core@1.2.0":
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/@clack/core/-/core-1.2.0.tgz#925c0e08c58f0d99a527f11872fc4e1b6bcf7d9b"
+  integrity sha512-qfxof/3T3t9DPU/Rj3OmcFyZInceqj/NVtO9rwIuJqCUgh32gwPjpFQQp/ben07qKlhpwq7GzfWpST4qdJ5Drg==
+  dependencies:
+    fast-wrap-ansi "^0.1.3"
+    sisteransi "^1.0.5"
+
+"@clack/prompts@1.2.0":
+  version "1.2.0"
+  resolved "https://registry.yarnpkg.com/@clack/prompts/-/prompts-1.2.0.tgz#509a87002f2830af04dd75d758ae27f5509f02fd"
+  integrity sha512-4jmztR9fMqPMjz6H/UZXj0zEmE43ha1euENwkckKKel4XpSfokExPo5AiVStdHSAlHekz4d0CA/r45Ok1E4D3w==
+  dependencies:
+    "@clack/core" "1.2.0"
+    fast-string-width "^1.1.0"
+    fast-wrap-ansi "^0.1.3"
+    sisteransi "^1.0.5"
+
 "@clack/prompts@^1.1.0":
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/@clack/prompts/-/prompts-1.1.0.tgz#f0dff2bcc48d68394f9ce4777651a8faed5714fa"
@@ -1409,6 +1427,14 @@
     "@nuxt/kit" "^4.4.2"
     execa "^8.0.1"
 
+"@nuxt/devtools-kit@^2.7.0":
+  version "2.7.0"
+  resolved "https://registry.yarnpkg.com/@nuxt/devtools-kit/-/devtools-kit-2.7.0.tgz#981dc6d27022dad38b9ec0644da4230b8556ff35"
+  integrity sha512-MIJdah6CF6YOW2GhfKnb8Sivu6HpcQheqdjOlZqShBr+1DyjtKQbAKSCAyKPaoIzZP4QOo2SmTFV6aN8jBeEIQ==
+  dependencies:
+    "@nuxt/kit" "^3.19.3"
+    execa "^8.0.1"
+
 "@nuxt/devtools-wizard@3.2.4":
   version "3.2.4"
   resolved "https://registry.yarnpkg.com/@nuxt/devtools-wizard/-/devtools-wizard-3.2.4.tgz#e227f6ad52319a4e50a1859ceb30d22de976336b"
@@ -1487,7 +1513,7 @@
     unctx "^2.5.0"
     untyped "^2.0.0"
 
-"@nuxt/kit@^3", "@nuxt/kit@^3.9.0":
+"@nuxt/kit@^3", "@nuxt/kit@^3.19.3", "@nuxt/kit@^3.21.2", "@nuxt/kit@^3.9.0":
   version "3.21.2"
   resolved "https://registry.yarnpkg.com/@nuxt/kit/-/kit-3.21.2.tgz#ad089e4c030ea96bbecff3b5293989141016a138"
   integrity sha512-Bd6m6mrDrqpBEbX+g0rc66/ALd1sxlgdx5nfK9MAYO0yKLTOSK7McSYz1KcOYn3LQFCXOWfvXwaqih/b+REI1g==
@@ -1571,6 +1597,41 @@
     rc9 "^3.0.0"
     std-env "^3.10.0"
 
+"@nuxt/test-utils@^4.0.0", "@nuxt/test-utils@^4.0.2":
+  version "4.0.2"
+  resolved "https://registry.yarnpkg.com/@nuxt/test-utils/-/test-utils-4.0.2.tgz#3d76ce266e12237c65423e28b484f28e886b5820"
+  integrity sha512-bexdsG2HbkSiCNt+2qwHBtPd6zNUYoZ8Pa+70uTkeHuYzCC6GXWb+CyEiFqE0Pd+A/7nrBflebKW0sGWGCR/uQ==
+  dependencies:
+    "@clack/prompts" "1.2.0"
+    "@nuxt/devtools-kit" "^2.7.0"
+    "@nuxt/kit" "^3.21.2"
+    c12 "^3.3.4"
+    consola "^3.4.2"
+    defu "^6.1.4"
+    destr "^2.0.5"
+    estree-walker "^3.0.3"
+    exsolve "^1.0.8"
+    fake-indexeddb "^6.2.5"
+    get-port-please "^3.2.0"
+    h3 "^1.15.11"
+    h3-next "npm:h3@2.0.1-rc.20"
+    local-pkg "^1.1.2"
+    magic-string "^0.30.21"
+    node-fetch-native "^1.6.7"
+    node-mock-http "^1.0.4"
+    nypm "^0.6.5"
+    ofetch "^1.5.1"
+    pathe "^2.0.3"
+    perfect-debounce "^2.1.0"
+    radix3 "^1.1.2"
+    scule "^1.3.0"
+    std-env "^4.0.0"
+    tinyexec "^1.1.1"
+    ufo "^1.6.3"
+    unplugin "^3.0.0"
+    vitest-environment-nuxt "2.0.0"
+    vue "^3.5.32"
+
 "@nuxt/vite-builder@4.4.2":
   version "4.4.2"
   resolved "https://registry.yarnpkg.com/@nuxt/vite-builder/-/vite-builder-4.4.2.tgz#2aa2e019249647aeb435c2c1e00aa4fcde46288b"
@@ -1635,6 +1696,11 @@
     defu "^6.1.4"
     pathe "^2.0.3"
 
+"@one-ini/wasm@0.1.1":
+  version "0.1.1"
+  resolved "https://registry.yarnpkg.com/@one-ini/wasm/-/wasm-0.1.1.tgz#6013659736c9dbfccc96e8a9c2b3de317df39323"
+  integrity sha512-XuySG1E38YScSJoMlqovLru4KTUNSjgVTIjyh7qMX6aNN5HY5Ct5LhRJdxO79JtTzKfzV/bnWpz+zquYrISsvw==
+
 "@oxc-minify/binding-android-arm-eabi@0.117.0":
   version "0.117.0"
   resolved "https://registry.yarnpkg.com/@oxc-minify/binding-android-arm-eabi/-/binding-android-arm-eabi-0.117.0.tgz#0b072643de615f43ca50a3708a8f9a0ce9d9c960"
@@ -2774,6 +2840,13 @@
   dependencies:
     undici-types "~7.18.0"
 
+"@types/node@>=20.0.0":
+  version "25.6.0"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-25.6.0.tgz#4e09bad9b469871f2d0f68140198cbd714f4edca"
+  integrity sha512-+qIYRKdNYJwY3vRCZMdJbPLJAtGjQBudzZzdzwQYkEPQd+PJGixUL5QfvCLDaULoLv+RhT3LDkwEfKaAkgSmNQ==
+  dependencies:
+    undici-types "~7.19.0"
+
 "@types/resolve@1.20.2":
   version "1.20.2"
   resolved "https://registry.yarnpkg.com/@types/resolve/-/resolve-1.20.2.tgz#97d26e00cd4a0423b4af620abecf3e6f442b7975"
@@ -2789,6 +2862,11 @@
   resolved "https://registry.yarnpkg.com/@types/trusted-types/-/trusted-types-2.0.7.tgz#baccb07a970b91707df3a3e8ba6896c57ead2d11"
   integrity sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==
 
+"@types/whatwg-mimetype@^3.0.2":
+  version "3.0.2"
+  resolved "https://registry.yarnpkg.com/@types/whatwg-mimetype/-/whatwg-mimetype-3.0.2.tgz#e5e06dcd3e92d4e622ef0129637707d66c28d6a4"
+  integrity sha512-c2AKvDT8ToxLIOUlN51gTiHXflsfIFisS4pO7pDPoKouJCESkhZnEy623gwP9laCy5lnLDAw1vAzu2vM2YLOrA==
+
 "@types/ws@^8.18.1":
   version "8.18.1"
   resolved "https://registry.yarnpkg.com/@types/ws/-/ws-8.18.1.tgz#48464e4bf2ddfd17db13d845467f6070ffea4aa9"
@@ -2984,6 +3062,17 @@
     estree-walker "^2.0.2"
     source-map-js "^1.2.1"
 
+"@vue/compiler-core@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-core/-/compiler-core-3.5.32.tgz#5115ca099b04fedd8f623f93b522d914c376cbeb"
+  integrity sha512-4x74Tbtqnda8s/NSD6e1Dr5p1c8HdMU5RWSjMSUzb8RTcUQqevDCxVAitcLBKT+ie3o0Dl9crc/S/opJM7qBGQ==
+  dependencies:
+    "@babel/parser" "^7.29.2"
+    "@vue/shared" "3.5.32"
+    entities "^7.0.1"
+    estree-walker "^2.0.2"
+    source-map-js "^1.2.1"
+
 "@vue/compiler-dom@3.5.31", "@vue/compiler-dom@^3.5.0":
   version "3.5.31"
   resolved "https://registry.yarnpkg.com/@vue/compiler-dom/-/compiler-dom-3.5.31.tgz#7d4b5688a8daef1513ee18f566ea129bded36ff7"
@@ -2992,6 +3081,14 @@
     "@vue/compiler-core" "3.5.31"
     "@vue/shared" "3.5.31"
 
+"@vue/compiler-dom@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-dom/-/compiler-dom-3.5.32.tgz#6069eae2f0d1a38263e9445f3c1da1a06e5f6534"
+  integrity sha512-ybHAu70NtiEI1fvAUz3oXZqkUYEe5J98GjMDpTGl5iHb0T15wQYLR4wE3h9xfuTNA+Cm2f4czfe8B4s+CCH57Q==
+  dependencies:
+    "@vue/compiler-core" "3.5.32"
+    "@vue/shared" "3.5.32"
+
 "@vue/compiler-sfc@3.5.31", "@vue/compiler-sfc@^3.5.22":
   version "3.5.31"
   resolved "https://registry.yarnpkg.com/@vue/compiler-sfc/-/compiler-sfc-3.5.31.tgz#ab3670bc81f0bf60ccd0766b16042ad5b334d821"
@@ -3007,6 +3104,21 @@
     postcss "^8.5.8"
     source-map-js "^1.2.1"
 
+"@vue/compiler-sfc@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-sfc/-/compiler-sfc-3.5.32.tgz#1f4bef6d4fbfc0cb8278a08d08c05a3afddbd2c8"
+  integrity sha512-8UYUYo71cP/0YHMO814TRZlPuUUw3oifHuMR7Wp9SNoRSrxRQnhMLNlCeaODNn6kNTJsjFoQ/kqIj4qGvya4Xg==
+  dependencies:
+    "@babel/parser" "^7.29.2"
+    "@vue/compiler-core" "3.5.32"
+    "@vue/compiler-dom" "3.5.32"
+    "@vue/compiler-ssr" "3.5.32"
+    "@vue/shared" "3.5.32"
+    estree-walker "^2.0.2"
+    magic-string "^0.30.21"
+    postcss "^8.5.8"
+    source-map-js "^1.2.1"
+
 "@vue/compiler-ssr@3.5.31":
   version "3.5.31"
   resolved "https://registry.yarnpkg.com/@vue/compiler-ssr/-/compiler-ssr-3.5.31.tgz#bc68bb14cedab04ff5230460badfca983de5391b"
@@ -3015,6 +3127,14 @@
     "@vue/compiler-dom" "3.5.31"
     "@vue/shared" "3.5.31"
 
+"@vue/compiler-ssr@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/compiler-ssr/-/compiler-ssr-3.5.32.tgz#5632a0934cb58cf88dcff1404ecf06b5a16f6816"
+  integrity sha512-Gp4gTs22T3DgRotZ8aA/6m2jMR+GMztvBXUBEUOYOcST+giyGWJ4WvFd7QLHBkzTxkfOt8IELKNdpzITLbA2rw==
+  dependencies:
+    "@vue/compiler-dom" "3.5.32"
+    "@vue/shared" "3.5.32"
+
 "@vue/compiler-vue2@^2.7.16":
   version "2.7.16"
   resolved "https://registry.yarnpkg.com/@vue/compiler-vue2/-/compiler-vue2-2.7.16.tgz#2ba837cbd3f1b33c2bc865fbe1a3b53fb611e249"
@@ -3101,6 +3221,13 @@
   dependencies:
     "@vue/shared" "3.5.31"
 
+"@vue/reactivity@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/reactivity/-/reactivity-3.5.32.tgz#a4cb973095eade1ae6d899ae60ba9019d2bd21f5"
+  integrity sha512-/ORasxSGvZ6MN5gc+uE364SxFdJ0+WqVG0CENXaGW58TOCdrAW76WWaplDtECeS1qphvtBZtR+3/o1g1zL4xPQ==
+  dependencies:
+    "@vue/shared" "3.5.32"
+
 "@vue/runtime-core@3.5.31":
   version "3.5.31"
   resolved "https://registry.yarnpkg.com/@vue/runtime-core/-/runtime-core-3.5.31.tgz#bbe07e3bda17caf3ca2ba289bdd2d22badf3dce4"
@@ -3109,6 +3236,14 @@
     "@vue/reactivity" "3.5.31"
     "@vue/shared" "3.5.31"
 
+"@vue/runtime-core@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/runtime-core/-/runtime-core-3.5.32.tgz#7ab8bc83210886aa4db69e5d72f31188628fe9d4"
+  integrity sha512-pDrXCejn4UpFDFmMd27AcJEbHaLemaE5o4pbb7sLk79SRIhc6/t34BQA7SGNgYtbMnvbF/HHOftYBgFJtUoJUQ==
+  dependencies:
+    "@vue/reactivity" "3.5.32"
+    "@vue/shared" "3.5.32"
+
 "@vue/runtime-dom@3.5.31":
   version "3.5.31"
   resolved "https://registry.yarnpkg.com/@vue/runtime-dom/-/runtime-dom-3.5.31.tgz#3fe39a7bbbbf3ef2cdd6c51f8a1ea63d13959ec6"
@@ -3119,6 +3254,16 @@
     "@vue/shared" "3.5.31"
     csstype "^3.2.3"
 
+"@vue/runtime-dom@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/runtime-dom/-/runtime-dom-3.5.32.tgz#fe7815b25e55df34c6ae82a0d06be79d1342d7cf"
+  integrity sha512-1CDVv7tv/IV13V8Nip1k/aaObVbWqRlVCVezTwx3K07p7Vxossp5JU1dcPNhJk3w347gonIUT9jQOGutyJrSVQ==
+  dependencies:
+    "@vue/reactivity" "3.5.32"
+    "@vue/runtime-core" "3.5.32"
+    "@vue/shared" "3.5.32"
+    csstype "^3.2.3"
+
 "@vue/server-renderer@3.5.31":
   version "3.5.31"
   resolved "https://registry.yarnpkg.com/@vue/server-renderer/-/server-renderer-3.5.31.tgz#d5dbc14dedc37315d197d0a846ef817e02257778"
@@ -3127,16 +3272,42 @@
     "@vue/compiler-ssr" "3.5.31"
     "@vue/shared" "3.5.31"
 
+"@vue/server-renderer@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/server-renderer/-/server-renderer-3.5.32.tgz#74579f65d271e217bdef0df62474b3c8a8dba55b"
+  integrity sha512-IOjm2+JQwRFS7W28HNuJeXQle9KdZbODFY7hFGVtnnghF51ta20EWAZJHX+zLGtsHhaU6uC9BGPV52KVpYryMQ==
+  dependencies:
+    "@vue/compiler-ssr" "3.5.32"
+    "@vue/shared" "3.5.32"
+
 "@vue/shared@3.5.31", "@vue/shared@^3.5.0", "@vue/shared@^3.5.22", "@vue/shared@^3.5.30":
   version "3.5.31"
   resolved "https://registry.yarnpkg.com/@vue/shared/-/shared-3.5.31.tgz#83276e1d450fea7d20dd15c3bbafbea5aada122d"
   integrity sha512-nBxuiuS9Lj5bPkPbWogPUnjxxWpkRniX7e5UBQDWl6Fsf4roq9wwV+cR7ezQ4zXswNvPIlsdj1slcLB7XCsRAw==
 
+"@vue/shared@3.5.32":
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/@vue/shared/-/shared-3.5.32.tgz#dd8ba0d709bf3f758c324a81c8897bad5e1540cf"
+  integrity sha512-ksNyrmRQzWJJ8n3cRDuSF7zNNontuJg1YHnmWRJd2AMu8Ij2bqwiiri2lH5rHtYPZjj4STkNcgcmiQqlOjiYGg==
+
+"@vue/test-utils@^2.4.6":
+  version "2.4.6"
+  resolved "https://registry.yarnpkg.com/@vue/test-utils/-/test-utils-2.4.6.tgz#7d534e70c4319d2a587d6a3b45a39e9695ade03c"
+  integrity sha512-FMxEjOpYNYiFe0GkaHsnJPXFHxQ6m4t8vI/ElPGpMWxZKpmRvQ33OIrvRXemy6yha03RxhOlQuy+gZMC3CQSow==
+  dependencies:
+    js-beautify "^1.14.9"
+    vue-component-type-helpers "^2.0.0"
+
 "@xmldom/xmldom@^0.8.8":
   version "0.8.11"
   resolved "https://registry.yarnpkg.com/@xmldom/xmldom/-/xmldom-0.8.11.tgz#b79de2d67389734c57c52595f7a7305e30c2d608"
   integrity sha512-cQzWCtO6C8TQiYl1ruKNn2U6Ao4o4WBBcbL61yJl84x+j5sOWWFU9X7DpND8XZG3daDppSsigMdfAIl2upQBRw==
 
+abbrev@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/abbrev/-/abbrev-2.0.0.tgz#cf59829b8b4f03f89dda2771cb7f3653828c89bf"
+  integrity sha512-6/mh1E2u2YgEsCHdY0Yx5oW+61gZU+1vXaoiHHrpKeuRNNgFvS+/jrwHiQhB5apAf5oB7UB7E19ol2R2LKH8hQ==
+
 abbrev@^3.0.0:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/abbrev/-/abbrev-3.0.1.tgz#8ac8b3b5024d31464fe2a5feeea9f4536bf44025"
@@ -3589,6 +3760,24 @@ c12@^3.3.3:
     pkg-types "^2.3.0"
     rc9 "^2.1.2"
 
+c12@^3.3.4:
+  version "3.3.4"
+  resolved "https://registry.yarnpkg.com/c12/-/c12-3.3.4.tgz#1253a5faf8b61244884d42459b4a6412571fe9f3"
+  integrity sha512-cM0ApFQSBXuourJejzwv/AuPRvAxordTyParRVcHjjtXirtkzM0uK2L9TTn9s0cXZbG7E55jCivRQzoxYmRAlA==
+  dependencies:
+    chokidar "^5.0.0"
+    confbox "^0.2.4"
+    defu "^6.1.6"
+    dotenv "^17.3.1"
+    exsolve "^1.0.8"
+    giget "^3.2.0"
+    jiti "^2.6.1"
+    ohash "^2.0.11"
+    pathe "^2.0.3"
+    perfect-debounce "^2.1.0"
+    pkg-types "^2.3.0"
+    rc9 "^3.0.1"
+
 cac@^6.7.14:
   version "6.7.14"
   resolved "https://registry.yarnpkg.com/cac/-/cac-6.7.14.tgz#804e1e6f506ee363cb0e3ccbb09cad5dd9870959"
@@ -3773,6 +3962,11 @@ combined-stream@^1.0.8:
   dependencies:
     delayed-stream "~1.0.0"
 
+commander@^10.0.0:
+  version "10.0.1"
+  resolved "https://registry.yarnpkg.com/commander/-/commander-10.0.1.tgz#881ee46b4f77d1c1dccc5823433aa39b022cbe06"
+  integrity sha512-y4Mg2tXshplEbSGzx7amzPwKKOCGuoSRP/CjEdwwk0FOGlUbq6lKuoyDZTNZkmxHdJtp54hdfY/JUrdL7Xfdug==
+
 commander@^11.1.0:
   version "11.1.0"
   resolved "https://registry.yarnpkg.com/commander/-/commander-11.1.0.tgz#62fdce76006a68e5c1ab3314dc92e800eb83d906"
@@ -3834,6 +4028,14 @@ confbox@^0.2.2, confbox@^0.2.4:
   resolved "https://registry.yarnpkg.com/confbox/-/confbox-0.2.4.tgz#592e7be71f882a4a874e3c88f0ac1ef6f7da1ce5"
   integrity sha512-ysOGlgTFbN2/Y6Cg3Iye8YKulHw+R2fNXHrgSmXISQdMnomY6eNDprVdW9R5xBguEqI954+S6709UyiO7B+6OQ==
 
+config-chain@^1.1.13:
+  version "1.1.13"
+  resolved "https://registry.yarnpkg.com/config-chain/-/config-chain-1.1.13.tgz#fad0795aa6a6cdaff9ed1b68e9dff94372c232f4"
+  integrity sha512-qj+f8APARXHrM0hraqXYb2/bOVSV4PvJQlNZ/DVj0QrmNM2q2euizkeuVckQ57J+W0mRH6Hvi+k50M4Jul2VRQ==
+  dependencies:
+    ini "^1.3.4"
+    proto-list "~1.2.1"
+
 consola@^3.2.3, consola@^3.4.0, consola@^3.4.2:
   version "3.4.2"
   resolved "https://registry.yarnpkg.com/consola/-/consola-3.4.2.tgz#5af110145397bb67afdab77013fdc34cae590ea7"
@@ -3849,6 +4051,11 @@ cookie-es@^1.2.2:
   resolved "https://registry.yarnpkg.com/cookie-es/-/cookie-es-1.2.2.tgz#18ceef9eb513cac1cb6c14bcbf8bdb2679b34821"
   integrity sha512-+W7VmiVINB+ywl1HGXJXmrqkOhpKrIiVZV6tQuV54ZyQC7MMuBt81Vc336GMLoHBq5hV/F9eXgt5Mnx0Rha5Fg==
 
+cookie-es@^1.2.3:
+  version "1.2.3"
+  resolved "https://registry.yarnpkg.com/cookie-es/-/cookie-es-1.2.3.tgz#06ca3c5f5f3531684a2059666a361173f74a89c8"
+  integrity sha512-lXVyvUvrNXblMqzIRrxHb57UUVmqsSWlxqt3XIjCkUP0wDAf6uicO6KMbEgYrMNtEvWgWHwe42CKxPu9MYAnWw==
+
 cookie-es@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/cookie-es/-/cookie-es-2.0.0.tgz#ca6163d7ef8686ea6bbdd551f1de575569c1ed69"
@@ -4137,6 +4344,11 @@ defu@^6.1.4:
   resolved "https://registry.yarnpkg.com/defu/-/defu-6.1.4.tgz#4e0c9cf9ff68fe5f3d7f2765cc1a012dfdcb0479"
   integrity sha512-mEQCMmwJu317oSz8CwdIOdwf3xMif1ttiM8LTufzc3g6kR+9Pe236twL8j3IYT1F7GfRgGcW6MWxzZjLIkuHIg==
 
+defu@^6.1.6:
+  version "6.1.7"
+  resolved "https://registry.yarnpkg.com/defu/-/defu-6.1.7.tgz#72543567c8e9f97ff13ce402b6dbe09ac5ae4d23"
+  integrity sha512-7z22QmUWiQ/2d0KkdYmANbRUVABpZ9SNYyH5vx6PZ+nE5bcC0l7uFvEfHlyld/HcGBFTL536ClDt3DEcSlEJAQ==
+
 degenerator@^5.0.0:
   version "5.0.1"
   resolved "https://registry.yarnpkg.com/degenerator/-/degenerator-5.0.1.tgz#9403bf297c6dad9a1ece409b37db27954f91f2f5"
@@ -4236,6 +4448,11 @@ dotenv@^17.2.3:
   resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-17.3.1.tgz#2706f5b0165e45a1503348187b8468f87fe6aae2"
   integrity sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==
 
+dotenv@^17.3.1:
+  version "17.4.1"
+  resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-17.4.1.tgz#d8e2179fe287365ef3aecb9459668454168eda88"
+  integrity sha512-k8DaKGP6r1G30Lx8V4+pCsLzKr8vLmV2paqEj1Y55GdAgJuIqpRp5FfajGF8KtwMxCz9qJc6wUIJnm053d/WCw==
+
 dunder-proto@^1.0.0, dunder-proto@^1.0.1:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/dunder-proto/-/dunder-proto-1.0.1.tgz#d7ae667e1dc83482f8b70fd0f6eefc50da30f58a"
@@ -4262,6 +4479,16 @@ eastasianwidth@^0.2.0:
   resolved "https://registry.yarnpkg.com/eastasianwidth/-/eastasianwidth-0.2.0.tgz#696ce2ec0aa0e6ea93a397ffcf24aa7840c827cb"
   integrity sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==
 
+editorconfig@^1.0.4:
+  version "1.0.7"
+  resolved "https://registry.yarnpkg.com/editorconfig/-/editorconfig-1.0.7.tgz#8d6e178aeb507c206d65e1804c1d7510d110d434"
+  integrity sha512-e0GOtq/aTQhVdNyDU9e02+wz9oDDM+SIOQxWME2QRjzRX5yyLAuHDE+0aE8vHb9XRC8XD37eO2u57+F09JqFhw==
+  dependencies:
+    "@one-ini/wasm" "0.1.1"
+    commander "^10.0.0"
+    minimatch "^9.0.1"
+    semver "^7.5.3"
+
 ee-first@1.1.1:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/ee-first/-/ee-first-1.1.1.tgz#590c61156b0ae2f4f0255732a158b266bc56b21d"
@@ -4605,6 +4832,11 @@ external-editor@^3.0.3:
     iconv-lite "^0.4.24"
     tmp "^0.0.33"
 
+fake-indexeddb@^6.2.5:
+  version "6.2.5"
+  resolved "https://registry.yarnpkg.com/fake-indexeddb/-/fake-indexeddb-6.2.5.tgz#74285b6821467d6c102af092f0a4517ad5521613"
+  integrity sha512-CGnyrvbhPlWYMngksqrSSUT1BAVP49dZocrHuK0SvtR0D5TMs5wP0o3j7jexDJW01KSadjBp1M/71o/KR3nD1w==
+
 fast-deep-equal@^3.1.3:
   version "3.1.3"
   resolved "https://registry.yarnpkg.com/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz#3a7d56b559d6cbc3eb512325244e619a65c6c525"
@@ -4641,11 +4873,30 @@ fast-safe-stringify@^2.1.1:
   resolved "https://registry.yarnpkg.com/fast-safe-stringify/-/fast-safe-stringify-2.1.1.tgz#c406a83b6e70d9e35ce3b30a81141df30aeba884"
   integrity sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==
 
+fast-string-truncated-width@^1.2.0:
+  version "1.2.1"
+  resolved "https://registry.yarnpkg.com/fast-string-truncated-width/-/fast-string-truncated-width-1.2.1.tgz#179d1ebab3b15b62893bbeaa8cefc728a649e761"
+  integrity sha512-Q9acT/+Uu3GwGj+5w/zsGuQjh9O1TyywhIwAxHudtWrgF09nHOPrvTLhQevPbttcxjr/SNN7mJmfOw/B1bXgow==
+
+fast-string-width@^1.1.0:
+  version "1.1.0"
+  resolved "https://registry.yarnpkg.com/fast-string-width/-/fast-string-width-1.1.0.tgz#8122fe1c4699474cb30c84e4419359e2d90c156a"
+  integrity sha512-O3fwIVIH5gKB38QNbdg+3760ZmGz0SZMgvwJbA1b2TGXceKE6A2cOlfogh1iw8lr049zPyd7YADHy+B7U4W9bQ==
+  dependencies:
+    fast-string-truncated-width "^1.2.0"
+
 fast-uri@^3.0.1:
   version "3.1.0"
   resolved "https://registry.yarnpkg.com/fast-uri/-/fast-uri-3.1.0.tgz#66eecff6c764c0df9b762e62ca7edcfb53b4edfa"
   integrity sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA==
 
+fast-wrap-ansi@^0.1.3:
+  version "0.1.6"
+  resolved "https://registry.yarnpkg.com/fast-wrap-ansi/-/fast-wrap-ansi-0.1.6.tgz#a2eb1b177ac05062d5ee2e7af7ec2813bd5c20cf"
+  integrity sha512-HlUwET7a5gqjURj70D5jl7aC3Zmy4weA1SHUfM0JFI0Ptq987NH2TwbBFLoERhfwk+E+eaq4EK3jXoT+R3yp3w==
+  dependencies:
+    fast-string-width "^1.1.0"
+
 fastq@^1.6.0:
   version "1.20.1"
   resolved "https://registry.yarnpkg.com/fastq/-/fastq-1.20.1.tgz#ca750a10dc925bc8b18839fd203e3ef4b3ced675"
@@ -4920,6 +5171,11 @@ giget@^3.1.2:
   resolved "https://registry.yarnpkg.com/giget/-/giget-3.1.2.tgz#6fa9841b6220b1d178f09c64da0661f6da801508"
   integrity sha512-T2qUpKBHeUTwHcIhydgnJzhL0Hj785ms+JkxaaWQH9SDM/llXeewnOkfJcFShAHjWI+26hOChwUfCoupaXLm8g==
 
+giget@^3.2.0:
+  version "3.2.0"
+  resolved "https://registry.yarnpkg.com/giget/-/giget-3.2.0.tgz#bacfdd1264f81485a915928b0ae219be0e81a7c9"
+  integrity sha512-GvHTWcykIR/fP8cj8dMpuMMkvaeJfPvYnhq0oW+chSeIr+ldX21ifU2Ms6KBoyKZQZmVaUAAhQ2EZ68KJF8a7A==
+
 glob-parent@^5.1.2, glob-parent@~5.1.2:
   version "5.1.2"
   resolved "https://registry.yarnpkg.com/glob-parent/-/glob-parent-5.1.2.tgz#869832c58034fe68a4093c17dc15e8340d8401c4"
@@ -4927,7 +5183,7 @@ glob-parent@^5.1.2, glob-parent@~5.1.2:
   dependencies:
     is-glob "^4.0.1"
 
-glob@^10.0.0:
+glob@^10.0.0, glob@^10.4.2:
   version "10.5.0"
   resolved "https://registry.yarnpkg.com/glob/-/glob-10.5.0.tgz#8ec0355919cd3338c28428a23d4f24ecc5fe738c"
   integrity sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==
@@ -5016,6 +5272,14 @@ gzip-size@^7.0.0:
   dependencies:
     duplexer "^0.1.2"
 
+"h3-next@npm:h3@2.0.1-rc.20":
+  version "2.0.1-rc.20"
+  resolved "https://registry.yarnpkg.com/h3/-/h3-2.0.1-rc.20.tgz#51050db30afb0b6e69718d88cccc23666fbe8039"
+  integrity sha512-28ljodXuUp0fZovdiSRq4G9OgrxCztrJe5VdYzXAB7ueRvI7pIUqLU14Xi3XqdYJ/khXjfpUOOD2EQa6CmBgsg==
+  dependencies:
+    rou3 "^0.8.1"
+    srvx "^0.11.13"
+
 h3@^1.12.0, h3@^1.15.5, h3@^1.15.6, h3@^1.15.9:
   version "1.15.10"
   resolved "https://registry.yarnpkg.com/h3/-/h3-1.15.10.tgz#defe650df7b70cf585d2020c4146fb580cfb0d42"
@@ -5031,6 +5295,33 @@ h3@^1.12.0, h3@^1.15.5, h3@^1.15.6, h3@^1.15.9:
     ufo "^1.6.3"
     uncrypto "^0.1.3"
 
+h3@^1.15.11:
+  version "1.15.11"
+  resolved "https://registry.yarnpkg.com/h3/-/h3-1.15.11.tgz#831179fc6b4bc06de8ad1077e7a5c7d63b796577"
+  integrity sha512-L3THSe2MPeBwgIZVSH5zLdBBU90TOxarvhK9d04IDY2AmVS8j2Jz2LIWtwsGOU3lu2I5jCN7FNvVfY2+XyF+mg==
+  dependencies:
+    cookie-es "^1.2.3"
+    crossws "^0.3.5"
+    defu "^6.1.6"
+    destr "^2.0.5"
+    iron-webcrypto "^1.2.1"
+    node-mock-http "^1.0.4"
+    radix3 "^1.1.2"
+    ufo "^1.6.3"
+    uncrypto "^0.1.3"
+
+happy-dom@^20.8.9:
+  version "20.8.9"
+  resolved "https://registry.yarnpkg.com/happy-dom/-/happy-dom-20.8.9.tgz#aeacc9ab9aacada379bce0ba37b2f02dabbba286"
+  integrity sha512-Tz23LR9T9jOGVZm2x1EPdXqwA37G/owYMxRwU0E4miurAtFsPMQ1d2Jc2okUaSjZqAFz2oEn3FLXC5a0a+siyA==
+  dependencies:
+    "@types/node" ">=20.0.0"
+    "@types/whatwg-mimetype" "^3.0.2"
+    "@types/ws" "^8.18.1"
+    entities "^7.0.1"
+    whatwg-mimetype "^3.0.0"
+    ws "^8.18.3"
+
 has-bigints@^1.0.2:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/has-bigints/-/has-bigints-1.1.0.tgz#28607e965ac967e03cd2a2c70a2636a1edad49fe"
@@ -5215,6 +5506,11 @@ ini@4.1.1:
   resolved "https://registry.yarnpkg.com/ini/-/ini-4.1.1.tgz#d95b3d843b1e906e56d6747d5447904ff50ce7a1"
   integrity sha512-QQnnxNyfvmHFIsj7gkPcYymR8Jdw/o7mp5ZFihxn6h8Ci6fh3Dx4E1gPjpQEpIuPo9XVNY/ZUwh4BPMjGyL01g==
 
+ini@^1.3.4:
+  version "1.3.8"
+  resolved "https://registry.yarnpkg.com/ini/-/ini-1.3.8.tgz#a29da425b48806f34767a4efce397269af28432c"
+  integrity sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew==
+
 ini@^4.1.1:
   version "4.1.3"
   resolved "https://registry.yarnpkg.com/ini/-/ini-4.1.3.tgz#4c359675a6071a46985eb39b14e4a2c0ec98a795"
@@ -5630,6 +5926,22 @@ jiti@^2.1.2, jiti@^2.4.2, jiti@^2.6.0, jiti@^2.6.1:
   resolved "https://registry.yarnpkg.com/jiti/-/jiti-2.6.1.tgz#178ef2fc9a1a594248c20627cd820187a4d78d92"
   integrity sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==
 
+js-beautify@^1.14.9:
+  version "1.15.4"
+  resolved "https://registry.yarnpkg.com/js-beautify/-/js-beautify-1.15.4.tgz#f579f977ed4c930cef73af8f98f3f0a608acd51e"
+  integrity sha512-9/KXeZUKKJwqCXUdBxFJ3vPh467OCckSBmYDwSK/EtV090K+iMJ7zx2S3HLVDIWFQdqMIsZWbnaGiba18aWhaA==
+  dependencies:
+    config-chain "^1.1.13"
+    editorconfig "^1.0.4"
+    glob "^10.4.2"
+    js-cookie "^3.0.5"
+    nopt "^7.2.1"
+
+js-cookie@^3.0.5:
+  version "3.0.5"
+  resolved "https://registry.yarnpkg.com/js-cookie/-/js-cookie-3.0.5.tgz#0b7e2fd0c01552c58ba86e0841f94dc2557dcdbc"
+  integrity sha512-cEiJEAEoIbWfCZYKWhVwFuvPX1gETRYPw6LlaTKoxD3s2AkXzkCjnp6h0V77ozyqj0jakteJ4YqDJT830+lVGw==
+
 js-tokens@^4.0.0:
   version "4.0.0"
   resolved "https://registry.yarnpkg.com/js-tokens/-/js-tokens-4.0.0.tgz#19203fb59991df98e3a287050d4647cdeaf32499"
@@ -6108,7 +6420,7 @@ minimatch@^5.0.1, minimatch@^5.1.0:
   dependencies:
     brace-expansion "^2.0.1"
 
-minimatch@^9.0.3, minimatch@^9.0.4:
+minimatch@^9.0.1, minimatch@^9.0.3, minimatch@^9.0.4:
   version "9.0.9"
   resolved "https://registry.yarnpkg.com/minimatch/-/minimatch-9.0.9.tgz#9b0cb9fcb78087f6fd7eababe2511c4d3d60574e"
   integrity sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==
@@ -6366,6 +6678,13 @@ node-releases@^2.0.27:
   resolved "https://registry.yarnpkg.com/node-releases/-/node-releases-2.0.36.tgz#99fd6552aaeda9e17c4713b57a63964a2e325e9d"
   integrity sha512-TdC8FSgHz8Mwtw9g5L4gR/Sh9XhSP/0DEkQxfEFXOpiul5IiHgHan2VhYYb6agDSfp4KuvltmGApc8HMgUrIkA==
 
+nopt@^7.2.1:
+  version "7.2.1"
+  resolved "https://registry.yarnpkg.com/nopt/-/nopt-7.2.1.tgz#1cac0eab9b8e97c9093338446eddd40b2c8ca1e7"
+  integrity sha512-taM24ViiimT/XntxbPyJQzCG+p4EKOpgD3mxFwW38mGjVUrfERQOeY4EDHjdnptttfHuHQXFx+lTP08Q+mLa/w==
+  dependencies:
+    abbrev "^2.0.0"
+
 nopt@^8.0.0:
   version "8.1.0"
   resolved "https://registry.yarnpkg.com/nopt/-/nopt-8.1.0.tgz#b11d38caf0f8643ce885818518064127f602eae3"
@@ -7137,6 +7456,11 @@ prompts@^2.4.2:
     kleur "^3.0.3"
     sisteransi "^1.0.5"
 
+proto-list@~1.2.1:
+  version "1.2.4"
+  resolved "https://registry.yarnpkg.com/proto-list/-/proto-list-1.2.4.tgz#212d5bfe1318306a420f6402b8e26ff39647a849"
+  integrity sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==
+
 proxy-agent@^6.3.0:
   version "6.5.0"
   resolved "https://registry.yarnpkg.com/proxy-agent/-/proxy-agent-6.5.0.tgz#9e49acba8e4ee234aacb539f89ed9c23d02f232d"
@@ -7219,6 +7543,14 @@ rc9@^3.0.0:
     defu "^6.1.4"
     destr "^2.0.5"
 
+rc9@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/rc9/-/rc9-3.0.1.tgz#3895e5834a2b5c2d8fb76d93e802fbcbc2579bc7"
+  integrity sha512-gMDyleLWVE+i6Sgtc0QbbY6pEKqYs97NGi6isHQPqYlLemPoO8dxQ3uGi0f4NiP98c+jMW6cG1Kx9dDwfvqARQ==
+  dependencies:
+    defu "^6.1.6"
+    destr "^2.0.5"
+
 read-cmd-shim@^6.0.0:
   version "6.0.0"
   resolved "https://registry.yarnpkg.com/read-cmd-shim/-/read-cmd-shim-6.0.0.tgz#98f5c8566e535829f1f8afb1595aaf05fd0f3970"
@@ -8008,6 +8340,11 @@ split2@^4.2.0:
   resolved "https://registry.yarnpkg.com/split2/-/split2-4.2.0.tgz#c9c5920904d148bab0b9f67145f245a86aadbfa4"
   integrity sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg==
 
+srvx@^0.11.13:
+  version "0.11.15"
+  resolved "https://registry.yarnpkg.com/srvx/-/srvx-0.11.15.tgz#51c08f993bb116f5821ec929a466a29e8d5c7b61"
+  integrity sha512-iXsux0UcOjdvs0LCMa2Ws3WwcDUozA3JN3BquNXkaFPP7TpRqgunKdEgoZ/uwb1J6xaYHfxtz9Twlh6yzwM6Tg==
+
 srvx@^0.11.9:
   version "0.11.13"
   resolved "https://registry.yarnpkg.com/srvx/-/srvx-0.11.13.tgz#cc77a98cb9a459c34f75ee4345bd0eef9f613a54"
@@ -8429,6 +8766,11 @@ tinyexec@^1.0.2:
   resolved "https://registry.yarnpkg.com/tinyexec/-/tinyexec-1.0.4.tgz#6c60864fe1d01331b2f17c6890f535d7e5385408"
   integrity sha512-u9r3uZC0bdpGOXtlxUIdwf9pkmvhqJdrVCH9fapQtgy/OeTTMZ1nqH7agtvEfmGui6e1XxjcdrlxvxJvc3sMqw==
 
+tinyexec@^1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/tinyexec/-/tinyexec-1.1.1.tgz#e1ff45dfa60d1dedb91b734956b78f6c2a3e821b"
+  integrity sha512-VKS/ZaQhhkKFMANmAOhhXVoIfBXblQxGX1myCQ2faQrfmobMftXeJPcZGp0gS07ocvGJWDLZGyOZDadDBqYIJg==
+
 tinyglobby@^0.2.10, tinyglobby@^0.2.12, tinyglobby@^0.2.15:
   version "0.2.15"
   resolved "https://registry.yarnpkg.com/tinyglobby/-/tinyglobby-0.2.15.tgz#e228dd1e638cea993d2fdb4fcd2d4602a79951c2"
@@ -8607,6 +8949,11 @@ undici-types@~7.18.0:
   resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-7.18.2.tgz#29357a89e7b7ca4aef3bf0fd3fd0cd73884229e9"
   integrity sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==
 
+undici-types@~7.19.0:
+  version "7.19.2"
+  resolved "https://registry.yarnpkg.com/undici-types/-/undici-types-7.19.2.tgz#1b67fc26d0f157a0cba3a58a5b5c1e2276b8ba2a"
+  integrity sha512-qYVnV5OEm2AW8cJMCpdV20CDyaN3g0AjDlOGf1OW4iaDEx8MwdtChUp4zu4H0VP3nDRF/8RKWH+IPp9uW0YGZg==
+
 unenv@^2.0.0-rc.24:
   version "2.0.0-rc.24"
   resolved "https://registry.yarnpkg.com/unenv/-/unenv-2.0.0-rc.24.tgz#dd0035c3e93fedfa12c8454e34b7f17fe83efa2e"
@@ -8944,6 +9291,13 @@ vite@^7.3.1:
   optionalDependencies:
     fsevents "~2.3.3"
 
+vitest-environment-nuxt@2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/vitest-environment-nuxt/-/vitest-environment-nuxt-2.0.0.tgz#b8b62390e1c38b0dcc341c42228a77cf5bd34d88"
+  integrity sha512-zEGFRiCAaRR3fHnqISHKMNTRvCzkQEI1XyFeqNgR2IBD0oYkfZ1rUHwi7C+h3Cns3KPykfB0av1B3MtLEbChDw==
+  dependencies:
+    "@nuxt/test-utils" "^4.0.0"
+
 vitest@^4.1.0:
   version "4.1.1"
   resolved "https://registry.yarnpkg.com/vitest/-/vitest-4.1.1.tgz#04700de9cb16898640ebfb4613abecfa83fac4fc"
@@ -8982,6 +9336,11 @@ vue-bundle-renderer@^2.2.0:
   dependencies:
     ufo "^1.6.1"
 
+vue-component-type-helpers@^2.0.0:
+  version "2.2.12"
+  resolved "https://registry.yarnpkg.com/vue-component-type-helpers/-/vue-component-type-helpers-2.2.12.tgz#5014787aad185a22f460ad469cc51f14524308bc"
+  integrity sha512-YbGqHZ5/eW4SnkPNR44mKVc6ZKQoRs/Rux1sxC6rdwXb4qpbOSYfDr9DsTHolOTGmIKgM9j141mZbBeg05R1pw==
+
 vue-devtools-stub@^0.1.0:
   version "0.1.0"
   resolved "https://registry.yarnpkg.com/vue-devtools-stub/-/vue-devtools-stub-0.1.0.tgz#a65b9485edecd4273cedcb8102c739b83add2c81"
@@ -9029,6 +9388,17 @@ vue@^3.5.30:
     "@vue/server-renderer" "3.5.31"
     "@vue/shared" "3.5.31"
 
+vue@^3.5.32:
+  version "3.5.32"
+  resolved "https://registry.yarnpkg.com/vue/-/vue-3.5.32.tgz#9a7cbeb181aa4b2a71c3ebac4995542cf0353de3"
+  integrity sha512-vM4z4Q9tTafVfMAK7IVzmxg34rSzTFMyIe0UUEijUCkn9+23lj0WRfA83dg7eQZIUlgOSGrkViIaCfqSAUXsMw==
+  dependencies:
+    "@vue/compiler-dom" "3.5.32"
+    "@vue/compiler-sfc" "3.5.32"
+    "@vue/runtime-dom" "3.5.32"
+    "@vue/server-renderer" "3.5.32"
+    "@vue/shared" "3.5.32"
+
 web-streams-polyfill@^3.0.3:
   version "3.3.3"
   resolved "https://registry.yarnpkg.com/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz#2073b91a2fdb1fbfbd401e7de0ac9f8214cecb4b"
@@ -9049,6 +9419,11 @@ webpack-virtual-modules@^0.6.2:
   resolved "https://registry.yarnpkg.com/webpack-virtual-modules/-/webpack-virtual-modules-0.6.2.tgz#057faa9065c8acf48f24cb57ac0e77739ab9a7e8"
   integrity sha512-66/V2i5hQanC51vBQKPH4aI8NMAcBW59FVBs+rC7eGHupMyfn34q7rZIE+ETlJ+XTevqfUhVVBgSUNSW2flEUQ==
 
+whatwg-mimetype@^3.0.0:
+  version "3.0.0"
+  resolved "https://registry.yarnpkg.com/whatwg-mimetype/-/whatwg-mimetype-3.0.0.tgz#5fa1a7623867ff1af6ca3dc72ad6b8a4208beba7"
+  integrity sha512-nt+N2dzIutVRxARx1nghPKGv1xHikU7HKdfafKkLNLindmPU/ch3U31NOCGGA/dmPcmb1VlofO0vnKAcsm0o/Q==
+
 whatwg-url@^5.0.0:
   version "5.0.0"
   resolved "https://registry.yarnpkg.com/whatwg-url/-/whatwg-url-5.0.0.tgz#966454e8765462e37644d3626f6742ce8b70965d"
@@ -9364,7 +9739,7 @@ write-file-atomic@^7.0.0:
   dependencies:
     signal-exit "^4.0.1"
 
-ws@^8.18.2, ws@^8.19.0:
+ws@^8.18.2, ws@^8.18.3, ws@^8.19.0:
   version "8.20.0"
   resolved "https://registry.yarnpkg.com/ws/-/ws-8.20.0.tgz#4cd9532358eba60bc863aad1623dfb045a4d4af8"
   integrity sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA==